Analysis

  • max time kernel
    84s
  • max time network
    139s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-09-2024 05:09

General

  • Target

    Ultimate Tweaks.exe

  • Size

    168.2MB

  • MD5

    02c4b9609f04037960d947113bc2a017

  • SHA1

    b593fc590fafb5e11ccceb199ff405874183c4e8

  • SHA256

    3b47e84d5ca6ad15d2e8916d6cbd6af9ab943a42e84241e0517eaab66b5ef214

  • SHA512

    d4b3d0f440f6c61716dc156494e0be5cb4053d170d8917f7686e26734023c4e29785f354f0bc21912da06a33547573256379874027dc990cdc91d648f176826a

  • SSDEEP

    1572864:9QqT4eFUirK1e2zSQ5Rcw/N5cae/bHhrPdacyodvcPSBoHESUlyAzl/:vBKRcAMyAzB

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 5 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 18 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 56 IoCs

    Using powershell.exe command.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 14 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Ultimate Tweaks.exe
    "C:\Users\Admin\AppData\Local\Temp\Ultimate Tweaks.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1820
    • C:\Users\Admin\AppData\Local\Temp\Ultimate Tweaks.exe
      "C:\Users\Admin\AppData\Local\Temp\Ultimate Tweaks.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Ultimate Tweaks" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1700 --field-trial-handle=1704,i,11949268860015926000,3716815935827869204,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:2
      2⤵
        PID:2476
      • C:\Users\Admin\AppData\Local\Temp\Ultimate Tweaks.exe
        "C:\Users\Admin\AppData\Local\Temp\Ultimate Tweaks.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Ultimate Tweaks" --mojo-platform-channel-handle=2116 --field-trial-handle=1704,i,11949268860015926000,3716815935827869204,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:3
        2⤵
          PID:2256
        • C:\Users\Admin\AppData\Local\Temp\Ultimate Tweaks.exe
          "C:\Users\Admin\AppData\Local\Temp\Ultimate Tweaks.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Ultimate Tweaks" --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --no-sandbox --no-zygote --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2320 --field-trial-handle=1704,i,11949268860015926000,3716815935827869204,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:1
          2⤵
          • Checks computer location settings
          • Checks processor information in registry
          • Suspicious use of WriteProcessMemory
          PID:3700
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /d /s /c "chcp"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:4452
            • C:\Windows\system32\chcp.com
              chcp
              4⤵
                PID:4796
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
              3⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:864
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
              3⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2960
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
              3⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2232
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
              3⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:1620
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
              3⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:4796
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
              3⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:1792
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
              3⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:764
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
              3⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:864
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
              3⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:4368
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
              3⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:1332
          • C:\Users\Admin\AppData\Local\ultimate-tweaks-updater\pending\Ultimate-Tweaks-Setup-1.0.2.exe
            C:\Users\Admin\AppData\Local\ultimate-tweaks-updater\pending\Ultimate-Tweaks-Setup-1.0.2.exe --updated /S --force-run
            2⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:3268
        • C:\Users\Admin\AppData\Local\Programs\Ultimate Tweaks\Ultimate Tweaks.exe
          "C:\Users\Admin\AppData\Local\Programs\Ultimate Tweaks\Ultimate Tweaks.exe" --updated
          1⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:4844
          • C:\Users\Admin\AppData\Local\Programs\Ultimate Tweaks\Ultimate Tweaks.exe
            "C:\Users\Admin\AppData\Local\Programs\Ultimate Tweaks\Ultimate Tweaks.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Ultimate Tweaks" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1792 --field-trial-handle=1796,i,8532186654939204995,5075855545452340556,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:2
            2⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:232
          • C:\Users\Admin\AppData\Local\Programs\Ultimate Tweaks\Ultimate Tweaks.exe
            "C:\Users\Admin\AppData\Local\Programs\Ultimate Tweaks\Ultimate Tweaks.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Ultimate Tweaks" --mojo-platform-channel-handle=2176 --field-trial-handle=1796,i,8532186654939204995,5075855545452340556,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:3
            2⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:756
          • C:\Users\Admin\AppData\Local\Programs\Ultimate Tweaks\Ultimate Tweaks.exe
            "C:\Users\Admin\AppData\Local\Programs\Ultimate Tweaks\Ultimate Tweaks.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Ultimate Tweaks" --app-path="C:\Users\Admin\AppData\Local\Programs\Ultimate Tweaks\resources\app.asar" --no-sandbox --no-zygote --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2456 --field-trial-handle=1796,i,8532186654939204995,5075855545452340556,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:1
            2⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Loads dropped DLL
            • Checks processor information in registry
            PID:3992
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /d /s /c "chcp"
              3⤵
                PID:2312
                • C:\Windows\system32\chcp.com
                  chcp
                  4⤵
                    PID:3112
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                  3⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  PID:3464
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                  3⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  PID:4528
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                  3⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  PID:2372
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                  3⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  PID:5064
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                  3⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  PID:1156
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                  3⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  PID:5056
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                  3⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  PID:1580
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                  3⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  PID:2684
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                  3⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  PID:2732
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                  3⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  PID:668
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                  3⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  PID:2344
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                  3⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  PID:4192
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                  3⤵
                  • Command and Scripting Interpreter: PowerShell
                  PID:1096
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                  3⤵
                  • Command and Scripting Interpreter: PowerShell
                  PID:2908
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                  3⤵
                  • Command and Scripting Interpreter: PowerShell
                  PID:2552
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                  3⤵
                  • Command and Scripting Interpreter: PowerShell
                  PID:2288
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                  3⤵
                  • Command and Scripting Interpreter: PowerShell
                  PID:2248
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                  3⤵
                  • Command and Scripting Interpreter: PowerShell
                  PID:4396
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                  3⤵
                  • Command and Scripting Interpreter: PowerShell
                  PID:4956
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                  3⤵
                  • Command and Scripting Interpreter: PowerShell
                  PID:5112
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                  3⤵
                  • Command and Scripting Interpreter: PowerShell
                  PID:4296
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                  3⤵
                  • Command and Scripting Interpreter: PowerShell
                  PID:3924
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                  3⤵
                  • Command and Scripting Interpreter: PowerShell
                  PID:3628
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                  3⤵
                  • Command and Scripting Interpreter: PowerShell
                  PID:4100
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                  3⤵
                  • Command and Scripting Interpreter: PowerShell
                  PID:2916
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                  3⤵
                  • Command and Scripting Interpreter: PowerShell
                  PID:2444
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                  3⤵
                  • Command and Scripting Interpreter: PowerShell
                  PID:1988
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                  3⤵
                  • Command and Scripting Interpreter: PowerShell
                  PID:4944
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                  3⤵
                  • Command and Scripting Interpreter: PowerShell
                  PID:972
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                  3⤵
                  • Command and Scripting Interpreter: PowerShell
                  PID:4964
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                  3⤵
                  • Command and Scripting Interpreter: PowerShell
                  PID:5004
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                  3⤵
                  • Command and Scripting Interpreter: PowerShell
                  PID:1660
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                  3⤵
                  • Command and Scripting Interpreter: PowerShell
                  PID:4044
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                  3⤵
                  • Command and Scripting Interpreter: PowerShell
                  PID:4724
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                  3⤵
                  • Command and Scripting Interpreter: PowerShell
                  PID:3752
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                  3⤵
                  • Command and Scripting Interpreter: PowerShell
                  PID:4444
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                  3⤵
                  • Command and Scripting Interpreter: PowerShell
                  PID:2520
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                  3⤵
                  • Command and Scripting Interpreter: PowerShell
                  PID:4356
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                  3⤵
                  • Command and Scripting Interpreter: PowerShell
                  PID:2996
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                  3⤵
                  • Command and Scripting Interpreter: PowerShell
                  PID:2288
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                  3⤵
                  • Command and Scripting Interpreter: PowerShell
                  PID:432
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                  3⤵
                  • Command and Scripting Interpreter: PowerShell
                  PID:3248
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                  3⤵
                  • Command and Scripting Interpreter: PowerShell
                  PID:3472
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                  3⤵
                  • Command and Scripting Interpreter: PowerShell
                  PID:4656
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                  3⤵
                  • Command and Scripting Interpreter: PowerShell
                  PID:1064
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
                  3⤵
                  • Command and Scripting Interpreter: PowerShell
                  PID:2312
              • C:\Users\Admin\AppData\Local\Programs\Ultimate Tweaks\Ultimate Tweaks.exe
                "C:\Users\Admin\AppData\Local\Programs\Ultimate Tweaks\Ultimate Tweaks.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Ultimate Tweaks" --app-path="C:\Users\Admin\AppData\Local\Programs\Ultimate Tweaks\resources\app.asar" --enable-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3544 --field-trial-handle=1796,i,8532186654939204995,5075855545452340556,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:1
                2⤵
                • Checks computer location settings
                • Executes dropped EXE
                • Loads dropped DLL
                PID:1948

            Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

              Filesize

              3KB

              MD5

              5c3cc3c6ae2c1e0b92b502859ce79d0c

              SHA1

              bde46d0f91ad780ce5cba924f8d9f4c175c5b83d

              SHA256

              5a48860ad5bdf15d7a241aa16124163ec48adc0f0af758e43561ac07e4f163b2

              SHA512

              269b79931df92c30741c9a42a013cb24935887272ed8077653f0b6525793da52c5004c70329d8e0e7b2776fc1aba6e32da5dadf237ae42f7398fdf35a930663e

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

              Filesize

              2KB

              MD5

              28c65370f12e84b734af87ad491ea257

              SHA1

              402d3a8203115f1365d48fa72daf0a56e14d8a08

              SHA256

              4ea873fb3d77a2f8eefae82c943f621f16723516e181bde133568f8f0c91290c

              SHA512

              56eb34162b0a39da4aaf66aad35ef355a7709982b5060792e3b4849c36650725176e927815537ec58e7ddf0fb1763066b203d6b7f9d1b3dd2c8bc091c0c850cc

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

              Filesize

              2KB

              MD5

              b3c9a4b5cac63fb68bfe8f999c0f961c

              SHA1

              6476831f636cb36bdce0e6a77f85d40c2e107614

              SHA256

              aa72a9de1cc3854baee8848d3af357e7209ea8f4f44d8ea574c9aeba58b30398

              SHA512

              5a852269f276ea0d8ab73bb2585a4af000ff3620ddc6869d27a525da3085f7b2be23a1583b92382d281e7964dcd789bb5a3e3caec4a719eff6e39d57279159f3

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

              Filesize

              2KB

              MD5

              efc3fc0d2164c72c14942dc48f75fa7d

              SHA1

              80ff9505effdf2e87b77267c209fc70e50cddd66

              SHA256

              2e3659b89ea3dfa643a89436508d1a31be1355a47f8aa00ce23dbb8ce03589b3

              SHA512

              e5468aff55e56abc29f967d3decf1815b6d7106f4d51f586903b532b8a0280e696a7a1acac6535f4b5ac418437049f24b85eb9fe5b61eb08e84ea7ea10c95850

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

              Filesize

              2KB

              MD5

              cce33e325982f2277c8d0b410914732d

              SHA1

              54cc132078e2900c5aa69e3dfac94919646e8a53

              SHA256

              b6893c8e42f463a12dee9021a512a591af61bc327a10ed5951ce7c4eb1b3f83f

              SHA512

              9fbb0b42439d69867f777ce6a84eeee9b6c30f5fe4b552829f6f1c8fbdbaecfe9f3572ecfcdd3ead7319856cb5bd9704fca3bd93f27c319deef0635e8584ff5e

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

              Filesize

              2KB

              MD5

              89054116dbf131364ee605ae7322e0e9

              SHA1

              b82159bc7c2bd21e108b71e7a068a343fe3d446f

              SHA256

              b22a6a6c4ef4796dfbecc38fcafa17fa929bb84d273594627c37b674c098dd01

              SHA512

              75b24d58032dcc6938286fa1a0a0e5e07e99adcfbc927cf942b610d32602222d4c7dce2f55b8d1b65be47efb8319b9433fd5e4453f61f93d9fcf68fd519d07ca

            • C:\Users\Admin\AppData\Local\Programs\Ultimate Tweaks\chrome_100_percent.pak

              Filesize

              150KB

              MD5

              b1bccf31fa5710207026d373edd96161

              SHA1

              ae7bb0c083aea838df1d78d61b54fb76c9a1182e

              SHA256

              49aff5690cb9b0f54f831351aa0f64416ba180a0c4891a859fa7294e81e9c8e3

              SHA512

              134a13ad86f8bd20a1d2350236269fd39c306389a600556a82025d5e0d5adaab0709d59e9b7ee96e8e2d25b6df49fefea27cdccefe5fba9687abf92a9a941d91

            • C:\Users\Admin\AppData\Local\Programs\Ultimate Tweaks\chrome_200_percent.pak

              Filesize

              229KB

              MD5

              e02160c24b8077b36ff06dc05a9df057

              SHA1

              fc722e071ce9caf52ad9a463c90fc2319aa6c790

              SHA256

              4d5b51f720f7d3146e131c54a6f75e4e826c61b2ff15c8955f6d6dd15bedf106

              SHA512

              1bf873b89b571974537b685cdb739f8ed148f710f6f24f0f362f8b6bb605996fcfec1501411f2cb2df374d5fdaf6e2daaada8cea68051e3c10a67030ea25929e

            • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ek1y00ff.u43.ps1

              Filesize

              60B

              MD5

              d17fe0a3f47be24a6453e9ef58c94641

              SHA1

              6ab83620379fc69f80c0242105ddffd7d98d5d9d

              SHA256

              96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

              SHA512

              5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

            • C:\Users\Admin\AppData\Local\Temp\nss17AB.tmp\7z-out\LICENSE.electron.txt

              Filesize

              1KB

              MD5

              4d42118d35941e0f664dddbd83f633c5

              SHA1

              2b21ec5f20fe961d15f2b58efb1368e66d202e5c

              SHA256

              5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d

              SHA512

              3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63

            • C:\Users\Admin\AppData\Local\Temp\nss17AB.tmp\7z-out\LICENSES.chromium.html

              Filesize

              8.7MB

              MD5

              bd0ced1bc275f592b03bafac4b301a93

              SHA1

              68776b7d9139588c71fbc51fe15243c9835acb67

              SHA256

              ad35e72893910d6f6ed20f4916457417af05b94ab5204c435c35f66a058d156b

              SHA512

              5052ae32dae0705cc29ea170bcc5210b48e4af91d4ecec380cb4a57ce1c56bc1d834fc2d96e2a0f5f640fcac8cafe4a4fdd0542f26ca430d76aa8b9212ba77aa

            • C:\Users\Admin\AppData\Local\Temp\nss17AB.tmp\7z-out\d3dcompiler_47.dll

              Filesize

              4.7MB

              MD5

              2191e768cc2e19009dad20dc999135a3

              SHA1

              f49a46ba0e954e657aaed1c9019a53d194272b6a

              SHA256

              7353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d

              SHA512

              5adcb00162f284c16ec78016d301fc11559dd0a781ffbeff822db22efbed168b11d7e5586ea82388e9503b0c7d3740cf2a08e243877f5319202491c8a641c970

            • C:\Users\Admin\AppData\Local\Temp\nss17AB.tmp\7z-out\ffmpeg.dll

              Filesize

              2.7MB

              MD5

              bf09deeeb497aeddaf6194e695776b8b

              SHA1

              e7d8719d6d0664b8746581b88eb03a486f588844

              SHA256

              450d5e6a11dc31dc6e1a7af472cd08b7e7a78976b1f0aa1c62055a0a720f5080

              SHA512

              38d3cac922634df85ddfd8d070b38cf4973bba8f37d3246453377f30165cc4377b4e67c4e0bca0ffe3c3fa0e024b23a31ec009e16d0ab3042593b5a6e164669f

            • C:\Users\Admin\AppData\Local\Temp\nss17AB.tmp\7z-out\icudtl.dat

              Filesize

              10.2MB

              MD5

              e0f1ad85c0933ecce2e003a2c59ae726

              SHA1

              a8539fc5a233558edfa264a34f7af6187c3f0d4f

              SHA256

              f5170aa2b388d23bebf98784dd488a9bcb741470384a6a9a8d7a2638d768defb

              SHA512

              714ed5ae44dfa4812081b8de42401197c235a4fa05206597f4c7b4170dd37e8360cc75d176399b735c9aec200f5b7d5c81c07b9ab58cbca8dc08861c6814fb28

            • C:\Users\Admin\AppData\Local\Temp\nss17AB.tmp\7z-out\libEGL.dll

              Filesize

              467KB

              MD5

              3a5cbf0ce848ec30a2f8fe1760564515

              SHA1

              31bf9312cd1beaedaa91766e5cde13406d6ea219

              SHA256

              afef052c621f72ba986d917a9e090d23a13f4ab6bc09f158eeb73fd671b94219

              SHA512

              bd5713e1d22145b4cc52f4e46b464f443aad6f783a5793268e7d9dca969f27b70e706eecd54cb01be1c94256e6a95864c6b7e50027cef7fa870cdb16820ad602

            • C:\Users\Admin\AppData\Local\Temp\nss17AB.tmp\7z-out\libGLESv2.dll

              Filesize

              7.3MB

              MD5

              c783045e4b7f00c847678d43a77367f7

              SHA1

              7f9192ce0b23ac93561aeec9d9c38daa3136c146

              SHA256

              3a39137dcee6cb6663ae9cca424b6b05cf56c0ad7e32fb72cb94549ea9dbcae8

              SHA512

              64e6d4fc84f1217ceef05a22ad63a6618ffdc470b1faf4ad9e2d7bab59e9285527b9c5fd7ea4be673a08b9466434e3c098e839bf6955597e3d8aa0e80589f4a3

            • C:\Users\Admin\AppData\Local\Temp\nss17AB.tmp\7z-out\locales\af.pak

              Filesize

              478KB

              MD5

              9554e414159d76754147d7e185056094

              SHA1

              e0fb0c95cef8e8d1ebeb11a6e2ea03b9067d799e

              SHA256

              f402c0d8494c9a2fceedcd7845ddf43b62e7d01ddb1d9c8e132efea83b724824

              SHA512

              9e8b41f69605d7bd426243e49b0f22347b211f7d13038ee6350d86d06cc7274bb2ef1918e27548802a5437903a653d86fce85338fa97f8c9642c0e74ed59ae88

            • C:\Users\Admin\AppData\Local\Temp\nss17AB.tmp\7z-out\locales\am.pak

              Filesize

              776KB

              MD5

              92ffe73f193d41c5a90303955b2da67f

              SHA1

              1d4136d8bb752da2834ebf0f4f62de56efefd78f

              SHA256

              325dd137903fc0d9e5010a62a314d9c6984ff82afbdff2254f7c48bd03dda06a

              SHA512

              6c4f0aac10276ab84ec4e63ec9ad0e20a1b3ce9d2368ec966cc6471600c3d28df8f9e501b4843bafa5bcf2aab57242559ba430d58853180ea653afbc8f468e67

            • C:\Users\Admin\AppData\Local\Temp\nss17AB.tmp\7z-out\locales\ar.pak

              Filesize

              851KB

              MD5

              7608398c66cd0b55396f7250b3c8747c

              SHA1

              7e8417dfc7055fb9ecbe7cfc97a8aba0bd5a0e13

              SHA256

              3bb407fa588fb801ab241e8dda018461b54010a38648c3acc1e3550c0dfbd75a

              SHA512

              5dd757e4f114782eab9ab8cadbfe3179ded594285b3d0f7f6fa5ca50d80d866e7c8ff6a1f44deba8bdf09c04106de635c1da22597c008023b1fdf1cc747b6f1c

            • C:\Users\Admin\AppData\Local\Temp\nss17AB.tmp\7z-out\locales\bg.pak

              Filesize

              885KB

              MD5

              c80a2008d9f61c182430a728a6e059af

              SHA1

              2f2aa33573156d9939e3fc81f8d81de4aac21e61

              SHA256

              5947f567ce1f4ab945dc6dab1599422d412f4417b9097905150d669122e43f7d

              SHA512

              016ce835b6bac4d5b38d72c0b3adf4d6b4e0ac04677d70c53e5938acd28b12220d2878bca7875471d008b779ea6ab4972a9875b44304e867d0bb5e4318c0edc3

            • C:\Users\Admin\AppData\Local\Temp\nss17AB.tmp\7z-out\locales\bn.pak

              Filesize

              1.1MB

              MD5

              d179d38e8b9f7e60a943e2fc9f9471ad

              SHA1

              8d109081959d194c82b89fb25a514a65233435a7

              SHA256

              a45279ccc13390e0d93cfe1e33a7f276a5d9e97f6aefa6b6e14ecc4289703bda

              SHA512

              fa6f3e45f40e1e48f191e4a65f5d15dabd7058af4537eea3e34998dc67dd250b00e52d1f07b10a73a67a15aada4523e50f40160d98a5f37ef4684a30ff338468

            • C:\Users\Admin\AppData\Local\Temp\nss17AB.tmp\7z-out\locales\ca.pak

              Filesize

              538KB

              MD5

              bd846046383d64073da6eb192f5cddb1

              SHA1

              6dd4bfb982101ecafc14eb35834caa1fe5b1e3f5

              SHA256

              1dca9a7fcd850aecd48288999b436ff7e70cd4a96f47b40319759a800fb8eefa

              SHA512

              521ddf6e8fb444b911212501825392562af14cfb5b31a80707fdeffb13c8afb04852b0e3f7e3363a1c3a37c5c35bb1cbe84b458e14e30b5e8d8cb00a6a349ce0

            • C:\Users\Admin\AppData\Local\Temp\nss17AB.tmp\7z-out\locales\cs.pak

              Filesize

              555KB

              MD5

              926b4d7f540ce0b1912e5fb6383dabb7

              SHA1

              a7adbc83ef38092a90d964d61359a6caa1253090

              SHA256

              2964edcdcb27b2edf73515615501d8af28ad94b5dd31d2794f2624808c74de38

              SHA512

              bf6160e46eebf16d6b6f05d330068fa226118457ff03277b59ed4e1a6d2d28b212155cae2f48c34adfa81d20ff71e4206f25052257559f4768323b342dd16278

            • C:\Users\Admin\AppData\Local\Temp\nss17AB.tmp\7z-out\locales\da.pak

              Filesize

              501KB

              MD5

              c54edb2260d2b907049cdd4772d5313b

              SHA1

              a12f623e6310b667a9c38b4c9143920d08564377

              SHA256

              318a9ec9e9fbe35d5d8cb9b719ecfbe1ecba9d8f246876c949c082107b439ddb

              SHA512

              4eef045080fecaf55bf2cca7d72d039b7d7a7b28021b649becee320a3a8c0753f4e0e5f869a188813e746bad05fd08c726b5c25f40ef9555967fafd93f7f6989

            • C:\Users\Admin\AppData\Local\Temp\nss17AB.tmp\7z-out\locales\de.pak

              Filesize

              536KB

              MD5

              5a252c49719970b8fb33fbc8ec98971a

              SHA1

              931834866af36a9e25582a1f631a8cbc965a8e84

              SHA256

              d5746f48800efbff7db9d1bb8d6e5a5102eb7d79ae136e0485fd427be1ca63a1

              SHA512

              d4e6ab68d0b1a564b886c8bbe60e7bf67c3f71e6fc70ed5bfbb63a974f72afce62e03559f29f46a424908c256e990ff6cebeab8fddfbd79f6deca997cf7117cd

            • C:\Users\Admin\AppData\Local\Temp\nss17AB.tmp\7z-out\locales\el.pak

              Filesize

              971KB

              MD5

              35ba1b364ecfff6486daed2a33cc6431

              SHA1

              b894b392d400fde4d35bc3b4edc130853cda340b

              SHA256

              c0434492be64b08f9ad00bc7cff65314822406dfb0c591fea0df6af9b6fc89c5

              SHA512

              5f5d2cf1d5c8158c62fe310338bfb1c9683ea2f43726c9f02fe6d2c29482e3211fd3d61a30dc0cf738549dc7047dfce0dbac36b9d22dfffb558f118fdbb3d856

            • C:\Users\Admin\AppData\Local\Temp\nss17AB.tmp\7z-out\locales\en-GB.pak

              Filesize

              436KB

              MD5

              a44922cb4cd8816b9ce3d018dba9e6a0

              SHA1

              2ed3a8bd4a11bb89d3699f583372ad7aecc46ddd

              SHA256

              e0df967ffdf872f0a9589a0d74d68a742fa9b956add7a6736b82aebd9e8f02d3

              SHA512

              461b04a170c562382f6c1022f881db9f6928a36c962a2e3aeabee62dd4c46e08b59ef33a2d1d26af21dcc47d00b0c51e10b43f14dcd627f84104ab4f31a9e526

            • C:\Users\Admin\AppData\Local\Temp\nss17AB.tmp\7z-out\locales\en-US.pak

              Filesize

              440KB

              MD5

              731c45f9f23957acc11b43d775758aaa

              SHA1

              12e66417a2dc0c5211ed67f026208ef02fcb40af

              SHA256

              02b97817b6eebd7caeaaff750f6462abc68911c398ddf0571b7900ff9b4ea9a2

              SHA512

              1a008df585ef76d9cf4459fc3e617b8d4397e7078c77852712fc7cf4f304081bc5195243437e64074016b05a8cd671db93666042e59b959595ba854ceb330a81

            • C:\Users\Admin\AppData\Local\Temp\nss17AB.tmp\7z-out\locales\es-419.pak

              Filesize

              530KB

              MD5

              763f8c8ce092a3d64bbebddf4169e108

              SHA1

              89f2834c1b4e3f84870af29650bda6fe360350f5

              SHA256

              0c816f00b15d59809d30b6611aa455ea1bf8b022d2f887137f1c9d7a5600d5d9

              SHA512

              8401cec52e80a5136543473b317f0e2d920008c83b9667605cd0deb9fa5f933deeda0aa475b436520001c6a7c91118a4d9b11e28a9f4b31271662780e678dc06

            • C:\Users\Admin\AppData\Local\Temp\nss17AB.tmp\7z-out\locales\es.pak

              Filesize

              530KB

              MD5

              f6f452e9fe45b56b489b2e99c99848d7

              SHA1

              c64384626ea966d3a24dfd4d6c2f42c1cc082d2f

              SHA256

              54f85551269c8b5f3985a09d313fdc04c4595e5058163cf147ede049b8faa605

              SHA512

              f3c50308531f9654ff394cbdfdcc6029c60dc6659fe60e0326b4855a31f3eedc86f3df82a96a9e7691d12c7a69079c4abe2722f599aae29f48b291fb5a39a3a1

            • C:\Users\Admin\AppData\Local\Temp\nss17AB.tmp\7z-out\locales\et.pak

              Filesize

              481KB

              MD5

              97918bb7b36900705b1a53b7851db6b3

              SHA1

              f8cca656478c6e15baa8f344dda2704087f54776

              SHA256

              8021814965878c4913d1f9f9d226da49cc2a37746d976f3b84aad7fe096fd14f

              SHA512

              6daa8f56c231cfd7dfc17bb5d5c56afca9490f953f22c92365a1f88e995c3a1705de98a725177001bb449070c860fd1c843ee0a499c6dd8321f2e6f4cf914da9

            • C:\Users\Admin\AppData\Local\Temp\nss17AB.tmp\7z-out\locales\fa.pak

              Filesize

              789KB

              MD5

              04f629bc5fa6d761f1d7b5dc28a6b97e

              SHA1

              d80f74a2b6508bae49b8344809062b48dc2b2dc5

              SHA256

              9b5334e4883a716c5616c859889aacd7b179b30ac65e5657198eb4e877700f81

              SHA512

              ea412096170ae29b33f3d54f17fb9f2f5a41035df56e2af9596ec7c15422277943c5c651df6b3a232aca4e979946732bec496da03b3e47e0d4629675751a4c67

            • C:\Users\Admin\AppData\Local\Temp\nss17AB.tmp\7z-out\locales\fi.pak

              Filesize

              492KB

              MD5

              3acdfec7edd4d3eb473f0deb32713c14

              SHA1

              41fdd4af5f9fa78f4f81d3996ecafd69587f05ef

              SHA256

              4bf099ac8a76449bf597caf005790f5c02efd533b9a329c5fdc460d38f77607e

              SHA512

              b167caf1e5ff38b0c80f891715866a7754e9bf3f1479aa1faa3cf3e8ae7fe9b71a87109239750f71855330b6d20704b43e814f188672aa52a5dc6912297f1997

            • C:\Users\Admin\AppData\Local\Temp\nss17AB.tmp\7z-out\locales\fil.pak

              Filesize

              556KB

              MD5

              89a63085d14b1b80f259e166e6ffe56d

              SHA1

              d1326c879a6ad203489226f7c5be08c897be71ac

              SHA256

              00b8cfe6131499a8a67a51dd8560a965a2abb863d52635dd3931df0479c3f5ee

              SHA512

              ab48fc4bc604648b4cc010a530fbcc5138b9d0a0f09398d2a69b6219799a43a052722c47dba96c9d001b4f6ddd491683c0a871c19ac2abc12843e68f9d4c2cf4

            • C:\Users\Admin\AppData\Local\Temp\nss17AB.tmp\7z-out\locales\fr.pak

              Filesize

              574KB

              MD5

              6708a286a0529ba7bed9840d53035be8

              SHA1

              af289ed518d9d90c75b69a870615e3f475c5d0e4

              SHA256

              7169684ff44f342b98648839b8963916f7323115dead332c2471baed6264b80e

              SHA512

              b329798fd85eac1505d0af5cb827ba11a5850eb926be39b414c40b5fdb56432db5f3dbc45237510bd4d1174c1cd62f623c6cc8ab10eb0ca51dea5d5487f0b0fd

            • C:\Users\Admin\AppData\Local\Temp\nss17AB.tmp\7z-out\locales\gu.pak

              Filesize

              1.1MB

              MD5

              ba34657d3f5ebe61b36a807c4a053d72

              SHA1

              163875c4ef39e3473d9d5aec4b6273f34a90a02d

              SHA256

              8c762963cca8eef2cbd39bd7bcd8b809f3b57a75353e687743894add9c19440f

              SHA512

              cb1c4adc59c3e99f819645ae84e3e6b601b340e05ae2182c0b1568bbbcd3eabf7bf09ef34e5d0757530997d0734dc52dd744b8b0edbb3702a3c06e29ba7f0c4e

            • C:\Users\Admin\AppData\Local\Temp\nss17AB.tmp\7z-out\locales\he.pak

              Filesize

              691KB

              MD5

              c47322869b458a1cd231f3dc385f80fb

              SHA1

              4155444dcb69c5b64711139cadb32a6df95ce3ae

              SHA256

              9e5544340da0e0aa28298e68765716a3960a28e50d86146b5324fd70fd756b41

              SHA512

              ca4664a9acbdd5896c6a0921e09d99f1a7ce3d7a80338c1a4310ad499a5a2cbb60ca074a02fcff128789da0a4cf82d3869f83836ae3ae3171085e58d6155fb73

            • C:\Users\Admin\AppData\Local\Temp\nss17AB.tmp\7z-out\locales\hi.pak

              Filesize

              1.2MB

              MD5

              6d3ce5a6049eda31ecbc55a9d3abb163

              SHA1

              100afed265c77a20f6636a0ab48c8a723e30b087

              SHA256

              8dae029a489f1bd7530650a9cb1be1f03741e1d7018503feb3c78759da8af531

              SHA512

              3668952ea707da9ee8fd3753c04d5dfbed97685b76dcc75dcf8d6a3699a832c3ff0db9cd40810f6ea9364f2b7aff4b1cd68980c74b59808fcb4900a36d933bba

            • C:\Users\Admin\AppData\Local\Temp\nss17AB.tmp\7z-out\locales\hr.pak

              Filesize

              535KB

              MD5

              2f7462a076c14f2c2733a41dcc5ecf1b

              SHA1

              c453dbf62d1cfe85adb64ae374b6a79cff2ef97f

              SHA256

              6dcc7d5d771475874471b78ee84db0230341f8634f4b38a9cb90c37226d70b00

              SHA512

              f1df750b779c908547a38b49bae0ed8734fe37cd96d3502186926e6cbd657c248c528cf9944353dfd26695ab384f17f22f0bec251e65a20906da4d67852cc516

            • C:\Users\Admin\AppData\Local\Temp\nss17AB.tmp\7z-out\locales\hu.pak

              Filesize

              576KB

              MD5

              f55e37076460b2e8b5ed0f414618d256

              SHA1

              b313287de6197f1bf9f9770e3d2c99e70c4d8179

              SHA256

              61854ab102bc57a7ad7b85a4fa008c3f071306838ba1a0491f68c19153decd49

              SHA512

              e8121a064a3209878f24c33e9c20c810c56aa15476909de1ce076c80ef635e69a60ac655b7714a116951de5b99bb690827edafddcd5e6b00ee6310807d78ce58

            • C:\Users\Admin\AppData\Local\Temp\nss17AB.tmp\7z-out\locales\id.pak

              Filesize

              475KB

              MD5

              260d34aaada70c9d491bfbedcf5ca8d1

              SHA1

              5fa83a3e53e6aa9eede9fa34a84eb55ee8493314

              SHA256

              64a8a25717ffae1855114d84b02223ad5b3963c1c6a21c826636146726d0a8a2

              SHA512

              a19ec6fae22689a8f851c1a782eb748ee9f38dfad89f05291c01a6070b24a8a02fac4bb4a441421f411966e8bc08e996900871d498efa307ac1793191710ebd2

            • C:\Users\Admin\AppData\Local\Temp\nss17AB.tmp\7z-out\locales\it.pak

              Filesize

              523KB

              MD5

              cfb2ddc4caafd038db00c1e7378d316e

              SHA1

              2573f32a41735efde916f0a73b415ca689c0dd36

              SHA256

              9395bf9a547561df6cd20d8e076452369cb72184f215448d1acd802dccf3a47d

              SHA512

              8a02ca980a8de8af8b179d610ff25557f81f67bfb5a9f82511641ec87b378a2ab7214d5ec681797acba1a865bd726cb9c5f609647ae6ee71a393b7e16fc06f8e

            • C:\Users\Admin\AppData\Local\Temp\nss17AB.tmp\7z-out\locales\ja.pak

              Filesize

              639KB

              MD5

              d84e12cecf6e4355933ed68816f090f6

              SHA1

              eb35ef52f341442dd887d43a52af7f02926d5288

              SHA256

              8de18410e38f4036367113bd4ed253a4957709d87e0aeb11134742bc89e16d62

              SHA512

              9dbe703493acb7b48ee1dbc4458ce0b9d757419e3fbf01379bc8dcbd22cc30a99348f7cb96840c19e873d6d97bb4d1a3baa4fcd6e0d332480273020a6e13a375

            • C:\Users\Admin\AppData\Local\Temp\nss17AB.tmp\7z-out\locales\kn.pak

              Filesize

              1.3MB

              MD5

              a4cce1cfe646eb2c268493603dcb358b

              SHA1

              aa19ee1cdf8776d07bf35614ff063aed5a798ef8

              SHA256

              01250aec7310bb59e0e847382325f940ea2cdab00369c1c7efe2f340d01ff806

              SHA512

              cecb7794a288e879324e74e7522bee61a43072ab58a289b686f1d48d98fe9a0d29a5505b8c891fe411b823c3d8366d6c1cffbcc1deffa6c7d3a04339a769dbc7

            • C:\Users\Admin\AppData\Local\Temp\nss17AB.tmp\7z-out\locales\ko.pak

              Filesize

              540KB

              MD5

              c21dde26f43530135ef37323b00dc1fd

              SHA1

              a118e9713b155bd2999f04c3075f2e1bb05bffaa

              SHA256

              ff88b56be0614232947bfb07e6beb88327a18ebec98cece17caa9b7cd8e6dd24

              SHA512

              0db144f03992c41c3703719e985183a6ec988265e5a629d09bf683d9b208656d605565d6b5597cead909c814f25ce200739e65b1327172afe10d395a5018206c

            • C:\Users\Admin\AppData\Local\Temp\nss17AB.tmp\7z-out\locales\lt.pak

              Filesize

              580KB

              MD5

              93a0a8181e8c251a2375645a552293d6

              SHA1

              57faf2e9f965a49d5294cf9759b9b50d87c2ad1d

              SHA256

              f87b2baacdde69b2b24dc7859d47bad0844cf4d275072812aaf4eedb10318450

              SHA512

              51e1ff74442cfd51fd2fe218755335ed99e4850c8266425b8d55aa0abde2712ab765ff909d6ee620268ade9d7b51a93be659d6a52143da2abf4ec309bbe9f2fc

            • C:\Users\Admin\AppData\Local\Temp\nss17AB.tmp\7z-out\locales\lv.pak

              Filesize

              579KB

              MD5

              07405dc51eddde72e367737c093c20db

              SHA1

              c66b8eccf167060c43b3c53631fc0c95b3afe05d

              SHA256

              dbc860a35ad08e4f502b8784ca1548110d3c7334478f6c392db42f52cb3074f2

              SHA512

              98f276fc137d6592cdbc1c804dd59983e290409bf7908137627ab114ab485e332f568d28c60a35d1dcb3d9753c2d1740065c654396af5f56f0dd5e1dfcffcf71

            • C:\Users\Admin\AppData\Local\Temp\nss17AB.tmp\7z-out\locales\ml.pak

              Filesize

              1.3MB

              MD5

              70c0c80fdfc006be0ff502e0e6115b2b

              SHA1

              43f96be4652ecbd22677b18ffe2260b79bcca19c

              SHA256

              878e268428ec7aa51105c921740931c545d4ba6a274b367c52675c90741d23bf

              SHA512

              c463c5d91b3cae6b2c70ef6b7e3758bacecbe76088d813e2632bde7939c1fb28bad3cccf914a14861b8611a490ea74ef2d8d10e7336b203d12cee9904e8f9423

            • C:\Users\Admin\AppData\Local\Temp\nss17AB.tmp\7z-out\locales\mr.pak

              Filesize

              1.1MB

              MD5

              fcaca3a4264563461b42b16d8fde4b02

              SHA1

              af37d4e73588d4a6d3d52f2dba67414393c9b168

              SHA256

              362df1aa112a0a521617c0496087b3547a242eb79a5416b8414c5798f31e187d

              SHA512

              9114dc4e7da2affdcee5c86b1f1f78e47279c31d0f76c8deb1eac545e0268b9592463bbe1a4b433ff4fcab1ad4a596655b775608515bf7455fda550d3bf47b8a

            • C:\Users\Admin\AppData\Local\Temp\nss17AB.tmp\7z-out\locales\ms.pak

              Filesize

              498KB

              MD5

              578dcc1aef901d00a57f2698a6e15826

              SHA1

              4dca370c3b22f9f54a62d31166a84848336a8fea

              SHA256

              e5e77421c5fca5b1eaef96fbf33c345c63119015986163cb43d65075df6265d0

              SHA512

              073aecedf4132faef7e896e6840bb6297e866a06fd65a7490f0a61179013f27b6592a4fb2be91cb5e139c77f6db7695bf60e5788154e51c9ab7889f6e7040a33

            • C:\Users\Admin\AppData\Local\Temp\nss17AB.tmp\7z-out\locales\nb.pak

              Filesize

              483KB

              MD5

              c2c49ebaebc448cfeb7933ce2cbd6ca6

              SHA1

              c3efca0fee40a3daf7d69768d7659de60b3e2c4f

              SHA256

              67d997fff8a24eaa030eadede7f5345fff5e954e96bc8f36d399839bed998774

              SHA512

              c500bc1097ed9077742c5708bd55dc4215c45f751522131b8203d7ae802d278ffc3a9ef607325bbea5b650d594dde0d74e7fa4502e1a0f905534c32fa1521bba

            • C:\Users\Admin\AppData\Local\Temp\nss17AB.tmp\7z-out\locales\nl.pak

              Filesize

              499KB

              MD5

              9229e4ded3219c948747a4dc9a6a5e32

              SHA1

              9147b2f2ac3837588aa3b71eb4a255d29cab0e74

              SHA256

              d88b02d74e01b9350d3ac9c48fe08333ca9c68e3e3824d64fae86c5b8b531feb

              SHA512

              8a81cefd9fa718b18de87555cb2d5c8e87ed14921fd3a0247b47988a1f3896d63b16dbf86fbf103097c73181473c37393c0f4e9e0a07d95d847aebcad526e8e8

            • C:\Users\Admin\AppData\Local\Temp\nss17AB.tmp\7z-out\locales\pl.pak

              Filesize

              557KB

              MD5

              ab94060826404cc09d5fed31f63cec05

              SHA1

              20d1cea9d2e60b9bbd4fddb38a652856a3561008

              SHA256

              03258ecf731487231cc7eab8f6cb96e92b7ede4cc5b63c3def6ba08e0f16da10

              SHA512

              a9ec28912bdd2b8b1e1b3fc4d5c76139253ee4ada8f0d562ecd611d7366b0cdc97c379c5ae93c9db69eb045d8834cd0e1e0ba84813ac0071b5a2bf6cea81173e

            • C:\Users\Admin\AppData\Local\Temp\nss17AB.tmp\7z-out\locales\pt-BR.pak

              Filesize

              524KB

              MD5

              f18cae95b8bb6760d370b435235c5629

              SHA1

              eb62bc4249ea8e5688c67aa65bfa2b628fd5e1d8

              SHA256

              952234ef1d2792204f4e65cc814e9fc6dc007610668ceffb980c74fc0167ba0b

              SHA512

              218e9e4e59c875fe7931f16e6df877f67b8466a5e8a5565a1cab0f091b40b0652eefcf205536f5f4b8697966aa201092c26249142dcd8b40e055529e23ef7819

            • C:\Users\Admin\AppData\Local\Temp\nss17AB.tmp\7z-out\locales\pt-PT.pak

              Filesize

              527KB

              MD5

              4aa908b531adedb0ee795704ab72e248

              SHA1

              2ea9f4a7e561e70b06b675b3fe35ccb0f2a12fca

              SHA256

              72ca754dcb34c54b72087ab7fd5a4a3fa03e09cd1ced906d99d6525c7a19ee9c

              SHA512

              7d4a1add737136acfc7ed7848b0ee54646d5c8aa3a54addd7cf0340ebf42b58f6ce2eff56a2ba94125475e7b64989d06fedfc8b1ee41ece63b18b1f95686ad08

            • C:\Users\Admin\AppData\Local\Temp\nss17AB.tmp\7z-out\locales\ro.pak

              Filesize

              546KB

              MD5

              36f8327b36f2c6c003f864895968af2f

              SHA1

              248d88aa9fe46cbcd013ea7d7270f8483215c073

              SHA256

              6343589863bdd2ae81ec9c33e335048fd8792d2c2e8872f91f7a325a1f0d97ac

              SHA512

              bb03b5af3ddf676dadb35d5b94f40ae1c95cba2e7175c87d128c319e0055dd91f412883daace89fa33a17b9761f1cd7bccdf261b16ffadd6e10da594445c2c8d

            • C:\Users\Admin\AppData\Local\Temp\nss17AB.tmp\7z-out\locales\ru.pak

              Filesize

              897KB

              MD5

              a0072d84d1bcb2fa7bbe7ae4e06151ba

              SHA1

              b9227c6cd4ff9f6db6a8edf694c444beccd369f6

              SHA256

              8c169d6995d97feae8b8ec947be27697ca0ff731b593fff36163e4f31969a6fd

              SHA512

              fad335e81a24427f2b0a2853733da94c9839139a7982796bf742eacba306ecd9998914bcac49b925d5bb18953091a4dcc62ea6a628fff125c086099cfd33e3b5

            • C:\Users\Admin\AppData\Local\Temp\nss17AB.tmp\7z-out\locales\sk.pak

              Filesize

              563KB

              MD5

              e9bb6352cdd0f1c2fdd543a48ba076fe

              SHA1

              50053620d7be5566bb3ee588feda1a4daa207672

              SHA256

              441155d63257beaac9e2998afa1a9e65957286ed1cd9e0670072a63e24ff3f8b

              SHA512

              c1f87c7976159c8ff3e28185adcabf93d47ace0dc9b95fbaa4d1e5ed9ea8257263276880486a4c17a68a5869e6ec640eaf81f5ae6c4481e351e73e7b4dd9dd9e

            • C:\Users\Admin\AppData\Local\Temp\nss17AB.tmp\7z-out\locales\sl.pak

              Filesize

              541KB

              MD5

              299acf51d74b95ae4272730c437763aa

              SHA1

              8a0ff73f37d830b6677e514371a5825631aa455d

              SHA256

              26e29cd70c4143d7e9fb65e86e02c9173997f2fc062633a5edb2b7df55942157

              SHA512

              d7d298a4eb476a3cd4411261058f6f9409d0dddb3756cdc1e27e64280efc8b84fe40afbd92c754d56f58ea333623b0481766320b5969f5dd71f0c2a93be8ff77

            • C:\Users\Admin\AppData\Local\Temp\nss17AB.tmp\7z-out\locales\sr.pak

              Filesize

              833KB

              MD5

              02bdb4d99bd466eed5fed3445560d52d

              SHA1

              c24e1895145b3066840be0d349f5e866e46e2a39

              SHA256

              ac09005a83d4ac8f61855c7e301e48a753d2f3558a04cdb94f23b539e2086e54

              SHA512

              fac7bcefe31f41b6e37f215f271b33ab21dad281c1b0bdaf28769c99e31bccca625f213fcfd7c0047b3e2104a8f51b2ebc5fb374b32f58ae22c4130e315aee1e

            • C:\Users\Admin\AppData\Local\Temp\nss17AB.tmp\7z-out\locales\sv.pak

              Filesize

              486KB

              MD5

              eb39645ebed4f980ab12585feae2f4b5

              SHA1

              fc7c471b93f59bef13f7bb4669e683385a8b9dec

              SHA256

              ca34ee1c147358b5e32b5829acc0c355708925dc8df91c21d8e495c7485fa5c7

              SHA512

              5fb25d7dfca3483967a5262d2c62b5d37a192f5a7a19dcf6722a9a8753e299e567bf7f26171859c374c8d035bb521fb4eddc4821aebf9ceea1253c63e1595c60

            • C:\Users\Admin\AppData\Local\Temp\nss17AB.tmp\7z-out\locales\sw.pak

              Filesize

              512KB

              MD5

              e2958cf2ab6cc74551c8360e6cc34333

              SHA1

              806aa1129f228ee48744cfa55d061149b37522b0

              SHA256

              51482431411be2d89bfc026b9acf9ce1a0fb971376468a47829a15392b47178a

              SHA512

              1f5f306b7233279800d18fa461f4c94ecad809b2bb7c292fce16abcac2e963f7567a86e43a3c950fc86bc73b4fef8451389fc57ac6750fe7546afad8ae00f589

            • C:\Users\Admin\AppData\Local\Temp\nss17AB.tmp\7z-out\locales\ta.pak

              Filesize

              1.3MB

              MD5

              474a2016df48f886e91fb9fd331d9bf9

              SHA1

              2548525143292d7d150f5014b44ef294ba7c4189

              SHA256

              75638ac7fdb226c0840d5c2edf763bae35afa1f47e89199d9724ff46c003a2c2

              SHA512

              a4c2c2c046420c77948a0479cbd2be3aa11c1b347eb508d020231eece5cf0c2cba8d4f6a0e9f875dece4a16413157fd9e9f1cf09e1746335eb11e8f8590cd013

            • C:\Users\Admin\AppData\Local\Temp\nss17AB.tmp\7z-out\locales\te.pak

              Filesize

              1.2MB

              MD5

              1f20952c1a61fa6e42a7f055de8986ea

              SHA1

              301ec89ca80695865d884927c4c07c6777fb321e

              SHA256

              caeba6c853a0ee12a802fb9f610a95c676071414c1d8407d18b05f2fe8ce6bb7

              SHA512

              c43f5316dff21cd08f86e0d3d7c407449cdc751ff466683dff9a51e3a07bda203e8e22064bf240726e6e389b661d6dc2bf5ed5dc42750539990379e513228d53

            • C:\Users\Admin\AppData\Local\Temp\nss17AB.tmp\7z-out\locales\th.pak

              Filesize

              1.0MB

              MD5

              7512a162ea0b65dd9477ac8c190136b9

              SHA1

              ae5fbce9516882a0d58da9ebee3c767c7ba4c305

              SHA256

              d01ecd4edecf1809d5c2133366df2502a4621e88d894817e80b913f3a0926fa4

              SHA512

              425fd803cd3ed9589df5d04bb8ca4b62af0e573301d31c48a1a05bf3b707a0672e1a033965946223e5873a98eb3c9d52bcdcc1296a08cb4971d0b1b6d2e95eb7

            • C:\Users\Admin\AppData\Local\Temp\nss17AB.tmp\7z-out\locales\tr.pak

              Filesize

              523KB

              MD5

              4727af70df9094888ba46f3a62eff264

              SHA1

              d2ead301efab607d040c69c238a06d3b4d080717

              SHA256

              026fc65ed90fe356ce2b5e2b459a4487512d89e48f0ff8b044d6739ef51c1658

              SHA512

              5bb8dd6ad100581a7e0cb87b57e054ab23551c263144f7ffebf729b2280a1bd95e92eba9c64b80e2f77ce59c3c4315ba2b5253ac83dbb540828e7a59a70e74ac

            • C:\Users\Admin\AppData\Local\Temp\nss17AB.tmp\7z-out\locales\uk.pak

              Filesize

              896KB

              MD5

              7f8d31b43f7319164bc0f6453bbaf007

              SHA1

              4be254da0ccb13040489403cc2d8015f448292da

              SHA256

              e33b1a611feca93d105dee7c867521b5fbf27da38532ea3ca0aec61bec7f6108

              SHA512

              9569bd24aa5d2f9b0a13784f5f3d98e636f72177c7ff7a14c7d390f1d5f0b39ffab512276f70e4d2df0d37fba94a2c2322a840ba303a4cde33ccb20f7980395f

            • C:\Users\Admin\AppData\Local\Temp\nss17AB.tmp\7z-out\locales\ur.pak

              Filesize

              782KB

              MD5

              305d39b5de5a1935d786da4bfc736dc5

              SHA1

              8dd952fea4dae937b9f87d229638cd22ca197a8c

              SHA256

              b551a93a300ab78ee6da5087ea417584c4fd3941fbac99c84c9c58be2c88a7e8

              SHA512

              d75ef12a56c2dbde5c7a1967297270f7d717a366776f6b2a316784f033c71fcb9d25dabc857398e8459d8ac40aae1bae59e82f551e00e9b96bfbea00a54fcde5

            • C:\Users\Admin\AppData\Local\Temp\nss17AB.tmp\7z-out\locales\vi.pak

              Filesize

              619KB

              MD5

              593d33203c539d027c5b5bcc13bb38c9

              SHA1

              2f6288bc43ddf31e49a733af97e3e9e2fb8a2940

              SHA256

              d435c4c7154c24982185842a09cacd343cea77a5eb7fb859c4d38973cf240a42

              SHA512

              7c41c74f7220270da242562b93db8db053c0a7b08fdc1864d063706caccbc6926f288ae6bff1de43af656af67fcf2d8ad57f53d791bbc47a3b29a6a0856a68e5

            • C:\Users\Admin\AppData\Local\Temp\nss17AB.tmp\7z-out\locales\zh-CN.pak

              Filesize

              447KB

              MD5

              156894db535f0fbe193d66c0afb4b112

              SHA1

              e347caa3c41ea7461c217c029dbca54567fbe27c

              SHA256

              cc5a411d3bf0ddfba9e5041dfeeaed70265ba949f7b7ccba0170b88e3e14ceb0

              SHA512

              e81a0968598536e91c17a1998682cb5fff42bd3199c41b64e2d76827c96b187e8f86182843c061735dad2b7cd5e32750e473c1a5f9c82bcc0dcc30f1bdb8b806

            • C:\Users\Admin\AppData\Local\Temp\nss17AB.tmp\7z-out\locales\zh-TW.pak

              Filesize

              442KB

              MD5

              337bba163068f2dd7ff107ea929c8473

              SHA1

              536ec5756f229696dd6f875180778afcee1966fb

              SHA256

              58753d4313ed7f548df16a9cd9aa1f0e30cebee675a76b8359ed23fc95825574

              SHA512

              000b98249d7b0e4c7e463bafdf827e3dc5afac447750320d6344c984f4ad41cab5795861920525f03dcaeea5aa3615684101b08bbc103d3ba01065676c8bd64f

            • C:\Users\Admin\AppData\Local\Temp\nss17AB.tmp\7z-out\resources.pak

              Filesize

              5.0MB

              MD5

              67bb5e75ceb8ced4c98cf0454933cb45

              SHA1

              c2b1c8c8d753318bc5ec18762c27512a5eb9f9cd

              SHA256

              5d63acd4034f7771ca346d138d7478014abf1f3f4386d07fc025dbc2c2bc0bff

              SHA512

              fd213d59ebc625f6f8b20cc8fde1a22132ce827b81deaddb9ca7993fe0d9616de17e089def338d23c4b6bbd7d3a931ee73aa329325eaa17f8145a58fe11d8c38

            • C:\Users\Admin\AppData\Local\Temp\nss17AB.tmp\7z-out\resources\app-update.yml

              Filesize

              106B

              MD5

              b0e31c54422860c9390a2e456d8f4624

              SHA1

              1b73cc7e00cbcae94a3ed921fbd055a393dedc0c

              SHA256

              897dac554968a2c49044a5e601cfcaf7c24d41599a58c03e91c62bd664b60ecf

              SHA512

              561cff0a281e073b0b2e3bc139a18b44ee1e2ab147d99ff007d5deae48c0c4c847bee4e14ad2e36abb27f7d9240f95aee7fcc9987246c717ba48666f550cc121

            • C:\Users\Admin\AppData\Local\Temp\nss17AB.tmp\7z-out\resources\app.asar

              Filesize

              36.6MB

              MD5

              04261cff6d42b7dac2b2429df634387e

              SHA1

              bd26ae0ef0c42a898f7a04a5bd8bcc7291ee11c7

              SHA256

              e0abebd549f6705666f056ac69cfa9989ffc9ea19eb86a562ac99ccacd8bee45

              SHA512

              0163f376c24cad9e2f189a60eec22f34ebc2526109fc9574a0c0986177e01179218507cf55e60c39a64d1b410f6e2cd2432b9523f6ac3aff7696106e6f482f13

            • C:\Users\Admin\AppData\Local\Temp\nss17AB.tmp\7z-out\resources\elevate.exe

              Filesize

              105KB

              MD5

              792b92c8ad13c46f27c7ced0810694df

              SHA1

              d8d449b92de20a57df722df46435ba4553ecc802

              SHA256

              9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37

              SHA512

              6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40

            • C:\Users\Admin\AppData\Local\Temp\nss17AB.tmp\7z-out\snapshot_blob.bin

              Filesize

              298KB

              MD5

              cadef56f5fb216b1fbf7ada1f894ea6d

              SHA1

              373d2a4266be5c8fbf61d4363ec47ddeb2d79253

              SHA256

              0976145cc8c02f3e64ddbf51dc983bdbb456be7fcf3ce54608e218981671ac12

              SHA512

              9c90e8943f9ef6d644fe0fbe55ab25ed371739d17da8cf973893a2e41ebfa0a92bcf1761e72da032f9f3d1c6f1080c62f856aa07a3cbb609c9e8c186f92216b6

            • C:\Users\Admin\AppData\Local\Temp\nss17AB.tmp\7z-out\v8_context_snapshot.bin

              Filesize

              663KB

              MD5

              81870fb2f641c8b845e9c6d1a632f0b7

              SHA1

              fcd47d8d1232c189a1c4087bb03a015ce14c25ba

              SHA256

              875515af4e7254458c17a98bed087fc609d45fbc8ebf60663e112c37204f6840

              SHA512

              7748c8fb6f356aa45023a56245c43c5171d0413617fb1ac6c75650be75bbe94bd5528e9aa83cd9df9a08af65540a76ab59bc866e5dcf0fa7284122f290bd45d3

            • C:\Users\Admin\AppData\Local\Temp\nss17AB.tmp\7z-out\vk_swiftshader.dll

              Filesize

              5.1MB

              MD5

              0a071201e4dd76996e273c81533bfa74

              SHA1

              5c92c634027692c344a8e74eab8b4d5c3e049497

              SHA256

              08e34bc25653f9357a4ccf62966d698b7cc6265dc668046a28403ae5786132ee

              SHA512

              b5de6548c5c743b6f119183fa06aaf67dcd4cdbc3542378ff87916b670ace1e2f4270f6dcaa4caabd01460c638bd02b565267e7bd9617ca92d72187d374bb7d6

            • C:\Users\Admin\AppData\Local\Temp\nss17AB.tmp\7z-out\vk_swiftshader_icd.json

              Filesize

              106B

              MD5

              8642dd3a87e2de6e991fae08458e302b

              SHA1

              9c06735c31cec00600fd763a92f8112d085bd12a

              SHA256

              32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9

              SHA512

              f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f

            • C:\Users\Admin\AppData\Local\Temp\nss17AB.tmp\7z-out\vulkan-1.dll

              Filesize

              932KB

              MD5

              a6588e66186ccf486eede8e9223f0d41

              SHA1

              777a5c4028c7675ee1fc4e265a825b35d5099577

              SHA256

              419488597ea255ec61f028aeecd36572d072dfe49b7ab716cd2c0a8e186f24e6

              SHA512

              ba8b9577f47ac5b9503aab8d4cca6059c7208bf0eb37999f4fbef0c2cf03032a9359559a0221f332c6cd66c38366fb0e1f1d32173f282afd639fabea8fc9400e

            • C:\Users\Admin\AppData\Local\Temp\nss17AB.tmp\StdUtils.dll

              Filesize

              100KB

              MD5

              c6a6e03f77c313b267498515488c5740

              SHA1

              3d49fc2784b9450962ed6b82b46e9c3c957d7c15

              SHA256

              b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e

              SHA512

              9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

            • C:\Users\Admin\AppData\Local\Temp\nss17AB.tmp\System.dll

              Filesize

              12KB

              MD5

              0d7ad4f45dc6f5aa87f606d0331c6901

              SHA1

              48df0911f0484cbe2a8cdd5362140b63c41ee457

              SHA256

              3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

              SHA512

              c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

            • C:\Users\Admin\AppData\Local\Temp\nss17AB.tmp\UAC.dll

              Filesize

              14KB

              MD5

              adb29e6b186daa765dc750128649b63d

              SHA1

              160cbdc4cb0ac2c142d361df138c537aa7e708c9

              SHA256

              2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08

              SHA512

              b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada

            • C:\Users\Admin\AppData\Local\Temp\nss17AB.tmp\WinShell.dll

              Filesize

              3KB

              MD5

              1cc7c37b7e0c8cd8bf04b6cc283e1e56

              SHA1

              0b9519763be6625bd5abce175dcc59c96d100d4c

              SHA256

              9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6

              SHA512

              7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

            • C:\Users\Admin\AppData\Local\Temp\nss17AB.tmp\nsExec.dll

              Filesize

              6KB

              MD5

              ec0504e6b8a11d5aad43b296beeb84b2

              SHA1

              91b5ce085130c8c7194d66b2439ec9e1c206497c

              SHA256

              5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962

              SHA512

              3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57

            • C:\Users\Admin\AppData\Local\Temp\nss17AB.tmp\nsis7z.dll

              Filesize

              424KB

              MD5

              80e44ce4895304c6a3a831310fbf8cd0

              SHA1

              36bd49ae21c460be5753a904b4501f1abca53508

              SHA256

              b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592

              SHA512

              c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df

            • C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

              Filesize

              2B

              MD5

              f3b25701fe362ec84616a93a45ce9998

              SHA1

              d62636d8caec13f04e28442a0a6fa1afeb024bbb

              SHA256

              b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

              SHA512

              98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

            • C:\Users\Admin\AppData\Roaming\Ultimate Tweaks\Cache\Cache_Data\data_0

              Filesize

              44KB

              MD5

              d5a821f2f5349380bb0fc73ac061e0f3

              SHA1

              f8349f892ae56b0a81140d83e01b8067e356bda0

              SHA256

              fe77f843faf8e9451588301c34f34425808e33ce5d5976f4f96302b6f75ddf8e

              SHA512

              57cfdd414eb26af38c51fa198a73d54e68de8e5230118636b6246b7fbbaa7eb39c06d7eea5dfdd65e55e32ef6ce11188d8a47e0b8bfbfc54ec2ae2e8ebcc6480

            • C:\Users\Admin\AppData\Roaming\Ultimate Tweaks\Cache\Cache_Data\data_1

              Filesize

              264KB

              MD5

              9d8e0bcddbf6a2b33d269b1f6b6a93c6

              SHA1

              b1e21dd37abf80c756121e84aedf0405b4e571ad

              SHA256

              80010332236e74981230a1bab8696e86ff1ba3c2c825fc8c301fe9ff4e3f4ccc

              SHA512

              8f895132621989a18d78eec44c28a962a644acb1faf12010d61b756ae19c3522737d63178d0bd168247f1b8666c33431a7d49e6ea0f9193f140179884b214f42

            • C:\Users\Admin\AppData\Roaming\Ultimate Tweaks\Cache\Cache_Data\data_2

              Filesize

              1.0MB

              MD5

              202802ed2753064e9c1caab85b215133

              SHA1

              f6f552948466a911694a05ebfa140ae36b303fda

              SHA256

              1a8ba076a94ac073259886c826c257a577b43a1cfe3a237f134eca84b15c531a

              SHA512

              0f7107280f08c06104f09fc543670999da9a50e8db7b181ebf9aeecc77d1009089e824f16cd3dfea159af307f69fb65439615021263c0c048f31eb54ad51abcb

            • C:\Users\Admin\AppData\Roaming\Ultimate Tweaks\Cache\Cache_Data\data_3

              Filesize

              4.0MB

              MD5

              c179ba64e9f1973f03988b80db2fe5c4

              SHA1

              13fdf801030a37b2a2fbd649406349642f3c1889

              SHA256

              195e40c3cb2469b762cde14d69c686ffd9a737acd87f0dc241bfd18ea43c3faa

              SHA512

              2fd8ed69caf6d85254023ed27a2c7ea06933329b5874481bfdda5ea0e2c8c9e118043ce6cfc0c543ae8e0dd01acc0d655ccef9a08cacd3a4d27bbd1bd9a7168a

            • C:\Users\Admin\AppData\Roaming\Ultimate Tweaks\Cache\Cache_Data\f_000001

              Filesize

              32KB

              MD5

              057478083c1d55ea0c2182b24f6dd72f

              SHA1

              caf557cd276a76992084efc4c8857b66791a6b7f

              SHA256

              bb2f90081933c0f2475883ca2c5cfee94e96d7314a09433fffc42e37f4cffd3b

              SHA512

              98ff4416db333e5a5a8f8f299c393dd1a50f574a2c1c601a0724a8ea7fb652f6ec0ba2267390327185ebea55f5c5049ab486d88b4c5fc1585a6a975238507a15

            • C:\Users\Admin\AppData\Roaming\Ultimate Tweaks\Cache\Cache_Data\index

              Filesize

              256KB

              MD5

              f64c91c2afa2df918bfe7715e2c174bd

              SHA1

              00dc5349161b6ca9fa715ab2466f99f162dba6ad

              SHA256

              8e02da3a9e2a7f16288324eaf76c28fddf1ef19f84f4eabd335db104ae487599

              SHA512

              58df41cc1f4f5b52343357d0578c0cfa1f3174124d09f3561e4590457ab7fe5ff4cac9f1800308ff2df82c797215587d608a2ebc9224b8867b18d10ca48d7766

            • C:\Users\Admin\AppData\Roaming\Ultimate Tweaks\Code Cache\js\index-dir\the-real-index

              Filesize

              48B

              MD5

              1883dde8d915b6bb87fb33a69c1a1321

              SHA1

              804f535f19e12e8832a421e6eda29bfa1cb6219c

              SHA256

              aaeb87a3c96a4211864481240092886c5afd9c1a27680007580bc9a194ee2fdf

              SHA512

              cbbd2581e1b7749f7cc6723aedff17f37df1a7f888f19181404ac526c757ef0f022e8e7cb7916a996bbfe9a07eff0d0a7a6b7639896bffb73f9d0b55cef2b40d

            • C:\Users\Admin\AppData\Roaming\Ultimate Tweaks\Code Cache\js\index-dir\the-real-index

              Filesize

              72B

              MD5

              67992b28c2b12f1144477d45cc31dc49

              SHA1

              e6f8e499c6ffdd0d31823deced7d81680781bfc1

              SHA256

              6a1f08e9b355d790be8cc105f9283b856a25d265130678e919888282499fcacf

              SHA512

              11ac239b83639735b2cf8f86caa6eed36179de979bb2e3a35b251bcbe532956a19b3f8f37e938421ed6077fbb683304f342228805e89b840505ba1083225f472

            • C:\Users\Admin\AppData\Roaming\Ultimate Tweaks\Code Cache\wasm\index

              Filesize

              24B

              MD5

              54cb446f628b2ea4a5bce5769910512e

              SHA1

              c27ca848427fe87f5cf4d0e0e3cd57151b0d820d

              SHA256

              fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d

              SHA512

              8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

            • C:\Users\Admin\AppData\Roaming\Ultimate Tweaks\Code Cache\wasm\index-dir\the-real-index

              Filesize

              48B

              MD5

              bf48ccd7cb223f5ade48fac307048ad1

              SHA1

              2d15f6bf39a80730c1c4fdcd9d8772a98b3c1565

              SHA256

              26934e0b42a90df63e95a7a55b60f26aa0014d8225828be335e9110ff008b9e8

              SHA512

              0b33f55e945a7cc0e81196cd9e70bb0c76f78ab962e40368fa8933ff52e73739cbaaae21da597b589fdb864fb3f0ff8e34d2bb619a9b9633bbb1675632065e04

            • C:\Users\Admin\AppData\Roaming\Ultimate Tweaks\DawnCache\data_0

              Filesize

              8KB

              MD5

              cf89d16bb9107c631daabf0c0ee58efb

              SHA1

              3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

              SHA256

              d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

              SHA512

              8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

            • C:\Users\Admin\AppData\Roaming\Ultimate Tweaks\DawnCache\data_1

              Filesize

              264KB

              MD5

              f50f89a0a91564d0b8a211f8921aa7de

              SHA1

              112403a17dd69d5b9018b8cede023cb3b54eab7d

              SHA256

              b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

              SHA512

              bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

            • C:\Users\Admin\AppData\Roaming\Ultimate Tweaks\DawnCache\data_2

              Filesize

              8KB

              MD5

              0962291d6d367570bee5454721c17e11

              SHA1

              59d10a893ef321a706a9255176761366115bedcb

              SHA256

              ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

              SHA512

              f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

            • C:\Users\Admin\AppData\Roaming\Ultimate Tweaks\DawnCache\data_3

              Filesize

              8KB

              MD5

              41876349cb12d6db992f1309f22df3f0

              SHA1

              5cf26b3420fc0302cd0a71e8d029739b8765be27

              SHA256

              e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

              SHA512

              e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

            • C:\Users\Admin\AppData\Roaming\Ultimate Tweaks\GPUCache\data_0

              Filesize

              44KB

              MD5

              aeb78b4de60873e6ea673bbf5d764811

              SHA1

              b692b83f7db3503678664ff149c874904f02ceba

              SHA256

              51b12cc5f7910b6cb8187eee50ca47fb45e8fc0b2b63984881d812e9eb354c4a

              SHA512

              190c9fff9262131fbcff03fc5a3493d87e1cdae1e72d94af77f0f93ffa838f6fe7400ae06aaed3161378569793e1d790d77b3237678a531ef40d543282058f43

            • C:\Users\Admin\AppData\Roaming\Ultimate Tweaks\GPUCache\data_1

              Filesize

              264KB

              MD5

              c021b478490b414e2008eb76ab1363a5

              SHA1

              4b058469cfc458818115cedd4bf58bde5631eebb

              SHA256

              a12054826a84aeac29ba1cd546ce338adf88e824bc06c585b98de70c8f3291ad

              SHA512

              1f898682183caa1d20b6a74d39d02008310a2f6cf8d0baf9878deb1a7aed41728c9f5dff24c135d6eba1b91f31bf6b06377b0cb2aab898985ad4b135448fa9cd

            • C:\Users\Admin\AppData\Roaming\Ultimate Tweaks\GPUCache\data_2

              Filesize

              1.0MB

              MD5

              01189f3b77ad66d99e15254081b27294

              SHA1

              b6add8d48408408b0ee2d3bf61c7bb4aedcfb745

              SHA256

              8e0df422f53c06091336443a389e834bdc85a2122bd997315a14484ffb04cb4b

              SHA512

              1580f2d774f3fc8b1a5e0d2918ca0fc5a84eb22529f10e0d21bfbdc6634cb90467b909f7870a67ecb8d5d06a3784659e3a51e66da959250f5df3f39bbece8502

            • C:\Users\Admin\AppData\Roaming\Ultimate Tweaks\GPUCache\index

              Filesize

              256KB

              MD5

              0cb8f57adb10c73ef6de9f40eaf577be

              SHA1

              8365c024ac3141153780c3ad392f46801070bd74

              SHA256

              7b1d9e5155d2000c3450d5ed11c0aae4ccd3e02711ad44e5e91f69e7e42e8c13

              SHA512

              1ecde85a54b6ab01576352a18a1857f62b0f40b23310b7e34dd9a69e2d1464b7392529d1c30a71567473d5a56cdbec3f6ccb577df29d71c12e0e5936728da949

            • C:\Users\Admin\AppData\Roaming\Ultimate Tweaks\Local State

              Filesize

              434B

              MD5

              3061630b1f008c3e64b43bb1550973e0

              SHA1

              c0e8498fe9c5eaadd49944bb2e1a7dcb02e42bfc

              SHA256

              db75c0b6549d90cd410592216f0eb251325495c1281d14a0fc9323df1c847a71

              SHA512

              06f516bbc8cee676d98b44912a46cc39e9dc6e377b88fec0fdc63a107d84083431db10353e6fbb7a63a9452558703645e7c0572128401386567781db65d9e69a

            • C:\Users\Admin\AppData\Roaming\Ultimate Tweaks\Local Storage\leveldb\LOG

              Filesize

              261B

              MD5

              33d12bbb3c267b69438c78fb260cf881

              SHA1

              2ae29469341df9a284077e5189bd812a45c493b2

              SHA256

              5c9d3c250fccff0ce456917c99df7ae03fabd96c0afd22009e04a2faf2365bc5

              SHA512

              b45e6f9406a9deb45efb1f358fdc63871341ae4c709b0c2aa6430ac1a2ab0c6bc2bce11c3820eeb785960ecae4174060d8622a9dbb256aa2dc63e283e50c68d2

            • C:\Users\Admin\AppData\Roaming\Ultimate Tweaks\Network\Cookies

              Filesize

              20KB

              MD5

              a603e09d617fea7517059b4924b1df93

              SHA1

              31d66e1496e0229c6a312f8be05da3f813b3fa9e

              SHA256

              ccd15f9c7a997ae2b5320ea856c7efc54b5055254d41a443d21a60c39c565cb7

              SHA512

              eadb844a84f8a660c578a2f8e65ebcb9e0b9ab67422be957f35492ff870825a4b363f96fd1c546eaacfd518f6812fcf57268ef03c149e5b1a7af145c7100e2cc

            • C:\Users\Admin\AppData\Roaming\Ultimate Tweaks\Network\Network Persistent State

              Filesize

              1KB

              MD5

              4b147d6245f9227cbaf8dd7e57d1cc03

              SHA1

              244d1921629a9a3cfbdfb837565e3400c31721a1

              SHA256

              4bc4c7d7c2d55c28e2f6b12b881b348055ac29e99a6950886c6b6fb93481b6d0

              SHA512

              61f5dfeb1a34a43dad49bbb539139638a5482e917d68f1c61a41ce775066bffeaed7c1737fea279d2d0bc2f9ff2c17597e8d56aec372df7a08c5854500cd8e20

            • C:\Users\Admin\AppData\Roaming\Ultimate Tweaks\Network\Network Persistent State

              Filesize

              977B

              MD5

              1701df7da211286fb93dbcb8e12d96e5

              SHA1

              8a4923b94d2125b27fcd180b8a4e1c9b30f20a58

              SHA256

              16af738627625f389d547b8983284e971ad7071bd5bea13ab95bbac85d52ff39

              SHA512

              79336606dbc4b564df64a5d3d63850ecb94c6ce8243d431623714b44c7b3ca4aea5046d99d738685db29c56943f8e3e217f9bc413238775d66c42da156a2c207

            • C:\Users\Admin\AppData\Roaming\Ultimate Tweaks\Network\Network Persistent State~RFe5815e4.TMP

              Filesize

              59B

              MD5

              2800881c775077e1c4b6e06bf4676de4

              SHA1

              2873631068c8b3b9495638c865915be822442c8b

              SHA256

              226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

              SHA512

              e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

            • C:\Users\Admin\AppData\Roaming\Ultimate Tweaks\Network\TransportSecurity

              Filesize

              524B

              MD5

              55e32d6ecaa63afa59a0eccb4285b8a2

              SHA1

              225b31a47aacd22a863eddd29c82a37d74a84f98

              SHA256

              fedfcf090f5974c01be01861ebc91a30473b812c0b43e2d78ae7e25e504260fe

              SHA512

              a7158e2d2aba438b9108002a9da04b339254f7b7b9bd24c07758724d9a99da3a15804f35dc6ef47b93b1b5be1cd89ec39e0444e5c881b8d120ac487f1628c2f6

            • C:\Users\Admin\AppData\Roaming\Ultimate Tweaks\Network\TransportSecurity

              Filesize

              524B

              MD5

              fd1448502bebc3524e1328a838042bad

              SHA1

              911ca65134cabd1cdcbba2f6dca0a5e251ff7d9d

              SHA256

              23f8e5bdcbccc1e0034c525e8091779ce67fd0641be44310bfcbf199a7cad820

              SHA512

              0d286daab62874c9c16f41d1a32b166421bd86bb0a8eb7e75b5d5e6e222fcadc78462771479103ee012b86be86710857bfb9765ae4ee18b49ea3745eb4ae8948

            • C:\Users\Admin\AppData\Roaming\Ultimate Tweaks\Network\Trust Tokens

              Filesize

              36KB

              MD5

              7289d4bdfbd73ed571278f95cb4c1939

              SHA1

              7c911f54243d9777a34666f4526a49c7e7aea244

              SHA256

              2d4ccf8ac8ae4f5c6ec8e0566210ff56585b6ba0290501a1a11ed9b23bfc226e

              SHA512

              6e7d48e18b0317449807c4ac2c377b3cccf5bd6121077d51152d7e188ba1ea3cf62372b7611036938986dd0c84465dbd747fe8580e3a699f8470229a6d57a749

            • C:\Users\Admin\AppData\Roaming\Ultimate Tweaks\Network\Trust Tokens-journal

              MD5

              d41d8cd98f00b204e9800998ecf8427e

              SHA1

              da39a3ee5e6b4b0d3255bfef95601890afd80709

              SHA256

              e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

              SHA512

              cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

            • C:\Users\Admin\AppData\Roaming\Ultimate Tweaks\Preferences

              Filesize

              57B

              MD5

              58127c59cb9e1da127904c341d15372b

              SHA1

              62445484661d8036ce9788baeaba31d204e9a5fc

              SHA256

              be4b8924ab38e8acf350e6e3b9f1f63a1a94952d8002759acd6946c4d5d0b5de

              SHA512

              8d1815b277a93ad590ff79b6f52c576cf920c38c4353c24193f707d66884c942f39ff3989530055d2fade540ade243b41b6eb03cd0cc361c3b5d514cca28b50a

            • C:\Users\Admin\AppData\Roaming\Ultimate Tweaks\Preferences~RFe57dbc9.TMP

              Filesize

              86B

              MD5

              d11dedf80b85d8d9be3fec6bb292f64b

              SHA1

              aab8783454819cd66ddf7871e887abdba138aef3

              SHA256

              8029940de92ae596278912bbbd6387d65f4e849d3c136287a1233f525d189c67

              SHA512

              6b7ec1ca5189124e0d136f561ca7f12a4653633e2d9452d290e658dfe545acf6600cc9496794757a43f95c91705e9549ef681d4cc9e035738b03a18bdc2e25f0

            • C:\Users\Admin\AppData\Roaming\Ultimate Tweaks\Session Storage\CURRENT

              Filesize

              16B

              MD5

              46295cac801e5d4857d09837238a6394

              SHA1

              44e0fa1b517dbf802b18faf0785eeea6ac51594b

              SHA256

              0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

              SHA512

              8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

            • C:\Users\Admin\AppData\Roaming\Ultimate Tweaks\Session Storage\MANIFEST-000001

              Filesize

              41B

              MD5

              5af87dfd673ba2115e2fcf5cfdb727ab

              SHA1

              d5b5bbf396dc291274584ef71f444f420b6056f1

              SHA256

              f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

              SHA512

              de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

            • C:\Users\Admin\AppData\Roaming\Ultimate Tweaks\Shared Dictionary\cache\index-dir\the-real-index

              Filesize

              48B

              MD5

              b71838b90d85e3a9bac8e86ed7918b11

              SHA1

              470c225974e3b3360760ff18cd688cbc3ddd0738

              SHA256

              513f7347ab8cd36a3f556d1211662ad853254df8871e272293acd9ae0a20e3f9

              SHA512

              0e83ce377b317ad92ca9bc61f268efa9b6ec90c5365b7dacf6e112bc4dcefdd72ff434df7f33972a5d0edeb4516ec1e6824b6872b65c14cfc265cf30ba88307b

            • C:\Users\Admin\AppData\Roaming\Ultimate Tweaks\Shared Dictionary\db

              Filesize

              44KB

              MD5

              71ccdda9f3186c8e729bb559f93bb992

              SHA1

              3712c11bb21b8e2a74bb879d47b2819ed1ac14a8

              SHA256

              79b107307408e5ad9a145c87533316174fd13f4ad943497d079522fbe325b3b1

              SHA512

              19f8134fcd1211964111b07884b52878b1649644b6ec623bb586df1a9b7dabc7f8c8a755d2a52c908b563bdd968135f4f703cc35103696e40d0ab0020c8dc4bd

            • C:\Users\Admin\AppData\Roaming\Ultimate Tweaks\logs\main.log

              Filesize

              4KB

              MD5

              3d70e07bd73f53f605baf2425b84af34

              SHA1

              5766f63c14f8d278a47897bd76c8db064a9447d0

              SHA256

              0ad6c3b6c433cca22737dd682567809224c7c68267da7da5edb2c8ecaae31079

              SHA512

              e280ebbd65299e537fc6bf30216d7f468560fc4db95ceeb807dfc11a5d781b8e6fc514f84a63f081c2454e9b5caead95de1f99b58dbf5f0e61e42fdfd9b3b1ed

            • memory/864-89-0x0000023E2ECB0000-0x0000023E2ECF4000-memory.dmp

              Filesize

              272KB

            • memory/864-77-0x0000023E2E8A0000-0x0000023E2E8C2000-memory.dmp

              Filesize

              136KB

            • memory/1156-1274-0x000002C9EA010000-0x000002C9EA040000-memory.dmp

              Filesize

              192KB

            • memory/1948-1200-0x00007FFF2D850000-0x00007FFF2D851000-memory.dmp

              Filesize

              4KB

            • memory/1948-1268-0x0000020FE4CB0000-0x0000020FE4D5C000-memory.dmp

              Filesize

              688KB

            • memory/1948-1201-0x00007FFF2E150000-0x00007FFF2E151000-memory.dmp

              Filesize

              4KB

            • memory/2960-98-0x000001F362110000-0x000001F362134000-memory.dmp

              Filesize

              144KB

            • memory/2960-97-0x000001F362110000-0x000001F36213A000-memory.dmp

              Filesize

              168KB

            • memory/2960-90-0x000001F362190000-0x000001F362206000-memory.dmp

              Filesize

              472KB