735c1121b6bb8ff9503fe9528f5a1db3327940e5baade3f7cb82844ef559ad57

Resubmissions

11/08/2024, 15:14

240811-smthssyhrf 6

11/08/2024, 14:57

240811-sb1sqsyeje 6

11/08/2024, 14:47

240811-r57ygaybrg 6

Analysis

max time kernel
149s
max time network
151s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
11/08/2024, 14:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

codpc_b7c281ea101cd1043e215e13130f495d.exe
Size

7.2MB
MD5

6877ad6bbd36aaf0d63cbc4cb98e730d
SHA1

84c40f17d0ce9749d4891bfc50fd562e0ccf59ea
SHA256

735c1121b6bb8ff9503fe9528f5a1db3327940e5baade3f7cb82844ef559ad57
SHA512

d2c6a7574d7db67858941b4c9f46813085f85b5d550a2731dcc8d811d4341222933dc167b562b4d4bbe84f78f656b1164d1f3ad01dc4f486992b5385513c8652
SSDEEP

98304:OkLRoeslmBH/BslmBH/d+4dfqslmBH/fdRETDMqjuJLzID5xWpni6+UMBaoU:JMvx45CKTljCLgypni6iaoU

Score

6^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
10	checkip.amazonaws.com
11	checkip.amazonaws.com

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Call of Dragons\update\CALLOFDRAGONS_Data\StreamingAssets\Audio\GeneratedSoundBanks\Windows\Vo_Narrative_Rocco_PCK_121_pack_5.pck.cfg	launcher.exe
File created	C:\Program Files (x86)\Call of Dragons\update\CALLOFDRAGONS_Data\StreamingAssets\_share_map_textures_iceborne.lb.cfg	launcher.exe
File created	C:\Program Files (x86)\Call of Dragons\update\CALLOFDRAGONS_Data\Plugins\locales\ca.pak.cfg	launcher.exe
File created	C:\Program Files (x86)\Call of Dragons\update\CALLOFDRAGONS_Data\Plugins\usd\usdRender\resources\plugInfo.json.meta.cfg	launcher.exe
File created	C:\Program Files (x86)\Call of Dragons\update\CALLOFDRAGONS_Data\Plugins\usd\usdVol\resources\generatedSchema.usda.cfg	launcher.exe
File created	C:\Program Files (x86)\Call of Dragons\update\CALLOFDRAGONS_Data\StreamingAssets\Audio\GeneratedSoundBanks\Windows\Vo_Narrative_Kella_PCK_113_pack_4.pck.cfg	launcher.exe
File created	C:\Program Files (x86)\Call of Dragons\update\CALLOFDRAGONS_Data\StreamingAssets\Audio\GeneratedSoundBanks\Windows\Vo_Narrative_Nico_PCK_116_pack_4.pck.cfg	launcher.exe
File created	C:\Program Files (x86)\Call of Dragons\update\CALLOFDRAGONS_Data\StreamingAssets\pet_preview_scene_123_pack_2.lb.cfg	launcher.exe
File created	C:\Program Files (x86)\Call of Dragons\update\CALLOFDRAGONS_Data\StreamingAssets\yaenbattlefield_replace_atlaspack.lb.cfg	launcher.exe
File opened for modification	C:\Program Files (x86)\Call of Dragons\update\CALLOFDRAGONS_Data\Plugins\limpcbrowser\locales\et.pak.cfg	launcher.exe
File created	C:\Program Files (x86)\Call of Dragons\uninst\is-BVPBD.tmp	codpc_b7c281ea101cd1043e215e13130f495d.tmp
File created	C:\Program Files (x86)\Call of Dragons\update\CALLOFDRAGONS_Data\Plugins\limpcbrowser\locales\es-419.pak.cfg	launcher.exe
File created	C:\Program Files (x86)\Call of Dragons\update\CALLOFDRAGONS_Data\Plugins\usd\usdGeom\resources\usdGeom\schema.usda.meta.cfg	launcher.exe
File opened for modification	C:\Program Files (x86)\Call of Dragons\update\CALLOFDRAGONS_Data\Plugins\locales\ar.pak.cfg	launcher.exe
File created	C:\Program Files (x86)\Call of Dragons\update\CALLOFDRAGONS_Data\Plugins\limpcbrowser\resources.pak.cfg	launcher.exe
File created	C:\Program Files (x86)\Call of Dragons\update\CALLOFDRAGONS_Data\Plugins\usd\usd\resources\plugInfo.json.cfg	launcher.exe
File opened for modification	C:\Program Files (x86)\Call of Dragons\update\CALLOFDRAGONS_Data\Plugins\limpcbrowser\locales\vi.pak	launcher.exe
File created	C:\Program Files (x86)\Call of Dragons\update\CALLOFDRAGONS_Data\Plugins\usd\usdGeom\resources\plugInfo.json.cfg	launcher.exe
File opened for modification	C:\Program Files (x86)\Call of Dragons\update\CALLOFDRAGONS_Data\Plugins\limpcbrowser\locales\pl.pak.cfg	launcher.exe
File opened for modification	C:\Program Files (x86)\Call of Dragons\update\CALLOFDRAGONS_Data\Plugins\limpcbrowser\locales\de.pak	launcher.exe
File opened for modification	C:\Program Files (x86)\Call of Dragons\update\CALLOFDRAGONS_Data\Plugins\locales\sk.pak	launcher.exe
File opened for modification	C:\Program Files (x86)\Call of Dragons\update\CALLOFDRAGONS_Data\Plugins\x86_64\AkSoundEngineDLL.dll.cfg	launcher.exe
File created	C:\Program Files (x86)\Call of Dragons\update\CALLOFDRAGONS_Data\StreamingAssets\alliance_replace_atlaspack.lb.cfg	launcher.exe
File created	C:\Program Files (x86)\Call of Dragons\update\CALLOFDRAGONS_Data\StreamingAssets\replace_texture_events33_nonatlas.lb.cfg	launcher.exe
File created	C:\Program Files (x86)\Call of Dragons\update\api-ms-win-core-debug-l1-1-0.dll.cfg	launcher.exe
File created	C:\Program Files (x86)\Call of Dragons\update\CALLOFDRAGONS_Data\Plugins\limpcbrowser\locales\ml.pak.cfg	launcher.exe
File opened for modification	C:\Program Files (x86)\Call of Dragons\update\CALLOFDRAGONS_Data\Plugins\locales\cs.pak	launcher.exe
File opened for modification	C:\Program Files (x86)\Call of Dragons\update\CALLOFDRAGONS_Data\Plugins\locales\sl.pak.cfg	launcher.exe
File created	C:\Program Files (x86)\Call of Dragons\update\CALLOFDRAGONS_Data\StreamingAssets\replace_texture_petskill_nonatlas.lb.cfg	launcher.exe
File created	C:\Program Files (x86)\Call of Dragons\update\CALLOFDRAGONS_Data\StreamingAssets\replace_texture_seasonkvkreward_nonatlas.lb.cfg	launcher.exe
File opened for modification	C:\Program Files (x86)\Call of Dragons\update\CALLOFDRAGONS_Data\Plugins\limpcbrowser\vk_swiftshader.dll.cfg	launcher.exe
File created	C:\Program Files (x86)\Call of Dragons\update\CALLOFDRAGONS_Data\StreamingAssets\Audio\GeneratedSoundBanks\Windows\Vo_Narrative_Capra_PCK_114_pack_4.pck.cfg	launcher.exe
File created	C:\Program Files (x86)\Call of Dragons\update\CALLOFDRAGONS_Data\StreamingAssets\embedded_LuaState_ResumeFunc.ls.cfg	launcher.exe
File created	C:\Program Files (x86)\Call of Dragons\update\CALLOFDRAGONS_Data\StreamingAssets\pet_pack_2.lb.cfg	launcher.exe
File created	C:\Program Files (x86)\Call of Dragons\update\CALLOFDRAGONS_Data\StreamingAssets\lc_buff.dat.cfg	launcher.exe
File created	C:\Program Files (x86)\Call of Dragons\cef\locales\uk.pak	codpc_b7c281ea101cd1043e215e13130f495d.tmp
File created	C:\Program Files (x86)\Call of Dragons\update\CALLOFDRAGONS_Data\Plugins\limpcbrowser\locales\de.pak.cfg	launcher.exe
File created	C:\Program Files (x86)\Call of Dragons\update\CALLOFDRAGONS_Data\StreamingAssets\hero_arda_mid_pack_3.lb.cfg	launcher.exe
File created	C:\Program Files (x86)\Call of Dragons\update\CALLOFDRAGONS_Data\StreamingAssets\prefabs_ui_template_talents.lb.cfg	launcher.exe
File opened for modification	C:\Program Files (x86)\Call of Dragons\update\CALLOFDRAGONS_Data\Plugins\locales\hr.pak	launcher.exe
File created	C:\Program Files (x86)\Call of Dragons\update\CALLOFDRAGONS_Data\Plugins\usd\usdGeom\resources\usdGeom.meta.cfg	launcher.exe
File created	C:\Program Files (x86)\Call of Dragons\update\CALLOFDRAGONS_Data\StreamingAssets\darkness_unit_wilding.lb.cfg	launcher.exe
File created	C:\Program Files (x86)\Call of Dragons\update\CALLOFDRAGONS_Data\StreamingAssets\demo_pcend.lb.cfg	launcher.exe
File opened for modification	C:\Program Files (x86)\Call of Dragons\update\CALLOFDRAGONS_Data\Plugins\usd\plugInfo.json.cfg	launcher.exe
File created	C:\Program Files (x86)\Call of Dragons\update\CALLOFDRAGONS_Data\Plugins\usd\usdSkel\resources\generatedSchema.usda.cfg	launcher.exe
File created	C:\Program Files (x86)\Call of Dragons\update\CALLOFDRAGONS_Data\StreamingAssets\darkness_unit_wilding_pack_2.lb.cfg	launcher.exe
File created	C:\Program Files (x86)\Call of Dragons\update\CALLOFDRAGONS_Data\StreamingAssets\lc_common.dat.cfg	launcher.exe
File created	C:\Program Files (x86)\Call of Dragons\update\CALLOFDRAGONS_Data\Plugins\locales\ro.pak.cfg	launcher.exe
File created	C:\Program Files (x86)\Call of Dragons\update\CALLOFDRAGONS_Data\StreamingAssets\replace_texture_artifactitems_nonatlas.lb.cfg	launcher.exe
File created	C:\Program Files (x86)\Call of Dragons\update\CALLOFDRAGONS_Data\StreamingAssets\replace_texture_multipleanswer_nonatlas.lb.cfg	launcher.exe
File opened for modification	C:\Program Files (x86)\Call of Dragons\update\CALLOFDRAGONS_Data\Plugins\usd\usdVol.meta	launcher.exe
File opened for modification	C:\Program Files (x86)\Call of Dragons\update\CALLOFDRAGONS_Data\Plugins\limpcbrowser\locales\sw.pak	launcher.exe
File opened for modification	C:\Program Files (x86)\Call of Dragons\update\CALLOFDRAGONS_Data\Plugins\locales\de.pak.cfg	launcher.exe
File opened for modification	C:\Program Files (x86)\Call of Dragons\update\CALLOFDRAGONS_Data\Plugins\usd\usdHydra\resources\shaders.meta	launcher.exe
File created	C:\Program Files (x86)\Call of Dragons\update\CALLOFDRAGONS_Data\StreamingAssets\_share_mapfbx_pack_2.lb.cfg	launcher.exe
File created	C:\Program Files (x86)\Call of Dragons\update\CALLOFDRAGONS_Data\sharedassets0.assets.cfg	launcher.exe
File created	C:\Program Files (x86)\Call of Dragons\cef\locales\nl.pak	codpc_b7c281ea101cd1043e215e13130f495d.tmp
File created	C:\Program Files (x86)\Call of Dragons\update\CALLOFDRAGONS_Data\StreamingAssets\hero_tohar_common_pack_3.lb.cfg	launcher.exe
File created	C:\Program Files (x86)\Call of Dragons\update\CALLOFDRAGONS_Data\StreamingAssets\lc_research.dat.cfg	launcher.exe
File created	C:\Program Files (x86)\Call of Dragons\update\CALLOFDRAGONS_Data\StreamingAssets\ezRes_strategyMap_sprite.bin.cfg	launcher.exe
File created	C:\Program Files (x86)\Call of Dragons\update\CALLOFDRAGONS_Data\StreamingAssets\replace_texture_events76_nonatlas.lb.cfg	launcher.exe
File created	C:\Program Files (x86)\Call of Dragons\update\CALLOFDRAGONS_Data\StreamingAssets\ui_texture_hero.lb.cfg	launcher.exe
File created	C:\Program Files (x86)\Call of Dragons\uninst\is-2S63U.tmp	codpc_b7c281ea101cd1043e215e13130f495d.tmp
File created	C:\Program Files (x86)\Call of Dragons\cef\natives_blob.bin	codpc_b7c281ea101cd1043e215e13130f495d.tmp

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\Fonts\Quadrat-Serial-Regular.ttf	codpc_b7c281ea101cd1043e215e13130f495d.tmp
File created	C:\Windows\Fonts\quadrat-serial-boldXXX.ttf	codpc_b7c281ea101cd1043e215e13130f495d.tmp
File created	C:\Windows\Fonts\SourceHanSansCNRegular.ttf	codpc_b7c281ea101cd1043e215e13130f495d.tmp
File opened for modification	C:\Windows\Fonts\SourceHanSansCNRegular.ttf	codpc_b7c281ea101cd1043e215e13130f495d.tmp
File created	C:\Windows\Fonts\SourceHanSansCNBold.ttf	codpc_b7c281ea101cd1043e215e13130f495d.tmp

Executes dropped EXE 5 IoCs

pid	Process
1040	codpc_b7c281ea101cd1043e215e13130f495d.tmp
1140	launcher.exe
1808	cef_helper.exe
1476	launcher.exe
292	cef_helper.exe

Loads dropped DLL 18 IoCs

pid	Process
1968	codpc_b7c281ea101cd1043e215e13130f495d.exe
1040	codpc_b7c281ea101cd1043e215e13130f495d.tmp
1040	codpc_b7c281ea101cd1043e215e13130f495d.tmp
1040	codpc_b7c281ea101cd1043e215e13130f495d.tmp
1040	codpc_b7c281ea101cd1043e215e13130f495d.tmp
1140	launcher.exe
1040	codpc_b7c281ea101cd1043e215e13130f495d.tmp
1040	codpc_b7c281ea101cd1043e215e13130f495d.tmp
1040	codpc_b7c281ea101cd1043e215e13130f495d.tmp
1040	codpc_b7c281ea101cd1043e215e13130f495d.tmp
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1140	launcher.exe
1808	cef_helper.exe
292	cef_helper.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	codpc_b7c281ea101cd1043e215e13130f495d.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	codpc_b7c281ea101cd1043e215e13130f495d.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	codpc_b7c281ea101cd1043e215e13130f495d.tmp
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	codpc_b7c281ea101cd1043e215e13130f495d.tmp
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\	launcher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	launcher.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	codpc_b7c281ea101cd1043e215e13130f495d.tmp
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	codpc_b7c281ea101cd1043e215e13130f495d.tmp

Script User-Agent 3 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	4	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	5	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	7	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1040	codpc_b7c281ea101cd1043e215e13130f495d.tmp
1040	codpc_b7c281ea101cd1043e215e13130f495d.tmp

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1040	codpc_b7c281ea101cd1043e215e13130f495d.tmp

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1040	codpc_b7c281ea101cd1043e215e13130f495d.tmp
1040	codpc_b7c281ea101cd1043e215e13130f495d.tmp
1040	codpc_b7c281ea101cd1043e215e13130f495d.tmp
1040	codpc_b7c281ea101cd1043e215e13130f495d.tmp
1040	codpc_b7c281ea101cd1043e215e13130f495d.tmp
1040	codpc_b7c281ea101cd1043e215e13130f495d.tmp
1040	codpc_b7c281ea101cd1043e215e13130f495d.tmp
1040	codpc_b7c281ea101cd1043e215e13130f495d.tmp
1040	codpc_b7c281ea101cd1043e215e13130f495d.tmp
1040	codpc_b7c281ea101cd1043e215e13130f495d.tmp
1040	codpc_b7c281ea101cd1043e215e13130f495d.tmp
1040	codpc_b7c281ea101cd1043e215e13130f495d.tmp
1040	codpc_b7c281ea101cd1043e215e13130f495d.tmp
1040	codpc_b7c281ea101cd1043e215e13130f495d.tmp
1040	codpc_b7c281ea101cd1043e215e13130f495d.tmp
1040	codpc_b7c281ea101cd1043e215e13130f495d.tmp
1040	codpc_b7c281ea101cd1043e215e13130f495d.tmp
1040	codpc_b7c281ea101cd1043e215e13130f495d.tmp
1040	codpc_b7c281ea101cd1043e215e13130f495d.tmp
1040	codpc_b7c281ea101cd1043e215e13130f495d.tmp
1040	codpc_b7c281ea101cd1043e215e13130f495d.tmp
1040	codpc_b7c281ea101cd1043e215e13130f495d.tmp
1040	codpc_b7c281ea101cd1043e215e13130f495d.tmp
1040	codpc_b7c281ea101cd1043e215e13130f495d.tmp
1040	codpc_b7c281ea101cd1043e215e13130f495d.tmp
1040	codpc_b7c281ea101cd1043e215e13130f495d.tmp
1040	codpc_b7c281ea101cd1043e215e13130f495d.tmp
1040	codpc_b7c281ea101cd1043e215e13130f495d.tmp
1040	codpc_b7c281ea101cd1043e215e13130f495d.tmp
1040	codpc_b7c281ea101cd1043e215e13130f495d.tmp
1040	codpc_b7c281ea101cd1043e215e13130f495d.tmp
1040	codpc_b7c281ea101cd1043e215e13130f495d.tmp
1040	codpc_b7c281ea101cd1043e215e13130f495d.tmp
1040	codpc_b7c281ea101cd1043e215e13130f495d.tmp
1040	codpc_b7c281ea101cd1043e215e13130f495d.tmp
1040	codpc_b7c281ea101cd1043e215e13130f495d.tmp
1040	codpc_b7c281ea101cd1043e215e13130f495d.tmp
1040	codpc_b7c281ea101cd1043e215e13130f495d.tmp
1040	codpc_b7c281ea101cd1043e215e13130f495d.tmp
1040	codpc_b7c281ea101cd1043e215e13130f495d.tmp
1040	codpc_b7c281ea101cd1043e215e13130f495d.tmp
1040	codpc_b7c281ea101cd1043e215e13130f495d.tmp
1040	codpc_b7c281ea101cd1043e215e13130f495d.tmp
1040	codpc_b7c281ea101cd1043e215e13130f495d.tmp
1040	codpc_b7c281ea101cd1043e215e13130f495d.tmp
1040	codpc_b7c281ea101cd1043e215e13130f495d.tmp
1040	codpc_b7c281ea101cd1043e215e13130f495d.tmp
1040	codpc_b7c281ea101cd1043e215e13130f495d.tmp
1040	codpc_b7c281ea101cd1043e215e13130f495d.tmp
1040	codpc_b7c281ea101cd1043e215e13130f495d.tmp
1040	codpc_b7c281ea101cd1043e215e13130f495d.tmp
1040	codpc_b7c281ea101cd1043e215e13130f495d.tmp
1040	codpc_b7c281ea101cd1043e215e13130f495d.tmp
1040	codpc_b7c281ea101cd1043e215e13130f495d.tmp
1040	codpc_b7c281ea101cd1043e215e13130f495d.tmp
1040	codpc_b7c281ea101cd1043e215e13130f495d.tmp
1040	codpc_b7c281ea101cd1043e215e13130f495d.tmp
1040	codpc_b7c281ea101cd1043e215e13130f495d.tmp
1040	codpc_b7c281ea101cd1043e215e13130f495d.tmp
1040	codpc_b7c281ea101cd1043e215e13130f495d.tmp
1040	codpc_b7c281ea101cd1043e215e13130f495d.tmp
1040	codpc_b7c281ea101cd1043e215e13130f495d.tmp
1040	codpc_b7c281ea101cd1043e215e13130f495d.tmp
1040	codpc_b7c281ea101cd1043e215e13130f495d.tmp

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1140	launcher.exe
1140	launcher.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 1040	1968	codpc_b7c281ea101cd1043e215e13130f495d.exe	30
PID 1968 wrote to memory of 1040	1968	codpc_b7c281ea101cd1043e215e13130f495d.exe	30
PID 1968 wrote to memory of 1040	1968	codpc_b7c281ea101cd1043e215e13130f495d.exe	30
PID 1968 wrote to memory of 1040	1968	codpc_b7c281ea101cd1043e215e13130f495d.exe	30
PID 1968 wrote to memory of 1040	1968	codpc_b7c281ea101cd1043e215e13130f495d.exe	30
PID 1968 wrote to memory of 1040	1968	codpc_b7c281ea101cd1043e215e13130f495d.exe	30
PID 1968 wrote to memory of 1040	1968	codpc_b7c281ea101cd1043e215e13130f495d.exe	30
PID 1040 wrote to memory of 1140	1040	codpc_b7c281ea101cd1043e215e13130f495d.tmp	33
PID 1040 wrote to memory of 1140	1040	codpc_b7c281ea101cd1043e215e13130f495d.tmp	33
PID 1040 wrote to memory of 1140	1040	codpc_b7c281ea101cd1043e215e13130f495d.tmp	33
PID 1040 wrote to memory of 1140	1040	codpc_b7c281ea101cd1043e215e13130f495d.tmp	33
PID 1140 wrote to memory of 1808	1140	launcher.exe	34
PID 1140 wrote to memory of 1808	1140	launcher.exe	34
PID 1140 wrote to memory of 1808	1140	launcher.exe	34
PID 1040 wrote to memory of 1476	1040	codpc_b7c281ea101cd1043e215e13130f495d.tmp	35
PID 1040 wrote to memory of 1476	1040	codpc_b7c281ea101cd1043e215e13130f495d.tmp	35
PID 1040 wrote to memory of 1476	1040	codpc_b7c281ea101cd1043e215e13130f495d.tmp	35
PID 1040 wrote to memory of 1476	1040	codpc_b7c281ea101cd1043e215e13130f495d.tmp	35
PID 1140 wrote to memory of 292	1140	launcher.exe	36
PID 1140 wrote to memory of 292	1140	launcher.exe	36
PID 1140 wrote to memory of 292	1140	launcher.exe	36

C:\Users\Admin\AppData\Local\Temp\codpc_b7c281ea101cd1043e215e13130f495d.exe
"C:\Users\Admin\AppData\Local\Temp\codpc_b7c281ea101cd1043e215e13130f495d.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Users\Admin\AppData\Local\Temp\is-L634G.tmp\codpc_b7c281ea101cd1043e215e13130f495d.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-L634G.tmp\codpc_b7c281ea101cd1043e215e13130f495d.tmp" /SL5="$400BE,6476341,925696,C:\Users\Admin\AppData\Local\Temp\codpc_b7c281ea101cd1043e215e13130f495d.exe"
  2⤵
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1040
- - C:\Program Files (x86)\Call of Dragons\launcher.exe
    "C:\Program Files (x86)\Call of Dragons\launcher.exe"
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:1140
  - - C:\Program Files (x86)\Call of Dragons\cef\cef_helper.exe
      ".\cef\cef_helper.exe" --type=renderer --disable-gpu-compositing --no-sandbox --enable-begin-frame-scheduling --lang=en-US --lang=en-US --log-file="C:\Program Files (x86)\Call of Dragons\cef_temp\cef.log" --ppapi-flash-path="PepperFlash\pepflashplayer.dll" --ppapi-flash-version=20.0.0.228 --device-scale-factor=1 --num-raster-threads=4 --content-image-texture-target=3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553 --video-image-texture-target=3553 --disable-accelerated-video-decode --disable-webrtc-hw-encoding --disable-gpu-compositing --channel="1140.0.2018247866\1373278181" /prefetch:1
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1808
  - - C:\Program Files (x86)\Call of Dragons\cef\cef_helper.exe
      ".\cef\cef_helper.exe" --type=utility --channel="1140.1.1524201436\617529941" --lang=en-US --no-sandbox --no-sandbox --lang=en-US --log-file="C:\Program Files (x86)\Call of Dragons\cef_temp\cef.log" /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:292
- - C:\Program Files (x86)\Call of Dragons\launcher.exe
    "C:\Program Files (x86)\Call of Dragons\launcher.exe"
    3⤵
    - Executes dropped EXE
    PID:1476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Call of Dragons\cef\cef.pak

Filesize
2.2MB

MD5
4d991b6db94e823aac8cef6eb1959662

SHA1
84856f2eba08c5ad2df6a946e0eb7519bc9fb6cc

SHA256
2e07dc909efb9d9316e15452f168581966bdc7ad8fb607d3d3a339aaa8dc0266

SHA512
9842bf88339eaed96f81e82b1f1b15f6fe259449097e44f5d7738cd0aa79786da5e0b777d84b9a6a1c08bf3d0edfcf71c9cb396bd6c78145c5dfd171b8384f1f

Download Submit
C:\Program Files (x86)\Call of Dragons\cef\cef_100_percent.pak

Filesize
141KB

MD5
ad2ddfc39c78eedc734af6506a579a8c

SHA1
64e66d48ab3a98503948202dec3ff2f35470cd5b

SHA256
58f7ce00d589aaaebfaf3d0badac45924545e49f2d1531156f282eac7abb11b5

SHA512
7482b0c4c51bf4d3c3389a6ccf9c59307911ba793116bac04077594d9b3d6f54a07e6187764201fba8bb31ede88b9ff65ab6867a2526e0f8e7b16136f7978367

Download Submit
C:\Program Files (x86)\Call of Dragons\cef\cef_200_percent.pak

Filesize
227KB

MD5
66fa52c0523ae2ec18c37960e4eb3e6a

SHA1
61ac3e8e84a7f84790a835998873431c4a086bd9

SHA256
25006f654d50e7e63f4557357437eff5f6bda3dc6e8bf86cf0bd5b02fdbf2a28

SHA512
e8cfdc0937982245e9d31d2d62ed39e7e3b86c9fee41482597cb6c77cd54ea4eff6e35362d81a32dbe54baffefeeca31a4259ce9ea7c06e65904f3816dc65d58

Download Submit
C:\Program Files (x86)\Call of Dragons\cef\cef_extensions.pak

Filesize
4.1MB

MD5
6e727928ebeeeb5847c65c15c41802ed

SHA1
d22ba6f8e3160484dd40fd5f4eb685182f404d88

SHA256
221a97daf8263321ceb9ce244452fc97b865b561e399b23d42682fef4785ea7f

SHA512
d39e98d8d2e9afc84f8188e27e412079667df2174da14f93f451396ea1a27fd5abf9fb8218ff02c94b56c60e7e5e59a5819d50d2463ef6f6ad71d29cf1f155a8

Download Submit
C:\Program Files (x86)\Call of Dragons\cef\cef_helper.exe

Filesize
413KB

MD5
268c09b97ec97307464edc76e51fae9d

SHA1
82625950cc91acb9de9d942d06173b062cd7ec34

SHA256
de65d9d3437b45e45ab689a9c3ad1bd35f4f97967cacc97bdce9d50cfd4f7a3d

SHA512
58ed50b3df711039693294f5c74edf42eb1ad2382dc1b4a8444013a60354860c7b15c83718c8aea7b38310744afa49fcb599d9ac714de72f625dd762fae15500

Download Submit
C:\Program Files (x86)\Call of Dragons\cef\d3dcompiler_43.dll

Filesize
2.0MB

MD5
10a7a235cdba26ef1cd30fa89ab300b3

SHA1
b5db9f52fc465115293023eee5eb80420ffbdcfa

SHA256
662296a0b55709fc4637314eb4ee1439e8bf1bdc40d262c72ab608d1be01d4b6

SHA512
850a3c1a4f8149cf18963f59e5567f0a0171bfc72427b3a100614202b343fcbe584e26abaf018d52e4514a3e07bd036f5076c13caba36db78c4af1895fba806c

Download Submit
C:\Program Files (x86)\Call of Dragons\cef\d3dcompiler_47.dll

Filesize
4.3MB

MD5
da234a040ecdc370d4c369de8b037ea6

SHA1
5e175f4e8b241938c1a0d44a78bc598297f2d4e7

SHA256
0b541caf0c17a9f72bfb0fd30f8ffc535a1a5282d8b5f9d8b306fe0df6baf871

SHA512
264d837601e8cf5c9449fdcaa6e2e64d5c634d84cf17eb602ef1c4449e62de5543e65b9027fb559a15d2434d95c67a2f39599fdd18f83b880de67a27fc3369fe

Download Submit
C:\Program Files (x86)\Call of Dragons\cef\devtools_resources.pak

Filesize
4.4MB

MD5
37936cb4d567ec68a1f22b5f923fd14f

SHA1
d85de3ce443335c6065a248801f56e9fa1ba3736

SHA256
de7fad0fb516c05ba2470d97d31e86ad44f5269c6b4fadaeb6ac955f4dc1a6d7

SHA512
5c08bdff7c6ac3724a277e2287eec2effc12793dae6fe05e99e772c0c0a3aa262e7d13a7569756466aa1c4bd9e1fc2f04c38adc34b38fdab0e5765dec7f1fcc1

Download Submit
C:\Program Files (x86)\Call of Dragons\cef\icudtl.dat

Filesize
9.7MB

MD5
d03ad9a1189d190119209072d048e428

SHA1
aa954098e3ae4c00f67bace45b39a7b4a8242c6a

SHA256
2857fbe46d007307b1e204c6eb1b7e4988973b958ec8edb07445988f332c1ab5

SHA512
4f73a2c0ceef525e5947dc6eeb7608db40e535eeadb37d83842bdd638eb4d9114f3654d8094c0b72c66ae4bb0214b0947cd4fe2b56426f778c07f3cac5faea21

Download Submit
C:\Program Files (x86)\Call of Dragons\cef\libEGL.dll

Filesize
95KB

MD5
d721e56009f8ab2ea1c2657a705dcdce

SHA1
3e8ff528e2c323a0e7e9836b7a9c02d42cdac195

SHA256
d24b6b39918f3e61e158b205af0964e0b827ba025c86726d6620db16537e8345

SHA512
1d212b12349d5cd799dbaa49ebe2a9da636a907ed02b0ef9df12dcc01e05a12f4e4dc3603a24aa183b3531f6591a3bd3b4b09537d5fc858058e2edd07c4d1f22

Download Submit
C:\Program Files (x86)\Call of Dragons\cef\libGLESv2.dll

Filesize
2.0MB

MD5
718a10bb9166f61824522f6d4b9b372e

SHA1
78340b9fe9e153c79e450b221733e1603a53cad8

SHA256
686dfcbec5a7f033fb51cae40e816f23fd56f39497cc2d2aa811e2626e0c5cbf

SHA512
2194c9d8debd0b66c315f7252d1b13dd893038375390c940960649d367f17929cf20327867e5563f022c468f1face8da52096b16fc7faf00a885be19d7d8dbe8

Download Submit
C:\Program Files (x86)\Call of Dragons\cef\natives_blob.bin

Filesize
402KB

MD5
8f4d6515f4d321313a39a659c3c5ff01

SHA1
f4c95f1abd24c715a3dd4b3e4c9cff5decda7250

SHA256
7d9c0c4d88618bdd16bb0681fdec1dd736e2ed1141ae527a27b22fb93f27848f

SHA512
3c00eb9a8ca8d076140df0071cfa702e1c032edbc20481bb7f7b7a88c1a82c959b8ac901182c2f9d235f55b4528c8e12b1e765119f1e784645c61f66c1c2b007

Download Submit
C:\Program Files (x86)\Call of Dragons\cef\snapshot_blob.bin

Filesize
604KB

MD5
f4f1cb8317868f36ffb3c57978167ae6

SHA1
fcf94677714fef6e1fadc7914c5c2c123f8aed56

SHA256
e32f9e538a286ea29adafa20d0269af7278cfc0f8899ea75281f4037c65ca00f

SHA512
cce41cfaf4a9a9f4600c97dc3882f38a0e55cfe6884f8c4f83d062a0253d035ff5d510805f88edf83e1a97a78c8a1dbf9282d8c24a0d2693e0c4e6cb6aed80dd

Download Submit
C:\Program Files (x86)\Call of Dragons\cef\widevinecdm.dll

Filesize
173KB

MD5
1d1b37f8ede3dccb1d84e06251045f7a

SHA1
fbee080631d3b51e62d19a5b79f2224158ba3ceb

SHA256
64a353d9e7e50d93812f078fc93a3203b5df475fe8437af21c76b6a0298ecfd8

SHA512
c5e9f7e63cdf50bc10fb8072c5fb9939468bfcdcade23213e7efb09ad6e09f2b8a29bc6f7aa6d1677c7ab22a48b3b92b06ed43a71532cc10a35087c9e8855b16

Download Submit
C:\Program Files (x86)\Call of Dragons\cef\widevinecdmadapter.dll

Filesize
238KB

MD5
3a6182fcabc5d91202282675534e4284

SHA1
93d4a3d71fa03e9b154c8eb6f4a54ae00df78a98

SHA256
c4da29aaace264e3f8e58f6e26dd21419f55733e5d29d4be18cfb8649b1d0567

SHA512
ed6c2b61c367c168d3efab469e4d18ce12f79915cb24dc88a3699efeab20ca3aafc65c4db515f683ce33d4eb59861932ec2254254a10dec12f7577fadc02696f

Download Submit
C:\Program Files (x86)\Call of Dragons\cef\wow_helper.exe

Filesize
75KB

MD5
f04e8b7613a6b18ccae2d074468d9489

SHA1
e2ae578b6626ac72a1b5033bfc4748e14795f313

SHA256
d3fca4455704f35add4f38fdc0e6d83581063b3c0fc30333a30f9aaf19edf733

SHA512
c4112c9789fc5e8045f3841cb821f9706399098a7e3eb969fc89a571a44bf7650090fd9c4f8dd4b44657b1656bfa7b2128034d8f684adb92c04c69318662f7c5

Download Submit
C:\Program Files (x86)\Call of Dragons\cef_temp\cef.log

Filesize
3KB

MD5
540436897652adbd7f3b50fd18e42ae2

SHA1
64ed59545df01413f96e1ec4ef5505e24e16fc72

SHA256
72fdffa5bde98e7ce5c132876fe899f85e3b62828f6613a6532d7aacb8ea739b

SHA512
ad97a9c0fd977580f9a20cb9062d37581ca97fa99bc5c2aa8d10b6e0946460fb53dd3c5f72703352b26832db66fa6547c719e01925b0f6a4844321f613657945

Download Submit
C:\Program Files (x86)\Call of Dragons\cef_temp\cef.log

Filesize
3KB

MD5
cfe9f81ffaf9d089828f057fcbc02e89

SHA1
164b1a7a4202c9a9e138c13520ab9b1a5d7997db

SHA256
571173a5872fea6b9a86a27e80f9c3a467a673872d2ffc71ee98ed1416b02267

SHA512
8ffc3ef609ff2c235ee25aa6d30095821f9b801f89c8245dca3768dac92e3907a14cc9c445d43e9e3a4f6b2aeb0ad95455afa13a1d510e0cf71a565ae5ecc751

Download Submit
C:\Program Files (x86)\Call of Dragons\dependence_version_map.txt

Filesize
528B

MD5
875ff9aa894f262f32c3cc019c6e71d7

SHA1
31d40687b5827efc933bf23f66aa7d16d2e033d9

SHA256
7da88bf3e62a3885e785913e9f09edb15777dacef42f25ef89ffa20b8722a5ec

SHA512
a71cb7956468293dbb9e4254142bb9589a9daa752bc57e6352c2eb3dae58b264954fb43b6b596a19b447ceebe66f4ad20b00b4ec000e5dc5586f05e7af5ceef3

Download Submit
C:\Program Files (x86)\Call of Dragons\launcher.exe

Filesize
30.2MB

MD5
5a351bcd025627e16ab67b87f9e063d2

SHA1
7abc45220ebe494e7e986ebbd58c6d91e295477b

SHA256
e83f510696529c84f073680e7c2d916f50d9d763309c88dd6f82d5f1dcf59a44

SHA512
6a078e017a4bb0a251d3280c0056c1487ca5bd605916844329c834abd1a735b2929a8e7c985bd868ac5e1931f24e17f6e4a83fef4d0d4547aa618076891c35ee

Download Submit
C:\Program Files (x86)\Call of Dragons\launcher_version_map.txt

Filesize
7KB

MD5
9d3dc5b82c245dfeea118edd7ed40d2a

SHA1
818cdb0c3f9c0cbb73a7561079220fcac538e93f

SHA256
9d4f5ad99d8ec88d41b232bb17eedefaf8792ea49dc639124c379f3a17638839

SHA512
611fa353b8106cd49eced0e974f7f62a14384fc5dd52baf1021192fc770f10e36e0f26afe2e21b8c9cb0bfd7dedaddde9eab51cdda2e890a5c51138cc9981660

Download Submit
C:\Program Files (x86)\Call of Dragons\save\extra_config.txt

Filesize
42B

MD5
976c4dd1c96dc3ff8f771db72f69d401

SHA1
ff052cd63669929827829be83df237ab1eef91f4

SHA256
c6e5a45b28ba3b26faae7baaff5bfb3abe284e8f5d3211062753d3e23d49ef54

SHA512
a40d144f17b8e4598dc60ffb2c4832733dbf2fe9484b24b28085fc286ca69f5d95c425ddc4d958a653bd216d73d91865f5cd819e8bccfba35b660768fd5ec818

Download Submit
C:\Program Files (x86)\Call of Dragons\save\gid.txt

Filesize
32B

MD5
f31906df47264b667dfb92d4327864d9

SHA1
ef42c9d58526287b122555a8b3eb235282e75d39

SHA256
0774ab2bb4764bfdf4c89efdbf2cc283312a3a14508ae17178a3535b22948067

SHA512
ff252d12d836bf105f7c322daa417b891e3820a76892dc646e73b1427dd1df70025bd40c3bda13a866ca1f6538ff8202e912ae3c96507164715300b9dfba5f36

Download Submit
C:\Program Files (x86)\Call of Dragons\uninst\is-9G692.tmp

Filesize
72KB

MD5
80d57687d340efdf9a72e8fb79c7b05b

SHA1
3942d1a7259ea061922bccd801726d4649813a9c

SHA256
e8ea8f8811722897d8c48850c6418d06428e38bab3e575e6ad8df3951c5c854e

SHA512
3afdefb505c8ab8ab885e82da367b803a77d26ed4b7f0c0f55a7450fb9dd219af935deab9eec4f2b98f08082e3c80b4f1e63add505b658b675b855c77cd22e04

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-UAQL1.tmp\cef\locales\am.pak

Filesize
66KB

MD5
c8e9074faa1d9428089fe39a6340c43d

SHA1
3d345aa7462ef82e000057e49dfe7d48f6f049eb

SHA256
3abf4b49ec48ea46d97c7def4c4dbce5d24d452710e8bd113cd7cfcf6280f95e

SHA512
f32201ffa1ce3b1db75193c4f737ff7973f6e449c7482b3871b8af612b2d25453fea0000a7b47026e44c91f627e9f56ce5278da14c34467f77f005653cc95889

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-UAQL1.tmp\cef\locales\ar.pak

Filesize
66KB

MD5
3e0f34e58af836de6b1ffa787e0653b2

SHA1
bdd143eb4abd1adf116ff7f6fb15381157ca0630

SHA256
1804cab9fa42d7735689e9cdd7a17ecc1660aa70fe0ffd4eb634f5c3b5a1c9bf

SHA512
875138895e23944b5a67c06f4519114067ecf2b0ef7d8365171d542f7df66ed8f9ac9ef2e0a20f74f3446bc7cf11c7d8c7c6e6840c3e9339f73aa78084a386d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-UAQL1.tmp\cef\locales\bg.pak

Filesize
73KB

MD5
5db5f8e5b0b52076aa0462d382c15c4d

SHA1
bc240e4b1c1697b86fcf916947a48393a3a1a6b1

SHA256
4fba49dca07e767405ab42a07b9273554a9ded4ff48ed0af64c5e11296317610

SHA512
93e9e56ae2f25406f52cd8c3271b54cf32095ef080b746695824fcb658b493337f4e5ef6f3d450eb36f13a79d4c546c9be00f6b4eb1d09f89c9bd793d4304d4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-UAQL1.tmp\cef\locales\bn.pak

Filesize
97KB

MD5
1442225a0a7fd12ca7ed34f6ed37ff22

SHA1
80e86ce712326d37a30eef8725c6a07a26eae577

SHA256
5328bfd92b9c1ac61ca43591574118d970ae7b158abbd9d331668e94583e5b14

SHA512
cef1294cbc46edc4d13f3ea4e2639bef62795393222bbc6ced75d7ffd4fbac78cb304fdea10484bfbf75ddfc64bf89bf66946f4f9995b981ac9bef4b350e0834

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-UAQL1.tmp\cef\locales\ca.pak

Filesize
48KB

MD5
63f9363aa965e0b6835b1b84c48b1ae8

SHA1
8dccb0f28805885a34abb183a3c74e8d9f017774

SHA256
132f24640ef6e7beb6bd5e7a8e556adc2c8b209576d9a92b4d2cffaf162958ef

SHA512
a81db236f338cf33e58f102e2bb1aa2c7e625038f251dab3081076ca3aa7a1671d857332da397c780a05c1aef2c63ba5ff22f8a5311b2c5dae2b2fa5c1a8b009

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-UAQL1.tmp\cef\locales\cs.pak

Filesize
48KB

MD5
4d08959d93c5f8f665ef2824856f5e64

SHA1
56d19a6da933186467adfad896d58e78a4c12e65

SHA256
220aa7ee2524ff663ff866a589a99bdcd8238fe2f5f1676896e881ed713a4ece

SHA512
afe2624a566be5dc22b47edf25d22e5286120b6f6e4856584ae5512b43c83491c41bab82ce0de318a84ae1d828b8c9ef60c131d7c35769e3162028a2c6751a0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-UAQL1.tmp\cef\locales\da.pak

Filesize
43KB

MD5
b99e86c8f7b181322ece052e1a57a2be

SHA1
6cbc6a960f9e071f23aee5d75f362ca5092924c6

SHA256
98214079c6d17eb7d878e23cfb3a87b6191d40baccfa4895bccf13324c1c29f4

SHA512
b03841b14868bbc1d9a65e23f86c3801ec8dc118d13efb267239f795b2adddbdd94907fdec7b558ec2767fac83ee82417cd283418a0756f9a55821479d9c888b

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-UAQL1.tmp\cef\locales\de.pak

Filesize
47KB

MD5
6a2b3005805a7500570e442251efebe8

SHA1
da2127683f6fb31d5e065db13ce39ad4651c5dfb

SHA256
d84ddda26f4f6122f05c2bf06924097d374fb6f339693a0f5f0a30a52b2fce8f

SHA512
d30a8e10e9bc5a8a3fbcedfa8d16cbfb8de9c449cb48c81f2696e399bbeeb5b55529bf12b297c1248be4432669c1d3c7d4219f8f8c57c50236547ff7cf79c019

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-UAQL1.tmp\cef\locales\el.pak

Filesize
82KB

MD5
9ca20da58e84e6f426deaf7821530ec6

SHA1
8d3b3ee5a2a3eb977ac6e88f4d3a448de89a87a6

SHA256
9a7bbba149721c583a42a74ec6a6579eed9999a8ea4b25d37315c5cc5a14b0bd

SHA512
f26a7b6ceefb96d37ad0818a22a35df5717331cb74835e7010ce8e1430a49c2a2467b7078b75068b7c8a422d40e89ce17e03c2de82086fe66e3cc7349b3b39b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-UAQL1.tmp\cef\locales\en-GB.pak

Filesize
39KB

MD5
3a0a0f6b73f7f7e8a021ee435f494139

SHA1
d63b91c0923872b2ba2cabf5bd8b00b6437b3b3f

SHA256
0150cca64343e7c4e29ddbb1e266a77fded9dbe42a09d4adeedb1dca61f07fa8

SHA512
5b895f8d1da1c5c1f7a6c29b06d8816fafdb518140d648b0a7b0747cd0349da25148999eed37da1bad44b1d48be92110ac8b35e8bc21b5b50c4de9d535db5766

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-UAQL1.tmp\cef\locales\en-US.pak

Filesize
39KB

MD5
ea20f7ef299ca680a72e9163c8ed0093

SHA1
f9ef3b9cc76f34f83142e1fcb67bf5c3f9031953

SHA256
a76263a6b5c969a0b0a2cc90bdb86d35f3adaddef41884fa84832c24b0940192

SHA512
c0d217475e81a629abce4cc3557f1ae3422eefcb27c71a36cdba607036977492eb5c28f31f3b9e9724fbda78661d29f27db816d18b86efc845b015298a6fe53d

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-UAQL1.tmp\cef\locales\es-419.pak

Filesize
46KB

MD5
4e39e879e5a53df3d78db05328bfe87e

SHA1
80b1abc10c0917a99e1f76f946a8f39471db83aa

SHA256
f56a343f0aa70ace3bd982d8dbddd59cd297cffd2ba2cf7a49e664a752c70606

SHA512
fe865f4f4cbabccd115ad926c2afec84fa8abf34dc4e32d17d4b593a5a29f436f5ebd2f7d461905f76620dcf4e7e5841f7b47a33a08e74f367585dbb034889f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-UAQL1.tmp\cef\locales\es.pak

Filesize
48KB

MD5
3a7434e0ede68cd976502cf490c6b8e2

SHA1
0590cee58d9e6b435b8b26e5f52bc919ac9f4f34

SHA256
d2df093e94aeb5abb31f1482bebcd1302ae699b98271072386ebbc803496dcd2

SHA512
c8f21d4ba907f68dc68cdd458a0c150df0cfec4337646d58365be1626569cfea8d27cef8bbef49d77aeb034b4df94123f894cf2f3ca5876d33f8f861a5dec447

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-UAQL1.tmp\cef\locales\et.pak

Filesize
41KB

MD5
efde79dd01a9a54343213e92e0f0fd17

SHA1
5e7e14aa6be07871797a5dd6d322717df7e1dd5e

SHA256
556bef8ce02fdb594daf3becafaa474ef0dc12b127289e63b3d8d8f34325802b

SHA512
aed31bc8aa639c246ed0cfe4495eabbd1d3f214cdcec52f51a8e26994554cc6e994f6f82dbb8da57d792f118638f83e8d4d1bd3c20e8c1286b31ae4aa0efc981

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-UAQL1.tmp\cef\locales\fa.pak

Filesize
64KB

MD5
8b70d5fd5cd6756f1741bf06bc45440c

SHA1
31d7407b576777420e8ee921988e54181ac82839

SHA256
1c0af7fa747d3c5906191fe47c1d17f7fea3984c42f0432927e5e52d02dbc64e

SHA512
8ddc4ecc9e520f31b609e5be1e58a6e439ad1aee0955204189e77bf67445443526bc6763088e2833d7104dc9be7960c2b9552d54b400ac2c5fb5bfaa974b073e

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-UAQL1.tmp\cef\locales\fi.pak

Filesize
43KB

MD5
d4a7ba8027cfca09caf1a7296eb3e7ec

SHA1
7fae130235012413dd7c2049bf790af0ef89f219

SHA256
84f9ff560f3df29722e75f47e29e978e4d963f36109a28d432ddbba8737f977f

SHA512
488b282d83ef3bcf1bc058cc383b8fffb3767b8af51d93e7d37c866bcf84827acfcae7ad766b454de08cfa9ac9c0fedd9b65ff455b16cb857dec4ed42b8f034d

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-UAQL1.tmp\cef\locales\fil.pak

Filesize
48KB

MD5
ba30c440e34a828c656b3057a6ef50d2

SHA1
cb223b3cc624a316ce4af12d0505c000a6820add

SHA256
c9ac272850e1da405981ec9c22c04280190988c69f20d8fa9d4ec35cf179d0a2

SHA512
3af89e096d1ed5c6814a331a00925fbfec6a971122bda17bf21402fe1a81a04c143744723106d0b7b5dfed55fcdacbc187e34beff5c51c22a18fdf2ed17e79af

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-UAQL1.tmp\cef\locales\fr.pak

Filesize
50KB

MD5
62ef4ab8c2884194759a32a45f4fc260

SHA1
ba939b19b995b7a4438c86902377a1c22594b3e3

SHA256
de82f49719ba9b941dfc9a2141043a9c78a6f54b8933fee5c1bfc3a5175ae500

SHA512
d2af98d51e77930a617d5f060d9abe94dda5e8f54bf1b79b76f16bec5cfb4837a72c3c0ba37e004a3448d92402e884fa98c977aad97061c5e0045b7f92c6323f

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-UAQL1.tmp\cef\locales\gu.pak

Filesize
91KB

MD5
470244adc1084b9411b6bd8f0a028ea7

SHA1
589c30309fc65e546a740a5d6ef04dd41919c2fc

SHA256
5a64cb26f7e95c44b9d400d8b30befe53c09096fb0385856f4b5b9e9006f9fd5

SHA512
d094f52f4f39d7dce640102b5ca09a65ce360620a9b259fbcb5bcd14366f07e90c2a0641b15766d73c5fe6559c9fe56cfbf611a168871a28ec3225cfb30a4203

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-UAQL1.tmp\cef\locales\he.pak

Filesize
54KB

MD5
a322fe105df1a8ff7bbb5411b2ddf744

SHA1
b546989536c7fdf2ea7852cef72d4690ed6f52df

SHA256
3525f253e1e2c575c22fdd87385d631ff848be6d065cafd2710e5cb00dd6e27b

SHA512
77112989a0e8391e991f5e30901bba9ec3fdc7e6c49955236c1856f7b74b64b1688fabc15b759ecfc7646fd1c573b1ccc0e8ae8e8a374fad18606b58cde0ad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-UAQL1.tmp\cef\locales\hi.pak

Filesize
94KB

MD5
a8dbe08e837af7350d12b0c6797e8f26

SHA1
c9142ed1d8a1b3a5bdc2ddd04f803a4a82c6abe0

SHA256
7607f601e7f7bc4a7deb1f68cf3d5791ec4d2811f37fac0efc658eb1ca1d9b04

SHA512
594a9e18ac99148418c866be74385249a44cd0c8b98065c0f0ca852dcc4532ab1dbfac884635e173be11348b42527abcd8f8dd238fecb0231b167072ed94a616

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-UAQL1.tmp\cef\locales\hr.pak

Filesize
45KB

MD5
d88949fd915bcb7a18ad44474ef74da7

SHA1
d1fa82bb1d7dd27fbd95cf08cadbef7a874b5333

SHA256
1ed331fbba49e120e97ecdb00e95ef6907dfbd060a061381fb5b12d712e32e58

SHA512
8ac613f86dd25ed77d7296313292272f8532d13e2da0111256f771311d95d715ad7235036e48cc8af46de387c6a65b1696482148f7218ef147af301fa488d756

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-UAQL1.tmp\cef\locales\hu.pak

Filesize
48KB

MD5
c81df0315db423d0c318d46e8fce8e39

SHA1
cb5e676e5cebf20ae94c3062321dab37520d2689

SHA256
6d7620ca3059fcf4fb2dcd935bfaa45968ef4851cd8dce9f435a6d5b129b2399

SHA512
a5e39c53f0d66ca4b8356c05d6f3ad6f4f1f8f3559b9b9f5dfa8716e5c256ea3649b8d53e6bff6c593d9f2d1207d4ba7bf6785a443d56d446a6252b98da45cb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-UAQL1.tmp\cef\locales\id.pak

Filesize
42KB

MD5
07428ca91eead354d60dc8fd68738f54

SHA1
d227c7023f9a28bd5d9dfb9cb95246470e7ea6fb

SHA256
c8744256f22ca0d32f22b2d7a5cbec9d0bfe86c112632718dfa53452298833a7

SHA512
3edb476603234b4d336fa6ac88c25bc0475aaea7792ac514bfe77db220779d73a1510d0a5c48d526322fcc799b742a90311b7380ed0281a2cd6952790f367c07

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-UAQL1.tmp\cef\locales\it.pak

Filesize
46KB

MD5
23f243b5399fbcf3d3a96a5219a1f80d

SHA1
c6945745b5a0a84e64149e53101abcda8cfaa992

SHA256
2d9efa8a626d16e8ad571813a3901e8fa0532ecf0da34760b8c725492c418244

SHA512
215f72dcc9b505ef6b413ce14cde69c0857f08da5b7ec44e80105b63514ee7f0b183652cef4b7268712c06056fb8c8b2b7176ffdd154f07480b356fcccb18ad9

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-UAQL1.tmp\cef\locales\ja.pak

Filesize
56KB

MD5
b44747ce81c6936d62d52e7ce33107e7

SHA1
5b0d1943b3173d7f2d3be74602100f2d2f685594

SHA256
ae8af09fdee6c385bae57d2d72562c3457db1194d3492a9ecca71219c6e6fdbd

SHA512
057958e47fd9407ee15bdd965f454cf65871f907219d1cb47893af70e0c11c0969279a860cf3e7919efe296ce4b32cfe05c4e68172808d52d73bd0fedeb91328

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-UAQL1.tmp\cef\locales\kn.pak

Filesize
105KB

MD5
3a02551fee49f1fdf1d6f334e1f9c3c9

SHA1
7ca83006a0b550704048236719f9f1948901e7c7

SHA256
58c0edb1598cf8404699e532f2c4d6421958bc575d2f55e2f351c464440e3288

SHA512
cb7368d84c25acb56dcae9be26c7ca539e4b62a9991264d71114740093ff1e52e6956e88a035a5f028ce29dfd46d7c80053cc6ca5212a752721d733f97e99f63

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-UAQL1.tmp\cef\locales\ko.pak

Filesize
47KB

MD5
5b3a3241d2b048074cf841cedfa48ab9

SHA1
49eaad312f6e1a84621bb3678e6477368da455f7

SHA256
bee7d8571d43883a5e90d06f59c6e60d63d354efaae6da93446841a961e1d881

SHA512
565513e0a6f476c3712cec30314d66d5d1faaa023d58c5a193d52fc9db6a2edb660275d97865e5a71845477cf9090bdfcb09b05b3224bf30d571396e0a9ed614

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-UAQL1.tmp\cef\locales\lt.pak

Filesize
48KB

MD5
3638ecb7e65f15945ef8f4d88c1f55ff

SHA1
6935747e844b561b28b3cf12c86f274d1ddb1c33

SHA256
e94e8cf76b9e7ce944f58e7a518cd34ed8d9b0fef0e9393181a885e6f36c8539

SHA512
b396c1ec13c194685df4ea2cbbb9bd25052c26295879e7414d08d6ed21ca52eaf432fa431ea321816bc1aaf2e977e693b7bab6bb42ae2bc3993b09d590529f73

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-UAQL1.tmp\cef\locales\lv.pak

Filesize
49KB

MD5
4f3db8bacddf08035ed01ea66cc72d84

SHA1
36b03be97bdc2abae90d191bb2f6f3eace7ee463

SHA256
9495c58645df64da9f12af60276420145c47cd032465ee52b216b243cec9022e

SHA512
ebd937084341926dc660972f13235c327514f9baf33824adfedea4f2ff04e57e3fe7243d2249271e75379ee98e6842562939b2d706a86c9e59d68904b7e18e58

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-UAQL1.tmp\cef\locales\ml.pak

Filesize
114KB

MD5
e53a7a75c56a080eaf70864602fdeef0

SHA1
88a2eb541037ea5c87568c7d9c7a8932f8e8c407

SHA256
76483b86b529d070dd5acd32fbf217cbc97f32b1c8878b238162323535b0eaff

SHA512
40606c964e95c51c348b32aa082425972f6a126174281e4e24115897782d148b135037c7e1f528a98b6ea20b3d0d75f3bd723d2ef465e619c25bc60022be20b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-UAQL1.tmp\cef\locales\mr.pak

Filesize
94KB

MD5
bc943169d21bbfd16dd412ae477b3dc0

SHA1
d7befe9dde62ff36e586f9d15c3719fbfba618f7

SHA256
f35537e623a4b0e1d335fd38d69e1d1df443f22aea206d0e151733a577771973

SHA512
25892f8e63cc7b3c35929fc729a620c761db5e528a30bbf00ad0471effd56b07d32768a0202e25f714414af8de92d6d775305329475e0119de93b2c099298b37

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-UAQL1.tmp\cef\locales\ms.pak

Filesize
42KB

MD5
6cfd5b74d08c8a5d5596b4712647feef

SHA1
7fd304a4cccce04a610f7c17e36b34c2b74bfecb

SHA256
d396545288768e70239190854577b1df2ab8e6a935b0b839d651116eeb7b195b

SHA512
bae13e8df222e7e71888c896d8a2553f15346bde966d6d700bc049677f847c194a55498dd5c7675604a6419562a0eb56b88561de76b9b2f4b963c2010231c3b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-UAQL1.tmp\cef\locales\nb.pak

Filesize
43KB

MD5
134cb79b07d6bfa385cdd0f93cec84e0

SHA1
acbd382820affad858bf37a2a4dc36a5c9ef05fc

SHA256
651883dcac3e615cca3f9759efa4f96672c788fd3e2524f1d7236a48fa8dc54b

SHA512
7c8187d8bc536879039d7810cd56d6b9fef0cc30c1c3d9f92fee86193c709a6744973d6bcca5c7a73ed891c038730876c37a900360fa3c65526cab45e3c46269

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-UAQL1.tmp\cef\locales\nl.pak

Filesize
44KB

MD5
264ffe560b523d126c51dceb311373cc

SHA1
3ea124acb4d1d5d76fd706279a0bedece200f08a

SHA256
2e50152c5f6215ac24dce2a3dc233a220869183034948f0356232c57514cbee0

SHA512
ef73ea8c1b7f486349bd39994561f4e303ac6600c7b5be512d23e3a06ccd6cdac1573d4fd328b0049e3ad20cf76e5cae3b6bdd2164b996b82986e143961b3ddb

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-UAQL1.tmp\cef\locales\pl.pak

Filesize
47KB

MD5
854a4765cb37d769a8b108b3b6335860

SHA1
390f2289f120337e5d9d29de757baafd452fb04f

SHA256
c4b00e4c223b241dc643f91531f0d503216d58d7dab4ee79ab64d63123661290

SHA512
046923875d42304af4c7a668b20887d48623c4418f1a6705a31671ad7eabf097509413a330333b2964fe872ab9b3ef3f72a39e62f1ef6aa6430070f87ef9a91e

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-UAQL1.tmp\cef\locales\pt-BR.pak

Filesize
46KB

MD5
d0fa28db4ee6aeff783c79b94ec50e80

SHA1
da7be8e7c2cf79679ebcdb562ae44e2525d3243b

SHA256
88c6ab714ba328de98c1b59cacc1ba2f2229f8262a57b5ba0d7be6fae0bcb2db

SHA512
d3668eeedf1560f5b3e293639ad154d8892b733160bf59c16f0922dde1629c469cec7d784c8e4b0a316af33f137abbc04f3e9e6e81c700bb0a48777a245e7b8b

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-UAQL1.tmp\cef\locales\pt-PT.pak

Filesize
46KB

MD5
3cd4193d8640c6139982f884f1e5322e

SHA1
1951b71a2f5bc8c8c42512003ca102f8826967ce

SHA256
861d4bc7876b968ffa5736127da462a1b09d9ddd5534668f4a871d569033a962

SHA512
89017a859e1b50e8bf4b0899efc7b251e18110c8f20c47dd8513b8659642c1b3eafcf9a98ec210245b5c272e4fdc7921d6ab6f1834180f6a02903e9ff06a35bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-UAQL1.tmp\cef\locales\ro.pak

Filesize
48KB

MD5
228c2dc6de89cc5889a556b04625277d

SHA1
f2d4bb245abf2ad71f9ea4fd67a82b826d9371b5

SHA256
efe550dc85ab44038178bb99afc10bcccf8dcd7d0563fb6b4c31708407ecab79

SHA512
3e8173244666f9bc3a8d3e79e895944970fbc725149196ce16dd1dbb548ee589e5d786b7febc7ae769f0d567be583b3d54a9d5b9b9495d506b6dedef2a4c8717

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-UAQL1.tmp\cef\locales\ru.pak

Filesize
72KB

MD5
6cc147ff2e74eb4640a65e42f45459e1

SHA1
11eaa5d4229173cfc621533f04ff11ac5ad31b59

SHA256
2a78c7b704cd403d488d7163bf13be9c0cc61b7647a0f8fc832111807748756b

SHA512
9eb211149b22328194854680e2b7ed59ce3f440138a063e75afb9c259b5223657625fcd644a76abd0adb4752c1738330488df2f7291ccbe9ee620fafef275e6b

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-UAQL1.tmp\cef\locales\sk.pak

Filesize
48KB

MD5
bd272aa038831bda0cdfab443849abbd

SHA1
176eed55b1668ca157e122941424c69017191c04

SHA256
ae2e05d6d0ea5a4bb798b550cb19ffeb6a940cbd9fc791f73ddaabbee80f1423

SHA512
b352dcd8d926fae34bec5f014b4e1cbb4378f8ffc742c423f00c032f19dd8188f503989d6ab065e01125d31434a30b8fbf39809b321666b721f0a9d9439d19d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-UAQL1.tmp\cef\locales\sl.pak

Filesize
45KB

MD5
a163522503dee64ed9165d7810fc2ecc

SHA1
bf0e8e185139d56b97812b2696267474ea5db540

SHA256
51cde2e6665acef0ab30c165006a6105b0f41235d050a4f1b6c5ee7395959adb

SHA512
cb2c2c3b2a8d8ed9121adeb57c223e87afa21a79f519c8bba20ffe7f98ba57e66d3a226e971a96e9484130f0835d037f068e871aa8069f920ae9b90a9e696613

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-UAQL1.tmp\cef\locales\sr.pak

Filesize
71KB

MD5
00b884aefac9f3d2ff05f910491081b0

SHA1
c74034c271d347a9a9f58058311adeeeed8c7953

SHA256
a8bcbb49cf933f2bb74bb6536eb2ea38f5082c8558c7bbed6f2f5fa89b6d536b

SHA512
5a61a9dac4dcce176cf31e690da5dd899a4c74920f46bb7fc9c378508811fe8fc8c1e94e7f36a401ee7ed1fea03bf49868b23e7302e27fafb86aaa83da2c3188

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-UAQL1.tmp\cef\locales\sv.pak

Filesize
42KB

MD5
f7e36957c30dfe2bd84d0e4caeb38665

SHA1
8def0bbc31904575c554c6197331213d4f206b89

SHA256
7a5e440b0a92d28be0f09a506011904c7869d3525ea9b401dcbd74926b20bfa6

SHA512
00ff87994062b22b7f5cb16925237d5af48160d999f23200398f07608c0045c540a8c59715cec3373a23668816f091d1c99abdad0a9ac2f85743cab14d5ee7b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-UAQL1.tmp\cef\locales\sw.pak

Filesize
42KB

MD5
3349962c8302ccf02250964b9e16dfd9

SHA1
890073d6dbdae60faae25913dff3689bb3e63a98

SHA256
d76d7bce5ce4cc34c94a496c1cd25851036bb3e2236aee8b2d7de2942f41f93a

SHA512
7a6e25cc8244e803465506818083ac072af623210ffa779fec986195bf6087bf15c9a17410c91395a47484f9a50dd946edfba57b6d6cd836279c3168886ac7b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-UAQL1.tmp\cef\locales\ta.pak

Filesize
109KB

MD5
cee22dd06699f093804e4cc822403392

SHA1
60b06291d29bc1588d83159058cca44a352d5d6a

SHA256
80b46f4e73ecff553ff815a0d406c9ed2c3d002909f1c1b2b57cde95d3fe3e2f

SHA512
5291234c2534c2b256ad13b8f0c6b978a45a0886848b52d300f9d3988b1adc5b2a26015d9c3729d55f880b744856128c35605d64d3366d0b6f28f4ff48644297

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-UAQL1.tmp\cef\locales\te.pak

Filesize
100KB

MD5
b0c9b3ca840cadb88394128a2270a648

SHA1
d242f4690da8dfcd05d2620273848406e8f4a4d4

SHA256
0d3d78dd76f894242fefd80d239f0f4b3052e2895aaddaa7e7e9ad640d6bf5d8

SHA512
f959b0592c701bd7da7bf7a286fa11f07990566066d9a5a679a696f306e3dec699dde07880f5685da0b45c02a714b681884209f7265cce2b8f4e844cc33ffc35

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-UAQL1.tmp\cef\locales\th.pak

Filesize
89KB

MD5
f836e6cc433d1144620b7774f3230efe

SHA1
1fe000b10eb44df261fb346dfbf4e294eb0bec8a

SHA256
75d3bd312d2cef6a0f24a57ddaed316e34ba38b791e14b25b173e896a5431d4f

SHA512
856c1807e1f64b6b0985734c7c2ad09ef7d956766a64c9148deecb66f40e52bc5386abed325ccb1d69282f209ba0c8408a972b48e9b30ab46545616815d39360

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-UAQL1.tmp\cef\locales\tr.pak

Filesize
45KB

MD5
034cbcb6d790b30c617e3a895d7b06eb

SHA1
63df99cd38fc2be9bdfd7faa32ee00c0c857f190

SHA256
adaf6a166e9a0ddcbc244a7e3aa61d5cd8d305f974ac24c1350914220d9d67d9

SHA512
f6fc957ca4d8b742384eda31b65e2bbb286ecfab8a8f6375fb5dd4388b74d5d44c6bcfd51e9c30e01ec442e27f06c281d85495105aba0625aba436c433ed067f

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-UAQL1.tmp\cef\locales\uk.pak

Filesize
75KB

MD5
879bca053ba87f9a8bf03cb46438188f

SHA1
9f8a48a8c0bb6dc40a579888f664dd9060b9bb4b

SHA256
6b12d2d25aa996dbefd4af3d02b12eed86ecd8b75b8e8cadc317c13cfcbf5144

SHA512
dcad289d91c8b05a3c8c5307bb63efcff973944cab9de98ed961caea44b1aa816a73f20f710ff9ba7f48c28fbf3f9a60fd049f227b59ec3b1a031dcd5e8898f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-UAQL1.tmp\cef\locales\vi.pak

Filesize
52KB

MD5
a2a7153a8b15820d1ca5be492b4d9600

SHA1
0fc2fa180c5785ce1432d19c0db1ed56b2ce25e9

SHA256
6016d121f8a5a6286c54cc27509af0b4de0c4c229e8d69cee6af437f6adee2ef

SHA512
47b7b5e35859ae2cef31711deecca342f31dd806c6730bf5b951b50e98efd5f49481502b5d71f43c7a2b6b8c9d76e1a51d28b5c29ee47ca12439031577712353

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-UAQL1.tmp\cef\locales\zh-CN.pak

Filesize
38KB

MD5
c3fd82ec2cddcf7192e9de8d9834dbc5

SHA1
f4cdb9879deef57d188b859744e4b1badfca7edc

SHA256
77650516087c2a6c43e7b775beb8148d8f9e6906dbe6bbcf5c3678fcbc02fa9a

SHA512
0542acd610c055fcf68e5c94a616df4b1fb0a0684b9c168f158e2ac97f1ed830fe68753c215d2837be0c5553cb5cf0f3522aa7990e6c91995a7f85293fadfe8e

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-UAQL1.tmp\cef\locales\zh-TW.pak

Filesize
39KB

MD5
1a09c6b7412b2a5d7f1b379dd4fcba1b

SHA1
58ac3377bcbc8fda31a0f77809128c9f0ecd82c5

SHA256
1f4b6a83d0e2ccebb596d010f5146fe3a45fcadcef786d696479e33be8c9c905

SHA512
a444b9ad2f7f9f7c3fa20537b6385d2c31d9674e1b9bd02a5f018bed6877145ec1cf8497a51e48c77dea64441ea5190bcb45dad87acc91cdaab7525f463fd9e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-UAQL1.tmp\dependence\SourceHanSansCNRegular.ttf

Filesize
10.3MB

MD5
6d4053d81311bf391df6578f8f456d2b

SHA1
06be20c0aabfd7898b445cb3f2480830d612946d

SHA256
1e1e3d86938b40ca4d7cdf10ec06d9a5ae59457cea98456f66f2a05d20202e34

SHA512
6d052753632bdf0fa57f383a36640cbef8c282d02520524c25d9a74f02c7adc440ceeaa81181316d966dd68f8fdc297d3a2950829bea3fb118f09723a32767b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-UAQL1.tmp\img_bg_install_finish.png

Filesize
404KB

MD5
60449283b109f9594edc0c695e06a889

SHA1
65b9e089afa1204ff0c8590b6806c81a89bd343c

SHA256
69f64e945d9f62d42882e802c34e4720495864b5e6c6d3c9ebd7bcd0054c51e3

SHA512
659c0df6db4a56384669609f390f5873ee7ba0b494732e23529854228dd0988150130faf7f301869f5f92ee09ee6d2e2db9d1212a29871eef9fbdd6f2669707b

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-UAQL1.tmp\img_bg_msgbox.png

Filesize
201KB

MD5
aab4c95793e3d3cc545a6e341dc4e84d

SHA1
2d6b3c63671697072dd08444e422dc26337df754

SHA256
dcfdcea69513d509aca4b183198a993b0387e283adc6ad3487b198fb4c01be82

SHA512
200e9e3f1f9912a854db348de01c3c16ce259530902a7a75623fbf2a251af9ca62944a9fa765989de29a3ae4a5806c96dc7e4e3a86085c8fabdba31fa0463c01

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-UAQL1.tmp\img_bg_progressbar.png

Filesize
198B

MD5
eb27ad7b333404ce6ba191787acd8acb

SHA1
d1658b7d7d0f256905acb5f3dfb89f7f46d84be3

SHA256
b993b1759b62bb0ec92d9eea2586a6f369fa652e5cb94115d10c3fcfb8826a9d

SHA512
74718fba21db1139a03a61697222f33fffe30174c4b1e7e6272340533ba296c18f98aab50df10d575949fb4c50e5f92a743fc17603ce443f85906119240fa1d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-UAQL1.tmp\img_btn_browse.png

Filesize
19KB

MD5
9c787d3d0dd30808a7771a2090d649b4

SHA1
14b7d21fa19242b74cf084d9d144f2a362739b28

SHA256
2736b836923e6482b96c3ae1e01a1a19ad56a3d24e1fdfc227a1f21fee97059a

SHA512
06f2fd7a6932f780dbe7f05bc90a83f43de71695eb3d1b5c52084401a1b4769fb6327fe8165fb149f3028e7db05cf86bb3c91e892346e988a8bfd18731c21061

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-UAQL1.tmp\img_btn_cancel.png

Filesize
44KB

MD5
bffc4032a1e538a98bb507d7ea0f313b

SHA1
9730bd3df4ccbc44ffe1e361d192170d03abe8e4

SHA256
7c90c5542148f5a28e44725c214abbc6b10df8ed289a25d4ed09c59b3b0bcdc0

SHA512
a38ef3f65d26b8749ebbfd22f56727784b1fe2118f8f7934c114d8a0241361fdda64cdc7d81d7908669e8e2a8d7d0953d8137834b5b071f92c606de561d5ce8f

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-UAQL1.tmp\img_btn_close.png

Filesize
2KB

MD5
ac9e085e7b1fa31b894ac9cb9796825d

SHA1
351d61dd8e9c202889fda63f9dd41256dc14f147

SHA256
a6a15f9f7a5a0d291f125d7a54b2dd0542efbd771a17162f909fee2ca6d67954

SHA512
29178c431cab95083ee3cba2b6d331f19e29344c61af2cf7a326e89d3d2fbe6ab62d781390082ed04e08c20059827003b2184c470c64be25c4b10377105cd8cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-UAQL1.tmp\img_btn_custom_down.png

Filesize
1KB

MD5
4c4f7109932ea77b3a7047b59e7ae63c

SHA1
7aa6be51b82b70b9ad6bc7cf2a2db6f4947c8fc9

SHA256
bd58c796075fbaec82063b6dc8b5a324f5fc97c755afb1c5ea57d4bcec31293b

SHA512
3a6610e72a3e67d15fa9b60979615faf386f42bcc3575a3f8e900696ee9dfc55a13f8cbe36ea6d889eccb1ef3dfb279ffc808335e390b7bde36541539004fe50

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-UAQL1.tmp\img_btn_custom_up.png

Filesize
1KB

MD5
a60a8c8291d334947f7a2d75bc993dbd

SHA1
daf580ad29d1b0301df6b46e0a8cfb508da89dda

SHA256
d512daef5b4b9773ec0f6ba1b1ca11fee3608d7f8f4d2717cdb723ee43b2435a

SHA512
b7cbbe7474e3a5a55934b1441ed0f6ab54a6f5588f24c580f81b453a8610ea4197bce09be6c22a9dec2411402ff17782bb41483333ac19296ca4c78e80c3aa79

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-UAQL1.tmp\img_btn_install.png

Filesize
109KB

MD5
6c5289d44025dbff064c31d61a55d5b7

SHA1
7fa593bb6215764b43e550ec1703088729b35bb6

SHA256
16ae4cda8b0f575740cb598760d5f972ef68c8bf90b301d83da29dc599c0d1f9

SHA512
7d18b4e3105d95b41248f8d8f310c000b9125739920bd735d4a147b0ab9c16d42dc7bb99c4ff37aca8f78d0bfa4148559c37ef99506ddef389f0e1fbb49c364e

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-UAQL1.tmp\img_btn_minimize.png

Filesize
1KB

MD5
0b3b7c59ecab696c9eb476c877ef42fc

SHA1
7b145316582aaff1e5f8bc20641b7826d4448a9e

SHA256
8c28f5f3988e6fedb8209ebb8b3dfaff236629e9651fe37191070067e62c3e13

SHA512
f51ad6335aeaf7708344738e927d629c08d36abc996386ddf1c3823e796a88215ce20de7cd05b2df7b50a3c90e070e060f111e5f794bce5c2d761c245054676e

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-UAQL1.tmp\img_btn_ok.png

Filesize
27KB

MD5
012de2b25eb3628177a074e6400b8705

SHA1
5c92235346bafeaffd69a3ca41380691bb484cec

SHA256
6564cd96bc99e8c1f574407bd24868b701b5fb82a0b00b1e865005e6d56730be

SHA512
762460f5b27623370914171fc92ba6816fa4f91cf298f798367b6ab86be0514ee636f37268ed1212488a63bfcab9a12f28b5aeb9cc4c019e6056f5519d23e8c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-UAQL1.tmp\img_checkbox_license.png

Filesize
1KB

MD5
eeb9de9456bd5337b31b4208161c073c

SHA1
0a3e8d1fb0a7c0e7a62c8167bc9aa929746b4aa6

SHA256
fe4d5a565d3fb9ceb3560445007cd07ad2d1b0a653fbc7b2132c921d5c13acb1

SHA512
191d173a40e89e2607b2d61a4ad065f0abaaf13db087d1f58287321311db4c0fdd2ac74f6aee9dbe01ac1ef2248ddcd88421d0c45e53a3c56ab237d1b06638c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-UAQL1.tmp\img_confirm_green.png

Filesize
1KB

MD5
71704690e907b6b469a95ba33fa1bd28

SHA1
b22112a849cb274574f181de3e346bf060369076

SHA256
f943b01cc918929594c7ae03b2076bc4a7bdd48a409a193eebb6020d137c517d

SHA512
3f8dd6c76a416ab4d169994f2bd75065dd88d4a9162cbf0884a2df4ce92a35efa123fe17e837bb1063070a25908f220e5d84f9c90821927f6e042d6a5534c2f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-UAQL1.tmp\img_fg_progressbar.png

Filesize
207B

MD5
0f03f844708b3c6aa7294df30334140d

SHA1
15e626370232f562320208b3c2fd91646d9cae1c

SHA256
600299f39a8e32ce9cbeba7136286b20fcd6b38b9ec42c8f8b5f6daf62959244

SHA512
5403a6b13300e139f1d819f35626f7ddbe3c11c3252dcf1ca5fc92fe47c6c1e341d41c58f5c268530583bd5efb500cf54e63a1b0ceccca5096b5c6c4cebef61e

Download Submit
C:\Windows\Fonts\Quadrat-Serial-Regular.ttf

Filesize
48KB

MD5
b4fed8c0e2becc358cb9f2edc1093704

SHA1
24e9b1f64315a0ae526cdb2d5fffb7b27aa014fc

SHA256
1783fea4e50778d0aff0cb4beb83098f56bec4eacb43de6fe12492ad9fcf4df0

SHA512
ec2f87f23549fcab490a1fc2dd367968fcc07cdef08d80a194f6bad1419cb0ae8ffa090269af7d20ec1c40cd4f5ef900b3d7dd9a75e799332e6b17836a331701

Download Submit
C:\Windows\Fonts\SourceHanSansCNBold.ttf

Filesize
10.3MB

MD5
776f617315df79419f8207313cb7e734

SHA1
e1ce31a3898b8569656be5e4ed9c9808b9bf5491

SHA256
6f3e7f02a3195f1407345ab7c9ec735251d501b76279953dac32d62d9ef45cc5

SHA512
a8bd4029e2fee4dbb87874bbc793a943d45b88a251692a7d6e4c6e5b4e805ead1aa8bc1347bafef3a8c349bd4b011a56bc5a3816bb0a72b2cd5797f9166e9a01

Download Submit
C:\Windows\Fonts\quadrat-serial-boldXXX.ttf

Filesize
48KB

MD5
28e96bba4ef08b07f0d1d7055b23435a

SHA1
d9ade701ec050da1f81915511c75f1b8b670fc3b

SHA256
d7816797375c15d1a5d28aeccb5151956780802b8321c8da44f20c6c937a8aff

SHA512
976fda38d82538f46775fe3726f5632751b1fb329ddc637c76bcc736ee0c0c7e360121f915f4c07c36c5ed98f394d6cefcf3dd3f8eedf32dfaf123db09923d55

Download Submit
\Users\Admin\AppData\Local\Temp\is-L634G.tmp\codpc_b7c281ea101cd1043e215e13130f495d.tmp

Filesize
3.1MB

MD5
43f1f539a70d286af154727fa41c313a

SHA1
d253d77499bfd222a452ae7fc2102e4abbf703cb

SHA256
15e29accf25b85dde10d4b557ef4204945181f9fae286193301695a8ed9adab8

SHA512
b84911f6f5f19834b7b0b3b623efdca832a697ed9eb6c570acbdc1aefb8d2247f3704eab0eb03ba3fded0a2d27e7e8ae5a02cdf1cd3e814db4ce59edf7b81256

Download Submit
\Users\Admin\AppData\Local\Temp\is-UAQL1.tmp\Utils.dll

Filesize
1.2MB

MD5
3232e86fec745e92b5471ca216720c6f

SHA1
c5d856a852a73c0d5059ed02be5c8d026e9f8f70

SHA256
a04f48500553212df6f3682c43e1f095358c588547284a54746a38b28f94a457

SHA512
a0aa44729f79d8042523c5433559a638a619f96e60710963fc5aaba121f423db29c370326d47c84ad97f03444f013cb5c9ce5a4425929465705fffb1a3d8c784

Download Submit
\Users\Admin\AppData\Local\Temp\is-UAQL1.tmp\botva2.dll

Filesize
229KB

MD5
31fc626b6a1d55aa2df23dfa3318b65f

SHA1
8797167dbb74711a593ae7604cfd3956ec1e9a1f

SHA256
96360a72a66bb997a94553f6c65f88d3eb88c294f73a0748a4b0b4444e1a061a

SHA512
c2bdf10f7b29ec4932551c9e509e804e692aae9662d0ac3df6862430c115bb024365f51d28313ede13e2cdbec4084bc7e823513b4be2bb9de4a74be1a50baba3

Download Submit
\Users\Admin\AppData\Local\Temp\is-UAQL1.tmp\innocallback.dll

Filesize
76KB

MD5
b11eade67865ed119b13052ffc4cc3b2

SHA1
2a3096a7d306c4fec2e3464a1803966081732b4b

SHA256
2f8a081a4676fa3753aa4137fea3eeb020c89c2949f3abda9f0bd1c58b0992fb

SHA512
6f545f46253409d1285532fa3090e9accc765925369dc44f356107ecf867ea17c19c885d151c64a12dccd6e616daa7798b27ca1d0a2c1c63a430c20d7a6f323c

Download Submit
memory/1040-764-0x0000000003BB0000-0x0000000003BC5000-memory.dmp

Filesize
84KB

Download
memory/1040-183-0x0000000003BB0000-0x0000000003BC5000-memory.dmp

Filesize
84KB

Download
memory/1040-321-0x0000000000400000-0x000000000072A000-memory.dmp

Filesize
3.2MB

Download
memory/1040-182-0x00000000039A0000-0x00000000039E3000-memory.dmp

Filesize
268KB

Download
memory/1040-9-0x0000000000400000-0x000000000072A000-memory.dmp

Filesize
3.2MB

Download
memory/1040-763-0x00000000039A0000-0x00000000039E3000-memory.dmp

Filesize
268KB

Download
memory/1040-383-0x0000000000400000-0x000000000072A000-memory.dmp

Filesize
3.2MB

Download
memory/1040-60-0x0000000003BB0000-0x0000000003BC5000-memory.dmp

Filesize
84KB

Download
memory/1040-766-0x0000000000400000-0x000000000072A000-memory.dmp

Filesize
3.2MB

Download
memory/1040-181-0x0000000000400000-0x000000000072A000-memory.dmp

Filesize
3.2MB

Download
memory/1040-765-0x0000000004890000-0x00000000049C4000-memory.dmp

Filesize
1.2MB

Download
memory/1040-184-0x0000000004890000-0x00000000049C4000-memory.dmp

Filesize
1.2MB

Download
memory/1040-53-0x00000000039A0000-0x00000000039E3000-memory.dmp

Filesize
268KB

Download
memory/1040-125-0x0000000004890000-0x00000000049C4000-memory.dmp

Filesize
1.2MB

Download
memory/1968-769-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download
memory/1968-2-0x0000000000401000-0x00000000004B7000-memory.dmp

Filesize
728KB

Download
memory/1968-180-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download
memory/1968-0-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download