Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/08/2024, 11:56 UTC

General

  • Target

    Battly-Launcher-Windows1.exe

  • Size

    112.1MB

  • MD5

    03696da629e834c395f699847326448a

  • SHA1

    3529afa76451ed5beeeb0bb4a31f7cc8bc463aa6

  • SHA256

    9d8763451c2bd900dbf10e3cdb16132ec706b8e13dbd563aa15835d5b2d8cc4d

  • SHA512

    fca0ef778b3ab13cf01e3d39d4c7eb4a587f600ed8d5ab10a03a3061178609dc13a75f6cc736ec27ed9f40a2a554030217cc91a8bf982d42f460585102f1969b

  • SSDEEP

    3145728:SJcuNt6i+X0MdTUPo+YFawtU4odzp7emMT:qcuN7+QYFjmPztemE

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 13 IoCs
  • Drops file in System32 directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 38 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Battly-Launcher-Windows1.exe
    "C:\Users\Admin\AppData\Local\Temp\Battly-Launcher-Windows1.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4260
    • C:\Users\Admin\AppData\Local\Temp\2jywVpiXCBPKrhj2foFddYdfPdc\Battly Launcher.exe
      "C:\Users\Admin\AppData\Local\Temp\2jywVpiXCBPKrhj2foFddYdfPdc\Battly Launcher.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4652
      • C:\Users\Admin\AppData\Local\Temp\2jywVpiXCBPKrhj2foFddYdfPdc\Battly Launcher.exe
        "C:\Users\Admin\AppData\Local\Temp\2jywVpiXCBPKrhj2foFddYdfPdc\Battly Launcher.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Battly Launcher Installer" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1700 --field-trial-handle=1704,i,11325780718270527530,16600849500304773758,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:2
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:2316
      • C:\Users\Admin\AppData\Local\Temp\2jywVpiXCBPKrhj2foFddYdfPdc\Battly Launcher.exe
        "C:\Users\Admin\AppData\Local\Temp\2jywVpiXCBPKrhj2foFddYdfPdc\Battly Launcher.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Battly Launcher Installer" --mojo-platform-channel-handle=1892 --field-trial-handle=1704,i,11325780718270527530,16600849500304773758,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:3
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:2292
      • C:\Users\Admin\AppData\Local\Temp\2jywVpiXCBPKrhj2foFddYdfPdc\Battly Launcher.exe
        "C:\Users\Admin\AppData\Local\Temp\2jywVpiXCBPKrhj2foFddYdfPdc\Battly Launcher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Battly Launcher Installer" --app-path="C:\Users\Admin\AppData\Local\Temp\2jywVpiXCBPKrhj2foFddYdfPdc\resources\app" --no-sandbox --no-zygote --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2452 --field-trial-handle=1704,i,11325780718270527530,16600849500304773758,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:1
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        PID:216
      • C:\Users\Admin\AppData\Local\Temp\2jywVpiXCBPKrhj2foFddYdfPdc\Battly Launcher.exe
        "C:\Users\Admin\AppData\Local\Temp\2jywVpiXCBPKrhj2foFddYdfPdc\Battly Launcher.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\Battly Launcher Installer" --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2304 --field-trial-handle=1704,i,11325780718270527530,16600849500304773758,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:8
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in System32 directory
        • Suspicious behavior: EnumeratesProcesses
        PID:980

Network

  • flag-us
    DNS
    228.249.119.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    228.249.119.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    g.bing.com
    Remote address:
    8.8.8.8:53
    Request
    g.bing.com
    IN A
    Response
    g.bing.com
    IN CNAME
    g-bing-com.dual-a-0034.a-msedge.net
    g-bing-com.dual-a-0034.a-msedge.net
    IN CNAME
    dual-a-0034.a-msedge.net
    dual-a-0034.a-msedge.net
    IN A
    204.79.197.237
    dual-a-0034.a-msedge.net
    IN A
    13.107.21.237
  • flag-us
    GET
    https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=64f62d9f99b04bc78c9395f5f589edcf&localId=w:E1FD06B2-9179-2377-8934-278C10EE140A&deviceId=6896205358121058&anid=
    Remote address:
    204.79.197.237:443
    Request
    GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=64f62d9f99b04bc78c9395f5f589edcf&localId=w:E1FD06B2-9179-2377-8934-278C10EE140A&deviceId=6896205358121058&anid= HTTP/2.0
    host: g.bing.com
    accept-encoding: gzip, deflate
    user-agent: WindowsShellClient/9.0.40929.0 (Windows)
    Response
    HTTP/2.0 204
    cache-control: no-cache, must-revalidate
    pragma: no-cache
    expires: Fri, 01 Jan 1990 00:00:00 GMT
    set-cookie: MUID=2A4999ED1D8B61E21CAE8D321CAC60FF; domain=.bing.com; expires=Fri, 12-Sep-2025 11:58:20 GMT; path=/; SameSite=None; Secure; Priority=High;
    strict-transport-security: max-age=31536000; includeSubDomains; preload
    access-control-allow-origin: *
    x-cache: CONFIG_NOCACHE
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 23BE49F4EB1148ED99C84593D7D1B0FA Ref B: LON04EDGE0620 Ref C: 2024-08-18T11:58:20Z
    date: Sun, 18 Aug 2024 11:58:19 GMT
  • flag-us
    GET
    https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=64f62d9f99b04bc78c9395f5f589edcf&localId=w:E1FD06B2-9179-2377-8934-278C10EE140A&deviceId=6896205358121058&anid=
    Remote address:
    204.79.197.237:443
    Request
    GET /neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=64f62d9f99b04bc78c9395f5f589edcf&localId=w:E1FD06B2-9179-2377-8934-278C10EE140A&deviceId=6896205358121058&anid= HTTP/2.0
    host: g.bing.com
    accept-encoding: gzip, deflate
    user-agent: WindowsShellClient/9.0.40929.0 (Windows)
    cookie: MUID=2A4999ED1D8B61E21CAE8D321CAC60FF
    Response
    HTTP/2.0 204
    cache-control: no-cache, must-revalidate
    pragma: no-cache
    expires: Fri, 01 Jan 1990 00:00:00 GMT
    set-cookie: MSPTC=hLs97829ewujXNmKyFEVhFV-IdrNUYq25zktRe9Kobw; domain=.bing.com; expires=Fri, 12-Sep-2025 11:58:20 GMT; path=/; Partitioned; secure; SameSite=None
    strict-transport-security: max-age=31536000; includeSubDomains; preload
    access-control-allow-origin: *
    x-cache: CONFIG_NOCACHE
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: E52F4B91F9F3474FA5214343544597AB Ref B: LON04EDGE0620 Ref C: 2024-08-18T11:58:20Z
    date: Sun, 18 Aug 2024 11:58:20 GMT
  • flag-us
    GET
    https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=64f62d9f99b04bc78c9395f5f589edcf&localId=w:E1FD06B2-9179-2377-8934-278C10EE140A&deviceId=6896205358121058&anid=
    Remote address:
    204.79.197.237:443
    Request
    GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=64f62d9f99b04bc78c9395f5f589edcf&localId=w:E1FD06B2-9179-2377-8934-278C10EE140A&deviceId=6896205358121058&anid= HTTP/2.0
    host: g.bing.com
    accept-encoding: gzip, deflate
    user-agent: WindowsShellClient/9.0.40929.0 (Windows)
    cookie: MUID=2A4999ED1D8B61E21CAE8D321CAC60FF; MSPTC=hLs97829ewujXNmKyFEVhFV-IdrNUYq25zktRe9Kobw
    Response
    HTTP/2.0 204
    cache-control: no-cache, must-revalidate
    pragma: no-cache
    expires: Fri, 01 Jan 1990 00:00:00 GMT
    strict-transport-security: max-age=31536000; includeSubDomains; preload
    access-control-allow-origin: *
    x-cache: CONFIG_NOCACHE
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 2D024495FD4A413BA069A6F79DBF8CB0 Ref B: LON04EDGE0620 Ref C: 2024-08-18T11:58:20Z
    date: Sun, 18 Aug 2024 11:58:20 GMT
  • flag-us
    DNS
    14.160.190.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    14.160.190.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    14.160.190.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    14.160.190.20.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    73.144.22.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    73.144.22.2.in-addr.arpa
    IN PTR
    Response
    73.144.22.2.in-addr.arpa
    IN PTR
    a2-22-144-73deploystaticakamaitechnologiescom
  • flag-us
    DNS
    73.144.22.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    73.144.22.2.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    237.197.79.204.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    237.197.79.204.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    55.36.223.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    55.36.223.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    234.75.250.142.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    234.75.250.142.in-addr.arpa
    IN PTR
    Response
    234.75.250.142.in-addr.arpa
    IN PTR
    par10s41-in-f101e100net
  • flag-us
    DNS
    dns.google
    Battly Launcher.exe
    Remote address:
    8.8.8.8:53
    Request
    dns.google
    IN A
    Response
    dns.google
    IN A
    8.8.4.4
    dns.google
    IN A
    8.8.8.8
  • flag-us
    DNS
    dns.google
    Battly Launcher.exe
    Remote address:
    8.8.8.8:53
    Request
    dns.google
    IN Unknown
  • flag-us
    DNS
    dns.google
    Battly Launcher.exe
    Remote address:
    8.8.8.8:53
    Request
    dns.google
    IN A
    Response
    dns.google
    IN A
    8.8.8.8
    dns.google
    IN A
    8.8.4.4
  • flag-us
    DNS
    dns.google
    Battly Launcher.exe
    Remote address:
    8.8.8.8:53
    Request
    dns.google
    IN Unknown
  • flag-us
    DNS
    67.179.250.142.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    67.179.250.142.in-addr.arpa
    IN PTR
    Response
    67.179.250.142.in-addr.arpa
    IN PTR
    par21s19-in-f31e100net
  • flag-us
    DNS
    4.4.8.8.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    4.4.8.8.in-addr.arpa
    IN PTR
    Response
    4.4.8.8.in-addr.arpa
    IN PTR
    dnsgoogle
  • flag-us
    DNS
    217.106.137.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    217.106.137.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    241.150.49.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    241.150.49.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    183.59.114.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    183.59.114.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    198.187.3.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    198.187.3.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    192.142.123.92.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    192.142.123.92.in-addr.arpa
    IN PTR
    Response
    192.142.123.92.in-addr.arpa
    IN PTR
    a92-123-142-192deploystaticakamaitechnologiescom
  • flag-us
    DNS
    tse1.mm.bing.net
    Remote address:
    8.8.8.8:53
    Request
    tse1.mm.bing.net
    IN A
    Response
    tse1.mm.bing.net
    IN CNAME
    mm-mm.bing.net.trafficmanager.net
    mm-mm.bing.net.trafficmanager.net
    IN CNAME
    ax-0001.ax-msedge.net
    ax-0001.ax-msedge.net
    IN A
    150.171.27.10
    ax-0001.ax-msedge.net
    IN A
    150.171.28.10
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239339388096_1DBFGPPKZBTOVVSVU&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
    Remote address:
    150.171.27.10:443
    Request
    GET /th?id=OADD2.10239339388096_1DBFGPPKZBTOVVSVU&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 370008
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 471FF96BEFE14D4AB79CB09FCAAE65ED Ref B: LON04EDGE0811 Ref C: 2024-08-18T11:58:55Z
    date: Sun, 18 Aug 2024 11:58:55 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239339388095_1V0S9Y27HKQEJAFN6&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
    Remote address:
    150.171.27.10:443
    Request
    GET /th?id=OADD2.10239339388095_1V0S9Y27HKQEJAFN6&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 857850
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 76B071635CD9426C9504947B5107845A Ref B: LON04EDGE0811 Ref C: 2024-08-18T11:58:55Z
    date: Sun, 18 Aug 2024 11:58:55 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239317301220_18O58FXYXLPJZL3DY&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
    Remote address:
    150.171.27.10:443
    Request
    GET /th?id=OADD2.10239317301220_18O58FXYXLPJZL3DY&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 320336
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 8B5F9AFB85744249B6C92E92FA448F4D Ref B: LON04EDGE0811 Ref C: 2024-08-18T11:58:55Z
    date: Sun, 18 Aug 2024 11:58:55 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239340418606_136U7G6Z7CWHAJN4L&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
    Remote address:
    150.171.27.10:443
    Request
    GET /th?id=OADD2.10239340418606_136U7G6Z7CWHAJN4L&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 617294
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 6D099657CC1043668436B74AA345CBAF Ref B: LON04EDGE0811 Ref C: 2024-08-18T11:58:55Z
    date: Sun, 18 Aug 2024 11:58:55 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239340418605_1YZ6O1QX1RJB3B5MZ&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
    Remote address:
    150.171.27.10:443
    Request
    GET /th?id=OADD2.10239340418605_1YZ6O1QX1RJB3B5MZ&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 538654
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: D479D018A9C148D18E6E888C6755186B Ref B: LON04EDGE0811 Ref C: 2024-08-18T11:58:55Z
    date: Sun, 18 Aug 2024 11:58:55 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239317301629_1OQFQHDVLTEIOH8CU&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
    Remote address:
    150.171.27.10:443
    Request
    GET /th?id=OADD2.10239317301629_1OQFQHDVLTEIOH8CU&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 713808
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 7D4FBCFF700A436FB6584FF2EDF48299 Ref B: LON04EDGE0811 Ref C: 2024-08-18T11:58:57Z
    date: Sun, 18 Aug 2024 11:58:56 GMT
  • flag-us
    DNS
    172.210.232.199.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    172.210.232.199.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    43.229.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    43.229.111.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    170.253.116.51.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    170.253.116.51.in-addr.arpa
    IN PTR
    Response
  • 204.79.197.237:443
    https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=64f62d9f99b04bc78c9395f5f589edcf&localId=w:E1FD06B2-9179-2377-8934-278C10EE140A&deviceId=6896205358121058&anid=
    tls, http2
    2.3kB
    9.5kB
    24
    20

    HTTP Request

    GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=64f62d9f99b04bc78c9395f5f589edcf&localId=w:E1FD06B2-9179-2377-8934-278C10EE140A&deviceId=6896205358121058&anid=

    HTTP Response

    204

    HTTP Request

    GET https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=64f62d9f99b04bc78c9395f5f589edcf&localId=w:E1FD06B2-9179-2377-8934-278C10EE140A&deviceId=6896205358121058&anid=

    HTTP Response

    204

    HTTP Request

    GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=64f62d9f99b04bc78c9395f5f589edcf&localId=w:E1FD06B2-9179-2377-8934-278C10EE140A&deviceId=6896205358121058&anid=

    HTTP Response

    204
  • 8.8.4.4:443
    dns.google
    tls
    Battly Launcher.exe
    1.8kB
    6.9kB
    16
    15
  • 8.8.8.8:443
    dns.google
    tls
    Battly Launcher.exe
    1.6kB
    6.8kB
    14
    12
  • 150.171.27.10:443
    tse1.mm.bing.net
    tls, http2
    1.2kB
    6.9kB
    15
    13
  • 150.171.27.10:443
    tse1.mm.bing.net
    tls, http2
    1.2kB
    6.9kB
    15
    13
  • 150.171.27.10:443
    tse1.mm.bing.net
    tls, http2
    1.2kB
    6.9kB
    15
    13
  • 150.171.27.10:443
    https://tse1.mm.bing.net/th?id=OADD2.10239317301629_1OQFQHDVLTEIOH8CU&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
    tls, http2
    123.7kB
    3.5MB
    2587
    2581

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239339388096_1DBFGPPKZBTOVVSVU&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239339388095_1V0S9Y27HKQEJAFN6&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239317301220_18O58FXYXLPJZL3DY&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239340418606_136U7G6Z7CWHAJN4L&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239340418605_1YZ6O1QX1RJB3B5MZ&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

    HTTP Response

    200

    HTTP Response

    200

    HTTP Response

    200

    HTTP Response

    200

    HTTP Response

    200

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239317301629_1OQFQHDVLTEIOH8CU&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

    HTTP Response

    200
  • 150.171.27.10:443
    tse1.mm.bing.net
    tls, http2
    1.2kB
    6.9kB
    15
    13
  • 52.111.243.29:443
    322 B
    7
  • 8.8.8.8:53
    228.249.119.40.in-addr.arpa
    dns
    73 B
    159 B
    1
    1

    DNS Request

    228.249.119.40.in-addr.arpa

  • 8.8.8.8:53
    g.bing.com
    dns
    56 B
    151 B
    1
    1

    DNS Request

    g.bing.com

    DNS Response

    204.79.197.237
    13.107.21.237

  • 8.8.8.8:53
    14.160.190.20.in-addr.arpa
    dns
    144 B
    158 B
    2
    1

    DNS Request

    14.160.190.20.in-addr.arpa

    DNS Request

    14.160.190.20.in-addr.arpa

  • 8.8.8.8:53
    73.144.22.2.in-addr.arpa
    dns
    140 B
    133 B
    2
    1

    DNS Request

    73.144.22.2.in-addr.arpa

    DNS Request

    73.144.22.2.in-addr.arpa

  • 8.8.8.8:53
    237.197.79.204.in-addr.arpa
    dns
    73 B
    143 B
    1
    1

    DNS Request

    237.197.79.204.in-addr.arpa

  • 8.8.8.8:53
    55.36.223.20.in-addr.arpa
    dns
    71 B
    157 B
    1
    1

    DNS Request

    55.36.223.20.in-addr.arpa

  • 8.8.8.8:53
    234.75.250.142.in-addr.arpa
    dns
    73 B
    112 B
    1
    1

    DNS Request

    234.75.250.142.in-addr.arpa

  • 8.8.8.8:53
    dns.google
    dns
    Battly Launcher.exe
    56 B
    88 B
    1
    1

    DNS Request

    dns.google

    DNS Response

    8.8.4.4
    8.8.8.8

  • 8.8.8.8:53
    dns.google
    dns
    Battly Launcher.exe
    56 B
    1

    DNS Request

    dns.google

  • 8.8.8.8:53
    dns.google
    dns
    Battly Launcher.exe
    56 B
    88 B
    1
    1

    DNS Request

    dns.google

    DNS Response

    8.8.8.8
    8.8.4.4

  • 8.8.8.8:53
    dns.google
    dns
    Battly Launcher.exe
    56 B
    1

    DNS Request

    dns.google

  • 8.8.8.8:53
    67.179.250.142.in-addr.arpa
    dns
    73 B
    111 B
    1
    1

    DNS Request

    67.179.250.142.in-addr.arpa

  • 8.8.8.8:53
    4.4.8.8.in-addr.arpa
    dns
    66 B
    90 B
    1
    1

    DNS Request

    4.4.8.8.in-addr.arpa

  • 8.8.8.8:53
    217.106.137.52.in-addr.arpa
    dns
    73 B
    147 B
    1
    1

    DNS Request

    217.106.137.52.in-addr.arpa

  • 8.8.8.8:53
    241.150.49.20.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    241.150.49.20.in-addr.arpa

  • 8.8.8.8:53
    183.59.114.20.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    183.59.114.20.in-addr.arpa

  • 8.8.8.8:53
    198.187.3.20.in-addr.arpa
    dns
    71 B
    157 B
    1
    1

    DNS Request

    198.187.3.20.in-addr.arpa

  • 8.8.8.8:53
    192.142.123.92.in-addr.arpa
    dns
    73 B
    139 B
    1
    1

    DNS Request

    192.142.123.92.in-addr.arpa

  • 8.8.8.8:53
    tse1.mm.bing.net
    dns
    62 B
    170 B
    1
    1

    DNS Request

    tse1.mm.bing.net

    DNS Response

    150.171.27.10
    150.171.28.10

  • 8.8.8.8:53
    172.210.232.199.in-addr.arpa
    dns
    74 B
    128 B
    1
    1

    DNS Request

    172.210.232.199.in-addr.arpa

  • 8.8.8.8:53
    43.229.111.52.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    43.229.111.52.in-addr.arpa

  • 8.8.8.8:53
    170.253.116.51.in-addr.arpa
    dns
    73 B
    159 B
    1
    1

    DNS Request

    170.253.116.51.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\2jywVpiXCBPKrhj2foFddYdfPdc\chrome_100_percent.pak

    Filesize

    150KB

    MD5

    b1bccf31fa5710207026d373edd96161

    SHA1

    ae7bb0c083aea838df1d78d61b54fb76c9a1182e

    SHA256

    49aff5690cb9b0f54f831351aa0f64416ba180a0c4891a859fa7294e81e9c8e3

    SHA512

    134a13ad86f8bd20a1d2350236269fd39c306389a600556a82025d5e0d5adaab0709d59e9b7ee96e8e2d25b6df49fefea27cdccefe5fba9687abf92a9a941d91

  • C:\Users\Admin\AppData\Local\Temp\2jywVpiXCBPKrhj2foFddYdfPdc\chrome_200_percent.pak

    Filesize

    229KB

    MD5

    e02160c24b8077b36ff06dc05a9df057

    SHA1

    fc722e071ce9caf52ad9a463c90fc2319aa6c790

    SHA256

    4d5b51f720f7d3146e131c54a6f75e4e826c61b2ff15c8955f6d6dd15bedf106

    SHA512

    1bf873b89b571974537b685cdb739f8ed148f710f6f24f0f362f8b6bb605996fcfec1501411f2cb2df374d5fdaf6e2daaada8cea68051e3c10a67030ea25929e

  • C:\Users\Admin\AppData\Local\Temp\2jywVpiXCBPKrhj2foFddYdfPdc\d3dcompiler_47.dll

    Filesize

    4.7MB

    MD5

    2191e768cc2e19009dad20dc999135a3

    SHA1

    f49a46ba0e954e657aaed1c9019a53d194272b6a

    SHA256

    7353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d

    SHA512

    5adcb00162f284c16ec78016d301fc11559dd0a781ffbeff822db22efbed168b11d7e5586ea82388e9503b0c7d3740cf2a08e243877f5319202491c8a641c970

  • C:\Users\Admin\AppData\Local\Temp\2jywVpiXCBPKrhj2foFddYdfPdc\ffmpeg.dll

    Filesize

    2.7MB

    MD5

    bf09deeeb497aeddaf6194e695776b8b

    SHA1

    e7d8719d6d0664b8746581b88eb03a486f588844

    SHA256

    450d5e6a11dc31dc6e1a7af472cd08b7e7a78976b1f0aa1c62055a0a720f5080

    SHA512

    38d3cac922634df85ddfd8d070b38cf4973bba8f37d3246453377f30165cc4377b4e67c4e0bca0ffe3c3fa0e024b23a31ec009e16d0ab3042593b5a6e164669f

  • C:\Users\Admin\AppData\Local\Temp\2jywVpiXCBPKrhj2foFddYdfPdc\icudtl.dat

    Filesize

    10.2MB

    MD5

    e0f1ad85c0933ecce2e003a2c59ae726

    SHA1

    a8539fc5a233558edfa264a34f7af6187c3f0d4f

    SHA256

    f5170aa2b388d23bebf98784dd488a9bcb741470384a6a9a8d7a2638d768defb

    SHA512

    714ed5ae44dfa4812081b8de42401197c235a4fa05206597f4c7b4170dd37e8360cc75d176399b735c9aec200f5b7d5c81c07b9ab58cbca8dc08861c6814fb28

  • C:\Users\Admin\AppData\Local\Temp\2jywVpiXCBPKrhj2foFddYdfPdc\libEGL.dll

    Filesize

    467KB

    MD5

    3a5cbf0ce848ec30a2f8fe1760564515

    SHA1

    31bf9312cd1beaedaa91766e5cde13406d6ea219

    SHA256

    afef052c621f72ba986d917a9e090d23a13f4ab6bc09f158eeb73fd671b94219

    SHA512

    bd5713e1d22145b4cc52f4e46b464f443aad6f783a5793268e7d9dca969f27b70e706eecd54cb01be1c94256e6a95864c6b7e50027cef7fa870cdb16820ad602

  • C:\Users\Admin\AppData\Local\Temp\2jywVpiXCBPKrhj2foFddYdfPdc\libGLESv2.dll

    Filesize

    7.3MB

    MD5

    c783045e4b7f00c847678d43a77367f7

    SHA1

    7f9192ce0b23ac93561aeec9d9c38daa3136c146

    SHA256

    3a39137dcee6cb6663ae9cca424b6b05cf56c0ad7e32fb72cb94549ea9dbcae8

    SHA512

    64e6d4fc84f1217ceef05a22ad63a6618ffdc470b1faf4ad9e2d7bab59e9285527b9c5fd7ea4be673a08b9466434e3c098e839bf6955597e3d8aa0e80589f4a3

  • C:\Users\Admin\AppData\Local\Temp\2jywVpiXCBPKrhj2foFddYdfPdc\locales\en-US.pak

    Filesize

    440KB

    MD5

    731c45f9f23957acc11b43d775758aaa

    SHA1

    12e66417a2dc0c5211ed67f026208ef02fcb40af

    SHA256

    02b97817b6eebd7caeaaff750f6462abc68911c398ddf0571b7900ff9b4ea9a2

    SHA512

    1a008df585ef76d9cf4459fc3e617b8d4397e7078c77852712fc7cf4f304081bc5195243437e64074016b05a8cd671db93666042e59b959595ba854ceb330a81

  • C:\Users\Admin\AppData\Local\Temp\2jywVpiXCBPKrhj2foFddYdfPdc\resources.pak

    Filesize

    5.0MB

    MD5

    67bb5e75ceb8ced4c98cf0454933cb45

    SHA1

    c2b1c8c8d753318bc5ec18762c27512a5eb9f9cd

    SHA256

    5d63acd4034f7771ca346d138d7478014abf1f3f4386d07fc025dbc2c2bc0bff

    SHA512

    fd213d59ebc625f6f8b20cc8fde1a22132ce827b81deaddb9ca7993fe0d9616de17e089def338d23c4b6bbd7d3a931ee73aa329325eaa17f8145a58fe11d8c38

  • C:\Users\Admin\AppData\Local\Temp\2jywVpiXCBPKrhj2foFddYdfPdc\resources\app\AppData\Launcher\shared_proto_db\metadata\CURRENT

    Filesize

    16B

    MD5

    46295cac801e5d4857d09837238a6394

    SHA1

    44e0fa1b517dbf802b18faf0785eeea6ac51594b

    SHA256

    0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

    SHA512

    8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

  • C:\Users\Admin\AppData\Local\Temp\2jywVpiXCBPKrhj2foFddYdfPdc\resources\app\node_modules\ejs-electron\index.js

    Filesize

    4KB

    MD5

    d441fba9399d196f943308f66d215d95

    SHA1

    76557f8a00782c3503b62784098b7832256c136b

    SHA256

    4574224bdcf1a47aab456dbec7b485d7cb8bd62bea5295f85db622b3ebab0c1b

    SHA512

    7f11d59d870c0ae386b6c0ae4a65b2ab49445ce8b36528323bb2a03a8a55611c8e71d2c7439f0a57c69fb7cfdc2d05fde59e535e0da36adf24947a131db18a0f

  • C:\Users\Admin\AppData\Local\Temp\2jywVpiXCBPKrhj2foFddYdfPdc\resources\app\node_modules\ejs-electron\node_modules\mime\Mime.js

    Filesize

    2KB

    MD5

    5a77829e31fd521878c9484a90ff107a

    SHA1

    73efaff8e2e9adb871396c15c076dbf28757949a

    SHA256

    9482411a27e56e69e9ff5ae077b25f64c38768ae268ac07ab74a9896b582b6a9

    SHA512

    dc542b656f18818fc5caab6bebaf67f2f33691661196fd588eeba8bb8d1520ea61f76df314d407e0e23b405706889f0e73f0bc61871a36764d2c3564a44b1c35

  • C:\Users\Admin\AppData\Local\Temp\2jywVpiXCBPKrhj2foFddYdfPdc\resources\app\node_modules\ejs-electron\node_modules\mime\index.js

    Filesize

    127B

    MD5

    f18d3eb05bbc4d65415ee72c4b5d4dff

    SHA1

    e2d3efd8917c4ff9cbe668474891269d3fedcb37

    SHA256

    7b35e6b3b981b498b62860b99063916772a7a199125866d4593db952ba1c14b9

    SHA512

    65316d6a06666e5acdb6fd293fcb737109a264fb6ed1174e7853f86b32d2b334fab3280d28535be21524fa15f86bc8f16b663461439d6bdf4ead0cba4b297eb5

  • C:\Users\Admin\AppData\Local\Temp\2jywVpiXCBPKrhj2foFddYdfPdc\resources\app\node_modules\ejs-electron\node_modules\mime\package.json

    Filesize

    775B

    MD5

    41460dd956f1244d052cbe727cb6be27

    SHA1

    4982079e4fc60559ed7fa2c066bf71fc7b74d9b4

    SHA256

    a1dccf7b9e97739c70cfe4a205babae71016a576f4385a8d66308978f21e0d19

    SHA512

    4e273dcbe5b5bde34c1ba8c0bf35251037b058fe3eef5703e53027a53b9f6661db97411be2ae2e7b4353adf5d77bb389566a81258adb8f11cac679ee6450c978

  • C:\Users\Admin\AppData\Local\Temp\2jywVpiXCBPKrhj2foFddYdfPdc\resources\app\node_modules\ejs-electron\node_modules\mime\types\other.js

    Filesize

    25KB

    MD5

    ce7fcb8480cc926c86d46e4b1fb6cc9d

    SHA1

    dbfc26ed679cce39b3ecb6bee5ef5968cea6408a

    SHA256

    ee0e65cdfde6e492be9c52e35bffcbe0e0fd9a5be1a18fbaa7cbbc7b9b406934

    SHA512

    c5c943a1722aa52c3f85f28189258ebb4e3ed025c98bfa0d7ce978de2587b10239c578d5d96fb63f85bd8ec16d7d156847268cc14421cb920832688984fc0cc9

  • C:\Users\Admin\AppData\Local\Temp\2jywVpiXCBPKrhj2foFddYdfPdc\resources\app\node_modules\ejs-electron\node_modules\mime\types\standard.js

    Filesize

    9KB

    MD5

    5119196e906ee770dfd3610bcfbd0587

    SHA1

    a21f9b1eba88b1af8d16231a5759ffb8108a645c

    SHA256

    70aaa6f9c1b7caf38db2eff138406911368729b8dfb478fe70078e46ec1824bc

    SHA512

    30d30134c1044d36bf4ffd93cb0b6f003cb702a14b9e006bbc9a18a7e9e6915f18c22eb0b8bcfb5cae6cc15636726e0d8ab59189610550140ac90e51f45c324e

  • C:\Users\Admin\AppData\Local\Temp\2jywVpiXCBPKrhj2foFddYdfPdc\resources\app\node_modules\ejs-electron\package.json

    Filesize

    367B

    MD5

    381be2da7b731d7e9f68c149ef521e46

    SHA1

    11f4eabe7d5c1236c02c9c6e1ef2e8f58226a2e3

    SHA256

    c30372a8a6ef7a7cf021a48200d7ca770ca5ad68022e92c6d15bd27878dc326a

    SHA512

    0595738800f268106a61f3526448bb1c89ed37db1950d00b7fc1f1d2874cfcd1bf7454b49d757614543caf756407d6594e2246f68d6916db51553c95e22c4f01

  • C:\Users\Admin\AppData\Local\Temp\2jywVpiXCBPKrhj2foFddYdfPdc\resources\app\node_modules\ejs\lib\ejs.js

    Filesize

    26KB

    MD5

    e7286ffae51527e51efadb4ce65d1dd8

    SHA1

    2170a351835c1ff3ef58faab251e3d5ce5dfe9d6

    SHA256

    9ff1cb7fb0a7dbd822e04d35e50560a199926cc323b5aa11f1e89556d7b89814

    SHA512

    5a551b8ae5dc38eb4893acb2876046ebe27ed3852777b7e832173bfba8d5470b08495232811a82edd0662634bc6351e51d7d3509c87663900ca122a15e1d50e7

  • C:\Users\Admin\AppData\Local\Temp\2jywVpiXCBPKrhj2foFddYdfPdc\resources\app\node_modules\ejs\lib\utils.js

    Filesize

    6KB

    MD5

    c4ed9f400aaac2c0b2ebe7c7f5795b1d

    SHA1

    4e88b60293299d879774768f84cf38524c3d34c3

    SHA256

    d77d4660b6fd5131949906b67fa4456223c308bd13a88d7dadbd2e10e5e7ace4

    SHA512

    100faa0f015ba8001eff8dc435174dde0af2d8717976448a3202272e7d0edde3d149f0a0acc6469f8d86fa0b15b79237cc1ffd5efb9456e0bbb625e6cfd53242

  • C:\Users\Admin\AppData\Local\Temp\2jywVpiXCBPKrhj2foFddYdfPdc\resources\app\node_modules\ejs\package.json

    Filesize

    748B

    MD5

    c811f299cfedf923d32f6126894283b1

    SHA1

    4d25c24f5ff44f2963d08d74d474b03127c02ecf

    SHA256

    ba32b2005d817a23dc0e0b57c248b53b8b0316e8271fa433780750a954d56e69

    SHA512

    ce77756d8c128eff055923c6622f3b438a3eba87513fc6d962180b93762cb325c5b96c89e05e1df4a7ef227d35ad1de659d28c893742c5a1e8912b365b1a3fcb

  • C:\Users\Admin\AppData\Local\Temp\2jywVpiXCBPKrhj2foFddYdfPdc\resources\app\package.json

    Filesize

    530B

    MD5

    e102ea0d9f0e36be31e25b787c35ca2c

    SHA1

    022ea237f37e95570872a64ba6af1e2f63cb0dab

    SHA256

    9f66eafe35c475aaba1157c877406f448273c6e4811a1ef2fce10aa0d5eee706

    SHA512

    426e0af432f24562e548bf53ea972636c494f0c5b840b9e6affbc40f32fdb9de3cde3c4fd83d9a221eae9832a42631b2b178a3d46f1b2a56d1a82978fe32fc51

  • C:\Users\Admin\AppData\Local\Temp\2jywVpiXCBPKrhj2foFddYdfPdc\resources\app\src\ads.ejs

    Filesize

    1KB

    MD5

    d7f2205fb3ea4fc29629fd16cc13e42e

    SHA1

    ac4addc19bdf3f56a2b2aa0b8e5a2b2d459b209f

    SHA256

    828df948e8dd1e0fc2a88511fd1f59568a97fc2c3626152e574e5f31c89ff5e8

    SHA512

    6ff7cbfb366642d6b1ce5ce15f335b27a8f500341bb059f6037d50409c071d9ef8a735c447a876bd986f4902e377a773b9e41e09d7d433b8365a5049a689bf3a

  • C:\Users\Admin\AppData\Local\Temp\2jywVpiXCBPKrhj2foFddYdfPdc\resources\app\src\assets\css\index.css

    Filesize

    20KB

    MD5

    9338a403220d934986f5dc738419174d

    SHA1

    33d0a93608f28900b4771b49d88259b2f70350e7

    SHA256

    2f281d5eb03f52a46514089fd0b0af408f02613a8fcef8d506dc01f590651d7c

    SHA512

    cd92d15c6ee9d6d9ed78fa073406462d5f3b33cc9c198a693fa51f53889ba9f5ef2a498ea3f033ef7cad73b1248e4bad9afcad8246f5b98dcde3435399dca508

  • C:\Users\Admin\AppData\Local\Temp\2jywVpiXCBPKrhj2foFddYdfPdc\resources\app\src\assets\icon.ico

    Filesize

    11KB

    MD5

    372b8e595552272d8980d7ce68a22a45

    SHA1

    3458abecc3172f86c0a42f889402a700964a7bdc

    SHA256

    9a6b51f26c9efb993a02f67582477d9b524b029af5d6b1bea046840012dc110e

    SHA512

    bb712405ea0c0ec66add82abd04ca8f32e07bea7e4bbdcb2bce53a16caf8d9bf2a514ec8e647739e739f995931fc6d04d155e8b2f381fb93765024a4aebc1fa4

  • C:\Users\Admin\AppData\Local\Temp\2jywVpiXCBPKrhj2foFddYdfPdc\resources\app\src\assets\images\background.png

    Filesize

    713KB

    MD5

    54d3046d693ef7dc0e06a32ff629e7a1

    SHA1

    1d14c54f2db92c94e467dc3b3f6480fe737ed830

    SHA256

    62a7ec1cb750aa28bcfdc93cebf1521f8cdc352992938652527aacb79618e57c

    SHA512

    b4e123d3bf4b21bdb1c73ab9374bad0e1090e5cfd0b758bebfd907d4f3736c9f4e87e73e693a85eed66bd0e1eee85fbcf1a152eeb83ea6f317e85022d67fca3d

  • C:\Users\Admin\AppData\Local\Temp\2jywVpiXCBPKrhj2foFddYdfPdc\resources\app\src\assets\images\flags\de.png

    Filesize

    274B

    MD5

    0c730750c8a99bc30cf20b83d235aea6

    SHA1

    8ea6cd3bbdaae43607b4882560c4e04ef8eeaf8d

    SHA256

    b9d2aced61236662459e3acaaeaf44ce7af28405847c9a54d42fa4ae344f045f

    SHA512

    2fc3251378520052892b529b8c3638cbc3dd9c4ac471dc20382930c103c886826f05969400d7d1054b066cc81d00813ba86532b20be646aa8910efec9dfc6c23

  • C:\Users\Admin\AppData\Local\Temp\2jywVpiXCBPKrhj2foFddYdfPdc\resources\app\src\assets\images\flags\en.png

    Filesize

    310B

    MD5

    c2de03c4d117d87763d4e1e5e28482db

    SHA1

    bfbecbfba4c5a871894c6784da913fa495a2aa3b

    SHA256

    e423db68a40835ac299155e365864461e37115a96f996091d5af026103d753e2

    SHA512

    628f47a91c2605a66dda06430f26d8685384136c0d04bc3146dd033462ef7def71c7d9ddd43cf3d07e892a400d089faed938a91317a94fce4febfd01183e1301

  • C:\Users\Admin\AppData\Local\Temp\2jywVpiXCBPKrhj2foFddYdfPdc\resources\app\src\assets\images\flags\es.png

    Filesize

    370B

    MD5

    ff0df90a5a69c16ef24fab173a89ee4f

    SHA1

    02b14de1912f54b2b0630346c2cfe75a8da6d5b9

    SHA256

    c79f2cdfee1e6666b8180b7ee33d1f06bcffb113e602e8ec47b668d4db4f18d9

    SHA512

    4387449064aada45fba5e933304c5f931c29187acc025d291f1a758c6b2453085faa42693b2395fb08829b62187577988149514e133c2d4c58d6a2ed851f7ccc

  • C:\Users\Admin\AppData\Local\Temp\2jywVpiXCBPKrhj2foFddYdfPdc\resources\app\src\assets\images\flags\fr.png

    Filesize

    284B

    MD5

    d03e36af77543804318d6a5e220724ea

    SHA1

    58f8df12d68e055019dce59a93afe17207d68bd8

    SHA256

    9914c4861965f03acbbc077509a8dbe76471a4b3c26eb3932427f9972236edb5

    SHA512

    8b10141b6411d05c4f7f7a1e3139fb0e7a8223c470b5f6a2ab84e07c482d39a56820b3e3a867263321744e2d5272bf9fabc81bde61fbb7e79e2ef31a37cacc12

  • C:\Users\Admin\AppData\Local\Temp\2jywVpiXCBPKrhj2foFddYdfPdc\resources\app\src\assets\images\flags\it.png

    Filesize

    279B

    MD5

    b9673fed0ded2c7a6a3e2572b60ebb5c

    SHA1

    b4c6de948d9d7fb396dee563804fb161dc541cbe

    SHA256

    7ed6102d8a617b6cc2f7fe101ce130b037bf4fe7cc41deb011430f8def81b14a

    SHA512

    0f5965e93a08ea0a4f2a38de0e9f4accef71dea85d56f07c771ca62a966ab2049d611b1749544343e4389cea203137cb037fa2b7bd420087acfd3ddec2fc52f8

  • C:\Users\Admin\AppData\Local\Temp\2jywVpiXCBPKrhj2foFddYdfPdc\resources\app\src\assets\images\flags\pt.png

    Filesize

    806B

    MD5

    188d843e650bbcb429950217dfc0131f

    SHA1

    ec3a3cbab918dc69f797f96b718fc22e398771b0

    SHA256

    60d97aeb01ec6481d1c9f5be24082655c880a4ec947e42713168e3c36d6015b6

    SHA512

    8b8aa9535194304633d229161377c73e0b13fb757a2661620a4ebb33d0bf6bc7d56fe2456a062e7ef9f6224fc2aabeaad9d472b83c96f2643e4e44b9e46015ea

  • C:\Users\Admin\AppData\Local\Temp\2jywVpiXCBPKrhj2foFddYdfPdc\resources\app\src\assets\js\index.js

    Filesize

    5KB

    MD5

    959306e641b1474f109d59c7320d2663

    SHA1

    add0e58d53d96050af3a55b07bef4e2b3aebb443

    SHA256

    863203fb3952d5a921208ceff5cef705fc35bfb29519799ac5c1f8ca228fe437

    SHA512

    dcd41217bc980b5817456341fa07c9d7301f0188479850942042d07c0183068b621445dc6903367e3ce809afbfe52ee574c69cb9913da9175b3f1b1bcad1b5dd

  • C:\Users\Admin\AppData\Local\Temp\2jywVpiXCBPKrhj2foFddYdfPdc\resources\app\src\eula.ejs

    Filesize

    981B

    MD5

    0887c927cc2ba0250bea889fd5d40660

    SHA1

    8ae1b01d3c501a15cfeade573a13b93c44ae34d5

    SHA256

    df0dc42c4ec4e3dbed33e6fd855e977f3bfb4cc2a49a8402ead53bfb9f544d6e

    SHA512

    01dd4c0e622e95adc652fd06c8503864506cae7466d4114bd11938f69a5b97065ecedf2a9d516d485abaa33fc3442bcd9de46f6a00b0979c11b05951bf2183db

  • C:\Users\Admin\AppData\Local\Temp\2jywVpiXCBPKrhj2foFddYdfPdc\resources\app\src\footer.ejs

    Filesize

    4KB

    MD5

    d6c4aec009f8a181f5f805169cbad491

    SHA1

    7a7263138772c78c8c4330a2ed6cfbd3092c8985

    SHA256

    a2da2ca46128fdf7530a27ab8345986278cda1b78d7a075ec0fb11b66474fa8d

    SHA512

    d0a2d60113cdce329303f9657b741317e2f5b691d248fa2131b6668e07e7db9a5292ab734456681f335b71c732e003009631113cf14f218e13aaad7d4e8bb4d7

  • C:\Users\Admin\AppData\Local\Temp\2jywVpiXCBPKrhj2foFddYdfPdc\resources\app\src\header.ejs

    Filesize

    38KB

    MD5

    eef60d35e9f75d3c7030d0574250e56f

    SHA1

    6d29148b90187fa1583652bc8799e65efa10f637

    SHA256

    3cf434b126e4369ffb8e9f4d489daee1aad9f47828850386984b3c752cdc7042

    SHA512

    529bf36dacd2fc808e63a8091a8aa92f5d3d39c23077bc72298bf052f1bdcd6fc05282608ce5337643d3c1a794bdde2b8d364f7deb0c4b7ae75810be3bdb165b

  • C:\Users\Admin\AppData\Local\Temp\2jywVpiXCBPKrhj2foFddYdfPdc\resources\app\src\index.ejs

    Filesize

    880B

    MD5

    5cb43b3d3c087f4dfb7ef3604a39e757

    SHA1

    62796be76ccb921544aa6279dd0139b00450e24a

    SHA256

    88b3b17146349c92955cc88bdd70ef1fa414bf624d771a0b8ed0d7f2d40d76cd

    SHA512

    b5247488c6dbd4f682d27884f3b516df00ad6725665f79c2d4ea76c1a54d318a31e32c6f96a11fafc382d36097e50f505e0cba904e13b4d45afa96544401eb81

  • C:\Users\Admin\AppData\Local\Temp\2jywVpiXCBPKrhj2foFddYdfPdc\resources\app\src\index.js

    Filesize

    4KB

    MD5

    45ed15c0c0a7ec66046343f4f3212a7a

    SHA1

    296de778426805a2bda8566c5b37f24c34a6c24a

    SHA256

    5f8ce9450962956086e6f19cfb2bd6c84f230a6264e3164f41e2d2c91ab61925

    SHA512

    4baa2d75426cde366088aec26907ab8fe9ca5eacbb3ea648e5864f807d83b1586dc00d0d4a9f4e06ca219505978139a14869fdac18e39faa47777e74d7621a67

  • C:\Users\Admin\AppData\Local\Temp\2jywVpiXCBPKrhj2foFddYdfPdc\resources\app\src\install-options.ejs

    Filesize

    3KB

    MD5

    877f16609a32c46ff5f8eab3648b1078

    SHA1

    5a3d5785704f016235b96fdbe04a9de69b48e203

    SHA256

    f8981d7e2001efe11511d6779675bcbead2fa27d6557a54dcb8492ea958a1454

    SHA512

    c6df43c91537d13d75e1b2e1b35fc2b452f7d62326f0074c24e975e18a47d31bade8a9e84514091bd537b8cb016c60e87920249cee73370188be045c628a30b0

  • C:\Users\Admin\AppData\Local\Temp\2jywVpiXCBPKrhj2foFddYdfPdc\resources\app\src\language.ejs

    Filesize

    5KB

    MD5

    3fbf51eb59e0f0b050f5abcd2fcd3dca

    SHA1

    90d676bc914c2bebf33464dd088952abbedd56f3

    SHA256

    9016b2792ecdd22276e1d1e4172b4e598478f5668b27beb005e2219d229f216c

    SHA512

    c5e04500ebdd922d989594e3a0822fa9a9557d749e60af86ab1e309847342431a606f5e604538fa5d5666535bc68c4f5fbeeb4cdda9a832384505aac1ba2d998

  • C:\Users\Admin\AppData\Local\Temp\2jywVpiXCBPKrhj2foFddYdfPdc\resources\app\src\logs.ejs

    Filesize

    1KB

    MD5

    6fc7c3d8bac3259202cb981acf8b18b6

    SHA1

    f3963b01f9a2df4e9b0b989b4e7ea8f55198ddfa

    SHA256

    62e112e61b5c9c582f5a9aac790a9275be8a560d1edb93c3a6879330298e53fc

    SHA512

    7d719b9698344ba99d3d860e28421bc7cfaf2e9d80cfc6da472413800900aa64f055add8269553e9838aa998df4d6575c6bf0091cf6263a6ea0c2537c36b5df0

  • C:\Users\Admin\AppData\Local\Temp\2jywVpiXCBPKrhj2foFddYdfPdc\resources\app\src\path.ejs

    Filesize

    2KB

    MD5

    21e1d48f90eb1017539741c7a74cf059

    SHA1

    7906534922134e26a5c59324aafad63e20bf10ba

    SHA256

    870496c864624ebce9da0b98ea830249897a2a2317f6a816751f0edb30aeb32b

    SHA512

    2cd3d44337c5e1b794a2233d25fef122a97910d7f7d32cb811c0fa3f84397dd4781e917ba3db0e024384439413925dd0ab73888d3d82119951b86192e807685b

  • C:\Users\Admin\AppData\Local\Temp\2jywVpiXCBPKrhj2foFddYdfPdc\v8_context_snapshot.bin

    Filesize

    663KB

    MD5

    81870fb2f641c8b845e9c6d1a632f0b7

    SHA1

    fcd47d8d1232c189a1c4087bb03a015ce14c25ba

    SHA256

    875515af4e7254458c17a98bed087fc609d45fbc8ebf60663e112c37204f6840

    SHA512

    7748c8fb6f356aa45023a56245c43c5171d0413617fb1ac6c75650be75bbe94bd5528e9aa83cd9df9a08af65540a76ab59bc866e5dcf0fa7284122f290bd45d3

  • C:\Users\Admin\AppData\Local\Temp\2jywVpiXCBPKrhj2foFddYdfPdc\vk_swiftshader.dll

    Filesize

    5.1MB

    MD5

    0a071201e4dd76996e273c81533bfa74

    SHA1

    5c92c634027692c344a8e74eab8b4d5c3e049497

    SHA256

    08e34bc25653f9357a4ccf62966d698b7cc6265dc668046a28403ae5786132ee

    SHA512

    b5de6548c5c743b6f119183fa06aaf67dcd4cdbc3542378ff87916b670ace1e2f4270f6dcaa4caabd01460c638bd02b565267e7bd9617ca92d72187d374bb7d6

  • C:\Users\Admin\AppData\Local\Temp\nsd9C02.tmp\BgImage.dll

    Filesize

    7KB

    MD5

    487368e6fce9ab9c5ea053af0990c5ef

    SHA1

    b538e37c87d4b9a7645dcbbd9e93025a31849702

    SHA256

    e27efa5dfde875bd6b826fafb4c7698db6b6e30e68715a1c03eb018e3170fc04

    SHA512

    bb3ed4c0d17a11365b72653112b48c8c63ab10590dda3dfd90aa453f0d64203000e4571c73998063352240e1671d14da5ee394439899aaa31054fa2e9b722ea7

  • C:\Users\Admin\AppData\Local\Temp\nsd9C02.tmp\StdUtils.dll

    Filesize

    100KB

    MD5

    c6a6e03f77c313b267498515488c5740

    SHA1

    3d49fc2784b9450962ed6b82b46e9c3c957d7c15

    SHA256

    b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e

    SHA512

    9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

  • C:\Users\Admin\AppData\Local\Temp\nsd9C02.tmp\System.dll

    Filesize

    12KB

    MD5

    0d7ad4f45dc6f5aa87f606d0331c6901

    SHA1

    48df0911f0484cbe2a8cdd5362140b63c41ee457

    SHA256

    3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

    SHA512

    c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

  • C:\Users\Admin\AppData\Roaming\Battly Launcher Installer\Cache\Cache_Data\data_0

    Filesize

    44KB

    MD5

    28fea55ab93e8f017d7f42ed06bccc77

    SHA1

    e5518db6a621f65820a3a9f63bd9a85012ca7ce7

    SHA256

    1ab6c91b032116535440d2d1a43342728c280096ed881e8534178657f1e2f56e

    SHA512

    093d5a665b87034f8e65a6bf62f42a02c1dd0b3135368c31d09b5f1db8625717f5276e668dfcce549b4441b816246ced5ed844f261daaf26e142697ebb00eea3

  • C:\Users\Admin\AppData\Roaming\Battly Launcher Installer\Cache\Cache_Data\data_2

    Filesize

    8KB

    MD5

    0962291d6d367570bee5454721c17e11

    SHA1

    59d10a893ef321a706a9255176761366115bedcb

    SHA256

    ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

    SHA512

    f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

  • C:\Users\Admin\AppData\Roaming\Battly Launcher Installer\Code Cache\js\index

    Filesize

    24B

    MD5

    54cb446f628b2ea4a5bce5769910512e

    SHA1

    c27ca848427fe87f5cf4d0e0e3cd57151b0d820d

    SHA256

    fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d

    SHA512

    8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

  • C:\Users\Admin\AppData\Roaming\Battly Launcher Installer\DawnCache\data_3

    Filesize

    8KB

    MD5

    41876349cb12d6db992f1309f22df3f0

    SHA1

    5cf26b3420fc0302cd0a71e8d029739b8765be27

    SHA256

    e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

    SHA512

    e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

  • C:\Users\Admin\AppData\Roaming\Battly Launcher Installer\Local Storage\leveldb\MANIFEST-000001

    Filesize

    41B

    MD5

    5af87dfd673ba2115e2fcf5cfdb727ab

    SHA1

    d5b5bbf396dc291274584ef71f444f420b6056f1

    SHA256

    f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

    SHA512

    de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

  • C:\Users\Admin\AppData\Roaming\Battly Launcher Installer\Network\Network Persistent State

    Filesize

    697B

    MD5

    306736b28bc92af4bba48a7740898bb0

    SHA1

    dccdb44aada49dc2152ab20714af60c7229cf045

    SHA256

    441942a11bdd90865ef2427034811922719496cfdf1abb1a013eb47eacd0910b

    SHA512

    0178ba3526ab68298289852967cd35ea45e6ec4448ad39e1b8b413a979473b71db669eb5049d9312fe821e8795a977cdc8dfe6c03695173ba76018ec8790bb26

  • C:\Users\Admin\AppData\Roaming\Battly Launcher Installer\Network\Network Persistent State~RFe58cb5a.TMP

    Filesize

    59B

    MD5

    2800881c775077e1c4b6e06bf4676de4

    SHA1

    2873631068c8b3b9495638c865915be822442c8b

    SHA256

    226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

    SHA512

    e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

  • C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

    Filesize

    2B

    MD5

    f3b25701fe362ec84616a93a45ce9998

    SHA1

    d62636d8caec13f04e28442a0a6fa1afeb024bbb

    SHA256

    b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

    SHA512

    98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

  • memory/980-622-0x0000026574010000-0x0000026574011000-memory.dmp

    Filesize

    4KB

  • memory/980-611-0x0000026574010000-0x0000026574011000-memory.dmp

    Filesize

    4KB

  • memory/980-610-0x0000026574010000-0x0000026574011000-memory.dmp

    Filesize

    4KB

  • memory/980-612-0x0000026574010000-0x0000026574011000-memory.dmp

    Filesize

    4KB

  • memory/980-621-0x0000026574010000-0x0000026574011000-memory.dmp

    Filesize

    4KB

  • memory/980-620-0x0000026574010000-0x0000026574011000-memory.dmp

    Filesize

    4KB

  • memory/980-619-0x0000026574010000-0x0000026574011000-memory.dmp

    Filesize

    4KB

  • memory/980-618-0x0000026574010000-0x0000026574011000-memory.dmp

    Filesize

    4KB

  • memory/980-617-0x0000026574010000-0x0000026574011000-memory.dmp

    Filesize

    4KB

  • memory/980-616-0x0000026574010000-0x0000026574011000-memory.dmp

    Filesize

    4KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.