e5fba4935007b0c55025b8fb2b70d325d69b52bad874081678d4b9e5ac3aa809

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03/08/2024, 00:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Badlion Client.exe
Size

134.1MB
MD5

d409118ee6393a7fb2837136d3a91452
SHA1

97f9c3bb965696f282d391f72ac8f8d03d969f38
SHA256

7e68928814344eb199b4d13f05d0ab244e22c2c066716cd12822c611f261c2e2
SHA512

691f703f6936dc36cf3e8353bf0b1f7bbf92b94d6fa3838493fdc53e5441ce8a75d9d1ea6fc5d6a895961cb0da682a0471ef42cfe74d54dfa8b216fffd2e08b5
SSDEEP

1572864:DyhU9i4Qmh8AxfjKhRh+10tb8lc6i/R60t:SEjV0D/w0t

Score

8^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\Drivers\etc\hosts	Badlion Client.exe
File opened for modification	C:\Windows\System32\Drivers\etc\hosts	Badlion Client.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Badlion Client = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Badlion Client\\Badlion Client.exe\""	Badlion Client.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
7808	powershell.exe

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	Badlion Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	Badlion Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	Badlion Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	Badlion Client.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Executes dropped EXE 4 IoCs

pid	Process
7516	Badlion Client Setup 4.3.2.exe
7052	Badlion Client.exe
8000	Badlion Client.exe
3768	Badlion Client.exe

Loads dropped DLL 17 IoCs

pid	Process
7516	Badlion Client Setup 4.3.2.exe
7516	Badlion Client Setup 4.3.2.exe
7516	Badlion Client Setup 4.3.2.exe
7516	Badlion Client Setup 4.3.2.exe
7516	Badlion Client Setup 4.3.2.exe
7516	Badlion Client Setup 4.3.2.exe
7516	Badlion Client Setup 4.3.2.exe
7516	Badlion Client Setup 4.3.2.exe
7516	Badlion Client Setup 4.3.2.exe
7052	Badlion Client.exe
7052	Badlion Client.exe
8000	Badlion Client.exe
3768	Badlion Client.exe
8000	Badlion Client.exe
8000	Badlion Client.exe
8000	Badlion Client.exe
8000	Badlion Client.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Badlion Client Setup 4.3.2.exe

Modifies registry class 24 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\discord-418076578333851669\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Badlion Client.exe"	Badlion Client.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\badlion\shell\open	Badlion Client.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4182098368-2521458979-3782681353-1000\{EADFBD9C-AA94-4CDD-99A9-751E6BF43FCD}	Badlion Client.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\discord-418076578333851669\shell\open\command	Badlion Client.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\discord-418076578333851669	Badlion Client.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\discord-418076578333851669\ = "URL:Run game 418076578333851669 protocol"	Badlion Client.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\discord-418076578333851669\URL Protocol	Badlion Client.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\badlion	Badlion Client.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\discord-418076578333851669\URL Protocol	Badlion Client.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\discord-418076578333851669\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Programs\\Badlion Client\\Badlion Client.exe"	Badlion Client.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\discord-418076578333851669\DefaultIcon	Badlion Client.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\discord-418076578333851669\shell	Badlion Client.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\discord-418076578333851669\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Badlion Client.exe"	Badlion Client.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\badlion\ = "URL:badlion"	Badlion Client.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\discord-418076578333851669	Badlion Client.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\badlion\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Badlion Client.exe\" \"%1\""	Badlion Client.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\discord-418076578333851669\ = "URL:Run game 418076578333851669 protocol"	Badlion Client.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\discord-418076578333851669\DefaultIcon	Badlion Client.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\discord-418076578333851669\shell\open\command	Badlion Client.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\discord-418076578333851669\shell\open	Badlion Client.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\badlion\URL Protocol	Badlion Client.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\badlion\shell\open\command	Badlion Client.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\badlion\shell	Badlion Client.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\discord-418076578333851669\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Programs\\Badlion Client\\Badlion Client.exe"	Badlion Client.exe

Modifies system certificate store 2 TTPs 16 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 040000000100000010000000c5dfb849ca051355ee2dba1ac33eb0280f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b1400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba953030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad190000000100000010000000d0fd3c9c380d7b65e26b9a3fedd39b8f2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f	Badlion Client.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 5c000000010000000400000000080000190000000100000010000000a823b4a20180beb460cab955c24d7e21030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c7e00000001000000080000000000042beb77d5017a000000010000000c000000300a06082b060105050703097f000000010000000c000000300a06082b060105050703091d00000001000000100000006ee7f3b060d10e90a31ba3471b999236140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b620000000100000020000000ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c990b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520031000000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000068000000306606082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050508020206082b0601050507030606082b0601050507030706082b0601050507030906082b0601050507030106082b060105050703080f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d0400000001000000100000003e455215095192e1b75d379fb187298a200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	Badlion Client.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD	Badlion Client.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 0f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b1400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba953030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f	Badlion Client.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1\Blob = 5c000000010000000400000000100000190000000100000010000000cb9dd0fceaaa492f75ce292c21bbfbdd0f0000000100000030000000ea09c51d4c3a334ce4acd2bc08c6a9be352e334f45c4fccfcab63edb9f82dc87d4bd2ed2fadae11163fb954809984ff153000000010000007e000000307c301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301f06092b06010401a032010230123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000056000000305406082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030906082b0601050507030106082b060105050703080b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d0020005200360000006200000001000000200000002cabeafe37d06ca22aba7391c0033d25982952c453647349763a3ab5ad6ccf697f0000000100000016000000301406082b0601050507030306082b06010505070309140000000100000014000000ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a01d0000000100000010000000521f5c98970d19a8e515ef6eeb6d48ef7a000000010000000c000000300a06082b060105050703097e00000001000000080000000080c82b6886d7010300000001000000140000008094640eb5a7a1ca119c1fddd59f810263a7fbd10400000001000000100000004fdd07e4d42264391e0c3742ead1c6ae200000000100000087050000308205833082036ba003020102020e45e6bb038333c3856548e6ff4551300d06092a864886f70d01010c0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3134313231303030303030305a170d3334313231303030303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820222300d06092a864886f70d01010105000382020f003082020a02820201009507e873ca66f9ec14ca7b3cf70d08f1b4450b2c82b448c6eb5b3cae83b841923314a46f7fe92accc6b0886bc5b689d1c6b2ff14ce511421ec4add1b5ac6d687ee4d3a1506ed64660b9280ca44de73944ef3a7897f4f786308c812506d42662f4db979284d521a8a1a80b719810e7ec48abc644c211c4368d73d3c8ac5b266d5909ab73106c5bee26d3206a61ef9b9ebaaa3b8bfbe826350d0f01889dfe40f79f5eaa21f2ad2702e7be7bc93bb6d53e2487c8c100738ff66b277617ee0ea8c3caab4a4f6f3954a12076dfd8cb289cfd0a06177c85874b0d4233af75d3acaa2db9d09de5d442d90f181cd5792fa7ebc50046334df6b9318be6b36b239e4ac2436b7f0efb61c135793b6deb2f8e285b773a2b835aa45f2e09d36a16f548af172566e2e88c55142441594eea3c538969b4e4e5a0b47f30636497730bc7137e5a6ec210875fce661163f77d5d99197840a6cd4024d74c014edfd39fb83f25e14a104b00be9feee8fe16e0bb208b36166096ab1063a659659c0f035fdc9da288d1a118770810aa89a751d9e3a8605009edb80d625f9dc059e27594c76395beaf9a5a1d8830fd1ffdf3011f985cf3348f5ca6d64142c7a584fd34b0849c595641a630e793df5b38cca58ad9c4245796e0e87195c54b165b6bf8c9bdc13e90d6fb82edc676ec98b11b584148a0019708379919791d41a27bf371e3207d814633c284caf0203010001a3633061300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0301f0603551d23041830168014ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0300d06092a864886f70d01010c050003820201008325ede8d1fd9552cd9ec004a09169e65cd084dedcada24fe84778d66598a95ba83c877c028ad16eb71673e65fc05498d574bec1cde21191ad23183ddde1724496b4955ec07b8e99781643135657b3a2b33bb577dc4072aca3eb9b353eb10821a1e7c443377932beb5e79c2c4cbc4329998e30d3ac21e0e31dfad80733765400222ab94d202e7068dae553fc835cd39df2ff440c4466f2d2e3bd46001a6d02ba255d8da13151dd54461c4ddb9996ef1a1c045ca615ef78e079fe5ddb3eaa4c55fd9a15a96fe1a6fbdf7030e9c3ee4246edc2930589fa7d637b3fd071817c00e898ae0e7834c325fbaf0a9f206bdd3b138f128ce2411a487a73a07769c7b65c7f82c81efe581b282ba86cad5e6dc005d27bb7eb80fe2537fe029b68ac425dc3eef5ccdcf05075d236699ce67b04df6e0669b6de0a09485987eb7b14607a64aa6943ef91c74cec18dd6cef532d8c99e15ef2723ecf54c8bd67eca40f4c45ffd3b93023074c8f10bf8696d9995ab499571ca4ccbb158953ba2c050fe4c49e19b11834d54c9dbaedf71faf24950478a803bbee81e5da5f7c8b4aa1907425a7b33e4bc82c56bdc7c8ef38e25c92f079f79c84ba742d6101207e7ed1f24f07595f8b2d4352eb460c94e1f566477977d5545b1fad2437cb455a4ea04448c8d8b099c5158409f6d64949c065b8e61a716ea0a8f182e8453e6cd602d70a6783055ac9a410	Badlion Client.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A	Badlion Client.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 0f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703016200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb658140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a2000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	Badlion Client.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1	Badlion Client.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1\Blob = 0f0000000100000030000000ea09c51d4c3a334ce4acd2bc08c6a9be352e334f45c4fccfcab63edb9f82dc87d4bd2ed2fadae11163fb954809984ff153000000010000007e000000307c301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301f06092b06010401a032010230123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000056000000305406082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030906082b0601050507030106082b060105050703080b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d0020005200360000006200000001000000200000002cabeafe37d06ca22aba7391c0033d25982952c453647349763a3ab5ad6ccf697f0000000100000016000000301406082b0601050507030306082b06010505070309140000000100000014000000ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a01d0000000100000010000000521f5c98970d19a8e515ef6eeb6d48ef7a000000010000000c000000300a06082b060105050703097e00000001000000080000000080c82b6886d7010300000001000000140000008094640eb5a7a1ca119c1fddd59f810263a7fbd1200000000100000087050000308205833082036ba003020102020e45e6bb038333c3856548e6ff4551300d06092a864886f70d01010c0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3134313231303030303030305a170d3334313231303030303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820222300d06092a864886f70d01010105000382020f003082020a02820201009507e873ca66f9ec14ca7b3cf70d08f1b4450b2c82b448c6eb5b3cae83b841923314a46f7fe92accc6b0886bc5b689d1c6b2ff14ce511421ec4add1b5ac6d687ee4d3a1506ed64660b9280ca44de73944ef3a7897f4f786308c812506d42662f4db979284d521a8a1a80b719810e7ec48abc644c211c4368d73d3c8ac5b266d5909ab73106c5bee26d3206a61ef9b9ebaaa3b8bfbe826350d0f01889dfe40f79f5eaa21f2ad2702e7be7bc93bb6d53e2487c8c100738ff66b277617ee0ea8c3caab4a4f6f3954a12076dfd8cb289cfd0a06177c85874b0d4233af75d3acaa2db9d09de5d442d90f181cd5792fa7ebc50046334df6b9318be6b36b239e4ac2436b7f0efb61c135793b6deb2f8e285b773a2b835aa45f2e09d36a16f548af172566e2e88c55142441594eea3c538969b4e4e5a0b47f30636497730bc7137e5a6ec210875fce661163f77d5d99197840a6cd4024d74c014edfd39fb83f25e14a104b00be9feee8fe16e0bb208b36166096ab1063a659659c0f035fdc9da288d1a118770810aa89a751d9e3a8605009edb80d625f9dc059e27594c76395beaf9a5a1d8830fd1ffdf3011f985cf3348f5ca6d64142c7a584fd34b0849c595641a630e793df5b38cca58ad9c4245796e0e87195c54b165b6bf8c9bdc13e90d6fb82edc676ec98b11b584148a0019708379919791d41a27bf371e3207d814633c284caf0203010001a3633061300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0301f0603551d23041830168014ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0300d06092a864886f70d01010c050003820201008325ede8d1fd9552cd9ec004a09169e65cd084dedcada24fe84778d66598a95ba83c877c028ad16eb71673e65fc05498d574bec1cde21191ad23183ddde1724496b4955ec07b8e99781643135657b3a2b33bb577dc4072aca3eb9b353eb10821a1e7c443377932beb5e79c2c4cbc4329998e30d3ac21e0e31dfad80733765400222ab94d202e7068dae553fc835cd39df2ff440c4466f2d2e3bd46001a6d02ba255d8da13151dd54461c4ddb9996ef1a1c045ca615ef78e079fe5ddb3eaa4c55fd9a15a96fe1a6fbdf7030e9c3ee4246edc2930589fa7d637b3fd071817c00e898ae0e7834c325fbaf0a9f206bdd3b138f128ce2411a487a73a07769c7b65c7f82c81efe581b282ba86cad5e6dc005d27bb7eb80fe2537fe029b68ac425dc3eef5ccdcf05075d236699ce67b04df6e0669b6de0a09485987eb7b14607a64aa6943ef91c74cec18dd6cef532d8c99e15ef2723ecf54c8bd67eca40f4c45ffd3b93023074c8f10bf8696d9995ab499571ca4ccbb158953ba2c050fe4c49e19b11834d54c9dbaedf71faf24950478a803bbee81e5da5f7c8b4aa1907425a7b33e4bc82c56bdc7c8ef38e25c92f079f79c84ba742d6101207e7ed1f24f07595f8b2d4352eb460c94e1f566477977d5545b1fad2437cb455a4ea04448c8d8b099c5158409f6d64949c065b8e61a716ea0a8f182e8453e6cd602d70a6783055ac9a410	Badlion Client.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 5c000000010000000400000000080000190000000100000010000000d0fd3c9c380d7b65e26b9a3fedd39b8f030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba9531400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b0b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab040000000100000010000000c5dfb849ca051355ee2dba1ac33eb0282000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f	Badlion Client.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0400000001000000100000003e455215095192e1b75d379fb187298a0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050508020206082b0601050507030606082b0601050507030706082b0601050507030906082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520031000000620000000100000020000000ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c99140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b9992367f000000010000000c000000300a06082b060105050703097a000000010000000c000000300a06082b060105050703097e00000001000000080000000000042beb77d501030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c190000000100000010000000a823b4a20180beb460cab955c24d7e21200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	Badlion Client.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 190000000100000010000000fd960962ac6938e0d4b0769aa1a64e26030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a1d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e76200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb65809000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030153000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6502000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	Badlion Client.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1\Blob = 190000000100000010000000cb9dd0fceaaa492f75ce292c21bbfbdd0f0000000100000030000000ea09c51d4c3a334ce4acd2bc08c6a9be352e334f45c4fccfcab63edb9f82dc87d4bd2ed2fadae11163fb954809984ff153000000010000007e000000307c301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301f06092b06010401a032010230123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000056000000305406082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030906082b0601050507030106082b060105050703080b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d0020005200360000006200000001000000200000002cabeafe37d06ca22aba7391c0033d25982952c453647349763a3ab5ad6ccf697f0000000100000016000000301406082b0601050507030306082b06010505070309140000000100000014000000ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a01d0000000100000010000000521f5c98970d19a8e515ef6eeb6d48ef7a000000010000000c000000300a06082b060105050703097e00000001000000080000000080c82b6886d7010300000001000000140000008094640eb5a7a1ca119c1fddd59f810263a7fbd1200000000100000087050000308205833082036ba003020102020e45e6bb038333c3856548e6ff4551300d06092a864886f70d01010c0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3134313231303030303030305a170d3334313231303030303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820222300d06092a864886f70d01010105000382020f003082020a02820201009507e873ca66f9ec14ca7b3cf70d08f1b4450b2c82b448c6eb5b3cae83b841923314a46f7fe92accc6b0886bc5b689d1c6b2ff14ce511421ec4add1b5ac6d687ee4d3a1506ed64660b9280ca44de73944ef3a7897f4f786308c812506d42662f4db979284d521a8a1a80b719810e7ec48abc644c211c4368d73d3c8ac5b266d5909ab73106c5bee26d3206a61ef9b9ebaaa3b8bfbe826350d0f01889dfe40f79f5eaa21f2ad2702e7be7bc93bb6d53e2487c8c100738ff66b277617ee0ea8c3caab4a4f6f3954a12076dfd8cb289cfd0a06177c85874b0d4233af75d3acaa2db9d09de5d442d90f181cd5792fa7ebc50046334df6b9318be6b36b239e4ac2436b7f0efb61c135793b6deb2f8e285b773a2b835aa45f2e09d36a16f548af172566e2e88c55142441594eea3c538969b4e4e5a0b47f30636497730bc7137e5a6ec210875fce661163f77d5d99197840a6cd4024d74c014edfd39fb83f25e14a104b00be9feee8fe16e0bb208b36166096ab1063a659659c0f035fdc9da288d1a118770810aa89a751d9e3a8605009edb80d625f9dc059e27594c76395beaf9a5a1d8830fd1ffdf3011f985cf3348f5ca6d64142c7a584fd34b0849c595641a630e793df5b38cca58ad9c4245796e0e87195c54b165b6bf8c9bdc13e90d6fb82edc676ec98b11b584148a0019708379919791d41a27bf371e3207d814633c284caf0203010001a3633061300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0301f0603551d23041830168014ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0300d06092a864886f70d01010c050003820201008325ede8d1fd9552cd9ec004a09169e65cd084dedcada24fe84778d66598a95ba83c877c028ad16eb71673e65fc05498d574bec1cde21191ad23183ddde1724496b4955ec07b8e99781643135657b3a2b33bb577dc4072aca3eb9b353eb10821a1e7c443377932beb5e79c2c4cbc4329998e30d3ac21e0e31dfad80733765400222ab94d202e7068dae553fc835cd39df2ff440c4466f2d2e3bd46001a6d02ba255d8da13151dd54461c4ddb9996ef1a1c045ca615ef78e079fe5ddb3eaa4c55fd9a15a96fe1a6fbdf7030e9c3ee4246edc2930589fa7d637b3fd071817c00e898ae0e7834c325fbaf0a9f206bdd3b138f128ce2411a487a73a07769c7b65c7f82c81efe581b282ba86cad5e6dc005d27bb7eb80fe2537fe029b68ac425dc3eef5ccdcf05075d236699ce67b04df6e0669b6de0a09485987eb7b14607a64aa6943ef91c74cec18dd6cef532d8c99e15ef2723ecf54c8bd67eca40f4c45ffd3b93023074c8f10bf8696d9995ab499571ca4ccbb158953ba2c050fe4c49e19b11834d54c9dbaedf71faf24950478a803bbee81e5da5f7c8b4aa1907425a7b33e4bc82c56bdc7c8ef38e25c92f079f79c84ba742d6101207e7ed1f24f07595f8b2d4352eb460c94e1f566477977d5545b1fad2437cb455a4ea04448c8d8b099c5158409f6d64949c065b8e61a716ea0a8f182e8453e6cd602d70a6783055ac9a410	Badlion Client.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 190000000100000010000000d0fd3c9c380d7b65e26b9a3fedd39b8f030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba9531400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b0b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f	Badlion Client.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1\Blob = 0400000001000000100000004fdd07e4d42264391e0c3742ead1c6ae0300000001000000140000008094640eb5a7a1ca119c1fddd59f810263a7fbd17e00000001000000080000000080c82b6886d7017a000000010000000c000000300a06082b060105050703091d0000000100000010000000521f5c98970d19a8e515ef6eeb6d48ef140000000100000014000000ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a07f0000000100000016000000301406082b0601050507030306082b060105050703096200000001000000200000002cabeafe37d06ca22aba7391c0033d25982952c453647349763a3ab5ad6ccf690b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520036000000090000000100000056000000305406082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030906082b0601050507030106082b0601050507030853000000010000007e000000307c301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301f06092b06010401a032010230123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000030000000ea09c51d4c3a334ce4acd2bc08c6a9be352e334f45c4fccfcab63edb9f82dc87d4bd2ed2fadae11163fb954809984ff1190000000100000010000000cb9dd0fceaaa492f75ce292c21bbfbdd200000000100000087050000308205833082036ba003020102020e45e6bb038333c3856548e6ff4551300d06092a864886f70d01010c0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3134313231303030303030305a170d3334313231303030303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820222300d06092a864886f70d01010105000382020f003082020a02820201009507e873ca66f9ec14ca7b3cf70d08f1b4450b2c82b448c6eb5b3cae83b841923314a46f7fe92accc6b0886bc5b689d1c6b2ff14ce511421ec4add1b5ac6d687ee4d3a1506ed64660b9280ca44de73944ef3a7897f4f786308c812506d42662f4db979284d521a8a1a80b719810e7ec48abc644c211c4368d73d3c8ac5b266d5909ab73106c5bee26d3206a61ef9b9ebaaa3b8bfbe826350d0f01889dfe40f79f5eaa21f2ad2702e7be7bc93bb6d53e2487c8c100738ff66b277617ee0ea8c3caab4a4f6f3954a12076dfd8cb289cfd0a06177c85874b0d4233af75d3acaa2db9d09de5d442d90f181cd5792fa7ebc50046334df6b9318be6b36b239e4ac2436b7f0efb61c135793b6deb2f8e285b773a2b835aa45f2e09d36a16f548af172566e2e88c55142441594eea3c538969b4e4e5a0b47f30636497730bc7137e5a6ec210875fce661163f77d5d99197840a6cd4024d74c014edfd39fb83f25e14a104b00be9feee8fe16e0bb208b36166096ab1063a659659c0f035fdc9da288d1a118770810aa89a751d9e3a8605009edb80d625f9dc059e27594c76395beaf9a5a1d8830fd1ffdf3011f985cf3348f5ca6d64142c7a584fd34b0849c595641a630e793df5b38cca58ad9c4245796e0e87195c54b165b6bf8c9bdc13e90d6fb82edc676ec98b11b584148a0019708379919791d41a27bf371e3207d814633c284caf0203010001a3633061300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0301f0603551d23041830168014ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0300d06092a864886f70d01010c050003820201008325ede8d1fd9552cd9ec004a09169e65cd084dedcada24fe84778d66598a95ba83c877c028ad16eb71673e65fc05498d574bec1cde21191ad23183ddde1724496b4955ec07b8e99781643135657b3a2b33bb577dc4072aca3eb9b353eb10821a1e7c443377932beb5e79c2c4cbc4329998e30d3ac21e0e31dfad80733765400222ab94d202e7068dae553fc835cd39df2ff440c4466f2d2e3bd46001a6d02ba255d8da13151dd54461c4ddb9996ef1a1c045ca615ef78e079fe5ddb3eaa4c55fd9a15a96fe1a6fbdf7030e9c3ee4246edc2930589fa7d637b3fd071817c00e898ae0e7834c325fbaf0a9f206bdd3b138f128ce2411a487a73a07769c7b65c7f82c81efe581b282ba86cad5e6dc005d27bb7eb80fe2537fe029b68ac425dc3eef5ccdcf05075d236699ce67b04df6e0669b6de0a09485987eb7b14607a64aa6943ef91c74cec18dd6cef532d8c99e15ef2723ecf54c8bd67eca40f4c45ffd3b93023074c8f10bf8696d9995ab499571ca4ccbb158953ba2c050fe4c49e19b11834d54c9dbaedf71faf24950478a803bbee81e5da5f7c8b4aa1907425a7b33e4bc82c56bdc7c8ef38e25c92f079f79c84ba742d6101207e7ed1f24f07595f8b2d4352eb460c94e1f566477977d5545b1fad2437cb455a4ea04448c8d8b099c5158409f6d64949c065b8e61a716ea0a8f182e8453e6cd602d70a6783055ac9a410	Badlion Client.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C	Badlion Client.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
3544	Badlion Client.exe
3544	Badlion Client.exe
3544	Badlion Client.exe
3544	Badlion Client.exe
3544	Badlion Client.exe
3544	Badlion Client.exe
3544	Badlion Client.exe
3544	Badlion Client.exe
1744	Badlion Client.exe
1744	Badlion Client.exe
1868	Badlion Client.exe
1868	Badlion Client.exe
5056	Badlion Client.exe
5056	Badlion Client.exe
3884	Badlion Client.exe
3884	Badlion Client.exe
5056	Badlion Client.exe
5056	Badlion Client.exe
5056	Badlion Client.exe
5056	Badlion Client.exe
3884	Badlion Client.exe
3884	Badlion Client.exe
3884	Badlion Client.exe
3884	Badlion Client.exe
3544	Badlion Client.exe
3544	Badlion Client.exe
7808	powershell.exe
7808	powershell.exe
7516	Badlion Client Setup 4.3.2.exe
7516	Badlion Client Setup 4.3.2.exe
7052	Badlion Client.exe
7052	Badlion Client.exe
7052	Badlion Client.exe
7052	Badlion Client.exe
7052	Badlion Client.exe
7052	Badlion Client.exe
7052	Badlion Client.exe
7052	Badlion Client.exe
7644	Badlion Client.exe
7644	Badlion Client.exe
7644	Badlion Client.exe
7644	Badlion Client.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3544	Badlion Client.exe
Token: SeDebugPrivilege	7808	powershell.exe
Token: SeSecurityPrivilege	7516	Badlion Client Setup 4.3.2.exe
Token: SeShutdownPrivilege	7052	Badlion Client.exe

Suspicious use of WriteProcessMemory 59 IoCs

description	pid	Process	procid_target
PID 3544 wrote to memory of 1744	3544	Badlion Client.exe	82
PID 3544 wrote to memory of 1744	3544	Badlion Client.exe	82
PID 3544 wrote to memory of 1868	3544	Badlion Client.exe	83
PID 3544 wrote to memory of 1868	3544	Badlion Client.exe	83
PID 3544 wrote to memory of 5056	3544	Badlion Client.exe	84
PID 3544 wrote to memory of 5056	3544	Badlion Client.exe	84
PID 3544 wrote to memory of 3884	3544	Badlion Client.exe	85
PID 3544 wrote to memory of 3884	3544	Badlion Client.exe	85
PID 3544 wrote to memory of 1572	3544	Badlion Client.exe	86
PID 3544 wrote to memory of 1572	3544	Badlion Client.exe	86
PID 3544 wrote to memory of 1572	3544	Badlion Client.exe	86
PID 3544 wrote to memory of 1572	3544	Badlion Client.exe	86
PID 3544 wrote to memory of 1572	3544	Badlion Client.exe	86
PID 3544 wrote to memory of 1572	3544	Badlion Client.exe	86
PID 3544 wrote to memory of 1572	3544	Badlion Client.exe	86
PID 3544 wrote to memory of 1572	3544	Badlion Client.exe	86
PID 3544 wrote to memory of 1572	3544	Badlion Client.exe	86
PID 3544 wrote to memory of 1572	3544	Badlion Client.exe	86
PID 3544 wrote to memory of 1572	3544	Badlion Client.exe	86
PID 3544 wrote to memory of 1572	3544	Badlion Client.exe	86
PID 3544 wrote to memory of 1572	3544	Badlion Client.exe	86
PID 3544 wrote to memory of 1572	3544	Badlion Client.exe	86
PID 3544 wrote to memory of 1572	3544	Badlion Client.exe	86
PID 3544 wrote to memory of 1572	3544	Badlion Client.exe	86
PID 3544 wrote to memory of 1572	3544	Badlion Client.exe	86
PID 3544 wrote to memory of 1572	3544	Badlion Client.exe	86
PID 3544 wrote to memory of 1572	3544	Badlion Client.exe	86
PID 3544 wrote to memory of 1572	3544	Badlion Client.exe	86
PID 3544 wrote to memory of 1572	3544	Badlion Client.exe	86
PID 3544 wrote to memory of 1572	3544	Badlion Client.exe	86
PID 3544 wrote to memory of 1572	3544	Badlion Client.exe	86
PID 3544 wrote to memory of 1572	3544	Badlion Client.exe	86
PID 3544 wrote to memory of 1572	3544	Badlion Client.exe	86
PID 3544 wrote to memory of 1572	3544	Badlion Client.exe	86
PID 3544 wrote to memory of 1572	3544	Badlion Client.exe	86
PID 3544 wrote to memory of 1572	3544	Badlion Client.exe	86
PID 3544 wrote to memory of 1572	3544	Badlion Client.exe	86
PID 3544 wrote to memory of 1572	3544	Badlion Client.exe	86
PID 3544 wrote to memory of 1572	3544	Badlion Client.exe	86
PID 3544 wrote to memory of 1572	3544	Badlion Client.exe	86
PID 3544 wrote to memory of 1572	3544	Badlion Client.exe	86
PID 3544 wrote to memory of 1572	3544	Badlion Client.exe	86
PID 3544 wrote to memory of 1572	3544	Badlion Client.exe	86
PID 3544 wrote to memory of 1572	3544	Badlion Client.exe	86
PID 3544 wrote to memory of 1572	3544	Badlion Client.exe	86
PID 3544 wrote to memory of 1572	3544	Badlion Client.exe	86
PID 3544 wrote to memory of 1572	3544	Badlion Client.exe	86
PID 3544 wrote to memory of 1572	3544	Badlion Client.exe	86
PID 3544 wrote to memory of 7808	3544	Badlion Client.exe	89
PID 3544 wrote to memory of 7808	3544	Badlion Client.exe	89
PID 3544 wrote to memory of 7516	3544	Badlion Client.exe	91
PID 3544 wrote to memory of 7516	3544	Badlion Client.exe	91
PID 3544 wrote to memory of 7516	3544	Badlion Client.exe	91
PID 7052 wrote to memory of 8000	7052	Badlion Client.exe	95
PID 7052 wrote to memory of 8000	7052	Badlion Client.exe	95
PID 7052 wrote to memory of 3768	7052	Badlion Client.exe	96
PID 7052 wrote to memory of 3768	7052	Badlion Client.exe	96
PID 3544 wrote to memory of 7644	3544	Badlion Client.exe	97
PID 3544 wrote to memory of 7644	3544	Badlion Client.exe	97

C:\Users\Admin\AppData\Local\Temp\Badlion Client.exe
"C:\Users\Admin\AppData\Local\Temp\Badlion Client.exe"
1⤵
- Drops file in Drivers directory
- Checks computer location settings
- Modifies registry class
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3544
- C:\Users\Admin\AppData\Local\Temp\Badlion Client.exe
  "C:\Users\Admin\AppData\Local\Temp\Badlion Client.exe" --type=gpu-process --field-trial-handle=2172,12508104181280379053,14424993973671048552,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --disable-gpu-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\Badlion Client" --gpu-preferences=UAAAAAAAAADgAAAIAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2632 /prefetch:2
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:1744
- C:\Users\Admin\AppData\Local\Temp\Badlion Client.exe
  "C:\Users\Admin\AppData\Local\Temp\Badlion Client.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2172,12508104181280379053,14424993973671048552,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Badlion Client" --mojo-platform-channel-handle=2936 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1868
- C:\Users\Admin\AppData\Local\Temp\Badlion Client.exe
  "C:\Users\Admin\AppData\Local\Temp\Badlion Client.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Badlion Client" --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --no-sandbox --no-zygote --autoplay-policy=no-user-gesture-required --field-trial-handle=2172,12508104181280379053,14424993973671048552,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  - Checks computer location settings
  - Suspicious behavior: EnumeratesProcesses
  PID:5056
- C:\Users\Admin\AppData\Local\Temp\Badlion Client.exe
  "C:\Users\Admin\AppData\Local\Temp\Badlion Client.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Badlion Client" --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --no-sandbox --no-zygote --autoplay-policy=no-user-gesture-required --field-trial-handle=2172,12508104181280379053,14424993973671048552,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
  2⤵
  - Checks computer location settings
  - Suspicious behavior: EnumeratesProcesses
  PID:3884
- C:\Users\Admin\AppData\Local\Temp\Badlion Client.exe
  "C:\Users\Admin\AppData\Local\Temp\Badlion Client.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2172,12508104181280379053,14424993973671048552,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --service-sandbox-type=audio --user-data-dir="C:\Users\Admin\AppData\Roaming\Badlion Client" --mojo-platform-channel-handle=3888 /prefetch:8
  2⤵
  PID:1572
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -InputFormat None -Command "Get-AuthenticodeSignature 'C:\Users\Admin\AppData\Local\@badlionnative-desktop-updater\pending\temp-Badlion Client Setup 4.3.2.exe' | ConvertTo-Json -Compress | ForEach-Object { [Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes($_)) }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:7808
- C:\Users\Admin\AppData\Local\@badlionnative-desktop-updater\pending\Badlion Client Setup 4.3.2.exe
  "C:\Users\Admin\AppData\Local\@badlionnative-desktop-updater\pending\Badlion Client Setup 4.3.2.exe" --updated /S --force-run
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:7516
- C:\Users\Admin\AppData\Local\Temp\Badlion Client.exe
  "C:\Users\Admin\AppData\Local\Temp\Badlion Client.exe" --type=gpu-process --field-trial-handle=2172,12508104181280379053,14424993973671048552,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --disable-gpu-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\Badlion Client" --gpu-preferences=UAAAAAAAAADoAAAIAAAAAAAAAAAAAAAAAABgAAAIAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:7644

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x51c 0x4bc
1⤵
PID:1476

C:\Users\Admin\AppData\Local\Programs\Badlion Client\Badlion Client.exe
"C:\Users\Admin\AppData\Local\Programs\Badlion Client\Badlion Client.exe" --updated
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:7052
- C:\Users\Admin\AppData\Local\Programs\Badlion Client\Badlion Client.exe
  "C:\Users\Admin\AppData\Local\Programs\Badlion Client\Badlion Client.exe" --type=gpu-process --disable-gpu-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\Badlion Client" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2308,i,6318523712486106542,17201248104035257694,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:8000
- C:\Users\Admin\AppData\Local\Programs\Badlion Client\Badlion Client.exe
  "C:\Users\Admin\AppData\Local\Programs\Badlion Client\Badlion Client.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Badlion Client" --field-trial-handle=2664,i,6318523712486106542,17201248104035257694,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2660 /prefetch:3
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\357F04AD41BCF5FE18FCB69F60C6680F_4307BEBDB73AC2C299035C3DC00B3AAE

Filesize
1KB

MD5
0553e75058031860cbfcc26e6fed5faa

SHA1
10747f4a6667eee9e434dfc4ae8bc449ebc62654

SHA256
e314a15ba7e8e49d208fe63482086465c73094f417ceebb5b965a7aacd009b12

SHA512
22aabfaa6a7a1028f0a365613a508259d384e934ccd3fd7495929af3acf3072deaf9c9e73c77a32e3b0c8fa7c80d1627ce1777a448390cca5d74c549d02749b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_B9E80DCC413B41CBF7F481ED50D49340

Filesize
727B

MD5
7a5eb1ff0fad1f87fce8276414b6b81d

SHA1
5ac48766167c8e21e71b5c12ba1932f3f2113acc

SHA256
3cb56f423ccf6a79ca282c08e15c1e1d3871c1a1691dbca123f192d2b818d685

SHA512
f6526018d2b8a351dd7c634e2ac8df336ac7cfd97c04da99e0091ea46c78b2cc37488c1a2d0ef5279d76e3f29cca3c21b2c9a04d8f244cee5e37d2221407a579

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E

Filesize
1KB

MD5
dfff655b3c7008e2bc15bb12fd8a813c

SHA1
a8a5d5ddede0528611ddd4e66d2dea5d6bb84042

SHA256
4e55ac31021bb7c3fa6f0de13f54852af9e466d5705c39ee4df46b57494ceaae

SHA512
bad389a524350c045afba53b297029e5e6e5e724a89092b7d98ec121d04260f53248f73fd4145a1cf1c871477e72097bb1d6f8dfbb5ac21c9ec3bcfb4cb64782

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_50385F8EB1F713E33924A830D7A2A41C

Filesize
1KB

MD5
28b9b6c849f28c9d66e692c8632f4468

SHA1
d054e862dcd0f40f743e6d66d6a5e451097963be

SHA256
064de3769c88047e4f3b03ae79bfa17011a2b943d837ea9da0398051770584e7

SHA512
1f9e2200b18d23a51d961fdd79b51c3106e4a237b33755b757ee652b1840e5bfc7dd31ceefbf1a4f5af86e7913b283c8f23d256095d104f79cc6afaec5192ae1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\357F04AD41BCF5FE18FCB69F60C6680F_4307BEBDB73AC2C299035C3DC00B3AAE

Filesize
540B

MD5
6c460dcffe2a3ee13387f175a9fbed7e

SHA1
361ff639cdcbe8e3771207ec62b32ba474e9c821

SHA256
dce6e54b2a7f296daa119f1f8d94bf10c155e7fa1afcf891325325c0e01df3e8

SHA512
37e1754d7de06c4da69dac9af68cc8e03c241ea52aa9aa16af0036095e8e8328954534bf5182d53757699229a6c405e5a9fa4fce0f1ba0d44e96bdb0792dd7a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_B9E80DCC413B41CBF7F481ED50D49340

Filesize
404B

MD5
c290cd325b82c3e8620bbd2c8fd304b0

SHA1
2b209a8b4ad3a89439fccd9a48bab340f875d870

SHA256
b593056c3fb86248954a4e258d76506f27b3ba4443fc978a0f1afaf951bd5273

SHA512
2be7b6bb73796d8fd4218a76bda9a7aa99cdadd7259d4cdcd13aa47f0729dfe9d6f68fde49f7e51de55f6def50ff3e790588d62785d785558487cea80c51cfca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E

Filesize
536B

MD5
49e7a7c701ae0aaf40f40c29b20300ff

SHA1
5886b5bb7470a3e0e658f3a915fe136804a43bb5

SHA256
346edb026d2903aaf1a756567f77169f8db2007020998f7525d4001af4279feb

SHA512
6b5f5285832993fe76820bb1606ca14e6d8251d56c8909ec98304b9613ba907ef8aaa1195e55bcf2a628dc90cae08623de3d212efed6244f8c4c861b288dc621

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_50385F8EB1F713E33924A830D7A2A41C

Filesize
508B

MD5
cfb5e58db97728f7f18a4a967a982dc1

SHA1
83186966a02bd67534f5507f625fa86bacbac146

SHA256
b1bdce56bbb414ed011d7546385fc8eba59a449ee96bffdbe6ad5aadb36464d5

SHA512
6b0c70cc563b02a68a4f3d7d5f057902cf69df7fab1f5ab70769d55f85a97f6b7a6c64b5e23e539a0289988ad2159ad05dbe5ae7495ee9aa165f8e444a64d9a9

Download Submit
C:\Users\Admin\AppData\Local\Programs\Badlion Client\api-ms-win-core-console-l1-1-0.dll

Filesize
18KB

MD5
3463d82d90601b441cf024c92abe4acc

SHA1
eac8fdafccbc1beb17386552922770bfe12ec1eb

SHA256
49ac9f317d0adfc3761d6ff0d32844be70cc78e2af18319c9a2e2ec2a44d672e

SHA512
ff4fe61c7dc5f8eb7012cc4867d7212cbf965ec786dfdfa8c74ecad8c582c4ac1107aa2876e5f11066908fbd07c1b353dc67060c28199a7e21d57adbdddac977

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cghqs42g.yau.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\LICENSE.electron.txt

Filesize
1KB

MD5
4d42118d35941e0f664dddbd83f633c5

SHA1
2b21ec5f20fe961d15f2b58efb1368e66d202e5c

SHA256
5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d

SHA512
3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\LICENSES.chromium.html

Filesize
9.8MB

MD5
b620990ddbd932d6475152e5a833860e

SHA1
70de0b3d7ffa77900f685c1788b32997a61ec386

SHA256
921452a09f92f10da4cfef0521acd6ee6c689c630661ed35189e793de2c99fc5

SHA512
ba84b5e6281dd64d5da41d0db35942b6c0b1ee6b47d24dedd5006be40b2d22d90f58dc653e17893347900fb1bfcd37b0f2fff5b532175ccacc3b63d98fe42ac7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\VMProtectSDK32.dll

Filesize
98KB

MD5
17011601817dd00866b681d4a0bd90f2

SHA1
d6ad7087f54182b47a9a6776fab90cb03e95f80c

SHA256
6ff20283e407a0f2829e4fa6def121cd63d715dd6582847ae2d6fc379ac40927

SHA512
1e41669c920ac65fea5fd0e5704430dd371893155d5f33674ad6eec011ec16bf4969b01e2b9b28c561d131a032b599e0479931221819c677140d1b272d121abb

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\VMProtectSDK64.dll

Filesize
116KB

MD5
6540242ff58d08c8849268cf305445b8

SHA1
ba0d0c8875ed96f137dcb28aeff873373b994eee

SHA256
889553cce491767b38df153b567b6da682709925dd7a1c23f12c6d53a9fb18c2

SHA512
073e44196cd0c4cdb1cb5004cca59da80e09b97c70b83f212344ec7b262f1a3a4ebdbdf059d9bdbc228545b49a269a8363b1db9180ff6565c94797b19cd3c515

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\api-ms-win-core-datetime-l1-1-0.dll

Filesize
18KB

MD5
ac3c4cafa028297da5037781f1156220

SHA1
937c2b11c7fe4effc16e67af716563aee2419a0f

SHA256
0f0cec83da06f06e9c42ffded72fa69c51efed881def2b4b7b88274bc1bf3d40

SHA512
a2d1135f497e3831f14369978ae6a5ff74106d9d4ea0407548b6c336a1082bddd196424b292c799ce60270182c13e148971039cf29241e76203b069ebf7bb72b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\api-ms-win-core-debug-l1-1-0.dll

Filesize
18KB

MD5
8c0531639f58f79b5b67b52edebb01bd

SHA1
866f3ca8819440e0ba67eb935e688509f86ce1e3

SHA256
a20dc11ab10769b38cafb701c2d08810c8aa61350f0b33ae7838ff5c26edf956

SHA512
d6ddcb814d7f507df03bd5fb378eae3bf30f31d0cbb41136382469297033965763dc20e68dc50108eeb5fb5996d167cf21b29dbdc0ea163521607e1cc75f7d9a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\api-ms-win-core-errorhandling-l1-1-0.dll

Filesize
18KB

MD5
2a3c5cbe313f4105dce8a79f533e5959

SHA1
26e6768280c83217ccbe36f3a405381defec12b9

SHA256
79cb8a8781feb448fe051e90ccaf3d6ecdfac12c1ad4bba2730aa1f0a229c31e

SHA512
e24ba69254b445a62add1d58269ee99841c36049f639671a311bfc0f60d965e6a8d79a67375eb0d3ee3be8cf998f182ff03291f0709ae2155bbee924708dd8c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\api-ms-win-core-file-l1-1-0.dll

Filesize
21KB

MD5
4215700161720c767e725b1f7fc358ab

SHA1
6e31fa39775c1c6c60fe8869761c31148b0a8019

SHA256
38e535e9a79cd72e3f5e3c0ec9c97a18e86d480a504ea6c85854a6f70b302c3a

SHA512
8c93f4021544ffafa37665efcbfa2c4d23742573e695766c637c9449a39af5ea0de114c821a5c50b886ed1ab0f0a2be0fdda164884d73f7488402cfa2137e5b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\api-ms-win-core-file-l1-2-0.dll

Filesize
18KB

MD5
285e3257c5a12d3384cd3f5a3ae941b2

SHA1
c05f6a72b73bc7ec8409ed42ccd947f501da0166

SHA256
8355bf70788c00fb1a17bc4160bcdc6930fa219b85473e08138efc10136d90eb

SHA512
f1ee0689b02e6a6e95940c1b3c2cc6902f3e04db44f4d767a1e68a890b7b3733b28c1d86f1f361f0db8b1ee955f5f5bca86b758b8f2e93d94b5bc4d469187df5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\api-ms-win-core-file-l2-1-0.dll

Filesize
18KB

MD5
72d542226f067dae07562fd093b0f5f0

SHA1
c0f7f85753bb351c51dd8e36ca2366a3b24c73ba

SHA256
e8e3550084cf30e16b16216266bc73b07c1a05bbfd94ee3f645122d3d167d7e6

SHA512
2fbf32b38852def53891a73b9b33f33de96ca09102baa8c37f02d1b3d5076b26d2a32f2e79aab1009dc5b2464abf50c956c797ba4321fd37ea13900753a1d182

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\api-ms-win-core-handle-l1-1-0.dll

Filesize
18KB

MD5
3b620d81c727a8aba6dc6895af695d35

SHA1
21641bc6c802d0ada3121d14c2a8de4e708c74bc

SHA256
9aa764023ddb501050f43d1af0ff87f592ed14c4f022ba58270c3315386141b0

SHA512
54af2248017db94ef81a5c4ba6496127f1e305e292bd165563929dd88ad756b15edb5f0e2e3da367581c0c9cd92e04699e28bcac12130299949b13267414d228

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\api-ms-win-core-heap-l1-1-0.dll

Filesize
18KB

MD5
d54e0da17090c6911db3fd0770faf91e

SHA1
5538096f53b4160ef2e91987d57d2da0ddb9b6ba

SHA256
17415ecd7f34def148a91defe99155b71c8048e253315b2d24d499b99207f618

SHA512
680142c329f6ab44cfeb7eb1572f296918866c9ca3ac9e66ae13ef38d79dadac9bf367e6dc6655c7e404cb6b243f3518639acd9cbcd9a37da5812823d43886d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\api-ms-win-core-interlocked-l1-1-0.dll

Filesize
18KB

MD5
2ca477f1799fc97d6bd05437bdfd0017

SHA1
31feb0b42e9237cddc5e47c3f4a076de86ca600e

SHA256
e81e0d9b2b09524e5790617547bb8bd8ef3dacdd001bd19057c4f8943d996227

SHA512
c0c991341619548e6944a78a090e1dd942140342d8cb77f41ba559b56034dc46a3ac731d2e2e67a7de1f6a65e26ca0c6a3eb358124a03eab55c2b5d061b64717

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\api-ms-win-core-libraryloader-l1-1-0.dll

Filesize
18KB

MD5
d6db1a6b5087a82e766fe7e9f818c135

SHA1
d786b2d8ab10edf0e893fcfbf52b03bceb15f53a

SHA256
f9457d0ddfa864e4bb383759bd7bbae961098055216b0b7d7d40c11084a1561d

SHA512
6118ed237839a49567340aca7a76d8ea366537942da060d4afc0399a88603f7f02a93c061be4475f35599d3cab8233f3925a491f4aa094bfbecd2adc5d3e65f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\api-ms-win-core-localization-l1-2-0.dll

Filesize
20KB

MD5
55902b92bbbca7a2d11a946297f583e6

SHA1
b6158f009d98a98ed2e56d377f9c4b6323b852fc

SHA256
2dea4ae5df0f7daa37e26dd0f9232f867884f57e850aa85062594b54f3a81e98

SHA512
85e0df8a390260e4e0cc0a9372dfd3c55464486812926775a5f9f5767157b88783e03701b1f1c28f34e822b21ea7436c3e8270df58f8de3ec1b15f68b633f4fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\api-ms-win-core-memory-l1-1-0.dll

Filesize
18KB

MD5
8fc176a3a6550f90e73d6da8445e8780

SHA1
5d249243678a789ce56037d0d1b36420d97dce06

SHA256
65bd14bfc1f14c35e345412ba5e9642e7f6c286f95de014c0f3af100e88b4467

SHA512
808daa3369df6704151b67f246eed90cc32d9110653faf06e973b97900003c8b7dc26095abf420d5c078e9546699c4b3debaf410819cd6060d3feb481576eefa

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\api-ms-win-core-namedpipe-l1-1-0.dll

Filesize
18KB

MD5
27a8f9e71a2f2d134c55de62fad6cf0e

SHA1
b60944dbf9a50a166b71fbc58305c3d559c4157f

SHA256
a319a14b76d8d67272128461f1cf53924dc2759ac72a76571f8b31e2f737553d

SHA512
3904895242acccec14feea4b7bda654a0eca3ef716df560764ca28f97eaeed10e94f5a0d46a633fa0671682188e4bc7b99b13649354bc26a88ca8211ee36307a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\api-ms-win-core-processenvironment-l1-1-0.dll

Filesize
19KB

MD5
ef80685a812d9c252de35fc9b38bad11

SHA1
c641bf0f41d0617b25aa20d63b033236ad3133ac

SHA256
e17aa51c5520a623dd530889838c54ddea91e06e235003833e019095f5458ad0

SHA512
431ea4ae368b2cf55542ad614cca8e24fa2cecf0c5163bddc3742412a6e43f53ee69d7cfd1931e59eae9ee8671598ea35d0936850e6b733af14a4a5ecbd79437

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\api-ms-win-core-processthreads-l1-1-0.dll

Filesize
20KB

MD5
ed69bc0f310c5ce427e25973a0a52c31

SHA1
0bd1683418c952490f6a791a044b5840f5dc90b5

SHA256
6bac5963da125b3e314beaef5903d37316e162eb92e7c0f0b9946044eb0bde01

SHA512
4fe23992c6ea37a2f88cd2e3519559b08cb302f51f35b1524816a6e29e1412c2e6e1a214fff6d6ff50d0f7b410591abd57fd7a87c987f18106c6ec44d991666b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\api-ms-win-core-processthreads-l1-1-1.dll

Filesize
18KB

MD5
d2eeb9f6789213bfda7fe6bcb2a1540a

SHA1
c330267c8abd56c04204deee9aabd566268daf97

SHA256
0ec2b6ee5e8ee5ee22b810795d097dd769ef054eb394355eecac1a1fdc18c971

SHA512
7795e972f46ec84cb1709354a40684593947cbf6b4df373cd823134a0b2deec7e5dc738a74c13c2accb74c467892d9a2375a96ab85147ae42fadc627a0f7e2cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\api-ms-win-core-profile-l1-1-0.dll

Filesize
17KB

MD5
46361d1f7b60b86f128f4e23c95cc3e6

SHA1
8c621d8dc4ec4fe3a9f40d25ba3dc26a19a02994

SHA256
978419fea728f20a4df8046e75b880343cd425548f8bc38e8c0a6e8c315c4310

SHA512
25f033816b7dbd387134fbf72f5c6ee351bec480a4975659702b0912d204486826e64612b94646056d97111612fa8a322547aef8755469f8a6edc45fea534322

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\api-ms-win-core-rtlsupport-l1-1-0.dll

Filesize
18KB

MD5
210b0178e7aca6b9444e2d10ac6ee054

SHA1
2ea3c9d780f6c3dc60b6247b3fb0dd5a8dc638f3

SHA256
7857b0c9c6517102ae5e047d7fe1cb0f85424f1ea01fcdc66afdc231f3127906

SHA512
3b3d10262bbca6559b2223be60f0d61a77ada9c147b167641de58b418634963bcdfc37fb4b11cf65517f5a3e29adb785e83c379a056c4992ffa59a468ec393f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\api-ms-win-core-string-l1-1-0.dll

Filesize
18KB

MD5
7f8e52ff5a64d2d471413e288a591866

SHA1
cefad6219c916307e0bf7ef1382512c2cd4c2d5f

SHA256
952b0ef3b3cc8d15c91e4e6605d49ea6bcee1459f465b99dd22decbce69012fb

SHA512
7e9025f0eee30552e24425c0d7fe441264a905469755f2aa94863d68f8d53da654a83b4146695d0320f5ad3538a2fd716619baf615d9b29d8767ef6296088253

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\api-ms-win-core-synch-l1-1-0.dll

Filesize
20KB

MD5
599025b219fb4f70b3f93eb0d4d12bb1

SHA1
c1ceab162231476cfa9aa35a54400f3d959369bb

SHA256
6defa74d4bf10f95815d965547065b5af5fc4154d93757735ebbe6aeca570ba8

SHA512
1b4e6af508ac9d353b0e2d02344181ea57ee654f505e04d3b6a7d758fbc0a72875d72ec185c138e69e1d7dfee3459e96c64cf6a2436db1c7425748556f99b922

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\api-ms-win-core-synch-l1-2-0.dll

Filesize
18KB

MD5
8f469c5b261e003ed991f570aea8f29f

SHA1
848046907a02d605d53a31748d8dcca18d11259b

SHA256
ae460b343b6fad12d26feeee14e68efb97e59686dbd2cb22ab228619508944c6

SHA512
f393b8c9ef4cbd6f660093016fd5a3267b5afaf4c26262f2fc3c52351c697ccc38744e530f779707f802398aa01a7eaec191497949d2c1fa5b34b8d33153beea

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\api-ms-win-core-sysinfo-l1-1-0.dll

Filesize
19KB

MD5
f58fd490561921c154c31c05bbb63a3e

SHA1
d5f009e7cbb070b35ed81acd68710716bf971b7a

SHA256
bc7203c7c0c539fd225701e39f1e430367376cd580af52cdf9dff680046027ff

SHA512
8389e2834559681accdc3ded3a8be06028e5e3fb8d62cafd218c545dff052604bd0b0c14a4956eeb7653522c05b45d05d072e44c4f125b0e5567d3a23318e8ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\api-ms-win-core-timezone-l1-1-0.dll

Filesize
18KB

MD5
f2d0493794b45c6a2629fc9c5c80f832

SHA1
12460ab8f625ecd0e0a02b4fa82061c2ff4644b8

SHA256
8c2d7b0dca0702b8f1870c9c404f41e00624132b239deb7917096dfed8ca1507

SHA512
4f44ea443413c3709c1521de0b9dc5c05ef9a4f853062e44658d7bc54663115afc1f04927797a5406b388cd5c9e226c9fea1f73f0c288999105d9db42fa257e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\api-ms-win-core-util-l1-1-0.dll

Filesize
18KB

MD5
e0b524ff31e7c651eee7d83b1c7cc2d5

SHA1
d29f001b843e452cae91a2d01ef338373fb24763

SHA256
b4afba280abaf5dd28d92d452b958e440c88a26ab7359a3200876a35775a33b6

SHA512
4d3dfbcefb85b8d6ef874cfdf04594ea4d6c58ae7de544588a9cf8646897aaf9b46bdccfe9e6f7cd87d00a58d5c595973493fa6cd6d82266b1a27736d4e15ded

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\api-ms-win-crt-conio-l1-1-0.dll

Filesize
19KB

MD5
d2de2615f123ce2bed3332d505a99385

SHA1
9f2ea75348020d271222fff7984c8ef21aee460e

SHA256
da36262bd3865024a6ec9726b8fcd0764ef3ddafe21387314c0bbb89a478e4e9

SHA512
a5e99e724a847c2193ce052dbedf0cd19a8765e3561ec028cd28e5972c8f004e257de0d5dd3870d41213a6cc84492ad488bd05106d2b5d3aa19f808eec820d51

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\api-ms-win-crt-convert-l1-1-0.dll

Filesize
22KB

MD5
66a41a8156a7f9cae4a7977cb8084fa7

SHA1
4c72b0d8c90daf993fa0371269af04703a81fe4d

SHA256
a454bd7a8fb18d19e3264855ec7ade9820b54fab31f9528bf1abc8cfe32e064b

SHA512
989ec1a0deff20bc9b3099a21bf9d45bf821e94eabfc1b18ba4ece1689d0cbcf83b6206bcf64530a55aac1d4165a54c395f8db17fe5d68778082dfb1db4f0d10

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\api-ms-win-crt-environment-l1-1-0.dll

Filesize
18KB

MD5
89abe10555d85e9bd183fae2c37d7aaa

SHA1
05c72b53f7d7b0667ff6cb14255e5c6453f1f35a

SHA256
d524f5aff8a3deaf37899187fed40b821c5e79251b99d0a8571b62ad87adffb2

SHA512
7b9c38e5270c401acb1b51ccf82ff0249671c4df905c31bc934d8d0b15a6eae22d3d82381199e4d61ac717bbe72726bd2f9b6c4b2fc930b39ec2c31d9fb1147d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\api-ms-win-crt-filesystem-l1-1-0.dll

Filesize
20KB

MD5
7dbc1ca1f1103cd971a67709d5203dbd

SHA1
717e689b96a5d029558e7cb663d5c7cda840b780

SHA256
88a6dc7c08725b447dd1b7061990977246dc62b7282dfb50fa36659627079fb1

SHA512
ec58c7bb26f669f5b90731ab8c787b3b4e4131d7a9450dfae4d74ef24541a51c98ee8cc71dd4744a242dfde2f75feb216727daccb18bf745e2539546fef746d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\api-ms-win-crt-heap-l1-1-0.dll

Filesize
19KB

MD5
dedf6460cb6fc8229b3e889d1b32f75e

SHA1
f47e35654cb90ed4505ba49a92b2fdc661c0fe8a

SHA256
bae857fe8e162640032aa8d7a88217a021810d305bc58b8f27409155f2299adb

SHA512
b1ce0119c2eb87ee36fe566477d14d317d01465319b72f7afd2f83a88f82591afb6f795eef76b20c0b13060530f67a4dc07923fd2f61922fdea06973c70f8352

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\api-ms-win-crt-locale-l1-1-0.dll

Filesize
18KB

MD5
21f5271a151394a654b2f1c44fc44049

SHA1
1d2f98700ee87fc747b230b908fea133b730bf0a

SHA256
a7a987527a2f7ad4474cc5be04e5bbc10375e072573b13a2cf3fe705789bf822

SHA512
cc46e3bdcd25f2d72802581955ee69af97781b19a40a51fb318206ca6916f188f40dd94a7a5e6bc2c4c2ce211229d03e50729b168ed771e52cee188d0c30638d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\api-ms-win-crt-math-l1-1-0.dll

Filesize
27KB

MD5
514a74d1050e7bdcbb1f422fb571c351

SHA1
5a82976e2456fe3f215316a85301460c6af389d7

SHA256
62e97230bbe85c0e2930d16cadf830acdbf9f2bccedd3d51fa8ee0c5102ac63a

SHA512
f2b19fe5fc4f95ec3a1b0d76e8e6767234c83a8b8a08ec6a2ba9b3620c08f67132fb7629235aee27ec172d6efa5260209e005564467abe3ec06f1a7756d21da0

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\api-ms-win-crt-multibyte-l1-1-0.dll

Filesize
26KB

MD5
3e4803f97b89adbaa575b45aac0dd4b8

SHA1
d810ed1486f86494828a8cd96f774881a629b652

SHA256
2fb9611a4227227d30bc9b8f6d389cd12bc9b38b325d23675fb737470bde27da

SHA512
b9824a29e712ae65b27a4ecc68bad7f127306e7c2267e1ca9704c09e15cc6faa0aa7649118d169813172557b6375b72f8e88a587e79bc97f1825b8cd4c1c2dd2

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\api-ms-win-crt-private-l1-1-0.dll

Filesize
69KB

MD5
3d2b4445b9fafaa0e13ae0e126be2669

SHA1
3b24c99469ef9a35bf720e711a0b022f2403be22

SHA256
6bc27ea87e05b365c74b093f0256d1acf85113ba356ad187886d8adc07526398

SHA512
9641d0d9470abc256f44c9d3881a42a674b41992dc25b7bd048a9e2b8d3523de9626460a9f73f2907f73e0be80219c913d33c9684664d6bd6642c06029e5c44e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\api-ms-win-crt-process-l1-1-0.dll

Filesize
19KB

MD5
90d42fdf308dfd771797dd41585d3baf

SHA1
daea1f05092de97ea558de14b4e112ad48b77726

SHA256
404ff7454e8dd3d766e433def1780a265ddc87a07981d223d241a528cc78c0fe

SHA512
e8f35f6087b9601d8a46b2534634f24a2841ff2cde9f6b7bc10326cf2197e98bae9c6ddcb2e53e8f81a984019b72080d1e826731fb6d7c28fdb47373c1e474f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\api-ms-win-crt-runtime-l1-1-0.dll

Filesize
22KB

MD5
6856722db8c9e3dbb7fc62938ad2cf1e

SHA1
6d1aa306d7793916adb30e9aac451b2e43516abe

SHA256
3d077c3cfa0a54f6f58814deee22d3dcf4bcaad44ae405b8d31552a9afabc086

SHA512
87a3c82af000fc1cfee5f12f01f077c2c87638245b2784e8827c587985f8c0014685d0d15a1498a01dcfcfe717cfbb9ee64344ae7a78aa75bdb65e2a0aef07cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\api-ms-win-crt-stdio-l1-1-0.dll

Filesize
24KB

MD5
dec83f473e43ee78e92a4b682a9a7904

SHA1
ce5e0479c78ad6ffa7d765479a7e1a7157eca4a3

SHA256
a5c05a8394c5aa71441ac18e945170a755d1f1ff141e614cdd92dc5737426a5b

SHA512
60bbd86035bbf3f80c17a01fb44ea5af5c84584a8aa5f34a7e0abf989ccccf8d40bab4d44af364c8ccf62ce4e21df0ed2c51bb70e817b2bf9c5319dbfd4100d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\api-ms-win-crt-string-l1-1-0.dll

Filesize
24KB

MD5
88b5f9bc871438973ef12782e0c8d12f

SHA1
d327208b4f26c1c6f0e9df50ecb22a89b426465d

SHA256
4691510b2bc2ba15b638a0d1765c2a8826a8b9fdbe3737989d8fea072fe7c20b

SHA512
d4de343a88c9933af67c4599d308f31332ca7a3ea0428fbad2d60e2fa2165eca9ea56410437be1154c551e7263dd6a5773e6f7c4dc5b6952e8b767a3c5b16597

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\api-ms-win-crt-time-l1-1-0.dll

Filesize
20KB

MD5
f862bd9516845b31973ba98e9f1288b3

SHA1
ada580fc93b4f5a86db92e1d612293ccc21c72f9

SHA256
72d31abee96fb3ee1d90afcf11fdc54ceba131bbb912b994761f32cd7cfc3ee1

SHA512
bb442aab30bb0d8797586eaafa53a6deaaaff19d41342b9fb828c87fc468d96953f8ed1123ace4c4d371f9eed91c2bf2c42b1d8ca92bbd0a89bc5a27a877a15e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\api-ms-win-crt-utility-l1-1-0.dll

Filesize
18KB

MD5
9975d1ae7b84b373d9095d757172ec08

SHA1
302edb92e0a6ee621379528fbef9dfcc249b9285

SHA256
8d3df297a7da678446dc9689f64dfbff0478cfd2da168180ff41c16e1344e584

SHA512
fb71a43887ec9675a4e42f2f810d33f6ec4726de5723c935961952f43d45982e5d1156e4d97d4c0c9ac8440fa186b13e1c6387c425b5a774218d6917efbe41d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\chrome_100_percent.pak

Filesize
146KB

MD5
6c2827fe702f454c8452a72ea0faf53c

SHA1
881f297efcbabfa52dd4cfe5bd2433a5568cc564

SHA256
2fb9826a1b43c84c08f26c4b4556c6520f8f5eef8ab1c83011031eb2d83d6663

SHA512
5619ad3fca8ea51b24ea759f42685c8dc7769dd3b8774d8be1917e0a25fa17e8a544f6882617b4faa63c6c4f29844b515d07db965c8ea50d5d491cdda7281fc5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\chrome_200_percent.pak

Filesize
220KB

MD5
77088f98a0f7ea522795baec5c930d03

SHA1
9b272f152e19c478fcbd7eacf7356c3d601350ed

SHA256
83d9243037b2f7e62d0fdfce19ca72e488c18e9691961e2d191e84fb3f2f7a5d

SHA512
5b19115422d3133e81f17eedbacee4c8e140970120419d6bbfe0e99cf5528d513eea6583548fa8a6259b260d73fab77758ad95137b61fe9056101dd5772e8f4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\concrt140.dll

Filesize
325KB

MD5
14b7a99127ca18df05dd1f5be3ac0245

SHA1
991891bb1ea603a002941696697f48cfe52cf94b

SHA256
511aba3d00b9925e7bc64e2132d77a76c1fd9e9d200ec0ef864b7a0f00c68995

SHA512
80f1a6cd377e62c96979fb4cf50d70e3005623c8debdb3c55dd27e5bae9dd46328d18066e59501ecac13ee96533f3b5189fcc93b4aadaf376ef6a2455ea7eff5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\cursors\col_resize.cur

Filesize
326B

MD5
23633a8dfa3548705f28c83ee9584d6d

SHA1
be5dd224d071d965bc0411206cadf9b33ddb384f

SHA256
d3b49998f6d1039bf8b65f73f5784653164804c72908a40a5cf8ea850978a0d0

SHA512
5b0971bf5c7bc17ae746c88e4fe3f0342d9288f8feb3ebc106b6a031d62b48af8843af0079a18c7ffe4a2200e9d6d58f92f1d87987a068bbf8e4bf7210153782

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\cursors\col_resize.png

Filesize
321B

MD5
0723c45d9f82b0e31a1fee26b9b4f53e

SHA1
5608c3c92d70c61f597d1f1d3aaa85e72ebc4dcb

SHA256
6ef1e382e5e2472e8426a0f486ab51fa2216cdf929a3b737f78564a8ad57b1ab

SHA512
326f31b3e25c11fee7c28040252b5eaf183b0380ef87033134ff032eca4d90a28eda08837af833e0d5c9ec06d7e63053f23c64d9fec5fda0038c27546bfc1932

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\cursors\copy_drop.cur

Filesize
4KB

MD5
f92d1851a489b0af7ab807a2f07ebe16

SHA1
d97c9d7ab76993448f6240322140dd23c756b6c6

SHA256
18920d4ab5cd0b654b1e8bbc33fe5278907514a1b227f701a16b9a3309ee87ab

SHA512
b4494c8da0734ec69caec38324c6b3b91e898ad8b25c9d7dee9ca56c41cdec768c16efc10d71c856a0bc633ff22cc76cb01ee8ef887899e2486fb7f78b340a7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\cursors\hand_grab.cur

Filesize
3KB

MD5
3f37213b8c0a7374308b2ae99d4eefa2

SHA1
b72b9901b3fe6fc8693d67cc5e419e494afddbb8

SHA256
3df4009e28e365e1666c868aede15239c75cbb6cf710cd691997b722c3eea7f0

SHA512
ce33a5698bc937ae0ba3da69fe7d4f9e15cee08e45451b7a21d17b5a2133a1b6579d622bd9a749612e15359abda4871335d60ce47545699326648df8b4b6fd36

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\cursors\hand_grab.png

Filesize
534B

MD5
7be75a54023adbe7d6b48260e4e8d032

SHA1
81f20b4e0ca495e393748e0054d9ba12b6179196

SHA256
8d8b7205410e7d0e32bd6b81769d7853025f5a1b2235e93088fd327c039e6b1e

SHA512
2724620cb131b175b22e405bad2c7b6f2b771cae8f8402d85933a93aad409a6d5d2c01a534ef4f10900130eec6e394b470c2451ebbae76a950f15c46229f80d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\cursors\hand_grabbing.cur

Filesize
3KB

MD5
8605cf2c21985f59d2480da72aebe3aa

SHA1
1b8137afa3dd66c23af9e40e75339d2f0174aff2

SHA256
22e823e71c106f338d42932c13c16e05a8310b3bdec18a89cc5ca197408cf11a

SHA512
fbbf45bb20f27c9faebd34101db1918c2ca0384a27e6502eea59c170fdc553ad2647ceaabf82cb0dc5662d277ca6eba70c6b615c79218f3de2e5822299399c76

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\cursors\hand_grabbing.png

Filesize
474B

MD5
ddbc22bda750215abfc73d75e1105b17

SHA1
f8dc1196227d95b7630dc85a3543c6db853f65cf

SHA256
0e6c5b2ec6b01b9a0c52dd26dafd1c969cf073c6d47e9db8e53fa05912f73cee

SHA512
5d1a6e89a1a96988230cf30fb156c166e26fc832affc5e7eb39ef974e69008403d54463a4b4a40c55c0ad8eb90e438c31a880f613d1ff42fc966ec961d396240

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\cursors\invalid.cur

Filesize
4KB

MD5
2f8b93325987b4eed575ffe251c67751

SHA1
ad1c4ee2358fc0f84d2ac2d17890822ff51ae725

SHA256
669c9cfd524f924b4358caf1fe239923473e87e2a01f388fc5247a60fb6253bf

SHA512
307e2608a66357b2dc296492a0dfa2b27c64e9d1b2009d9370c76ed7b24c8115c3dfdd675bea3c244c3a07d672fd959c3d31b5c8134d1591c0c554adc4f4e405

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\cursors\link_drop.cur

Filesize
4KB

MD5
66e13793e687bdb92c09e0ae7964e194

SHA1
71019343b1747c19503e935aff3c7aba1fb70541

SHA256
49d5f9b95e9968ba54ef9457f89386fbb29d7492fb9db1af920fd3433aae4a67

SHA512
19dedb36b972ab005f01deb6f1eae1b9c0609f3312fd3f70dff93285390fac7b535e5d181f4a7cb25bd4f5933538ad7ebf44154f9d6d3eb04e412144926c4143

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\cursors\move_drop.cur

Filesize
4KB

MD5
63942f237ac6b11d62adf014d2cbdfbb

SHA1
f8b582c7d8edf28c2637d5f0f27f2586cc92bce8

SHA256
1ba52f630ff570480f920d13d04b7cf5e4d993c68b5f4d183a6c75c87bc22b6e

SHA512
e87f7e95e49513ccc75195976fe8b8926269bfaeb766fe816fcc0de603bb55b936ce1a59964022e7438c0c3b41bc28abe323fbaff5b0a4583ed9cbf24c450fd5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\cursors\row_resize.cur

Filesize
326B

MD5
70618f41c70238453a7d876bac5ab501

SHA1
bbf033428d8cf562ac3347440848b1b3ed1b65a2

SHA256
241ca59e728f9faaa3ac9c626f44f8387a04699ec1bc468ecdae04c53ae2df04

SHA512
513dfa3e15b887f4e785da9dbe04cff591a4ae3bc6d5f4b14d7dbfd3695221f6448b0d67132dbf80b1e36d9fbc2d245df23c1135d4dfa33edca3706d23bc89a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\cursors\row_resize.png

Filesize
321B

MD5
cd9d05d1ce7c942af1ab5e6eafd0a13c

SHA1
d3dc6b0df04e3c6bcf6166984e3738a7651284ff

SHA256
12f76ebabda00b84c395cf989b92e0870c5a3b678bd6f5ac90b8a6820059e28f

SHA512
7fa9b03d668d5232b10fb6da719399d808cff95592214c8adc1d00210e4826545d49ccd4c0dc5bfea099db1c8ad4c183778ed2f6517d81b44817a428b488e900

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\cursors\zoom_in.cur

Filesize
326B

MD5
77492cf358d8b12629399322926c93f2

SHA1
8291ac3dad4e4f33183ccdfad7b92b1594c760f9

SHA256
eb69f540be1e416b7346017da48deaf5ba2f2ee0af366c04f1e374351b651872

SHA512
6c8652770a041084a88f6a535991224423c003ac2b6b5949b515dc03b0187fb4a6cfdf3f39a6279e103601d991e95139e6ef8352e68e5dfd85d99c078e0b4f0b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\cursors\zoom_in.png

Filesize
374B

MD5
6a5fbd95c627afe076f43f9254dfe3ed

SHA1
f71cab57e9e80ba792f73f363056f6dede7c8bcd

SHA256
e910c607f60fa385d67624fc7449a05b419718f60a6b93d4be79d6a974bea522

SHA512
cf73a830bdf76f319db8b34ec8daf70405cc52cee7fe03d4ac75cba1859d007e30993da1c123e13deae6de09e5b234a9dfb02089d546601964d26bd597949b8b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\cursors\zoom_out.cur

Filesize
326B

MD5
48b46c3e0650d525e715cf9cfa6c67e5

SHA1
1ae6e82c4aae58c7e1cdcb1e5e76ce8973f8774a

SHA256
f3829987f7124f73facf282354553b6ef8d9b58b3b02384d92c45421e2443536

SHA512
e154d7fa552bc78755e6451950a159044fa85f5cea4a6a3a19a88e451962b24bce52a1b46b4b13eaa6b55b2e8be4b9eba0cf16adf1d2200f73be7dd0681b19e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\cursors\zoom_out.png

Filesize
370B

MD5
e1a004a51cb04c38f49184333a23379f

SHA1
5b54adccfebbfe4bb96502db5370c1ab830c829d

SHA256
e7133e53b0ce06b92ef48dcd5bbce4f3d36e6ff8bb69193d3df40c4adf1a6814

SHA512
7506d9998cdd5bb75c8b142f8231009f15ad0548a52a037b78b98eff427b50a2a42c16580a53899cf5dd2b41abfb51eb24223c827e5e277dfd295f5510d4424d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\d3dcompiler_47.dll

Filesize
4.7MB

MD5
a7b7470c347f84365ffe1b2072b4f95c

SHA1
57a96f6fb326ba65b7f7016242132b3f9464c7a3

SHA256
af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a

SHA512
83391a219631f750499fd9642d59ec80fb377c378997b302d10762e83325551bb97c1086b181fff0521b1ca933e518eab71a44a3578a23691f215ebb1dce463d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\discord-rpc.dll

Filesize
390KB

MD5
5882c37b79bae47a0d090006564edb22

SHA1
ac7bbbdb1d34eb763d8db4ef7875a50f700e9d48

SHA256
5cc2e504800cf4ed2f4781364f661ea22349658ddc391b5d54195e573109d87b

SHA512
d4a6a1a36842dd1c8b2162168807b990e0d491a908e11b52ebf11174a67f818b131607c2122dbb484f5d946418a05a1a84d42e1468bef5c98ec3fcff7d225ccd

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\ffmpeg.dll

Filesize
2.6MB

MD5
1268e3c8fe56351c438de7e3e1af1e62

SHA1
be1c096c70aa2fc848b4217bbc2def1003c94485

SHA256
c624147af5b16c2d7293fe54f13d11540c5b0572f5976c3ed90b49b23448d0ce

SHA512
f230cda66bce2146c54a935b5a30b43ca768945c4fb3c584f912f82147b0a1ca08725859b62b5e8a2ce69dcf3793f8af2eb6985c3f8c6028402675a52eabfac5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\icudtl.dat

Filesize
10.2MB

MD5
74bded81ce10a426df54da39cfa132ff

SHA1
eb26bcc7d24be42bd8cfbded53bd62d605989bbf

SHA256
7bf96c193befbf23514401f8f6568076450ade52dd1595b85e4dfcf3de5f6fb9

SHA512
bd7b7b52d31803b2d4b1fd8cb76481931ed8abb98d779b893d3965231177bdd33386461e1a820b384712013904da094e3cd15ee24a679ddc766132677a8be54a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\libEGL.dll

Filesize
469KB

MD5
f5c6da45f4b806647d386a18a8b6654c

SHA1
4188a9d07c3167ff3a2110cd8521cbb7475abce6

SHA256
ace3cc6928009a21d0d3e297c642295a15468f793db421f8183d72e6b1ec90ff

SHA512
6b754248812e041ea525989a763dbc45b9026e182984e6f05dea98afeda867a6ff4e36321a8ec423e7373041281d785932e6f2aad53e29a72667857de80daa96

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\libGLESv2.dll

Filesize
7.6MB

MD5
81b03a6a422d2976cbdb214d4f3d929e

SHA1
979e0018854578c3194d18055b5a1481451a4a5d

SHA256
32ec1aaded0c0b5f5ae0a6a5daf3527808b4d9ff73a87676bed3f38a7ee5d6c7

SHA512
4926b2761b8a40b14647339ee5d4e446e57b77e290d60c99d7d1255b56571c658a78cd9eb2b709e02bd824e6dea66f1e986672e43f45a60dce5373a4660334fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\libeay32.dll

Filesize
1.8MB

MD5
4b8269a6ec04ec8ac23904eaaee075bd

SHA1
7e58e27dfd38de0d77eb729824f10c6aa5a0b8c6

SHA256
3c3d0df094235029e561a7813aa5835b25a8bb7b38dd77ef8acbd335f6db0485

SHA512
82a303b1e5adb8ffaa86c99fd63c533841bc9e3237ea3478584411dd92d60ea573ef063758747ff0497d58dfb085e014be1b234b5902face23a29e842b095d1b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\libs\caffeine-2.8.8.jar

Filesize
900KB

MD5
ddac1f8f76743255084022ac6f06b7cf

SHA1
298bb2108157513a39a1a52a686a1fe8b57cc973

SHA256
7b7b72c6ce3e47e774e29060ceba19e83e8259bd475986e04b4f3272d4a58f73

SHA512
6cb83b6d5054c63c13af5fd39f11065556137edd423385f5d960a656fafddf5a5ddccd1ddeddafdcbd511d0fef005c58fac9e3fb0bdf1d469af24450dfbc2325

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\libs\disruptor-3.4.2.jar

Filesize
81KB

MD5
6895a3c4f54cf92eef6530e9e2cd3c46

SHA1
e2543a63086b4189fbe418d05d56633bc1a815f7

SHA256
f412ecbb235c2460b45e63584109723dea8d94b819c78c9bfc38f50cba8546c0

SHA512
da76e44fc9834c6d9e21eafe2fe64604159dba99770946bd114823ba037ea0217ae3a13f5eaf29e28edf92fcfd4f20c60b7645d6f117c38c897594e1337a744c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\libs\joml-jdk8-1.9.25.jar

Filesize
710KB

MD5
9b868b921d0490b417bd594984b680b1

SHA1
7bb2cd964c5e7b129a52e1f47edfdd557a7ec3da

SHA256
fc76d61e7900e65cab1f3c237a5186ff2344dd7d7d0bbf8f01a453c4fa2a1b28

SHA512
c54cdcfe63c1998fd14d46988fc49509ac6af2e2516eaad0dae19566baf1c99f0482d026d7f6e79a66706905b76af9b4298a23521ecb32f5a3708806340b3959

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\libs\lz4-java-1.7.1.jar

Filesize
634KB

MD5
d56d86823662a663a4d614dd5e117eff

SHA1
c4d931ef8ad2c9c35d65b231a33e61428472d0da

SHA256
f1167a45d4b8002053670ef6991ca66d1bab9dcc03e4ef00183674d2f3fb9cac

SHA512
ff48daeca92c5a7657aa9c7fe41c5ae75a5fa0aad05c655bacb64a40acfe93ffd3d40bef16544614ce8a38db3e1df177023101773f6f7c1d32031413270e42d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\libs\optifineinstallwrapper.jar

Filesize
3KB

MD5
8967319339fd7ff2a67b3a9eab3e4b93

SHA1
03e69508f50bffba71390c367fbc5e8c00d07335

SHA256
f4c5909042743c4a7206f52ae352fbfcad807185a985884314044b236ccb24c0

SHA512
e376022ce07135b77d46da898c27bf49239332e88410b4a20362e9f4ada0fb2a02b7cdbd00bfc0f11d3228ce56e77cd165b77baf41c21790dbb52ccf771555a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\licenses\aperature.license.txt

Filesize
1KB

MD5
1837a1eb671079c67ed2724719588c48

SHA1
ed2c02b395fdeb3b56d0d4258c677a1329e78e54

SHA256
ca1baea19e60be57dccc08a4cd82e75eca24ca683980cb1ff212824a964fd6b6

SHA512
1df4217f219e0826c07d8bd8ebfff17d2cf34691c3450c23f84edf2bb35886bc6244b1897cfcbbc6b47f4c70e1c84a698bd48177c2fbb2f2154d2c005305e506

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\licenses\autofriend.license.txt

Filesize
1KB

MD5
318bceaa1151b1b6bffabad8dae01498

SHA1
c776fc09a2e25058149deb3bfa163c0053860a90

SHA256
ddae5748ee219e263f4239460d07d38a10852fc1f6693fe2765e28037783dd88

SHA512
60c8960d6fdeb04711f6aa2713a66b05d3f7008ee33c4d762fe30f98f266b81a6c198a68aa0ea73bcd1ff4eea88db56ccd1a680c11db4ebfc444896da6b80a7e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\licenses\autotip.license.txt

Filesize
1KB

MD5
5b0b97f483331418e30c469af896d87b

SHA1
3e0ae2526e0f2809c81d524b8507fb64fc2bb4ae

SHA256
09716796eb67471c518f3f4e567377d5ea5179c36e10bc0b30afe1261b770442

SHA512
5882826f7f2c9921d5c309aaba79ea30bf57f95816058b2f1c26c3ec9848c8dcdae91d58512092dd7647f41f74f57975aadd9d048e18d8567dd3ed8a5b28b12b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\licenses\badlion.licenses.txt

Filesize
9KB

MD5
a2ed77a24bd53e33a3fd458d99e9be0f

SHA1
07af4fb75f3122867c9e3255ad6d1e11fca88808

SHA256
803a15fe94c8ab1f4adf1a62fa043d414d3e4c1281c74cee57e6976474bbba05

SHA512
8649571f5670a36e7fd011e533c394b0f28f51045abcdcb3928d731f02366cbc286b88cb4463d86e07e92b967d81cacda74a58f658843d89669045530324524d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\licenses\cairo.font.license.txt

Filesize
4KB

MD5
5a540f4d98fc81713b81aeadc530c6ed

SHA1
273c8a98fc1b2709cfce81d7f6960b63326e5485

SHA256
17b90cece30db64934b7299fd76b033a3774c8a990e78badc74c59a5be8e0727

SHA512
12b5e3d50da4d0aef2badcf784554257e7c8dcd9f598acca500861c1f0bb4686fd238c6ad8c2259b5047140e10d731e928490fa474577b7d847d387c9c07d702

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\licenses\chromium.license.txt

Filesize
1KB

MD5
8694b4a605dcd105b40d081ad09f0f46

SHA1
6666d31977554cf9d1558cbc63c339e8b07e3c94

SHA256
73392d01c89eff27363d32973ba9fdce354b4bd82f90192bf8773174e358538a

SHA512
17c5eb20d00902789d172c78379cc80b0c77696f3d2e076af79a056d537e2a0d68a0066a8fd132b3b7b20186dba509b1833128c2f082f2fb97058070336baad6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\licenses\discord.license.txt

Filesize
1KB

MD5
f8cba3d1a6a62d09224f131fd3054008

SHA1
661a941700833f7229cb17d206f1d25e23301a2d

SHA256
cc981e3b2afd06ab5a1cdab7ced3cbb8a69145b5e2388485b806f6634313ff4f

SHA512
4517c0046d156c67f3d7fb37e5985904de476cdb75ad7114eeb2fefd9957b67b07ef1cff02cae1ea37503e34eb0d7cd0bdba03fad5aadeaf6d070855e481edd8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\licenses\disruptor.txt

Filesize
11KB

MD5
ae32a12a5be0d4878506f2c7927826c7

SHA1
ef0f419dca631ac1219e19af5b4a5a0875f68da5

SHA256
eaa350f6f6982e086b1ae1c3b70743d1f3653164b4a4832f02d7baa134ef028f

SHA512
a80642b73b5b968c1e8b44449972449e17e6c3e46c2beffee1d524faa363b48d2540c0d7db6289183065af975aec1e8c45833ac1e1cd3e2c85f5fdae955791c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\licenses\ffmpeg.license.txt

Filesize
34KB

MD5
e62637ea8a114355b985fd86c9ffbd6e

SHA1
1eba7caf09a39110ad2f542e3ed8700d1a69c6d3

SHA256
230184f60bae2feaf244f10a8bac053c8ff33a183bcc365b4d8b876d2b7f4809

SHA512
714d66c4a17e6dfc1553521af2be03f4579fac64048c0b96c592177562b01fc70a8e184bb21725e11ef96a54bf466ae1abd4992b8940f0fe2c0859d6a166a2ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\licenses\ffmpeg.readme.txt

Filesize
4KB

MD5
46efd225e4f70c87659ee3728c4cc352

SHA1
3772c422a0f862d32a0cdd082479e432051f17e6

SHA256
20243b750670270b8cb8cfa8b44f120814751d744c973ebba52284968b602544

SHA512
3a7ab5b99537984212d204aa83b0dbce97afdbab9f8dac554d9afcd506bed6e4617e72be84bbb710e79352caeaaa6ebcc728b19c12ada7574c0817d35640664f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\licenses\flag-icon-css-license.txt

Filesize
1KB

MD5
d0bc1323b617fbb4d3232b745ff45dfd

SHA1
5c11645d0455590741dacb68d3eb1d253a5ec106

SHA256
5f6432917a260a6e8f7022742bb6cb8761b1d17cf45083e30174908041405225

SHA512
dec0dd099dd2a778f5afd129750175e42335677b199f1d5e2ad10ec2459c803e3168c6e89f44bc9544fe8a5513b85eb2d53db65b3ad6ccfe77ea0a8ccdcdb131

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\licenses\freetype-jni.license.txt

Filesize
1KB

MD5
5db6495b17d58ad312a32e5791c61097

SHA1
428650191730f35163e8ec78a25126869b2ab1e2

SHA256
d10f28ec38b68a33bd4deb7239ba86e2f43a26f81dfa2d53f2ac89a88e2685aa

SHA512
7520cd5dc59f6899bd542a713ca045f64a9dd90751db7e5ab197d1c8a25e94aaefb9eb8d69a6b3c9ff5b1d433c85cdd67d36cd333fd33c824ffff53bc187cad9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\licenses\freetype.license.txt

Filesize
6KB

MD5
02891d3fb5adadff2546b4279649112b

SHA1
1b299099e16ad96ebf53e67391685d9d0a51b368

SHA256
650737ec7589c35600de73b0db88dafb314f7e32e7e3cf38d0c87ceb1a7ed31b

SHA512
630d9247498b84bb53e2c2ea4165994c141791675c192860127cdcd1ccbabc80a331604c6ae185531abb0eb3fdefe6637643e0d3f11b751e79b076b5da4f30ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\licenses\licenses.dependencies.txt

Filesize
409KB

MD5
2053245129c2910e9a1a854dcf69ece1

SHA1
294462e57e57fc416d28ef2ced053f97465e3fc1

SHA256
9b78cde2913327cb5ac2dc6f53f430b6233c52bbf3e156e969737d87cca51943

SHA512
1387d33cdc715b006844579b90137aeea7b9dd7899542667c988e8c565866d26f462e60a0d5b26bb94113291f1db659c08a4cb4a2f8a9ba32c6b5af8ddaab48f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\licenses\licenses.txt

Filesize
409KB

MD5
4a9c8bbed40470a9ffb7db1d63bbcb9c

SHA1
88a83ce9d6734d54139ee7cbfab63253cb73b415

SHA256
c0aaf6703c87055786772878c27e8d3c4ccff0efcd088d5dcf77a2fe8146c44f

SHA512
12c3b1e11dcb90c5e4ff426c1a8bec314efeef9e5b3eca1840460f1a1fe894aca4c1755b599d460e995e7f477b69887089a93dac67da2016d8c84bd98f841039

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\licenses\lunatriuscore.license.txt

Filesize
1KB

MD5
ee99c1f26cd4e6a2bda84ac34b9ff861

SHA1
0327523304d63b6addb96ba18abb6c47a3fd684c

SHA256
7a1d05e596d50dfabc0d3e206861cb778252dedb87b48b9dc7dd9cda24f5dc22

SHA512
14774897b95813736654e850fb328e7fc0a19c076417fda35a2a57e284b54fbde6619fe6a1ba953300bb54ea77ca90fa93fac4a03914027bcf186d30f645230a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\licenses\lz4-java.license.txt

Filesize
11KB

MD5
0ba5044c64ef53cb0189c9546081e228

SHA1
c8bc7df08db9dd3b39c2c2259a163a36cf2f6808

SHA256
49bbe9114e49214df2ccc324cb3ac8d1d1aa1c3a0947f94c286765e86647b32e

SHA512
a7ce8c7f21c031e4e6d037f4eabe8b200b8f1470731c05ea86028171f2964310dadc5def814d2d65164fbd23d720ecfd4d479ff5e269e519c787b4db96c7724f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\licenses\mclib.license.txt

Filesize
1KB

MD5
12873b817d4334eac6197edbc5956864

SHA1
20a910d495a276c23bc9b43faa7994338f51ce69

SHA256
5f6ad061e9e7dd5d3bfaaf8d065f14f863897c276d217c94084603680a324e72

SHA512
0323a87ba5c5f9ac5b049b6770a78590e83e74a9fdc0076b67f3669c4f1b43db240b5a86390191d3c19ed9b6d9e9c6000cbdd970f2db458252321a5fb106ec85

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\licenses\nan.license.txt

Filesize
1KB

MD5
895f9d80d77e26153e48525caeb23827

SHA1
3d7128bb4973afb706aa1f67493b537006d79937

SHA256
0bfcb5e608c491edc1621ec2d842ce5b683e05db6b38c6eded10b0630c59d2f1

SHA512
e0c278c0da87f33202bddddf739fa5f511c0b5f3176854d4f382d40dc8cc0767e71c622368561d40a2b4a37c1a9b79fd845096073077be03c6a1cf35fc152cfc

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\licenses\nativefiledialog.license.txt

Filesize
930B

MD5
292e3e89db90cb0fbffba767983a8f55

SHA1
36c4792a78a72fb5c6e315c62c4e8358b6c8d2ec

SHA256
c894fd883a9af3a9174a4ee9897451d4fc9fd56c2985c872cd37eed4a44156c3

SHA512
b21c7123f5f214a0d19497f62f9cc461fba59edf64bd1c4f5557c9d2af69cb7ea6afff8d75aafbdc6631f9164e69dd547d3265d2ae8e237a9ea39ddb9dcf705e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\licenses\notenoughupdates-repo.license.txt

Filesize
1KB

MD5
3a5337edcf43176e258e1a5ed8baafd7

SHA1
fe2b722844bb6331deef47fc5192c1e742ab5caf

SHA256
282d4b11d651c5fab2a4cb55568aa36b80eecd47ae3ac9f4c2c7978a3be53dbc

SHA512
8bf297651f29f33800793dcd1d9b26ddb9fad75a625514fb558e5b964eac5f8b760597d76f43feced41001bc0196f116fce12e0c9f17216d3b04569fa651c1d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\licenses\notoseriftc.font.license.txt

Filesize
4KB

MD5
bec6f772ed2e38634da53c388c30437d

SHA1
43513d1f6a1329962106efc212457e1d6ef9e980

SHA256
7f18ec1ebb6b50e3ed0f74b2c61f25b8d7cd69e43f4de66e991bcfd3c419a8bb

SHA512
de6c45f891db9add2d253939f35739f3c246ab93f6bde97232ecf32fadcf0afcadea4aa632e44df4ddc0e3b80e1db669f4769e9d59a04a4e38888b530fb050f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\licenses\openjdk.license.txt

Filesize
19KB

MD5
8425bcbfbe27f7f8ec1e46e9f0ae0c99

SHA1
5898367b940826f516f625dbd78fb8957f3be986

SHA256
1bd89daf45a5b68234c32104bbe9903c6c6d2d7798d61a36f21ad85482945f7b

SHA512
0323a715e5f65027a66738c1db24d2e4f6240095f710a2c06a67bc70b59e4185bb026ce7438dbeedd6cc95af8cfc0ae9259b3aa8e7d84692bf6b2b7f5a655149

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\licenses\quickplay.license.txt

Filesize
11KB

MD5
c3e1cf1c2620ba0f75411f66deee382a

SHA1
37f7156c3c10e3c09169697bf2e42bb7fdab27ee

SHA256
3cb66d8ea7938893173f73f9e938dd1501cd7d7f50bb091b76a681dc680ccf64

SHA512
cc445e11f256db1327701c33cf08e531a8c543567af2515ac06dea830ea24b154e46d229f56b25a94cf7f1cf62467bbf1979f4aa524dd65b71f62c4dd183f8fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\licenses\replaystudio.license.txt

Filesize
1KB

MD5
faddac7574586fc2805a9b3f3365767a

SHA1
bb87c11cb254b9c7693c2e62c051a10596648ecc

SHA256
eb622d5d149ea9b7ebeebededf0b20068d5471a462e0d4bd9e482c9b48f37f12

SHA512
545a11e5c6abe6ad060de4f809865acfba9f57c91f1bd3fcdf890a599923207977f429ed3059455c36136f84a937fcdb20033b2bbd2afc653eaf3ec97da0ae37

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\licenses\rubik.font.license.txt

Filesize
4KB

MD5
1a74d7f49b7531048b89d6ee3f49e1e1

SHA1
374e9b0f4d9efba8e93d5698b04dc0cdd73817d5

SHA256
5797d3461e28e3f3f540ab932fb730d6532ef7233e110b96f0aed9526776c141

SHA512
41d0fc489f4eba72bfddf70d56ba34abcc1a9fa5957fa701e88e80289fe74992be774783fc678d434a09404116b6a73f8ea9a3a36867e24ea9268a21cfca8efe

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\licenses\skyblockaddons.license.txt

Filesize
1KB

MD5
b5697125b9a58f980344d778c84eddc0

SHA1
9ae4fdf6d1ca59adbc2649667eb03ee12c50c659

SHA256
6b3411f158e9c8a7f03632c2977279852a9700f636a7cd93bad8646de6ea65bf

SHA512
491a8e6a3b5495c518ff11cf4734b546a53c83e5edcd05137c9f263d77a34bb856b05bf2a45fc80519b3c1753d4d97ea707acc7a204693a0fc3b5cf5b74e54f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\licenses\skyhelper-networth.license.txt

Filesize
1KB

MD5
27fa1700231bee88a24cd306d673af97

SHA1
ccaf356f932ddceaa1c59756b2d72c5c21c89fb0

SHA256
91b7f048db90b189dadf1db30e5cd0a95a8bbc4ab5437535815359b8186ebcf5

SHA512
5025d7044a3ba8e4a279c1dcb5be65675d61c7bca864a5face31fe6ab7a72bc980e412054294f49629a00d6e6c4b753bd1892c991a3408ad850d12a269f5ccdf

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\licenses\slim.license.txt

Filesize
1KB

MD5
b9647dfe37ebff8112b7fb0204192de8

SHA1
ae084d7c34776826e0398e73eb827682852a4b54

SHA256
5e08a239b2c110156929d97ee61ace55adc283456c72f51052eb23e0b7cac499

SHA512
3262527cd4df1c45decd80ce733e6280e3f08422daf0079af023a8ab2454c03cbae8a5e944c0fa594c845c2e1148cc531688ba7221f7de3c630b4a4367773fc4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\licenses\tiny-process-library.txt

Filesize
1KB

MD5
52607bf5b5dbb263092f9672eb5b0b1f

SHA1
ac2b9621c7b1649ccfbd31034ebdff57249802c2

SHA256
13c053468f9f56ad8f1f2c36ad23955953e0cd2aaa49e7e82b14001f2f322bf5

SHA512
88862eb3a57b6a640519e88abb843102da3d98fe228fedcd1f7875fbd2fd9d6e8f93c35aafe0343b8d7e8e1b780862066327f4b9ceed74c1b7bb8c76373e1c54

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\licenses\xdelta.license.txt

Filesize
1KB

MD5
b743e02a975dc959abb35bcda12cd4c1

SHA1
13dd1cc3f00f5ab22dd44c40a0abb13cb4512f2c

SHA256
b0b0442c47b75d2f5ae41c660574d751ccf12fcee6bbc27bde20e208802ed63c

SHA512
7d14b3253a7fcc594b84af77e9b2a053e720e9b03bf8f4b8afd82c43a1b3f579726b68ad5e688d0363ca7bee8d192cfd6ad40e1ce3819570af5c29d38e262a5f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\licenses\xxhash.license.txt

Filesize
1KB

MD5
184732fe7ad572cca839560f13667eb6

SHA1
76fcece0f58b529b1ecde86e8bf8f8bb1c652519

SHA256
ef87b7b79f4c48edd555809ab0e97b780940925589b7d5f9ff26025410c87c4a

SHA512
71bc6b522b99cf66c764a7554823e7da19ea3924226d67385fbc397128b9dc781e66c457505bd3616eca31f1d93fc25d9eaf67f9c32aa4c599da4c7d2d5c6f30

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\locales\af.pak

Filesize
481KB

MD5
94af96b7f60a4cfb9d596cd8927ba37d

SHA1
556833517bc6ad77b5427000f2c3dccad91b92e6

SHA256
716e296c2f663ad90cdde85c5134582fc2305e5ebe10649fc9653bea533500a6

SHA512
6605688a373a358ff1dfbeda1c09dd031e4a63de662555f5304843c31eb3afcedbc8ffa4dae8ddc1483b04ea24cb709ecc639a9902caa68731d8e44d04cdbd83

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\locales\am.pak

Filesize
782KB

MD5
34b24f035bad74764b7cc57420488180

SHA1
fac3fdba1a94d7676ac4d71447178cfbd1fa4e82

SHA256
9cff5c4af5997b45fb2a384bd73560e56bcb7710149e1a7e3e172d64e6eda025

SHA512
a01da4c45c6295a57248603f01a6b6231c4ce400aa3ec94e4228b26e8cea995c31d52b2008f99d0f17482aad80f1d67725c32e0f37cad6b012b1022ecde998f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\locales\ar.pak

Filesize
855KB

MD5
6b69a3e75825b3a84213417068fb0a4c

SHA1
69d3d58bf725c0a6db38603e92e49cf621a5aad4

SHA256
ab302055bbd53b8ad85833f8bad1aa37630745c321a6e1683c3dd4e7988b0e1e

SHA512
21bd198ca9f400729cc583c3e517ff6c74cc1de5a3d91cc60de296ad68d87d6d3f3882e957a52a3b952c771b46d7807b683a8bccf9b5921f9303e73aa4b12441

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\locales\bg.pak

Filesize
892KB

MD5
d08e8e493f0b3c8ab19070ab05a78af8

SHA1
c5fa430269dc2d32baa6885de2453fa84c36f2fc

SHA256
d223e994ad1aa6e747507187f724cdede8c369d2e8e0def50c4a6c912dba3880

SHA512
4b415fa2ae6ba399674f90ea67e571d90a35fff1ce93df77f20bf692b52c92bfc41e5a3622776e3979b1662fecd2d9665209d5d1d53ece1bff3ed01a28e499d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\locales\bn.pak

Filesize
1.1MB

MD5
696016f43190747d63befa354d76e50b

SHA1
3399e641930b820b627a4e28dea0a79fc457f929

SHA256
1e49980f89360b395a70e844ccd0c43b3a34eab84461b1499e7621f757149e3e

SHA512
3966fcc5988ceeb4dca79c0053fb428e5180029d44704faa4723334c69413a6eacf622e637857c1dcc096e129dd84e2369e4595ea50316cf8eb68696611a8430

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\locales\ca.pak

Filesize
542KB

MD5
df20bb77cbb74d859662fe008818c0bc

SHA1
29bc66dfebcc655971034124bcd1a7cb59e4dd9a

SHA256
588335bf283f9f34d49337256694cc2043df47c8ce294445bee906c54fde3571

SHA512
be742b87e33ccffd99cad61502b90b4fac35f3ac043092fd1709fe6d224261a7fc13d9b487ec2ef1d4d52373bceb9860ebf14f7b6d5a1b2bdeed1351195a6230

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\locales\cs.pak

Filesize
558KB

MD5
c0b5c8b3e46c715f313ee78a788401ca

SHA1
5a59b4c2214f52c63f6e8c7ef7a11662c30a1ff9

SHA256
f7eafc84e6e55fc7dcfbc749e0b7bbd7cf051390bef3dbc37f2cdeecf92637e0

SHA512
b6a28846601ee937b21dc5e7c3b19e612b2a654e4de7e9dd7943f7b981ca6c3a1c86a93ce6a4b801debbbfbf71fdb243ca81e56163d44b2bc0fe8415ca5a55c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\locales\da.pak

Filesize
505KB

MD5
a97f00b4bd958876ac55e9a3c73e7c79

SHA1
0a019a4e1077dbb735bacf7b19374bbeec1a3e6f

SHA256
247790939c3e549ebcc079b872ba8f3b9645875c0bae26fc49b36d9bf73c3b82

SHA512
fd6d89f016b679e3f4afad590a591e592eaf4a147b7d7566a745a695cadc51957c5df06d0d60d52de00f434d8d8a5fdc27aa5ae29086762c5fc4615f4302a10e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\locales\de.pak

Filesize
539KB

MD5
0e434b38cfd98a0979a4373b6ffd1b8d

SHA1
cda239ac9cbe2b93597940cad6f8554ae61bc5b4

SHA256
e1a2f20da317a6a7790dc0b2832d6533aa451a4cb2e06cf1a46525db26c96b12

SHA512
00b00aa6420dd0f7849144bc7b1d6e8ac93fe2cd759d196c5eb143a4950fe0a3af9f468fc6d952d347fc9706fffad0d5744ab5e276b4b1e0cdc5b445c90197a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\locales\el.pak

Filesize
979KB

MD5
271c3234e3a07223e6db8f6ab1c18f92

SHA1
dbc1ecc686eda75627f3fa60d034ea4021da0acf

SHA256
58ca76aa55e11a475c830ac89010d4431f455f531079c1e8a0943490b4dd8e4b

SHA512
50e6fab168889a283e26eacd7731367032db41841f39fef0f99543b98266c3784ee62a956cd4415c83a6fb7451b3f618f4f3dcf9807cf9b0f2f595ce26e24aac

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\locales\en-GB.pak

Filesize
439KB

MD5
39ec72403cad7f94d3c76843f0c64618

SHA1
02891afa3ec62e8d8ad8f7e0d9c8450fb32e48b5

SHA256
64f7936397cc422bb8e4eccffe7744911622b414517c73009dbd56ef789f3a78

SHA512
49d338f7a413b0732ad0abd43dabb5369a212e90fb3f8af0c26b903033b153364fdb38759cf8ef55dc36fa78ac3e2a8dd4068b14d048dd750a0a0559a9053e2b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\locales\en-US.pak

Filesize
443KB

MD5
88bbc725e7eedf18ef1e54e98f86f696

SHA1
831d6402443fc366758f478e55647a9baa0aa42f

SHA256
95fd54494d992d46e72dad420ceee86e170527b94d77bfaaa2bfc01f83902795

SHA512
92a5c6cfc2d88272bb5144e7ee5c48337f2c42083bc9777506b738e3bcb8f5a2c34af00c4ccc63b24fb158c79f69e7205b398c9e22634dae554410450978a2c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\locales\es-419.pak

Filesize
534KB

MD5
0b2f21294e4ef0dc26b3101e3b050c15

SHA1
6964d2e5f15767e771697488b67042ad4eb7f399

SHA256
453f699a7fa645e0e1d3427e06e65c3626540c5f68e9469e1cc18dcd141c2245

SHA512
54be2b630664ffdc02cfd58803a3e4d74edebcd814efbfc1530c777030291387f09bab5200f97951a47c70e6b1881146b798dbfc1deb2f953b9e91f3519c126e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\locales\es.pak

Filesize
534KB

MD5
2e163e56cce7f1a0feed489ead44923f

SHA1
6a1b40ce5c3f210ccc5f64383010fa4796e36df9

SHA256
ca83c63f335929fa300129c9661ec295a3d5749ee9edb0f36ba8da902ff6a6a6

SHA512
509288b4324fb5f3e7a505aed4ea806d90fd437de52b2edf773187520c12b3d280020d90e98b0c091561da7e67c83b56846065a63d5f584cca95280a8e111c3c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\locales\et.pak

Filesize
485KB

MD5
818d154524c0c900d15a8a25b3659c14

SHA1
4121be86ee3869c3c884e3467d82ca6b8f4ae0cc

SHA256
3610615dcac844cc9a64b843da606f4f8d29b1c945ecc19b288b54829d0e92e4

SHA512
1bffdc771102997bc16b3b5fb01ba009a61a85e7d9c53f32a2b2e713ff70f396a9be9431cc45ebdd28dc5eda43490b8d8d82866b42acd32f49e6368ec0b779ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\locales\fa.pak

Filesize
794KB

MD5
ce83173d23a1cef564f1bea1ff84fa47

SHA1
eec0a456badcfaca0d2a91c813208a0fdca2337c

SHA256
5b177c87681395165063b801a2c55cd535973be9de60a73ae494e72322af12ed

SHA512
d5c516d02b8a4d61cb141704a31ce83575d845b139c6dfbb770f5cfbf71604bf42d02c139b372ade1cc89dbe99f34c013815a60a1ed0ce0465d87789398d40da

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\locales\fi.pak

Filesize
495KB

MD5
671cff3aa38e9810a6fdd11c91861acd

SHA1
6062122660beade0e00cb86d9e2c8abc274f9f59

SHA256
3e69afb533da49338f036ad2c286c4193ce6b5a2476230dc4a1140cdaf03a6fd

SHA512
3127764aa594de149528b716ed135aff1e45a3fdf4a0a936b9240785812be2509f61d629c4dfae1759c87defab61e34203bf2a196381e87633d0fd02a1b76454

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\locales\fil.pak

Filesize
559KB

MD5
4990033756bc1b2410e77a607bb62f8c

SHA1
a02c0f347606bf50aa6f281e42d2d66ce6155299

SHA256
3265ae5b6c16a09b1ec9ea53181de78df75e951c3ce28f33d4c483088a9ab37b

SHA512
3d45c6dd30eea6d6929039c0cdaa7bb6f7b665fe67fc7a5ca79567d4fd3f907011857e5cb43c16cce9c558d4f669618bc5378f05fa583b19360df58b12b5f913

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\locales\fr.pak

Filesize
577KB

MD5
7a3aea67220b35635222eaaad3262786

SHA1
d1781514cc868c0f24e0b10e57ae3087da100e36

SHA256
143d6325ada3e381358d7cc7fad1b8703f6fb787a4ff3b593123506be7fd2589

SHA512
978b169d32654ba515cfa1ba8fffe7c8735c998d051f50da0aac2292fb1997b38989e271566b3eaa3dbe4701f9d0163d24e97b29f52a830f4b006540f3c2504c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\locales\gu.pak

Filesize
1.1MB

MD5
86b829b3cdcf383f11ffa787a32446a0

SHA1
c9f626a97bcf00541876caa7a49d23e0b84b83ef

SHA256
74c62dca0b7a310aa593d1dcca8b0b0b382b052837e7cae6b87cf05b8b346b1b

SHA512
72b69cc9846fb078a8c03afd60154a3b55bc828b9e13b5124a473c0ee528e3cb3ed67f67d7d763ec8e78883640c53d4c88a7a14552b851d493abf65e269353f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\locales\he.pak

Filesize
696KB

MD5
ea9c3917ea883891c1e8245b20526eaf

SHA1
7371df82fc6c7732e8895cbcf095b8146d472ee3

SHA256
9bf5261a4169fe060a8109406adb0c8210e8f88260a8f12959db2bd57400eeb6

SHA512
abd6902196fcef6026310e57482fa651b4582af4a622e243148413389eaad4a0634490584566c48b4c519ee7e0672b37f5ce9fe2d7702c5502512ef79937094b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\locales\hi.pak

Filesize
1.2MB

MD5
3751919d994ad0a1b9657b947945c5a4

SHA1
cdf66f0260e28076e56eedb07239e65cd195759f

SHA256
d9979ea297325ae36f2a467b07d41e281f0b3a9a77373cbdf76200eaed2f48a7

SHA512
8c161c5ff23cf35b6ec5c49481445d7cb978a8bafa5635d2dcdee435f73dd9bca994bdb51010223ded6c49089e5b4879ec3b4fe4a54f864fec00247c96678130

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\locales\hr.pak

Filesize
538KB

MD5
ee08edd61377c4d0aa6e1749ebe4cdb5

SHA1
a2ce9d5f682e0b61fc2a92d42a8f90a32c6ed70c

SHA256
86761c837293c3450e68905750d6888ad76cf7fea78d6468489c8ef156a444d6

SHA512
cb140f6955a3291543b419241b0c16f8dd757643d40a7241cfcf8f2bb4dfcbc495e38716f0a54c773e91bc27415cf8450e954386227f3bda81434b8331cd7296

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\locales\hu.pak

Filesize
581KB

MD5
92995b10868e466811b909c9702f1727

SHA1
6cd34086b876bf07dc1222cbd33e8fac60e401ae

SHA256
0a62d168c0f6d9d651dedb4e01be5b533b94e8617535cd70ad22717748fbbc64

SHA512
412d0f253d31eff5819fc05ed0da6284a39cd5dbc3f8dac81153511c69aef9cd3f1170d3c6a74616e3d9c51bc457045e9715456b1ef50e139f68f667d5662f53

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\locales\id.pak

Filesize
478KB

MD5
fb42de6be21c78da1b05c518c5625882

SHA1
7d8d4e28ea196e3e48df4999d94a04c0be31de16

SHA256
d9fc19e683240404a60d57037f24e1d8b20cfda4c8bcacfed577b86cd8988517

SHA512
63885e8c82dbef4902c75ae7bc4c3f953057236b07d6919bf3a9f8d1e6ec0ae2cb94cbe0366e56e1272653087faf2fb07b92b18bd312e8e1b38fc76ff5eb3922

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\locales\it.pak

Filesize
527KB

MD5
6df9010ca701d9f6730090ed0592fcbd

SHA1
362766d03ca7d8d82c8184d4b2ecd389ea014894

SHA256
be28fa81c293f15383fb54d9bf8cf8f1e48cb184b829048ffdbf764b14f89dd2

SHA512
c9c04635c38502f70913d53c9db55c5a70c6ab6686d9e37e0851d573d844c19114581b2868a73e318d9752a09a334bb5635240ecdb2c051a578098684c2fc77e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\locales\ja.pak

Filesize
644KB

MD5
e049505ad91c088b2bc6c11f478810f6

SHA1
11ccc84a0cac8b14728997eab4529e2f365e55b3

SHA256
014c329d7c5d55364b4fb237ef3b117272a53f7a7e5f0d0cb7b2861942a5345c

SHA512
51b983cbcad124687965afab566ce52fbab6d71b25022a377b091cc8f6b2435051fff70bf671df1d7e363ef64b80216cf64a6d05a472d55fbb3ba0ed29956bc6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\locales\kn.pak

Filesize
1.3MB

MD5
a48fa9762b3504adc3fe4ec828c75149

SHA1
043f6ced7e30cee906eb15dcdd3ae59b9574fb1a

SHA256
333725ea1045d44acf2c19efc765bffc38cc5cea6e9977fe583ad6e203442582

SHA512
40d983b3df4b6cd8e3df855f4062e163bdbdd5142882088e6e8d5ca30bc538af44044f61803d33e94f4527cceafc44059c5de67c847567190767d3246bb93396

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\locales\ko.pak

Filesize
544KB

MD5
1f5119dd92ec03f975380f230b443402

SHA1
c98368f16506e1c8570dea5dc402f68153f0ca7c

SHA256
35c53c68cfb1356540925a2c2dcd03adcca70c52714c8bc0fc60d56edaa1d4c4

SHA512
df5e894881609c06971e2b61346a4a9e38b21a5c69f5d574cf556aafe9a30551f164dac2d2993318e0fc2bcd09a7786c8a5e0791ac1bacd42fd790736d3e2d1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\locales\lt.pak

Filesize
583KB

MD5
1bab0f6c08b1cb26db455aaf581490dc

SHA1
3a32246b812e8ed35ddf0a6842b8bf26b19be9d3

SHA256
946351ed2d74f247dea0f2742fc36d89225355480f0cec99d71599ccce3ea9e1

SHA512
c6e4502fda62e2606e31a7c67679d59d21a04342c507e1fa39ac59156a4d1e1cab1923de4bcf30b735d5bcf89824d4283b57db11af9673b5b956c2f883a3bc7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\locales\lv.pak

Filesize
582KB

MD5
e4993f39d6fa671658aa3ce037aec60d

SHA1
2db9bfc42b07060f6e256c74a01c348cd6c2ac0a

SHA256
1e6f9a40f4fa1206117063234399bd7c1e7d198cbf6c4ad633e5e18ad0929836

SHA512
4192274330be238a93e370fc3fc8ada444b38fa1464889f0e3d0f6c5e548f7f7de14248937d45f8aa84c043078a69174ac1c9a5894fc9b4ff8f10deef6f77e5e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\locales\ml.pak

Filesize
1.3MB

MD5
9f0422326953a0c48c1db82ca2a9d639

SHA1
2305bc895e9ccc5b9a3d661e891c4f06d8a503ff

SHA256
f2fb440eb0518dc695810fcb854b20b72aa47e5ffc75c803aacf05861d35a94f

SHA512
a899dd975a56a53503b5cbc7448f54423b18bfbd917f73f0871840d6cf6a574bbaac8d735ae8de6a074cd78c43b6640e3e46be1550dcef8f8cfd1971cc1513d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\locales\mr.pak

Filesize
1.1MB

MD5
b0e1f36587445f28f22777d555683a0f

SHA1
42f7cd3c596c2f52662b86df9d9096bf822a80f3

SHA256
a674db4e60152fc17a32d4b92add129adaebfc02a1a783a12653f984447c535e

SHA512
575fdea827497ceab51df5fc8783f960b87d180f6031f0947525279d224189a6299943df37a014f7bcefc637ee23327fb1ae82eb77c175d63c515b29947ac0d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\locales\ms.pak

Filesize
502KB

MD5
c8d605a91b2b66603b379f5557783afe

SHA1
d6f294eb91675182f658158ff9399592935c779a

SHA256
7707f79a2a4aec553e68af87802a0f19d3714a25311fb7b8afdc6ff4a5b6c5ff

SHA512
a9f100dc1fe0a19a0a0a4360fff392af4e07eaed6613ab6dc61548d36afe55e4c9183e6584ca4e15feb477947ee8a79a96775718197129a555319a162281b9c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\locales\nb.pak

Filesize
487KB

MD5
d1e0429ab9ad3821bb0ad398eb3ea362

SHA1
ee4efa5aa14bb10e70f3542dbe0b256df6c99fcb

SHA256
5844a4a660e41045bf86dca31242e33a6c4726b8dbde15161261446d29ec7add

SHA512
5189abc6844372ed0c115c6ce341387514034dc2c54f068fe6b479d12ee76d5a727653fa0dabb2950eabff6e6f529c17cdd7ae822515d20b74889012d27f7032

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\locales\nl.pak

Filesize
503KB

MD5
525b638051d9ac36fa759039c17283c4

SHA1
c1922ba3bceae681b90064b60fcb85a7e6c944b1

SHA256
a2335c62cdd4875660e955b0d65d9e995946b1281ed7f34521d3ee01cedd643c

SHA512
680c18b6782f977c87ae0ecae9d1cc0e2590ad75d8146a5ee3e9b1dd9ed1081530f310e871bbd6dccbba42306d8f59778f202691e5690da1859e22d485fc75b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\locales\pl.pak

Filesize
560KB

MD5
10659a05a7180f54fc46f122ab331052

SHA1
968a0faea6eac3e82f694eb76d24228be58cb734

SHA256
16e9adf63d98e00d0a5433dc9c08253c678d5e3ccdde11783da3c94e98f65e46

SHA512
b815ed62b10bc5abf8bfcaf3a1e42f821bdccb0ebfa6ac15dfb0d1246c71f613fb8c7f2f9f57001377ab5ef700406d0ce3c338fe4a41065d98398341021aad6c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\locales\pt-BR.pak

Filesize
527KB

MD5
576c1c0bbac545348532ffe36bf27fc1

SHA1
55c614f9d31c5e6466080afdaca79b6daf8ab10a

SHA256
1deee32edff320827dbfbe22aa42e83d8caf79f95f7cf18013424da7cdadb975

SHA512
11caaa048778e258fdf2af5b442eaeadf3412921d2e50065b7217de2277980a5fde086b7d6749cb918090daf4feaeb5e89ad7876ded2fba9f62d9e809593ccda

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\locales\pt-PT.pak

Filesize
530KB

MD5
e4565bfa531c9c4344f84dc8be207c93

SHA1
5d1084ad5bff80383129850a853fe1319c23199f

SHA256
fcd194e5caf36be4958c559acbde4f28a957083bf2aceac893f9e5c9e65d8a95

SHA512
531a318e8ef1683abe4bc7b44e7d3a4d6ef907d5e7ddfa1f5cea20414dd33060981afdb8d1f4813b05be90985f10fb892f9060f6c1f2b975984f12acc8cdce6a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\locales\ro.pak

Filesize
549KB

MD5
8c922129bfb61fe14fa035d965108823

SHA1
aa8d8dac978053163a303c1f1206480144d4b330

SHA256
06c6486e8a42b447a55bd789bf2bc794354fa4be062139481e4612550f16c755

SHA512
25f9c2b75febfe607cbdd872a82338aecb5f277ed2d3d80fe0ec01289e3361445102392ea23207658ac347a774a7f47bbe19672d49f080cd6aea220da5ac3618

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\locales\ru.pak

Filesize
902KB

MD5
d3b4fb98cf7b6264153d36abb0fbdfc1

SHA1
5ee4de29ea31557cf7a6d288d4332a6bcbbbee0a

SHA256
00ed687ea8cb3ac394a7e2f789f33729811b2be5f28b35bac46fd7d03d496798

SHA512
5a3d90612a87f52e345354c47eb3a232a9b19093cff9e6555997e18c2f544e50239d845ce15da30c5df13f878f6b755dd47bddcf3f884fe05f77bce4251111ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\locales\sk.pak

Filesize
566KB

MD5
b74b01d80d6edcf13ba6514dcb1bf3f7

SHA1
405ddedaa9e3c9f3b5ddfeae6f440085c155a6f8

SHA256
7a1db23a5b4f8e4c7cbc80a832f4f4c33fe29e31d4ae78a814bd8ca85620968f

SHA512
2f649b116eb297c7ee7248a35858506f5329094c14be2e6c2cf52bca42170c519ef0446773be096c1571d1cb4502a5a840c3c934710c4900c8cd8344e4e9bd1c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\locales\sl.pak

Filesize
544KB

MD5
998585ed4b877e6cb29bef5ec5675004

SHA1
d82e9c2127062187a0ad3906579cdc491f6ecf04

SHA256
7235e631afff75cad9d25b2e5a0e74696ea6b7f4b2a05753331bbd719a0699cb

SHA512
b0d4ad73c4e1aaddd156cd115dbadcda692e314e6f5629e26aa13144e2bac5fdb432db345b68eb79f732e6e102674ebf8cb90c06570ea4d49e4045fbd8cedba4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\locales\sr.pak

Filesize
839KB

MD5
044954b860180caff2b57af02aa4e1ec

SHA1
c006f910386d7a11c9d074586c60b629131caf0b

SHA256
35e57d972a60e161f123a5783e67e250f5cae1f66a2c11b119c10b81c43bd03f

SHA512
33d8a0fb6c76364b756eb199f629f930d419ea31f631b8e6935b2efdefeca7f755a87bc3ec5422f9ca9f00da7ed5564fd90e228b0f1e9951a82cd1a4deb9b2b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\locales\sv.pak

Filesize
489KB

MD5
8132fd35c20f775508f5440b7f3d6871

SHA1
4e50c2b45c69e95f95f34398a7a4babc06420c1a

SHA256
867687296810c4a95a1876edd91ce08e57ff1894c9f22913808fee1d21362589

SHA512
e13ca94f6766a49a9b11a128bad1a5803c3ae9aaa9a8a536995eaf510da071995fa27b087fd3f14422cf21792a54b9527a1fe658947a446a6764b32a86479d3f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\locales\sw.pak

Filesize
515KB

MD5
0787972a076c6690e7938758c2a92e24

SHA1
dbf02e5a3ae26acb060b533bb006756c19122bfe

SHA256
eb96ab83e2e08e811928742590178e97454863bc581dd8574d6a644fd3c6615a

SHA512
9f3560a3b648b1a7025cd8a98c39ec7634883aade1ac2c7836fde890cc04bd009aa5c1bca8354ee1259ebcd9482326c51a7d21bdee3caf92984ecbefab35d34c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\locales\ta.pak

Filesize
1.3MB

MD5
088f7313392bd5bd898a984b434cee97

SHA1
bda9d5f5e87055674aecdb609a46a046bb0a6903

SHA256
e2868cbfde36485e8227ec24789a809ef4590f8841e5ee625cee154ba3701e78

SHA512
f8849d13924da2f5e3bb98f2aae19317d3f4260ec8e916ab88a91d6af97c9ba8fab929f91acb3b5575e30e87dda847f1192b6b2dc1d05341ce75a86a4fee8edb

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\locales\te.pak

Filesize
1.2MB

MD5
d251d089aa789bccc27a0b473d39e46c

SHA1
283d8fb6b6195b3427144773ffc4691c82e31f0e

SHA256
8dd7d206379445bd9afa4e01ab986c439cf70841d080fca6e152b453e94fcc49

SHA512
27e6f13f6c7937c8121451d70ee90d2a2ce5e519d17e882a86b29a6a78764427022c36b6a99178e9933e01500b55bcbfd0dc79a6f028a046967c2c53f78424fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\locales\th.pak

Filesize
1.0MB

MD5
f30b74c4203bc2cdf830681b14651943

SHA1
47f541c0b5ca948dd371e657ac24f7e61b402ceb

SHA256
a4c2c305aa9d3df52d988c4da2bda398e8ee81d320e9da1de7d4d366e826dbc2

SHA512
a92ac611d43287060fafc66070d7b40d4d253d32cec9cfd01c15fd7892eabbc49c1ba63d03c39919bb2ba94e974f93c73f6e455263ce4e0080fc8161587f09c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\locales\tr.pak

Filesize
527KB

MD5
94c2ca9278f0f1972bfbf15ef40b58a3

SHA1
fc20953ab1fef55ceaad816bbef325190f3f2bb5

SHA256
2228a903d36a037f4e02cff6e1a15b11139c077a0185a8ebe21137b0c2ecb2e6

SHA512
302e7008e2f776a7f547f31a4d1723ec5af266e8e743d41076342b653f4d822fec93043530bcb598556b38b676c1b6fda2763f537868224a043e3486877cb780

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\locales\uk.pak

Filesize
902KB

MD5
fe1c88fb652010a7204498885ba9a3be

SHA1
3bf77630703766a3d0562b42696f13bf4defdc42

SHA256
343f3c55d4695b7c52f40cd11c62d212bbdbe4814d2f16d15742fbc1ce45557a

SHA512
9ed204bb6f45c1dc116f14c184eff6b648afc5b1d904c1c7508d16ff804e9ca8b90f30b6449c9221921e0e85b673c0307da1182e7b96b73c1962097249b7002f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\locales\ur.pak

Filesize
790KB

MD5
7b5fed5150135b728bf8865246f7c8fc

SHA1
214b0f507ff6384b1b305f1718db43023499eeaa

SHA256
a0c752a805da7dd6608ad04625734f4d27cb75b682f51b2dc8ef08350cc7a2cc

SHA512
81fc55db4b0635e09057fd060d9eb72bda5a5fd2d2e1e4284e1b45098b287c609526c766b030dd0eaebc0836a32bcbf6dc0aae94327c103f3f736b5cd051a8a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\locales\vi.pak

Filesize
624KB

MD5
33566e475394dbcc91c562a8e3b763c5

SHA1
15b389ac113d72722a21f28b90c610c5a7a92c13

SHA256
f94e4fbdac19fc0fe6fb84b7a89685f7e2ab8525c6f9ae00c700e5918ce6d035

SHA512
a52380c2003bd19423f59d75abb818686d70a2467ab0d42a1c9f8e9614e5cd926875be5c4895aab1cd556dd009b7871bf9765cf6bbf909fe9c9857304e0ca7de

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\locales\zh-CN.pak

Filesize
450KB

MD5
847759d4cf53fd6840665a29f00761b6

SHA1
624d9b6da9467cb12ffa8a2c34dacdafecf683cc

SHA256
f42e3f9857ed17621a4ecafc6cbe76b449604eaa4a8d79599ddba538b62330ea

SHA512
6b642e16b3b5bb2948a2fd1b1e7935f43394bd5d95ccebf463fc767f725ad71cc2970583518117d94a40ab692f1d1d4e3e1129c779a026eba2e70d7b38e7b3bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\locales\zh-TW.pak

Filesize
445KB

MD5
84e058e6700ebd44cc8ad1d773976678

SHA1
37ad1b6a2c4b4d07a8d806f521b04377fd2140f4

SHA256
b7014cfcf82f9c0d79b7a3a7b7b6e3c683a605948193a3790405ca1d96cf1bce

SHA512
eaaaf9d040f8d57c79fa6315437325c50421c76bbdfc669d9b9f534be4f1a3219e77da7beb2dbc06da88bddcc92571e5dc38046e57c4a008c16759d262c4af00

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\msvcp140.dll

Filesize
618KB

MD5
9ff712c25312821b8aec84c4f8782a34

SHA1
1a7a250d92a59c3af72a9573cffec2fcfa525f33

SHA256
517cd3aac2177a357cca6032f07ad7360ee8ca212a02dd6e1301bf6cfade2094

SHA512
5a65da337e64ea42bcc461b411ae622ce4dec1036638b1e5de4757b366875d7f13c1290f2ee345f358994f648c5941db35aa5d2313f547605508fd2bcc047e33

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\native-modules\badlion_electron.dll

Filesize
17.2MB

MD5
676f616e90b312ad3efa6f3e05dd0ff9

SHA1
a2bfa9b9111d8fee3a9810390bac91b65f37cc07

SHA256
c94f7b0d8e99c3648c4c18b890a9db4512f2b094e3e97172e01d7a0dd270744d

SHA512
4badc6f9afaa47f1a46630803742811a9a7308b94142dcc6f6553333dea5f78fc1973dbbf3f5e1e68b636dece985da67130abda5e488da5aac41b3274dc1b2da

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\native-modules\badlion_js.dll

Filesize
8.6MB

MD5
69fe606b70e678455b9438ef705702fb

SHA1
47ce94e5dd777a89eccc1daf0b3b8e8aae9b25d1

SHA256
b76d929bdc901dd8ad2f3b071ab6486f1cd44b32aa417247fee7eebf04aa3290

SHA512
ae574bce7dc237e2819d759b4a16d12356189405667376066bd42899ebb78da72cbfa447baaef2dd0ab1adc203aba84909aa71a871608e7196a94fb40d93311c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\native-modules\freetype-jni.dll

Filesize
744KB

MD5
c62d69bb574942712355af981de6a8fc

SHA1
322d1f552782fe47222dbd27cd33941ee9055c52

SHA256
7cfd7fffd6ec741685453431610bd48c488a8edc158de581bcfa534dc00baf90

SHA512
229d15809c83364f39b08530e42585575e0cf52f6e9bc5f1947aaa2b3d0a5cb10559aff5de92e5d7ec3d81fb9413a1a4c747c878788056c50faa8d1ef88910ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\native-modules\launcher.node

Filesize
10.3MB

MD5
95cfb61dbdb645d419bb2912017808c4

SHA1
4ba9815f981f35ba818a7b6f7160a138a187910b

SHA256
35267a2326adff24e64052268d0cd2b8811f1bdcae2eaae37ff63f2ed60235ab

SHA512
eee7b43f8760511eea4db04f4291a4b5e22f0c3b6bd0cdc0fc35cc1625cfc05259a85b9511acfead0a02aa11f99c7b8cc24340e064835a9acf9a4c9e3947a277

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\psapi.dll

Filesize
18KB

MD5
80050af28eb0070a582b33470d20fc91

SHA1
bacf5fdb74ef5fbaf91d0475736d566ee3babc18

SHA256
65e42f8fcd039abaccd6aa815d237f1d6f7ee2067457c8ce235333226cff16b2

SHA512
780cc5783d93fd8e7dfedb291f384be4fb1c4022bea22dce991b360a2029ae42f864c540af3d75602a9975e3b66324a3b5f3ce4582ecc32918c35e00f3abf68d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\resources.pak

Filesize
5.1MB

MD5
b63989e783a36db05a8cd2787e921ca0

SHA1
892215c687c91ee68c492459db8d34d0a66476b9

SHA256
f9ea0c361c8ace0f64f16b89e82c538b5b8039cc870254c2ff54510466775296

SHA512
a2b917c8eff06ea64e2319b6af135d586ac8003d8a0e16c0ee13d315ada10f05976ccaad8c6606a4d1acd3af80d7f13978e16c388cf45366cb79f56146a62365

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\resources\app-update.yml

Filesize
222B

MD5
a85c6f31bef49be88b0a8846daf72dd1

SHA1
1563fbe30087d902674e1e6d4ad5d2a94f559fb4

SHA256
959ea658d5b7f99fc2e9c8e990f98081e019f5917316ab6c3e9e3e81e4d73c88

SHA512
87f6436610c0519daa2580bb08d1a4ca5be5c0a803b4b9db4fd797bedacb28a78d52a9891e891b1c5efa7b09da470206506ce207b61be76025f7b99a34bdf2e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\resources\app.asar

Filesize
38.3MB

MD5
ab934febcce5825f0ae7f88357c30fdb

SHA1
9f558fff9a42178237e088ac77691046822c1fd0

SHA256
6700a7ecafb842ff642293599cc18c6aa3b66f08b8f85cb5f8b3ce77446cb852

SHA512
87d965828f14600a8eab6f5e0c1ddd0b6abe950638a9ef956a57d8b2c75b2d4071d0de460b30f438ddc57eb4254929d010ecdee16135a7260c1ae302de23245a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\resources\debug-log4j2.xml

Filesize
832B

MD5
dd7150b869964d8a892cdd584948dc55

SHA1
f8053aba6ad32932509c37f9d06fff2af011ce52

SHA256
c96f78d1ca05337800a323610ef458796b5b625bd248d40c6f9a6c324509f4ba

SHA512
a31659ef05c55b0df2cde4eb7f3ba5e6f7152af9bdc9e70155469259bd05275a497e751aaa315c7fe2357e6a4c1fa0c42a84a7e4a7ff517cc76ea1d32aa383ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\resources\elevate.exe

Filesize
115KB

MD5
2f9a88fd51412b3a325988b47c33ac35

SHA1
55a64d08620f36434f9101e6ea4c99acbaac2ed8

SHA256
1c08f121ca7301ce587cfdcf70ba0614ede1ab8497d1ae90a37b5f2ff05bb98a

SHA512
c5cd996aef3012852f4761ebac2c5ed620143a9102a8db4e60e7e05e76797c373fe82b850297ab9284481a4cdb72d5331f239f5c8c0c2005eee925030165e44c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\resources\roots.pem

Filesize
279KB

MD5
bec29e7471bdfd13632a88a0e1177a4e

SHA1
f06003491572f8c18b6c18f1857562562eb48032

SHA256
00598bc1f737f7cc56eb82e58137a3e65c6f5a840011db174b5b65076311270e

SHA512
629862482f92323a07ea5f514b36271b4d4b3b8a46f1f2d3b654c8b1113eea1cb05dd1689599c076425e4ee88c461b245d2d06eea9711b95ecb7758340bf692f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\snapshot_blob.bin

Filesize
300KB

MD5
f7c9b4ea6c9d3e22236cb9aef84bb6c5

SHA1
56d24d42dd338ece109c11ed2ed06f4b25d5a100

SHA256
43ef9734d64580cc3dd0b9eb4f17ef69fe44945f1e34cb1342537facfc25d641

SHA512
a640e365950b9cc2d8b44650b21f88f483da39ea16261b5b5f59a14d9a97aa388551c2fbf44820324b23a0b97d8ff1f442582dbe19c3e03db4c183b680bf50a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\ssleay32.dll

Filesize
444KB

MD5
c87e22c79b0653a27e0f9e6b1a9ac8bc

SHA1
bd37e85bf38192614d2b8fb5048d7e9f38eb34ac

SHA256
4a53f602f4891247dec42ce9a79862192cc80e12f40e6b4bb0a8db25052c8132

SHA512
97bc98e134636bff81bbfe3275141106377fa4dcf63bd191151a8f6d1c5109ac49eae81a89bdd90e5e2e5aeba274d673f646c0aa65f3dfd673ec2b23067417b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\ucrtbase.dll

Filesize
978KB

MD5
cca4929ef8dd988d7221ef6ba398f1b5

SHA1
1d21e60e56a15038702dc18148be8cecee279890

SHA256
4292c29e74d90aef21bbad50e8fe25858c5990846adb629372ca6fd717cd0ca3

SHA512
d990d1370201541e7a1e1ec9b68e40a984d0195847010919148d0de80d2a2c51bcccfeeca59087fca95ab410c9e170c4585c8daa1383f1383b98500d797a41ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\v8_context_snapshot.bin

Filesize
641KB

MD5
936a529299d925f06181035c01c3fc71

SHA1
1795ff36f04aeb830dc47c7648890bc4040eb711

SHA256
7249d4a31a52cdb29031445b9ccbe0ec2ff1b86c947fc16f8a0a96d5bd071898

SHA512
60fc3fa4ecef679bd1041e5c072c97ef907a0f6026aa00616cfdc69e4458cadcd2812ce0871a1aae13a5196357dbc3325589e00084bf8cbbf791db9e077a79e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\vccorlib140.dll

Filesize
386KB

MD5
3d8e0ebbb613cbe80320a61259d18514

SHA1
a69747866b33159ee14eecc9ac19a0ad1f1db4e5

SHA256
8a442077df17ac412be9072a91e4b2b39a69f1aed189034d34fdd79956d3d6b6

SHA512
83c72e2db25b86de925ad9711a03943fc4801f77d6950a23917898e877faa3276cc2c5e8605cc0132e48c1bf66cc45b172578f77d075746ac38880257e579660

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\vcruntime140.dll

Filesize
85KB

MD5
edf9d5c18111d82cf10ec99f6afa6b47

SHA1
d247f5b9d4d3061e3d421e0e623595aa40d9493c

SHA256
d89c7b863fc1ac3a179d45d5fe1b9fd35fb6fbd45171ca68d0d68ab1c1ad04fb

SHA512
bf017aa8275c5b6d064984a606c5d40852aa70047759468395fe520f7f68b5452befc3145efaa7c51f8ec3bf71d9e32dbd5633637f040d58ff9a4b6953bf1cbf

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\vk_swiftshader.dll

Filesize
5.1MB

MD5
00cd46eb8f0e7d9b32671cb625bd093f

SHA1
637d75d55e47c7f349f8a1fb987c8e385c61c732

SHA256
925ebd8b12224f730e6c909e9c6e7a663cb68ba0b9eff15afd7cb0ea35e3268e

SHA512
0bdb5b701893bee2921f4d01e5e119ff70963990d7fedadee3d2473d9142697edfc3b9708076874e0b56b3fc0917845881abb39d80998cd43f7edc55813be077

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\vk_swiftshader_icd.json

Filesize
106B

MD5
8642dd3a87e2de6e991fae08458e302b

SHA1
9c06735c31cec00600fd763a92f8112d085bd12a

SHA256
32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9

SHA512
f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\vulkan-1.dll

Filesize
935KB

MD5
47ef8be1063e93dc9ea18aa0553e675b

SHA1
f26749f45e61f8ef997a60935fc136467cec5ebf

SHA256
7871a619b9d7d3924a42eab77c75d962e8b9a27d4deb7878a0caaf36cc6f97d4

SHA512
be321c8e939aa54b32718d0516c4fd15771b21692fdcc4424dfa9dcc45b857025a90a8253bd0106eb099e354b19aae9e4f92b04b3e9299c79ac2aae305bfd913

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\7z-out\zlib.dll

Filesize
80KB

MD5
d48c270acab962aac5d222abee92c39f

SHA1
b23f9b747d859856fcad94652ebd07284fbd33c4

SHA256
809dd3e4ff98abf54aeac27cec2e0c194550bffd2f55ddfe725ea109306ae49c

SHA512
32a83196ec83bcaaabd83923409ac98201785a3915293187718d61d2cc6f8b51b10e0c7c1ce765524a8f800a3bb52dcbed430d143fb3357511644b6b666d8ac1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\StdUtils.dll

Filesize
100KB

MD5
c6a6e03f77c313b267498515488c5740

SHA1
3d49fc2784b9450962ed6b82b46e9c3c957d7c15

SHA256
b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e

SHA512
9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\System.dll

Filesize
12KB

MD5
0d7ad4f45dc6f5aa87f606d0331c6901

SHA1
48df0911f0484cbe2a8cdd5362140b63c41ee457

SHA256
3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

SHA512
c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\UAC.dll

Filesize
14KB

MD5
adb29e6b186daa765dc750128649b63d

SHA1
160cbdc4cb0ac2c142d361df138c537aa7e708c9

SHA256
2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08

SHA512
b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\WinShell.dll

Filesize
3KB

MD5
1cc7c37b7e0c8cd8bf04b6cc283e1e56

SHA1
0b9519763be6625bd5abce175dcc59c96d100d4c

SHA256
9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6

SHA512
7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\nsExec.dll

Filesize
6KB

MD5
ec0504e6b8a11d5aad43b296beeb84b2

SHA1
91b5ce085130c8c7194d66b2439ec9e1c206497c

SHA256
5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962

SHA512
3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqACF5.tmp\nsis7z.dll

Filesize
424KB

MD5
80e44ce4895304c6a3a831310fbf8cd0

SHA1
36bd49ae21c460be5753a904b4501f1abca53508

SHA256
b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592

SHA512
c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df

Download Submit
C:\Users\Admin\AppData\Roaming\Badlion Client\.updaterId

Filesize
36B

MD5
53855c1ad153a69aa8b0e0bdebc7d05e

SHA1
1cc41ca390008fcec96d90c8ce8142875bf34439

SHA256
a33d8ed65962a66fcb667f511a0aebc864c4cdae32007aac33233d8dc5a78b29

SHA512
8d733464164e195896fe133b046f4994a70089da3537c190269061e4b032f0bac0ad54bc2facbef43a48d13c5adb003656c541c3954b2627e07205dfa9db6967

Download Submit
C:\Users\Admin\AppData\Roaming\Badlion Client\7a71254f-e76b-438c-9710-7f0c3be052aa.tmp

Filesize
57B

MD5
58127c59cb9e1da127904c341d15372b

SHA1
62445484661d8036ce9788baeaba31d204e9a5fc

SHA256
be4b8924ab38e8acf350e6e3b9f1f63a1a94952d8002759acd6946c4d5d0b5de

SHA512
8d1815b277a93ad590ff79b6f52c576cf920c38c4353c24193f707d66884c942f39ff3989530055d2fade540ade243b41b6eb03cd0cc361c3b5d514cca28b50a

Download Submit
C:\Users\Admin\AppData\Roaming\Badlion Client\Code Cache\js\index

Filesize
24B

MD5
54cb446f628b2ea4a5bce5769910512e

SHA1
c27ca848427fe87f5cf4d0e0e3cd57151b0d820d

SHA256
fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d

SHA512
8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

Download Submit
C:\Users\Admin\AppData\Roaming\Badlion Client\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
63be93cf294fd619f0818bd04a3b403d

SHA1
09c9572ed035c1cc8db2897434c788d95ea6f5a3

SHA256
ab72548bb7a7c92ac0d2440e70ac00ffe40798c15c734500f59338ec73946ed7

SHA512
a900329701ff79731711c022e16878c774c3cbab667ed113c00488c53990ab9219d25306595825869f7c0a86da46348095fa3b64c078c7efe44074959d4574ae

Download Submit
C:\Users\Admin\AppData\Roaming\Badlion Client\Cookies

Filesize
20KB

MD5
b35bd3d9ce107b4e0f1ec0aec43e86ba

SHA1
a59233187694a4f996f6052b4f7aa2067b1319d9

SHA256
5bfdf7b5929c85e08fcf1ebecdb97e9da7c34428416461a0224a882b99cdd141

SHA512
cca665bdba6ade2fa683a55812e738694a6a48603adc3baac577e52116b77279779a44b6f56f15a9cc211d8def8660c930cdb43c68648f8d5e7629ae2eabc29b

Download Submit
C:\Users\Admin\AppData\Roaming\Badlion Client\GPUCache\data_0

Filesize
8KB

MD5
cf89d16bb9107c631daabf0c0ee58efb

SHA1
3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

SHA256
d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

SHA512
8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

Download Submit
C:\Users\Admin\AppData\Roaming\Badlion Client\GPUCache\data_1

Filesize
264KB

MD5
a2a8f87165327b4bcdca5a92c4ce6ed4

SHA1
3d512de8750fd6f8d7bb963afa3b55eb164f2f7a

SHA256
c822ae4653406f317c64054a5ac76b8f59ae00084b79377eb94d661df1ef846a

SHA512
bce6b1cc90e882cea551898dbf7204614dcd0f014dc84a890fac3bef6d32d2341d9f5e4e2f459e28018553ae45b36e36943d47f23e83995ad7743ad548535a82

Download Submit
C:\Users\Admin\AppData\Roaming\Badlion Client\GPUCache\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Roaming\Badlion Client\GPUCache\data_3

Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\AppData\Roaming\Badlion Client\GPUCache\index

Filesize
256KB

MD5
be1b5b158671c22b528b7585533fa445

SHA1
5658cb5015d121d597a38df52be7152265850727

SHA256
2fae4ed4ac37af8b88124b05ba9ee162df3ae70438fde6668f334f3fd6131b25

SHA512
4887894a584f3629c2c94ff50e98a972b4f818f1ee3d1c11261e8556ac5f83783caac85e9e4085fc8b5a6ac07d60848bb5d452b8e9e702fdf1b866e45eadfa7c

Download Submit
C:\Users\Admin\AppData\Roaming\Badlion Client\Local State

Filesize
389B

MD5
acbca08cd25b447146ffb32278775084

SHA1
590fa4758426fcc07c2e9df40494851e8f541e35

SHA256
1850caae9ee7b2ec903a68ddc28644f7a822ec19459cf8099f90c7eb6fb2986b

SHA512
11c434d750516767b5aeca403945bf864495528222d0ebb11b723c272f39a1b2c0b074c7782ccd9fef204b4d8d0d8042e3c2c0b2ee94b96b6845053a55292a15

Download Submit
C:\Users\Admin\AppData\Roaming\Badlion Client\Local Storage\leveldb\LOG

Filesize
259B

MD5
00abb2bf1bfdfe036835e859d2842568

SHA1
9c8ad0afdd75ea5be64b26097f831e4eda6e0626

SHA256
11cf35c5e9188a875adb648959c4ea76a9b7cb6f4897f1d1fa2d30c86134e76c

SHA512
f25423eaa33375d62674cdbd505cd5148d8d9eafe741009e902a4c2d77407c170aa86f83b8cb7f4aa10caba3cc0c348c3e3c43daad1a0422997140a365888b4b

Download Submit
C:\Users\Admin\AppData\Roaming\Badlion Client\Network Persistent State

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Users\Admin\AppData\Roaming\Badlion Client\Session Storage\000003.log

Filesize
475B

MD5
fe3fe216169e4747735f0754b40452ce

SHA1
95b1f6621ca1d4f56941bcd5ad9fb905def64ffc

SHA256
92286a64b04b47834bc5f0fa75f5ac08fe5ba3f936d3860a89fd58d9df52f1c0

SHA512
214d2e7a8394a8100b254a44a7bedb58f34f3cdc04ab849daac301a77fca95b99a6d83b9eb83bfc97cc5e86b70c57982652fbdb34512bddaa80461e83bb9dd7e

Download Submit
C:\Users\Admin\AppData\Roaming\Badlion Client\Session Storage\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Roaming\Badlion Client\Session Storage\LOG

Filesize
249B

MD5
fbc68c7500ff59701477a60c500b59b5

SHA1
e4e360a23eb9317d7af1714903572eb13eba90dc

SHA256
6e4ee0e64e9078cf78e5f2bb0a957c2b05dfa6cb4563b5fb23b4a67ee2587fb7

SHA512
dcd5daa3cb5026151cb336913745f2e3f06d8b8b2e28281932de21ba68868e38e9e65a52520fb42041239be6cdb2dd96c5d14559196c08595116950715223641

Download Submit
C:\Users\Admin\AppData\Roaming\Badlion Client\Session Storage\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Roaming\Badlion Client\config.json

Filesize
1KB

MD5
62d5d73ee869a0a2654d8fd554aaf742

SHA1
be1d557c26633ffd5edcb5caf37b2a09f47c6667

SHA256
9ef970b76a91f607002afb164aa7f01d85e20290cf242e4adafb7f6026900b59

SHA512
8706794249e1bd7fcaa3e7e25c0b976a069b02abc877a0fdf9fce408a12b4aa5c151e5e3f75fc81185f8fef84a0b9c5a908b84f60102ac9aa03aec908a094550

Download Submit
C:\Users\Admin\AppData\Roaming\Badlion Client\config.json

Filesize
1KB

MD5
d2da35e826a1e6af049f99048b4fb6ec

SHA1
ad261dccdbf7c44cdcc00a24bcd1bb4fa95da29e

SHA256
21eaa56d4ca1308f21bb534c446d5b0e56410efe28d08fd8780b75a02222d227

SHA512
d85f391144bc05992ab86569e03fe12bedee427e2b1ed7be4eb55a3a428e6bca118b23e9c567fc381b6329f60e67413cb35a06126c268b2063b8fa0d89d95162

Download Submit
C:\Users\Admin\AppData\Roaming\Badlion Client\config.json.tmp-26437727725acbcb

Filesize
1KB

MD5
ffb98039924220fb33837a443cdc5f51

SHA1
4731fbc7a581df4e0abc248aebc158fb377213a1

SHA256
9a41ec4fbdfa1329a945cc71da90f33605f5b550c8a5ffb7de31f1dd04b095ba

SHA512
e0e1011075b3da237776210fe81511177d093e8e64f3f241ca16f299a3e7198d7431b9a1a705a42073d8524ff77c7d09f0d5094f5cec689c4ba197e7dcf9b70c

Download Submit
C:\Users\Admin\AppData\Roaming\Badlion Client\logs\launcher\launcher-2024-08-03-00h-09m-27s.log

Filesize
50KB

MD5
b5dcd4163eeb19d1b6fb2aa9c6c24a42

SHA1
ce8bd0e711d6b658578302e525b171e6a47e238f

SHA256
a63f00bd2d70109d4cef57dba4c002d390e4982280cca3dfdcc32d22f5fbac6c

SHA512
64c375b262cd702aff0ea7fb2d80b86053c8b63bd3a11f59a4b8ed025fedf8a41af62f5aba04ccd18f845fd167b8d68368b913512497d8513a3811d0a2beb54a

Download Submit
C:\Users\Admin\AppData\Roaming\Badlion Client\logs\main.log

Filesize
3KB

MD5
366765270b668e53878eec6fbfb0b366

SHA1
bcb1a1f76ae2043082e258b4bcdb6381947ce0be

SHA256
c15a8143317984da7346913f0b73c048d3702e7f14355a698f219c4f428aaa47

SHA512
2011bb851fd165ad1d9b47477a9f4cb2673a228826cddaa7dc9b89b80331cd57ed55ca771ade3992ebfeda4bc4b91738a16dd9aeee8d7cabf05427b624f5aeb1

Download Submit
C:\Users\Admin\AppData\Roaming\Badlion Client\logs\main.log

Filesize
15KB

MD5
1f19a4b193e3f3c509d4caf75c4456ef

SHA1
631015ed38c04859de0ba5c9166bd9b156493987

SHA256
80ec2ee27afe1111dfd74b8902fe13492e242fd9085c8fae465a6a5c5a80aa4e

SHA512
b688cce42299d5b221519ff57749d5e13169e7cd218a84b6d2caa0ade23b1aff950b2b3b3cf0e917c54ecd167a33bac8181ccd456cb2da16f5a94cdf73dad0b5

Download Submit
C:\Users\Admin\AppData\Roaming\Badlion Client\logs\main.log

Filesize
31KB

MD5
45e127b54ba486f0a3a4b929f4b2999c

SHA1
55e1ca5d2a471b9ad50887580b7d01034d86805d

SHA256
2eec75e6f7fc3fb7282891e6e6bb73b04e97c1145e02aa3d70d6b580cd505fb6

SHA512
1e97af4e2731c6ea749dde941374d0666e64c9ad8843198a0515250c833e7798e9f77857664c887de77d096653d34bd410cd2b766804bd837bc5eed05cdc178b

Download Submit
C:\Users\Admin\AppData\Roaming\Badlion Client\logs\main.log

Filesize
1KB

MD5
6178747e4b1ff50582503426a7024efb

SHA1
a931a6e3f262eb47bc2174cced43b7b731bfc88d

SHA256
add21fdfc90043985e782fbd433afc9c190fa45e88443ad80843b1bc45c60bc3

SHA512
07109d73d9086e9ff9f4ca55f416ef9d20c283299ecd53b866dee8d61a04c60584568f9c7ef5824f84328a7dc5c6b52c84f3eee7047a49ecf11d92800c6da181

Download Submit
C:\Users\Admin\AppData\Roaming\Badlion Client\logs\main.log

Filesize
1KB

MD5
f24e8bc62c70f3b38194b021eedebdc9

SHA1
75a375d8152e419e9114a7c530173a04a8793223

SHA256
cb191c4c9538d9fdbb297e2cec6711d1899f3c9c9eb44a84b6caf6de0a3e2994

SHA512
3409a5bd9f801673e37a92de642b68e4b92e6b5aa56c905b67ba4b98e81e4b65383ba27ec8f99a272e00e0287d19214bfcec1170df6dc9025a80c18ad4370240

Download Submit
C:\Users\Admin\AppData\Roaming\Badlion Client\logs\main.log

Filesize
363B

MD5
137d2a964831006b11916f55266ddc05

SHA1
0aea1006e2b4e2a954d66c0609c0f180840ef760

SHA256
f2521a2d4b030c39a38cebde1498c89e5f4a81762360a56b98549879a82ed024

SHA512
15a5d46048270019f186a514e98d4dd2c605723efb89a5405c755b9be7157f58a3d71c0abda05305365fd2339a4bf507d2d7808e8d9d009f52ad3336780b3219

Download Submit
C:\Users\Admin\AppData\Roaming\Badlion Client\logs\main.log

Filesize
595B

MD5
1565cf76f8ddc2674456c41c5c4d57ae

SHA1
8f8969af90b2a9dce85c319acbf3d275982ec377

SHA256
65c6e94d4d34bde3a44daa01d60626dc50e98b27441428527cac09152fd0c295

SHA512
0c192fcb5138221975c6f9654e9af90d3691adf4d65dd8e4c85d2d054e0225ff7117fe322d4817faf3431a1e00e4fa9d606572b01e9099f92069b54a1ce6a7a9

Download Submit
C:\Users\Admin\AppData\Roaming\Badlion Client\logs\renderer.log

Filesize
49B

MD5
fd4718522fd36809226c4099a146f0c1

SHA1
de150e24411b2a1b3d6c73b0e2c9c76ea583a0f7

SHA256
9a77c048713dda04242c879ed9f77fba537d5abec06c69fa4cc6671249b78668

SHA512
149a36f2a1ceed9b1efacd34de5ff792eddb2d8f9558a5182433216e71abceaef76d5cf16283cda8be3b0f5c71c95dc0d9eafd8cc131918eb89a95c8b3a5989e

Download Submit
C:\Users\Admin\AppData\Roaming\Badlion Client\versions.dat

Filesize
92KB

MD5
5b89428b4bcd2775b079fd6ff8b82413

SHA1
81e1dfae77855b811f5421689f8a00992544cd8a

SHA256
96cd613e63ad0a602da6aec372ef53a4b59000bad0b5fe7d32572e0c7292b53c

SHA512
4fffce0ba39eac57ea5c385adb75adc0acded0387bf4b4a7cc8acfdaf09550c8bfc045cda7a7c0038850f977107af932d934e47cf4ecc4261cb817719e97a247

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\a19b786d-9541-48a1-b2b9-ab9ce3d21360.tmp

Filesize
203B

MD5
c4bea1d625393a151f96af8895c071f1

SHA1
3d49ef00d08121704ab888426412639d4bf78536

SHA256
61c76a1e005bcef3fbdcf4a56821b901fa9e0165a4b0b0f8138c451d7dab2730

SHA512
29b11c133735133ad9f64913724cb4520c1de6591774e553b98ae242a24a26dab3cd78021fcc04cc1b5f927fcf7afe5df8a400b795187f554c38e8fb719868c3

Download Submit
C:\Windows\system32\drivers\etc\hosts

Filesize
1KB

MD5
008fba141529811128b8cd5f52300f6e

SHA1
1a350b35d82cb4bd7a924b6840c36a678105f793

SHA256
ab0e454a786ef19a3ae1337f10f47354ffa9521ea5026e9e11174eca22d86e84

SHA512
80189560b6cf180a9c1ecafc90018b48541687f52f5d49b54ca25e040b3264da053e3d4dbb0cd38caaf496e23e516de18f500b333e3cda1fd1b25c6e9632defc

Download Submit
memory/1572-1362-0x00007FF8F5AC0000-0x00007FF8F5AC1000-memory.dmp

Filesize
4KB

Download
memory/7644-3847-0x00000263FD080000-0x00000263FD081000-memory.dmp

Filesize
4KB

Download
memory/7644-3841-0x00000263FD080000-0x00000263FD081000-memory.dmp

Filesize
4KB

Download
memory/7644-3843-0x00000263FD080000-0x00000263FD081000-memory.dmp

Filesize
4KB

Download
memory/7644-3842-0x00000263FD080000-0x00000263FD081000-memory.dmp

Filesize
4KB

Download
memory/7644-3849-0x00000263FD080000-0x00000263FD081000-memory.dmp

Filesize
4KB

Download
memory/7644-3853-0x00000263FD080000-0x00000263FD081000-memory.dmp

Filesize
4KB

Download
memory/7644-3852-0x00000263FD080000-0x00000263FD081000-memory.dmp

Filesize
4KB

Download
memory/7644-3851-0x00000263FD080000-0x00000263FD081000-memory.dmp

Filesize
4KB

Download
memory/7644-3850-0x00000263FD080000-0x00000263FD081000-memory.dmp

Filesize
4KB

Download
memory/7644-3848-0x00000263FD080000-0x00000263FD081000-memory.dmp

Filesize
4KB

Download
memory/7808-1931-0x000001FCDFB90000-0x000001FCDFD52000-memory.dmp

Filesize
1.8MB

Download
memory/7808-1921-0x000001FCC66E0000-0x000001FCC6702000-memory.dmp

Filesize
136KB

Download
memory/7808-1935-0x000001FCE0290000-0x000001FCE07B8000-memory.dmp

Filesize
5.2MB

Download