b97fd5c260a812244120a8d3df6e8756fb0c74222a5e6197a2f440f6b59807e2

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
08-08-2024 03:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

FiveModsSetup.exe
Size

91.6MB
MD5

04d56fd988cc8045e00940637399c766
SHA1

254fc55679074d077aabedfa5825a53b53c4d376
SHA256

b97fd5c260a812244120a8d3df6e8756fb0c74222a5e6197a2f440f6b59807e2
SHA512

1f3575f32d4938e90c4118d01c6ef7e9bd0faef916e9b8966e4c321b46d1640852ad9f6e8647f9d10887350eb86815e740e77619566f762362d2c51d6b6c9c94
SSDEEP

1572864:x7h2MpPi9DgwWOnUYxYbJCQw6Cgob4fTZ/idlOO6UdH7zGu4wQjx:x92Oi1gwWOJCbkOCg8AGT6UdH76u4xx

Score

6^/10

discovery execution

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
86	discord.com
89	discord.com
90	discord.com

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation	FiveMods.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation	FiveMods.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation	FiveMods.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
408	tasklist.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Executes dropped EXE 4 IoCs

pid	Process
3308	FiveMods.exe
1784	FiveMods.exe
4316	FiveMods.exe
2032	FiveMods.exe

Loads dropped DLL 17 IoCs

pid	Process
4820	FiveModsSetup.exe
4820	FiveModsSetup.exe
4820	FiveModsSetup.exe
4820	FiveModsSetup.exe
4820	FiveModsSetup.exe
4820	FiveModsSetup.exe
4820	FiveModsSetup.exe
3308	FiveMods.exe
3308	FiveMods.exe
3308	FiveMods.exe
3308	FiveMods.exe
3308	FiveMods.exe
3308	FiveMods.exe
3308	FiveMods.exe
1784	FiveMods.exe
4316	FiveMods.exe
2032	FiveMods.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3944	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FiveModsSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2876	ping.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\fivemods\shell	FiveMods.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\fivemods\shell\open	FiveMods.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\fivemods\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\FiveMods\\FiveMods.exe\" \"%1\""	FiveMods.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\fivemods	FiveMods.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\fivemods\URL Protocol	FiveMods.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\fivemods\ = "URL:fivemods"	FiveMods.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\fivemods\shell\open\command	FiveMods.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2876	ping.exe

Suspicious behavior: EnumeratesProcesses 21 IoCs

pid	Process
4820	FiveModsSetup.exe
4820	FiveModsSetup.exe
408	tasklist.exe
408	tasklist.exe
4316	FiveMods.exe
4316	FiveMods.exe
4316	FiveMods.exe
4316	FiveMods.exe
2032	FiveMods.exe
2032	FiveMods.exe
2032	FiveMods.exe
2032	FiveMods.exe
3944	powershell.exe
3944	powershell.exe
3944	powershell.exe
3308	FiveMods.exe
3308	FiveMods.exe
4648	msedge.exe
4648	msedge.exe
4304	msedge.exe
4304	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4304	msedge.exe
4304	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	408	tasklist.exe
Token: SeSecurityPrivilege	4820	FiveModsSetup.exe
Token: SeShutdownPrivilege	3308	FiveMods.exe
Token: SeCreatePagefilePrivilege	3308	FiveMods.exe
Token: SeShutdownPrivilege	3308	FiveMods.exe
Token: SeCreatePagefilePrivilege	3308	FiveMods.exe
Token: SeShutdownPrivilege	3308	FiveMods.exe
Token: SeCreatePagefilePrivilege	3308	FiveMods.exe
Token: SeDebugPrivilege	3944	powershell.exe
Token: SeIncreaseQuotaPrivilege	3944	powershell.exe
Token: SeSecurityPrivilege	3944	powershell.exe
Token: SeTakeOwnershipPrivilege	3944	powershell.exe
Token: SeLoadDriverPrivilege	3944	powershell.exe
Token: SeSystemProfilePrivilege	3944	powershell.exe
Token: SeSystemtimePrivilege	3944	powershell.exe
Token: SeProfSingleProcessPrivilege	3944	powershell.exe
Token: SeIncBasePriorityPrivilege	3944	powershell.exe
Token: SeCreatePagefilePrivilege	3944	powershell.exe
Token: SeBackupPrivilege	3944	powershell.exe
Token: SeRestorePrivilege	3944	powershell.exe
Token: SeShutdownPrivilege	3944	powershell.exe
Token: SeDebugPrivilege	3944	powershell.exe
Token: SeSystemEnvironmentPrivilege	3944	powershell.exe
Token: SeRemoteShutdownPrivilege	3944	powershell.exe
Token: SeUndockPrivilege	3944	powershell.exe
Token: SeManageVolumePrivilege	3944	powershell.exe
Token: 33	3944	powershell.exe
Token: 34	3944	powershell.exe
Token: 35	3944	powershell.exe
Token: 36	3944	powershell.exe
Token: SeIncreaseQuotaPrivilege	3944	powershell.exe
Token: SeSecurityPrivilege	3944	powershell.exe
Token: SeTakeOwnershipPrivilege	3944	powershell.exe
Token: SeLoadDriverPrivilege	3944	powershell.exe
Token: SeSystemProfilePrivilege	3944	powershell.exe
Token: SeSystemtimePrivilege	3944	powershell.exe
Token: SeProfSingleProcessPrivilege	3944	powershell.exe
Token: SeIncBasePriorityPrivilege	3944	powershell.exe
Token: SeCreatePagefilePrivilege	3944	powershell.exe
Token: SeBackupPrivilege	3944	powershell.exe
Token: SeRestorePrivilege	3944	powershell.exe
Token: SeShutdownPrivilege	3944	powershell.exe
Token: SeDebugPrivilege	3944	powershell.exe
Token: SeSystemEnvironmentPrivilege	3944	powershell.exe
Token: SeRemoteShutdownPrivilege	3944	powershell.exe
Token: SeUndockPrivilege	3944	powershell.exe
Token: SeManageVolumePrivilege	3944	powershell.exe
Token: 33	3944	powershell.exe
Token: 34	3944	powershell.exe
Token: 35	3944	powershell.exe
Token: 36	3944	powershell.exe
Token: SeIncreaseQuotaPrivilege	3944	powershell.exe
Token: SeSecurityPrivilege	3944	powershell.exe
Token: SeTakeOwnershipPrivilege	3944	powershell.exe
Token: SeLoadDriverPrivilege	3944	powershell.exe
Token: SeSystemProfilePrivilege	3944	powershell.exe
Token: SeSystemtimePrivilege	3944	powershell.exe
Token: SeProfSingleProcessPrivilege	3944	powershell.exe
Token: SeIncBasePriorityPrivilege	3944	powershell.exe
Token: SeCreatePagefilePrivilege	3944	powershell.exe
Token: SeBackupPrivilege	3944	powershell.exe
Token: SeRestorePrivilege	3944	powershell.exe
Token: SeShutdownPrivilege	3944	powershell.exe
Token: SeDebugPrivilege	3944	powershell.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4820 wrote to memory of 4896	4820	FiveModsSetup.exe	88
PID 4820 wrote to memory of 4896	4820	FiveModsSetup.exe	88
PID 4820 wrote to memory of 4896	4820	FiveModsSetup.exe	88
PID 4896 wrote to memory of 408	4896	cmd.exe	90
PID 4896 wrote to memory of 408	4896	cmd.exe	90
PID 4896 wrote to memory of 408	4896	cmd.exe	90
PID 4896 wrote to memory of 448	4896	cmd.exe	91
PID 4896 wrote to memory of 448	4896	cmd.exe	91
PID 4896 wrote to memory of 448	4896	cmd.exe	91
PID 3308 wrote to memory of 4348	3308	FiveMods.exe	97
PID 3308 wrote to memory of 4348	3308	FiveMods.exe	97
PID 4348 wrote to memory of 4344	4348	cmd.exe	99
PID 4348 wrote to memory of 4344	4348	cmd.exe	99
PID 3308 wrote to memory of 1784	3308	FiveMods.exe	100
PID 3308 wrote to memory of 1784	3308	FiveMods.exe	100
PID 3308 wrote to memory of 4316	3308	FiveMods.exe	101
PID 3308 wrote to memory of 4316	3308	FiveMods.exe	101
PID 3308 wrote to memory of 2876	3308	FiveMods.exe	102
PID 3308 wrote to memory of 2876	3308	FiveMods.exe	102
PID 3308 wrote to memory of 2032	3308	FiveMods.exe	104
PID 3308 wrote to memory of 2032	3308	FiveMods.exe	104
PID 3308 wrote to memory of 4268	3308	FiveMods.exe	105
PID 3308 wrote to memory of 4268	3308	FiveMods.exe	105
PID 4268 wrote to memory of 3944	4268	cmd.exe	107
PID 4268 wrote to memory of 3944	4268	cmd.exe	107
PID 3308 wrote to memory of 4304	3308	FiveMods.exe	112
PID 3308 wrote to memory of 4304	3308	FiveMods.exe	112
PID 4304 wrote to memory of 2584	4304	msedge.exe	113
PID 4304 wrote to memory of 2584	4304	msedge.exe	113
PID 4304 wrote to memory of 4620	4304	msedge.exe	114
PID 4304 wrote to memory of 4620	4304	msedge.exe	114
PID 4304 wrote to memory of 4620	4304	msedge.exe	114
PID 4304 wrote to memory of 4620	4304	msedge.exe	114
PID 4304 wrote to memory of 4620	4304	msedge.exe	114
PID 4304 wrote to memory of 4620	4304	msedge.exe	114
PID 4304 wrote to memory of 4620	4304	msedge.exe	114
PID 4304 wrote to memory of 4620	4304	msedge.exe	114
PID 4304 wrote to memory of 4620	4304	msedge.exe	114
PID 4304 wrote to memory of 4620	4304	msedge.exe	114
PID 4304 wrote to memory of 4620	4304	msedge.exe	114
PID 4304 wrote to memory of 4620	4304	msedge.exe	114
PID 4304 wrote to memory of 4620	4304	msedge.exe	114
PID 4304 wrote to memory of 4620	4304	msedge.exe	114
PID 4304 wrote to memory of 4620	4304	msedge.exe	114
PID 4304 wrote to memory of 4620	4304	msedge.exe	114
PID 4304 wrote to memory of 4620	4304	msedge.exe	114
PID 4304 wrote to memory of 4620	4304	msedge.exe	114
PID 4304 wrote to memory of 4620	4304	msedge.exe	114
PID 4304 wrote to memory of 4620	4304	msedge.exe	114
PID 4304 wrote to memory of 4620	4304	msedge.exe	114
PID 4304 wrote to memory of 4620	4304	msedge.exe	114
PID 4304 wrote to memory of 4620	4304	msedge.exe	114
PID 4304 wrote to memory of 4620	4304	msedge.exe	114
PID 4304 wrote to memory of 4620	4304	msedge.exe	114
PID 4304 wrote to memory of 4620	4304	msedge.exe	114
PID 4304 wrote to memory of 4620	4304	msedge.exe	114
PID 4304 wrote to memory of 4620	4304	msedge.exe	114
PID 4304 wrote to memory of 4620	4304	msedge.exe	114
PID 4304 wrote to memory of 4620	4304	msedge.exe	114
PID 4304 wrote to memory of 4620	4304	msedge.exe	114
PID 4304 wrote to memory of 4620	4304	msedge.exe	114
PID 4304 wrote to memory of 4620	4304	msedge.exe	114
PID 4304 wrote to memory of 4620	4304	msedge.exe	114
PID 4304 wrote to memory of 4620	4304	msedge.exe	114

C:\Users\Admin\AppData\Local\Temp\FiveModsSetup.exe
"C:\Users\Admin\AppData\Local\Temp\FiveModsSetup.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4820
- C:\Windows\SysWOW64\cmd.exe
  cmd /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq FiveMods.exe" | %SYSTEMROOT%\System32\find.exe "FiveMods.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4896
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "USERNAME eq Admin" /FI "IMAGENAME eq FiveMods.exe"
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:408
- - C:\Windows\SysWOW64\find.exe
    C:\Windows\System32\find.exe "FiveMods.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:448

C:\Users\Admin\AppData\Local\FiveMods\FiveMods.exe
"C:\Users\Admin\AppData\Local\FiveMods\FiveMods.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3308
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "chcp"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4348
- - C:\Windows\system32\chcp.com
    chcp
    3⤵
    PID:4344
- C:\Users\Admin\AppData\Local\FiveMods\FiveMods.exe
  "C:\Users\Admin\AppData\Local\FiveMods\FiveMods.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\FiveMods" --mojo-platform-channel-handle=2324 --field-trial-handle=2328,i,13599214855348985814,14899391261720915283,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1784
- C:\Users\Admin\AppData\Local\FiveMods\FiveMods.exe
  "C:\Users\Admin\AppData\Local\FiveMods\FiveMods.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\FiveMods" --app-user-model-id=electron.app.FiveMods --app-path="C:\Users\Admin\AppData\Local\FiveMods\resources\app.asar" --no-sandbox --no-zygote --first-renderer-process --disable-breakpad --disable-lcd-text --enable-threaded-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-zero-copy --disable-partial-raster --enable-gpu-memory-buffer-compositor-resources --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2424 --field-trial-handle=2328,i,13599214855348985814,14899391261720915283,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:4316
- C:\Windows\system32\ping.exe
  C:\Windows/system32/ping.exe -4 -w 5000 -n 1 -l 32 fivemods.app
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2876
- C:\Users\Admin\AppData\Local\FiveMods\FiveMods.exe
  "C:\Users\Admin\AppData\Local\FiveMods\FiveMods.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\FiveMods" --app-user-model-id=electron.app.FiveMods --app-path="C:\Users\Admin\AppData\Local\FiveMods\resources\app.asar" --no-sandbox --no-zygote --disable-breakpad --disable-lcd-text --enable-threaded-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-zero-copy --disable-partial-raster --enable-gpu-memory-buffer-compositor-resources --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3120 --field-trial-handle=2328,i,13599214855348985814,14899391261720915283,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:2032
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command "$Action = New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Local\FiveMods\FiveMods.exe' -Argument '--task'; $Trigger = New-ScheduledTaskTrigger -Daily -At '18:00:00'; Register-ScheduledTask -Action $Action -Trigger $Trigger -TaskName "\"Updater Task FM\"" -Force;""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4268
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -Command "$Action = New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Local\FiveMods\FiveMods.exe' -Argument '--task'; $Trigger = New-ScheduledTaskTrigger -Daily -At '18:00:00'; Register-ScheduledTask -Action $Action -Trigger $Trigger -TaskName "\"Updater Task FM\"" -Force;"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.com/
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff8847e46f8,0x7ff8847e4708,0x7ff8847e4718
    3⤵
    PID:2584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,8872239949687139965,16160493477919370027,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2204 /prefetch:2
    3⤵
    PID:4620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2172,8872239949687139965,16160493477919370027,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2172,8872239949687139965,16160493477919370027,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2816 /prefetch:8
    3⤵
    PID:2616
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,8872239949687139965,16160493477919370027,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
    3⤵
    PID:3940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,8872239949687139965,16160493477919370027,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
    3⤵
    PID:1192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2172,8872239949687139965,16160493477919370027,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3920 /prefetch:8
    3⤵
    PID:1044

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1620

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1684

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x324 0x4d4
1⤵
PID:4004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\FiveMods\chrome_100_percent.pak

Filesize
132KB

MD5
e4cbb48c438622a4298c7bdd75cc04f6

SHA1
6f756d31ef95fd745ba0e9c22aadb506f3a78471

SHA256
24d92bbeb63d06b01010fe230c1e3a31e667a159be7e570a8efe68f83ed9ad40

SHA512
8d3ea1b5ca74c20a336eaa29630fd76ecd32f5a56bb66e8cef2bce0fa19024ea917562fd31365081f7027dde9c8464742b833d08c8f41fdddc5bd1a74b9bc766

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2783c40400a8912a79cfd383da731086

SHA1
001a131fe399c30973089e18358818090ca81789

SHA256
331fa67da5f67bbb42794c3aeab8f7819f35347460ffb352ccc914e0373a22c5

SHA512
b7c7d3aa966ad39a86aae02479649d74dcbf29d9cb3a7ff8b9b2354ea60704da55f5c0df803fd0a7191170a8e72fdd5eacfa1a739d7a74e390a7b74bdced1685

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
099f3d4f67aa6580814fe2253db93ea5

SHA1
abee2e3114fe21f85e3ecd5bd967cc10f30e9f60

SHA256
c089399e658e16c463d7abfc55ac691b621d261ec14e8c0db03bd7ce6b3df26f

SHA512
8f5776ef67b23a71264053340020973e6ebb294fe27b6c015f6515b7db74daed2d9532bb2b9bfde2ecc6503858504d5429b2aa46d085a563c94a37c40ab32915

Download Submit
C:\Users\Admin\AppData\Local\Temp\03d0f2d1-2fa0-43d1-bd3a-445fe5a75fb5.tmp.node

Filesize
251KB

MD5
0b3ffb5b756beae28d8d9da67c288283

SHA1
7c2a0be0a5ab1b936c4752254927f5ed066abe5a

SHA256
462e527de86494f96ed0d42a80c261e46bb57352e86d6175607186c1dcdfc7b0

SHA512
a1568e7d02bd34992236c587cd77404e4cc9c25011a075dc0cbe52b59ae254eea65cc31ee7fdf26898386e370a752df8bbb2ce70592244d6f24b10d39f9f7854

Download Submit
C:\Users\Admin\AppData\Local\Temp\77f14c11-61f2-4702-aa44-7cb506fbf3bd.tmp.node

Filesize
613KB

MD5
174c50bb9795f9d23b87158da5cfa977

SHA1
f5d963f733d9a82490bd828051b45c2b322b032b

SHA256
77ad8327ae7fb12e0d6b8f3d806311be07d2c34cca0da720cab2af4cb8c30435

SHA512
bf9bb12ac5b4a38fba44736ddefd48afb98ba3b5ce9ee262ea24ae7d41b8d4a41cb5a8c66336218e40cc20c2df75166b11587ea4c4a6764e5942a7cfa110b769

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_v1431r5u.qci.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\bc2ba44c-1891-4620-86ba-f55e7d582aca.tmp.node

Filesize
143KB

MD5
1d0d8685ce856cbab1f50034e2b6a423

SHA1
06c480eb785c4fe82f007a39cbcb58e124602a32

SHA256
3185bb232e572193f94ac13139cf7574645c834028f63b4bd77351f174d8b6d6

SHA512
8d1ae40378c680d78dfd5dce74657bd767e2db9d09a2a798a73b5a2f541f6729af4991ea828dfe52844011737e7c260db37b73748ff73b843fd80125927f25f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxA5E6.tmp\7z-out\LICENSE.electron.txt

Filesize
1KB

MD5
4d42118d35941e0f664dddbd83f633c5

SHA1
2b21ec5f20fe961d15f2b58efb1368e66d202e5c

SHA256
5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d

SHA512
3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxA5E6.tmp\7z-out\LICENSES.chromium.html

Filesize
8.4MB

MD5
e400cd908b8fb7c13985e2f5cc7a7044

SHA1
bbafebdf5b067a7d7da130025851eaa52ec3c9d7

SHA256
ee3b1ab8794c749673ce9bd2dd302f12d69f0a1a4adfe40a64247746cc311829

SHA512
e7ca440f0e042d7fcfa99367426bf19899a2b227c6d7b6e2c25d4f1a40113250f21ebeaaf91067d8569dfbad1415d4fe3e5626d7254722f2778497fcb22e5d6e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxA5E6.tmp\7z-out\chrome_200_percent.pak

Filesize
191KB

MD5
99b95d59d6817b46e9572e3354c97317

SHA1
6809db4ca8e10edd316261a3490d5fc657372c12

SHA256
55d873a9f3ac69bbf6eb6940443df8331ebd7aa57138681d615f3b89902447e7

SHA512
3071cfeb74d5058c4b7c01bfe3c6717d9bb426f3354c4d8a35bd3e16e15cde2f2c48238cb6382b0703b1cc257d87fcecfb84fbf4f597f58e64463ceede4366dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxA5E6.tmp\7z-out\d3dcompiler_47.dll

Filesize
4.7MB

MD5
2191e768cc2e19009dad20dc999135a3

SHA1
f49a46ba0e954e657aaed1c9019a53d194272b6a

SHA256
7353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d

SHA512
5adcb00162f284c16ec78016d301fc11559dd0a781ffbeff822db22efbed168b11d7e5586ea82388e9503b0c7d3740cf2a08e243877f5319202491c8a641c970

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxA5E6.tmp\7z-out\ffmpeg.dll

Filesize
2.7MB

MD5
15c3cc618663ad92e772556bf7d1558d

SHA1
49beb2598fbaf01f62fd91c9e7e90dd6583d0175

SHA256
c47a8ccae037883173e0c3c2c3face8d4d5394f7c4492449e9bcfce6d09f5d6e

SHA512
971559d0b0a01123b2ba7816ca6f7e18c78d34a4a019ddc65cc37c9975c5bc632016ca7298d6a2fb2cedaf1d5aca41e4fabc076eab5ad8c834515249373a468f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxA5E6.tmp\7z-out\icudtl.dat

Filesize
10.1MB

MD5
62880b7d351a9f547b62b8da6c97ce25

SHA1
057f11003013cfb3f1c63e6bdd4f2f9949ff0104

SHA256
7c40c811d30d459dbf04a04c141b60eb4247cd58a008fb836605317df665748f

SHA512
0d6f83175a91d90f4cc3ec4d9071b7acd0cd8ebbcc592322e46fde2adb7198e035af62c45a11a622f2a908e26d4dd8b8d1af023e634a74d0824d02c791ba3c1a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxA5E6.tmp\7z-out\libEGL.dll

Filesize
469KB

MD5
8a5340cb6f4b3f2b994805377e55064a

SHA1
3467c3ee0f43e7f96067a4214b4a779047b513c8

SHA256
82d58ee19e2e9e4dbd1538b86826764127bd9c803786e3b0dd7ed8a20db52516

SHA512
3ba4804fb812e0ef002ed28bc427e9ba9d72d2ef1061c1f740be74f2d14292e40cc0f458cf996e682da9fbf506158cb1771a2b8520f29de08f0fa37762e22008

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxA5E6.tmp\7z-out\libGLESv2.dll

Filesize
7.1MB

MD5
7ef231a60b94dc67d845879e53253a9d

SHA1
6d8d60149e27ef0e2868cc516a2b92bca3aecf28

SHA256
75c0f506a6dbe0a69baace580625974558f794258dc55d957f1f0ffe48cf7479

SHA512
7e9d8639221b9049c36723df0098bbfafdd1b4f4b046ee74c24586fc290d2ac0b25152ef857a6bf2619a40e6791abdd62c46e36f5be5326b115c414aef14681a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxA5E6.tmp\7z-out\locales\af.pak

Filesize
425KB

MD5
2cad5db5ea641da992fd53a7b1a3a323

SHA1
d378fb0efb1d3872730e6e6754c15dec85715337

SHA256
d92ea687eb37eb017082aafee4860d3ee703c7d31800dd36f9d3d5ceb4f86865

SHA512
d301ff718cefc54d51fb815faa0adf833231e01db7ecd9cc92119820fa853bac224022e4851257205fb6e861e5ec28ddb9e4b2001afb479757a022f4a5e67aee

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxA5E6.tmp\7z-out\locales\am.pak

Filesize
693KB

MD5
5f442ca412b334854dd7a852973fce70

SHA1
a6859cb627fc6ed68f0a48694982f7e6b6877832

SHA256
ecdc38f8e18b0fb46ad100356311a7b1f8ff7b10060f1c2b0bb2945d5bfe7492

SHA512
4d7c528c7ffc9edba5d544efda4a077e7f6a97a42b014c90f793b9c7e28e10921316b9948d0f2f82f383c16b33bac22be1b945ea12b1083838b99e27c66c5ddc

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxA5E6.tmp\7z-out\locales\ar.pak

Filesize
757KB

MD5
f78877d596c1a71cba1878242827db85

SHA1
64b1c4501af798f55af262e6cce803e58009556d

SHA256
efdc75d31b9cddb08ba85f326c105235b4e1cc9406d4c08f96f1b6ab97946ca9

SHA512
860beb924db56ae3d71d9ad74d6d6e97202035d102e68f6c67a5a53bddaf59b5f29657400fdf516387217eafb5655429b076e19b2e9f17134ab570592edda776

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxA5E6.tmp\7z-out\locales\bg.pak

Filesize
787KB

MD5
10864a2c117e476957362c9532392d48

SHA1
edd3a22ead5d1a1742bdc5f03f358164eb43753b

SHA256
712e02b9245efce980ead070c1b3b92bbaebe942121f68c06743d6f5fdab6e7c

SHA512
5a5499a0ec50ab0bf30da24d11ec4aa590c774faea7880ae9f01b521340e53afd79940e05673c162566d87ecbcb15a150be105ab96e9557d2480f5999d814733

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxA5E6.tmp\7z-out\locales\bn.pak

Filesize
1018KB

MD5
1b945050e4c512db5945a8257281cddc

SHA1
3274588831f1bafc26ceecc4c280b1fd4f5236db

SHA256
09f00d5b2786ff632d29cfc9cfe2d9bc81bf66442015d97eb721e2a2f331101f

SHA512
d0d44af4a82f8e14158c6e5b3aa272f16e9db7a2dfd203105f6e648298d6fff43da08081622ec38e376fba10fe2bf963d93a5bcff9a1893311afebaa3658e7ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxA5E6.tmp\7z-out\locales\ca.pak

Filesize
479KB

MD5
099a6f0c07eeca1f3112b484a4cc8fc4

SHA1
b0af44af1fa831b9236c32a6fe65eab1e44549b4

SHA256
62444fc120fa961d2aa793718bb379e028669b24606081f2f92ca8b775b57fc2

SHA512
da2ae6dc569eda694974bdad4cffd1c0785df07c284880894d1b54145777df2726eaf7b7d014092b238c4ea1642507e62f29ce744b0e31c87906a03d928c0b67

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxA5E6.tmp\7z-out\locales\cs.pak

Filesize
493KB

MD5
8d211383002983edf082d8b8b711ee20

SHA1
8f0bbf9980cf7c74d716eae500d580aca0de8cac

SHA256
920de03fbb806be81cc3533ce1a2c47086c45fabf4a68368fa239a740753b660

SHA512
505d125207261d7a220cf0727fe7c4a9c1154d94e67dbc56684e588c659bace7415c0cc05b855cce7cd0777e36f910d909bf7222b06116f884452c6bc88a01a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxA5E6.tmp\7z-out\locales\da.pak

Filesize
446KB

MD5
a3018946498850cbc53f0695cba18cd1

SHA1
0d72682e5710452251d7bbe05cc94b15505efcdb

SHA256
73f42be213e546b137e453e395a1898295f0d9a2adadb42742a7d65654afccfb

SHA512
55a3a6d02e6bd59ea5922a3ab6da982953ef36bed759859ed9ec7e6722f873e4ea282b7ebb7505bcf12387c2f817379e24801f18172af97da1b1cdc0371ec5cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxA5E6.tmp\7z-out\locales\de.pak

Filesize
476KB

MD5
2be04da2bc064074db828194e2ffca6c

SHA1
5c91e6f4db417d889077eb3ea5c7666231216a16

SHA256
722fb8daaff00dd72120f36873373e950f9870ad409e5fb52735cc1fe762bf0e

SHA512
5b246febadd828c619c144f330529c317258894c64ab1e0e11eb35d4142ad22a1a08680b73ec11bc7a3e09db63190ccb06502383569a330ae8f4f62980e3c115

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxA5E6.tmp\7z-out\locales\el.pak

Filesize
864KB

MD5
7345a82a438aa762404138a5db51bda3

SHA1
9d90cdfb56169ac146bb7484ef2efec8d11e3104

SHA256
13bb17c673bc45195663f1a4f20172d6dd9d789f0e07600fa4e2f5d304e6c0f7

SHA512
d19517fbdd330af1c950508eadc3af91a8abcfa835fe18ff96ec7964d21254f21cdd3eda4673caa81162acc0a32b13c8c60212a92b9e51764a135e9436f40631

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxA5E6.tmp\7z-out\locales\en-GB.pak

Filesize
388KB

MD5
89a238cb2ae63d6ce1a9db2ba4a8aa52

SHA1
7fe5c3f236d03e1aaf536fdd080022e5563441f2

SHA256
df3b00fea2883d6e82ebf9180f78daf0589f05d62c1c1de4c05072e05793ceb7

SHA512
684944a83fe8c9e3d49f3cf011900ba2c2ba4962104bcc8050cf625061f280ae7acbe1771a951edd236512a025402c0c31ed9564b6530d50b28a9570412c7321

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxA5E6.tmp\7z-out\locales\en-US.pak

Filesize
391KB

MD5
7d44956c8b87bbc66fa3cc4877b8575c

SHA1
1bda88bac8f372cb854b42d4c34c3e13fc819184

SHA256
b17f0513da0133b71e6f3f6b1c519c7faafcde3cf03742091b394156cc668014

SHA512
376df4f5f33941701021b75e5c089a947c6e2021d0bfa785f81dd0e1be323d22e72e31c65500b52f32624f974b7643300d2b0b385a25fa6081c7bee1139de0c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxA5E6.tmp\7z-out\locales\es-419.pak

Filesize
473KB

MD5
c440104556d6904f5e08e128da3b34a0

SHA1
c0fb37e5ea17d4162297996c62173c3bbd8e11c6

SHA256
a247f2020b3eabd4980a0d9f155162b8b647cf692a10fa6aee53e1334cbeac84

SHA512
a989c15a0a0fe2477a3d4802de4bceb8416e24d0787b81b96941d83eac91749ed47a2feb4c5edfb8a6f29f80499cbfd408b4e99e87d2640fe3a5698be5d47ee4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxA5E6.tmp\7z-out\locales\es.pak

Filesize
473KB

MD5
e20b08182c308456d3e828acda61faff

SHA1
1688d392002f7972b5945e4dc3fa3ed67e6220df

SHA256
71666b2f0790378c2390e35c8e2503c814de34902cc990d7bd513fc0e7e9cd49

SHA512
3e41607dbbf1e7f6a257ad652a64db250db497273b16b14e57f41cb21ae357335453a7ceaacc0ba820af8e034d1682b838fe7789b43421c3ac3fa1ea7228aba5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxA5E6.tmp\7z-out\locales\et.pak

Filesize
427KB

MD5
dfbafae98055df9ac82dc57ac012666a

SHA1
32981479c3bc09bc3cf5630a1b9737a295350774

SHA256
3c685d37274dfee7e5607185b9621e2f4a8f12a24f8d37742c2e11416e347544

SHA512
168bd50a4a38c0be06f614545d1212076905e5b745cb9ce894f8938e7d9d9f6cfea691c60e71b0d6bf674270a28133fb4c77ee3370d0d47d7c621bc014c1bf7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxA5E6.tmp\7z-out\locales\fa.pak

Filesize
703KB

MD5
9d4c64590f6bfaf4364bbda9ff95f113

SHA1
bcef7ab180e70d353a78327abfed3d33a27447fe

SHA256
5992e3d1c6e998509550fb9be3ccb485a31e36b7730277879a96d9d0cb07b598

SHA512
a992052793737768917605d662c68a9329e7876cf9c4127df326e2d24e3609d5750d534f54d3510acdc9cc6a9cb46cf8f4c5a06c74cc8b11fd62eb08142ac310

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxA5E6.tmp\7z-out\locales\fi.pak

Filesize
438KB

MD5
c1c7456d0618a216012dc4a6e92cef5f

SHA1
f0aa7152f3531cb0bb059ef5de3ed09f91d3ca0c

SHA256
c2e7afbd5f28e3360c0ea2d57664ba54e3f7d187e1fe30907c3b40d96880f82e

SHA512
52361f26eb345d41f93a71b32fcb7be547f99d56210d8eabd70ddebb51c2d69dd903fbef6def3dad8895067b6390de498815fc592677b1010ef849f880b4ae9e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxA5E6.tmp\7z-out\locales\fil.pak

Filesize
495KB

MD5
563fc69f1369d47e363f17ba7ee3bd90

SHA1
855c36edd5cf012cb0e52a1cf93b97b4882a3595

SHA256
af00b57e13f47a9d2a9e0c6232db38c09fd5c33ed3b93a2b09699641438c8a48

SHA512
fe31ba90e581c736f27bf9f97ea8f291005ccadf6094ceb5cc01ab56ea0d6bd0ac0bfc60981021a18e7c3a76a96acc0f61e6fa5aed8bc28ea95bee472851a79c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxA5E6.tmp\7z-out\locales\fr.pak

Filesize
512KB

MD5
758be81bec00452bb28b1f646a77e62e

SHA1
3c613321fdb3b9eb4f19649a46a75e8f5608c2af

SHA256
62bbfe8ff17d80dec68156256ba3df2c902a2410df8a7dbe9c1e10b6ce6f5501

SHA512
ce60e0a7486b95290a6df37fe5b57ed23709a595c92af12dc3b300e0b73cadc15320e8f5668c1bbd385a505c57a94051754407f0d8d7e189e0fdd9cd7b041ec0

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxA5E6.tmp\7z-out\locales\gu.pak

Filesize
995KB

MD5
9d7b2d26274d431f29b6f527d7c1272c

SHA1
9e3d28b03216333f11ab314285b3586c38d1b041

SHA256
c7fe8df76e7fae94f3a9754ee28fa098faeaa30388d5a1773ab50cbfc9ed342f

SHA512
13cbbd57dc5ff5f7b921a247b8b1eb055b8f570ba92f377406e16334497f4d01b6bb6277264c24d02fdfab524d5728247250c8f67cc5aff80a257b1c6fc8c59b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxA5E6.tmp\7z-out\locales\he.pak

Filesize
615KB

MD5
cc5971cc17fb0dcc130e78bd8fc3a2d6

SHA1
0824e9a24e4aadd252cd78b97d037c401b698202

SHA256
fd984e6be7bcf4ab9551fe791825c26b12470c1f80ee38c8e5f338fb83be0ff4

SHA512
7a6033474392e796ad7c6cd938c12837d2b87b8ffb81438f40321f7f4ccc58e75b90d73354f020df8cff19aa7983cb75be7bb3937ce55de2841991431b2a0198

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxA5E6.tmp\7z-out\locales\hi.pak

Filesize
1.0MB

MD5
c5a8a66837827141819f610ff6e24287

SHA1
a08d99121dd9e9cb9f74eb9c03cb006732bd48c3

SHA256
a99e7155acc1dbfb31209ce4042124ee6e867571cd10dc01f34152613f23acd9

SHA512
69862f3e108cd0ee49bbdc010d2e014e5213dc47d8baff7e38ebeb3b36b4bf91c8b3b490cdf0bc46b35c12d14844d24f7a2ccf1e9be66af5ffbe0c42a38f10af

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxA5E6.tmp\7z-out\locales\hr.pak

Filesize
477KB

MD5
c10130c26e3c02524ef294bcda43f4a0

SHA1
94ac094fe5b9d2d0cd29bea7a5694196fef4f777

SHA256
ae6103631df64e56623d92d65a3372b0d787c27d72ca18e9080c0aeb28d83b41

SHA512
1b3acdc524e96363e1639152c45b222cb7e3a8e77fa030f165b9634ae63244f7056ced3e079176ea89d9e2ef02461d85244e6e8b3c8d752bde4d32149732e063

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxA5E6.tmp\7z-out\locales\hu.pak

Filesize
513KB

MD5
20143c05e209e587f43ca6908d7b5edf

SHA1
f11259e17507ae063076525a3caa8a9fcfd7c96b

SHA256
ab80e87e7202cc56335ba1d0a7770838d8d478d3128e46c9d30f38884c650671

SHA512
2d2c4936b6af6f5a29738db5688acb6cd2ac8aa48e886a1e32dc450edc95e357ccd6616155d631f68cb7478107cb47d02bd0c13192f6b4e33a47a7c0771b9942

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxA5E6.tmp\7z-out\locales\id.pak

Filesize
421KB

MD5
529affd46bd5d0a6ae12d4d87407651d

SHA1
bf148f7873f17082e66444607e9937343e2cada4

SHA256
1d8f4f7519f4add8f5f4a2eff21b6e703acc49f9ceceea293114cd040e9b5d6d

SHA512
ccd8496edbfaca0d47a4e2fb924820d10ba05f59a7e7a4b1c65bdf1e51ba82ffc1d71fa07d4e8cf07b8f626f804b345a31c38797edfce79dda5fba0e298b6c9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxA5E6.tmp\7z-out\locales\it.pak

Filesize
466KB

MD5
3b2dbf6468414b8baea5fa241917e688

SHA1
5cdd39b14d21c193ec6ec9f14d671b37e67859f5

SHA256
202e8961915e6fa6a910dbf7dee705fb2e71b98a34eacd34a7c317d3a12b15af

SHA512
87fd024be7ded242742d64ce53d769b0b2315432860ecee91d423eba9194ae34a8ccd1752a3d407ab3ee8fb632b130c40ae6d5e349a5e8bb9a9b3a46f8fae452

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxA5E6.tmp\7z-out\locales\ja.pak

Filesize
569KB

MD5
e6a4668568d691547d3a9d92985f5c37

SHA1
d43c9adc391e219baef9221062bbb8a7327ad6a9

SHA256
5f3cbcb09862f54a20580268baefc79a65183e95e8935877a834c773a458de6e

SHA512
79a063b5d47f9f49056831f6565d99d1ce56bc73a22d9794ca85bf3780c69c1ef29392a0b735de984fbab77e83ef97f9c730a3b03d296e292afe64b559797012

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxA5E6.tmp\7z-out\locales\kn.pak

Filesize
1.1MB

MD5
11960cc947442c7e8fbe7946f518a3b6

SHA1
b6dfee9ac101ee2c2cdff2f8755c1f453f9bb686

SHA256
efab8245113da2f602c21eda7a16ca7b967e55925289a6965a19ed3f5c80b449

SHA512
077df8a48e69d4e144ad91fc06a66274da06f0a4fa27fc9e339da80e7ff0e4a29aa9c964c9261f1dafd1450678a268abc231e8e43b0bde6e514553cfb735f82c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxA5E6.tmp\7z-out\locales\ko.pak

Filesize
480KB

MD5
d19e0fe749813eec84e8e8830c35db7d

SHA1
e676a3524dba2d1b0d8da4bc508f4cc579dcce72

SHA256
cfe45b518c2e5d77c8c2c567481acc6a7f56b3b2d365c8f9b699660711f75738

SHA512
636fa8d8730b8235423d2d3e49329ac8b109659f1d930b56c9e0e7b5da9cedac9814a2b34dbbae3e2da2e95e0258fd9b4a17c112172f24b5b4c2a42bb62be63b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxA5E6.tmp\7z-out\locales\lt.pak

Filesize
518KB

MD5
0dfc077d51fb6f73a09fbb0b04df2dee

SHA1
b8b14e4ee2557edc13df68d2bf0d5469642f4d6a

SHA256
6f86e008a84a0f1f0f471ff891014b3c8dd19831cdbb5cf3ed301b2477b5f552

SHA512
1b1c0bf62e87657491106a970d2d59bdb7b8876ce901466687b499902ffe136e6409dc705ce49417fcfcabce3e134a2a85e2aaf71161b839b31325874b7556e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxA5E6.tmp\7z-out\locales\lv.pak

Filesize
516KB

MD5
f98e3517560753ab21a0436c74ef236e

SHA1
104dc9d23ce0c2c33788276e9beff4746367900a

SHA256
a9c0abf7f2056c2ac265ca802e46c30f9320e983c7e683885fa0ddcb51b46a02

SHA512
7b5db4b03c231059c20fd160d8cdf8c0946e8903caf13e401e57fb125422a9a0f724d4ce4d9e06a1f051c905188100890dbdc161042e74628e1dbb8c4c39d1fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxA5E6.tmp\7z-out\locales\ml.pak

Filesize
1.2MB

MD5
3003e662a7ca1384782a039d78f0bb1f

SHA1
f306c49febfdb76714f3feb0c03a84939f471a19

SHA256
99eb2ec5820f961a1e70700fdd8ec7f91ad670a513b59a49fea4d50c869b4525

SHA512
ad8318291dbbb33b2bad9be81f82032c807220bb921cf8b9f7ca95d0b903610dcefbc0e6339afa72adef66b2293364c4b4a3c8727642a5e52d932984a5821c90

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxA5E6.tmp\7z-out\locales\mr.pak

Filesize
975KB

MD5
5f6ea652adc1623509872e31b636ca32

SHA1
90712685e8e2426be975ee500ea6a1c038583ab7

SHA256
400494aee11c22936c8fe9cb8139c6025f7c0e1ec985d702b5045fdfb98ef940

SHA512
301ae1ee946fd30276f0c3db0d2056241cebd767efb11b1fa6d07a0c8e44cf6fb3f6b6e954656b80f372d470312fbad2d3fd247a617a0abe06a74bde0f71426b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxA5E6.tmp\7z-out\locales\ms.pak

Filesize
442KB

MD5
0c8cbb712619936c253bb6f5ee3ac0f7

SHA1
0cf5938bc3134ab64cd729c4bf5227966e11ccab

SHA256
810c0399d63b4fb95b729db3e7e2fc7d30dc15a32c20cf8a3bfa153d28397de0

SHA512
528c827784af8772104a1abd47c0591b642f7b10d05bc4a16b6945e9767805827a265f9cf2af72631bbe713b0d9f1aba0c5904bf8b8cda642915c9f7fc8f1fc0

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxA5E6.tmp\7z-out\locales\nb.pak

Filesize
430KB

MD5
21b40c03071574765a76bc7a99b1e7c3

SHA1
0bd4f467c6509ba85a2b249fb9b99428a01ccb66

SHA256
f27e8dc3a38984da22792403089dce4c46126377ab581cf53a96007207e6b7e6

SHA512
6501e94a842aa26e376272aac58f318c4858772225e2f609df01716de79a72d2dabdbd2d41243eccd3c413071bcd79f2cca0e0423f4c1932173dacce9125ab3f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxA5E6.tmp\7z-out\locales\nl.pak

Filesize
444KB

MD5
d20a7273031dc45fa61f74c3be3696e4

SHA1
6d3fbb3ab5ee819d3211c1eac3eacf0ca1afd031

SHA256
9ded962c949661cb698c350afd42fdae14926edaff9d30fb40001e20d4c37c21

SHA512
6587207c043f958e0c6aafe4ebb84d64806a407ad94e6d6decebe5f946a05bfe7506e43f78d6b0c4540dfa8c82f16cfb31d42cb324d89b8a1206eb1dbc68e001

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxA5E6.tmp\7z-out\locales\pl.pak

Filesize
497KB

MD5
79caf07d9d41518798ed25a31e160bc6

SHA1
fc8f73f74a6f5fee4920d93abb14ec18c18b3ebd

SHA256
8433f29111cc6dc2c73c64ef5da4978cf0023c95bfa9aa892ac826109bdf224c

SHA512
e3ddf6a00fbf892f7190a2a7c476e8a7596bc6dcd3b866a3735df537593146766709b934267433576348ae1c7feaea54cc91c92f973f04df57776bdea887c830

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxA5E6.tmp\7z-out\locales\pt-BR.pak

Filesize
468KB

MD5
c044b36ef488b9957eef793200fe9c1f

SHA1
042abca765a200dab57662d2e3dc812967f45324

SHA256
c8bfbf6e29e0c3bbfa464437d15a02f69c878b9746ca35e479f5afde2a5e7ca0

SHA512
14b5414b2e57899a12df69a05462086e1f11149a9aeb03adba5b6435edbab93f688a2515c866c03a6dfe942f02201888849626e52cac05df3df5c57f75bbe79b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxA5E6.tmp\7z-out\locales\pt-PT.pak

Filesize
469KB

MD5
51c0134ba23a8a33da20194d72eebc1f

SHA1
e4d5d133a2cb77ea127a80a05221341bfd143b0e

SHA256
375e65df835b2df08087b14a3abd08ec2a798df098298d7061ab24a23cab0e74

SHA512
4a74152fbcbb5e283cc23e519f1afb44875183aa56da7b990c9a088e1eeae48b60919e98df9272e862252a424379ee37a292741d1916b300ad67da33bae6dbf0

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxA5E6.tmp\7z-out\locales\ro.pak

Filesize
485KB

MD5
61e6762d98ed5f5cdfab4e5f5ad86988

SHA1
227c87c44aff4955068ee2caea819c2231e6b7d9

SHA256
270e65d21c46f62fa5f880dc6485dc2b1fb4e3bd208b6b61e3c5d3e53631d1d9

SHA512
d537965009460fb0ebf0ac56fa010d9844971cb56bc6e3075a544c08fdf2eb35da44da4565e41cbe5aaf8f3e6b4a72c4756c33b85f30913b1d0f9cb6b95d97c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxA5E6.tmp\7z-out\locales\ru.pak

Filesize
797KB

MD5
634190e6bac68f1704543d79a326fcde

SHA1
af9f15c78e5c00fbc9dc5a9cc105f0c406ef83f2

SHA256
a0e812c6e7b9fa7d5646aa5f3dc268ea5e5a47634c7c6622bdd6be89b195bed6

SHA512
88e98f0e6332268c8402c038b1c0551f9db56ed8ab24d6fb7c6bfe5b80abd6a82ccc1d420da333e097e1468f3e20534a04d7b9e8f0e3dd9592781e4016bb7900

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxA5E6.tmp\7z-out\locales\sk.pak

Filesize
502KB

MD5
abb14b45fb6d6ef70c14f7ad4207fdf8

SHA1
7912dc3ea4f0702add5ac48ef58a9e64f6ae053e

SHA256
2ce99f386a2f8dc6c0ee334f9e9f561cf2d0e007b90bab71630621102bb6418a

SHA512
995b2f366824da52bec994803bbcfdf71d0221c294b35791f67a7658a967bbc8248d9984eee6a39e1f04620b97a5757e37179126554ab9ec4d7cd69bba46d4f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxA5E6.tmp\7z-out\locales\sl.pak

Filesize
482KB

MD5
508dec1f398cf905406b8b3a5c9211f5

SHA1
bb9373e2e2f926490aa87621910de5864365d091

SHA256
b3543e1a020516f7a3cdd5e3636aeae6ffce1fc34040477679db01a1e4624753

SHA512
2d355d410e92a7170af1751ac52fd66a02463d58525e25530b3bba0a68467441a2687b4f8fffeda7375726737a0045b7fc7b727652108027e6b759991e3fc079

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxA5E6.tmp\7z-out\locales\sr.pak

Filesize
744KB

MD5
34cd9d59eda1ebf2ec04d857ae046282

SHA1
7c5aa258a971c5e01bea62a6d9c83cacc51999c3

SHA256
814302959a230d1a4f77d69759bb8ae578e2b0e3d24a30b50756a054eb961889

SHA512
f8b010771dd4b27ee41837a508e1083aa790d3e5577876169c02db72ecacc9ccb670dbcb84349638062c74a50e4f7c6af8aba25046921709ea8a0eaf5e5f3d57

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxA5E6.tmp\7z-out\locales\sv.pak

Filesize
433KB

MD5
450a3aee15d65a35bbaebee850d6774a

SHA1
c4bf0c498d23984cad3b11e78653ee814bf3d422

SHA256
e1abd731a88926ae532439f12b95121c45e06e8927b6d4d230994e5667ea68a4

SHA512
5583eacb1f688270779b662a825c42ef7e479ef182450ca895c40d909f0b1f3664ddeb2aa12360626871d6d30cffd0486d28950849a0a048dee4d1876eb97894

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxA5E6.tmp\7z-out\locales\sw.pak

Filesize
455KB

MD5
a5cc00913436b9281ade4c76a3752bf6

SHA1
e41c1056228c5c88fd42257d93420841742a6b96

SHA256
6621ff23bfaf8a200e9010d8042a8fcadd775702d35b6c27cec47b0e76eba568

SHA512
2f441de1d94a8e692c45940cf7db01873d7e162ce03343106bffa4a5e714e019bdd9d854c247d8ec359b5f64ffd60135e2e3b41f27c01b18cda131cb27cf6d26

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxA5E6.tmp\7z-out\locales\ta.pak

Filesize
1.1MB

MD5
2f757dffc404098b26efe5e083fdac82

SHA1
dd503618deaeb7e895e54f07662cfb95ef216f1a

SHA256
4aa49a31e0474c65760147a4c411b65414c8b30e6b6a60194274a900a7282e48

SHA512
023667b56108dbedf3581cb1911cacb80791eedcd47f2677ea9aedea793480c1a65eb2ee8d4b5f75df215649aa9d966ddd72f51abe11e431bcf4104247f0d7f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxA5E6.tmp\7z-out\locales\te.pak

Filesize
1.1MB

MD5
d8b98c61ad607c3837850a1eb895e270

SHA1
ae6f74f669663dc6d2ed52007f8eae4a3e3b717b

SHA256
dd9794a9fa95eb6c67d749cc6867cdfac6da13049ef08148fc3a72ea0e5b7607

SHA512
ed07e7af5f93c4aa82ca1e216f4e3ccf8d66aadcdedcb651d8497d99d7f2cf38fc9b415310ebd376214ca0c048d8553aae0e3c9c2655c68a0fce4f82b1b51219

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxA5E6.tmp\7z-out\locales\th.pak

Filesize
917KB

MD5
7e49149e6f56f852e99272ddee6bfa67

SHA1
9e2d90da4e419e3ff8f1c5969695fe45c9953b84

SHA256
bd6b84b7fbac2059c5f1bc9666c82b2f5c91ff441d667fd4e286dd653cd609c7

SHA512
30798ed6d9897e93c97944ae23350f941f611a16444a276bc33a3eba31439eebb8eb9809c35467ef2aaa4267c49e51695c382a0f4e8d1450eeebc64c875f5be0

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxA5E6.tmp\7z-out\locales\tr.pak

Filesize
465KB

MD5
e8ac7da69798cd5b6fd2f03332f4f5d7

SHA1
f42d4d534ce766714ee9ae0ee30e19cce7d6848f

SHA256
a1d2a534e508463b14b01c9fa4fecd4cdf0e9181e9f73bd725d9a47879beaa0b

SHA512
9273106062ddb56dc78e8bba2d798441fc92da967f1f7ca61942bd366a0b614895f865cee3494dfcefc42531289f7570b1e9c57adadd9ff53d769edac338dbf9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxA5E6.tmp\7z-out\locales\uk.pak

Filesize
797KB

MD5
4c4eb9932cc253b91190d611ccdbe212

SHA1
2ec354336dccd3c1fb7382a81f8cb90687717994

SHA256
216a8e451d3b492fadec1ad433d0cca95830a8cc504b675d06341c4b03b9df22

SHA512
0b0034aa886cc636d429c757ed004e4670770a290f7850dec273766acb980c0a6c270a8383c3676cd02636a1fd7498a33958f6769f82e9b8af283e15a8232a03

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxA5E6.tmp\7z-out\locales\ur.pak

Filesize
695KB

MD5
f06bac2698e9a023954e9f76fab5d06e

SHA1
59c6995373a4c4ae7ef0e5c9f831993ef6ab456a

SHA256
edfb467e0b26bc10f9085c816e92d23411fb16bb57a91434f3d435ed4bc28522

SHA512
07be0b9c80b93d8e1207e892229f31badf047d22a6d7b3b3c2bfa3dd44215fd9bfcfcd958e20b285b30836d185dabb94f207e4fd7afce246b6d574e3b935fac6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxA5E6.tmp\7z-out\locales\vi.pak

Filesize
551KB

MD5
0eec47e1c3a072dfa58ec494e13c61a6

SHA1
b07c5f7368a100fd21cec86b31cf5ec29a71a760

SHA256
175bfd7d1b70f7ebe2a8c091ba63422edba8fbf64f52707989c4a070ae81618c

SHA512
ec8e54f07aeff3b655feee6bff824e16059cced4dce9fb695150dd8ce9240335f6023d806677eb682dec8e99a3eed4a1305e4f3fbfec3cbfa3a1df2dd3e96350

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxA5E6.tmp\7z-out\locales\zh-CN.pak

Filesize
398KB

MD5
8bbcb4b24c3b9d27e26d75bedb21b20f

SHA1
b82da1dd644dad253d39231d5694494e0f902d34

SHA256
300c0752e1831981f365bdc35c2fa0044df342f623c5b879cda6eb21094383af

SHA512
c6ca32f8b2f4cad9936c2030f1c412a8bf82b92d583cd62e2ea25b2e736f30b6bdd2fb9be20135bc09a3062208b775c11ae50199b726fe3edfa62196678646d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxA5E6.tmp\7z-out\locales\zh-TW.pak

Filesize
394KB

MD5
7ae486f1d7be0224c30cfd85bedb4878

SHA1
8b3eeddb27277174561f54bdace6034102475ab4

SHA256
0bdd3b326e09ab2a4bbfa6af08a6a18552045c0c1319e4e32374f9246415b51d

SHA512
1457531a3deab89ddffaf286793459d3143e4d945e807e7db7216fd976d85a7c74f6cf437dae7889a1e1a98bceea7781081ca39fa180d82fecf3c0aa8ecbbea7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxA5E6.tmp\7z-out\resources.pak

Filesize
5.2MB

MD5
5b0d9bdb7192808257a426a158201154

SHA1
d36b921197e88bfdbe8f0c85d4248428b28ddc74

SHA256
2cf66385c4a917de07563fac63b973936ffc7f7f3ad665ea0df489bcc74ddf35

SHA512
3312f1c75b3848404c50aa345b28c856f476a7b66756d9316734c174af3c9ad30193b9123a928ee9e94bd3184998d86ee1474a62e657e4c329f310a5f7b3207b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxA5E6.tmp\7z-out\resources\app-update.yml

Filesize
1KB

MD5
43f1518a5a28fd0d862f1ea547489603

SHA1
370e5e79400d8efd1bf2e9790b4f96bdb92acd34

SHA256
117c19056c11bc30ebb38b07177baa3108307ef97f23d2cf59168c8341ef6ebc

SHA512
2765d70896bff23ba4bf3b2d3a266dae3b0251888e09cbaaf68b8a54265b0dae373d0b19555e16adeb1b4c3e6b7e251194b3989794037a3e7c7acfd24b9f222b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxA5E6.tmp\7z-out\resources\app.asar.unpacked\node_modules\node-notifier\.github\workflows\test.yml

Filesize
401B

MD5
a8158bf94ef160e0503aafa3f76239c6

SHA1
696eb02186543346472fe81465beafc4a69300cb

SHA256
8d2c6731e3966bb9221e7b53ced1ee8fe473bc18f7d2f22da505611fccf22b92

SHA512
eeb41da5a5ddf8230e783af875a9db7be227029796b666d1e7c8e1036edf674f47f766c0b797dba0723cf0d71da47523fae338f7933a1e517500779983aa6f84

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxA5E6.tmp\7z-out\resources\app.asar.unpacked\node_modules\node-notifier\.prettierrc

Filesize
73B

MD5
e1a520af5c26e784010480f59df5cc15

SHA1
e6a2425dc49db9cb45825eef4b8113c36088028d

SHA256
bd5cc7b1eba49f927a3bdbc18c009407ea2f5ae07bdc980c193907d7d7c7a11b

SHA512
36a9bddf14cf84ab9cecd8453eb3322e8dca6b821a4a7393b66829740034f462db9a90cfc8f99363aaad1b21b8fdf9514d69ad7dd7916e46b026fa322df7e2c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxA5E6.tmp\7z-out\resources\app.asar.unpacked\node_modules\node-notifier\LICENSE

Filesize
1KB

MD5
3359947cbc36ff45b55bb830956f06aa

SHA1
ac30774e2db317e4a5ca1dfd150fea3c0b818a82

SHA256
c5f00acfdb0120b3fafa9869ece941c0a095253770f652927da96352b502df90

SHA512
465af14db0693bcfcf2c13fa83f7c8ed93e8595bc5b624f0aa9d3a9b41881a965b11ed5ad3ab2a1193c628d082ada1be7338911daeab732f1f1f4415a638a9d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxA5E6.tmp\7z-out\resources\app.asar.unpacked\node_modules\node-notifier\index.js

Filesize
1KB

MD5
e4f4ed46cbf7884a2227a07d47907ab9

SHA1
7b9e4d9904b4468c101b121cf47e4c2816ac77e5

SHA256
04a22ae517a8f93453097ed636dee04a7635f928eef73cbc003916d091d0bbce

SHA512
4ba3d99629d983c2b073a584c58ad1d54fc3d2c55eed3e704a18e5db2c8625dc3fd5ffbffe8c56fbe5b096448eddf14b808dc97be9cf73c554095c1d842398f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxA5E6.tmp\7z-out\resources\app.asar.unpacked\node_modules\node-notifier\lib\checkGrowl.js

Filesize
550B

MD5
fa7d81bc020ec4ef6c8055083876fcd0

SHA1
d3c62e48427f39dc613bca96997d38a06c966283

SHA256
01c807bd9f273f09ffd87bab13473865bbf321071513f5c487dd1b6e7fbdaf10

SHA512
4fb0844820363199ad78f0a667e0f945114e9d65d86283fb5bb79a1b97be25dbe8ebd2ce85a9dc40545630f3146b3897433e1d23e9117027d2c74fa698df3f1a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxA5E6.tmp\7z-out\resources\app.asar.unpacked\node_modules\node-notifier\lib\utils.js

Filesize
14KB

MD5
46b0f23f133ba1bd568e5cbdde8e7502

SHA1
fa3154cd92cb2c398e8b324e6b8a2402e46c4a32

SHA256
bd5ed859adeda193e15672e769551966b31cecaa6294fc52297533d835af3702

SHA512
198ea2cb626be8ed7ded3188489952ae6a424da8a9294a507345bc23fd14ccbd4715dc472e4febf25f2ece460492ee3d3dceef394a79e79ea8e91950016380fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxA5E6.tmp\7z-out\resources\app.asar.unpacked\node_modules\node-notifier\notifiers\balloon.js

Filesize
4KB

MD5
22e0b5a21107a340bd37f034e88be79a

SHA1
cfa46acdefbfb08542ac890d8de2fd007e343355

SHA256
ef68f4d2e8dfcd1443843d81707a3e0e7a2e01d9573100710736eb1990306220

SHA512
0c45207ec1875459355a01a8ce163811f267a95546171f2837dfd09a9587bd2888add14c4c0f868a67a66b56e6a15fcc8bbfb713141311bb8df737c8a23a91c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxA5E6.tmp\7z-out\resources\app.asar.unpacked\node_modules\node-notifier\notifiers\growl.js

Filesize
1KB

MD5
b899ef0e83aee19a163ce8ee249ac392

SHA1
b729bd63844cb485a8cb183725d8c6720633c23e

SHA256
922eecd40262c26337901479de95b0960c719df76fd3b53dfa3fc3aaed95823f

SHA512
cfc0ab6a0ab5111da7759868d4478043688f6eccd261d4f5fdaa74ffb4422956fe1cfe94974fbf3b08f1405ddd505053ee4ca3102c7182ae1e4ac5006ee2f882

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxA5E6.tmp\7z-out\resources\app.asar.unpacked\node_modules\node-notifier\notifiers\notificationcenter.js

Filesize
2KB

MD5
09de38e77abd206cd405aa6ea70bda26

SHA1
f91eb550baf3378e63086160100fbc82e88a6c1e

SHA256
10dc099d7164133959a61c70ed2951921ef591738c327dbd76d7338f1c9630b4

SHA512
0dff587aedc93fd315b1b6f8001ef33973cbea5b416b5103da80dbb54e8182ceffa00402b3e6affd5193ddbac3b9c3d00210b052e8f1ee0ae91bb306552c056e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxA5E6.tmp\7z-out\resources\app.asar.unpacked\node_modules\node-notifier\notifiers\notifysend.js

Filesize
2KB

MD5
9792dbfec85c053f46582638e9c8a966

SHA1
35ab80ae67cabc161aa3b91c2539de8c4a00035a

SHA256
29fe357ee97ad29245f55bfcfee3ce75bc86375910d9b9709105a11d28f287de

SHA512
16347295888393ab2cae5730cb5f54fa87cc19fb1f745302cb0132eee1c5326ba15d651f81980fc8568e34fe4a935e0926e31b528ed9ccfc480b2468d53564f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxA5E6.tmp\7z-out\resources\app.asar.unpacked\node_modules\node-notifier\notifiers\toaster.js

Filesize
4KB

MD5
5930863c25cd9d285e91ff10cbe7a947

SHA1
4d1a2e9942335d16b8af07b26d780dd2e1dd30cb

SHA256
3dc551eb4aa9f5ef5a2d983336e8e52714b16ad044a6e29435300299058823ed

SHA512
3b60cfb76634e60ae57a147d65930ecc5826b45f82c749bbadb16183cbbcc74faf8bad46a34058e13896f49a24d50492bcb9b1fa67e0e618bfb87d9715fb5d60

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxA5E6.tmp\7z-out\resources\app.asar.unpacked\node_modules\node-notifier\package.json

Filesize
1KB

MD5
719724ee5627e1882d44f7e2d94dbc46

SHA1
7a2379ff9e5e9d2690ef09b888a0c1b5905f3254

SHA256
930aaacf5d93e64d22491731b89edd9000971824255bf0fbd8f029629bca0978

SHA512
a4c759456c3341f7fad9fca548d61f77e0b6eb03cba33e7ed2b494ec8c7736c6572d1236fd456e35451e3ba7e7ad907562a03eac2471578a9bebaa4bf56d221a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxA5E6.tmp\7z-out\resources\app.asar.unpacked\node_modules\node-notifier\vendor\mac.noindex\terminal-notifier.app\Contents\Info.plist

Filesize
1KB

MD5
5046a82c05834cc8c474b184c6043cd6

SHA1
2a55a72951e61cf66e46fa7f136e68e58646ac7b

SHA256
258d7eb87e20094ee0a3c9b65e33a90effdec238c5d785a088af3d2e1ead4a61

SHA512
af782e0fe4162bc6f520ed5a75fa78f6e33e4d7a9bcb914c2ae8b73ee02a1ab3c4dc432782a8603f7f111dbe3de4bfe0e14f8fb40373602cb63a44ecf3a04823

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxA5E6.tmp\7z-out\resources\app.asar.unpacked\node_modules\node-notifier\vendor\mac.noindex\terminal-notifier.app\Contents\MacOS\terminal-notifier

Filesize
85KB

MD5
ade5227f13963b5bb72b47f0ad410819

SHA1
24d1a22cbd8b026c35b29f1981f4d9fdff08af37

SHA256
2588f4ae2118396419767c388cf2b0a9a5e0cb53ce5d05a07c00f68a97a50215

SHA512
ee702782dbd44682f0c9234fbd2d256b14ee70f349186f37e025bdac20ec5b10d515e9d91e6b54a5df7ee7312f2faf4d299e1ba1e03419cfa52585f2c1195fb6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxA5E6.tmp\7z-out\resources\app.asar.unpacked\node_modules\node-notifier\vendor\mac.noindex\terminal-notifier.app\Contents\PkgInfo

Filesize
8B

MD5
23b7d7d024abb0f558420e098800bf27

SHA1
9f9eea0cfe2d65f2c3d6b092e375b40782d08f31

SHA256
82502191c9484b04d685374f9879a0066069c49b8acae7a04b01d38d07e8eca0

SHA512
f77d501528dd0ced155c80406cfbee38d5d3649b64d2a9324f3d6cee39491eb8f54cdebae49c6e21a20d2309d8fae1b01c41631224811e73483db25a2695738c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxA5E6.tmp\7z-out\resources\app.asar.unpacked\node_modules\node-notifier\vendor\mac.noindex\terminal-notifier.app\Contents\Resources\Terminal.icns

Filesize
360KB

MD5
20c4ead98b17946b21b207c59d9a84af

SHA1
3aaf46b493350ea7061752421e21206f486837a2

SHA256
ccfc0f457dbbed2b164a9f708e1a0000fad8f896b0d5332b376e2b748f3ff525

SHA512
f0e8557e37c3aad01d80c4bbfe36eb506164cfbeb689934b300934a3ec46025559dbaa9d5d725a9b5f0b6a1d0dea2ed8f940fa041bb1756fb0dc7aea717c5435

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxA5E6.tmp\7z-out\resources\app.asar.unpacked\node_modules\node-notifier\vendor\mac.noindex\terminal-notifier.app\Contents\Resources\en.lproj\Credits.rtf

Filesize
436B

MD5
f0d4a61caf597423ff07c5e9b24a345e

SHA1
60a248148b319de26e36424d25021c2488e23ce8

SHA256
b4386fe1cef65cd91e6c8ecc065d117089083f91b7cadbf0c3e5eae20e8b9640

SHA512
e361011499cf70fc71e247fdda71f49d913654a983aa4ae67d00dc977e53b9cf0d88d4d2ac07efe248261c3ab6e3345e829e22dda3e51dccc221a94c660ace69

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxA5E6.tmp\7z-out\resources\app.asar.unpacked\node_modules\node-notifier\vendor\mac.noindex\terminal-notifier.app\Contents\Resources\en.lproj\InfoPlist.strings

Filesize
92B

MD5
51ef59b60e5b41b91519cc662a9fe886

SHA1
3222ca0c39eb50aaf8126baf852e55430c4718af

SHA256
39cf2ee07b7b333e7c179d0bf4d798a5b72af6a4e584f51e642703bbfa4fc828

SHA512
3952a908b72d44040f5072f6344f6327fc78981c3aa55e931acae84c0c9bcc0d148991cd564af4803765c328cbf5f7efe9eb558fc56e47e8206b7b706026f30a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxA5E6.tmp\7z-out\resources\app.asar.unpacked\node_modules\node-notifier\vendor\mac.noindex\terminal-notifier.app\Contents\Resources\en.lproj\MainMenu.nib

Filesize
25KB

MD5
27c712a6b920b5908ffe207ef1eb5dd9

SHA1
97af8138a9a90d74a6cea6833df3c0cee775f836

SHA256
66a2378cee667b39af5a92676f20f2db13dcf73cf2d23d2a30ef140cdb71f1ad

SHA512
50086e239d8c791f6cadd9a2451e6842646beba6c39b4b63cd9fa9a06f0319becd02791a3136efd3268053f82e9b676599a64e4d42a254ea8d63abe97e76cae9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxA5E6.tmp\7z-out\resources\app.asar.unpacked\node_modules\node-notifier\vendor\notifu\LICENSE

Filesize
1KB

MD5
48c1d9a871026f547e17ead59cde3e57

SHA1
d2354b8b8a09321bd6b19dde969631683cdc9c67

SHA256
70277439f914fd361541c44fec279ae8d03ad37aeac8c92f79c2914da4b5d7eb

SHA512
78024387578b9f8d73c2d89916a40ab6a0b6dd325b9cbc4ec41e429cece566bf7e01adb804d2f313c3900c5dbd2c188dd9d983ea3b8c59b8b6602ec8ecc7b43f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxA5E6.tmp\7z-out\resources\app.asar.unpacked\node_modules\node-notifier\vendor\notifu\notifu.exe

Filesize
260KB

MD5
59f3390e3e23b4c4ce8c88e6786c03f4

SHA1
5656b58a34309af83512024a19a3bd08fd210851

SHA256
1c63a9c2647ad4049ab8836c10b9085a57ef8c06709a6dde0f96ea51403c6e69

SHA512
3b1a07499e8353ca79a0cb861e938f29fa43775cba5ebdf6176f9983a11b17dfc06c21a15dcacaa9c2861ba78744a1927d97ee553e455c07d576faa4ffdaf441

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxA5E6.tmp\7z-out\resources\app.asar.unpacked\node_modules\node-notifier\vendor\notifu\notifu64.exe

Filesize
310KB

MD5
f4cdba3cc6a1f547a2ee831829516cef

SHA1
38482aec9170b8f9df5fbdbf00fcb12c3ab50d61

SHA256
3fcff9ef47eae205298571dfad9fc4da6b0fb48547b986e4cd2be593981d2310

SHA512
b833db356750b5981f9d62e589d7dfcc645e31c307a1414f1f98d524d8abcc798cdb388775309b924f2ba70decc8cc2197825e0e1d52e79f18920b85806109fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxA5E6.tmp\7z-out\resources\app.asar.unpacked\node_modules\node-notifier\vendor\snoreToast\LICENSE

Filesize
7KB

MD5
7d8cf1676495e6aada6674f45e6a64ef

SHA1
1ed1a695762806e180df6e90f6330d242233b3fb

SHA256
2f4414f727c43c1ea8778482d4a88087f871717539299116c498fa113d1fcdbc

SHA512
c8610057717aa1eacbb247cdf18a83d27e890d2f65c92597ef282b960dda9aabc64e313e1210ca53c6db9979ffdf3b9af2376c6d7b3f0b5de5414dfc4900335f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxA5E6.tmp\7z-out\resources\app.asar.unpacked\node_modules\node-notifier\vendor\snoreToast\snoretoast-x64.exe

Filesize
2.4MB

MD5
eabd9ef2f9c27a7e0b6b298351efe8c2

SHA1
fe2f59c67fd2c28b9444795b1fdb9d5680cd1673

SHA256
bda54c8ec55f8aac727a1c8da813928b0f07d8e9a7fc15b5fc7194bc0dcbfc2e

SHA512
d11d6192e44045754a905337adba0063c29765025a5d4db92868fa401de15d2a1ee722279b7cb2d228cd45fd73686f1cd1a6968c34b33fe7ae1dcb6aa742dbc4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxA5E6.tmp\7z-out\resources\app.asar.unpacked\node_modules\node-notifier\vendor\snoreToast\snoretoast-x86.exe

Filesize
2.0MB

MD5
84f5ab0866a5f017ebcbf770330c47ff

SHA1
094c97bf736dbbc3bcfa6bc8695ebf028fc3ca67

SHA256
78c3214f3b8d1f96c75ba424cceac77e93f768148362c0dcdd1d71564663a49a

SHA512
f258bc5d8d9626e493c512e5141f7784d4fa6d24543818b600e4f9d4d716cf5d706d896704d7c05b2659863b99ad874f4d7959e7fb240aedb18015a12ec2a8d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxA5E6.tmp\7z-out\resources\app.asar.unpacked\node_modules\node-notifier\vendor\terminal-notifier-LICENSE

Filesize
1KB

MD5
191db4e4fb4f0164cdf521b3ba0ac98e

SHA1
355f9a67f5e1306d76b40a720522c6999ac3c466

SHA256
77a2769c8dc103f8051ccabab083c18e4cfbd26ba51589f26278c94dee997e56

SHA512
215fe158874088f703ba003f1b163da7f99a8bd7727ca0a39406e4f51553e7149630731a78ecb573c5eeb56e04af32d984f1db2b85ccd727b0a59c52ba04d7d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxA5E6.tmp\7z-out\resources\app.asar.unpacked\node_modules\process-exists\node_modules\ps-list\fastlist.exe

Filesize
64KB

MD5
da33555f206f1da1725aa3a578e7c3c1

SHA1
d93406b5d1a95c3da4d274a7692ce48325b7f20b

SHA256
cc586664e63e70749e4abc4c2a24261bbc0e501dad3571796543456984fdde48

SHA512
7a88aad4ce6c052a119b627b3fbcbf0ee9a1fce326d25f8db75e591fb89b723aa2ddd58c124ec03cdc11eeec0826174c7a0ce87d9b7e37f56c4fd5aada528b22

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxA5E6.tmp\7z-out\resources\app.asar.unpacked\node_modules\process-exists\node_modules\ps-list\index.js

Filesize
1KB

MD5
d3d4212183b548694716135fda1fd6bf

SHA1
2a1b28abf4bad549d8b2c925c1d596c11d2a9fb5

SHA256
12ec18fe8707e1555c57f59c4009b5ab4192a59fb4d1128b5da4441bc7224ad9

SHA512
702aa699eda287d22c1b7e0d11a0b18d441a65210b4b85df7b6297a3c52aa660c376c125703b63cdb749d27abbd22d123f1012d1f99c7319dce19d3947ab1c26

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxA5E6.tmp\7z-out\resources\app.asar.unpacked\node_modules\process-exists\node_modules\ps-list\license

Filesize
1KB

MD5
915042b5df33c31a6db2b37eadaa00e3

SHA1
5aaf48196ddd4d007a3067aa7f30303ca8e4b29c

SHA256
48da2f39e100d4085767e94966b43f4fa95ff6a0698fba57ed460914e35f94a0

SHA512
9c8b2def76ae5ffe4d636166bf9635d7abd69cdac4bf819a2145f7969646d39ae95c96364bc117f9fa544b98518c294233455d4f665af430c75d70798dd4ab13

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxA5E6.tmp\7z-out\resources\app.asar.unpacked\node_modules\process-exists\node_modules\ps-list\package.json

Filesize
463B

MD5
dc77bf45f28e0abae2942ba91e6eadc0

SHA1
c4891845666f4466e378ee21f8db1b9a3929956e

SHA256
59285e2d67e79267d6ddad7fe996fd2faeff345b19c44f0953995bd0ce52cba7

SHA512
7f47550fd22b7d806cc3e1a905e994a692cdf8264a6844d4f679fc1734b359fc1ac96060eac58e27243c7de153abc24b01608afe601349eaecd1f432cb707f75

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxA5E6.tmp\7z-out\resources\app.asar.unpacked\node_modules\ps-list\index.js

Filesize
4KB

MD5
32385488335d3acbac238ae79c09256b

SHA1
6945ac03e7581574c5e9dc0b943d89f13eb6bc81

SHA256
fb267dc224440784ece7cac39c0143d79420a206ac8054d5cec1bc702a885a9c

SHA512
76fbdc4e34e68acdbac018c73d937a3da3cad307e417174f9b52db26959388d23f9bb502f9b4f64e44f62565d675dedaabb4f4f3b0f3dbae088b284c96a8bfbe

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxA5E6.tmp\7z-out\resources\app.asar.unpacked\node_modules\ps-list\package.json

Filesize
522B

MD5
fab8c951d36e58fc69feaeb3a5edc356

SHA1
d304db544078dd0a5095d4a86ef92c650a176895

SHA256
6784a7400f302ef6ea92423c0542ebb4babbe8f42c3d9ab857243f58a962f2ad

SHA512
ab09b51d7d0f0f029b563b8aef9371419c9ae414703742a9c8802acbe3a30111beaa7b485eafb5aeb103b8cf2f2c75853f9bb7b098809e6969cbaad8878003c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxA5E6.tmp\7z-out\resources\app.asar.unpacked\node_modules\ps-list\vendor\fastlist-0.3.0-x64.exe

Filesize
286KB

MD5
c8cda9ff7ede268c08f6fe7b9b26cc77

SHA1
9eaeecd3c864e2ddfedd5a19c7c9e9d0e31311ca

SHA256
2169e14e5e6107f912b46f4f6e539a104c72d102f07aa6ef21f02422639461ee

SHA512
2d3d3be842cf494f63281efb108b43e92f654fc78abdace05c88e6272638cc91f7ff71007eb54607113a0d0401859c1ffc163633cf729b0f4240af2e99409c36

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxA5E6.tmp\7z-out\resources\app.asar.unpacked\node_modules\ps-list\vendor\fastlist-0.3.0-x86.exe

Filesize
230KB

MD5
1a32b1c9d5c512f4d82f204f27bc3793

SHA1
f6d3a38fd2500b1a03f6cf121f4b99b97c42610f

SHA256
4314df523214f745e8fe995b1c22ae9664be3ee86b1318943ace9af126af5a54

SHA512
c275f04cb14d24ab62ed69bdd2ed926a9fe91557795b1630f428856d3c5025fde7f317f6355682c3a72bb4686c9086461f23b3a2f6e9e6687eb124bea10f0737

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxA5E6.tmp\7z-out\resources\elevate.exe

Filesize
125KB

MD5
94cbff18095f37973b8cf14d7ddd33e0

SHA1
2c2311f403ba032fe40005074b47fc24890e211e

SHA256
c66d619ba256cb87c391daec55cb3d3a785cb3f1c3a8166d39e2766fcd512881

SHA512
5303f4bd8300d4bcb66b76b115f8612055f339fc14812042873e80fe7ae33ea3f94f61bf7937cdf03a61c9699ba1ca505f9e8179fa25f9d2a6b1d94089dfb5ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxA5E6.tmp\7z-out\snapshot_blob.bin

Filesize
262KB

MD5
801731c081a37a32473e0c490d7bc210

SHA1
34f2c0e0d4001cc6abba360c2593faf77680f510

SHA256
13051347751c052484db5b21b7604d20a281a2a98d66af2b856f32322b4b1d1a

SHA512
fd84cf2bf3ccdb44c988f79c66bf147f21cb1c0ead7e794120808f4c35825a613cbefafe436c9b48849eca02336f04f2732c88bb6a8c12aa95e08366de32a2bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxA5E6.tmp\7z-out\v8_context_snapshot.bin

Filesize
581KB

MD5
27eb201cddf803cfc34aa9263a3eb2bf

SHA1
f47986464c38d35458fd1ff0bf7ae70290ce96bc

SHA256
4a4801c6d845ac24aeb5b1849c51890bbff35045d41172de0cd8a296d9b9b0be

SHA512
b15a0ef36d5a907e416c0eec575fa6396ac9b8d1aa888983f6026cdf757ab1fa9eb7e59bd7d03b26ea5f4c5e551f52c36bc17a6cf07a0d961f361aec702a2330

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxA5E6.tmp\7z-out\vk_swiftshader.dll

Filesize
4.9MB

MD5
9281a9a4a96eaa608ee657de992f5f3d

SHA1
e663c605ee7c2f79409a784a823e0dc9eebbaa0e

SHA256
c7ce4bf37998052ee3be6c36ab5a18f2fae1ae0474f3a0d0fbad2382855aeec1

SHA512
578c1ca8523a94403f6695cf4d201fc036bce75c6dabe63f57ad2b5b1aca8d32ab66ca7df8bdee84a8a7202a539995f5128a448418d07a1589837b53e40013a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxA5E6.tmp\7z-out\vk_swiftshader_icd.json

Filesize
106B

MD5
8642dd3a87e2de6e991fae08458e302b

SHA1
9c06735c31cec00600fd763a92f8112d085bd12a

SHA256
32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9

SHA512
f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxA5E6.tmp\7z-out\vulkan-1.dll

Filesize
917KB

MD5
e500db5dbb5d6bb83acc3272011c874d

SHA1
5c2f176831e0376c58d2484334430761b0fc9f4c

SHA256
538d78238812eb6d6847c26bada47ae38f9c26c035739352273e439d4a78bf94

SHA512
3d20e206c44771cc6db52a88b9048b54d8afeb5c0b4ad5e64cd7de0c3589fb5326edecc7fad931d15a5e3a07d30733f8891ab7a0555110068eb73f11de5a069e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxA5E6.tmp\SpiderBanner.dll

Filesize
9KB

MD5
17309e33b596ba3a5693b4d3e85cf8d7

SHA1
7d361836cf53df42021c7f2b148aec9458818c01

SHA256
996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93

SHA512
1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxA5E6.tmp\StdUtils.dll

Filesize
100KB

MD5
c6a6e03f77c313b267498515488c5740

SHA1
3d49fc2784b9450962ed6b82b46e9c3c957d7c15

SHA256
b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e

SHA512
9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxA5E6.tmp\System.dll

Filesize
12KB

MD5
0d7ad4f45dc6f5aa87f606d0331c6901

SHA1
48df0911f0484cbe2a8cdd5362140b63c41ee457

SHA256
3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

SHA512
c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxA5E6.tmp\WinShell.dll

Filesize
3KB

MD5
1cc7c37b7e0c8cd8bf04b6cc283e1e56

SHA1
0b9519763be6625bd5abce175dcc59c96d100d4c

SHA256
9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6

SHA512
7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxA5E6.tmp\nsExec.dll

Filesize
6KB

MD5
ec0504e6b8a11d5aad43b296beeb84b2

SHA1
91b5ce085130c8c7194d66b2439ec9e1c206497c

SHA256
5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962

SHA512
3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxA5E6.tmp\nsis7z.dll

Filesize
424KB

MD5
80e44ce4895304c6a3a831310fbf8cd0

SHA1
36bd49ae21c460be5753a904b4501f1abca53508

SHA256
b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592

SHA512
c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df

Download Submit
C:\Users\Admin\AppData\Roaming\FiveMods\Network\Network Persistent State

Filesize
893B

MD5
633e0117b29bc24a403d3a150b21b883

SHA1
c154d210c9c1495d33734074c519fa1c90297c8f

SHA256
1a491fc6ca6ea63a202c51c3d37d75b224668c84e7c48e2727c04d7475036f47

SHA512
d4a1700568cdcfce739ffb62f53e112478e7951eb801db211321bed33ed8d7869141212ecb942df0451c8de5485fb33b4d99e093e7222d3c0075310131c4eda5

Download Submit
C:\Users\Admin\AppData\Roaming\FiveMods\Network\Network Persistent State~RFe58f21b.TMP

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Users\Admin\AppData\Roaming\FiveMods\Network\TransportSecurity

Filesize
354B

MD5
11d9e39df6e665b0a3cb7b5449613f76

SHA1
e705b8aa88aed6c9108d0cad036f83318e5f92b0

SHA256
77f76039233e771f52f3b9d550fdac09278a99a19d9fb410af231da8c12794f4

SHA512
42c2edeb1fb7eae7697f91ac19252e4e0da4c039305eead462c6708c2238ae8e5cc373be86c7febf4b6b5fa52c94ff916a24a2fcf83e5aaa00ce7dd1225ba518

Download Submit
C:\Users\Admin\AppData\Roaming\FiveMods\Network\TransportSecurity~RFe58f3b2.TMP

Filesize
352B

MD5
a63da456daf5ef470a882e9d08db3fa0

SHA1
40f634bea89e76c8aa3e31e3e23aa453fc902247

SHA256
774eff1afe2bd4dbb8d573c36461034571f1b1f4534ed2f3a3639550b325516b

SHA512
ceff3f30f0342538c94391aa73ce13ccc43980d55350692cee792bdf9ab947a7d4ccbb3f779958269b4021dde5a002480eaa099a1d636562fe09c1ea24cd4eea

Download Submit
C:\Users\Admin\AppData\Roaming\FiveMods\Preferences

Filesize
57B

MD5
58127c59cb9e1da127904c341d15372b

SHA1
62445484661d8036ce9788baeaba31d204e9a5fc

SHA256
be4b8924ab38e8acf350e6e3b9f1f63a1a94952d8002759acd6946c4d5d0b5de

SHA512
8d1815b277a93ad590ff79b6f52c576cf920c38c4353c24193f707d66884c942f39ff3989530055d2fade540ade243b41b6eb03cd0cc361c3b5d514cca28b50a

Download Submit
C:\Users\Admin\AppData\Roaming\FiveMods\Preferences~RFe580191.TMP

Filesize
86B

MD5
d11dedf80b85d8d9be3fec6bb292f64b

SHA1
aab8783454819cd66ddf7871e887abdba138aef3

SHA256
8029940de92ae596278912bbbd6387d65f4e849d3c136287a1233f525d189c67

SHA512
6b7ec1ca5189124e0d136f561ca7f12a4653633e2d9452d290e658dfe545acf6600cc9496794757a43f95c91705e9549ef681d4cc9e035738b03a18bdc2e25f0

Download Submit
C:\Users\Admin\AppData\Roaming\FiveMods\Session Storage\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
memory/3944-1161-0x0000024A4E9F0000-0x0000024A4EA12000-memory.dmp

Filesize
136KB

Download