3c2a264125e31a22a5b1d1b92e8d93671498b5f3d093bebdad2566362695c183

Analysis

max time kernel
48s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
13/10/2023, 01:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

XMind-for-Windows-64bit-12.0.3-202206241736.exe
Size

94.6MB
MD5

f0186214e503891f98428c3ee06af9ce
SHA1

df01d2ad8155a8665ab49fe604b7b54d95b52e33
SHA256

3c2a264125e31a22a5b1d1b92e8d93671498b5f3d093bebdad2566362695c183
SHA512

d1e4bf352529c13ae8c93d5ea8a04666177905e178add6f9a3072ffc3562626d0a7830a80c21604bf20f2d1fec8df82acccddaabdcf65833e46ae954f6bc32ea
SSDEEP

1572864:0AgcWzgjFuXBX5jFikMcD41Op95BszWMZGZ7dH0eHW3sVFgHUofqkp8mA5ZEe:0AlWzgYDjd41OrzPZ9JVFg0BkpaOe

Score

5^/10

discovery persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Control Panel\International\Geo\Nation	XMind.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Control Panel\International\Geo\Nation	XMind.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\core-js\library\modules\_to-iobject.js	XMind-for-Windows-64bit-12.0.3-202206241736.exe
File opened for modification	C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\es5-ext\object\compare.js	XMind-for-Windows-64bit-12.0.3-202206241736.exe
File created	C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\native-keymap\deps\chromium\keyboard_codes.h	XMind-for-Windows-64bit-12.0.3-202206241736.exe
File created	C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\util-deprecate\package.json	XMind-for-Windows-64bit-12.0.3-202206241736.exe
File created	C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\core-js\modules\library\es6.regexp.flags.js	XMind-for-Windows-64bit-12.0.3-202206241736.exe
File created	C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\babel-runtime\helpers\classCallCheck.js	XMind-for-Windows-64bit-12.0.3-202206241736.exe
File created	C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\core-js\library\modules\_native-weak-map.js	XMind-for-Windows-64bit-12.0.3-202206241736.exe
File opened for modification	C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\core-js\web\dom-collections.js	XMind-for-Windows-64bit-12.0.3-202206241736.exe
File created	C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\es5-ext\array\#\slice\implement.js	XMind-for-Windows-64bit-12.0.3-202206241736.exe
File opened for modification	C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\ast-transform\node_modules\esutils\lib	XMind-for-Windows-64bit-12.0.3-202206241736.exe
File opened for modification	C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\babel-runtime\core-js\error\is-error.js	XMind-for-Windows-64bit-12.0.3-202206241736.exe
File opened for modification	C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\core-js\fn\string\virtual\match-all.js	XMind-for-Windows-64bit-12.0.3-202206241736.exe
File created	C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\core-js\library\modules\es6.string.link.js	XMind-for-Windows-64bit-12.0.3-202206241736.exe
File opened for modification	C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\core-js\library\modules\_set-species.js	XMind-for-Windows-64bit-12.0.3-202206241736.exe
File created	C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\fontkit\src\opentype\shapers\IndicShaper.js	XMind-for-Windows-64bit-12.0.3-202206241736.exe
File created	C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\pako\lib\zlib\inflate.js	XMind-for-Windows-64bit-12.0.3-202206241736.exe
File opened for modification	C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\core-js\fn\typed\array-buffer.js	XMind-for-Windows-64bit-12.0.3-202206241736.exe
File opened for modification	C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\core-js\library\fn\math\iaddh.js	XMind-for-Windows-64bit-12.0.3-202206241736.exe
File created	C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\core-js\library\modules\es6.math.log1p.js	XMind-for-Windows-64bit-12.0.3-202206241736.exe
File opened for modification	C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\core-js\modules\core.string.escape-html.js	XMind-for-Windows-64bit-12.0.3-202206241736.exe
File opened for modification	C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\core-js\modules\es6.number.max-safe-integer.js	XMind-for-Windows-64bit-12.0.3-202206241736.exe
File created	C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\core-js\modules\es7.reflect.metadata.js	XMind-for-Windows-64bit-12.0.3-202206241736.exe
File created	C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\restructure\src\Struct.js	XMind-for-Windows-64bit-12.0.3-202206241736.exe
File opened for modification	C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\pako\lib\zlib\inftrees.js	XMind-for-Windows-64bit-12.0.3-202206241736.exe
File opened for modification	C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\readable-stream\lib\internal\streams	XMind-for-Windows-64bit-12.0.3-202206241736.exe
File created	C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\ast-transform\node_modules\esprima\esprima.js	XMind-for-Windows-64bit-12.0.3-202206241736.exe
File created	C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\core-js\library\fn\weak-set\index.js	XMind-for-Windows-64bit-12.0.3-202206241736.exe
File opened for modification	C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\core-js\library\modules\_object-pie.js	XMind-for-Windows-64bit-12.0.3-202206241736.exe
File created	C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\es5-ext\function\#\copy.js	XMind-for-Windows-64bit-12.0.3-202206241736.exe
File opened for modification	C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\es6-set\is-native-implemented.js	XMind-for-Windows-64bit-12.0.3-202206241736.exe
File created	C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\nan\doc\errors.md	XMind-for-Windows-64bit-12.0.3-202206241736.exe
File opened for modification	C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\pako\lib\zlib\zstream.js	XMind-for-Windows-64bit-12.0.3-202206241736.exe
File created	C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\babel-runtime\helpers\create-class.js	XMind-for-Windows-64bit-12.0.3-202206241736.exe
File created	C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\core-js\library\fn\string\virtual\index.js	XMind-for-Windows-64bit-12.0.3-202206241736.exe
File opened for modification	C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\es6-symbol\is-native-implemented.js	XMind-for-Windows-64bit-12.0.3-202206241736.exe
File created	C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\htmlparser2\lib\CollectingHandler.js	XMind-for-Windows-64bit-12.0.3-202206241736.exe
File created	C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\native-keymap\build\Release\obj\keymapping\keymapping.tlog\CL.command.1.tlog	XMind-for-Windows-64bit-12.0.3-202206241736.exe
File opened for modification	C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\babel-runtime\helpers\define-property.js	XMind-for-Windows-64bit-12.0.3-202206241736.exe
File opened for modification	C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\es5-ext\date\#\days-in-month.js	XMind-for-Windows-64bit-12.0.3-202206241736.exe
File created	C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\es5-ext\number\is-finite\implement.js	XMind-for-Windows-64bit-12.0.3-202206241736.exe
File created	C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\es5-ext\object\entries\shim.js	XMind-for-Windows-64bit-12.0.3-202206241736.exe
File created	C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\regedit\node_modules\readable-stream\lib\_stream_duplex.js	XMind-for-Windows-64bit-12.0.3-202206241736.exe
File opened for modification	C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\acorn	XMind-for-Windows-64bit-12.0.3-202206241736.exe
File created	C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\acorn-walk\dist\walk.js.map	XMind-for-Windows-64bit-12.0.3-202206241736.exe
File created	C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\fontkit\src\opentype\GlyphInfo.js	XMind-for-Windows-64bit-12.0.3-202206241736.exe
File created	C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\readable-stream\readable-browser.js	XMind-for-Windows-64bit-12.0.3-202206241736.exe
File opened for modification	C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\babel-runtime\core-js\reflect\set-prototype-of.js	XMind-for-Windows-64bit-12.0.3-202206241736.exe
File opened for modification	C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\core-js\library\modules\_is-regexp.js	XMind-for-Windows-64bit-12.0.3-202206241736.exe
File created	C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\has\LICENSE-MIT	XMind-for-Windows-64bit-12.0.3-202206241736.exe
File created	C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\regedit\node_modules\isarray\build\build.js	XMind-for-Windows-64bit-12.0.3-202206241736.exe
File opened for modification	C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\util-deprecate\package.json	XMind-for-Windows-64bit-12.0.3-202206241736.exe
File created	C:\Program Files\XMind\locales\hu.pak	XMind-for-Windows-64bit-12.0.3-202206241736.exe
File created	C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\core-js\fn\array\filter.js	XMind-for-Windows-64bit-12.0.3-202206241736.exe
File created	C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\deep-equal\package.json	XMind-for-Windows-64bit-12.0.3-202206241736.exe
File opened for modification	C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\es5-ext\function\#\index.js	XMind-for-Windows-64bit-12.0.3-202206241736.exe
File created	C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\fontkit\src\tables\directory.js	XMind-for-Windows-64bit-12.0.3-202206241736.exe
File created	C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\convert-source-map\index.js	XMind-for-Windows-64bit-12.0.3-202206241736.exe
File created	C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\xmind-vana-osx-tokenizer\package.json	XMind-for-Windows-64bit-12.0.3-202206241736.exe
File created	C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\es5-ext\array\#\index.js	XMind-for-Windows-64bit-12.0.3-202206241736.exe
File created	C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\ext\node_modules\type\number\ensure.js	XMind-for-Windows-64bit-12.0.3-202206241736.exe
File created	C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\fontkit\src\tables\morx.js	XMind-for-Windows-64bit-12.0.3-202206241736.exe
File opened for modification	C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\oauth\LICENSE	XMind-for-Windows-64bit-12.0.3-202206241736.exe
File opened for modification	C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\esutils	XMind-for-Windows-64bit-12.0.3-202206241736.exe
File created	C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\readable-stream\lib\internal\streams\stream.js	XMind-for-Windows-64bit-12.0.3-202206241736.exe

Executes dropped EXE 5 IoCs

pid	Process
4232	XMind.exe
556	XMind.exe
4444	XMind.exe
4452	XMind.exe
5088	XMind.exe

Loads dropped DLL 19 IoCs

pid	Process
2320	XMind-for-Windows-64bit-12.0.3-202206241736.exe
2320	XMind-for-Windows-64bit-12.0.3-202206241736.exe
2320	XMind-for-Windows-64bit-12.0.3-202206241736.exe
2320	XMind-for-Windows-64bit-12.0.3-202206241736.exe
2320	XMind-for-Windows-64bit-12.0.3-202206241736.exe
2320	XMind-for-Windows-64bit-12.0.3-202206241736.exe
2320	XMind-for-Windows-64bit-12.0.3-202206241736.exe
2320	XMind-for-Windows-64bit-12.0.3-202206241736.exe
2320	XMind-for-Windows-64bit-12.0.3-202206241736.exe
1232	regsvr32.exe
4408	regsvr32.exe
4232	XMind.exe
4444	XMind.exe
556	XMind.exe
556	XMind.exe
556	XMind.exe
556	XMind.exe
4452	XMind.exe
5088	XMind.exe

Registers COM server for autorun 1 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DC87822F-79AE-4553-84F6-B03DE7645DC1}\InProcServer32\ = "C:\\Program Files\\XMind\\resources\\app.asar.unpacked\\static\\native\\XMindShellExt.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DC87822F-79AE-4553-84F6-B03DE7645DC1}\InProcServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{046A62C6-3E11-4002-BF9B-08416E236570}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{046A62C6-3E11-4002-BF9B-08416E236570}\InProcServer32\ = "C:\\Program Files\\XMind\\resources\\app.asar.unpacked\\static\\native\\XMindShellExt.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{046A62C6-3E11-4002-BF9B-08416E236570}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{DC87822F-79AE-4553-84F6-B03DE7645DC1}\InProcServer32	regsvr32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\xmind\URL Protocol	XMind-for-Windows-64bit-12.0.3-202206241736.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\xmind\shell	XMind-for-Windows-64bit-12.0.3-202206241736.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\xmind\shell\Open\	XMind-for-Windows-64bit-12.0.3-202206241736.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\xmind-zen\URL Protocol	XMind-for-Windows-64bit-12.0.3-202206241736.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\XMind Workbook\DefaultIcon\ = "C:\\Program Files\\XMind\\resources\\xmind_file.ico"	XMind-for-Windows-64bit-12.0.3-202206241736.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.xmind\TypeOverlay	regsvr32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{F6F00E65-9CAF-43BB-809A-38AA4621BCF2}\PersistentAddinsRegistered	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\XMind Workbook\shell\ = "open"	XMind-for-Windows-64bit-12.0.3-202206241736.exe
Key created	\REGISTRY\MACHINE\Software\Classes\XMind Workbook\shell\open\command	XMind-for-Windows-64bit-12.0.3-202206241736.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\xmind-zen\DefaultIcon\ = "C:\\Program Files\\XMind\\XMind.exe"	XMind-for-Windows-64bit-12.0.3-202206241736.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{F6F00E65-9CAF-43BB-809A-38AA4621BCF2}\PersistentAddinsRegistered\{89BCB740-6119-101A-BCB7-00DD010655AF}	regsvr32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.xmind\PersistentHandler	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\xmind-zen\shell\open	XMind.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\xmind-zen\ = "URL:xmind-zen"	XMind.exe
Key created	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\xmind-zen\shell\open\command	XMind.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.xmind	XMind-for-Windows-64bit-12.0.3-202206241736.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{DC87822F-79AE-4553-84F6-B03DE7645DC1}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\xmind	XMind-for-Windows-64bit-12.0.3-202206241736.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\xmind\shell\Open\command\ = "C:\\Program Files\\XMind\\XMind.exe %1"	XMind-for-Windows-64bit-12.0.3-202206241736.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\xmind-zen\shell	XMind-for-Windows-64bit-12.0.3-202206241736.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\xmind-zen\URL Protocol	XMind.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.xmind\XMind Workbook_backup	XMind-for-Windows-64bit-12.0.3-202206241736.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.xmind\ShellEx\{e357fccd-a995-4576-b01f-234630154e96}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F6F00E65-9CAF-43BB-809A-38AA4621BCF2}\ = "XMind Persistent Handler"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\xmind\DefaultIcon\ = "C:\\Program Files\\XMind\\XMind.exe"	XMind-for-Windows-64bit-12.0.3-202206241736.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\xmind-zen\shell\Open\	XMind-for-Windows-64bit-12.0.3-202206241736.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\XMind Workbook\ = "XMind Workbook"	XMind-for-Windows-64bit-12.0.3-202206241736.exe
Key created	\REGISTRY\MACHINE\Software\Classes\XMind Workbook\DefaultIcon	XMind-for-Windows-64bit-12.0.3-202206241736.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.xmind	regsvr32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{046A62C6-3E11-4002-BF9B-08416E236570}\InProcServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\xmind\DefaultIcon	XMind-for-Windows-64bit-12.0.3-202206241736.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\xmind\shell\	XMind-for-Windows-64bit-12.0.3-202206241736.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\xmind-zen\ = "URL:xmind-zen"	XMind-for-Windows-64bit-12.0.3-202206241736.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{DC87822F-79AE-4553-84F6-B03DE7645DC1}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DC87822F-79AE-4553-84F6-B03DE7645DC1}\InProcServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{046A62C6-3E11-4002-BF9B-08416E236570}	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\xmind-zen\shell	XMind.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{046A62C6-3E11-4002-BF9B-08416E236570}\ = "XMind Filter Handler"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\xmind\ = "URL:xmind"	XMind-for-Windows-64bit-12.0.3-202206241736.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\xmind-zen	XMind-for-Windows-64bit-12.0.3-202206241736.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\xmind\shell\Open	XMind-for-Windows-64bit-12.0.3-202206241736.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\xmind-zen\shell\	XMind-for-Windows-64bit-12.0.3-202206241736.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\xmind-zen\shell\Open\command	XMind-for-Windows-64bit-12.0.3-202206241736.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\xmind-zen\shell\Open\command\ = "C:\\Program Files\\XMind\\XMind.exe %1"	XMind-for-Windows-64bit-12.0.3-202206241736.exe
Key created	\REGISTRY\MACHINE\Software\Classes\XMind Workbook\shell	XMind-for-Windows-64bit-12.0.3-202206241736.exe
Key created	\REGISTRY\MACHINE\Software\Classes\XMind Workbook\shell\open	XMind-for-Windows-64bit-12.0.3-202206241736.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DC87822F-79AE-4553-84F6-B03DE7645DC1}\ = "XMind Thumbnail Provider"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\xmind\shell\Open\command	XMind-for-Windows-64bit-12.0.3-202206241736.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\xmind-zen\DefaultIcon	XMind-for-Windows-64bit-12.0.3-202206241736.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.xmind\ = "XMind Workbook"	XMind-for-Windows-64bit-12.0.3-202206241736.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{046A62C6-3E11-4002-BF9B-08416E236570}\InProcServer32\ = "C:\\Program Files\\XMind\\resources\\app.asar.unpacked\\static\\native\\XMindShellExt.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.xmind\PersistentHandler\ = "{F6F00E65-9CAF-43BB-809A-38AA4621BCF2}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.xmind\ShellEx	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{046A62C6-3E11-4002-BF9B-08416E236570}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F6F00E65-9CAF-43BB-809A-38AA4621BCF2}\PersistentAddinsRegistered\	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\XMind Workbook\shell\open\ = "Open with XMind"	XMind-for-Windows-64bit-12.0.3-202206241736.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\XMind Workbook\shell\open\command\ = "C:\\Program Files\\XMind\\XMind.exe \"%1\""	XMind-for-Windows-64bit-12.0.3-202206241736.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.xmind\ShellEx\{e357fccd-a995-4576-b01f-234630154e96}\ = "{DC87822F-79AE-4553-84F6-B03DE7645DC1}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DC87822F-79AE-4553-84F6-B03DE7645DC1}\InProcServer32\ = "C:\\Program Files\\XMind\\resources\\app.asar.unpacked\\static\\native\\XMindShellExt.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.xmind	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\xmind-zen\shell\open\command\ = "\"C:\\Program Files\\XMind\\XMind.exe\" \"%1\""	XMind.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F6F00E65-9CAF-43BB-809A-38AA4621BCF2}\PersistentAddinsRegistered\{89BCB740-6119-101A-BCB7-00DD010655AF}\ = "{046A62C6-3E11-4002-BF9B-08416E236570}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\xmind-zen\shell\Open	XMind-for-Windows-64bit-12.0.3-202206241736.exe
Key created	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\xmind-zen	XMind.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2320	XMind-for-Windows-64bit-12.0.3-202206241736.exe
2320	XMind-for-Windows-64bit-12.0.3-202206241736.exe
2320	XMind-for-Windows-64bit-12.0.3-202206241736.exe
2320	XMind-for-Windows-64bit-12.0.3-202206241736.exe
2320	XMind-for-Windows-64bit-12.0.3-202206241736.exe
2320	XMind-for-Windows-64bit-12.0.3-202206241736.exe
4452	XMind.exe
4452	XMind.exe
5088	XMind.exe
5088	XMind.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeSecurityPrivilege	2320	XMind-for-Windows-64bit-12.0.3-202206241736.exe
Token: SeIncreaseQuotaPrivilege	4700	WMIC.exe
Token: SeSecurityPrivilege	4700	WMIC.exe
Token: SeTakeOwnershipPrivilege	4700	WMIC.exe
Token: SeLoadDriverPrivilege	4700	WMIC.exe
Token: SeSystemProfilePrivilege	4700	WMIC.exe
Token: SeSystemtimePrivilege	4700	WMIC.exe
Token: SeProfSingleProcessPrivilege	4700	WMIC.exe
Token: SeIncBasePriorityPrivilege	4700	WMIC.exe
Token: SeCreatePagefilePrivilege	4700	WMIC.exe
Token: SeBackupPrivilege	4700	WMIC.exe
Token: SeRestorePrivilege	4700	WMIC.exe
Token: SeShutdownPrivilege	4700	WMIC.exe
Token: SeDebugPrivilege	4700	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4700	WMIC.exe
Token: SeRemoteShutdownPrivilege	4700	WMIC.exe
Token: SeUndockPrivilege	4700	WMIC.exe
Token: SeManageVolumePrivilege	4700	WMIC.exe
Token: 33	4700	WMIC.exe
Token: 34	4700	WMIC.exe
Token: 35	4700	WMIC.exe
Token: 36	4700	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4700	WMIC.exe
Token: SeSecurityPrivilege	4700	WMIC.exe
Token: SeTakeOwnershipPrivilege	4700	WMIC.exe
Token: SeLoadDriverPrivilege	4700	WMIC.exe
Token: SeSystemProfilePrivilege	4700	WMIC.exe
Token: SeSystemtimePrivilege	4700	WMIC.exe
Token: SeProfSingleProcessPrivilege	4700	WMIC.exe
Token: SeIncBasePriorityPrivilege	4700	WMIC.exe
Token: SeCreatePagefilePrivilege	4700	WMIC.exe
Token: SeBackupPrivilege	4700	WMIC.exe
Token: SeRestorePrivilege	4700	WMIC.exe
Token: SeShutdownPrivilege	4700	WMIC.exe
Token: SeDebugPrivilege	4700	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4700	WMIC.exe
Token: SeRemoteShutdownPrivilege	4700	WMIC.exe
Token: SeUndockPrivilege	4700	WMIC.exe
Token: SeManageVolumePrivilege	4700	WMIC.exe
Token: 33	4700	WMIC.exe
Token: 34	4700	WMIC.exe
Token: 35	4700	WMIC.exe
Token: 36	4700	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2320	WMIC.exe
Token: SeSecurityPrivilege	2320	WMIC.exe
Token: SeTakeOwnershipPrivilege	2320	WMIC.exe
Token: SeLoadDriverPrivilege	2320	WMIC.exe
Token: SeSystemProfilePrivilege	2320	WMIC.exe
Token: SeSystemtimePrivilege	2320	WMIC.exe
Token: SeProfSingleProcessPrivilege	2320	WMIC.exe
Token: SeIncBasePriorityPrivilege	2320	WMIC.exe
Token: SeCreatePagefilePrivilege	2320	WMIC.exe
Token: SeBackupPrivilege	2320	WMIC.exe
Token: SeRestorePrivilege	2320	WMIC.exe
Token: SeShutdownPrivilege	2320	WMIC.exe
Token: SeDebugPrivilege	2320	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2320	WMIC.exe
Token: SeRemoteShutdownPrivilege	2320	WMIC.exe
Token: SeUndockPrivilege	2320	WMIC.exe
Token: SeManageVolumePrivilege	2320	WMIC.exe
Token: 33	2320	WMIC.exe
Token: 34	2320	WMIC.exe
Token: 35	2320	WMIC.exe
Token: 36	2320	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 1232	2320	XMind-for-Windows-64bit-12.0.3-202206241736.exe	92
PID 2320 wrote to memory of 1232	2320	XMind-for-Windows-64bit-12.0.3-202206241736.exe	92
PID 2320 wrote to memory of 1232	2320	XMind-for-Windows-64bit-12.0.3-202206241736.exe	92
PID 1232 wrote to memory of 4408	1232	regsvr32.exe	93
PID 1232 wrote to memory of 4408	1232	regsvr32.exe	93
PID 4232 wrote to memory of 4924	4232	XMind.exe	98
PID 4232 wrote to memory of 4924	4232	XMind.exe	98
PID 4924 wrote to memory of 4700	4924	cmd.exe	99
PID 4924 wrote to memory of 4700	4924	cmd.exe	99
PID 4232 wrote to memory of 556	4232	XMind.exe	100
PID 4232 wrote to memory of 556	4232	XMind.exe	100
PID 4232 wrote to memory of 556	4232	XMind.exe	100
PID 4232 wrote to memory of 556	4232	XMind.exe	100
PID 4232 wrote to memory of 556	4232	XMind.exe	100
PID 4232 wrote to memory of 556	4232	XMind.exe	100
PID 4232 wrote to memory of 556	4232	XMind.exe	100
PID 4232 wrote to memory of 556	4232	XMind.exe	100
PID 4232 wrote to memory of 556	4232	XMind.exe	100
PID 4232 wrote to memory of 556	4232	XMind.exe	100
PID 4232 wrote to memory of 556	4232	XMind.exe	100
PID 4232 wrote to memory of 556	4232	XMind.exe	100
PID 4232 wrote to memory of 556	4232	XMind.exe	100
PID 4232 wrote to memory of 556	4232	XMind.exe	100
PID 4232 wrote to memory of 556	4232	XMind.exe	100
PID 4232 wrote to memory of 556	4232	XMind.exe	100
PID 4232 wrote to memory of 556	4232	XMind.exe	100
PID 4232 wrote to memory of 556	4232	XMind.exe	100
PID 4232 wrote to memory of 556	4232	XMind.exe	100
PID 4232 wrote to memory of 556	4232	XMind.exe	100
PID 4232 wrote to memory of 556	4232	XMind.exe	100
PID 4232 wrote to memory of 556	4232	XMind.exe	100
PID 4232 wrote to memory of 556	4232	XMind.exe	100
PID 4232 wrote to memory of 556	4232	XMind.exe	100
PID 4232 wrote to memory of 556	4232	XMind.exe	100
PID 4232 wrote to memory of 556	4232	XMind.exe	100
PID 4232 wrote to memory of 556	4232	XMind.exe	100
PID 4232 wrote to memory of 556	4232	XMind.exe	100
PID 4232 wrote to memory of 556	4232	XMind.exe	100
PID 4232 wrote to memory of 556	4232	XMind.exe	100
PID 4232 wrote to memory of 556	4232	XMind.exe	100
PID 4232 wrote to memory of 556	4232	XMind.exe	100
PID 4232 wrote to memory of 556	4232	XMind.exe	100
PID 4232 wrote to memory of 556	4232	XMind.exe	100
PID 4232 wrote to memory of 556	4232	XMind.exe	100
PID 4232 wrote to memory of 556	4232	XMind.exe	100
PID 4232 wrote to memory of 556	4232	XMind.exe	100
PID 4232 wrote to memory of 556	4232	XMind.exe	100
PID 4232 wrote to memory of 556	4232	XMind.exe	100
PID 4232 wrote to memory of 556	4232	XMind.exe	100
PID 4232 wrote to memory of 4444	4232	XMind.exe	101
PID 4232 wrote to memory of 4444	4232	XMind.exe	101
PID 4232 wrote to memory of 3988	4232	XMind.exe	111
PID 4232 wrote to memory of 3988	4232	XMind.exe	111
PID 4232 wrote to memory of 3356	4232	XMind.exe	103
PID 4232 wrote to memory of 3356	4232	XMind.exe	103
PID 4232 wrote to memory of 2256	4232	XMind.exe	104
PID 4232 wrote to memory of 2256	4232	XMind.exe	104
PID 4232 wrote to memory of 2192	4232	XMind.exe	110
PID 4232 wrote to memory of 2192	4232	XMind.exe	110
PID 4232 wrote to memory of 4452	4232	XMind.exe	102
PID 4232 wrote to memory of 4452	4232	XMind.exe	102
PID 4232 wrote to memory of 5088	4232	XMind.exe	112
PID 4232 wrote to memory of 5088	4232	XMind.exe	112
PID 4232 wrote to memory of 764	4232	XMind.exe	113

C:\Users\Admin\AppData\Local\Temp\XMind-for-Windows-64bit-12.0.3-202206241736.exe
"C:\Users\Admin\AppData\Local\Temp\XMind-for-Windows-64bit-12.0.3-202206241736.exe"
1⤵
- Drops file in Program Files directory
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Windows\SysWOW64\regsvr32.exe
  "regsvr32.exe" /s "C:\Program Files\XMind\resources\app.asar.unpacked\static\native\XMindShellExt.dll"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1232
- - C:\Windows\system32\regsvr32.exe
    /s "C:\Program Files\XMind\resources\app.asar.unpacked\static\native\XMindShellExt.dll"
    3⤵
    - Loads dropped DLL
    - Registers COM server for autorun
    - Modifies registry class
    PID:4408

C:\Program Files\XMind\XMind.exe
"C:\Program Files\XMind\XMind.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4232
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\wbem\wmic.exe os get Caption"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4924
- - C:\Windows\system32\wbem\WMIC.exe
    C:\Windows\system32\wbem\wmic.exe os get Caption
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4700
- C:\Program Files\XMind\XMind.exe
  "C:\Program Files\XMind\XMind.exe" --type=gpu-process --field-trial-handle=1828,4614274627749934042,7546787652168087208,131072 --disable-features=FormControlsRefresh,PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --user-data-dir="C:\Users\Admin\AppData\Roaming\XMind\Electron v3" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAANAAAAEAAAAAAAAAABAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1840 /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:556
- C:\Program Files\XMind\XMind.exe
  "C:\Program Files\XMind\XMind.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\XMind\Electron v3" /prefetch:7 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\XMind\Electron v3\Crashpad" --url=https://www.xmind.net/_api/vana-error-report "--annotation=_companyName=XMind Ltd." --annotation=_productName=XMind --annotation=_version=12.0.3 --annotation=prod=Electron --annotation=ver=16.0.6 --initial-client-data=0x7c4,0x7c8,0x7cc,0x7c0,0x7d0,0x7ff7d2e029d8,0x7ff7d2e029e8,0x7ff7d2e029f8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4444
- C:\Program Files\XMind\XMind.exe
  "C:\Program Files\XMind\XMind.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1828,4614274627749934042,7546787652168087208,131072 --disable-features=FormControlsRefresh,PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\XMind\Electron v3" --standard-schemes=cache --secure-schemes=cache --bypasscsp-schemes --cors-schemes --fetch-schemes --service-worker-schemes --streaming-schemes --mojo-platform-channel-handle=2120 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:4452
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic CsProduct Get UUID"
  2⤵
  PID:3356
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic CsProduct Get UUID
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2320
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\wbem\wmic.exe baseboard get /value"
  2⤵
  PID:2256
- - C:\Windows\system32\wbem\WMIC.exe
    C:\Windows\system32\wbem\wmic.exe baseboard get /value
    3⤵
    PID:5068
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\wbem\wmic.exe csproduct get /value"
  2⤵
  PID:2192
- - C:\Windows\system32\wbem\WMIC.exe
    C:\Windows\system32\wbem\wmic.exe csproduct get /value
    3⤵
    PID:1408
- C:\Windows\system32\cscript.exe
  cscript.exe
  2⤵
  PID:3988
- C:\Program Files\XMind\XMind.exe
  "C:\Program Files\XMind\XMind.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\XMind\Electron v3" --standard-schemes=cache --secure-schemes=cache --bypasscsp-schemes --cors-schemes --fetch-schemes --service-worker-schemes --streaming-schemes --app-path="C:\Program Files\XMind\resources\app.asar" --no-sandbox --no-zygote --force-color-profile=srgb --field-trial-handle=1828,4614274627749934042,7546787652168087208,131072 --disable-features=FormControlsRefresh,PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2604 /prefetch:1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:5088
- C:\Windows\system32\cscript.exe
  cscript.exe //Nologo "C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\regedit\vbs\regList.wsf" A HKCR\.xmind "HKCR\XMind Workbook\shell\open\command"
  2⤵
  PID:764
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\wbem\wmic.exe /namespace:\\root\wmi path MS_SystemInformation get /value"
  2⤵
  PID:4556
- - C:\Windows\system32\wbem\WMIC.exe
    C:\Windows\system32\wbem\wmic.exe /namespace:\\root\wmi path MS_SystemInformation get /value
    3⤵
    PID:1312

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\XMind\XMind.exe

Filesize
133.5MB

MD5
2d68586fee3e3916c68adf927b539bcd

SHA1
2458681015cad6302634cdd559aa572daa562306

SHA256
1d6fa9dc10498c1d48b1857da4d7f8cf4397478c4e55bd6fe24c082afe887c2d

SHA512
76ac9d62fda48b874301998eb3b07fa35503b603123743f12e97b52cec84fb8265b0098ef3fd6bc052e668acb1e04f9f7da7e5bd4225365de368478e218ad7f1

Download Submit
C:\Program Files\XMind\XMind.exe

Filesize
133.5MB

MD5
2d68586fee3e3916c68adf927b539bcd

SHA1
2458681015cad6302634cdd559aa572daa562306

SHA256
1d6fa9dc10498c1d48b1857da4d7f8cf4397478c4e55bd6fe24c082afe887c2d

SHA512
76ac9d62fda48b874301998eb3b07fa35503b603123743f12e97b52cec84fb8265b0098ef3fd6bc052e668acb1e04f9f7da7e5bd4225365de368478e218ad7f1

Download Submit
C:\Program Files\XMind\XMind.exe

Filesize
133.5MB

MD5
2d68586fee3e3916c68adf927b539bcd

SHA1
2458681015cad6302634cdd559aa572daa562306

SHA256
1d6fa9dc10498c1d48b1857da4d7f8cf4397478c4e55bd6fe24c082afe887c2d

SHA512
76ac9d62fda48b874301998eb3b07fa35503b603123743f12e97b52cec84fb8265b0098ef3fd6bc052e668acb1e04f9f7da7e5bd4225365de368478e218ad7f1

Download Submit
C:\Program Files\XMind\ffmpeg.dll

Filesize
2.6MB

MD5
23a5146bb672822ee001e39c74851df5

SHA1
a8dcef52637fd7d9b3b2a72c6200c3adf88b5266

SHA256
2c07f5cc7667d49c5635b373edd851cc92ae1f05cc05446b501720d99155c83a

SHA512
034f971ba9979801b688197990ee55a2bc8118b38be446f38fb8c4299ba180a22a33b84a1b6811daf4f18f1d413960bd1ceede4a7eeba3116f0836409c885dc2

Download Submit
C:\Program Files\XMind\ffmpeg.dll

Filesize
2.6MB

MD5
23a5146bb672822ee001e39c74851df5

SHA1
a8dcef52637fd7d9b3b2a72c6200c3adf88b5266

SHA256
2c07f5cc7667d49c5635b373edd851cc92ae1f05cc05446b501720d99155c83a

SHA512
034f971ba9979801b688197990ee55a2bc8118b38be446f38fb8c4299ba180a22a33b84a1b6811daf4f18f1d413960bd1ceede4a7eeba3116f0836409c885dc2

Download Submit
C:\Program Files\XMind\icudtl.dat

Filesize
9.7MB

MD5
2e7d2f6c3eed51f5eca878a466a1ab4e

SHA1
759bd98d218d7e392819107fab2a8fd1cfc63ddf

SHA256
b62b7240837172959299dc3be44fffa83dc374353154eca1612e1bde330aa8fa

SHA512
0f1465e8efe32b0eaba628a30bbb21254a05d80f4407a1434120a55fb928cf575b3879e1b7cf754cd19b23c262ae715fa84a8049073563cb38f1855be7db1124

Download Submit
C:\Program Files\XMind\resources\app.asar

Filesize
87.5MB

MD5
9d9bd5e75e4d45c4d2002bc29bcd2c93

SHA1
d1a4b4f6997ef5f897f2ff3d90636bdc2f0e3b45

SHA256
558ffb8bd1cfadd304abd9b42f6277eb10567ca64c748052a8670557ca931935

SHA512
24927046ae96abafd0fc04630601956b16db51a16b435cca677d2e3d6186f0f1fdb09578fd666af635de6270d8d6423f72ff71cc5a70d497da8eff73d1781d6c

Download Submit
C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\core-js\library\core\_.js

Filesize
90B

MD5
d861fb3b00fb776dcb6fc4887c4ac80c

SHA1
8fcd44d9d8fe3703a8bf46e80bb8579bffae30dc

SHA256
ba4cb2dcf8dc6eceeab3abc32113c8638ae91846103d2d4c474b00db4e43c288

SHA512
ed28ca9a537c67b13f3ba920a54dd95d4d8c5b0b8640cbc363871c0c04fb588d9e93ae23d2540ff0ac4c28a4109ba94bd54fe2db64b1c37a99d93ef757eff75c

Download Submit
C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\core-js\library\core\delay.js

Filesize
86B

MD5
63aac485c8a03510b81a0a4c2bd18336

SHA1
228e248f7f9bce1c79f1b01fbc1045cb6b399cc1

SHA256
4ef6161fba95bdc34b0fb5945e5b3f1355970f8313ac674844399f655e6c0749

SHA512
abc27628797b3cd178f5cf8b0154fb9462300cb9f8f8f2bb423f4591d13d650a9f03c1df3365736897ee1bdc5f18330cd14b38a3eb54f396ff027af624cb8961

Download Submit
C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\core-js\library\core\dict.js

Filesize
84B

MD5
feba9cdeebb0c7261fab886a8170c624

SHA1
84914f9f137bc04a4752ee4cd07eeafb96caabc2

SHA256
304a950897124b7b29258e753a93b4b210ac81bbadb56430456ba13fa92bc63a

SHA512
6ee04f9a3a737ef0164fa64cb9da3ac7bedb21c62f48279234ee0e9239e018b29d92d2e9841e4d914d23aa7f6f9b93b886cc6023369e6066910e95d4707af210

Download Submit
C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\core-js\library\es6\parse-float.js

Filesize
96B

MD5
f97592318c11d79ac384a28eb3373eda

SHA1
01735a2d9abd3d186c33628d650032c8bd975118

SHA256
23ffcf84d3fbb79d648aa6aa81630770167473eb37b6793d954e72a1ffd3f5dc

SHA512
7d475bccd7457cda247ee8ab41ea5b91c97537ef9122c872b9309adddfe634b2f32f5913668bde13cf24286691317d8bd3163333970e85c6a739d9864e45118e

Download Submit
C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\core-js\library\es6\parse-int.js

Filesize
92B

MD5
e9475584baa3e867e8bd82b5149bc3aa

SHA1
76db73513547102678147feb20c7ba6cb08aa080

SHA256
1abbde1b0225f65ccee86057a43413a39a8d0afc19c53a68df09ab4d21f0495b

SHA512
161c9df7aa88aaca2f3309fbf73de74abaed4784ecc9e7e30ecb2c19e599e89ba0bf271a5e9f93081d9121ee616760f50b84102dc317fb599dd76a7faa982932

Download Submit
C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\core-js\library\es7\asap.js

Filesize
83B

MD5
23332027d2dd56a4d6c979819e53dbf9

SHA1
886a1a46374a861e623fcccfcb0d366195961a1b

SHA256
8b55f5c7192f9e924ccb0b2242e0eed768edb5fb82a84afa99dd17c2329ae785

SHA512
0cb0292f95a6405cb7dcc353827a20d0dd487ff621109bc2d3f47ce63962c82c5d0e448f8f29ce6e447e29f49d8120ad7c7858fdeed4f72cec110fb82170df38

Download Submit
C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\core-js\library\es7\global.js

Filesize
87B

MD5
8b496bc0ff982b0ccf81f5842ad9c525

SHA1
44f4d9111918bb8870e9bb1ea3d3646036704bee

SHA256
ca93cf817b932fe1b63ac6893032c909a18044af122f7e33edd23baf0f990b2b

SHA512
efbaeb94d885aff7c0dd42ea0e5fa42ef1bae612a68165315a5292b722fc62bd22df5460e62e67e281465faa87f481ec6c2b34b82f042ed4271a8d8a7fed42b3

Download Submit
C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\core-js\library\es7\observable.js

Filesize
302B

MD5
2f3b12af0c02ed1a6e3ffc65938a2ff4

SHA1
52bf2478fdaebcef1c6175b92bc86dcd8bb7ca91

SHA256
f9e31ae42e64925f52e8c1fca5d076f0e5be5b569f58175547f2d3f10e4798b0

SHA512
cef46ccb458a7260fa617834dd3a9a0959e32dcc9b8404877d7bb414798d83cf010ae776136e54cca967ec2580f9b2bd15e01f258b8e4b41afd0fca5d324acf3

Download Submit
C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\core-js\library\fn\array\iterator.js

Filesize
107B

MD5
8af75261a9d4acd038eebe3e14f3e4c0

SHA1
ed8f2bf8f0494b0d4e0c48253794f2c5a1b589ce

SHA256
69882a5b076557ee650eda42dd08bf78af5d2c8e01c1b088f80a73a01e2662b0

SHA512
369fea607683418b3ed0be3eb275aaac870d81a7b3ca1420e0f2342cc10acc2ea2ea85835a9bd3397a9098b04692b51eeca6b207e04dc924d18d8762a0a95912

Download Submit
C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\core-js\library\fn\array\virtual\iterator.js

Filesize
111B

MD5
1dcae10ca0ff8eb66e087f2e4d7f965b

SHA1
39f0c9dc16b79ab1ef17a4294809f2b9e6c48979

SHA256
20135e71d292926d9eba2d671cc2640e5d8c30f0d959192205baca226aed6d6b

SHA512
b79bd8602aac31b6148b3c0417952fe3810c172ce9826852720314b662804258f76dfca45fdbf815d13e49e27deddea4d538543d9ccbdbead93993f72efe6be9

Download Submit
C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\core-js\library\fn\string\trim-end.js

Filesize
114B

MD5
8d512324b9d6076af859b59db71d9cf0

SHA1
de59c3f523cceabea6f82661084cff2ee4f26de5

SHA256
90f0b9b385056e6ef1f835e61ae9b570eee316996c25e9475de05868c7a5643a

SHA512
7279f6bd08d3ffa9fd15b5394ee6c7e365fe5e03c5c6760d0c3e9992e4f62d162ac9411299a26232bfcadb7af0759b5de343d77e9ad12b480ee30126a064c2b8

Download Submit
C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\core-js\library\fn\string\trim-left.js

Filesize
112B

MD5
c20d7e5fe76586da1ca03eb874dadcfd

SHA1
005ad020f1f4eed2f58d3d45c6dfecee9102a26f

SHA256
01ecb3f44047f84ae19e19cb04fbb1981858a76f10e31c8348aea5d50733e9e1

SHA512
d7ac9e9016d6fd72574b1b926e58931978c776fb7d9a8f9bdef8c010d66efe20d4455b49447534c0d62746544f55d18f9c81dcf49cbcb91f4419ac490704c7ef

Download Submit
C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\core-js\library\fn\string\virtual\trim-end.js

Filesize
132B

MD5
12c991cc36c539d9bff707683095cc51

SHA1
78e99892601b60b7ba2d6eb4f7215321a1bd2a5c

SHA256
8d2bf543e52a43287fe02f0629594217a0074f4f33316acf9357e2ae6da4c028

SHA512
7e813177c98b003bea79c788d57beb1fa2506076a5a9361d9b72adb096ae9396e7275f91d084802916454ac94bddd842649d6e7d56416635a2ead3d6de03240b

Download Submit
C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\core-js\library\fn\string\virtual\trim-left.js

Filesize
130B

MD5
1ddc49fc1cb2ecdc2bdabdd87203a8a8

SHA1
392ae1870d0e5f5e63b8ce5dcec3f9ece242065d

SHA256
d77989a2bb34e82a0385b08e4228b303cadcfd1add1a0fd3694d8771f8b56420

SHA512
efe1a445197e53a7b73c2df27303693246755f21724cd3a4c9c2a581873faf0e468fa0209ec6d86d9bbce38532cd22d054de1c74569728da9d6682247b9df6b1

Download Submit
C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\core-js\library\modules\_regexp-exec.js

Filesize
9B

MD5
8733db8bb02cf7abd5d7d07601acc332

SHA1
9f8c54fe2dad4a5f9adbac98d1f814b1a6728bec

SHA256
909c50607a29630c8b3ba42ccb712816ced4a96ad97d346cab88e3b0ebfc02a2

SHA512
912775ee690a8850d06086fa3a000af67c38687d587972d021ece658f6e663a43bed3c0f6b88243b1ce211dbff6be1337513fca4778909a464f0293f365bf9e7

Download Submit
C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\core-util-is\lib\util.js

Filesize
2KB

MD5
c75dad3935f65e5a8012862007213be8

SHA1
25525aef8bf5d234491b3fc84a39e3f9915ebd9e

SHA256
7427f16d9bd9185e409baff3e4b1ed6e3d8dfca84d367f4b8b351eb921618652

SHA512
882a583847306599efa6e9adf6232a3b228da2049cec629cbf94fe5315063de7daecbb71d4e74ce2a4fb17568b7dc9022b15c10e167d4d9252119db8cd818e5e

Download Submit
C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\core-util-is\package.json

Filesize
513B

MD5
30f8f18bad106182452b0d4f35d29e20

SHA1
0b595c3c500f68e922f5b723cf49941c471726ce

SHA256
9eec175d60051b17e66ce2eaf62ea94fbb6a6f62f0a44f635931eb7dab7dac1b

SHA512
abb5fadfb7f057eb10489be1bf7e44193ca9d08409d9d0f850dff627ff7b5941b2531f9688ead92c99b14a7059807a4abe5229057258497a53e8237ddc11564b

Download Submit
C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\debug\package.json

Filesize
1003B

MD5
f3d043b8f0fdc42a2da696f6391fee43

SHA1
3353f9368a1ba63d031819eb678b50a5531aa314

SHA256
04fb26450b3f86793933133ba8c2bfce9bc37824f60c285a4a5c50a9924a31dc

SHA512
b754343fc36d5c3ebbcd6154b39478befadee1bd96a273288c8e0ea02fe8e23e90adc1da7ae077fdb48057c91917b261c986f172111456427048dbbabd53e9f6

Download Submit
C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\debug\src\common.js

Filesize
6KB

MD5
49832460bfd46a5c273bdce51a0731a3

SHA1
d9b4485634aaf8703fc136ea9b7981872e669277

SHA256
8eac4c6b52b2bc8ee38545aa75376f4af6fda94fda4142361afeccfbf2f7953a

SHA512
348ef0034bd47fb860ce1d3f27cb8f8d6ff1df3d38ccb9f9a0aec302da94f7bce362d692562d15d9088f8f441aa836251c7abdcb11286d29da6a879f3743f022

Download Submit
C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\debug\src\index.js

Filesize
314B

MD5
d6c53f5a0dd8f256d91210ad530a2f3e

SHA1
0f4ce3b10eff761f099ac75593f7e05b149ae695

SHA256
aa127ff1752b7d9c7415c5c7bb6994d9aa722b81bcbcab4bd48316b013d23bf3

SHA512
4faa874d9d862ffc921528742c4f1fe8a9b22a358760f6e93fcef138523575329a801ce9659ed8e96b02b73e581b3e99d91973e22981b358ffb5e43103a536c2

Download Submit
C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\debug\src\node.js

Filesize
4KB

MD5
6e63fda079262f01e14f03bdf77146c0

SHA1
481608e3c95722f3a474336e5b777a6a521e76f9

SHA256
f237adcb52849de7c128f57e0468b52353c529a6c8341810477c0e7144359559

SHA512
3017b4717118f56fac106dcaa046aecf3cc63c37e64f49838e5379a13583c293f39ec5ace48fb2dabeac6af4a967f96219812733ead6f36c3f5c8d132d795900

Download Submit
C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\domutils\LICENSE

Filesize
1KB

MD5
d5b9cb3bc7f6ffd7bea8661f30447c11

SHA1
a4b5765e26b195e972e961e2c241a54eff51dafb

SHA256
cb992345949ccd6e8394b2cd6c465f7b897c864f845937dbf64e8997f389e164

SHA512
ea3679d79a1a7161ff68dd4265d7e89b9ee2bfff4f32d8da4802692d6fdc5c1706ff9edd5dce36ad4e88f7aa5f76061cf4cc8794a010efbf39b5bcb1ef08a550

Download Submit
C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\estraverse\LICENSE.BSD

Filesize
1KB

MD5
e74cede38e957fe3e525b0e53a510bcf

SHA1
e74ff75ee8a455b69f308ecaeef9804e6c9c8fd8

SHA256
0e74697a68cebdcd61502c30fe80ab7f9e341d995dcd452023654d57133534b1

SHA512
60a97bf6c9abdb4bdd20a0b2f9fc8ffb3b1cc901f0caa0cc34464ec152c43a343123182db35cf492506b703b02211d893eb701d349e19bc6c2cf8eee0b1db848

Download Submit
C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\ext\.editorconfig

Filesize
288B

MD5
d0a659a1700857990a78667d6afa3fc0

SHA1
d45f7f68b281c0fdb09fe3eeb23d5b5f011ce0f8

SHA256
1a8d6feac06860df9742d39a173e76557ed4b85254ec67d384c77d187f1d6a17

SHA512
531154a7723ee71b98832ac8dcd1abc6dd4f736da0a66a5c5985e32e07fb0c4287cbfa8230de3f02eb823ab9be5b39e2a28191395904c8361aa15922bdb170a3

Download Submit
C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\fontkit\index.js

Filesize
508KB

MD5
f71ed33c03319fa58fe56612cc00634f

SHA1
6bb7ec577c283408de2364db93a7c9a2bbabc6a4

SHA256
dab3a4178a76bfc10db020722dfe69281586682781fc787e6a15762c8b7f475f

SHA512
369f3168c63f4dc33e99f417f4b71816a4f28c50255813c50ab47a0dfafbe879a790e83a0b573b8081d63715a983a33aa46306f36346653c78957f1c4a0727fa

Download Submit
C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\fontkit\package.json

Filesize
1KB

MD5
c642592fca73d7426946a369affc03cc

SHA1
17ab872866e8876851992a80bfaaae681a6ad891

SHA256
0385a0639029031d45a54cff109c56c3c9ae928fd91e72a153ff5f7ae2e863cc

SHA512
7c4e6129feb5e074efe0cfe54eda4991098616ab54d649fd5781479419a23e389a471f48252cfd513e8fd160e64bdd1cf1372884085e05934ee063667423254a

Download Submit
C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\has-symbols\.eslintignore

Filesize
10B

MD5
0549babc2213b12c788bfeb5c47cab97

SHA1
8525adbdf9ac9a497e638cc69cedd64804151830

SHA256
5c5daf48fdf4db42e16c29b5b3de54984bafe0c2ff367a186ca97f1d4ed48290

SHA512
54b84472aba9dc81d7b5924fb74ed962803d24d463cb58e153f354e35630e04f2613279aff3fba6f0e612f796108ed3da638bd134047d90dda0d775cde2f7306

Download Submit
C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\has-symbols\.nycrc

Filesize
216B

MD5
c2ab942102236f987048d0d84d73d960

SHA1
95462172699187ac02eaec6074024b26e6d71cff

SHA256
948366fea3b423a46366326d0bb2e54b08abd1cf0b243678ba6625740c40da5a

SHA512
e36b20c16ceeb090750f3865efc8d7fd983ae4e8b41c30cc3865d2fd4925bf5902627e1f1ed46c0ff2453f076ef9de34be899ef57754b29cd158440071318479

Download Submit
C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\iconv-lite\lib\bom-handling.js

Filesize
1KB

MD5
7b3d4519f05bf0cc8d70a4d950c72c55

SHA1
5c6518ce3acc35c3e1da961bc02c110e08f81db2

SHA256
c230d25d8e7fbb50960c634b636b71327c409e9a77e67fe9446b566bdcea362d

SHA512
bd62df0406af2f67d45fc418faec70d6d63f58112704cfdf9a28bc633696043554a09048e69abbb4e3dde653d85f9d64e9d0d5c0117c7d9d404914da5323fc07

Download Submit
C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\iconv-lite\lib\extend-node.js

Filesize
8KB

MD5
24ac97737522b61c26b830d350cfcaea

SHA1
850643aa226441c0d0d9913ea5362bb85543c26a

SHA256
7b86aebd7175d940c50f60eac1981490962855d9723bf971981ddd703ba6af43

SHA512
237809b8fd38f594e583492e98d291ffd6ee44b5c94628615420b5d9daf76f03b1619ddf77ac306fe7323530e2fa6346194866e7e165eae90ae5075b2caeb823

Download Submit
C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\iconv-lite\lib\index.js

Filesize
5KB

MD5
c1da5b53fa60006bc973dc785bed2ca6

SHA1
68ccc5b53b1b7aa66dae594ad3150b0f66d158a5

SHA256
77d20e2fd5bcd9e324fb6cfdb909cd06fdaf6a91769adffcf4d7c4c066cce4c3

SHA512
8d8ac4e9119bbe1f9a8475edbbffbcb260d17eac94bd5c0ab321d1012fcd0762786a449259355f25a10905be18051ca494f120d0e826005ba33468b05cfc54f1

Download Submit
C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\iconv-lite\lib\streams.js

Filesize
3KB

MD5
8628e41438801c5bfdabf3be9b1ff548

SHA1
3982c3e4c6abe5ec4064a8c5196395067d0c504b

SHA256
25a423eaf41f8dc6bc40cb28189a24e2d63b990ed72c824940bed55d0264ea6d

SHA512
6bbb6c654b75a23e73343f2cbc8eb84aacb09a98e4e49a875689e75040333edaaebdc8649da8399bc89532150dc1aa30f5f0fb07c1523c94a6cba3817f33a88d

Download Submit
C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\iconv-lite\package.json

Filesize
814B

MD5
93d76a3bc4a84a856b9d5f04e4bbe0ef

SHA1
6dd2cb0d2c4fce056eab09c9e82ab1c4fbd06815

SHA256
5076dd0cabe1f0ecc90cc056368c557e1f6a4e595afdc2b699497d153f896048

SHA512
2643eb4ad367f3941cc374f47147a60562ff5466a895be1ffe8ba1f04d50f15b644f271a799e86aba4c7b0cfa555bfaba1f721821e3313b9d406e01f870727de

Download Submit
C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\if-async\index.js

Filesize
3KB

MD5
734a2732fa3cf1d0b694085dbb83c25d

SHA1
d7956f33c982d8f2ba972cdff02062d0531cbfba

SHA256
e8d78e34c63963e78c5579f3d5d300d18aacfe369e3f9b8d503d4e4523aa5467

SHA512
954507de1e9c1493a6db83c383effdb529c2c4f5ad705dff16b63116c61f054e8c6b64216e46510a633d1567ff9b27fad92cf9cd174ebfc1e3a416d939f2aa09

Download Submit
C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\if-async\package.json

Filesize
464B

MD5
eb038ef92c522341dc03e9e460e823c3

SHA1
ee005314b4791596110513041a9bee45855f1790

SHA256
7bea9e63f9da82a53cb3394b09e870ad12971352f16e10bb1a70602be5505c10

SHA512
8743afd9ad5e0c7c8a85acabca8ff4dc152757ba0632d11fbfb095f117495349f8d84dc36524d6f4a756a8bf2fa9c2d39392e8ea7395fc8d14496f6f46cdddbd

Download Submit
C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\inherits\inherits.js

Filesize
250B

MD5
9ced637189714b8d21d34aeb50b42ae8

SHA1
222da288a07d8f65b2aed9b88815948cfe0b42d9

SHA256
bb380f32bef5feb18678f0f45f88073fed5d7a0069a309132cb2080cd553d5c7

SHA512
59925a20877c9193308e6766b96c11b6d910b45583c73498b8761b091231bce2f4f7d95eb7d2b2e83d6b8a595689b80878c27e7c1e87347ba03f6ccb0c945cd1

Download Submit
C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\inherits\package.json

Filesize
493B

MD5
63b0980f399168534d97cacca78c989c

SHA1
d7c684dc53dc89111109fd4a8feff02dc4e0240a

SHA256
a25499991984970b76aaaf21d8529cfacf48c9d68f8f44bd0fb4594b462169be

SHA512
ac8d306dc2461a5802daa38283ccccc181d76564b5d5b66f81e1a36898ba321206ab9b472abc507034f849255c08493dcce51e0f6ac4e61c0dc85d2149b1e42a

Download Submit
C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\is-regex\.editorconfig

Filesize
286B

MD5
6e089132bbc839003220249f345aaf01

SHA1
b613101963356bfaf6118fc55cf67bd5f5567303

SHA256
0a73be687a86b6f0e5494b1be555fcfbb886108794948837170c28f18820aae2

SHA512
803de242d802ed98054bdee9c99a91d053e330dc9101f6adf1d8a96d22f6f22889e81d4c3f974378361e1273f9b18313cfcc21408937139be5b64da473224911

Download Submit
C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\minimist\LICENSE

Filesize
1KB

MD5
aea1cde69645f4b99be4ff7ca9abcce1

SHA1
b2e68ce937c1f851926f7e10280cc93221d4f53c

SHA256
435a6722c786b0a56fbe7387028f1d9d3f3a2d0fb615bb8fee118727c3f59b7b

SHA512
518113037ee03540caae63058a98525f9a4a67425bd8c3596f697bed5ae1d2053fe76f76b85a4eefb80cc519f7b03d368cf4b445288c4ca7cacb5e7523f33962

Download Submit
C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\ms\index.js

Filesize
2KB

MD5
fddcc2097091479666d0865c176d6615

SHA1
55f9b3a7d4cfbf68b19ccd0d698aa86483dd4694

SHA256
55986972f5f3c9446f876c576e1cd30fd4f04cd26527efbb5ad834637c740e4c

SHA512
252644169a9398527927b69a2f19c6578bd62dcd180b94984d991939f53bf4e77ca687e840db42f7dba3b37124a5e3f3eda83535e75491bbe6ca440a7149913f

Download Submit
C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\ms\package.json

Filesize
584B

MD5
6d1a91e3b4481b49526691670eb03134

SHA1
19a1e8bba588bbfdd3fe6ac332e3c7757d67b043

SHA256
7facc3283b9bdc72541307299a20e163cbbb60a27d573de8287c1257d5e847f5

SHA512
966a0c42bd36094d2a7fb357e284f9bb7409639a57b9fee9ddd8f460aaaf543f5d0dba83dfa840f81a7c2a0f230244fd1629a93fc25cc53f871d8ee06ff3e5a1

Download Submit
C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\native-keymap\index.js

Filesize
1KB

MD5
396086fd8487173b04f326f082f116e7

SHA1
8191964287cb665778c262423aca59183ef83b6c

SHA256
d9cb9697c143856118f25192e39ab2e991c72fbc7d75f1d831219bb973dd11f2

SHA512
80fc04c6dd7adb15f954515e5194a2711f303796a36cbb2191da555926bece68b8d263199ded2d340340c103965424563da78edd8de56ab1bd9edc7825f28e51

Download Submit
C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\native-keymap\package.json

Filesize
416B

MD5
16167ba6ac06435cba19042eae246150

SHA1
06d771dac6ba0f9eed36039b0c1da408c57941a5

SHA256
916b9b2dd71582e9483201cbcb5119601e51f505727fced72bc099b1b5a6f696

SHA512
035f1f45ae7ca30cd50c0c1927679b038f76845c4d157627f26a30c6d1b69ad71d7d87173056d78f94458f4f764b847c2dd1f6e45eaa1441c4cdca6e373b69d3

Download Submit
C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\object-is\LICENSE

Filesize
1KB

MD5
d22b3eb619d81197fd4f3ca47c2c1ea5

SHA1
cecc49e000ac69f8dc602f6967a3d9df155285cf

SHA256
dc0fe5a22d9336f345ee984f9bf56f11f22877a3aa5fd16a1db9a8ca0e23a5d1

SHA512
54069fc3a9f8378d57bc0b11fa7fa211daf4cd320435af21ca6514b4b19166d340133aca36ec253dd1bfe175532bc6e08e138ba72dac391269fd0aa8a512be62

Download Submit
C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\prelude-ls\LICENSE

Filesize
1KB

MD5
7733af876e78a187f3a51e7c276ae883

SHA1
7bc795bf398cfa51e99e85dc51931c3b0d1b5a79

SHA256
b9eb082c39fe245e38793699074c394c43a722c51fce031c3c165cb92a31035c

SHA512
164ca6658b71df6f4298868edc777368767a5ab2f90598ff3462d655a33a4ee36fb1b61c0674e339de98cef8ba9497cb5405b4a091a197c98af442882e8a580e

Download Submit
C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\regedit\errors.js

Filesize
25KB

MD5
cb78cc5e189ed0da1f84960d7a6c052f

SHA1
c38e0125230a6a857701dc59d32107fb0d8211e6

SHA256
3dcdaa706f47439505f4a65905240e219f3d449aad3d40eb00b6a21f7c9fa064

SHA512
9bf4d83f661d188339bbf2553b440199c254587757011d41016367f246ddf997504bd3a9268350d4f2c206f8f2519c7fcbdcf8d1da28f1297ee92f7c9fbe7f05

Download Submit
C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\regedit\index.js

Filesize
8KB

MD5
916f934a61554eca6adcea44aa7f4c50

SHA1
8093fd4bf69f35b049e30a207d5560a7a147a433

SHA256
4594b06f27e24113a3559d4c5d1fca0cdce89c04ef2b65c143e4a6ffb6e0df3a

SHA512
36dac6d41b7b954737fb8d9b5d6190bcb39699626803a0d13e843b0419ad63392575add57c351dbd37076265c1b121525f904adcd8b3ab8868b702aaf4e4844f

Download Submit
C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\regedit\lib\cscript.js

Filesize
2KB

MD5
263a5bf3f7635547d8ed016fd7e030dd

SHA1
6c30f3efe7b5ff817baf55089d0bec80bad4848e

SHA256
1c745555e1f0a12c48775e95270fdeaefb49ae92578a0632c119c5f277637fe5

SHA512
94ae873feb44c0736d9e8533a5aa0b0d2a596f6268543811c2f3542b9ca772e00b004f6ff79c466c51ea90c633ade5f754f17cb1685b5c6a25f31a533b6a7696

Download Submit
C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\regedit\lib\execFile.js

Filesize
385B

MD5
1248619f75b7ed6fe24c0c845a33f207

SHA1
cc0303fdf7792f3dcd5b9249a3166a3bac0a32a6

SHA256
d64e4aad82b020932da2ba67c45ec4653afbb3daf5a23028397139181b425b62

SHA512
f0adda227caeac76bc650c70db19474f942754ebb22b7c07eb4fc255547c4ed8d20ee979aa1a6406ef3b701e2cacf6a71afebfacb93fdcce480a5b56f558b02c

Download Submit
C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\regedit\lib\helper.js

Filesize
1KB

MD5
6addbb78adda37e7b4fcf445fd5a440e

SHA1
c0195d13644c64db01790c273d1b2aa430243006

SHA256
3fd9e913fdab45db06ba15cf6792fe60d7fcdd02216e4ce99e3c2942eb129b7a

SHA512
15de1364856b476e538aba3de14f7995806b93fcc09a76ca4adf88bad332d83123c190e69cd9fe4a67271e9dc88da0ba03cd72f4288fc6f3978e87b5bd12c551

Download Submit
C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\regedit\node_modules\isarray\index.js

Filesize
120B

MD5
e8460ef833145a9652fba1bb4c47ede7

SHA1
eec5f3c0d16211678cfc7c2d9c18bc4718adf700

SHA256
74ab5ec2cd52e2c1ef699859f9c7aa7a6408f7f7231576db3b0b56af1d97d966

SHA512
30037f9df588ae73d24dc6793b9ac8d92b2fffa6bf5808679f16454d9fb6fc73369e189e8e47d08878ff51ee652f86a2a2bdb71abbcc1c7f471190e3a6a710de

Download Submit
C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\regedit\node_modules\isarray\package.json

Filesize
482B

MD5
c020ef2abfcd22eeb9b878fdaf22ccd5

SHA1
ecca2f5faf35b3368afceafd2a2562739a8eb8f2

SHA256
60fde13c0039b39b85e14c5b25761cbee63e1e217176e9089759cca19104c3f0

SHA512
e50f063c68b81c447e2e8be62474ce5f8fa5c472dd7c999e865f5e7db27ef22dde198b5bcc742ca68e8f611f9cc942b9a0ddb891768b8f334a713a83d65f5093

Download Submit
C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\regedit\node_modules\readable-stream\lib\_stream_duplex.js

Filesize
2KB

MD5
b1a73c853d96fdaff0e860b807893ebd

SHA1
df4c4045d53e722a0a88aec73ebec447c5ca9069

SHA256
de52709f6e4b46b9bbf2923eb050227ef0c0ce9fc0aa059624df467708951e61

SHA512
988df6c9f86ad6381e5d4f777c998c94764550146780654a217c50dfa4de2644d79963f3dc945dcca47a7bb63495d551bb2ddb58e24a4fb795a6eb08ea2e2829

Download Submit
C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\regedit\node_modules\readable-stream\lib\_stream_readable.js

Filesize
26KB

MD5
df49a9a27415c7c87d62a9d5e4d531eb

SHA1
fbe877a784cabfe0f67f1a194bfa164517554453

SHA256
cfbbc0e5266a9e8ff28bba5b8465293b62ccdebeb294f620d415d90009a73f5c

SHA512
424d03c118cc9a91f5a201411f39c69061d01911d908617ee30d43eac0131eed2aca7f29e52f802df60e28c94f06c42efb0a6c51bd05671cf9381a698cd5406c

Download Submit
C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\regedit\node_modules\readable-stream\lib\_stream_transform.js

Filesize
7KB

MD5
6256b8cd1189182f3f6ead29685e1803

SHA1
1eb7ec328583b5c038773c5702d01911e1107f17

SHA256
a079035a08709da67f75ef792cff5a3877796f460d4a660b4e61d6e70f803701

SHA512
cfa00301439f12a933769890c3160b27541da11538048d37e80f700b5720b8b97d237a7a56ccf9cced17d581d2aa6ad174b62248775fff7822505a0b585e454c

Download Submit
C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\regedit\node_modules\readable-stream\lib\_stream_writable.js

Filesize
10KB

MD5
7f5ca9563c1a4c7f271d0ffc6045733f

SHA1
29fb611c264c00b9001364c1ce90fc64efa66ed9

SHA256
62f4c3706e0c3d9783255fe60c38ec681c8dcb507154d6a85e20ca975b1196e5

SHA512
8820539ff64074e7e6ebe1b0ac789a5d40c2fceddbaf56f19724fe571e3fcf55fb58a2649ed69d0668fb26fc015557879315e8efa34bc68f11257c18b280235e

Download Submit
C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\regedit\node_modules\readable-stream\package.json

Filesize
688B

MD5
5e288f6058196bba589f1583eed46abb

SHA1
6443ec71a10df61f2352ab7c7ed2e9f692b64199

SHA256
c5e66304be4f73d9dbcae87965fc711dce66bd75b4441d57329bb20ac44991aa

SHA512
5c76edf6d1b79ee818d6940414a110260348a66e779ca93dfa9be756e9098e67ae7c15467ebd1befa4aaabca06d9b90423955f6bdbe320deef344e24439fcd8c

Download Submit
C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\regedit\node_modules\readable-stream\transform.js

Filesize
55B

MD5
c741030ec12b51eb7b7db4cb33018418

SHA1
2d31b50e657e5b03ce5abc5ce6b77187e8e876c2

SHA256
8f8b0728a921ec127d314c6a7b33dd61b4e37ca0fff8a90747966b32fc11f4cd

SHA512
bed108571659b25796a0d076cebc6798f20219934aaaf050f1242517cabc1c57eb28c6a38c633243a1a8d2be04bab4c0552f39be2e390f4c82f3c652649f33ad

Download Submit
C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\regedit\node_modules\through2\package.json

Filesize
689B

MD5
c5ef2eefbcdb9a88a148c91b28070cac

SHA1
2ddd4768501c3792d6c7c6fa32d5a8bcd7348a0f

SHA256
2dec0a7df8ce7a2014dec00a9fc01132bca8ac129c207806788f4b0d37db252f

SHA512
d0a4c142ab829c920844d8f8d6ca68f2c694afed599caaa1e7a2d6f3e834d86921fc55452da5253bde47eae048568a6d61f468c824a577414893916c298e359f

Download Submit
C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\regedit\node_modules\through2\through2.js

Filesize
2KB

MD5
90f016e89813009fce103724bae3ff89

SHA1
f1b43012d500dc93017f8fc933a0f79bcdb5825b

SHA256
2f9b622e5831afa8a93cf6c252479464703eaa279fb01d8d86ce82c1ee03bf16

SHA512
113a625a41d73e4875e7137e9cacc5ea00646874b7a8d8529d099e463bcca8d652c9577859d90a4a77dad051ac9c0be425e90bc93bc5ba95ec488aeb8c92a815

Download Submit
C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\regedit\package.json

Filesize
684B

MD5
f102b85fdb10f7bdd4fa3ff8b7953c6e

SHA1
7e5e2f723f4e9355f40863d76c8390af25f72fa6

SHA256
1a38e32949a326be015e74607c408111b38537c546727a85090260e6d9e22bae

SHA512
474a57921e8b4d40059e7f51d26bfb2426525fb3d6486ed586af45ecb944ae108e037caa3ef1e70b968f6fc115d2013459eaa9b005623709b853c179a232c90e

Download Submit
C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\regexp.prototype.flags\.editorconfig

Filesize
276B

MD5
21da6a90c8609948afe0be1430baa42d

SHA1
41dcc6e5dcfee2cc601b47fdcc716306ccf8f0c4

SHA256
ede54e8b6b96147c61efd0ddc56d3683508a26066a8baabd63673d2779a06f23

SHA512
a77e4ed2536be5bf0085ae0dd5d9ecfd9cb7fab57564bc7a7df49572b95447313e5b7cdbaf2bb406443ab6219e4a0a76e3c9cff7867151af22066b69d687199e

Download Submit
C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\restructure\index.js

Filesize
951B

MD5
861274d78cf1ad38ea2e2b9093ec1efb

SHA1
2855a584bf7c016896c65c27871efe9608b87619

SHA256
161666bab404d61d4b3b7828f74442fae00eddd23e42bc0cee4be36d9547e7eb

SHA512
1899bdf0c8df8391fef1c5ae384c7b176d7de0d058626a2f8464f9f6b4cc9dcae1aad22d304ae88765b9983d74432683d7f9d510ac78785e52e99ee7f7ccf67a

Download Submit
C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\restructure\package.json

Filesize
796B

MD5
2a91d864f80a3b512f39c627a6d722b6

SHA1
1b24865d071bb6279b463df421597b12f01326ea

SHA256
950ef6d383cef79185e27ef2d78b7390dbbaec5c9d5f563a1301602dcd8bc2fc

SHA512
75c087064174aaa1eab69c2597fa8130483ce9966b6f9d82f1f1a93c17766081118468859ed0347025f018e778aba6ee7ef3e14b25a1c7b0758531554075c95a

Download Submit
C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\safer-buffer\package.json

Filesize
636B

MD5
b14e32a5dde33e513f6f863db550fe9b

SHA1
be80f8992dfa858df3ac3a3510398050de086102

SHA256
377c52d56cd4f36ae0b06afe022a59ee976c40258dfa342bf112176f4305866b

SHA512
edb69402f48bacb46dec948f8149d57386648394c6d1bee9a019a220de5d934ff420c6dc4bc3a4ef529614a1ee8af73150a08f659ef7f3177dd4b15e62f911d4

Download Submit
C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\safer-buffer\safer.js

Filesize
2KB

MD5
b548fa7365e81d472250949a6b4ccc69

SHA1
ad919cad501061f663026f382334cc6ce5a8b381

SHA256
37f9716144105051ab302f6a0c30a52ff5de7269b9e1173ac22be798fc11ccad

SHA512
6b3c16541246ddf1bd12c0cf537fc54dd9ed932c70a834d8df57d6758bc9532af554910d4b292f69fa5b3fd0b5f66dce2451eb3f6cf19ba295d1397bcad8a574

Download Submit
C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\scope-analyzer\LICENSE.md

Filesize
628B

MD5
8dac565a09a15ba65bd1f95a4abc0644

SHA1
c20c5efdcff19323246abec5e2b941918fda7ff3

SHA256
7eb14a7bb0599785afd77bf111ddcf81ae619aaa4fff9fcd0562a12744ad9d47

SHA512
93beb653764ac0777d3c9c080c3a762420d54a41f61e2594eabd11e656daea242c3bb1f05be32f529b5646b9d5950f35ba69c8d1379298334738ff3461e2d562

Download Submit
C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\source-map\LICENSE

Filesize
1KB

MD5
b1ca6dbc0075d56cbd9931a75566cd44

SHA1
914d42b13ad394be4aa75b4d93fde94b1e79cbbd

SHA256
6cb0631f71c7749763fd3dd1d5bee52dd1070ec17f2edc1710079ad070bd2fbd

SHA512
6b8aae75aeaa2150548d86f1f0025cec9ddbc7dfa3c1f51e87de87721ec64ef31b60da2b04871838ca951cea1bb83af0dc518ab16d08e5334119d12aef4de27b

Download Submit
C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\stream-slicer\index.js

Filesize
1KB

MD5
93cebf8a4010ad28e0bd45fe19383000

SHA1
70703f06ec9748b26953bec004de26cd09bfdd16

SHA256
ae4b6b83bedbd27f59b40f5ce0ad8a8726d1de24d5222f04d370519fe6510d4a

SHA512
836c659e6921cf15777878bb21176b00948d5877a90d514422ea74255ff48201ff707b0d6ce0d69c5883f9c1de5d621d788561aa3f15da7e4a66c2131803be9f

Download Submit
C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\stream-slicer\package.json

Filesize
373B

MD5
9b5287549c37a74fcf7d88adcce35782

SHA1
91975092d59ac2d2f7585308248b486fe2cf893c

SHA256
6a96bc6e5f2ea2e7e6d643fa254c440dc56c72aa4e02f8677ef08afdb80e1c4e

SHA512
e36767b852add60a6b0b3fe48cf05a09c1edf59df032e2745cd0d44e92504760894a14ed99adcfeb28b06dffb73c022b828deffdf127fc2d9f3b883f3acd8594

Download Submit
C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\xtend\immutable.js

Filesize
384B

MD5
fca955864fd157aa6808a43e977c1ffb

SHA1
3c1de57f8d038e3ebc9e1ab278fe2f683866079c

SHA256
04986f168b8f16f4f25237d0608cdf57b6ca14f100fed62c0295bda2559ab24b

SHA512
1e3a827649b32d4a43ffb7c894e7a374c12116dadc9c1f53dc8d2fcfa918e83813737dad02280fb6c09e80018be0f093840abdda58994519a9462ae8aafe54df

Download Submit
C:\Program Files\XMind\resources\app.asar.unpacked\node_modules\xtend\package.json

Filesize
769B

MD5
509bb4a8913df2977199607749fff7d4

SHA1
7bc0937975084dc475f605538a32c447fa986a45

SHA256
83e7f5eb7cf038e7e18a3e31e388582d31039129a45ca5e7f1be768aaa11ffdd

SHA512
0dc0cd60b4c8f45bb83fec75c9111dd9048aa39b44773d85e46e1f3e31d272de3596cfb257f193dbf38c0ecc3fe554484e8ff2b347773e88f0240363abbee1d9

Download Submit
C:\Program Files\XMind\resources\app.asar.unpacked\static\native\XMindShellExt.dll

Filesize
164KB

MD5
8cdb18a8c77df5cff96a01a548311f1e

SHA1
aacdddb87162f799f374cf16a87d4ac69a032974

SHA256
398520eb6f58c3e1b1865994daeb776997ac186f939e878cccdf5cac0aebcf6c

SHA512
17addce83d8972d8a98f80fc5f1306ae079e7ca64569e084c89acb748d2f4a0ff371525bc878797f0dc1d4a05d89cf301fb20f36a68927313178a5c9c1219553

Download Submit
C:\Program Files\XMind\resources\app.asar.unpacked\static\native\XMindShellExt.dll

Filesize
164KB

MD5
8cdb18a8c77df5cff96a01a548311f1e

SHA1
aacdddb87162f799f374cf16a87d4ac69a032974

SHA256
398520eb6f58c3e1b1865994daeb776997ac186f939e878cccdf5cac0aebcf6c

SHA512
17addce83d8972d8a98f80fc5f1306ae079e7ca64569e084c89acb748d2f4a0ff371525bc878797f0dc1d4a05d89cf301fb20f36a68927313178a5c9c1219553

Download Submit
C:\Program Files\XMind\resources\app.asar.unpacked\static\native\XMindShellExt.dll

Filesize
164KB

MD5
8cdb18a8c77df5cff96a01a548311f1e

SHA1
aacdddb87162f799f374cf16a87d4ac69a032974

SHA256
398520eb6f58c3e1b1865994daeb776997ac186f939e878cccdf5cac0aebcf6c

SHA512
17addce83d8972d8a98f80fc5f1306ae079e7ca64569e084c89acb748d2f4a0ff371525bc878797f0dc1d4a05d89cf301fb20f36a68927313178a5c9c1219553

Download Submit
C:\Program Files\XMind\v8_context_snapshot.bin

Filesize
160KB

MD5
8fdac2cb67bb23f7c2e159121a356626

SHA1
24da4c3a16b09961375aca57595bca974083e553

SHA256
7f86fd6ca3e16a122eb6b2a0bd612879a9c0fb15ca4907a8bc546ebc807285d5

SHA512
9c8b8c4f14ba39a3e1caaae893dca7f7ccaddc50c0b6ce3ad25f8adb8be4bf9b140a491d8f71ddec959a4bc9300e9eeba496eee5f8ed24b07a1cc7ea94da2c89

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsiF32B.tmp\SpiderBanner.dll

Filesize
9KB

MD5
17309e33b596ba3a5693b4d3e85cf8d7

SHA1
7d361836cf53df42021c7f2b148aec9458818c01

SHA256
996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93

SHA512
1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsiF32B.tmp\StdUtils.dll

Filesize
100KB

MD5
c6a6e03f77c313b267498515488c5740

SHA1
3d49fc2784b9450962ed6b82b46e9c3c957d7c15

SHA256
b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e

SHA512
9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsiF32B.tmp\StdUtils.dll

Filesize
100KB

MD5
c6a6e03f77c313b267498515488c5740

SHA1
3d49fc2784b9450962ed6b82b46e9c3c957d7c15

SHA256
b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e

SHA512
9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsiF32B.tmp\System.dll

Filesize
12KB

MD5
0d7ad4f45dc6f5aa87f606d0331c6901

SHA1
48df0911f0484cbe2a8cdd5362140b63c41ee457

SHA256
3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

SHA512
c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsiF32B.tmp\WinShell.dll

Filesize
3KB

MD5
1cc7c37b7e0c8cd8bf04b6cc283e1e56

SHA1
0b9519763be6625bd5abce175dcc59c96d100d4c

SHA256
9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6

SHA512
7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsiF32B.tmp\WinShell.dll

Filesize
3KB

MD5
1cc7c37b7e0c8cd8bf04b6cc283e1e56

SHA1
0b9519763be6625bd5abce175dcc59c96d100d4c

SHA256
9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6

SHA512
7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsiF32B.tmp\WinShell.dll

Filesize
3KB

MD5
1cc7c37b7e0c8cd8bf04b6cc283e1e56

SHA1
0b9519763be6625bd5abce175dcc59c96d100d4c

SHA256
9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6

SHA512
7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsiF32B.tmp\WinShell.dll

Filesize
3KB

MD5
1cc7c37b7e0c8cd8bf04b6cc283e1e56

SHA1
0b9519763be6625bd5abce175dcc59c96d100d4c

SHA256
9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6

SHA512
7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsiF32B.tmp\WinShell.dll

Filesize
3KB

MD5
1cc7c37b7e0c8cd8bf04b6cc283e1e56

SHA1
0b9519763be6625bd5abce175dcc59c96d100d4c

SHA256
9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6

SHA512
7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsiF32B.tmp\nsProcess.dll

Filesize
4KB

MD5
f0438a894f3a7e01a4aae8d1b5dd0289

SHA1
b058e3fcfb7b550041da16bf10d8837024c38bf6

SHA256
30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11

SHA512
f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsiF32B.tmp\nsProcess.dll

Filesize
4KB

MD5
f0438a894f3a7e01a4aae8d1b5dd0289

SHA1
b058e3fcfb7b550041da16bf10d8837024c38bf6

SHA256
30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11

SHA512
f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsiF32B.tmp\nsis7z.dll

Filesize
424KB

MD5
80e44ce4895304c6a3a831310fbf8cd0

SHA1
36bd49ae21c460be5753a904b4501f1abca53508

SHA256
b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592

SHA512
c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\XMind\Electron v3\Network Persistent State

Filesize
393B

MD5
427c60f92c432a20a0d1c187b04a14cb

SHA1
38a9633787a813bfabd8476b25fea646a2003334

SHA256
51b44da22be34b67be31a1b3740d1315aff9e85fac71bef5b0b5c524d838a1f9

SHA512
447fb58753889f856e0f2e5790833193bc53cdb1d79ab87e0977b9e68acca283fd8acb792a906a72741a89fd75d35bda80698fac130d5524b38fa74d67f15022

Download Submit
C:\Users\Admin\AppData\Roaming\XMind\Electron v3\Network Persistent State~RFe59bcbe.TMP

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Users\Admin\AppData\Roaming\XMind\Electron v3\Session Storage\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Roaming\XMind\Electron v3\vana\auto-updater\user-config.json

Filesize
134B

MD5
c1a87595b0830851d477a7f44e976749

SHA1
a2fe091486ce4f6d79ce1f074f09ca95b67f3d86

SHA256
b6f4413d8d03efe2323e2f328d007eb0dc948055d796c57af665fdb27fa2885c

SHA512
3b0e0c348e2bda0b3403c1625b5d9ab1281bd0c3bb1db6f53ca52b774805bde3669bdc35b56f24a88b2b00be3a17c40d5c0ac31a8e78eafdf46e7dbca69a6f4f

Download Submit
C:\Users\Admin\AppData\Roaming\XMind\Electron v3\vana\state\usageReporter.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
memory/556-7104-0x00007FFDF4650000-0x00007FFDF4651000-memory.dmp

Filesize
4KB

Download
memory/556-7197-0x0000028BEC210000-0x0000028BEC565000-memory.dmp

Filesize
3.3MB

Download
memory/556-7204-0x0000028BEC210000-0x0000028BEC565000-memory.dmp

Filesize
3.3MB

Download
memory/556-7209-0x0000028BEC210000-0x0000028BEC565000-memory.dmp

Filesize
3.3MB

Download