e811567264dd128af6efa83239cf708c19e2b2448f10ecff11273494636f9ded

Resubmissions

23/12/2023, 11:53

231223-n2sgtsafd5 7

23/12/2023, 11:46

23/12/2023, 11:38

23/12/2023, 11:06

23/12/2023, 10:42

Analysis

max time kernel
902s
max time network
836s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
23/12/2023, 11:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

updater.exe
Size

62.3MB
MD5

91ea9c72059f52e9e0769fff4d76ca5d
SHA1

3ce72eefb89093b32dce452d03b46a713c894cf7
SHA256

e811567264dd128af6efa83239cf708c19e2b2448f10ecff11273494636f9ded
SHA512

fbf8d4669e15c782b83aff1cdca6f02d6166641a3fe3ada94e23b5123f36f082670b6aaad83f34c0259aef4dbbc2ef2501732e8d78c3548659259c70edf71d7d
SSDEEP

1572864:hm6aqeAMcLGXdHPMNMLpZyIdiBcQ60E8z:86aZAuNHPfLDjih60E8z

Score

7^/10

persistence spyware stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Control Panel\International\Geo\Nation	updater.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Control Panel\International\Geo\Nation	updater.exe

Executes dropped EXE 4 IoCs

pid	Process
3792	updater.exe
1324	updater.exe
452	updater.exe
1004	updater.exe

Loads dropped DLL 13 IoCs

pid	Process
4472	updater.exe
4472	updater.exe
4472	updater.exe
3792	updater.exe
3792	updater.exe
1324	updater.exe
452	updater.exe
1324	updater.exe
1324	updater.exe
1324	updater.exe
1324	updater.exe
1004	updater.exe
3792	updater.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsBootManager = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\0\\WindowsBootManager.exe"	reg.exe

Looks up external IP address via web service 12 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
44	ipinfo.io
224	ipinfo.io
235	ipinfo.io
243	ipinfo.io
252	ipinfo.io
253	ipinfo.io
261	ipinfo.io
41	ipinfo.io
225	ipinfo.io
234	ipinfo.io
242	ipinfo.io
262	ipinfo.io

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 7 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	updater.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	updater.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	updater.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	updater.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	updater.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	updater.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	updater.exe

Detects videocard installed 1 TTPs 6 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
4860	WMIC.exe
4804	WMIC.exe
3384	WMIC.exe
3904	WMIC.exe
1548	WMIC.exe
3364	WMIC.exe

Enumerates processes with tasklist 1 TTPs 3 IoCs

Process Discovery

T1057

pid	Process
3844	tasklist.exe
5404	tasklist.exe
3760	tasklist.exe

Kills process with taskkill 3 IoCs

evasion

pid	Process
1876	taskkill.exe
5336	taskkill.exe
4040	taskkill.exe

Runs regedit.exe 1 IoCs

pid	Process
5836	regedit.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeSecurityPrivilege	4472	updater.exe
Token: SeShutdownPrivilege	3792	updater.exe
Token: SeCreatePagefilePrivilege	3792	updater.exe
Token: SeShutdownPrivilege	3792	updater.exe
Token: SeCreatePagefilePrivilege	3792	updater.exe
Token: SeIncreaseQuotaPrivilege	1712	WMIC.exe
Token: SeSecurityPrivilege	1712	WMIC.exe
Token: SeTakeOwnershipPrivilege	1712	WMIC.exe
Token: SeLoadDriverPrivilege	1712	WMIC.exe
Token: SeSystemProfilePrivilege	1712	WMIC.exe
Token: SeSystemtimePrivilege	1712	WMIC.exe
Token: SeProfSingleProcessPrivilege	1712	WMIC.exe
Token: SeIncBasePriorityPrivilege	1712	WMIC.exe
Token: SeCreatePagefilePrivilege	1712	WMIC.exe
Token: SeBackupPrivilege	1712	WMIC.exe
Token: SeRestorePrivilege	1712	WMIC.exe
Token: SeShutdownPrivilege	1712	WMIC.exe
Token: SeDebugPrivilege	1712	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1712	WMIC.exe
Token: SeRemoteShutdownPrivilege	1712	WMIC.exe
Token: SeUndockPrivilege	1712	WMIC.exe
Token: SeManageVolumePrivilege	1712	WMIC.exe
Token: 33	1712	WMIC.exe
Token: 34	1712	WMIC.exe
Token: 35	1712	WMIC.exe
Token: 36	1712	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1712	WMIC.exe
Token: SeSecurityPrivilege	1712	WMIC.exe
Token: SeTakeOwnershipPrivilege	1712	WMIC.exe
Token: SeLoadDriverPrivilege	1712	WMIC.exe
Token: SeSystemProfilePrivilege	1712	WMIC.exe
Token: SeSystemtimePrivilege	1712	WMIC.exe
Token: SeProfSingleProcessPrivilege	1712	WMIC.exe
Token: SeIncBasePriorityPrivilege	1712	WMIC.exe
Token: SeCreatePagefilePrivilege	1712	WMIC.exe
Token: SeBackupPrivilege	1712	WMIC.exe
Token: SeRestorePrivilege	1712	WMIC.exe
Token: SeShutdownPrivilege	1712	WMIC.exe
Token: SeDebugPrivilege	1712	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1712	WMIC.exe
Token: SeRemoteShutdownPrivilege	1712	WMIC.exe
Token: SeUndockPrivilege	1712	WMIC.exe
Token: SeManageVolumePrivilege	1712	WMIC.exe
Token: 33	1712	WMIC.exe
Token: 34	1712	WMIC.exe
Token: 35	1712	WMIC.exe
Token: 36	1712	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4860	WMIC.exe
Token: SeSecurityPrivilege	4860	WMIC.exe
Token: SeTakeOwnershipPrivilege	4860	WMIC.exe
Token: SeLoadDriverPrivilege	4860	WMIC.exe
Token: SeSystemProfilePrivilege	4860	WMIC.exe
Token: SeSystemtimePrivilege	4860	WMIC.exe
Token: SeProfSingleProcessPrivilege	4860	WMIC.exe
Token: SeIncBasePriorityPrivilege	4860	WMIC.exe
Token: SeCreatePagefilePrivilege	4860	WMIC.exe
Token: SeBackupPrivilege	4860	WMIC.exe
Token: SeRestorePrivilege	4860	WMIC.exe
Token: SeShutdownPrivilege	4860	WMIC.exe
Token: SeDebugPrivilege	4860	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4860	WMIC.exe
Token: SeRemoteShutdownPrivilege	4860	WMIC.exe
Token: SeUndockPrivilege	4860	WMIC.exe
Token: SeManageVolumePrivilege	4860	WMIC.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3792	updater.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4472 wrote to memory of 3792	4472	updater.exe	94
PID 4472 wrote to memory of 3792	4472	updater.exe	94
PID 3792 wrote to memory of 1324	3792	updater.exe	99
PID 3792 wrote to memory of 1324	3792	updater.exe	99
PID 3792 wrote to memory of 1324	3792	updater.exe	99
PID 3792 wrote to memory of 1324	3792	updater.exe	99
PID 3792 wrote to memory of 1324	3792	updater.exe	99
PID 3792 wrote to memory of 1324	3792	updater.exe	99
PID 3792 wrote to memory of 1324	3792	updater.exe	99
PID 3792 wrote to memory of 1324	3792	updater.exe	99
PID 3792 wrote to memory of 1324	3792	updater.exe	99
PID 3792 wrote to memory of 1324	3792	updater.exe	99
PID 3792 wrote to memory of 1324	3792	updater.exe	99
PID 3792 wrote to memory of 1324	3792	updater.exe	99
PID 3792 wrote to memory of 1324	3792	updater.exe	99
PID 3792 wrote to memory of 1324	3792	updater.exe	99
PID 3792 wrote to memory of 1324	3792	updater.exe	99
PID 3792 wrote to memory of 1324	3792	updater.exe	99
PID 3792 wrote to memory of 1324	3792	updater.exe	99
PID 3792 wrote to memory of 1324	3792	updater.exe	99
PID 3792 wrote to memory of 1324	3792	updater.exe	99
PID 3792 wrote to memory of 1324	3792	updater.exe	99
PID 3792 wrote to memory of 1324	3792	updater.exe	99
PID 3792 wrote to memory of 1324	3792	updater.exe	99
PID 3792 wrote to memory of 1324	3792	updater.exe	99
PID 3792 wrote to memory of 1324	3792	updater.exe	99
PID 3792 wrote to memory of 1324	3792	updater.exe	99
PID 3792 wrote to memory of 1324	3792	updater.exe	99
PID 3792 wrote to memory of 1324	3792	updater.exe	99
PID 3792 wrote to memory of 1324	3792	updater.exe	99
PID 3792 wrote to memory of 1324	3792	updater.exe	99
PID 3792 wrote to memory of 1324	3792	updater.exe	99
PID 3792 wrote to memory of 1324	3792	updater.exe	99
PID 3792 wrote to memory of 1324	3792	updater.exe	99
PID 3792 wrote to memory of 1324	3792	updater.exe	99
PID 3792 wrote to memory of 1324	3792	updater.exe	99
PID 3792 wrote to memory of 1324	3792	updater.exe	99
PID 3792 wrote to memory of 1324	3792	updater.exe	99
PID 3792 wrote to memory of 1324	3792	updater.exe	99
PID 3792 wrote to memory of 1324	3792	updater.exe	99
PID 3792 wrote to memory of 452	3792	updater.exe	100
PID 3792 wrote to memory of 452	3792	updater.exe	100
PID 3792 wrote to memory of 1004	3792	updater.exe	101
PID 3792 wrote to memory of 1004	3792	updater.exe	101
PID 3792 wrote to memory of 1004	3792	updater.exe	101
PID 3792 wrote to memory of 1004	3792	updater.exe	101
PID 3792 wrote to memory of 1004	3792	updater.exe	101
PID 3792 wrote to memory of 1004	3792	updater.exe	101
PID 3792 wrote to memory of 1004	3792	updater.exe	101
PID 3792 wrote to memory of 1004	3792	updater.exe	101
PID 3792 wrote to memory of 1004	3792	updater.exe	101
PID 3792 wrote to memory of 1004	3792	updater.exe	101
PID 3792 wrote to memory of 1004	3792	updater.exe	101
PID 3792 wrote to memory of 1004	3792	updater.exe	101
PID 3792 wrote to memory of 1004	3792	updater.exe	101
PID 3792 wrote to memory of 1004	3792	updater.exe	101
PID 3792 wrote to memory of 1004	3792	updater.exe	101
PID 3792 wrote to memory of 1004	3792	updater.exe	101
PID 3792 wrote to memory of 1004	3792	updater.exe	101
PID 3792 wrote to memory of 1004	3792	updater.exe	101
PID 3792 wrote to memory of 1004	3792	updater.exe	101
PID 3792 wrote to memory of 1004	3792	updater.exe	101
PID 3792 wrote to memory of 1004	3792	updater.exe	101
PID 3792 wrote to memory of 1004	3792	updater.exe	101

C:\Users\Admin\AppData\Local\Temp\updater.exe
"C:\Users\Admin\AppData\Local\Temp\updater.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4472
- C:\Users\Admin\AppData\Local\Temp\2ZidQNSw2b3DkU3fP0oLZ5qf3od\updater.exe
  C:\Users\Admin\AppData\Local\Temp\2ZidQNSw2b3DkU3fP0oLZ5qf3od\updater.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3792
- - C:\Users\Admin\AppData\Local\Temp\2ZidQNSw2b3DkU3fP0oLZ5qf3od\updater.exe
    "C:\Users\Admin\AppData\Local\Temp\2ZidQNSw2b3DkU3fP0oLZ5qf3od\updater.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\updater" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1704 --field-trial-handle=1836,i,934127749722085470,11885052935958051905,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1324
- - C:\Users\Admin\AppData\Local\Temp\2ZidQNSw2b3DkU3fP0oLZ5qf3od\updater.exe
    "C:\Users\Admin\AppData\Local\Temp\2ZidQNSw2b3DkU3fP0oLZ5qf3od\updater.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\updater" --mojo-platform-channel-handle=2000 --field-trial-handle=1836,i,934127749722085470,11885052935958051905,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:452
- - C:\Users\Admin\AppData\Local\Temp\2ZidQNSw2b3DkU3fP0oLZ5qf3od\updater.exe
    "C:\Users\Admin\AppData\Local\Temp\2ZidQNSw2b3DkU3fP0oLZ5qf3od\updater.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\updater" --app-path="C:\Users\Admin\AppData\Local\Temp\2ZidQNSw2b3DkU3fP0oLZ5qf3od\resources\app.asar" --enable-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2384 --field-trial-handle=1836,i,934127749722085470,11885052935958051905,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1004
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "cmd /c chcp 65001>nul && netsh wlan show profiles"
    3⤵
    PID:408
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
    3⤵
    PID:4480
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List"
    3⤵
    PID:852
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKCU\Software\Valve\Steam" /v SteamPath"
    3⤵
    PID:4556
  - - C:\Windows\system32\taskkill.exe
      taskkill /IM chrome.exe /F
      4⤵
      Kills process with taskkill
      PID:5336
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions""
    3⤵
    PID:5064
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:1848
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WindowsBootManager /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\Windows\0\WindowsBootManager.exe /f"
    3⤵
    PID:516
- - C:\Users\Admin\AppData\Local\Temp\2ZidQNSw2b3DkU3fP0oLZ5qf3od\updater.exe
    "C:\Users\Admin\AppData\Local\Temp\2ZidQNSw2b3DkU3fP0oLZ5qf3od\updater.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\updater" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1788 --field-trial-handle=1836,i,934127749722085470,11885052935958051905,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
    3⤵
    PID:5184

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKCU\Software\Valve\Steam" /v SteamPath
1⤵
PID:4348

C:\Windows\System32\Wbem\WMIC.exe
wmic path win32_VideoController get name
1⤵
- Detects videocard installed
- Suspicious use of AdjustPrivilegeToken
PID:4860

C:\Windows\system32\cmd.exe
cmd /c chcp 65001
1⤵
PID:1444
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:1028

C:\Windows\system32\netsh.exe
netsh wlan show profiles
1⤵
PID:3384

C:\Windows\System32\Wbem\WMIC.exe
wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1712

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions"
1⤵
PID:3924

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WindowsBootManager /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\Windows\0\WindowsBootManager.exe /f
1⤵
- Adds Run key to start application
PID:2076

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:852

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:3844

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5432

C:\Windows\regedit.exe
"C:\Windows\regedit.exe"
1⤵
- Runs regedit.exe
PID:5836

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
PID:2480

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:2732

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:2568
- C:\Users\Admin\AppData\Local\Microsoft\Windows\0\WindowsBootManager.exe
  .\WindowsBootManager.exe
  2⤵
  PID:4416
- - C:\Users\Admin\AppData\Local\Temp\2ZGqVI35eiWooQiWxnuv32zdJbv\WindowsBootManager.exe
    C:\Users\Admin\AppData\Local\Temp\2ZGqVI35eiWooQiWxnuv32zdJbv\WindowsBootManager.exe
    3⤵
    PID:5240
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
      4⤵
      PID:1640
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        5⤵
        Detects videocard installed
        
        PID:4804
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "cmd /c chcp 65001>nul && netsh wlan show profiles"
      4⤵
      PID:1176
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM chrome.exe /F"
      4⤵
      PID:4556
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List"
      4⤵
      PID:400
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKCU\Software\Valve\Steam" /v SteamPath"
      4⤵
      PID:5592
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions""
      4⤵
      PID:4512
  - - C:\Users\Admin\AppData\Local\Temp\2ZGqVI35eiWooQiWxnuv32zdJbv\WindowsBootManager.exe
      "C:\Users\Admin\AppData\Local\Temp\2ZGqVI35eiWooQiWxnuv32zdJbv\WindowsBootManager.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\WindowsBootManager" --app-path="C:\Users\Admin\AppData\Local\Temp\2ZGqVI35eiWooQiWxnuv32zdJbv\resources\app.asar" --enable-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2424 --field-trial-handle=1828,i,4538365727326824219,10769038006178394477,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
      4⤵
      PID:5588
  - - C:\Users\Admin\AppData\Local\Temp\2ZGqVI35eiWooQiWxnuv32zdJbv\WindowsBootManager.exe
      "C:\Users\Admin\AppData\Local\Temp\2ZGqVI35eiWooQiWxnuv32zdJbv\WindowsBootManager.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\WindowsBootManager" --mojo-platform-channel-handle=2144 --field-trial-handle=1828,i,4538365727326824219,10769038006178394477,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
      4⤵
      PID:6112
  - - C:\Users\Admin\AppData\Local\Temp\2ZGqVI35eiWooQiWxnuv32zdJbv\WindowsBootManager.exe
      "C:\Users\Admin\AppData\Local\Temp\2ZGqVI35eiWooQiWxnuv32zdJbv\WindowsBootManager.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\WindowsBootManager" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1676 --field-trial-handle=1828,i,4538365727326824219,10769038006178394477,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
      4⤵
      PID:6028
  - - C:\Users\Admin\AppData\Local\Temp\2ZGqVI35eiWooQiWxnuv32zdJbv\WindowsBootManager.exe
      "C:\Users\Admin\AppData\Local\Temp\2ZGqVI35eiWooQiWxnuv32zdJbv\WindowsBootManager.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\WindowsBootManager" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1624 --field-trial-handle=1828,i,4538365727326824219,10769038006178394477,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
      4⤵
      PID:736
- C:\Users\Admin\AppData\Local\Microsoft\Windows\0\WindowsBootManager.exe
  ".\WindowsBootManager.exe"
  2⤵
  PID:4952
- - C:\Users\Admin\AppData\Local\Temp\2ZGqVI35eiWooQiWxnuv32zdJbv\WindowsBootManager.exe
    C:\Users\Admin\AppData\Local\Temp\2ZGqVI35eiWooQiWxnuv32zdJbv\WindowsBootManager.exe
    3⤵
    PID:3560
  - - C:\Users\Admin\AppData\Local\Temp\2ZGqVI35eiWooQiWxnuv32zdJbv\WindowsBootManager.exe
      "C:\Users\Admin\AppData\Local\Temp\2ZGqVI35eiWooQiWxnuv32zdJbv\WindowsBootManager.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\WindowsBootManager" --app-path="C:\Users\Admin\AppData\Local\Temp\2ZGqVI35eiWooQiWxnuv32zdJbv\resources\app.asar" --enable-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2408 --field-trial-handle=1876,i,17712232143290567832,11585176417261378120,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
      4⤵
      PID:5792
  - - C:\Users\Admin\AppData\Local\Temp\2ZGqVI35eiWooQiWxnuv32zdJbv\WindowsBootManager.exe
      "C:\Users\Admin\AppData\Local\Temp\2ZGqVI35eiWooQiWxnuv32zdJbv\WindowsBootManager.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\WindowsBootManager" --mojo-platform-channel-handle=2024 --field-trial-handle=1876,i,17712232143290567832,11585176417261378120,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
      4⤵
      PID:4324
  - - C:\Users\Admin\AppData\Local\Temp\2ZGqVI35eiWooQiWxnuv32zdJbv\WindowsBootManager.exe
      "C:\Users\Admin\AppData\Local\Temp\2ZGqVI35eiWooQiWxnuv32zdJbv\WindowsBootManager.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\WindowsBootManager" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1692 --field-trial-handle=1876,i,17712232143290567832,11585176417261378120,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
      4⤵
      PID:4888
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "cmd /c chcp 65001>nul && netsh wlan show profiles"
      4⤵
      PID:3368
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
      4⤵
      PID:1792
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List"
      4⤵
      PID:4616
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKCU\Software\Valve\Steam" /v SteamPath"
      4⤵
      PID:1648
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM msedge.exe /F"
      4⤵
      PID:1140
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /IM msedge.exe /F
        5⤵
        Kills process with taskkill
        
        PID:4040
      - C:\Windows\system32\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        
        PID:5404
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions""
      4⤵
      PID:1052
  - - C:\Users\Admin\AppData\Local\Temp\2ZGqVI35eiWooQiWxnuv32zdJbv\WindowsBootManager.exe
      "C:\Users\Admin\AppData\Local\Temp\2ZGqVI35eiWooQiWxnuv32zdJbv\WindowsBootManager.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\WindowsBootManager" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=728 --field-trial-handle=1876,i,17712232143290567832,11585176417261378120,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
      4⤵
      PID:5584
- C:\Users\Admin\AppData\Local\Microsoft\Windows\0\WindowsBootManager.exe
  .\WindowsBootManager.exe ""
  2⤵
  PID:2120
- - C:\Users\Admin\AppData\Local\Temp\2ZGqVI35eiWooQiWxnuv32zdJbv\WindowsBootManager.exe
    C:\Users\Admin\AppData\Local\Temp\2ZGqVI35eiWooQiWxnuv32zdJbv\WindowsBootManager.exe ""
    3⤵
    PID:1220
  - - C:\Users\Admin\AppData\Local\Temp\2ZGqVI35eiWooQiWxnuv32zdJbv\WindowsBootManager.exe
      "C:\Users\Admin\AppData\Local\Temp\2ZGqVI35eiWooQiWxnuv32zdJbv\WindowsBootManager.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\WindowsBootManager" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1748 --field-trial-handle=1808,i,10516523529876820789,17317954978055866826,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
      4⤵
      PID:4672
  - - C:\Users\Admin\AppData\Local\Temp\2ZGqVI35eiWooQiWxnuv32zdJbv\WindowsBootManager.exe
      "C:\Users\Admin\AppData\Local\Temp\2ZGqVI35eiWooQiWxnuv32zdJbv\WindowsBootManager.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\WindowsBootManager" --mojo-platform-channel-handle=1992 --field-trial-handle=1808,i,10516523529876820789,17317954978055866826,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
      4⤵
      PID:5412
  - - C:\Users\Admin\AppData\Local\Temp\2ZGqVI35eiWooQiWxnuv32zdJbv\WindowsBootManager.exe
      "C:\Users\Admin\AppData\Local\Temp\2ZGqVI35eiWooQiWxnuv32zdJbv\WindowsBootManager.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\WindowsBootManager" --app-path="C:\Users\Admin\AppData\Local\Temp\2ZGqVI35eiWooQiWxnuv32zdJbv\resources\app.asar" --enable-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2216 --field-trial-handle=1808,i,10516523529876820789,17317954978055866826,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
      4⤵
      PID:4688
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "cmd /c chcp 65001>nul && netsh wlan show profiles"
      4⤵
      PID:1540
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
      4⤵
      PID:5604
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM chrome.exe /F"
      4⤵
      PID:3364
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List"
      4⤵
      PID:5152
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKCU\Software\Valve\Steam" /v SteamPath"
      4⤵
      PID:6076
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions""
      4⤵
      PID:2272
  - - C:\Users\Admin\AppData\Local\Temp\2ZGqVI35eiWooQiWxnuv32zdJbv\WindowsBootManager.exe
      "C:\Users\Admin\AppData\Local\Temp\2ZGqVI35eiWooQiWxnuv32zdJbv\WindowsBootManager.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\WindowsBootManager" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1032 --field-trial-handle=1808,i,10516523529876820789,17317954978055866826,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
      4⤵
      PID:5556
- C:\Users\Admin\AppData\Local\Microsoft\Windows\0\WindowsBootManager.exe
  .\WindowsBootManager.exe /f
  2⤵
  PID:5488

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:3924

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:1444

C:\Windows\system32\netsh.exe
netsh wlan show profiles
1⤵
PID:2592

C:\Windows\system32\chcp.com
chcp 65001
1⤵
PID:756

C:\Windows\system32\cmd.exe
cmd /c chcp 65001
1⤵
PID:3516

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKCU\Software\Valve\Steam" /v SteamPath
1⤵
PID:2336

C:\Windows\System32\Wbem\WMIC.exe
wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List
1⤵
PID:3348

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions"
1⤵
PID:3952

C:\Windows\System32\Wbem\WMIC.exe
wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List
1⤵
PID:4644

C:\Windows\System32\Wbem\WMIC.exe
wmic path win32_VideoController get name
1⤵
- Detects videocard installed
PID:3384

C:\Windows\system32\netsh.exe
netsh wlan show profiles
1⤵
PID:2044

C:\Windows\system32\chcp.com
chcp 65001
1⤵
PID:4404

C:\Windows\system32\cmd.exe
cmd /c chcp 65001
1⤵
PID:6140

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions"
1⤵
PID:4380

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKCU\Software\Valve\Steam" /v SteamPath
1⤵
PID:1292

C:\Windows\System32\Wbem\WMIC.exe
wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List
1⤵
PID:1916

C:\Windows\System32\Wbem\WMIC.exe
wmic path win32_VideoController get name
1⤵
- Detects videocard installed
PID:3904

C:\Windows\system32\netsh.exe
netsh wlan show profiles
1⤵
PID:3728

C:\Windows\system32\chcp.com
chcp 65001
1⤵
PID:5308

C:\Windows\system32\cmd.exe
cmd /c chcp 65001
1⤵
PID:1304

C:\Windows\system32\taskkill.exe
taskkill /IM chrome.exe /F
1⤵
- Kills process with taskkill
PID:1876

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions"
1⤵
PID:532

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKCU\Software\Valve\Steam" /v SteamPath
1⤵
PID:4656

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
PID:4696

C:\Users\Admin\AppData\Local\Temp\updater.exe
"C:\Users\Admin\AppData\Local\Temp\updater.exe"
1⤵
PID:5316
- C:\Users\Admin\AppData\Local\Temp\2ZidQNSw2b3DkU3fP0oLZ5qf3od\updater.exe
  C:\Users\Admin\AppData\Local\Temp\2ZidQNSw2b3DkU3fP0oLZ5qf3od\updater.exe
  2⤵
  PID:5936
- - C:\Users\Admin\AppData\Local\Temp\2ZidQNSw2b3DkU3fP0oLZ5qf3od\updater.exe
    "C:\Users\Admin\AppData\Local\Temp\2ZidQNSw2b3DkU3fP0oLZ5qf3od\updater.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\updater" --mojo-platform-channel-handle=2172 --field-trial-handle=1860,i,11184192435072412600,10309329506355942910,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
    3⤵
    PID:392
- - C:\Users\Admin\AppData\Local\Temp\2ZidQNSw2b3DkU3fP0oLZ5qf3od\updater.exe
    "C:\Users\Admin\AppData\Local\Temp\2ZidQNSw2b3DkU3fP0oLZ5qf3od\updater.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\updater" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1736 --field-trial-handle=1860,i,11184192435072412600,10309329506355942910,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
    3⤵
    PID:540
- - C:\Users\Admin\AppData\Local\Temp\2ZidQNSw2b3DkU3fP0oLZ5qf3od\updater.exe
    "C:\Users\Admin\AppData\Local\Temp\2ZidQNSw2b3DkU3fP0oLZ5qf3od\updater.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\updater" --app-path="C:\Users\Admin\AppData\Local\Temp\2ZidQNSw2b3DkU3fP0oLZ5qf3od\resources\app.asar" --enable-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2464 --field-trial-handle=1860,i,11184192435072412600,10309329506355942910,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
    3⤵
    PID:4580
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
    3⤵
    PID:1544
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "cmd /c chcp 65001>nul && netsh wlan show profiles"
    3⤵
    PID:1508
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List"
    3⤵
    PID:5156
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKCU\Software\Valve\Steam" /v SteamPath"
    3⤵
    PID:5692
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions""
    3⤵
    PID:4956
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4040
- - C:\Users\Admin\AppData\Local\Temp\2ZidQNSw2b3DkU3fP0oLZ5qf3od\updater.exe
    "C:\Users\Admin\AppData\Local\Temp\2ZidQNSw2b3DkU3fP0oLZ5qf3od\updater.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\updater" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1712 --field-trial-handle=1860,i,11184192435072412600,10309329506355942910,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
    3⤵
    PID:4220

C:\Windows\System32\Wbem\WMIC.exe
wmic path win32_VideoController get name
1⤵
- Detects videocard installed
PID:1548

C:\Windows\system32\cmd.exe
cmd /c chcp 65001
1⤵
PID:5604
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:5204
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\Software\Valve\Steam" /v SteamPath
    3⤵
    PID:3804

C:\Windows\system32\netsh.exe
netsh wlan show profiles
1⤵
PID:1136

C:\Windows\System32\Wbem\WMIC.exe
wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List
1⤵
PID:388

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions"
1⤵
PID:116

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKCU\Software\Valve\Steam" /v SteamPath
1⤵
PID:1480

C:\Users\Admin\AppData\Local\Temp\updater.exe
"C:\Users\Admin\AppData\Local\Temp\updater.exe"
1⤵
PID:5376
- C:\Users\Admin\AppData\Local\Temp\2ZidQNSw2b3DkU3fP0oLZ5qf3od\updater.exe
  C:\Users\Admin\AppData\Local\Temp\2ZidQNSw2b3DkU3fP0oLZ5qf3od\updater.exe
  2⤵
  PID:3544
- - C:\Users\Admin\AppData\Local\Temp\2ZidQNSw2b3DkU3fP0oLZ5qf3od\updater.exe
    "C:\Users\Admin\AppData\Local\Temp\2ZidQNSw2b3DkU3fP0oLZ5qf3od\updater.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\updater" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1620 --field-trial-handle=1836,i,17589488740975563485,1004756935061931635,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
    3⤵
    PID:1440
- - C:\Users\Admin\AppData\Local\Temp\2ZidQNSw2b3DkU3fP0oLZ5qf3od\updater.exe
    "C:\Users\Admin\AppData\Local\Temp\2ZidQNSw2b3DkU3fP0oLZ5qf3od\updater.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\updater" --app-path="C:\Users\Admin\AppData\Local\Temp\2ZidQNSw2b3DkU3fP0oLZ5qf3od\resources\app.asar" --enable-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2256 --field-trial-handle=1836,i,17589488740975563485,1004756935061931635,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
    3⤵
    PID:4836
- - C:\Users\Admin\AppData\Local\Temp\2ZidQNSw2b3DkU3fP0oLZ5qf3od\updater.exe
    "C:\Users\Admin\AppData\Local\Temp\2ZidQNSw2b3DkU3fP0oLZ5qf3od\updater.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\updater" --mojo-platform-channel-handle=2044 --field-trial-handle=1836,i,17589488740975563485,1004756935061931635,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
    3⤵
    PID:904
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "cmd /c chcp 65001>nul && netsh wlan show profiles"
    3⤵
    PID:3520
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
    3⤵
    PID:5108
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List"
    3⤵
    PID:6128
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKCU\Software\Valve\Steam" /v SteamPath"
    3⤵
    PID:5204
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions""
    3⤵
    PID:3668
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4968
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:3760

C:\Windows\System32\Wbem\WMIC.exe
wmic path win32_VideoController get name
1⤵
- Detects videocard installed
PID:3364

C:\Windows\system32\netsh.exe
netsh wlan show profiles
1⤵
PID:1536

C:\Windows\system32\chcp.com
chcp 65001
1⤵
PID:5368

C:\Windows\system32\cmd.exe
cmd /c chcp 65001
1⤵
PID:3796

C:\Windows\System32\Wbem\WMIC.exe
wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List
1⤵
PID:1588

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions"
1⤵
PID:2008

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa381e055 /state1:0x41c64e6d
1⤵
PID:1988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Comms\UnistoreDB\store.jfm

Filesize
16KB

MD5
68a2715f6c7c0d5386e50f274b921ab4

SHA1
473a42d83e7c30eed0cc83933c1c8c5f4e9b82d3

SHA256
51b38bb5e371d074db8f01cae1a52048174f872bb907d3146888b8cc9d9086c1

SHA512
4c73349efc4b95c50adbe4eec41d9b373aa7a2272b5b017553721f0e4c5f1568b0946e8d610c1207a0d5a7bf6bd8075d03ce59e30cc29d0f26ccc8a2214c1810

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\ba43530dcef124cc\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

Filesize
4B

MD5
f49655f856acb8884cc0ace29216f511

SHA1
cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

SHA256
7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

SHA512
599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\0\WindowsBootManager.exe

Filesize
420KB

MD5
765efa7f99a486863ba46731cb935229

SHA1
9399d6aeabb0ab4e2defaca7efa43a54d3a34fb8

SHA256
e945d57f3b5534bfb0bc588f02f06c323edec9a810646f24941e397d02e11bab

SHA512
58c337b8df3a0ecf59549caa88d24468c3700a9de9b3bcbf988fae6db15475992b0553da3d2378ebf17e6080a8947b7b83078a8cbfb300f6f9e5218ce1cec042

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\0\WindowsBootManager.exe

Filesize
198KB

MD5
fff91174318462953a9625370576002f

SHA1
43c6d9172e9ee143670060675f90d106ec16116c

SHA256
1468840ceeb4f840396727b860812ae1da9f4100a92771c4f340d498395478aa

SHA512
9c0d81aa3b9f8dc5e043678c98f1322eb10de7ed8f9ef398fa4aefffa9fabdde307183362c2c54aef5af275e25f1b908b5454591fe560f8f2bf0b67b0db5d391

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\0\WindowsBootManager.exe

Filesize
337KB

MD5
939d48d7c9a4dcb938c0cc5814aa1bdc

SHA1
f530058641ee94d693890db3fe5a6110c31bb64b

SHA256
f153fd972c122d7c4a3b6b4507ab01ef953a21c3355fb9068b118ea697bed8ad

SHA512
f6d4128965cb415dbf957d0afc2f91d42a017b112c14956e0af2fe50bef63db84281b4bfb018c56242464f487e18623b12d6cfa4d9aaa209629402e42fa4e576

Download Submit
C:\Users\Admin\AppData\Local\Temp\16cd78c9-2d91-43b9-8d6b-fdf65708749a.tmp.node

Filesize
62KB

MD5
8a6bb156eea9acdb3773f4eedcaa0a7d

SHA1
bfe80d46180975caa14ca8cf0cb7194a48479f22

SHA256
6b1f7b9f0022a9ee6fb7d136334cc7641cc558c7aacb2aacc2c06e9d1e804584

SHA512
f0cb0f9f19acb35bc51235f99c04a7be9bbc8b45e6b69f6e5511d91d37d5e6170ba6532961238a5eb96ad540fffa58d87e4b5287580ce92ac59410cef18741f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\2433eb44-671f-4816-a391-73d933f0fa0a.tmp.node

Filesize
39KB

MD5
15f71ab39eaa77f09b61965e9ee530c7

SHA1
c3d186a1e3c9daffd5e9aec121329a4275b0bb96

SHA256
d74716f8a4fb3b6429b038916d49c4370de41f094ba42121cf8c604ac2eedf23

SHA512
574c53d011ab2414ea4890a55ad57c2517dc355aa69ff030808038182f3315ae12583f77c0a69d395735f642308640606427d1def25eb12fe96eeadc1dc2962f

Download Submit
C:\Users\Admin\AppData\Local\Temp\2ZGqVI35eiWooQiWxnuv32zdJbv\D3DCompiler_47.dll

Filesize
35KB

MD5
6ff3095d209923624b9be3b13e7bc219

SHA1
cc0b668e19f1da1fa01aa37982bad07474fb27ed

SHA256
031bf734aaa803d98cad10cb11b18dc8e779753c87fa7655af1ca32155e573e8

SHA512
6518ecd9e90ba23675b8f244866132a5d3b0396d669e642f9095f1b8c7d27aaef10fa4804d34c839f8bd53a2c364d12b36daa48ff29c52226471c61cb04f6b07

Download Submit
C:\Users\Admin\AppData\Local\Temp\2ZGqVI35eiWooQiWxnuv32zdJbv\WindowsBootManager.exe

Filesize
72KB

MD5
c1d4461bfee01dba662c6b8037fc0cff

SHA1
889d865f2e360a0fc9827f8d37581596b6fbeb1b

SHA256
18f0e40c86a7fb2028be5569f681531613a82916714ff949ec14835049fd2f56

SHA512
059ab7287acb5c76feb1f3d09884cc17ffbce43e23739e3e9dc0676314b13e12c360fd4c562e467b3c53028f6ecd523031796063ccc8cac0c2e4fad0391ec9ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\2ZGqVI35eiWooQiWxnuv32zdJbv\WindowsBootManager.exe

Filesize
159KB

MD5
808c146f6bb3d44e4be5ba9b905cba5c

SHA1
27ab3c722e66cbe6024a816e1cff5968c263fcda

SHA256
97e70d4e6c0478f0bf192ef2035f18855365ae161f8fadf81a91f2f7b5f80b7b

SHA512
4c6b479bf65d37ccc235ed760b86e86570a6674575e8a515f4ba95b7a6e6d2703fed4e75b02c4286dfaa6a01b7694c66028a89f0b8b5e6cdedc29bda4771860f

Download Submit
C:\Users\Admin\AppData\Local\Temp\2ZGqVI35eiWooQiWxnuv32zdJbv\WindowsBootManager.exe

Filesize
266KB

MD5
498404cacd7927ab3602fa6adb9cb9cd

SHA1
644f7609c99c4108c29d10347d95cc8fb80f4a50

SHA256
dc346ac345d5ff788908b80c417fb0bca3838ab7ab3e52b3a509e9ad69e3018f

SHA512
c445d81442ab3a0a9c7afbf366548da982ffda3e8c7928f1d43fd02ef543bda00da1bd7ca78ca6638cbe548ebfae72b3791ff16fbd27c67e90029f535b7c1b1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\2ZGqVI35eiWooQiWxnuv32zdJbv\WindowsBootManager.exe

Filesize
67KB

MD5
7eb52ab3a0d07f28ef91c71d3bab48b7

SHA1
8d8720be3843e52b9b1649146d6fb31642fe82f2

SHA256
fae7a11a1b671d722378716e1bd993be0312b27a4da4b0315279db52c8ffe8e7

SHA512
24d745962aa8af745398959dedfc3927b5b94bfa527db782a3faf6c6e3e87743ff9cfe5d9de99f751a31d736ee193fb0e998f5e1d4045b75996be000a936681e

Download Submit
C:\Users\Admin\AppData\Local\Temp\2ZGqVI35eiWooQiWxnuv32zdJbv\WindowsBootManager.exe

Filesize
91KB

MD5
31acfe04db046c67cee5bf37881e0f74

SHA1
ef45eedc0078397e799c1573b4c8850ee466410a

SHA256
a949ed8175b183f6367a4b2612d2c6a272d58b4cc54e345725e79e7dac435d69

SHA512
d9c79e4b22db2808e82cd3829139208bd28236b7c1da3ab20debbc826664587f3623253a163f56b880bb0b1bf0dfc8e7b2757c0f4bd9797e005021e8bf5310cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\2ZGqVI35eiWooQiWxnuv32zdJbv\chrome_100_percent.pak

Filesize
72KB

MD5
33b7690c798ef28c204f2b425bb1504a

SHA1
e87cfa9269c4a13025f343ede23a967dc318f986

SHA256
fd98383ef5f6614174b4ebab6ea1a0fa3b2e75dcd734e68c238d65ed730a02b6

SHA512
1da4bb276341a00e8d6bb75a6c05a821112500bb94c2f7ccbd0a8ec5b37484114001e97cbf8ddfa24b2718d421a49dd522b8584aefd44e8bc2f02202cdb0fff2

Download Submit
C:\Users\Admin\AppData\Local\Temp\2ZGqVI35eiWooQiWxnuv32zdJbv\chrome_200_percent.pak

Filesize
56KB

MD5
8b5d4286ecb33747e4acfed566d9d1dc

SHA1
b4cd2b03cdb64421befd14a6c7d22733bca42c9e

SHA256
44ecc0c56d029ace5b9f1dd9f58a0265172a82440475e903905948ba43170af7

SHA512
ef49fb7a7bd5469b6f1bf5006b880707e0ff265aa9826e70b5b3337792de5ba429c3e2db23e8e0ce09de2ec1dbd2bc43e4171e13dff5bcebb1234fc992684b34

Download Submit
C:\Users\Admin\AppData\Local\Temp\2ZGqVI35eiWooQiWxnuv32zdJbv\d3dcompiler_47.dll

Filesize
183KB

MD5
be8c06fe14635ec1f98c47e92b1f387b

SHA1
fd773b588174763891b4b31e2835d37490d5ffa3

SHA256
1e44ee51e04386d9ae692504d90e3034c9812303393cf24dd28fe0f3312b825e

SHA512
16568b59978d2cdd47a549b8306addfb63af1294338f21cd0d61a05c648f9a5550b470f6b62967af468bbcfffc26e52dfa390c361762479002e87c094c3f81a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\2ZGqVI35eiWooQiWxnuv32zdJbv\ffmpeg.dll

Filesize
115KB

MD5
028a190ed0f97b07b662a0887dbe5cf3

SHA1
24cf0e36ddb74d82696236a65398e25daa1f1fc8

SHA256
5977b182a22e73b7d0c9f6fdec92c4291316e429d4586537c841e32d8edf172b

SHA512
4745152822825aa1568e3a7e1dfffa682a5085ba9d16fde6e791951402d7558faac1c8a2a8615d0aefe2cc94c46fa3b1bc07c68c6d7a7a9fc988ee2dcbe25411

Download Submit
C:\Users\Admin\AppData\Local\Temp\2ZGqVI35eiWooQiWxnuv32zdJbv\ffmpeg.dll

Filesize
130KB

MD5
d2737e4768c3dde8debd1c08fba0fe3e

SHA1
4490d808846f35510913958cfcb3e34f2b7e39fa

SHA256
cf48d30063e5f766674e5254c6bc6640cb7c6a262d205aa6281ee26676347bef

SHA512
4c7bb976ef074aa77da8895355dc831404475857fb1fc83f73a19f9ea296b5d34311742590c379b6d83471156805d347929480bad1fb28b9f653115f8286a657

Download Submit
C:\Users\Admin\AppData\Local\Temp\2ZGqVI35eiWooQiWxnuv32zdJbv\ffmpeg.dll

Filesize
57KB

MD5
3ffb62f4da56e0787ebdf2a78a443cc7

SHA1
cd28365f26b178b0f39b84fcd638bdbc38c26de2

SHA256
5ff4495670051296448854bb22a49bee6f6ed64aad99c33f91c9dd4a26b95094

SHA512
f631430a77cde6efead0a90d4c1f205f108ba2ecffc1850946938194e00b729b54782af460eaae718a162448a0e12b2791225385c7092ccbd2ef6222393038df

Download Submit
C:\Users\Admin\AppData\Local\Temp\2ZGqVI35eiWooQiWxnuv32zdJbv\ffmpeg.dll

Filesize
216KB

MD5
d66219b7ed1986a9c6e43cb4f13481eb

SHA1
7cfd05d81fe4ae1520918a2739f5b1f206d77a16

SHA256
d3e5f027844664913636162a3d11356f70a81d190b8d0d679e04af74a8ee557b

SHA512
aa83839080db2c0e2fa84c23672aa32ff4b25097fc1de48cc911313d9a04c2d0f677550b16f12724163cb98f800944c508adb163c9fe9ad7d27b7279b3336c6b

Download Submit
C:\Users\Admin\AppData\Local\Temp\2ZGqVI35eiWooQiWxnuv32zdJbv\icudtl.dat

Filesize
37KB

MD5
a434d22ffb9feaba2a6e648ad3de728f

SHA1
8eff1550ee1e2312726f9312f7a8e14213d3b9c0

SHA256
b5b7730eff93be3a146a1735efc85932e31c92909d69fe628fb8811e804a1b6b

SHA512
f21a252b2dc05430051b00efbd444edda899bfabb61b108badf5ee66a32d2cb198d2cdb1d0a219f41c1ecb3c1185a5428fde4348fb0182c273ca6902ca21c70d

Download Submit
C:\Users\Admin\AppData\Local\Temp\2ZGqVI35eiWooQiWxnuv32zdJbv\libEGL.dll

Filesize
111KB

MD5
8f0b895c0893c18524895283b21f530b

SHA1
598fe9c194c82ace2f09ece21b8d8487043a77de

SHA256
a27e808b23160c7fc8dccd5f14d5ec49fc096e89f62d7b3f1d4faa3c99fdf3b1

SHA512
66cac01330438b65bc5d532d996aea818513897abb1289e53c0f494306e80332fd1d9c345287760943006c7722716369fce6c965bcba3c863a179de106c80487

Download Submit
C:\Users\Admin\AppData\Local\Temp\2ZGqVI35eiWooQiWxnuv32zdJbv\libGLESv2.dll

Filesize
73KB

MD5
28f3337db70cf8129b35eb4992861bdf

SHA1
a7f3cb6c2e76bfeb81397fe328274dc0954c746b

SHA256
280260ac1efdadbaab9d62dd885f84d542bb0ed680ccdad271c55d74fe144353

SHA512
36b38c86fc3ed83c9fafcd1c4810c590570eba0b4a96f37ed916ebb00455cd727e708af432d0d2fada17f049b3f4031808e743a6f2842dc977081a464d20329a

Download Submit
C:\Users\Admin\AppData\Local\Temp\2ZGqVI35eiWooQiWxnuv32zdJbv\libegl.dll

Filesize
51KB

MD5
ef8fa5bc5cfcb0124540d77eb13b11c2

SHA1
2cb14efb997ab296db21b05994742e3b7c14062b

SHA256
618ebf76543ded7fc47097d56b45fb57eeaca2594df61e93260e61fce12de30b

SHA512
cc1f156a6b9371317f8a69f4f2dfc9d368026a1bb7746729d7f5958532c437642f03ce33f481cf23971055617c38dce3cfe21ca793771f744b23b724f61446b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\2ZGqVI35eiWooQiWxnuv32zdJbv\libglesv2.dll

Filesize
84KB

MD5
8e69f629ecfb4d74b86573fc16f2f4a4

SHA1
ddce023dafa6d5aa984e8b90b391a573943de9f3

SHA256
8ad7ddd8832cea5e1743281bc9f294b48b5dacd8a2a1014f99255e9103b64272

SHA512
42bd80209f0eccd4e6c639df95ad351ecb2688ffbed1675dee3f9076bb203e08eaf516a8ef34026baa853ca4f4a8a47abf990235d2a6aa16f67c901085b22546

Download Submit
C:\Users\Admin\AppData\Local\Temp\2ZGqVI35eiWooQiWxnuv32zdJbv\locales\en-US.pak

Filesize
114KB

MD5
88b9e849c0035cb100d031fa5e3fa0b4

SHA1
3576e0fa589e53ae36d2b75937bd3c5c0ab8dbfc

SHA256
25462802f57f52581d34d67df00f7a4d62cb5ee5ee0e5e853f48ad9caf04dd89

SHA512
99e8cf196cd9098adf74f569d06043809454860f8f3de9e942f3ce3c2faeeaa3d6bd0572503cb6c2a6b932aff9aa7e4542501731693ec6a015cc7282af388e8b

Download Submit
C:\Users\Admin\AppData\Local\Temp\2ZGqVI35eiWooQiWxnuv32zdJbv\resources.pak

Filesize
233KB

MD5
6437f44cf7a10e3bf94f14f5d9d27ab0

SHA1
9be3edfdf1e1207ec4215e5c9f2195294837b1b4

SHA256
049876ec97eedf33aab098992abed841b01b762301b952b87d0feb191e134a9e

SHA512
8739e7276713a2563cd3cab90bd1dc11af788062d9df9d4a902f2f12cbbacd18d1459931f228f8af95fa367b6154a73f7d31d136812526b28a6b78eccd9e49d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\2ZGqVI35eiWooQiWxnuv32zdJbv\resources\app.asar

Filesize
127KB

MD5
246ebc30e36906a1ca0116ac981f0612

SHA1
a8bedbc8f5b9ec0437ed35cc3c18663666b962e2

SHA256
fe6a5fb84a31cb48c98510213d2ad9bb2e0719edfb9a5829d66305283b7f39de

SHA512
2f349e3077d3e174bec18615185c3150c8540b329d32fd13b989f5ef2a9f5a16b972d3589a23c40e8e60da0a2f296631108f50e9256ef55bd7044804b0c7cb1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\2ZGqVI35eiWooQiWxnuv32zdJbv\v8_context_snapshot.bin

Filesize
85KB

MD5
f06be5100e56e35f5b150a56b1a1ab8d

SHA1
dbb883b703a7405da0102df539302935470fa113

SHA256
668275c8e4c2017b60b8aff94d7588e23871d768aa6424ab2b83e950e3b9be1f

SHA512
a3c62c670075dd5de91263581a2412845fc7ed984eb338a969b1bfcd0b7cd5cc8afd7e32a783b36550337066032faf821c3c229d93a3732e6964d1a7bbc0cf7b

Download Submit
C:\Users\Admin\AppData\Local\Temp\2ZGqVI35eiWooQiWxnuv32zdJbv\vk_swiftshader.dll

Filesize
13KB

MD5
44c568103462e3a460d4ac4422105974

SHA1
9616debc064bbafacc8ad499fc101b297c2017dd

SHA256
4630ea1d6912e25d704fd59f072ac11df0ba9635b8504436a739f97e6b5ab724

SHA512
5433ea9cf1643150e0ac2e445e14d6beb7887e79eb5228b93a03d87e94b20f7b361928e9a2b1b0a8662e9eb04b09a5256f9ae72f93e4d7b3e0385fdaefff0bf2

Download Submit
C:\Users\Admin\AppData\Local\Temp\2ZGqVI35eiWooQiWxnuv32zdJbv\vk_swiftshader.dll

Filesize
14KB

MD5
f334bfc670b6b64826d6e2533f5725b3

SHA1
d5b4d8ede4fcca5768535d552ebcbcb52eab5623

SHA256
00b4f6aea57879b9ac98c2fd271572d76b6bbca227db793c4ff53d2aaef3d30e

SHA512
f17c461b6ee5cdff4eaf40040a450a5766526eb11c9a41d282b100b85d16a4c2d62d9655ca3a3d5f57a65167bd3bc0ed0eda8788c8329e37e3d8ca8f448d2bd4

Download Submit
C:\Users\Admin\AppData\Local\Temp\2ZidQNSw2b3DkU3fP0oLZ5qf3od\D3DCompiler_47.dll

Filesize
252B

MD5
4131b838a64ce470b2c6f1ca818c6dac

SHA1
288e20538a714b0fc74ce45ec148f4dbae35a65e

SHA256
1fc0e57982ac52e81c64821186ff98c0da0477253a58253536fc3bfed336cedd

SHA512
85157deff818a2f0e7a4a99c24183db23c40d4d80af793fbee6e89fc482238621ef154aa2f3b48ce93df3927b80baabde6a37dbf698750e62af903f0fa36d8aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\2ZidQNSw2b3DkU3fP0oLZ5qf3od\chrome_100_percent.pak

Filesize
87KB

MD5
17c0a7eacb5e64872e9c629939c11d65

SHA1
4235fd0814e32bb59f3b83759a71736f758dc00d

SHA256
94c327eb89f3f75661b39752d675a1a68d9726a901e6af02feb200a04a9eddef

SHA512
5c6b859f16163253f3bab5edc5f570a6cf54d8f9f7c402c903cc91e0b9e9d8e5f41d526b0a7a9c84164f2354c691374748779088a3ec3257c80d730e73ad47f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\2ZidQNSw2b3DkU3fP0oLZ5qf3od\chrome_200_percent.pak

Filesize
1KB

MD5
29f9fce12f52c5b03332a733abd10012

SHA1
7d4baa37d07d455b64dd24f372bba65c6cddda9c

SHA256
e82b4a381daa7dc77b20a8352bddc0e9c381ddb78e44816600411fbb0fb8376e

SHA512
3f83da3acb894cf5e2561777901e1d793c405b99a02bed28d5a6bc1b094766d2c29f8a802232e6f051e870f6a52013cffccba1629e792192c10e881a8bb47cf0

Download Submit
C:\Users\Admin\AppData\Local\Temp\2ZidQNSw2b3DkU3fP0oLZ5qf3od\d3dcompiler_47.dll

Filesize
1KB

MD5
c7db3d46b52c0e54da8bb77514ab8756

SHA1
e8486530609a818f681fad6f0d084bbcf7b2b37c

SHA256
8d7fa78a0e6456e95c7fc13a3d19bb67b62e76a7af9a516c678575826a5c1772

SHA512
a7b3199388c989945ea31c2644bfb92040dce8234738c8bb74bd508fe33786b967f7281bba83afe2f6e8ab9cbf01bd694eda1c7d3bf77b8530056daa154d1df7

Download Submit
C:\Users\Admin\AppData\Local\Temp\2ZidQNSw2b3DkU3fP0oLZ5qf3od\ffmpeg.dll

Filesize
14KB

MD5
3871420836320862ac4607f18b2b411d

SHA1
b32f5a4c81b581228e6af44aea802b7e032d2197

SHA256
e2d82c894647bd7576f3b0be199dafa426a803c71c59533fd88bd055e36fba44

SHA512
afd724984cb554790a94172266388baa0dea5b1f4cbbeafa8b5186e58e5befda435bf7515d8bc789d2014cfa4defe6285e569cfe273321ecba4a41c89755a7d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\2ZidQNSw2b3DkU3fP0oLZ5qf3od\ffmpeg.dll

Filesize
64KB

MD5
58292d66f3ce87ba0bbfc2a237b3e9b1

SHA1
b4217e0c157f0363fb072a4a2563184a91246c7a

SHA256
34f4d19d7ee2feb7136a323a3d16013b3335c173e664882213ca732a75dbe9f6

SHA512
85de18cac46fec012a8bd6c4b8b5491e1da4c52880e68eca98c373e27e1a49561023ce41b0551e5b3393afccdbfb8478a1dbf9664dc376379ba707cde2638892

Download Submit
C:\Users\Admin\AppData\Local\Temp\2ZidQNSw2b3DkU3fP0oLZ5qf3od\ffmpeg.dll

Filesize
2KB

MD5
8aa282f26ddebef8ca9193b0437a2cb9

SHA1
110cae18bd80d743fe8819645588ec4a2b7e4932

SHA256
a74bce58a6ce0838e3f5dadd16fc06a606e9c25c1afe66989593232dbe7dd8a1

SHA512
4a4b173d6cc26617391885e37bf6852d0f57a7fac2c3bcbea9baccd3c6cf5362609799170055e5cdcf7514c6fe668ae134995c2287984d0586d3c0e3a86e3c92

Download Submit
C:\Users\Admin\AppData\Local\Temp\2ZidQNSw2b3DkU3fP0oLZ5qf3od\ffmpeg.dll

Filesize
6KB

MD5
f1afba773c8fe6067089bb0810a2d155

SHA1
42a6e55411334aee30cdcd2a0cebf3984e0bc496

SHA256
1b8a74c1ad567e67120cbbe56f9c8ce8e879617148eee7f3d5396f346806f138

SHA512
f30851efd396170f912389b7d7aee9df36261ee89f41a606966647beab2c6980199af09443d45b85105df50cac7629705f68d11ebbb5fdd6923aaa14a74f1108

Download Submit
C:\Users\Admin\AppData\Local\Temp\2ZidQNSw2b3DkU3fP0oLZ5qf3od\ffmpeg.dll

Filesize
55KB

MD5
22ab228124af8d9975463d9c26a02685

SHA1
5aa7519d41be28ca3818c7913519a47faebf0f48

SHA256
0f06303f42671a46c4f22dc7181f2cce0e4d5afba5ee70c8d210d38b13db73dc

SHA512
d62d7b40a9e0e3ac4bcb9fe731bd89b3cad0aa6c72c8402787a5eefdd4fe05147d6df735834ad73424f366a10acdf626c0e8d8877926c644aa02b9cbe576b609

Download Submit
C:\Users\Admin\AppData\Local\Temp\2ZidQNSw2b3DkU3fP0oLZ5qf3od\icudtl.dat

Filesize
10KB

MD5
3b2487bfdb3472f623614737e3352b16

SHA1
caef6e811ff8ff234bbc98028d22675681ad07a5

SHA256
fcadc6df3cd0c49605569b992ccb01427264dd885e3b14878f2922d5d5d862fb

SHA512
d12bec59f485fb7c41cbc26e784f9e10db33af4ff6874c8ff753f0acc8d7598280b49c1ffabcce51247c3bb5da4132e3bf0ca08ea5709d885ca9c936c9a8d43a

Download Submit
C:\Users\Admin\AppData\Local\Temp\2ZidQNSw2b3DkU3fP0oLZ5qf3od\libEGL.dll

Filesize
27KB

MD5
2a97476bdb5e70e8a9f83557c66b55c2

SHA1
c2c6c6718c12c069397c9b6afc3571567ed4905a

SHA256
fd622ba44e2d7a43aa3902d94ef86bc1ee8b6d3e64fd94fb177bbaaf43648c4f

SHA512
e10e16b793da1088ca7837f21c9590ffd3e093feebf78be4761c07ed0c8ad8805a1c158131d90a56663ca81036a970f2cd04356982971ba0943ea54f73a9fc82

Download Submit
C:\Users\Admin\AppData\Local\Temp\2ZidQNSw2b3DkU3fP0oLZ5qf3od\libGLESv2.dll

Filesize
3KB

MD5
72530da09fe503671ae15f3129c7e86e

SHA1
b07e0b4ed6bcce16d2358a8d51a9843a32d7760f

SHA256
b913ae5e219d8c1623fea5f750247bf1c2f82671a7db6c8e599fd6dcd813d642

SHA512
a9544dd7675fbaed98711af86fed4aa0031c96440b2d116727964a8bf84c3c288bc320042691e4dc4275cb58543d7c00f5d4946a0776aed262c5a9b2172b3c11

Download Submit
C:\Users\Admin\AppData\Local\Temp\2ZidQNSw2b3DkU3fP0oLZ5qf3od\libegl.dll

Filesize
2KB

MD5
fcb19422f21e4a8621271dc08f88c48b

SHA1
a3ff4977e9fea25d6fc5228b2000085bf3612cae

SHA256
a42ce89114ec031a91aa7e495e0f562519b1fec21c3ab75adbf7546d2ec1eb54

SHA512
1e3ae2cfcc3b87ed11ff21b9df6a252c1b0d71229810784d867cfe5439132f26c5653c76c4271d471d6049ed4675d5665327f6513625a135a29a3a0b01047418

Download Submit
C:\Users\Admin\AppData\Local\Temp\2ZidQNSw2b3DkU3fP0oLZ5qf3od\locales\en-US.pak

Filesize
5KB

MD5
ac6048af6d2ce05b68163326405e6610

SHA1
6498d050bf2f976363c80d8483fb35194c755b3e

SHA256
da4b2ca20a61b6a28b8f9760f1be9578822c6071a3365b14dd4f954c522dcc4b

SHA512
eea7dcf513f3ad459c6ee14b1ec2efccd6c1eef99ed6ecb57c683b26e788e766575d327a6e6100f70490a97131853668205ffeb60e396acfac866a51b42fc1b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\2ZidQNSw2b3DkU3fP0oLZ5qf3od\resources.pak

Filesize
11KB

MD5
fd0462be86dfaa0fa5424fe502512235

SHA1
d9c330507912b976d89f5a3548e07c763ad45c21

SHA256
d135840094dc71008039e2374ff4ee42e78fb8422e7abd3afccb61ac0475cc96

SHA512
c8fdc06efd03917abf4d4550cad96b7322610dc7a455458c952fab64a139557372e4d791e87d5802ce7de5cd7e1ea66902c8a11e3358cbd1de4250a4f0aa889a

Download Submit
C:\Users\Admin\AppData\Local\Temp\2ZidQNSw2b3DkU3fP0oLZ5qf3od\resources\app.asar

Filesize
9KB

MD5
fed7a2c6db9353fa44dec4c2d3a56817

SHA1
351a9929f1aff8cbd43ad005270b7406467ed760

SHA256
e77fdb00f152ccb361d70745534ef1b491d2ed2f72b5059db8de41dd19f43e54

SHA512
7d15a61b648790c3c33a199a0e799393d9b08c55fd1415856628fb9b81d78346aa80464515251b6fc3b5109165e5dafba0131a667d8b7d39951e56e1973515e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\2ZidQNSw2b3DkU3fP0oLZ5qf3od\updater.exe

Filesize
88KB

MD5
3267158f350c93c8bc97d2666ca689e8

SHA1
2bebc57beef6ed0189cbf6a28238646561569946

SHA256
3f02586946a99d039cb2ac23c6d98d19ea3a5c353ead3815ab6631422baacd6e

SHA512
3f7f25f31bb41e402ec5a5280453937ba275bd551aa7bbf5ea788c588919be5a6af85ffa57667f23f89170521e92b651ca840633af9088c2e6231938f6ad028d

Download Submit
C:\Users\Admin\AppData\Local\Temp\2ZidQNSw2b3DkU3fP0oLZ5qf3od\updater.exe

Filesize
1KB

MD5
0261c86dcf4c498f39c2fb12452e18a6

SHA1
4147fb1e83e92632a06c23c7c97b3e7ce7165385

SHA256
6b762474d5811a86a86223ee7e1417915856751fdae950fb319844cc0299b645

SHA512
82601af21335a31eebcddc786592b3e466bb4eed5ed6db4adad812767e6aa5b2a6913d09482dda80a202cc63d9ab5a799704adb44fae332b2d2e7ff1674053d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\2ZidQNSw2b3DkU3fP0oLZ5qf3od\updater.exe

Filesize
73KB

MD5
22115afbb7a351fdb0b2f6cdf53ab622

SHA1
10fd006c861c51b65689bda1859e96188614d6b6

SHA256
4c0deba269cccec929fb77e5ff54780aaffbe0bc7e71489540039b107904e3ae

SHA512
dda9c4202ec856bf19ad10e43ce103f530b727a14ab2a8a0d6c0e67652a89b2447321d0d9ccece26e56fe09d1c722e0c9dfc0c28a0e8a0c019967137b24b0619

Download Submit
C:\Users\Admin\AppData\Local\Temp\2ZidQNSw2b3DkU3fP0oLZ5qf3od\updater.exe

Filesize
32KB

MD5
55b222986b4e275371cf996917e9820e

SHA1
573c9388ef8ae997ba4f1be2776d302a54fef4c9

SHA256
cff99e41762d8c3b2e51d617fc16b4df0acf61ec267c07f7dfc5cac738997ad4

SHA512
d96144c832728dce344218d101e9b1997ae607a8a19b5436c73fbd598f6eae959d551414bce31f0b0e81cee9b15e96deb2d07649b0df78e132d9bf18652972e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\2ZidQNSw2b3DkU3fP0oLZ5qf3od\updater.exe

Filesize
67KB

MD5
269fdb76b83c9e0ad4ae49827262980c

SHA1
00b14396351b165dc05f72d461c119e15a5d0eb9

SHA256
4f102e8a4a2c19403b7db3b1d1d1d01f62262faded6971215a8fddc6e5e4cf54

SHA512
0ce4e8127e84027d7f2c8bcf7ff2cddbb5a147fd15c23d9f5499b3762ba3a212074334fb7415bba5224cdec197b4a6ec10fb14ae5b274c5d13f4188e5f0268a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\2ZidQNSw2b3DkU3fP0oLZ5qf3od\v8_context_snapshot.bin

Filesize
7KB

MD5
5a268c4b690ee3ab29f83847f7c698b2

SHA1
cfd8dea4e86dc92378cd1603edde7d5eb7f72f17

SHA256
413902db3211aa70d1dff3b39810380994f7a295ab7a20f14309bde81ac76430

SHA512
79359151d26c7e202e8f89b4164d3a9eb7eea9bed59023da3881fcfca06865d06a2387ea8a34931a9fedb211bc90e16ab94bb7017a783348b963009a6d38141c

Download Submit
C:\Users\Admin\AppData\Local\Temp\2ZidQNSw2b3DkU3fP0oLZ5qf3od\vk_swiftshader.dll

Filesize
6KB

MD5
4f3156410e15811379a2d8df9bf070f4

SHA1
5fae80eca8570a99a2d2cb14a8bad4571822c783

SHA256
46f59f86e233e00f6202775466f1d341037cb43e4f1127a6c8edd22b0cdc3572

SHA512
f640a97989a9125e081809a7259f11c783d0786239e65b20264a6cc29fac362595e60c38ab3c73e041681c3a7abfb14715170c81ce5d98a6d213bb1c2ce97b30

Download Submit
C:\Users\Admin\AppData\Local\Temp\2ZidQNSw2b3DkU3fP0oLZ5qf3od\vk_swiftshader.dll

Filesize
1KB

MD5
6b1d7a965d836ab921f4cc1e9bc92b28

SHA1
aa9dc06e4cb68fd7730d1a57c87ad02a5f9e2c04

SHA256
5e10b79d2acbf515ee616e50095ee7d3c3ae3c019cdeb4bbb37a4fe7cac5bb62

SHA512
48c68c727fc7868929370b5dc8b1a382eb6fe7bb42e5f1a251a5a2ac7535955e5bfbab439d82cd6838dbae280ade941e0dab5a35c2f2c24b0755816be7c6a938

Download Submit
C:\Users\Admin\AppData\Local\Temp\2ZidQNSw2b3DkU3fP0oLZ5qf3od\vk_swiftshader.dll

Filesize
21KB

MD5
54b7bd606e61d02b9cd7e094d7730d44

SHA1
551df1ba72ed1c38a4641b25e1329cccd2a8e0ba

SHA256
5bf2cb30eb78aefa336b4a85b52f7e8de9264590db0f018f57aeec2efb219de9

SHA512
6b5a6fba399c93fef9eb835eab15bc6520b7ccaeb3bfb68d0dca1443bf456dd4cbea17255547f77bcd3b66c966a0f14b6ae342095db66ac8ee050e29a370fda4

Download Submit
C:\Users\Admin\AppData\Local\Temp\4e4430bd-84d7-4300-8fed-c1fbfb663a38.tmp.node

Filesize
148KB

MD5
635fb2f09f2e94368adca1cfc3d0d091

SHA1
0f0af99b5e129b0afaf5c4263c298e7d64bcc56d

SHA256
20b7b69b42413771a3aa9a62a0b4bbc9929d74a313c23fbe8c973c0baf3163fb

SHA512
7063836e81c500065029eda63784daae5f62d8a0d653d46b29cca11d94152e08b65c0bf162995511f811aeb164f95b362491f148bad86b4306922b7005be3b2e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cookies

Filesize
20KB

MD5
c9ff7748d8fcef4cf84a5501e996a641

SHA1
02867e5010f62f97ebb0cfb32cb3ede9449fe0c9

SHA256
4d3f3194cb1133437aa69bb880c8cbb55ddf06ff61a88ca6c3f1bbfbfd35d988

SHA512
d36054499869a8f56ac8547ccd5455f1252c24e17d2b185955390b32da7e2a732ace4e0f30f9493fcc61425a2e31ed623465f998f41af69423ee0e3ed1483a73

Download Submit
C:\Users\Admin\AppData\Local\Temp\Login Data

Filesize
46KB

MD5
02d2c46697e3714e49f46b680b9a6b83

SHA1
84f98b56d49f01e9b6b76a4e21accf64fd319140

SHA256
522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9

SHA512
60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

Download Submit
C:\Users\Admin\AppData\Local\Temp\Login Data

Filesize
48KB

MD5
349e6eb110e34a08924d92f6b334801d

SHA1
bdfb289daff51890cc71697b6322aa4b35ec9169

SHA256
c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a

SHA512
2a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574

Download Submit
C:\Users\Admin\AppData\Local\Temp\Web Data

Filesize
92KB

MD5
d63e3a8d4109b7212d419e17141dd862

SHA1
c9637da0763277477e60128ae2cd26fb314fa80a

SHA256
0cdd05fd9d9515c99e713a0cdf201fae20cd5db884c08a292ce16471725c521f

SHA512
dfee6ccabfe03415bea0d817ac0c393e98b54a0dfff102f0eee21c8e85d903e11a073aa97b7a3e8b95d88d5f86afd4c9782e7618e3119727da1e01d4895315e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Web Data

Filesize
109KB

MD5
1e41e1bacab9391f473a683238739034

SHA1
2b8f9ae64fda22104b375bdfd4f72962217c5d67

SHA256
a712ca2b384377843fce36c28f92c9a053d2b4d0dc7c1525ca76501cf547ef32

SHA512
ea430c11099fe74ac59fa5c198483db1a725039879f3038dfbe55a9c63ba224b2f9ef6db3a5c8ab9baf7c7e318ca77dacb4cd850c27a26ddb9ed8ebce13f8255

Download Submit
C:\Users\Admin\AppData\Local\Temp\cookies.sqlite

Filesize
96KB

MD5
d367ddfda80fdcf578726bc3b0bc3e3c

SHA1
23fcd5e4e0e5e296bee7e5224a8404ecd92cf671

SHA256
0b8607fdf72f3e651a2a8b0ac7be171b4cb44909d76bb8d6c47393b8ea3d84a0

SHA512
40e9239e3f084b4b981431817ca282feb986cf49227911bf3d68845baf2ee626b564c8fabe6e13b97e6eb214da1c02ca09a62bcf5e837900160cf479c104bf77

Download Submit
C:\Users\Admin\AppData\Local\Temp\e1e3a04e-6621-4bb1-9b35-34223e610bed.tmp.node

Filesize
57KB

MD5
1357caf817d27c97e8b965fb1d2338fb

SHA1
61deb5a0acfcd0dec1a394dc726eb64e4250e543

SHA256
bf5a0ba5489133a047f0446e342a183cd9afcee4ad1451e7d0267efd69b616b2

SHA512
a6d4dbfd1215321bd827ca3439d570a0e01d9e33caf244b9bbeaba59b37b7632c50adc210e85cba0c75d86b83f53abe9316b16c9731910fc33731589869a38d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\e50b8e80-b23c-4e84-abeb-3eddb82ea5d4.tmp.node

Filesize
67KB

MD5
1ac0730ce2e5b48cf7e70019122ed328

SHA1
91ec58a5890dd342831ff4f60992273b65897b6f

SHA256
f094bb0243462cb3a74f495397e3ab6ce152b8e1bea0972844ea81d1ff9f832f

SHA512
82562c6bb19d1457aea63c2d08e93f2a636676784dc158710ba34968ac0246ef89ab7568379cff79286407d7c0586f309a6f4937ca73ace90fad89e20628d968

Download Submit
C:\Users\Admin\AppData\Local\Temp\epsilon-Admin\Antivirus.txt

Filesize
231B

MD5
dec2be4f1ec3592cea668aa279e7cc9b

SHA1
327cf8ab0c895e10674e00ea7f437784bb11d718

SHA256
753b99d2b4e8c58bfd10995d0c2c19255fe9c8f53703bb27d1b6f76f1f4e83cc

SHA512
81728e3d31b72905b3a09c79d1e307c4e8e79d436fcfe7560a8046b46ca4ae994fdfaeb1bc2328e35f418b8128f2e7239289e84350e142146df9cde86b20bb66

Download Submit
C:\Users\Admin\AppData\Local\Temp\epsilon-Admin\AutoFill Data\All Autofill Data.txt

Filesize
249B

MD5
cf7e4a12f932a3fddddacc8b10e1f1b0

SHA1
db6f9bc2be5e0905086b7b7b07109ef8d67b24ee

SHA256
1b6d3f6ad849e115bf20175985bed9bcfc6ec206e288b97ac14c3a23b5d28a4b

SHA512
fab79f26c1841310cc61e2f8336ca05281a9252a34a3c240e500c8775840374edb0a42094c64aa38a29ca79e1cafa114d6f1bbe3009060d32f8c1df9f088c12c

Download Submit
C:\Users\Admin\AppData\Local\Temp\fbff9e65-c679-4e98-9fa7-6952eb43e74e.tmp.node

Filesize
267KB

MD5
746fd9076065c331bd98e3ddbe123f8a

SHA1
56d94e7da0ad82dd1be0157a8b9caa1a15a5efd1

SHA256
afbf5be1dcbab71029a66bb854bf687237d03e9567bcf6a82e35172020d8e35a

SHA512
5a56f9175ac92514aedf2761dacc7dec045bac0911a55d9e85bc9c8ca63024df9252b05c5058f59f288d2568b9c2877b56265a24cf0a118e887955322e661d8b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsgF16D.tmp\7z-out\WindowsBootManager.exe

Filesize
103KB

MD5
c4479d6cb7368d14a94fad7f2362f3b0

SHA1
0d4185dfb738cac643329ee00beb3f780e67a6f6

SHA256
4802e0e8988b3e77556faabf7b092f533786a1d06792b8d236acf4ec4c247bb8

SHA512
05438eb2f87b00fc1aae8d689d938a5eb86f57ff097790407d4a90b042e99a33864096597f9a6fbfb6b59dc7b9cffbfdf1b817c60d2a5755fe890d8599288d81

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsgF16D.tmp\7z-out\resources\app.asar

Filesize
257KB

MD5
5c6e71736a42f98db9e1b2ec795517ee

SHA1
ce920a2fbef2ca1c6399988f79f5b827006302f7

SHA256
4a89caa128efc4c0dc1d5890bcacb338865117ba911e6a3b1ff9343d69617a67

SHA512
b6571db02f01752542813a973cc4cb5f5704697b64fea7baafc7c18e9218abc80e05beec872a101dcd0e1e2bb86507fd6026eb6fab716cbac196da500e67a40a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsgF16D.tmp\StdUtils.dll

Filesize
100KB

MD5
c6a6e03f77c313b267498515488c5740

SHA1
3d49fc2784b9450962ed6b82b46e9c3c957d7c15

SHA256
b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e

SHA512
9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsgF16D.tmp\nsis7z.dll

Filesize
148KB

MD5
1441775b18abad406f9b7ea61e268c40

SHA1
40829e17de544038f90e89b3fd3cfc08ca4f7447

SHA256
f279b0fafc3953528491aa42590fe8b5fd349f5ee2403ec368fd21e3d8caddd5

SHA512
ba6c34cbe3ab6edb3559be499ca0acd6f10f582a749e40b85e35b982b8f72bc6c73e7cbb8e4004608e94745f600e34ca3673b555f9d49d58a5be4067e1db8b80

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsgF16D.tmp\nsis7z.dll

Filesize
261KB

MD5
f03712160f9bc18beac75526c04b67cb

SHA1
68f8ce97e59a7171af5c66a0d14680559a4ceea4

SHA256
b6b30dc87f8d5ce049b50dcaabd842661cc30060525d41e0024e0f3e05423a1b

SHA512
3262270ac457551ff5afbe8f50c7add6300f7534b15206400e5f1c19a75880d6b907bc33806b8b60167caece46dbf4a4211cb63b2abf5f7953fbfff1d7b68c9d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsnABE0.tmp\app-64.7z

Filesize
245KB

MD5
4e9ec907580a0b451261a8665dfa0544

SHA1
fce3a0472f52ba7c1929c14aa1d6145d3253d0e4

SHA256
9e65756040d154e7e77fc60faedf3c292f790747fd00a712fa74bab91952ec54

SHA512
bd63297d2ff4810edcb50c647f6eaec7294295d8988c46e39e85ec03a9f2a68182eea9d10c502dd922cd3fa5e1a892a93e93742220e388fef14ff3f4d2c68995

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqC7F7.tmp\app-64.7z

Filesize
358KB

MD5
5bcc34da885595d4785b0f4a088d81f7

SHA1
3c5690d86f682527ecf318a0b65c9d9b02b4c6a8

SHA256
3cfffa831f9d785ef627ba7f2eedbbcb234cc014515a6873bf6ba857e2aa517a

SHA512
43eae8d5ace2eaed7e8b9964672c7a58725b41cb663b6619ca13ddd3749b97a74b1ea4c948b434413e4e22859f463323ff4cb4585cc61a79629ce5cefcae2921

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv4816.tmp\7z-out\LICENSE.electron.txt

Filesize
1KB

MD5
4d42118d35941e0f664dddbd83f633c5

SHA1
2b21ec5f20fe961d15f2b58efb1368e66d202e5c

SHA256
5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d

SHA512
3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv4816.tmp\7z-out\LICENSES.chromium.html

Filesize
105KB

MD5
1a67dd4522105453247cc7ce754e5d4a

SHA1
919dd9cd122562dcd1cd893edb3bae55a140962d

SHA256
ffaa3887f411119bc6d6fe79733ee61f7e000d22c5d30b19f12c931aaa4946eb

SHA512
56a1ab20378e7f4ace3d5ae55ab3fe9a8c0926c37bdcfd2d1de03c9a0610bfdb3b737adabfa0aa0db669401ed7483d7d5a727aa2bf6d27d1fd41298e9ff60e84

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv4816.tmp\7z-out\chrome_200_percent.pak

Filesize
149KB

MD5
4facb03c71942930d1bfcec5af4d2b5d

SHA1
b097a2ceea6246785184d1545a9506802887caba

SHA256
460a79dcf251e3ef097f1ad030e8b87e6a752d3042a69956550b82f48ebfdc94

SHA512
c79e69c189fe4517b86bff177d870abb6d43b8bce90842a14d086bb6b593d38229ca6d41dee7870828697c07ce20fcf1be493ea2a32a32fd504c6279fadb7c30

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv4816.tmp\7z-out\d3dcompiler_47.dll

Filesize
51KB

MD5
696e593bdb0d90b6ce7920ed5ceeca6f

SHA1
66ce018889d2aa09cd74b0fc871a846a13d1d86c

SHA256
d1fb5e2dc6b6f4ed198fbf3c29102288322ac58c913359181cf9aaa1a03d880c

SHA512
e7c660bcd1ecea2611b24e4e1afaa10c40511ad2459b0d9b2f5e527c9c825e5902ce4ff4fd3e71b2086d6ad13be092c2aacc658db3df0a94ba1311321c53c788

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv4816.tmp\7z-out\ffmpeg.dll

Filesize
113KB

MD5
728f393f8e582718b70270b2e4c10c16

SHA1
4808f20568e67cf51e67bf2f78e39d6bbb4ca340

SHA256
82357d9e99891dcd8932109abbf9836ddc2755657be147062f00e1a918ef09dd

SHA512
2b92e74ec99364ef36f1a3d162af0f4812737fc79e94d64b3573740c63861af5e6639910dc4efdd7ffe8683fe4b3282592dcae2c91ea16615c6518120b9ea398

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv4816.tmp\7z-out\icudtl.dat

Filesize
70KB

MD5
8a08ed13a24de86540478e04f939ab2a

SHA1
929521fa382cf11bc2dc29d5ec12be2ad887065f

SHA256
8962428346dae2623470d77b6d8931ec1e0130a9fd973a8e98f7d8274391d9b4

SHA512
01a4810e3ce3d7165f294c0b9c59b7e9f62eceb8b1dbe8c25c06a0da18b71f72e01e745fdb08bb10604eb6158c6785f97995c17c7925f7ae9d34e306b99a7dfd

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv4816.tmp\7z-out\libEGL.dll

Filesize
114KB

MD5
95f05495bf34d709959660d9780d7ef1

SHA1
39ffbf981531efe2451c2db079d3518081eede17

SHA256
0b00560778a50ebad9c4b472505c1064ff170a927ce8cb2e47093443a119f48c

SHA512
a458e82ff5890bff6a3851f495676978843e5d01acda378eded707377e26fcdb6c73666773acac994b5625f825fcb0b8109cf54a382a757ecca0549a71e85e45

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv4816.tmp\7z-out\libGLESv2.dll

Filesize
143KB

MD5
acaa4053c83dc002d03252a462581dc1

SHA1
bc49e5c53e9c7fa1e831f9e65c8ed591ae2cf001

SHA256
40e951b358c10620c6c7143ab35bac90709e8cf9365954ad3fa6b2a1240c0263

SHA512
0ece6bdd4c566bcad87d8936d5d068a4abb417003e1804c3066b2c55babd765746be2dc88fcc3fc45ad2100e0c25a0c1f5414eeca9320037c78800bf61d98807

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv4816.tmp\7z-out\locales\am.pak

Filesize
100KB

MD5
d5571b367588a58f9f7268b7061dd8e9

SHA1
d2349578dae83d8b13e3aae5f715cd1790d13da6

SHA256
b7f02d722ca56ae93439334dd40e300c963425664948eee4d1a273eee546acba

SHA512
bc805c058ff0453fe6ee9954eb73307aa213ba81ea8b36bc7ef920be6493836a21b3ad081d239636557e3ea9d3a89f609883d0b3a81071da735824d8276954f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv4816.tmp\7z-out\locales\ar.pak

Filesize
23KB

MD5
5de500522fdf1d59480793de1dd4787c

SHA1
ba67a903871f86f7a6e60a5dbcf644e3684a7c2a

SHA256
08e46acd1b99fb5556806f6c34fdb5e7bad118b47986675603649ce5cfd8e03c

SHA512
86a56d2fab24eaf12cda7b35e70ffd44b11ad9e2cf9230ff6772971b88847089b954f5f8f5971f142498fef266ccb03ffb8ac53095ab2e166847f0b4ffcab981

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv4816.tmp\7z-out\locales\bg.pak

Filesize
65KB

MD5
ddfe37615e057fc0ac3b6369b2811573

SHA1
b8340027e2aff268c0b7ec331553eb459ec4ffd8

SHA256
ae941de5141c8e3bf91f099c522c0418b7918787c90992ab9cd12d932e9266d3

SHA512
11dcd70d7bf26ca7599512d931015ef26e2a598ab520aa70c2933dffdc79dcb9863286997375e9b76d89ae1f29ea96ac96e3e4280fb8c138c03a874cff61b077

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv4816.tmp\7z-out\locales\bn.pak

Filesize
46KB

MD5
668778a8ed75e9b58b27336ab40dd121

SHA1
dbdfbe1381225bf40f00aa801f62158448f387dc

SHA256
af251a5b020f24a3728971e580c33c9d8a3f43b242b2fa762cdeede4644ff201

SHA512
92cbf497407cc0ef31b90e0556fefea38a1321d3ea33dbb27e388743d92c6f5a479a28aa950840d13daea0110a93a3616546967bcd4371fb09b20f8b75d4cd64

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv4816.tmp\7z-out\locales\ca.pak

Filesize
68KB

MD5
f455cac1f6d12e79db06d17b0f52a9bc

SHA1
c00c86ec05745573859874b2ea12513d1947f07d

SHA256
792aff8a8bbd9b77e50d2707e1da68195b051257ad48fcf92660f308bd2bb97a

SHA512
aa98efa90baf61748c24f5cc2d6bd6ece8aef8dae84bb648590814aefe1a643baede9bee61d3a1c24975317114443e33ed156a9b101232891ae9e9b1f2f36e3c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv4816.tmp\7z-out\locales\cs.pak

Filesize
32KB

MD5
72bc4c9bcbfa2d0f55771f8cec0e2d50

SHA1
93273b36d28339683c62866b169f3567b388da78

SHA256
e0a39f8c125f3f15b5ab79b5f437e423fc8b856372c72f854f53dfd60ef8bce5

SHA512
b53dd8c3e43be016b4a4a17edb79d5ab30540e12194687744806fb6630cdedb7582571bed2c7372caa8918b8cea0dca789554dfe41f95679b684e2e56305aeca

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv4816.tmp\7z-out\locales\da.pak

Filesize
91KB

MD5
baf7ba6c9671e2b685b0c21e6c2ffb89

SHA1
b83496d92e12ce9c7e3d8492d198ce9609d38b1c

SHA256
a83f4533c48e7e5ae113379e408f694675aeccd177c7d29354d58e81c7a47f11

SHA512
81bb1ac009bd9cd61b1a3a339b6c527d563ff3a4695e87f4d865e49f4665189c504db6a88695dd2a9d20da51c5c649e7b47f9a0a90e41dad2108840f21cec607

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv4816.tmp\7z-out\locales\de.pak

Filesize
34KB

MD5
164d603e4d4f18534817eb645c874fc4

SHA1
ae0619115661bd00092c31def5e7b6d929a60ef1

SHA256
73da2c8757ffeba0cf8667aa850f740cbdc94d301df1bb49284e31328ba27b2d

SHA512
9ad5a884c71da0a4b4c1e727273453172fc5139584b12dee236a1a8e24a4373f8183e6ef5726c41bb97b0b13aa82d604764e900b9bee2ef90264d4b67016ea15

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv4816.tmp\7z-out\locales\el.pak

Filesize
55KB

MD5
88c5df6c925858e3011f211d8f3dc710

SHA1
ecdef5a5f7f08f093237fa9a514d090b223028fa

SHA256
a2267ed5c5208fa0ced7093b0f55e61653631169b83746c2d64c05243feb4c92

SHA512
7a7e318c4da34807d3ad856e43625078768a2e4aeb867ae110a9f0939f25d5ebea24d392fc3a50da21ce24604ba2316d6cf8da2df1d30ccfad73c1183a380c30

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv4816.tmp\7z-out\locales\en-GB.pak

Filesize
19KB

MD5
ffd202f64964419d9c38fa18aeec8977

SHA1
e75f700d1367f46bd862d0100e586f42e0d42f8f

SHA256
bc2a6fbe9bc6426f885c24e68cd66851276f7e5a4320119a206a5b5920f7b495

SHA512
f1623ea5feb738323870a1c446e790f41d0acb9704731cc02a0ee864428faceebeee8b201d77b28876e59a74d06e71f3a0b09e914b98477309a6f8b04485bfc2

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv4816.tmp\7z-out\locales\en-US.pak

Filesize
27KB

MD5
95c4ece85e3c173ba630b007e1b9b7d2

SHA1
f428757f394810dc86158e44a3b10dee53c7c104

SHA256
a08cad4d753ad5e151d3dbaf00e02932f95b3b87fc31057b4e4951211eddd208

SHA512
5a6812c8e8089eb6c17dc54f0e76a243575e8252a93c278c3f1eb5a746a2883096c2ad501826d6e0544196e1802bb68acb1ded83da2d639b78bd0d15ba4635c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv4816.tmp\7z-out\locales\es-419.pak

Filesize
84KB

MD5
f81bcc2d85880505096193c334d24258

SHA1
358071b7df1780a5a3f18cc183e1309d02357859

SHA256
f64cd5b2c3eda9bd69bcdfd77a0765a7ad5488ce46e9755b3a4a2e2d189c7d26

SHA512
5db01218585a63a1849b8a94e29ef1b8108f6ba75ed1767afeebc1cbb941e4f4b4d16ad8863da716bcfa118e1df9cb783ea4f66d429b3a96a27290f269efe024

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv4816.tmp\7z-out\locales\es.pak

Filesize
50KB

MD5
765d9f82aa9aac49bc22946250d21ac6

SHA1
42b7537aeac2fd27e8bf7490b29da0ff0c741f52

SHA256
312a694bf80c53d567e7de86f521e10afa0f322715c37dc4c0b210f156bfc53e

SHA512
611fcf840b0f06d44cd72416653e7aa96d0a8bb277b0a3d56d1315c2f171234d098466a60c6ec443373f7e9723d10213dc2ef7186bc07f1c4273ec70fb524d59

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv4816.tmp\7z-out\locales\et.pak

Filesize
76KB

MD5
681fbd2816fa8dcdd90ca218cc890f21

SHA1
b8b0fbefcf9835aaa08cea716bfdf48033ca305c

SHA256
b9df958c4a8d8cb2749e98f8c5dc1abd8785c810bea08b08c6459acdfb1f4d2b

SHA512
c184752da0c99b9f53f43837e459f574fcfd34bd85cef3371618a753b5f8eaf3c21057de8067a18c354951b15e056aa8297ec5f14d041b3180f5ed8439dbf356

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv4816.tmp\7z-out\locales\fa.pak

Filesize
28KB

MD5
82c1c593597cb6971deea982748a2965

SHA1
7a269f437c748f0b16c692151eef2e0c2d6e92c3

SHA256
a2f1f54fd371edf4a184f19ab59cc18caa762984b4825b1c7485727bf8533b62

SHA512
3529e8969804b0491bf030a01b9c02ef542da37c8711698914fa136c546df393be067a0f05aca12f8cc8935bf4aea55de019a123256426185d648f9f8983131c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv4816.tmp\7z-out\locales\fi.pak

Filesize
48KB

MD5
fe1585c8e34627de401c70eb818a80f4

SHA1
1616c2a6b042bcf69f46097da35d7907f5b2cd3b

SHA256
1d935119c40c5f6b16c153e861ebfc9503994d1552b6c6d3813581bda6a99c13

SHA512
47f84f7ebfb9e4f17aba3fb18d67677ff94e053dfa6ef87ffaa649620f02a25c43abcf6b18d08d9b492e1bc676c678fcaffadaca25d671747c61b9bde70f137f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv4816.tmp\7z-out\locales\fil.pak

Filesize
21KB

MD5
893b82ca962a7b032ea8208d712710af

SHA1
bddbacefcb6e7b1ced179acac7632cf17b63f68a

SHA256
48b7394dc799bb42eb80ee17946bdb35894c2e1048949673f6b3a28fc6b5e573

SHA512
26e6e30fe2390bcf53755748e77d949f4534ba0333cb3a421ed793a1c484c09adb630a70bf847f2820a7b9d5de742ca9d08ba5f2ccc74f47900477af9a878ea5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv4816.tmp\7z-out\locales\fr.pak

Filesize
50KB

MD5
8e1c8fc39521bec63fe2ea6f276d6223

SHA1
79cb2aebaf07a56ded5c3de7db5fdfddfcb50d8b

SHA256
4459bb8dab9c8ab504bca146080976f54ad4e75865c5d76a69d552b4854493d0

SHA512
d8e7181b2a0f509ac409b33075362d0f8d71ffde64edba44f112606d068719731e9cd842aa9ee539661ca7713b2a1b652f94e1d41060fb1053276e7ccd251942

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv4816.tmp\7z-out\locales\gu.pak

Filesize
10KB

MD5
1b4d7ab5180a914a374c0a9a3f9f7999

SHA1
81d58c1d2770825d5e5187c972593b5baf2ecdbc

SHA256
0b77b5a036b578d2c4ed17effaf4061ccc8736026cdbb44c62d8711576605259

SHA512
95e80be1b6a143800a7a67ce87c3497066942f535785031c4b595e5115b546203f48d0eb82acf6a48fd7887b3c1d5e07eecfcb89b4767ad3404e31497116a34d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv4816.tmp\7z-out\locales\he.pak

Filesize
55KB

MD5
cf6ff991625275216d42e3138d2bcbbe

SHA1
55859ddaf15092a50cbdbd69f401c95f88a488dc

SHA256
ff2fdfc71bec3a19c5461e1ca7381da4059fc22981ed5d957692d4cf83cf8fc8

SHA512
ca728b540ce8fb6ef47e04b46a7a15b223517702e53fcdfc7c673dbe24dd97b90db5d01a3eb0bd0aab7d8c1e39ceb4864a89f174f86765e5556c87620d0e96b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv4816.tmp\7z-out\locales\hi.pak

Filesize
58KB

MD5
a228c1cce9d5456ca79462c1dfe2c541

SHA1
33f68294e833ed2536b1a3dc8117c0d91d151e28

SHA256
6049484de4f95992ece7d1deb42a5b6834185963f9e0446b5a6844e7c1472279

SHA512
27c18d14071679132ecb610da97deaacd194d600a5671c01959ef3867317c04451f817398a2116cd3a180d1cc0b06ee7a3ca648beaf63b74fbc260aee8b8210d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv4816.tmp\7z-out\locales\hr.pak

Filesize
66KB

MD5
56f82e215a6ce735dad1b15dcb005216

SHA1
59e5eb19fb6c459f0f7c61b3a987e8c3862ad814

SHA256
c44d6dff0a40590405cd70f0461c90e6989314dbfe313c8649f64ae20bfe5991

SHA512
1b80bb730dbf86368d9e4cb4218baa98b3a6a21f105e0f7381260818a030c73a476463a6120d1b62280bf7e63f01c3c32c7d47d7fc3373d0062806a60c362d43

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv4816.tmp\7z-out\locales\hu.pak

Filesize
40KB

MD5
f7d93a402ce2e5ab24f18e01729461c7

SHA1
184c1510055aeb12c7fbbd4adffc6510c514f7a9

SHA256
e8a83d53e3f92d11e8ca3ea7e58bcfbcfd20fb47847a39750fb5b4019a00f2f0

SHA512
ae9b98195bed2bcc0389af534ded552f79594b34c8e45da4d212f16a6dd8f8c4e79c23478718ac05a4d6eb836373d67f208b09e3fc07e3ce75922508672fd79c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv4816.tmp\7z-out\locales\id.pak

Filesize
97KB

MD5
9a7170341e8df813ab301a6eb919e249

SHA1
2a92f1fe334650d51926d0745d1e2678127e86e5

SHA256
1a9568c6710fd4c54136ff6ee462b233692bec47e4eaa2c086ceca0f81d9d7d5

SHA512
d77984a5447193b96676ba029f4d41754a5c317a5da587c2785bca6cbbd89f80fbaeb32bc4cf249a224fd3d8349470dd82e3e1f1dbdae69590b3acdeb8439632

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv4816.tmp\7z-out\locales\it.pak

Filesize
64KB

MD5
40aff82f7c860cc77fbaed5b0cc69266

SHA1
9705775f63b5a703a42fef76e4bcd156dd7c2025

SHA256
90190b48dffb7a07300b8995abbbb86cba0940d5b81484084cc39acc56cd5959

SHA512
a94af7c5cd0ca604b8aed0a9fa040867a783daf8685a694092f0724ec71a44b8cd48d355a36dfa254eeda6f2086ac6ac8e66d3baa8fdf7a165da64005a7c39a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv4816.tmp\7z-out\locales\ja.pak

Filesize
66KB

MD5
616549f45a8634a9a0a860efda80c27e

SHA1
dbfab685ad040da8bbcd400e8c1a36d300c806b4

SHA256
7b1e179f81f7e7ce6fdfd1f1180dd3fe1b0e281c724af49ea17c72f9d841354b

SHA512
a84ef51d939ec5fea5a8ed4dda22a3643a13ad879ebf5156447a31bf191e67152d6556c930d151c335f0afe7802afe57fdc4696db7043ebda995c59112f58f9a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv4816.tmp\7z-out\locales\kn.pak

Filesize
32KB

MD5
aa03fb29396b40a397b51053c6bf5afc

SHA1
e3fedb5f689c59f096a3ef4bcfafad24bdedc3b9

SHA256
11f3e2a05ad31ae224603c193a32b1664cbee5f7b09c6b2014c6c37428cd9da5

SHA512
29b500a51c928df7f944f163ac8f9b67a6cdd191cc2d0721a95eb74c72554fc49bf17e31468fec8df9ad56bb546845492b51f21f632c0a15774f883ceeac18eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv4816.tmp\7z-out\locales\ko.pak

Filesize
22KB

MD5
0567e8dffb01e0a39c7d9f4acaf5e9ee

SHA1
f48c6f992aad439af56655e552ad0e5fe86ca2ba

SHA256
6115edad92fceca6de479968247f597efa2ca02e74a82995f6ec18b0a1133303

SHA512
141c180b7164031797dca1cc5ff5c86528cc7613790777b19d250dbeac952bbc01b3c17dbac56bf1ebbbb141edf08b3a82bfe96df1966305746f09783136e8ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv4816.tmp\7z-out\locales\lt.pak

Filesize
59KB

MD5
43a663ad8abe2d2bac61b3c87f58ae7b

SHA1
947de0375974831e0c00c230d0f093242d373704

SHA256
1e3dd227618bea5434771601fd0311c75359f72504f09f9a4227c994e236b5e1

SHA512
dc44cd73aabc23188f6a33e017ad945437debae8d3f1da6cecd4b16fba2218faa7afbfdc6dda32ef79fc7ebf50738df064861e2a7e0489621c119441f31e015f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv4816.tmp\7z-out\locales\lv.pak

Filesize
54KB

MD5
02b21240b93f49fec20474b61b103448

SHA1
35edd643499f7dede0d52b283eb7a63f80449c28

SHA256
7f91a63e6b4e54c74fe36b816d72d729a15a5f5353e7514a492946545fe37b72

SHA512
a528d139f574aa3df843e61e4d799e235806032f11cecc1d354756cff0cfa2e8f61f544df3dbae03e42b6ce2ce268f2324fc460597f5e65576859bdb87f3d13d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv4816.tmp\7z-out\locales\ml.pak

Filesize
78KB

MD5
8ed9f615529fea9b177c72c43a8c9374

SHA1
0d51963dcf877b81fa8af0882d25af1caa162b87

SHA256
fc2f93ce4b4e2cbe906871d74b82e5fbd8289f2f46a493da7f9deacae39774e0

SHA512
56709bdc9bde11972a3c5d8a5cc357df1815f80c3d854bce811a65cc019221ef67c273ecbcd41fb0fbe868e003eb2d9259f12af132ed122f017a2ae660daf8fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv4816.tmp\7z-out\locales\mr.pak

Filesize
52KB

MD5
b9e1855ec287b48a97726332083911b4

SHA1
641194b79a58c97b56dfcc06c39b64353506974c

SHA256
bcafd49d8f25a18e67962200fc7a33ad4ac64cabf902b0e42ce55e2f6be8d0c4

SHA512
1d936b6254d93f2964ff7ac92f2c944cb245a9ff7e692721edc9df281fc8a2959109a05afdbd65ebfa2a9ed782cf1c4b89fa404026280ac6d7adbc41c6d8779f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv4816.tmp\7z-out\locales\ms.pak

Filesize
73KB

MD5
cf62dbae1bdc714db8b0df6beb76d5ec

SHA1
f0fa66110522b3da2165bebe02c4ac36af66c4fd

SHA256
01b80619a1c6ec69f1bc91b7b42887b9d49b7cbe146be3b6b40f5c44c5879f6a

SHA512
070f3b78fa203aea81196865f40bf266c7fc41ed4d6232bd2a37da7f670f927ecc58252eab9b7ce8c59ed0fcfc7b6fd212ab92522e5df129469a90a152383a9d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv4816.tmp\7z-out\locales\nb.pak

Filesize
124KB

MD5
906145785a21bfc4b3bba5092e894059

SHA1
c61757f0bfeabdf35af9eb822b9179be273255b9

SHA256
fcdbde0a8858167fecf295584bef157f779e68f925ff16750101f6ce7323d9d0

SHA512
5646be486f245145f9ba8a65e2047addad251757031021c2c969c36c70e98b86e1d20b1406bde1d95112988ced6601e4ecc6a62866177463137d08f5cc95df58

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv4816.tmp\7z-out\locales\nl.pak

Filesize
63KB

MD5
8fe6fcc5a3c222c65a4b34ac12a47c25

SHA1
9ab9b01b1a6305f1f7dd883f1a539f52219f8e92

SHA256
369c0231ab93e803113dbfdc28ec7832b7e0d7c2f69d343009c0ddb0bbad62a7

SHA512
531eb2c5296c005ee7fb021892ddb631ddbbde023a152b2a5920a8d6e4bcfb914e1bcde7bf6ccf8f91841d2ba8e556498f2238eb916d80ef2572820b43ce02b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv4816.tmp\7z-out\locales\pl.pak

Filesize
40KB

MD5
8c0ddc75ff62d1de556a8cdace4aeaad

SHA1
8448fba944a99a99edab983d13cbe631bcd1d5f3

SHA256
dcf9451c83e8538e64bf7f312768149178c6b08882d267d62c4672735be71de2

SHA512
d8e275a6fb7dc6e4d663b8dd57c2fbd12cf1c03c428fdd63a6ee3c74ce0c4859cb1a24dcdbb7a6416c89cfd3717cc7cf1d5431a7b45ed7b381c97eceba5c6530

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv4816.tmp\7z-out\locales\pt-BR.pak

Filesize
53KB

MD5
9c5914d881c1ef2eb6ee6f8c5ffd25dc

SHA1
083ba23e238f16241d980506d34aeb2bcb787790

SHA256
9c36a7bbdd8ab2cb8dea338a95f0f350ca8b2fc8cb5b62ed8d807353d54297d6

SHA512
c1c4583ae3a97791b34f83fa28e54cddb0c7147887d6e384b3c91a52a7b4852aa544e2d14de751d4a5f1c36ecc98be7cf785a4aa2ca20ca63ea27193c30e03b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv4816.tmp\7z-out\locales\pt-PT.pak

Filesize
66KB

MD5
a001d54ae1dff9e7668a77ab7503f53e

SHA1
454e16a1e6eb3ad6fda6d39507302aedd9e9b5aa

SHA256
b28102eb85a77fb9415a9063752b3f9f809816de2191b2a3c3efec24f64e99aa

SHA512
c3b467bec2e77c1901ec2d864e85f1fbb73f9395fde93a29e97b5eb8aa42217a5ae2c761b7fdbdf15f54aa9d1d8cedab987aa62cbea21aebb8bcbf5d9392500e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv4816.tmp\7z-out\locales\ro.pak

Filesize
72KB

MD5
6ca28faf15e30684a09e803155f6a439

SHA1
656df0785886e9e883d09f9b148691eab3e02bff

SHA256
99ee84d1751b8f5b999f07b77df88c557005edca6f0b2a0287bd93dd1b3232ab

SHA512
4fa62cfb5baaf64481b7191ffe396ad3affe54b406e78c8c55ec2223b65d5fac763d5a5f432895dd88dd31a3c1af3fa069ef269c459dd099771f7a3d25c5af3d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv4816.tmp\7z-out\locales\ru.pak

Filesize
45KB

MD5
f99b4a57078d44cff2ebc3393b069c66

SHA1
3eb12af4b8b1047e626446d1a1845529fe595a4f

SHA256
3e566168e6722e46471301fedcbdf37dc87e414804752b12a05798bde94edf76

SHA512
185954ba44fa57f140784573deb8f98e5f9dc10fc2452aa359e4b084036871430a0447d0c0d92f555175de9de4b27a5418c4654e2a4b50999c946ba7ffc178cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv4816.tmp\7z-out\locales\sk.pak

Filesize
39KB

MD5
5a2bdb85b7c1064e4b0aaf543e6bdfc9

SHA1
9329404991bc43fddef614f3ed72c984e8904419

SHA256
3504941bdbef50d7c0c4dcda831d46b5949e96f5f2b11755f862d737c1292c39

SHA512
d558d5925f951393ea08675539470064a27f858efed2a62216aacf3969215aff9e1e1e543c2ecfca39aa67adc633aec01b53f0fd77b5e775dc35f7a8dd3b60be

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv4816.tmp\7z-out\locales\sl.pak

Filesize
49KB

MD5
d7f61643bd75f5d180afd664b5959ba9

SHA1
22ecd8dc240c0386bcdfe1463104fc9cead3e3ea

SHA256
22c157660abfc81feb1e3e76c0ca4a3ca5e59687c2206779a3f384488ec552b5

SHA512
61ba9b32c8dbab9631654c8924b337b357d3666fb97e8d85d7a91bbcbfbd478cb756fa82b638c2fc512ed0fab2436793c0ed0978dc155ce8e3f3b840ad97fbe7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv4816.tmp\7z-out\locales\sr.pak

Filesize
99KB

MD5
0e907cb2ae356b8079c105847e73eb10

SHA1
6b09469a13c3f67efbbe325144b1bdc5e1c2ee2d

SHA256
88ad5cf0178d2674acbb9e3626ea2c0ad17890047ca2e1f80423265044e27ec0

SHA512
d6546c8b171636a9681380e25012516f940e6e0d0a42f62e347ff9aa978301ef0d1e9fa7d63fec6b75376de3ec3ebc805216aab38b60cef5598f19efcf1dbf5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv4816.tmp\7z-out\locales\sv.pak

Filesize
10KB

MD5
574e7338f9886a523bc2a13c1b1c0431

SHA1
0b43c0a2f746609f53284b5634220f7da3e9d0c0

SHA256
18af9c62e16d253af4332cbdd82eb6e69452620ced077a473414471f3d066c0f

SHA512
0cf13718884da6288a47cbea66e8de98f1f223913fb9e625ec0b79dcd6ba046827bde671d38a0c2e583819bf90d6d98a8185e4d344c6215b091aef460c4bf195

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv4816.tmp\7z-out\locales\sw.pak

Filesize
12KB

MD5
53749d6b20e3e663a5bd36cd9882e584

SHA1
5c8035a623afbfe7633f926dabf019ed998feac6

SHA256
1bc5377c1e087cc2dfecd98180b3e72ddd801d86cd80822e2bc6468a622eb326

SHA512
0830f046e797d5314f9cfde4a1d97c2396df7427dd7d4128b64510193351ccae9573e87b7433967383904e8af65d8da65c6ca7c6164d5f4ecf37a51a6dcd311d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv4816.tmp\7z-out\locales\ta.pak

Filesize
83KB

MD5
1ad923e48be0dd2f333e17d7d1a7f6b9

SHA1
027960f6b6acba4c9887b33e795195504bb46e37

SHA256
97f1b30aaba004da9a52e69ea57605d2cb03fb853a2678875cdc2d04efbb031f

SHA512
8814399ae3ec5dc027832ffc99a0f296354a4654429f6c23f1665c3a99f81af8af668b3d25f4ead5f11b8ff145b6d0fd9c7eab9470220e226f171265fd46f427

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv4816.tmp\7z-out\locales\te.pak

Filesize
96KB

MD5
0fb0d10e6f4f373e638c5c546224dd32

SHA1
7beffd7fd87938ecba738079279809d2724bd410

SHA256
e7b0ff688cf14dc020af1e238ecc636b0066c52243e0a3424d57d83e0f10c642

SHA512
1dbae15e8f117c54cd85c5145802a9b255f3074128635a4d68e4a498d277e5ff9cb237edebea011bfd1985ae0bcdac71d30c93a991dd5e77cfa8ec886ce4d3b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv4816.tmp\7z-out\locales\th.pak

Filesize
67KB

MD5
628037bc824814bcc5357775fc4155c2

SHA1
9a39ce17290a933c16eca2c336b1feb6b1952037

SHA256
7087c8910f1cc37ebd60be3cad48363acd11a20669c82e4622042f852e563883

SHA512
6673e456c6ab388a7f0a4b31cf6fe94c65e5d848f2354342932776278e6e469e6e9245e0756f0642dde9c8674d232634bc730300fa1418803fdd75f91bf29de2

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv4816.tmp\7z-out\locales\tr.pak

Filesize
36KB

MD5
d7d5f369de5c0bc73643d29470d9c4db

SHA1
afe1460507beb0e9b190890031e3177074efb7b0

SHA256
cb4969b5bd13581e7b7f6870ed27ab91dce04ff5abf6a12856d476799584af4d

SHA512
b3527cbc22735e0c6f9025606e52bed2e1111df7e61e8c44df4c1fe128af4cead53765af1b78d6acc5cd614a33ea9491e3fa5b6280d69456ae18cf00569427cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv4816.tmp\7z-out\locales\uk.pak

Filesize
34KB

MD5
93b25747bf409cb80603e9fe17c02c20

SHA1
a1c8cfa2f8cc3fbf27b666adf58432f52b2c4e11

SHA256
9f86d1aea32ee40a55f1530c7d9a067f1c3b69b27ace83a43dc63f05d41f4681

SHA512
16fb69bd640c9cc45c9e46eae9667a1d063ebdca83ca3db5555ad036ca9f283ea333ae9ffcf14de4a3f68e87aea3ca224f9cd0fea9a52b2138a5d9a1f9497e28

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv4816.tmp\7z-out\locales\vi.pak

Filesize
79KB

MD5
387e491c7809b5928570cbf02c747ff3

SHA1
6e54c1e6024084742c168de43174501f3a650b19

SHA256
9e7fbacbb638ab1e66f71ee8ca8232512c5c7c8bf19de178e98ecef6daadd293

SHA512
bfb0ff3ca1d48e74c92e44d1e5228af659e2da3a98a0ba1d872df1935d5651e8d0c8630802f8f83a32e630d5b9f7c26d8d0ae0371b876a1319b9c6a21483bf4b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv4816.tmp\7z-out\locales\zh-CN.pak

Filesize
50KB

MD5
3c5eebc6767da7b41ab02112c3ada29c

SHA1
d61176ed6d6c41d38e8491400ace86f227e0d002

SHA256
0179f815ee0798d0f8b07b839459970e49aa396f2feffb413aadb83e7a11448d

SHA512
044255a7a0a52bc4d086ecca05a4a6ebc9611ba3887a1ad4e7e0ae7ae0fca4ecb54c2c2476135ba4edc69f260efb73442a3896f8ec545c8fdb8e96059c1c1059

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv4816.tmp\7z-out\locales\zh-TW.pak

Filesize
113KB

MD5
3db4656ebdf132f50ea5d7be73721ef7

SHA1
b3d8407659e658ef8c8075e08b889166a4135f97

SHA256
c6016056365c7641157131dda95c0e1878394805fd14604c96019fd4fd5d93ed

SHA512
b21cc98788b794254f97e2b7b2d7858ceaa45261ff3c3bee4164bbfa8c3bb9951a07bb787294f6ba3012501f8f9fd6b7e86c30ac7f129a9b8b6581d3a1428444

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv4816.tmp\7z-out\resources.pak

Filesize
30KB

MD5
bb3d4c4608c864fcc5fce111aa597b38

SHA1
8483520c85b8217f6b640f4654fa9b25c3c2437b

SHA256
eff3c9ab8eaac92470b0baaea21c5c6fbe1488b659f19fd7e3b163262c2bf750

SHA512
86ac1316e36a9db07226a1b784018b6328960dd1a10b0310a665ec6d6d7180806425210058830db642f24de87d18acd7a724267a48fe1b007bd0ffaa7da1ed62

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv4816.tmp\7z-out\resources\app.asar

Filesize
34KB

MD5
87b969a1d17783af3aab403a4f8e18f5

SHA1
23bfd7e2cf85540d8584a92922f5e83f49cff793

SHA256
460f184f37bb5b876dd21f1892b852b210c21601cb13ea35ab99e4d9329bf1fb

SHA512
5b361c098ac5a451c1bd944bbd4ef940500a5295666857f8e44c09595b3e8be022462cfc8ee9314f09636f685c9163f9d5c264cf5fd60fd27be78a238c8951a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv4816.tmp\7z-out\resources\elevate.exe

Filesize
91KB

MD5
0dbcc6fcaf431a0b833457579f64b8db

SHA1
ffe27cf47bcf3db245ac04848d3f3c7242d32eea

SHA256
a82cfe018dacdbb2dcb25643733fe51c45897a20fc288ac1be4d2c1241688040

SHA512
e972bbd1bcc084f79f42f690eda680b0428f1b69ecc553e123b17f2da7fc5e8e3499eaa86b1a01647188e8a43b1bb39ea633d2c0f117505fd7ddf298a62d4fb6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv4816.tmp\7z-out\snapshot_blob.bin

Filesize
49KB

MD5
fd725fc7f35b5b9558cf81021b066950

SHA1
c4d6870ec08ebf942cac93a4fd3965533337e6e9

SHA256
19c718928cac1371bec641de3ff0aee091fffb23e24fa4fec71c8e713cf58dcd

SHA512
09b5097ab2ec67cd9aa0c5fd440eb419065af1e254552e265331b03a992fc85a2958bfcd0601630e6f22a7172a841b7765a11b9ff172c08dfb67d4a8cd302a45

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv4816.tmp\7z-out\swiftshader\libEGL.dll

Filesize
20KB

MD5
20f5df29097022fd9033cd3dadeb2253

SHA1
e50e7960f5f2113097efab1727c659f8714601d1

SHA256
83c05b9d04ee8a321c57e10bdd458a5069476971258f5f1b0907eae9a6f99f67

SHA512
8b6070140fa2e07d73cde67c0893c4bcaa9480e9b803a7848b581f5517c949dcb73e857550c708675b6c7cda0ac38d36de0d416f817e87d9efde28a1cbf5e7e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv4816.tmp\7z-out\swiftshader\libGLESv2.dll

Filesize
69KB

MD5
521f3cb6564c1761e7373f4ee2dc8311

SHA1
f340585ebe078c22817cc9cb14221ac727ddaa7c

SHA256
23e8b87e122c22807c876d8d111c1d28125e29d3f59ffa16e313aba7543d1d11

SHA512
9954d9861a283052a1f21f7ef01ca23978f30239010458eaa6aa406eb16a0b36e533cf28a04f41e08f2111c3c5f8189775557d86d3a0eb487fcfd3670e33e1f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv4816.tmp\7z-out\updater.exe

Filesize
36KB

MD5
21691457eee9f807d081182c5dca1d83

SHA1
9c3823bbca903dfe64fbede0fd63856c4369922a

SHA256
c4f0617675ee045ca9e23feaaa21ca54204a9ecc0c1170b76f752a5a0b485dea

SHA512
300131bf0ae9ed3dee7cb3d8b76b58452410ac54b39a59cc417c43ec520c55e1550d5619504209a4975949304aa3ba34376239b5ecf25f5285be25a564c0a9f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv4816.tmp\7z-out\v8_context_snapshot.bin

Filesize
28KB

MD5
8b26c71d2e610a8bbbc087ba9d613b63

SHA1
b9d7903fbedb155cd66f679152a81141d26afe2f

SHA256
b392d0514d2fc915fe3ceb9f6a89d1aed4a616194aeb988a112d487694c0da41

SHA512
afeea9f58a5e037b659ce5ba00d12778401463a1543bc1dba7f0701834c83724263242243c34256b5f7b539a2c33cde63fa8a258258da5e704be2764f7dee71f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv4816.tmp\7z-out\vk_swiftshader.dll

Filesize
15KB

MD5
bdfc299b5aa7c04b1a20016f2bcf993a

SHA1
1ba6df682178fc51b4f07cbc6ba098b92e8828ec

SHA256
060ba24631f7616aa3a7216c8cdda293e1fc3b876988029c5ad8d8aa3815059c

SHA512
dfd2d1415f527d3e2d6f2ead598e158f5ad1fff3e56bea15d072f47fdf38464891f626a4eea404b35e10a1247afb8fcc5e9ec1a62b9ff32a7961aa002ec5a5c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv4816.tmp\7z-out\vk_swiftshader_icd.json

Filesize
106B

MD5
8642dd3a87e2de6e991fae08458e302b

SHA1
9c06735c31cec00600fd763a92f8112d085bd12a

SHA256
32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9

SHA512
f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv4816.tmp\7z-out\vulkan-1.dll

Filesize
10KB

MD5
895551342bcd7ae2bc5681cd40c6995f

SHA1
eca240c0553ca684909cf4e414086bec33335f1e

SHA256
739c3ac9e006e3dd63653375f7947b13274d354ec5c9f5256a66dde6f4afa203

SHA512
068951a089f4e2ca50d4911195334ef6f2f0e570555acf21867614d57da3b1feda72a3248c8ec3814144b89aec48b0d3b6d25eddab4990f659f3c158082b5e41

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv4816.tmp\StdUtils.dll

Filesize
56KB

MD5
a099af7ea41980e3688ea655422121ca

SHA1
85d9c9a76098697095157887490be5dee64e6e81

SHA256
b742aafe4a2e423bf6f3941fec6323533862ec923d5c5100f40d1ccf1ad122fb

SHA512
9ee0463cff08fdb882eb9d56b573d334288843af5e94eb80ca2cb97024af231f602c16e3420504eb970c76878c24ba8c13c9bd0fc146ff7f9a27bbe768a66f91

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv4816.tmp\System.dll

Filesize
12KB

MD5
0d7ad4f45dc6f5aa87f606d0331c6901

SHA1
48df0911f0484cbe2a8cdd5362140b63c41ee457

SHA256
3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

SHA512
c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv4816.tmp\nsis7z.dll

Filesize
424KB

MD5
80e44ce4895304c6a3a831310fbf8cd0

SHA1
36bd49ae21c460be5753a904b4501f1abca53508

SHA256
b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592

SHA512
c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df

Download Submit
C:\Users\Admin\AppData\Roaming\WindowsBootManager\4dd7067a-35c0-4ffa-add6-4cd3f4be3714.tmp

Filesize
57B

MD5
58127c59cb9e1da127904c341d15372b

SHA1
62445484661d8036ce9788baeaba31d204e9a5fc

SHA256
be4b8924ab38e8acf350e6e3b9f1f63a1a94952d8002759acd6946c4d5d0b5de

SHA512
8d1815b277a93ad590ff79b6f52c576cf920c38c4353c24193f707d66884c942f39ff3989530055d2fade540ade243b41b6eb03cd0cc361c3b5d514cca28b50a

Download Submit
C:\Users\Admin\AppData\Roaming\WindowsBootManager\Local Storage\leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Roaming\WindowsBootManager\Network\Network Persistent State

Filesize
296B

MD5
979d95b2da192574b2053fbb9d0c1c0b

SHA1
570f8e7ec1e33712f94a7f74e1419932a63bd1f0

SHA256
f40e3c9f615c8dd2e17a2e74917f338027d0bc7c3d2b0e18aa61c8081e08c7b0

SHA512
687e9d4991ee6e8f4a8e8c26f4b8f8107e01ce5ef3e1d81091e795be5b9641360daf01b32a029da9f728af6a232c6f1b5c04d31076e91d0579a06abef0744e08

Download Submit
C:\Users\Admin\AppData\Roaming\WindowsBootManager\Network\Network Persistent State

Filesize
296B

MD5
575e1064e012d6ae8e651ac99b0f2137

SHA1
8dffe54485e1ba4a7a95dd487729c7d6c381eecf

SHA256
1180c75e0b8894a7c585f2e024a08e5748dd767a815506838fe08fd45d567d5d

SHA512
72d8f3c4ef64fb62105c0006c00c6db6e290d2d2130ade0bd10dc6a0f3f7555ff7d79b93034308f735a6206364d4345d6aee539f4ca57b97c413f5b3b61b1a9d

Download Submit
C:\Users\Admin\AppData\Roaming\WindowsBootManager\Network\Network Persistent State

Filesize
385B

MD5
f85ba4d3813d49744d4f7180f8c20196

SHA1
87b9c421e4d5a5fc588aba42af667a20fa125d83

SHA256
402ecb3b91e290860c11a08b13aed8d029480f7778358db0bd059a424f938bd9

SHA512
76996cf2127b04c7f8f0cec1d1eff944d79cd8f0ca1ba67d99d6c129753fdc44478d48ef36a515396837031ec8db08f6c42d97754e78606416e566ba6d2d0f20

Download Submit
C:\Users\Admin\AppData\Roaming\WindowsBootManager\Network\TransportSecurity

Filesize
203B

MD5
7b82e3a238098c5b3be95bee3c1f9abd

SHA1
f5c1f083dc8eed9ecf4b06de36b5ae8fbba4352c

SHA256
92e2a71596d4432b59069b9980b2badae49ff727ce1b28cb8b768aca60dcbc53

SHA512
7712751b8a09b76631bb2536ffe501311732326c6ede0fe2764976a87ec604caec8e92765f5a249fa53245fba09a435c42a33cbe7a9c8895b9ea3d7ae0f43912

Download Submit
C:\Users\Admin\AppData\Roaming\WindowsBootManager\Network\TransportSecurity

Filesize
203B

MD5
7324fbde230d5f764afbf974e2ab5efa

SHA1
58a7a60a3eb96329177fa76304704ca18549d517

SHA256
97c4606e828a25c6470ed9cceb26b5ffdb747d1b1e4cd87f9512d2e6ecacf794

SHA512
254c2fc18b19e1282938c7ce1af7c25206bd2139a97e3d1c511a99cc552c9954d8056d914a19d986becc317809ce00ac8df4f15cb7c7c8777a60d496626cab6e

Download Submit
C:\Users\Admin\AppData\Roaming\updater\Network\Network Persistent State

Filesize
296B

MD5
01f7593ed409f381dc5fb822d8376e26

SHA1
fb95be633a94b655fcc732fe8f38d9e8fa409686

SHA256
1748d684256c1ca28249ecb4f1057bc02157b3467ced3a7e550e7bcd76d1b86b

SHA512
8c0a5a94b49ceb395335161e24f8b884f9a0e969d5d76c656cc6e45e9485380a3e58c145d81624ffc7ed41331aa05aa61c195bd4f155079f384344d45a046e61

Download Submit
C:\Users\Admin\AppData\Roaming\updater\Network\Network Persistent State

Filesize
385B

MD5
3f7472a579667a859f8177cac0d84ffa

SHA1
a9d4bce004e8542ba8ab21e174475e0e1f875c83

SHA256
af6f437bbda3f5c4f41337739026c80eb0bd36ebfba614a4c402769b177e1a8b

SHA512
1e796c62de0ed4a6a16a4311dc56e33d48f0c9d7b359754215dec426ef18092223c63b1cecb83a387bc2596e85f105c734b5bb10ce0d53d9ac3944ed8cec0f38

Download Submit
C:\Users\Admin\AppData\Roaming\updater\Network\Network Persistent State

Filesize
296B

MD5
9737656d32aa4ebec5b4805450526fd9

SHA1
ec34c6fd7d2a878262e8210cf13a36e0c1757f85

SHA256
638a66bae2854ac8b0449404c0079e5217e49529ced09c6c47fdfbe43d3d43d2

SHA512
4f41c2028feb353f81ec2ad95518031f251459dbd0dcf558418c6b94e475fd95c409697e1ae421c803e7eba09daa2ac1c46d48ea22afc2e697ec7834104282ec

Download Submit
C:\Users\Admin\AppData\Roaming\updater\Network\Network Persistent State~RFe588c3d.TMP

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Users\Admin\AppData\Roaming\updater\Network\TransportSecurity

Filesize
201B

MD5
56e86264e197572358b5128e5339d2f7

SHA1
98e8d253ab5f2a76d364401a67ca4081f62535ba

SHA256
2cf7d803ff504628edc1cde540f1044f0ceb1ef105f880c567015e4af43f3601

SHA512
ba159e57c2d8f06e86c27f2a9b9f3cff5f7419ef9ba56eeb47ab5c52085ee517b3234953c476f1a5bda6d999e3e81cd59c8a07242da61ab5f332362d8cdb8af3

Download Submit
C:\Users\Admin\AppData\Roaming\updater\Network\TransportSecurity

Filesize
203B

MD5
1a3bc754a9387ef476657d1885faeb6a

SHA1
3a1118711cdda0da630d89ad62d52fceed6ebd89

SHA256
87f2308dc49e37b724c23770b9a34bd6001c49456fc75a8d0d8e1728b542f9d4

SHA512
82578d1c68eb1358b9ff7acd3b8ff8b7fc639a31f887241d0aea7cc8e342ab053c325a331ee1b7b094d38d4a92a077b32eb1d57bf44c416a7692f8be8a740319

Download Submit
C:\Users\Admin\AppData\Roaming\updater\Preferences

Filesize
86B

MD5
d11dedf80b85d8d9be3fec6bb292f64b

SHA1
aab8783454819cd66ddf7871e887abdba138aef3

SHA256
8029940de92ae596278912bbbd6387d65f4e849d3c136287a1233f525d189c67

SHA512
6b7ec1ca5189124e0d136f561ca7f12a4653633e2d9452d290e658dfe545acf6600cc9496794757a43f95c91705e9549ef681d4cc9e035738b03a18bdc2e25f0

Download Submit
memory/1004-581-0x00007FFE75FB0000-0x00007FFE75FB1000-memory.dmp

Filesize
4KB

Download
memory/1004-597-0x00007FFE769B0000-0x00007FFE769B1000-memory.dmp

Filesize
4KB

Download
memory/1324-546-0x00007FFE77490000-0x00007FFE77491000-memory.dmp

Filesize
4KB

Download
memory/2480-756-0x000001FE61F60000-0x000001FE61F61000-memory.dmp

Filesize
4KB

Download
memory/2480-761-0x000001FE61C70000-0x000001FE61C71000-memory.dmp

Filesize
4KB

Download
memory/2480-766-0x000001FE61C70000-0x000001FE61C71000-memory.dmp

Filesize
4KB

Download
memory/2480-759-0x000001FE61F60000-0x000001FE61F61000-memory.dmp

Filesize
4KB

Download
memory/2480-758-0x000001FE61F60000-0x000001FE61F61000-memory.dmp

Filesize
4KB

Download
memory/2480-757-0x000001FE61F60000-0x000001FE61F61000-memory.dmp

Filesize
4KB

Download
memory/2480-755-0x000001FE61F60000-0x000001FE61F61000-memory.dmp

Filesize
4KB

Download
memory/2480-754-0x000001FE61F60000-0x000001FE61F61000-memory.dmp

Filesize
4KB

Download
memory/2480-753-0x000001FE61F60000-0x000001FE61F61000-memory.dmp

Filesize
4KB

Download
memory/2480-763-0x000001FE61C80000-0x000001FE61C81000-memory.dmp

Filesize
4KB

Download
memory/2480-733-0x000001FE59A40000-0x000001FE59A50000-memory.dmp

Filesize
64KB

Download
memory/2480-760-0x000001FE61C80000-0x000001FE61C81000-memory.dmp

Filesize
4KB

Download
memory/2480-749-0x000001FE61F30000-0x000001FE61F31000-memory.dmp

Filesize
4KB

Download
memory/2480-752-0x000001FE61F60000-0x000001FE61F61000-memory.dmp

Filesize
4KB

Download
memory/2480-750-0x000001FE61F60000-0x000001FE61F61000-memory.dmp

Filesize
4KB

Download
memory/2480-751-0x000001FE61F60000-0x000001FE61F61000-memory.dmp

Filesize
4KB

Download
memory/2480-769-0x000001FE61BB0000-0x000001FE61BB1000-memory.dmp

Filesize
4KB

Download
memory/2480-781-0x000001FE61DB0000-0x000001FE61DB1000-memory.dmp

Filesize
4KB

Download
memory/2480-717-0x000001FE59940000-0x000001FE59950000-memory.dmp

Filesize
64KB

Download
memory/5184-714-0x00000218F5050000-0x00000218F5051000-memory.dmp

Filesize
4KB

Download
memory/5184-713-0x00000218F5050000-0x00000218F5051000-memory.dmp

Filesize
4KB

Download
memory/5184-712-0x00000218F5050000-0x00000218F5051000-memory.dmp

Filesize
4KB

Download
memory/5184-711-0x00000218F5050000-0x00000218F5051000-memory.dmp

Filesize
4KB

Download
memory/5184-710-0x00000218F5050000-0x00000218F5051000-memory.dmp

Filesize
4KB

Download
memory/5184-704-0x00000218F5050000-0x00000218F5051000-memory.dmp

Filesize
4KB

Download
memory/5184-703-0x00000218F5050000-0x00000218F5051000-memory.dmp

Filesize
4KB

Download
memory/5184-702-0x00000218F5050000-0x00000218F5051000-memory.dmp

Filesize
4KB

Download
memory/5184-708-0x00000218F5050000-0x00000218F5051000-memory.dmp

Filesize
4KB

Download
memory/5184-709-0x00000218F5050000-0x00000218F5051000-memory.dmp

Filesize
4KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads