remcos | bc71f58b2438a89e2cd189b8896a97b2436f091ab240861b84435afcdc3db746

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
27-01-2025 10:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

calc.exe
Size

87.1MB
MD5

c50aeb0698e41af933510280fc1aa01c
SHA1

e313ae95cc7857e13c781a842c783013ab8b9df4
SHA256

bc71f58b2438a89e2cd189b8896a97b2436f091ab240861b84435afcdc3db746
SHA512

a67dcde6d29ec5a23dca60de03604158343e2c8190b2f0fe4d7e9e92ec0ce4c2af7c232d90c7ef594d969bf35280440554adbe37cfb00d1d117bb5c285cb43a5
SSDEEP

1572864:R/2/nTbAdNcILd/GsOSLkxMjCMfEbZP+GoOoJOzRLdaB+sAJ+7VVg0:RqsDCMfENhfoUzRsB+sAJ+7p

Score

10^/10

remcos remotehost defense_evasion discovery execution rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

185.42.12.75:2405

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
NSIS
keylog_path
%AppData%
mouse_option
false
mutex
NSIS-NAFC0M
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 4868 created 2628	4868	explorer.exe	44

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2812	powershell.exe
3472	powershell.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	GlobalPackageHandler.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	GlobalPackageHandler.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	GlobalPackageHandler.exe

Executes dropped EXE 13 IoCs

pid	Process
2208	GlobalPackageHandler.exe
4988	GlobalPackageHandler.exe
896	GlobalPackageHandler.exe
4732	GlobalPackageHandler.exe
2460	GlobalPackageHandler.exe
2624	GlobalPackageHandler.exe
2524	GlobalPackageHandler.exe
4648	GlobalPackageHandler.exe
1096	WebCopier.exe
2260	WebCopier.exe
2392	WebCopier.exe
4236	WebCopier.exe
4888	GlobalPackageHandler.exe

Loads dropped DLL 22 IoCs

pid	Process
4708	calc.exe
4708	calc.exe
4708	calc.exe
4708	calc.exe
4708	calc.exe
2208	GlobalPackageHandler.exe
4988	GlobalPackageHandler.exe
4732	GlobalPackageHandler.exe
896	GlobalPackageHandler.exe
4988	GlobalPackageHandler.exe
4988	GlobalPackageHandler.exe
4988	GlobalPackageHandler.exe
4988	GlobalPackageHandler.exe
2460	GlobalPackageHandler.exe
2624	GlobalPackageHandler.exe
1096	WebCopier.exe
2260	WebCopier.exe
2392	WebCopier.exe
4236	WebCopier.exe
4140	dib_Fm_v5.exe
4888	GlobalPackageHandler.exe
4888	GlobalPackageHandler.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Hide Artifacts: Hidden Window 1 TTPs 1 IoCs

Windows that would typically be displayed when an application carries out an operation can be hidden.

defense_evasion

Hidden Window

T1564.003

pid	Process
3628	cmd.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
2496	tasklist.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4236 set thread context of 4808	4236	WebCopier.exe	131
PID 2392 set thread context of 1720	2392	WebCopier.exe	133

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WebCopier.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WebCopier.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WebCopier.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dib_Fm_v5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WebCopier.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	powershell.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
4708	calc.exe
4708	calc.exe
2496	tasklist.exe
2496	tasklist.exe
3472	powershell.exe
3472	powershell.exe
3472	powershell.exe
2812	powershell.exe
2812	powershell.exe
2812	powershell.exe
1096	WebCopier.exe
2260	WebCopier.exe
2392	WebCopier.exe
4236	WebCopier.exe
4236	WebCopier.exe
4236	WebCopier.exe
2392	WebCopier.exe
2392	WebCopier.exe
4808	cmd.exe
4808	cmd.exe
4808	cmd.exe
4808	cmd.exe
1720	cmd.exe
1720	cmd.exe
1720	cmd.exe
1720	cmd.exe
4868	explorer.exe
4868	explorer.exe
4868	explorer.exe
4868	explorer.exe
2924	svchost.exe
2924	svchost.exe
4888	GlobalPackageHandler.exe
4888	GlobalPackageHandler.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4140	dib_Fm_v5.exe

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
4236	WebCopier.exe
2392	WebCopier.exe
1720	cmd.exe
4808	cmd.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2496	tasklist.exe
Token: SeSecurityPrivilege	4708	calc.exe
Token: SeShutdownPrivilege	2208	GlobalPackageHandler.exe
Token: SeCreatePagefilePrivilege	2208	GlobalPackageHandler.exe
Token: SeShutdownPrivilege	2208	GlobalPackageHandler.exe
Token: SeCreatePagefilePrivilege	2208	GlobalPackageHandler.exe
Token: SeShutdownPrivilege	2208	GlobalPackageHandler.exe
Token: SeCreatePagefilePrivilege	2208	GlobalPackageHandler.exe
Token: SeShutdownPrivilege	2208	GlobalPackageHandler.exe
Token: SeCreatePagefilePrivilege	2208	GlobalPackageHandler.exe
Token: SeShutdownPrivilege	2208	GlobalPackageHandler.exe
Token: SeCreatePagefilePrivilege	2208	GlobalPackageHandler.exe
Token: SeShutdownPrivilege	2208	GlobalPackageHandler.exe
Token: SeCreatePagefilePrivilege	2208	GlobalPackageHandler.exe
Token: SeShutdownPrivilege	2208	GlobalPackageHandler.exe
Token: SeCreatePagefilePrivilege	2208	GlobalPackageHandler.exe
Token: SeDebugPrivilege	3472	powershell.exe
Token: SeShutdownPrivilege	2208	GlobalPackageHandler.exe
Token: SeCreatePagefilePrivilege	2208	GlobalPackageHandler.exe
Token: SeDebugPrivilege	2812	powershell.exe
Token: SeShutdownPrivilege	2208	GlobalPackageHandler.exe
Token: SeCreatePagefilePrivilege	2208	GlobalPackageHandler.exe
Token: SeShutdownPrivilege	2208	GlobalPackageHandler.exe
Token: SeCreatePagefilePrivilege	2208	GlobalPackageHandler.exe
Token: SeShutdownPrivilege	2208	GlobalPackageHandler.exe
Token: SeCreatePagefilePrivilege	2208	GlobalPackageHandler.exe
Token: SeShutdownPrivilege	2208	GlobalPackageHandler.exe
Token: SeCreatePagefilePrivilege	2208	GlobalPackageHandler.exe
Token: SeShutdownPrivilege	2208	GlobalPackageHandler.exe
Token: SeCreatePagefilePrivilege	2208	GlobalPackageHandler.exe
Token: SeShutdownPrivilege	2208	GlobalPackageHandler.exe
Token: SeCreatePagefilePrivilege	2208	GlobalPackageHandler.exe
Token: SeShutdownPrivilege	2208	GlobalPackageHandler.exe
Token: SeCreatePagefilePrivilege	2208	GlobalPackageHandler.exe
Token: SeShutdownPrivilege	2208	GlobalPackageHandler.exe
Token: SeCreatePagefilePrivilege	2208	GlobalPackageHandler.exe
Token: SeShutdownPrivilege	2208	GlobalPackageHandler.exe
Token: SeCreatePagefilePrivilege	2208	GlobalPackageHandler.exe
Token: SeShutdownPrivilege	2208	GlobalPackageHandler.exe
Token: SeCreatePagefilePrivilege	2208	GlobalPackageHandler.exe
Token: SeShutdownPrivilege	2208	GlobalPackageHandler.exe
Token: SeCreatePagefilePrivilege	2208	GlobalPackageHandler.exe
Token: SeShutdownPrivilege	2208	GlobalPackageHandler.exe
Token: SeCreatePagefilePrivilege	2208	GlobalPackageHandler.exe
Token: SeShutdownPrivilege	2208	GlobalPackageHandler.exe
Token: SeCreatePagefilePrivilege	2208	GlobalPackageHandler.exe
Token: SeShutdownPrivilege	2208	GlobalPackageHandler.exe
Token: SeCreatePagefilePrivilege	2208	GlobalPackageHandler.exe
Token: SeShutdownPrivilege	2208	GlobalPackageHandler.exe
Token: SeCreatePagefilePrivilege	2208	GlobalPackageHandler.exe
Token: SeShutdownPrivilege	2208	GlobalPackageHandler.exe
Token: SeCreatePagefilePrivilege	2208	GlobalPackageHandler.exe
Token: SeShutdownPrivilege	2208	GlobalPackageHandler.exe
Token: SeCreatePagefilePrivilege	2208	GlobalPackageHandler.exe
Token: SeShutdownPrivilege	2208	GlobalPackageHandler.exe
Token: SeCreatePagefilePrivilege	2208	GlobalPackageHandler.exe
Token: SeShutdownPrivilege	2208	GlobalPackageHandler.exe
Token: SeCreatePagefilePrivilege	2208	GlobalPackageHandler.exe
Token: SeShutdownPrivilege	2208	GlobalPackageHandler.exe
Token: SeCreatePagefilePrivilege	2208	GlobalPackageHandler.exe
Token: SeShutdownPrivilege	2208	GlobalPackageHandler.exe
Token: SeCreatePagefilePrivilege	2208	GlobalPackageHandler.exe
Token: SeShutdownPrivilege	2208	GlobalPackageHandler.exe
Token: SeCreatePagefilePrivilege	2208	GlobalPackageHandler.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4140	dib_Fm_v5.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4708 wrote to memory of 4100	4708	calc.exe	83
PID 4708 wrote to memory of 4100	4708	calc.exe	83
PID 4708 wrote to memory of 4100	4708	calc.exe	83
PID 4100 wrote to memory of 2496	4100	cmd.exe	85
PID 4100 wrote to memory of 2496	4100	cmd.exe	85
PID 4100 wrote to memory of 2496	4100	cmd.exe	85
PID 4100 wrote to memory of 1676	4100	cmd.exe	86
PID 4100 wrote to memory of 1676	4100	cmd.exe	86
PID 4100 wrote to memory of 1676	4100	cmd.exe	86
PID 2208 wrote to memory of 4988	2208	GlobalPackageHandler.exe	95
PID 2208 wrote to memory of 4988	2208	GlobalPackageHandler.exe	95
PID 2208 wrote to memory of 4988	2208	GlobalPackageHandler.exe	95
PID 2208 wrote to memory of 4988	2208	GlobalPackageHandler.exe	95
PID 2208 wrote to memory of 4988	2208	GlobalPackageHandler.exe	95
PID 2208 wrote to memory of 4988	2208	GlobalPackageHandler.exe	95
PID 2208 wrote to memory of 4988	2208	GlobalPackageHandler.exe	95
PID 2208 wrote to memory of 4988	2208	GlobalPackageHandler.exe	95
PID 2208 wrote to memory of 4988	2208	GlobalPackageHandler.exe	95
PID 2208 wrote to memory of 4988	2208	GlobalPackageHandler.exe	95
PID 2208 wrote to memory of 4988	2208	GlobalPackageHandler.exe	95
PID 2208 wrote to memory of 4988	2208	GlobalPackageHandler.exe	95
PID 2208 wrote to memory of 4988	2208	GlobalPackageHandler.exe	95
PID 2208 wrote to memory of 4988	2208	GlobalPackageHandler.exe	95
PID 2208 wrote to memory of 4988	2208	GlobalPackageHandler.exe	95
PID 2208 wrote to memory of 4988	2208	GlobalPackageHandler.exe	95
PID 2208 wrote to memory of 4988	2208	GlobalPackageHandler.exe	95
PID 2208 wrote to memory of 4988	2208	GlobalPackageHandler.exe	95
PID 2208 wrote to memory of 4988	2208	GlobalPackageHandler.exe	95
PID 2208 wrote to memory of 4988	2208	GlobalPackageHandler.exe	95
PID 2208 wrote to memory of 4988	2208	GlobalPackageHandler.exe	95
PID 2208 wrote to memory of 4988	2208	GlobalPackageHandler.exe	95
PID 2208 wrote to memory of 4988	2208	GlobalPackageHandler.exe	95
PID 2208 wrote to memory of 4988	2208	GlobalPackageHandler.exe	95
PID 2208 wrote to memory of 4988	2208	GlobalPackageHandler.exe	95
PID 2208 wrote to memory of 4988	2208	GlobalPackageHandler.exe	95
PID 2208 wrote to memory of 4988	2208	GlobalPackageHandler.exe	95
PID 2208 wrote to memory of 4988	2208	GlobalPackageHandler.exe	95
PID 2208 wrote to memory of 4988	2208	GlobalPackageHandler.exe	95
PID 2208 wrote to memory of 4988	2208	GlobalPackageHandler.exe	95
PID 2208 wrote to memory of 896	2208	GlobalPackageHandler.exe	96
PID 2208 wrote to memory of 896	2208	GlobalPackageHandler.exe	96
PID 2208 wrote to memory of 4732	2208	GlobalPackageHandler.exe	98
PID 2208 wrote to memory of 4732	2208	GlobalPackageHandler.exe	98
PID 2208 wrote to memory of 4732	2208	GlobalPackageHandler.exe	98
PID 2208 wrote to memory of 4732	2208	GlobalPackageHandler.exe	98
PID 2208 wrote to memory of 4732	2208	GlobalPackageHandler.exe	98
PID 2208 wrote to memory of 4732	2208	GlobalPackageHandler.exe	98
PID 2208 wrote to memory of 4732	2208	GlobalPackageHandler.exe	98
PID 2208 wrote to memory of 4732	2208	GlobalPackageHandler.exe	98
PID 2208 wrote to memory of 4732	2208	GlobalPackageHandler.exe	98
PID 2208 wrote to memory of 4732	2208	GlobalPackageHandler.exe	98
PID 2208 wrote to memory of 4732	2208	GlobalPackageHandler.exe	98
PID 2208 wrote to memory of 4732	2208	GlobalPackageHandler.exe	98
PID 2208 wrote to memory of 4732	2208	GlobalPackageHandler.exe	98
PID 2208 wrote to memory of 4732	2208	GlobalPackageHandler.exe	98
PID 2208 wrote to memory of 4732	2208	GlobalPackageHandler.exe	98
PID 2208 wrote to memory of 4732	2208	GlobalPackageHandler.exe	98
PID 2208 wrote to memory of 4732	2208	GlobalPackageHandler.exe	98
PID 2208 wrote to memory of 4732	2208	GlobalPackageHandler.exe	98
PID 2208 wrote to memory of 4732	2208	GlobalPackageHandler.exe	98
PID 2208 wrote to memory of 4732	2208	GlobalPackageHandler.exe	98
PID 2208 wrote to memory of 4732	2208	GlobalPackageHandler.exe	98
PID 2208 wrote to memory of 4732	2208	GlobalPackageHandler.exe	98
PID 2208 wrote to memory of 4732	2208	GlobalPackageHandler.exe	98

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2628
- C:\Windows\System32\svchost.exe
  "C:\Windows\System32\svchost.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2924

C:\Users\Admin\AppData\Local\Temp\calc.exe
"C:\Users\Admin\AppData\Local\Temp\calc.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4708
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq GlobalPackageHandler.exe" /FO csv | "C:\Windows\system32\find.exe" "GlobalPackageHandler.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4100
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "USERNAME eq Admin" /FI "IMAGENAME eq GlobalPackageHandler.exe" /FO csv
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2496
- - C:\Windows\SysWOW64\find.exe
    "C:\Windows\system32\find.exe" "GlobalPackageHandler.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1676

C:\Users\Admin\AppData\Local\Programs\GlobalPackageHandler\GlobalPackageHandler.exe
"C:\Users\Admin\AppData\Local\Programs\GlobalPackageHandler\GlobalPackageHandler.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Users\Admin\AppData\Local\Programs\GlobalPackageHandler\GlobalPackageHandler.exe
  "C:\Users\Admin\AppData\Local\Programs\GlobalPackageHandler\GlobalPackageHandler.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\GlobalPackageHandler" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1792,i,10374451140369037053,1490570449191096802,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1784 /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4988
- C:\Users\Admin\AppData\Local\Programs\GlobalPackageHandler\GlobalPackageHandler.exe
  "C:\Users\Admin\AppData\Local\Programs\GlobalPackageHandler\GlobalPackageHandler.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\GlobalPackageHandler" --field-trial-handle=2220,i,10374451140369037053,1490570449191096802,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:3
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:896
- C:\Users\Admin\AppData\Local\Programs\GlobalPackageHandler\GlobalPackageHandler.exe
  "C:\Users\Admin\AppData\Local\Programs\GlobalPackageHandler\GlobalPackageHandler.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\GlobalPackageHandler" --app-path="C:\Users\Admin\AppData\Local\Programs\GlobalPackageHandler\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=2532,i,10374451140369037053,1490570449191096802,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2528 /prefetch:1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4732
- C:\Users\Admin\AppData\Local\Programs\GlobalPackageHandler\GlobalPackageHandler.exe
  "C:\Users\Admin\AppData\Local\Programs\GlobalPackageHandler\GlobalPackageHandler.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\GlobalPackageHandler" --app-path="C:\Users\Admin\AppData\Local\Programs\GlobalPackageHandler\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3512,i,10374451140369037053,1490570449191096802,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2460
- C:\Users\Admin\AppData\Local\Programs\GlobalPackageHandler\GlobalPackageHandler.exe
  "C:\Users\Admin\AppData\Local\Programs\GlobalPackageHandler\GlobalPackageHandler.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\GlobalPackageHandler" --app-path="C:\Users\Admin\AppData\Local\Programs\GlobalPackageHandler\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3648,i,10374451140369037053,1490570449191096802,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2624
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Start-Process -FilePath "'C:\Users\Admin\AppData\Local\Temp\c606549ea3c559f52706da14e202637c\execute.bat'" -WindowStyle hidden -Verb runAs"
  2⤵
  - Hide Artifacts: Hidden Window
  PID:3628
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe Start-Process -FilePath "'C:\Users\Admin\AppData\Local\Temp\c606549ea3c559f52706da14e202637c\execute.bat'" -WindowStyle hidden -Verb runAs
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3472
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\c606549ea3c559f52706da14e202637c\execute.bat"
      4⤵
      PID:3668
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:4876
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2812
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "rmdir /s /q "C:\Users\Admin\AppData\Local\Temp\c606549ea3c559f52706da14e202637c""
  2⤵
  PID:920
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Users\Admin\AppData\Roaming\UI_1_1737972903423\GlobalPackageHandler.exe x -pLJ8zK9VgHp -o+ C:\Users\Admin\AppData\Roaming\UI_1_1737972903423\UI_1.kit C:\Users\Admin\AppData\Roaming\UI_1_1737972903423"
  2⤵
  PID:4428
- - C:\Users\Admin\AppData\Roaming\UI_1_1737972903423\GlobalPackageHandler.exe
    C:\Users\Admin\AppData\Roaming\UI_1_1737972903423\GlobalPackageHandler.exe x -pLJ8zK9VgHp -o+ C:\Users\Admin\AppData\Roaming\UI_1_1737972903423\UI_1.kit C:\Users\Admin\AppData\Roaming\UI_1_1737972903423
    3⤵
    - Executes dropped EXE
    PID:2524
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Users\Admin\AppData\Roaming\UI_2_1737972903923\GlobalPackageHandler.exe x -pLJ8zK9VgHp -o+ C:\Users\Admin\AppData\Roaming\UI_2_1737972903923\UI_2.kit C:\Users\Admin\AppData\Roaming\UI_2_1737972903923"
  2⤵
  PID:4472
- - C:\Users\Admin\AppData\Roaming\UI_2_1737972903923\GlobalPackageHandler.exe
    C:\Users\Admin\AppData\Roaming\UI_2_1737972903923\GlobalPackageHandler.exe x -pLJ8zK9VgHp -o+ C:\Users\Admin\AppData\Roaming\UI_2_1737972903923\UI_2.kit C:\Users\Admin\AppData\Roaming\UI_2_1737972903923
    3⤵
    - Executes dropped EXE
    PID:4648
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Users\Admin\AppData\Roaming\UI_1_1737972903423\WebCopier.exe"
  2⤵
  PID:4576
- - C:\Users\Admin\AppData\Roaming\UI_1_1737972903423\WebCopier.exe
    C:\Users\Admin\AppData\Roaming\UI_1_1737972903423\WebCopier.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2260
  - - C:\Users\Admin\AppData\Roaming\ClientPatch\WebCopier.exe
      C:\Users\Admin\AppData\Roaming\ClientPatch\WebCopier.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      PID:4236
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\SysWOW64\cmd.exe
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        
        PID:4808
      - C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe
        6⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Suspicious behavior: EnumeratesProcesses
        
        PID:4868
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Users\Admin\AppData\Roaming\UI_2_1737972903923\WebCopier.exe"
  2⤵
  PID:3472
- - C:\Users\Admin\AppData\Roaming\UI_2_1737972903923\WebCopier.exe
    C:\Users\Admin\AppData\Roaming\UI_2_1737972903923\WebCopier.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:1096
  - - C:\Users\Admin\AppData\Roaming\DriverService_ENQ\WebCopier.exe
      C:\Users\Admin\AppData\Roaming\DriverService_ENQ\WebCopier.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      PID:2392
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\SysWOW64\cmd.exe
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        
        PID:1720
      - C:\Users\Admin\AppData\Local\Temp\dib_Fm_v5.exe
        
        C:\Users\Admin\AppData\Local\Temp\dib_Fm_v5.exe
        6⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of SetWindowsHookEx
        
        PID:4140
- C:\Users\Admin\AppData\Local\Programs\GlobalPackageHandler\GlobalPackageHandler.exe
  "C:\Users\Admin\AppData\Local\Programs\GlobalPackageHandler\GlobalPackageHandler.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\GlobalPackageHandler" --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2476,i,10374451140369037053,1490570449191096802,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3952 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:4888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Window

T1564.003

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
6cf293cb4d80be23433eecf74ddb5503

SHA1
24fe4752df102c2ef492954d6b046cb5512ad408

SHA256
b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8

SHA512
0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
3ca1082427d7b2cd417d7c0b7fd95e4e

SHA1
b0482ff5b58ffff4f5242d77330b064190f269d3

SHA256
31f15dc6986680b158468bf0b4a1c00982b07b2889f360befd8a466113940d8f

SHA512
bbcfd8ea1e815524fda500b187483539be4a8865939f24c6e713f0a3bd90b69b4367c36aa2b09886b2006b685f81f0a77eec23ab58b7e2fb75304b412deb6ca3

Download Submit
C:\Users\Admin\AppData\Local\Temp\5d2e35b4-ee56-4946-9edd-6de735edbe0a.tmp.exe

Filesize
744KB

MD5
16659ae52ce03889ad19db1f5710c6aa

SHA1
66b814fe3be64229e2cc19f0a4460e123ba74971

SHA256
0b1866b627d8078d296e7d39583c9f856117be79c1d226b8c9378fe075369118

SHA512
f9dd360c3a230131c08c4d5f838457f690ed4094ec166acd9f141b7603f649cfa71a47ea80e9ff41b8296246bdc1c72a75288f9a836c18431e06c2e8e3fc8398

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zjgbmurf.keg.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\c606549ea3c559f52706da14e202637c\command.bat

Filesize
181B

MD5
578d90b907a53278bfc9eed642c28bd3

SHA1
be9871cf1814c42c1e1372b8436d4a3748e4bc3a

SHA256
db75724258767bbafb42866ca524696fe333c5cae820f5ce70a431f3ad661359

SHA512
463031be1ebf73961cf500ebf943efb830415909e627f90db024c1bc56e3f79e24b25f5c1a881cfe09800b29f33185d3d364d2a0d1b52618d176b86d149470a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\c606549ea3c559f52706da14e202637c\execute.bat

Filesize
352B

MD5
c21845a16c8836b9e81c7ff5f99d706f

SHA1
cea73b9687be7a6316710dd6b86dd2a4be03a6f4

SHA256
74fd5db0b5d1e4b4d226232cf0754c2707ca07231308fe55dc12a83dd5d5c4e5

SHA512
c5d03a5cb27977ead73ff6609da157b887304a8a4544cb166f41ef06a008d415da021b642c0bd76bb5699b1c7f9d28c13a8f3aa92347c3a96e7be8b980bb17bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\c606549ea3c559f52706da14e202637c\status

Filesize
3B

MD5
a5ea0ad9260b1550a14cc58d2c39b03d

SHA1
f0aedf295071ed34ab8c6a7692223d22b6a19841

SHA256
f1b2f662800122bed0ff255693df89c4487fbdcf453d3524a42d4ec20c3d9c04

SHA512
7c735c613ece191801114785c1ee26a0485cbf1e8ee2c3b85ba1ad290ef75eec9fede5e1a5dc26d504701f3542e6b6457818f4c1d62448d0db40d5f35c357d74

Download Submit
C:\Users\Admin\AppData\Local\Temp\c606549ea3c559f52706da14e202637c\stderr

Filesize
512B

MD5
427ac64ceb9c8831555a95d96dc6e286

SHA1
10d57d1aa033d565ab2cad7ea4d317e07a3f3d3e

SHA256
6812569a7161b574febdf2ad51ab8f1bc9bd6e2a4a7ba04a3bb211164d583d8f

SHA512
d365e62adf7417fffa54c743edf22c4fa1e46cab44b6dbbbb9fcee5a576612a4a24d7235260937dfc1d98abfdfa9f3f30cdcbcdf857cfcc7981611cf62bde4c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7ACE.tmp\7z-out\LICENSE.electron.txt

Filesize
1KB

MD5
4d42118d35941e0f664dddbd83f633c5

SHA1
2b21ec5f20fe961d15f2b58efb1368e66d202e5c

SHA256
5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d

SHA512
3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7ACE.tmp\7z-out\LICENSES.chromium.html

Filesize
8.7MB

MD5
6ff57c0aeccdf44c39c95dee9ecea805

SHA1
c76669a1354067a1c3ddbc032e66c323286a8d43

SHA256
0ba4c7b781e9f149195a23d3be0f704945f858a581871a9fedd353f12ce839ca

SHA512
d6108e1d1d52aa3199ff051c7b951025dbf51c5cb18e8920304116dcef567367ed682245900fda3ad354c5d50aa5a3c4e6872570a839a3a55d3a9b7579bdfa24

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7ACE.tmp\7z-out\chrome_100_percent.pak

Filesize
148KB

MD5
83ec43f2af9fc52025f3f807b185d424

SHA1
ea432f7571d89dd43a76d260cb5853cada253aa0

SHA256
a659ee9eb38636f85f5336587c578fb29740d3effaff9b92852c8a210e92978c

SHA512
6ddca85215bf6f7f9b17c5d52bd7395702515bc2354a8cd8fa6c1ccd7355a23b17828853ceabeef597b5bca11750dc7c9f6ec3c45a33c2106f816fec74963d86

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7ACE.tmp\7z-out\chrome_200_percent.pak

Filesize
223KB

MD5
dc48a33bd20bfc7cacfc925a84b015b6

SHA1
8dfee88fd1dc77f89ad88c19146fe3ab45e43f3c

SHA256
2c1b3e4b8a0cf837ae0a390fca54f45d7d22418e040f1dfea979622383acced6

SHA512
1d54eb5d2ba06af0ba8f6b491b0d43f178a48ac82cdf383beb265e732ddfc06bca9692003fdfce56f7f00af97f29acf046c73b891b8c561610098f9626eaf05a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7ACE.tmp\7z-out\d3dcompiler_47.dll

Filesize
4.7MB

MD5
a7b7470c347f84365ffe1b2072b4f95c

SHA1
57a96f6fb326ba65b7f7016242132b3f9464c7a3

SHA256
af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a

SHA512
83391a219631f750499fd9642d59ec80fb377c378997b302d10762e83325551bb97c1086b181fff0521b1ca933e518eab71a44a3578a23691f215ebb1dce463d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7ACE.tmp\7z-out\ffmpeg.dll

Filesize
2.8MB

MD5
122ac1450759999a23bb68230770d998

SHA1
72142d71a8fa21e4a54d23fce08d817cfd4c7ed7

SHA256
015c30885776c9fe35242bc7ed612c1a3caaf737c4d3116a443e2c473cd87270

SHA512
fa0d26b23c2e1a7395bbe63615b103581c0f1fc7663530e154ab569ca28723303738b8c54c3569f9fc1b1a842064db57cffd95a71cfe711f1b91f6a364d664eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7ACE.tmp\7z-out\icudtl.dat

Filesize
10.0MB

MD5
ffd67c1e24cb35dc109a24024b1ba7ec

SHA1
99f545bc396878c7a53e98a79017d9531af7c1f5

SHA256
9ae98c06cbb0ea43c5cd6b5725310c008c65e46072421a1118cb88e1de9a8b92

SHA512
e1a865e685d2d3bacd0916d4238a79462519d887feb273a251120bb6af2b4481d025f3b21ce9a1a95a49371a0aa3ecf072175ba756974e831dbfde1f0feaeb79

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7ACE.tmp\7z-out\libEGL.dll

Filesize
481KB

MD5
50e76b71cba1747050f591f60d49a465

SHA1
21d9652102d47bbf818f2a41ebc6e888d88eade9

SHA256
071160c865fac5bc6c232a10b1906cda0c4315fcf8c5349541cc709e9bcf386c

SHA512
6923968062cee0d1660280fcd386f13c3b5650d49b73dd66f9c6f4634cb6314d2132d47e161671d41dc355c08bdc55dcdb5b9c566b633db52270a293e23dc312

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7ACE.tmp\7z-out\libGLESv2.dll

Filesize
8.0MB

MD5
e450b4432235e3ef2ab86f9f12e14680

SHA1
a6e9f17508d126ddbe5d47c7991512c304b35cf5

SHA256
c57cf0d74eddd6324a437d3e210949ae39b15c6f058b0828f3cde07c11b6c52c

SHA512
ecaaa302c410ebe004bee4d6c93a7ecdcad3257b126ea2d27aaf4f91708876364ad44877e4b107b2d0b88ae8530a83dd6e9d33bb19606d03ea32d9ebcb93d17c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7ACE.tmp\7z-out\locales\af.pak

Filesize
520KB

MD5
fc32a6b72fc91e1be9c2c9d2ea586ec3

SHA1
5d439600cff26476d8715b778881f5735356d723

SHA256
c56cb2841ee2e40fbdd6b7e293a1ce74bd10fd500465fcf99d1e07f8d69f8ce7

SHA512
b34c7390d4a15936b1f74f42fa91ccd0ca0587f0dd630096c9a16ec77756e2137d9e49ab1ebbf703c8ce6f56f110d5bb3333b1ebed51779d1bb2460b203a7250

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7ACE.tmp\7z-out\locales\am.pak

Filesize
840KB

MD5
873548bf4ab0feadf7c83068036377ca

SHA1
b0b4311d02a1be1933fa90233e436e23da178640

SHA256
8f46ccb4459b50fe06c4f825dd42c4d458dcc05df9631fdfb9d5a0926038246e

SHA512
0ee9a1046d4fbde5a7caa7d922d3ed910023337d87e727b9a216f07c43f511563b93910e1992b9f8df6dbcf96c7f527451f2ebfa48868724b83297a50f34d202

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7ACE.tmp\7z-out\locales\ar.pak

Filesize
921KB

MD5
8d4ab96df9be981c11a48955117463c2

SHA1
338eb5752bdefa22cd0db3853b9a45d5d6bc0d27

SHA256
e8d59cb109f5f6a923281c619ba1eacbe795c88a3da30c3fcb960a54230627bf

SHA512
d7bb3b9b96e5ae4d12d7e937a13ca839232cf06d1f172602fb7a250c9c17d0119c53ca308092c0ef4d0e7a3cd34f5a25ffc1fd54a222304a3a203f0899f122c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7ACE.tmp\7z-out\locales\bg.pak

Filesize
959KB

MD5
d9d3b4d420be9277d69584a3c0b5080a

SHA1
285a094979b739c4455e3790968d33ca4d466146

SHA256
f08de6909faf88465c28388aa03fdf08e165866a5a23c738ed33382275c4ec83

SHA512
388ca1cc11485fd3d31a7fbf710145cbd480cb386d96cf6dfd83e1ef2f5376df76db5c2cb051c5a045452875f8362890cbc6df547200bec624c9f13636655803

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7ACE.tmp\7z-out\locales\bn.pak

Filesize
1.2MB

MD5
c798cc5946a04209cb601637fda7e573

SHA1
c4a503fe368980d12e097792fa67b76b5934ade7

SHA256
c48b7423d5638b09860ed1ed4a0741890dc4b3f7c9e682e94867eb8441d196ba

SHA512
7ef077cd66508d47ef4f0e5ec98fd3f18469b66fdd468c9f8eb71e1a960042b12ac9f185fbf598544997cbf7dd7de5694c7bfd7f8b9d7d5c267baf81218ccc2b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7ACE.tmp\7z-out\locales\ca.pak

Filesize
584KB

MD5
f20051b4128957c1637c01ead53b97f2

SHA1
dfa1cb8288e5489f126bb6998581176ac3f296e0

SHA256
06809011053b482b4830517039057c65021783129cc90b20857141d4f37ce9bb

SHA512
d63ab5d8b0641b6eb984fa9162a565bda14692b86b18d69e4b676d6f2e894d2317022d713bc726f94578c9518162479ab68ff6e52f5c60bcee416df79a1b2a18

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7ACE.tmp\7z-out\locales\cs.pak

Filesize
602KB

MD5
d661bfa360061a0d0f18024cbc00bb6a

SHA1
8603b59dc08b8256b242332effbc0430677aa8d7

SHA256
690f31abc263f7c479531b267909777dcb20c680b3cf7801b287860d2415af3f

SHA512
52c3c82e6f08fe0c2a2cd9b22aa185084d0378f75a6b8bb53d012a1c56a12231540b819724a76ab622a36d9165237299727d1cc0ba49c04c0314ba9bf2ce7e57

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7ACE.tmp\7z-out\locales\da.pak

Filesize
545KB

MD5
3c8a4730a2d935de6ecf17ad8d782f48

SHA1
f520707cfd5856a8f868099fdb894b41993b1637

SHA256
e71730c1bfb469f327212f7488c7674e66a59f857a4bdbb8c7736765215e5ffb

SHA512
bc92bf0dc203fe3b65bbbbbacfbf44835d65bf869b91be292a2f196a34f47a253be77f4aa2be8da3103d6e62fef0ad93614ea55d3ad28516372d096c60cb39df

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7ACE.tmp\7z-out\locales\de.pak

Filesize
582KB

MD5
dd811ae7ee2beb54b60246e8dcd3e212

SHA1
967de04b1c9d98e41de4ab1c7f73428a2b14d654

SHA256
be0d49be3b021c0a4d917ad437d8ed817d676c40bca4fc08f2f9a8b2cbe67fc3

SHA512
970135c8591f33d978bc705724c1ab42ead4050b60bfc5315ea47a9e12ce967f2cf6136f863e772c76ef2550aa36544b5afbaef215acc6cdd547d85cf6ff6faa

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7ACE.tmp\7z-out\locales\el.pak

Filesize
1.0MB

MD5
444f3f565941ddd5f108f17c3803079b

SHA1
f90d186106f1ad8625257b549dd1d0ebd48b623b

SHA256
7e54f3c19a0343435685738d41cbedcba6b1df30f6cc837f0b5c27e0a91e2d84

SHA512
d6d9afb0c138cdbf6d5e23d5120b3e953eb1848fa790f481dc92dbfb6b8a084511dee873acc0fdee4188d3a07843635e0231d5a1cf3c3f37545d12e2aa1e0d17

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7ACE.tmp\7z-out\locales\en-GB.pak

Filesize
474KB

MD5
5c61abacfcec504091c0bdd7efe9b4dc

SHA1
fd794fd1ec93028b1cf9ef482b0940f40012a327

SHA256
33132446072ddfd058a395afeec901d7fae18505bb48e271ca870a4435d9e338

SHA512
a9cc6fc1b3ddf941fcfacf3101600cd9e1feb664bda0b0a9f8e5f30ba1db70590dc148fb0b8cb7f5adc8dd3cc1ed65187908463ccb923f53efdc5a1150aba7c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7ACE.tmp\7z-out\locales\en-US.pak

Filesize
478KB

MD5
a99b6152bdeac44148f94394c4149622

SHA1
df7371533e92aa24f48469116d9a8ac73249315e

SHA256
75db989561e145d0d990c4918502316c77ce66b344d3dce4739e3a6db43fde82

SHA512
3160b58d10ca147594ff4aca004007d4e6823421be349cfad945c681e220eec7266d88434a4d31c719a346650ac0ed31f1f13fca3e824d81bb65ebb4d21cc2c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7ACE.tmp\7z-out\locales\es-419.pak

Filesize
575KB

MD5
3b180e08076ae90821f3b305ee5728ec

SHA1
690509fa47f843d443c423e0e9b344e4e15bc995

SHA256
0ee595ac6814586b46101e854d01ce6b1076092b07aa2564d6c8adb5d7a082e6

SHA512
cdb7b852bf9098813b2fba593fbc9dcc8136c1e643300e4117948fd49dc9f9779eaa99571d36722dacf38f9c71709778618ed271aadaeb3c2f75641b56a3f867

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7ACE.tmp\7z-out\locales\es.pak

Filesize
575KB

MD5
fb43793b61c4a62da84ff340c3a342d7

SHA1
72941c56a2e268ec7262efc92bf3cfe9c06d07ae

SHA256
31f98fca9ab6837569315fd1baac8fab16c592b03e47d7e1dfe4c16bb3ac2567

SHA512
35572bffc9b113616958f2aa50265417f22c653c97eaabcefad1fe71bcb97b0aef79efbe363f5eaa64571a8d4014c614621f3059ee66bc5f77116b9dedb93e1f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7ACE.tmp\7z-out\locales\et.pak

Filesize
523KB

MD5
ace748cc20a646162bd473343539d5ce

SHA1
d9aeba3004206b76a1f6b23607281b6484df76d1

SHA256
9954e80792a5cac7b0a7ae2899b0adaa620af2f3ed2a273ee65b10b22ffa4bbc

SHA512
a9b36941a808c2b93beb1d3cb4d939ce3333f2f42316b9eb47ad31fbce85e789230856e43be1f2660f22677ddbeb192cb492511596ea318a24f158b8c0319571

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7ACE.tmp\7z-out\locales\fa.pak

Filesize
855KB

MD5
587832600a9d596f526f1edc8b845b55

SHA1
1eab6376bdd341de25a4017a65508eb5e03af5a2

SHA256
b2d24b4311edd8e0cad01308b6667c8be2fb04ca624666cf0a841e907312b551

SHA512
1e1a975ffa69f12ec8f88eafc80bb8c6c7838a7be570c3d4fcf471018b2b4d4acb124205f01b06a4755b1224471c34c7b969d93effebdac7dc75912e245dfce9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7ACE.tmp\7z-out\locales\fi.pak

Filesize
534KB

MD5
b452982f5d1dc232ac8869217348bb74

SHA1
39cfefdce0ad7dbbfd72789eef4835e25d1585f5

SHA256
8d62395944362d437fc1bd7810d8fd037afcc2f94f56bfaee4368350c189c106

SHA512
f053285f4341e92a6b06bc019a90c461cb76281c8c5d6b8024f8c15eaa20ac42ad7409b71178ca0b9cb5adbfac0216d73b9eb63bf8563f1c9f82c1028a5f5c3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7ACE.tmp\7z-out\locales\fil.pak

Filesize
604KB

MD5
d02d3bb645c67a0a3c12f1d174545b48

SHA1
6e1aa00c0eb20489ab7e518faa43f6d3a99ec8f3

SHA256
1a6d121fb42a1b2941f2bc3c11c25e2a7c1e96ed845d08cd5f2370b9d399a0be

SHA512
5f3ae15a587f7cc2cdb10a4c1535e039517b08d24bcb8acbadbb2d2b9ba8425c26852a82441a9a32d190e4c06fd83c80b8d06d4226ecc49dc77dd77a67ac717d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7ACE.tmp\7z-out\locales\fr.pak

Filesize
622KB

MD5
0ee0556f9fd32215ff5a6b64e1a71a59

SHA1
8e1c8774daf341d3b4e541b6bd443f22cb3fbb2e

SHA256
4abf6ce2de7f20ffaeed953b97d364f08324bbc9819d2ae02a4aaadcf9b88cff

SHA512
ba7bc3637a57b26e990c4e23f3f4a3337a5566d0bcbb46238e58ef774605ecc58055ce32be01584792d5e0a7986fb59138a690d8bff86cdaee434cc8d97735a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7ACE.tmp\7z-out\locales\gu.pak

Filesize
1.2MB

MD5
69b8b51ca26d07c798b8216f51e8e8c9

SHA1
a50995b86475799a32ccf48ba92dd736f4175731

SHA256
d0ee25a5a7dee8337b9dd12e65a5910e75c09aed36eb3ade0907de6e14a6d760

SHA512
5be0c2c91fcd5fb4c45ddc57fa2e07a40eafcbc9e1eabd29e59af33b147cad5a7ffecf4c1e9c05b0282c01939bec11b13656a8cb299ce286188e2281f7b08e05

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7ACE.tmp\7z-out\locales\he.pak

Filesize
751KB

MD5
3ee6aecc3e7faab761ee57f73852bc2a

SHA1
32374d3e543a57fb7e883b73522314d1958f3401

SHA256
f9e4f3e50d86f0c6fd271caa160675e224adb56a292bf21283733e2066a09995

SHA512
298ffc69605c0bf9bd809fa3dda05769c78eede7e39934d8db71c2362cab07fe361f21de9ab6696cea38399e3f44819ec5a9559151eade82d65a254be8e90270

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7ACE.tmp\7z-out\locales\hi.pak

Filesize
1.3MB

MD5
fa5f71ca9c17172d374d0a2fcfe907eb

SHA1
23abf6f3ead1559632caa31ee351193ef6cb7983

SHA256
f73ccac3debba20fb225209805ff2383609853111f931e6b82095c1eb56a6ce4

SHA512
06d990747eded7aa09ce13107e44fbdde17e60031191564d51d7e15c6dcc2ed411dd31ed5b343052757fa99ce2969321c61733cfd28c4309f3db97ae4c8e2c87

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7ACE.tmp\7z-out\locales\hr.pak

Filesize
581KB

MD5
51b515fbc314ce3c9bad9c4e64380b7c

SHA1
46ffd2d0f72eb74066139edb79aa9ad55edef6dd

SHA256
3ca8e7eb09aa20845684beefa2351afd4c6ca95bc09ba8bd7a0b629fe8a40565

SHA512
97f23db01d5517f5f2dd49bf3d8479ea2f7825a0684fbcf1decee49a136cfc0e933f1dd04d2b21edf2e4a2200ec4a663c38e42e43fa2c1557e709ac010ec8b74

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7ACE.tmp\7z-out\locales\hu.pak

Filesize
625KB

MD5
85d8bd3516b1965b153236d86b9bccbc

SHA1
996fa6ae823e72e811311c7f4f4fe76cce686dd6

SHA256
ec81ac981af0e962654ad4f65030064a6369dc2316cb1b10bb24b473808ad1e9

SHA512
ecaa5210de1b3e389e5c728fead4538deae129339f3aa577aeb231e5fdb6c6615c11fe345753559ff491e63f80eb8390893a3576f3061979ce513a8193c3595e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7ACE.tmp\7z-out\locales\id.pak

Filesize
516KB

MD5
7f8abc55705a2e2561b2b2bb3068f361

SHA1
4f1e68732efc7e3f0f6e01b9e2093c0370ba4955

SHA256
84a9b61e27edda9b2998e8c57e5e81bc0c0d47d6988bd3b03959487d2fff4921

SHA512
865b7571551e029b066e5db9519aaffd0a611644b860cb249d4344482b2ffd9ca5454b83c5150a9b89d1d8d270e304d848c8a6285f136fdedaa3fc6f54cbc0cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7ACE.tmp\7z-out\locales\it.pak

Filesize
567KB

MD5
c1b0dcd5078858e58b6bb2dbd387b713

SHA1
291eff6c34726fd1d5ff950de3c55fcdc6b211cc

SHA256
73cd1e113eba841c26e67ea9431b885f7c51fe85d61862b1a766e185accb3e20

SHA512
2923967c21594d4a67c5c66e6f380bb4045271a2bb94f02221e63adaf2e352e2c421d7bfd2832c2a5f85c6bead89f30dd22e0a1e2f01ae7bba0e2ea0d6624abc

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7ACE.tmp\7z-out\locales\ja.pak

Filesize
691KB

MD5
6d6909eb9e119554810ec30769475367

SHA1
f54bf21a6df4cd16ebc4460697f29c6b0406cce0

SHA256
1dd20f7bd91426229bfb131b575e8154b21e623e3db0162aec26dc67e568584a

SHA512
73f32bc9f0fc9cc4c0b06eac9f4eafc8b2fdf424bcac1ec8ec1e78c592c9302f847fcd3c15e52b15150ce8ff48aae503b048f8819062df1a2542a64dd528c9c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7ACE.tmp\7z-out\locales\kn.pak

Filesize
1.4MB

MD5
e0263df94950f8d42a2ab5e966b9fcc6

SHA1
6081b840c5925212c3e298a4d4423138faea117d

SHA256
87ee47c4cec984a995a53ce2ef212539b7adee4a9011775b8699a29164e53c5c

SHA512
35f020b541654b3ca776c1151a542cb8f2dcbf565693c313da654708cb502ffe8454e8ec90575fba54081e9b33b4e11d3272e49b37bfae5b76f8c58d8e09a758

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7ACE.tmp\7z-out\locales\ko.pak

Filesize
585KB

MD5
136eec6fcc52d9320760b395ce88bce2

SHA1
1e5390aaf2d771767c955ca141e75f650547603b

SHA256
1af8aeac229711e127844a71cabcafb29fc752d3d8401f42cd120fce3084744b

SHA512
95f4d062771250f883dd6d42128bd53392ba5390f695a868d11f626688727466ddbec992ee391006779cd56f6116edd88e37ce06dde878d3dcecda188599efdc

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7ACE.tmp\7z-out\locales\lt.pak

Filesize
629KB

MD5
f17350067d1481437bb09810f7df062e

SHA1
b2fadff14a973ea17a8b1b9462ac989059e05ba4

SHA256
b31b65e81db7f1f3daffac67b6436039ead2545f02c428e60ab755aa2630285f

SHA512
b1463705e672b54cd9dea76756ae3357c1750d9e2fdad0dfa1799c896417637557f0269f830dad73c4be4cee3564a4021d70bd692345ebacdc6dd9733df46a8d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7ACE.tmp\7z-out\locales\lv.pak

Filesize
628KB

MD5
157d4757176a12671e1ead17e4fc2c1e

SHA1
ba783cbe4a80d91f5331cf8c39637530caf3ee45

SHA256
614e634224d32e39e9a79679d915ce402a6d0106bee37d39930884f9f6e3e01c

SHA512
fe55263345e043f9a1042b81df6e5b04698ddf00b462ac51dff7b3b6e73285315824d63e68a28b5ca236e211e6e04432153051e535315fe7ccd03d9848e02480

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7ACE.tmp\7z-out\locales\ml.pak

Filesize
1.4MB

MD5
8ef6f88631246b1b0eac82e2d8329d20

SHA1
346584aed03dd416fd4f81e3ed6c33004b5efd35

SHA256
f003a5671d619e6ed42370e70d943ee276012246dfe99310366bc3a70484307a

SHA512
83cc553d2238b83170054d13fa3bdfba400fa9d55f256f53529b89d69e0370e0c0f9a93ab0ac10592e0d8cc64a3b6f4bed9753e0440fdc0d35d79dc0f8c1733a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7ACE.tmp\7z-out\locales\mr.pak

Filesize
1.2MB

MD5
7d2a82ce8f0f601cac213b692484db4d

SHA1
fc90ec9c5e3ced11f0ea18eaad949384b3cdb321

SHA256
0e65a4f22a6a52369f948526d5a3ee3c9bbc99ae23e0b2c414b376ba23c2d411

SHA512
bce9b80a8ad088af4d480e1beae9d8123cd7772ec0211041b8b537e18757e32ee6446005974596a92b2e7e1cf922d440a926c68c760d06326319107f538a7684

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7ACE.tmp\7z-out\locales\ms.pak

Filesize
541KB

MD5
9e6eaf18a4406adf701388f8a1a43bb3

SHA1
fa06d4903ad23d67b9b55a54e76b852d2091389e

SHA256
ce4b0390f707e3ec3bcbefc11cb7b6b914af50d89b950e16704dfb6d13f0fca2

SHA512
f14c00aeed38c9abd356805830279e64c35cae07fd70c8d1b33f1f39a5e989785fe78b100e30629a74eea2f208370b1ea1f6319351df4a6e583e5f0c0b91e384

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7ACE.tmp\7z-out\locales\nb.pak

Filesize
525KB

MD5
84bb0f7aec428dc3d18aaa5d95d649f5

SHA1
090a7a274f885c7a31c6872ca353000e6e7276b7

SHA256
697882ac2da78894e449cb1f75da43e7115c2481bbd2fee3bdaa425e82fc232c

SHA512
5e92c748bb0b0f8e9605a5e851fe4441399d3cdf12192339c5ed6b707cc7d0b3d7a0131add9baf7d7a83abb895a415f93bf2472009bec423d1ed6c59c3e7254b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7ACE.tmp\7z-out\locales\nl.pak

Filesize
543KB

MD5
e0926abe13ae64ee311d61621cffba0e

SHA1
667307630e89f42838f8a644cce5c4ee3745035f

SHA256
68d981bd2119d714fbc4ba22ea2d2a0b3d9e127da7060d3bd02bd1fb5e895a43

SHA512
0be1820ec3d592af20f884fe9a9411209f5eeedd656873c2304a3ae709c08cf5b724082810cfc9c7017248228400f4e55cbbb80592e51f897add2e44d6322bbc

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7ACE.tmp\7z-out\locales\pl.pak

Filesize
604KB

MD5
2fa7348a1a79d06a0e19954504752a69

SHA1
6c6108d36c9ec617e467a60d3025803e52ecb3ac

SHA256
2ab697892ed2186bde0cfa3ed27857f850a73b195529f5a4f5a9658de188ef6a

SHA512
3ee745fa39164ae8d08a531664d0f3d48b42bdf0a4e75542ba18f850ad2c087c7153592fdd588a0fcf9c3131320603441a3de45170d5b12d64d8d39db0c3c6c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7ACE.tmp\7z-out\locales\pt-BR.pak

Filesize
568KB

MD5
fed7836f880f10063c82a7535904d132

SHA1
6f7415bae68ce0177505451684bf64f40dbe9d3f

SHA256
5a496e969e72eebbd4d4757923c8c47f15ca3aff2a5f9cd3147ff9fdf7f9baa3

SHA512
f63f431416f73b1b570e1ac1e6067d5d64fd729bdba49655c01f28a40ff36d2227ccdef610b8beeb52a0e9c911b7880304ae26c798d92c1e6846b46a3cf6f34d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7ACE.tmp\7z-out\locales\pt-PT.pak

Filesize
571KB

MD5
75a31e0fb6cd1d9725ac06a0aa3571f0

SHA1
c72a670a4ad9ae358acc58b6a0e9c0cebe5260a9

SHA256
9ebafb943bf20c66f8d9ca533633fdc63519e8ad38d78a3dd28b4457c38ba79d

SHA512
1aa5874cb6ad6da85b3cd36787d6783f27a8f6a0a17b7bae1e1fc1749b385d76cd899f95ba1b3900e80113d176b011e659b8ecc17e0a721db2d357f7cf1febb1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7ACE.tmp\7z-out\locales\ro.pak

Filesize
592KB

MD5
f9f4dbbf7ef8b266c557230667da57df

SHA1
375b4cb7b9decdf88d9604defd0ec2bb71976a44

SHA256
cb60090b451122165bb41abc238318474c4e86a545eef28ae2790c310c7d0050

SHA512
e667cb46fa9ad15abeec1fc30718bb21832233dab257491827b70bc136162314ed5f51ce5debbdba80ae7183114d297c3e5220d4824efe4a33baea237de63a1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7ACE.tmp\7z-out\locales\ru.pak

Filesize
972KB

MD5
0a6433f5a21736c5f764bd09125493bb

SHA1
d6138d087ba165f5166e550578c33a8242753d3c

SHA256
53ced8c091b6745d06d6fe06ea3e9b6824256cd279a45c6ade419ba1c9d547ef

SHA512
3d939f38baa94d40a51b7056d81fc05c8180846f911768432e5044f235c5bed93f209adfeb4bce6e9e085fca00efcb7191ef1d22860fe48c7ec1fb6d4e2f0ec6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7ACE.tmp\7z-out\locales\sk.pak

Filesize
611KB

MD5
4a1099074ddf127479370924850f9596

SHA1
b638f9d506d05151148334a8c6a564f3b589349d

SHA256
2f09ff1b8f02f735511f1ac1ecae5a3e88cd7fe16c58cee38beea5aba7fb83c9

SHA512
2f1bb9fc1aecd7ed5f3ca217a5bcd3482c699c785604492471e8eb8e2d233bee3494224fa659a9fc7e7bab5fbd9a235db24a7b3e493b9e942de28840560d1131

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7ACE.tmp\7z-out\locales\sl.pak

Filesize
587KB

MD5
e1fe6b616d7c2149ed10303a0e1b2397

SHA1
d115e509b608a11bd0f7ce7420803efb19acfc48

SHA256
70457f29ed3790557ef4c9792620c499a9e6134e004c5034586fadef5a833f6b

SHA512
780567ffca7c960a9a58e78b755f2cd334d4b1869c523621d8d36495e83be77ebdbfb90faa2fb99bf62544343d83db1f618989425d6edf4d8b8dc19debb70bdb

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7ACE.tmp\7z-out\locales\sr.pak

Filesize
903KB

MD5
f18b138f89861aba4e85dfa74cbe2ee7

SHA1
a86c210ab3e972578cff3755a1ad1df9116d87da

SHA256
7f3c729230ef2ed709c17bcdff781ec4aa5921334ccedda148df0027544094dd

SHA512
f4f80ccb74e49b0338b2d0b9db7add3bf03b85b47119bb44a84697aa08a0081b4a6cb61fe970719268c3e9c6fb32a2cf21ec7c34ee12deeb3a1d982b3485bb99

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7ACE.tmp\7z-out\locales\sv.pak

Filesize
528KB

MD5
7fbb29177d899c484cab464442e57521

SHA1
2e3a42786109d84fd2b8388e9abb1ec4993477f3

SHA256
7fd305f5ec9ac220d6ba7eefe49686ee02a574146ad023c99ea5c364780e79ab

SHA512
88738d0f652cc41c32e1018378252c8370ba9d9bfdbe5122380f9c1fc05bf6a437ffd3e562216f281d628294d9eee74c4f10819ebfe7c2b6de04ea2ca7ddb280

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7ACE.tmp\7z-out\locales\sw.pak

Filesize
557KB

MD5
af1fb718bfb3484f5df40300b777e399

SHA1
ccfb3f58a16388448bc9707e7e5cf79a6cf3a838

SHA256
434879a83079fba562af9dac928ad2fcc1033e0a6a5a1f4822d36e710decdd2b

SHA512
7666c6aefcf9a7c266e3b2a0144ccd77448ce09d6b7fd2d863d9ff12689e393b5733b2dd577db853a0775935f176cc1f6ea3e804b11db14b831271af4d6f0aee

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7ACE.tmp\7z-out\locales\ta.pak

Filesize
1.4MB

MD5
7b03d2e9dcd91caa8fcd7c38475eb1e0

SHA1
6a4e53a3f995afd5af8b845850b2f100fb355281

SHA256
8c3e1b39555fd7852eefdbf8e0d32843605e5b5c3b6770d573a89dbec7cdeb85

SHA512
1883c030690e962833cbe5f7a68a870577d47ebe5018035153edd365889722d0d4654be384b6be48cdfdd229d992c45b73304b1ca8333dde212abf15a2d3de94

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7ACE.tmp\7z-out\locales\te.pak

Filesize
1.3MB

MD5
466338a39904d7758bab24cfb55c61d4

SHA1
1f147e8ccadd1e40a91752542b80cf59fa6a19e7

SHA256
513a1db6caa7f4e454ddc0cba87494f5adb754f437019696a991d228ebbbe945

SHA512
d6e935b1595d6ee595db5b9c690f69f9daaf44cbd9614716846abf753726cfeeee8415dec41ff184d3f0cd17548f09696a2f832bedf432dc7da515e15c9cb28b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7ACE.tmp\7z-out\locales\th.pak

Filesize
1.1MB

MD5
631edf43bb77d016f4ae0be9e979ffb5

SHA1
597783295612e603917ea0b981105267cd902da9

SHA256
6605217a533a0d0a9060dbd94ab3027762b21cb29c3bf1d2247ca4459d288bb9

SHA512
26f9150757fd6b863e837d1c83c9548b372ee05969999ef4316a538d1bacbe342e5ca908609acae1cb2c277314aeee26567177470c11f4cc1a883c55e0feca7e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7ACE.tmp\7z-out\locales\tr.pak

Filesize
567KB

MD5
4b2ae4045996e28aa7dc340d8ee70672

SHA1
b943ee6fb376df266d8a0d0e8d6bacb337190dfb

SHA256
f2ca71fed0f1c1d8f081adf740e5a04927890ff35dccde1fb2253479b927f93f

SHA512
5703645908eafab11503593f4a3b7f3bb278422f32608429cd98b28c5708d2656bf9042f41b3a70afbd7dcd962a7cab0476308abaa987e395270ccf11ba64ba4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7ACE.tmp\7z-out\locales\uk.pak

Filesize
973KB

MD5
7a639846a33339b486f485df1706f3ca

SHA1
eccf7589474b7da80cba4670fef45103b6770ef7

SHA256
843c206ad3fdd6a34d083ae3f969ef58bf3c087dcba31af6126ffe46b2726511

SHA512
32fe2d71233d300fa3054e631234194429a7c80bea879f342ea4ee67b7bc514f697fa618deb8ed456c0a9a099af1d17811e621a359e66d4469229c95c8bfd39e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7ACE.tmp\7z-out\locales\ur.pak

Filesize
850KB

MD5
e63b8cf9588245f579fccb8dae57daa4

SHA1
8638a0b0bcdfdc973b6491f9bdaaf2ecf9c6ac94

SHA256
1929f3c85e550ccca9985cef47be30b690a701cbca70345baa0c2aaee99809f6

SHA512
e7e3ef949b4917f929536f094884149e27d98a13d90a00d81f1fd0e2a67408839705bdd718e17da6e1228dbe20d63746d7078ca15d2f59a8a37310f1972c04f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7ACE.tmp\7z-out\locales\vi.pak

Filesize
673KB

MD5
7e8b63ac1207caca4892722737568983

SHA1
81d8aaf528146b58e69635db579ff62c9560c9e2

SHA256
590c7c9bcceb61c96b24bcfbacc2b77b02a643e028c838abbdac7327a53d63b0

SHA512
5ecda016a2ca9c4fb72bdf63cc145c580bb67489f1383ad51046e68b55e1fb39c0dde084ca43080112cda71f2847e9060ff2f5ab590365f08211dfc450b87468

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7ACE.tmp\7z-out\locales\zh-CN.pak

Filesize
484KB

MD5
6f713d7bf5fe896f7bfb8f224d5e9fef

SHA1
6fb7c002cee17130c7e429b446ab84c1029b2120

SHA256
a9d2faa4ed07828e9939854a1ae09f3b42eac956abaa75af66c37dd923b191c2

SHA512
0a692e643dd687f787f8681adc6a4dd55d0cac68b8ca640072ca5bdf897a816553f8fae7d9ae674053051001bf0471a762807d6135e2d13c79052a7319e22619

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7ACE.tmp\7z-out\locales\zh-TW.pak

Filesize
479KB

MD5
71fb2e4270d6f3a1f04669e019f33764

SHA1
e9f6ed29af9daf900431480cb8a17a1ee852459d

SHA256
965a32f56caabad66615659a0d79e0a4eb7a60c6e5cd8dc784fd7a1f95e80a0d

SHA512
39b7434dcab722bfb14387f477990ddb2e13113f2065a047b5249dc075e98775d1868cee30032c612b5aff1b5bdc05192bc859f2c11e3e9cb89e4e694ce60322

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7ACE.tmp\7z-out\resources.pak

Filesize
5.5MB

MD5
22729a6f12bff0fec1f416b52291e22c

SHA1
851e4f5bd748f8e7f726314f9df6fbcfe797d7bd

SHA256
e52ff4895aa4e1dc82462cdeeb0bcb1d89fc481bf82e8c604d0d0bd383ac3ec8

SHA512
da88f1ef938f87ad8ade5c71df828521c06c5057a020c6aff4074dbe33ddf72e2ef79f36d1cf92807796d8e0f4093bbb1676225e28155a9e02a55f27cf664da4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7ACE.tmp\7z-out\resources\app.asar

Filesize
16.6MB

MD5
8ca10388122fb0b3dfe5cf2a78f51fce

SHA1
ae8ca9a46a6f774bcadac954b667c3b7eefd3ddb

SHA256
0012515b0b00a91bbb197813a6c864f543827e829fa4b008a674cc3904e3922f

SHA512
814fe89932f2e2761ddcac9de59b9b0f18b28eb784e7e15ec4085d27e77220e4ac26e1533fd15fc7b867cad586bb4816db2b03fa2a4d37432c0f466502a1bc04

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7ACE.tmp\7z-out\resources\elevate.exe

Filesize
105KB

MD5
792b92c8ad13c46f27c7ced0810694df

SHA1
d8d449b92de20a57df722df46435ba4553ecc802

SHA256
9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37

SHA512
6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7ACE.tmp\7z-out\snapshot_blob.bin

Filesize
309KB

MD5
6afb38479a96ee960ed64fc0caa0401b

SHA1
01ff59215dfdfdb41a38634ee8115aaaf89553f5

SHA256
769785eda3922bd210ee776fa46e97e30217755ca1dbb928230542bda2786857

SHA512
4ddebd9b337cb857835696e4579db0e735cb0e4ccc454ef851b940710cad2ce77cc55ad0d7c44d55e532d131d35317060addc7975f9da7d33d9165038fe143eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7ACE.tmp\7z-out\v8_context_snapshot.bin

Filesize
671KB

MD5
c7c05a84743ecdce85b273166d1e933d

SHA1
7f550b7ed0d4202f6e126a6d4615766998425437

SHA256
30f46b08a76755b48e569afff2657cd14734508a0d48dd053462d8c95604bc52

SHA512
c43fcbf0ce71bb6144dd56a9bfd25341e60d0eadacee21a662d578ce40d79d8d9e377dfd5de3af2e33268041a5c665dc803d282243a145cae22600d77b6de5eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7ACE.tmp\7z-out\vk_swiftshader.dll

Filesize
5.3MB

MD5
e165350675c58a0c27ac73ddc852292f

SHA1
6103eb6d27653238a12b56f092937c58decb1894

SHA256
9ffb78591fdf2d24f8e7290dc95b98bd16eb59192d9ecec9d656c46164c27e22

SHA512
972b228a1ad7aa5cd3ccd3e4d1a18489d06b1c2f5d6ad742df250934406281a699717fee38c22902b0d59bdfa2f1bbaaa9bece3ba41292e9d45f7e3354c95d85

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7ACE.tmp\7z-out\vk_swiftshader_icd.json

Filesize
106B

MD5
8642dd3a87e2de6e991fae08458e302b

SHA1
9c06735c31cec00600fd763a92f8112d085bd12a

SHA256
32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9

SHA512
f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7ACE.tmp\7z-out\vulkan-1.dll

Filesize
874KB

MD5
18ff150adb11324a4f3219aac9a7349b

SHA1
88150d7716d9e1acaf3814ea660f24da1ee70032

SHA256
7f6739a3a7f91e817dc5c6f25ec1e04cc453fa2e2c3ae676b198cde76e1fcf01

SHA512
536490da0c33aaa26d8b2879ec815a7135f172257f0708dd039042aa309caf129851c12bd01ae8df25ed379eca43d22c150cfabc025fa9f9342afa871da7539b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7ACE.tmp\SpiderBanner.dll

Filesize
9KB

MD5
17309e33b596ba3a5693b4d3e85cf8d7

SHA1
7d361836cf53df42021c7f2b148aec9458818c01

SHA256
996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93

SHA512
1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7ACE.tmp\StdUtils.dll

Filesize
100KB

MD5
c6a6e03f77c313b267498515488c5740

SHA1
3d49fc2784b9450962ed6b82b46e9c3c957d7c15

SHA256
b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e

SHA512
9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7ACE.tmp\System.dll

Filesize
12KB

MD5
0d7ad4f45dc6f5aa87f606d0331c6901

SHA1
48df0911f0484cbe2a8cdd5362140b63c41ee457

SHA256
3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

SHA512
c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7ACE.tmp\nsExec.dll

Filesize
6KB

MD5
ec0504e6b8a11d5aad43b296beeb84b2

SHA1
91b5ce085130c8c7194d66b2439ec9e1c206497c

SHA256
5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962

SHA512
3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf7ACE.tmp\nsis7z.dll

Filesize
424KB

MD5
80e44ce4895304c6a3a831310fbf8cd0

SHA1
36bd49ae21c460be5753a904b4501f1abca53508

SHA256
b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592

SHA512
c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df

Download Submit
C:\Users\Admin\AppData\Roaming\GlobalPackageHandler\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
d29d0ccc0d499bca8cb5fdad3cd44354

SHA1
dc595398ff1621d6ca0472c5f4001450a75c2da7

SHA256
a86bd483b231c054dfd30b798698b18b805c4124a685cfa0fe5b644f2ed4fb79

SHA512
c911b9c61a32b8247d95b37977e93c4115ed81596cc423929da476bef9267b80ea46dc8f7626336502cfb5ec2ef76582569bee16b2cf3ed31984cd3d13dd9a63

Download Submit
C:\Users\Admin\AppData\Roaming\GlobalPackageHandler\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
575854bce36e44a56b567ab8d7ea1fa7

SHA1
d95a1887795ed9b37b57576a5b599f1c0277287d

SHA256
c846cf34cfe519b1bb2ede7b4e83a355095c118294c11e4184fda0fd8ba6238b

SHA512
d2ca1750fe506687a22663a5000fe72ffb7913b6852ddd9d0a77fd755a986376905c9e8ea130ff71c799bc1f1f19faddfcf0f0f72154ed46648295db2e9330a4

Download Submit
C:\Users\Admin\AppData\Roaming\GlobalPackageHandler\Network\Network Persistent State

Filesize
385B

MD5
35764e089cca0a2c9b4d818797a696b1

SHA1
e2ec4feadae69946902f15a4cd3f497c70a9e81a

SHA256
98c69f2e7a82572580b62fe42fb43770d2c593a5f17efd070d590fbd6e442836

SHA512
673650447f40b67795f63575e9242e11f72beb9d645d83ec649f3882e7bfe45465a70eb8047272fca76b53eb8931576fbdd62f0c9310c5f31b306f8b4198c151

Download Submit
C:\Users\Admin\AppData\Roaming\GlobalPackageHandler\Network\Network Persistent State~RFe58cc34.TMP

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Users\Admin\AppData\Roaming\GlobalPackageHandler\Session Storage\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\UI_1_1737972903423\UI_1.kit

Filesize
3.6MB

MD5
6dbbaaefdd2202393fb36c20501bf7ce

SHA1
a05990bb005d2e701cf3404f3a66ea19a575bac4

SHA256
a9192e5c04f0fb8a030aadbd0cb4105ca7810441c3ede98bb35760576eb42b36

SHA512
358fa355aaef27dd4ea18fc405171adfd08d0aa276ca2b629a72f806329c60f929f69cbf4f7670293af26e2be33b31e13b36025ca37c66b5458939ad1ab0fec7

Download Submit
C:\Users\Admin\AppData\Roaming\UI_1_1737972903423\WebCopier.exe

Filesize
7.2MB

MD5
e2a27870ba4da90df6276c4da9e3cf82

SHA1
cd0a17f6ddc7b4994d98f26848c3a2d7dae74e68

SHA256
9f1bb79ef7d76e5dddc628d0455c1f6a6aa068cc210f1d238a231f77ac9cbba2

SHA512
66c4d8d1c6cb45a6c10cbb16d4388858980e7bc4f57fb88dc2a3b7b8fc6da82dba3e9b1bfd33ea4c25a7afd5612c2823915e5f0759728cccfe81bd4f99afc235

Download Submit
C:\Users\Admin\AppData\Roaming\UI_1_1737972903423\dessert.msg

Filesize
41KB

MD5
f8b8d4ea2b5b0bb04171c660397e7444

SHA1
dd508669db7c0f2b17b148273d61b8feedd967ce

SHA256
14833e780599fed4a0dd417b8574ddb6bd3324778aa91aa40810b1c1c5d73e50

SHA512
4b5f755282308b9b2d57c50018a173939fb1ba7229a6b9cc93734b6845f6970c3a2922b2f9dbf24f3bbe79c07850d4abcfccc1d0ad47592efb32b6927247e9d1

Download Submit
C:\Users\Admin\AppData\Roaming\UI_1_1737972903423\kickshaw.dxf

Filesize
895KB

MD5
e1b15bb12273c6aaa4c27761c4c6c439

SHA1
f64311cb32b31c308843068ba667efef85f9b5da

SHA256
c0e1a1743c7649b84f660eb4c184a0efc684fb6af0cf411d248bd7d4017eb235

SHA512
e2c60dbaaa79212e44fe7f33f370d48821bcee75b89fc6401ce5275c0068d4b571a0ff6c71142dbc43ff78d1e2b206e34324b3c8c410fd2ebdf94a080b40c20c

Download Submit
C:\Users\Admin\AppData\Roaming\UI_2_1737972903923\UI_2.kit

Filesize
3.8MB

MD5
cbbca624f9fa6c71b4bb81537ac3d73b

SHA1
68a3433c8235b6032b860eb9495f747515a22b33

SHA256
a9cc92512d586691308fe5e24197b2662b60cbfcf2a1380228e7ae4b49bfaa11

SHA512
7ac534b7b9eb32aeb4836c3fde8d70d83f49462111fec7abb7b4b356c99cc25fab2f810de67cef0fd2a9582e50ad0c2b31357f01d27c5f2b60b235427f77de4a

Download Submit
C:\Users\Admin\AppData\Roaming\UI_2_1737972903923\WCUtil.dll

Filesize
180KB

MD5
a46a164cb1ff11eac8bc153edd9f80dc

SHA1
8f8f826ef17f62262ed58bf1b627131bacd4fbc6

SHA256
167624c3c5ca05855a71d0485df678ad18414318f084d449e4f2288c35d84c3f

SHA512
3b9149213df1038f81c472a3bf21258d323b717bba785c6c5c70774cfcc7a20452565e7ebed65be0c94e173f9597eb4dd1e68990589719c4e526ddfa0d8a2667

Download Submit
C:\Users\Admin\AppData\Roaming\UI_2_1737972903923\kickshaw.dxf

Filesize
1.1MB

MD5
f9ebe319c9e9d2767ad6e0d2e0dfc3c1

SHA1
4d1e295093c6d400649e14625a65c8e35804e477

SHA256
4ddba1a4a72855619d353e8246957689681668cb9067f68a546b61382bfb8edd

SHA512
50742b0f56e644bb0a0f8cc46ccb5226159cf06a3f830a722eaf53651daf5a6015412ae9f3362d8da81ae4e7fc0871bd72c6d1cc4f7648bfc894fc66c012bd87

Download Submit
memory/1096-896-0x00007FFE947D0000-0x00007FFE949C5000-memory.dmp

Filesize
2.0MB

Download
memory/1096-893-0x0000000074790000-0x000000007490B000-memory.dmp

Filesize
1.5MB

Download
memory/1720-941-0x0000000074790000-0x000000007490B000-memory.dmp

Filesize
1.5MB

Download
memory/1720-928-0x0000000074790000-0x000000007490B000-memory.dmp

Filesize
1.5MB

Download
memory/1720-927-0x00007FFE947D0000-0x00007FFE949C5000-memory.dmp

Filesize
2.0MB

Download
memory/2260-895-0x00007FFE947D0000-0x00007FFE949C5000-memory.dmp

Filesize
2.0MB

Download
memory/2260-894-0x0000000074790000-0x000000007490B000-memory.dmp

Filesize
1.5MB

Download
memory/2392-923-0x0000000074790000-0x000000007490B000-memory.dmp

Filesize
1.5MB

Download
memory/2392-915-0x0000000074790000-0x000000007490B000-memory.dmp

Filesize
1.5MB

Download
memory/2392-919-0x00007FFE947D0000-0x00007FFE949C5000-memory.dmp

Filesize
2.0MB

Download
memory/2624-920-0x000002B628F70000-0x000002B628FA0000-memory.dmp

Filesize
192KB

Download
memory/2924-965-0x00007FFE947D0000-0x00007FFE949C5000-memory.dmp

Filesize
2.0MB

Download
memory/2924-960-0x0000021019430000-0x000002101943A000-memory.dmp

Filesize
40KB

Download
memory/2924-964-0x0000021019800000-0x0000021019C00000-memory.dmp

Filesize
4.0MB

Download
memory/2924-967-0x00007FFE92370000-0x00007FFE92639000-memory.dmp

Filesize
2.8MB

Download
memory/2924-966-0x00007FFE93F40000-0x00007FFE93FFE000-memory.dmp

Filesize
760KB

Download
memory/3472-805-0x000002926C890000-0x000002926C8B2000-memory.dmp

Filesize
136KB

Download
memory/4140-953-0x00007FFE947D0000-0x00007FFE949C5000-memory.dmp

Filesize
2.0MB

Download
memory/4140-971-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/4140-977-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/4140-954-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/4140-998-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/4140-995-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/4140-992-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/4140-989-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/4140-974-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/4236-916-0x00007FFE947D0000-0x00007FFE949C5000-memory.dmp

Filesize
2.0MB

Download
memory/4236-914-0x0000000074790000-0x000000007490B000-memory.dmp

Filesize
1.5MB

Download
memory/4236-921-0x0000000074790000-0x000000007490B000-memory.dmp

Filesize
1.5MB

Download
memory/4732-766-0x00007FFE94700000-0x00007FFE94701000-memory.dmp

Filesize
4KB

Download
memory/4732-767-0x00007FFE93960000-0x00007FFE93961000-memory.dmp

Filesize
4KB

Download
memory/4732-897-0x000001C9DB060000-0x000001C9DB090000-memory.dmp

Filesize
192KB

Download
memory/4808-926-0x00007FFE947D0000-0x00007FFE949C5000-memory.dmp

Filesize
2.0MB

Download
memory/4808-944-0x0000000074790000-0x000000007490B000-memory.dmp

Filesize
1.5MB

Download
memory/4868-952-0x00007FF7FC240000-0x00007FF7FC2C7000-memory.dmp

Filesize
540KB

Download
memory/4868-963-0x00007FF7FC240000-0x00007FF7FC2C7000-memory.dmp

Filesize
540KB

Download
memory/4868-959-0x00007FFE92370000-0x00007FFE92639000-memory.dmp

Filesize
2.8MB

Download
memory/4868-957-0x00007FFE947D0000-0x00007FFE949C5000-memory.dmp

Filesize
2.0MB

Download
memory/4868-958-0x00007FFE93F40000-0x00007FFE93FFE000-memory.dmp

Filesize
760KB

Download
memory/4868-956-0x0000000003480000-0x0000000003880000-memory.dmp

Filesize
4.0MB

Download
memory/4868-955-0x0000000003480000-0x0000000003880000-memory.dmp

Filesize
4.0MB

Download