hxxps://neverlose[.]fr/buy/

Analysis

max time kernel
205s
max time network
328s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
15/03/2024, 19:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://neverlose.fr/buy/

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
2968	System.exe
1668	System.exe
2380	System.exe

Loads dropped DLL 12 IoCs

pid	Process
4232	Loader.exe
4232	Loader.exe
4232	Loader.exe
2968	System.exe
2968	System.exe
2968	System.exe
1668	System.exe
2380	System.exe
1668	System.exe
1668	System.exe
1668	System.exe
1668	System.exe

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
76	ipinfo.io
59	ipinfo.io
62	ipinfo.io
64	ipinfo.io

Checks processor information in registry 2 TTPs 7 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	System.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	System.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	System.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	System.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	System.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	System.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	System.exe

Detects videocard installed 1 TTPs 2 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
8164	WMIC.exe
5748	WMIC.exe

Enumerates processes with tasklist 1 TTPs 64 IoCs

Process Discovery

T1057

pid	Process
7948	tasklist.exe
8928	tasklist.exe
8912	tasklist.exe
8832	tasklist.exe
8236	tasklist.exe
8208	tasklist.exe
8144	tasklist.exe
10048	tasklist.exe
5024	tasklist.exe
8020	tasklist.exe
8348	tasklist.exe
8268	tasklist.exe
5280	tasklist.exe
7332	tasklist.exe
6668	tasklist.exe
9596	tasklist.exe
2096	tasklist.exe
6048	tasklist.exe
10868	tasklist.exe
452	tasklist.exe
7880	tasklist.exe
8356	tasklist.exe
8952	tasklist.exe
7972	tasklist.exe
2080	tasklist.exe
7864	tasklist.exe
10816	tasklist.exe
11976	tasklist.exe
6792	tasklist.exe
8960	tasklist.exe
8756	tasklist.exe
8568	tasklist.exe
7924	tasklist.exe
1152	tasklist.exe
8088	tasklist.exe
7852	tasklist.exe
9228	tasklist.exe
5624	tasklist.exe
8472	tasklist.exe
8276	tasklist.exe
8856	tasklist.exe
8228	tasklist.exe
8176	tasklist.exe
2484	tasklist.exe
10024	tasklist.exe
5720	tasklist.exe
3376	tasklist.exe
8008	tasklist.exe
7988	tasklist.exe
8788	tasklist.exe
7964	tasklist.exe
8948	tasklist.exe
3520	tasklist.exe
11840	tasklist.exe
8944	tasklist.exe
5808	tasklist.exe
8920	tasklist.exe
8700	tasklist.exe
7856	tasklist.exe
6092	tasklist.exe
9192	tasklist.exe
11844	tasklist.exe
10828	tasklist.exe
10888	tasklist.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133550031518692922"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings	chrome.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Neverlose_Free.zip:Zone.Identifier	chrome.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4604	chrome.exe
4604	chrome.exe
4996	chrome.exe
4996	chrome.exe
2968	System.exe
2968	System.exe
2968	System.exe
2968	System.exe
2968	System.exe
2968	System.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4604	chrome.exe
Token: SeCreatePagefilePrivilege	4604	chrome.exe
Token: SeShutdownPrivilege	4604	chrome.exe
Token: SeCreatePagefilePrivilege	4604	chrome.exe
Token: SeShutdownPrivilege	4604	chrome.exe
Token: SeCreatePagefilePrivilege	4604	chrome.exe
Token: SeShutdownPrivilege	4604	chrome.exe
Token: SeCreatePagefilePrivilege	4604	chrome.exe
Token: SeShutdownPrivilege	4604	chrome.exe
Token: SeCreatePagefilePrivilege	4604	chrome.exe
Token: SeShutdownPrivilege	4604	chrome.exe
Token: SeCreatePagefilePrivilege	4604	chrome.exe
Token: SeShutdownPrivilege	4604	chrome.exe
Token: SeCreatePagefilePrivilege	4604	chrome.exe
Token: SeShutdownPrivilege	4604	chrome.exe
Token: SeCreatePagefilePrivilege	4604	chrome.exe
Token: SeShutdownPrivilege	4604	chrome.exe
Token: SeCreatePagefilePrivilege	4604	chrome.exe
Token: SeShutdownPrivilege	4604	chrome.exe
Token: SeCreatePagefilePrivilege	4604	chrome.exe
Token: SeShutdownPrivilege	4604	chrome.exe
Token: SeCreatePagefilePrivilege	4604	chrome.exe
Token: SeShutdownPrivilege	4604	chrome.exe
Token: SeCreatePagefilePrivilege	4604	chrome.exe
Token: SeShutdownPrivilege	4604	chrome.exe
Token: SeCreatePagefilePrivilege	4604	chrome.exe
Token: SeShutdownPrivilege	4604	chrome.exe
Token: SeCreatePagefilePrivilege	4604	chrome.exe
Token: SeShutdownPrivilege	4604	chrome.exe
Token: SeCreatePagefilePrivilege	4604	chrome.exe
Token: SeShutdownPrivilege	4604	chrome.exe
Token: SeCreatePagefilePrivilege	4604	chrome.exe
Token: SeShutdownPrivilege	4604	chrome.exe
Token: SeCreatePagefilePrivilege	4604	chrome.exe
Token: SeShutdownPrivilege	4604	chrome.exe
Token: SeCreatePagefilePrivilege	4604	chrome.exe
Token: SeShutdownPrivilege	4604	chrome.exe
Token: SeCreatePagefilePrivilege	4604	chrome.exe
Token: SeShutdownPrivilege	4604	chrome.exe
Token: SeCreatePagefilePrivilege	4604	chrome.exe
Token: SeShutdownPrivilege	4604	chrome.exe
Token: SeCreatePagefilePrivilege	4604	chrome.exe
Token: SeShutdownPrivilege	4604	chrome.exe
Token: SeCreatePagefilePrivilege	4604	chrome.exe
Token: SeShutdownPrivilege	4604	chrome.exe
Token: SeCreatePagefilePrivilege	4604	chrome.exe
Token: SeShutdownPrivilege	4604	chrome.exe
Token: SeCreatePagefilePrivilege	4604	chrome.exe
Token: SeShutdownPrivilege	4604	chrome.exe
Token: SeCreatePagefilePrivilege	4604	chrome.exe
Token: SeShutdownPrivilege	4604	chrome.exe
Token: SeCreatePagefilePrivilege	4604	chrome.exe
Token: SeShutdownPrivilege	4604	chrome.exe
Token: SeCreatePagefilePrivilege	4604	chrome.exe
Token: SeShutdownPrivilege	4604	chrome.exe
Token: SeCreatePagefilePrivilege	4604	chrome.exe
Token: SeShutdownPrivilege	4604	chrome.exe
Token: SeCreatePagefilePrivilege	4604	chrome.exe
Token: SeShutdownPrivilege	4604	chrome.exe
Token: SeCreatePagefilePrivilege	4604	chrome.exe
Token: SeShutdownPrivilege	4604	chrome.exe
Token: SeCreatePagefilePrivilege	4604	chrome.exe
Token: SeShutdownPrivilege	4604	chrome.exe
Token: SeCreatePagefilePrivilege	4604	chrome.exe

Suspicious use of FindShellTrayWindow 61 IoCs

pid	Process
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4604 wrote to memory of 3372	4604	chrome.exe	80
PID 4604 wrote to memory of 3372	4604	chrome.exe	80
PID 4604 wrote to memory of 3832	4604	chrome.exe	82
PID 4604 wrote to memory of 3832	4604	chrome.exe	82
PID 4604 wrote to memory of 3832	4604	chrome.exe	82
PID 4604 wrote to memory of 3832	4604	chrome.exe	82
PID 4604 wrote to memory of 3832	4604	chrome.exe	82
PID 4604 wrote to memory of 3832	4604	chrome.exe	82
PID 4604 wrote to memory of 3832	4604	chrome.exe	82
PID 4604 wrote to memory of 3832	4604	chrome.exe	82
PID 4604 wrote to memory of 3832	4604	chrome.exe	82
PID 4604 wrote to memory of 3832	4604	chrome.exe	82
PID 4604 wrote to memory of 3832	4604	chrome.exe	82
PID 4604 wrote to memory of 3832	4604	chrome.exe	82
PID 4604 wrote to memory of 3832	4604	chrome.exe	82
PID 4604 wrote to memory of 3832	4604	chrome.exe	82
PID 4604 wrote to memory of 3832	4604	chrome.exe	82
PID 4604 wrote to memory of 3832	4604	chrome.exe	82
PID 4604 wrote to memory of 3832	4604	chrome.exe	82
PID 4604 wrote to memory of 3832	4604	chrome.exe	82
PID 4604 wrote to memory of 3832	4604	chrome.exe	82
PID 4604 wrote to memory of 3832	4604	chrome.exe	82
PID 4604 wrote to memory of 3832	4604	chrome.exe	82
PID 4604 wrote to memory of 3832	4604	chrome.exe	82
PID 4604 wrote to memory of 3832	4604	chrome.exe	82
PID 4604 wrote to memory of 3832	4604	chrome.exe	82
PID 4604 wrote to memory of 3832	4604	chrome.exe	82
PID 4604 wrote to memory of 3832	4604	chrome.exe	82
PID 4604 wrote to memory of 3832	4604	chrome.exe	82
PID 4604 wrote to memory of 3832	4604	chrome.exe	82
PID 4604 wrote to memory of 3832	4604	chrome.exe	82
PID 4604 wrote to memory of 3832	4604	chrome.exe	82
PID 4604 wrote to memory of 3832	4604	chrome.exe	82
PID 4604 wrote to memory of 3832	4604	chrome.exe	82
PID 4604 wrote to memory of 3832	4604	chrome.exe	82
PID 4604 wrote to memory of 3832	4604	chrome.exe	82
PID 4604 wrote to memory of 3832	4604	chrome.exe	82
PID 4604 wrote to memory of 3832	4604	chrome.exe	82
PID 4604 wrote to memory of 3832	4604	chrome.exe	82
PID 4604 wrote to memory of 3832	4604	chrome.exe	82
PID 4604 wrote to memory of 4860	4604	chrome.exe	83
PID 4604 wrote to memory of 4860	4604	chrome.exe	83
PID 4604 wrote to memory of 3212	4604	chrome.exe	84
PID 4604 wrote to memory of 3212	4604	chrome.exe	84
PID 4604 wrote to memory of 3212	4604	chrome.exe	84
PID 4604 wrote to memory of 3212	4604	chrome.exe	84
PID 4604 wrote to memory of 3212	4604	chrome.exe	84
PID 4604 wrote to memory of 3212	4604	chrome.exe	84
PID 4604 wrote to memory of 3212	4604	chrome.exe	84
PID 4604 wrote to memory of 3212	4604	chrome.exe	84
PID 4604 wrote to memory of 3212	4604	chrome.exe	84
PID 4604 wrote to memory of 3212	4604	chrome.exe	84
PID 4604 wrote to memory of 3212	4604	chrome.exe	84
PID 4604 wrote to memory of 3212	4604	chrome.exe	84
PID 4604 wrote to memory of 3212	4604	chrome.exe	84
PID 4604 wrote to memory of 3212	4604	chrome.exe	84
PID 4604 wrote to memory of 3212	4604	chrome.exe	84
PID 4604 wrote to memory of 3212	4604	chrome.exe	84
PID 4604 wrote to memory of 3212	4604	chrome.exe	84
PID 4604 wrote to memory of 3212	4604	chrome.exe	84
PID 4604 wrote to memory of 3212	4604	chrome.exe	84
PID 4604 wrote to memory of 3212	4604	chrome.exe	84
PID 4604 wrote to memory of 3212	4604	chrome.exe	84
PID 4604 wrote to memory of 3212	4604	chrome.exe	84

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://neverlose.fr/buy/
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff9e2bb9758,0x7ff9e2bb9768,0x7ff9e2bb9778
  2⤵
  PID:3372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1548 --field-trial-handle=1820,i,12937729171290644674,8843028193077147480,131072 /prefetch:2
  2⤵
  PID:3832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2092 --field-trial-handle=1820,i,12937729171290644674,8843028193077147480,131072 /prefetch:8
  2⤵
  PID:4860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2160 --field-trial-handle=1820,i,12937729171290644674,8843028193077147480,131072 /prefetch:8
  2⤵
  PID:3212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3100 --field-trial-handle=1820,i,12937729171290644674,8843028193077147480,131072 /prefetch:1
  2⤵
  PID:3924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3108 --field-trial-handle=1820,i,12937729171290644674,8843028193077147480,131072 /prefetch:1
  2⤵
  PID:4912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4844 --field-trial-handle=1820,i,12937729171290644674,8843028193077147480,131072 /prefetch:8
  2⤵
  PID:500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5112 --field-trial-handle=1820,i,12937729171290644674,8843028193077147480,131072 /prefetch:8
  2⤵
  PID:3340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=5020 --field-trial-handle=1820,i,12937729171290644674,8843028193077147480,131072 /prefetch:1
  2⤵
  PID:4352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3216 --field-trial-handle=1820,i,12937729171290644674,8843028193077147480,131072 /prefetch:8
  2⤵
  PID:1956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=1820,i,12937729171290644674,8843028193077147480,131072 /prefetch:8
  2⤵
  - NTFS ADS
  PID:228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1616 --field-trial-handle=1820,i,12937729171290644674,8843028193077147480,131072 /prefetch:8
  2⤵
  PID:4884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1520 --field-trial-handle=1820,i,12937729171290644674,8843028193077147480,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4996

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1956

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4772

C:\Users\Admin\Desktop\Loader.exe
"C:\Users\Admin\Desktop\Loader.exe"
1⤵
- Loads dropped DLL
PID:4232
- C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\System.exe
  C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\System.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:2968
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:1144
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:452
- - C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\System.exe
    "C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\System.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\megamindnva" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1748 --field-trial-handle=1756,i,16279767411602666515,17610803267872535505,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1668
- - C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\System.exe
    "C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\System.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\megamindnva" --mojo-platform-channel-handle=1828 --field-trial-handle=1756,i,16279767411602666515,17610803267872535505,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2380
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic process where processid=NaN get ExecutablePath"
    3⤵
    PID:4576
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic process where processid=NaN get ExecutablePath
      4⤵
      PID:2924
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3612
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7856
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5092
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:7916
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4836
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:8072
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:1328
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:7908
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4776
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:7728
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2308
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7988
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3384
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7924
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3744
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:7848
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:920
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7948
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:764
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:8036
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3424
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7864
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2388
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:7872
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2292
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:7744
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4368
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:7736
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2204
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:8804
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3124
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:7528
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3332
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:8220
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2244
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:7932
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:436
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7880
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4896
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8008
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4996
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:8768
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3944
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:8000
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2288
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:8300
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:1016
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8568
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:1012
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:7840
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3560
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:8252
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2404
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8020
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:772
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:8288
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3224
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:8028
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4020
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:8340
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5044
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:8184
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:1692
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2924
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8144
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:1956
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:7980
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:500
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:6692
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:1432
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7964
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:816
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:7940
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4244
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:8820
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4532
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:8044
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4752
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8944
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2012
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:8544
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:1036
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7972
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:1628
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:7956
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2736
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8276
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3056
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8788
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3292
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:6792
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:740
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8268
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:1144
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:8796
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4932
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8700
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3520
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:6884
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4564
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8176
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2572
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8920
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2108
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:8152
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:796
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:8848
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3052
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:8840
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:1560
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:8556
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4524
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:7808
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5132
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8756
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5148
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8356
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5172
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8208
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5192
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8912
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5216
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:8124
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5228
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:8896
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5260
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:8936
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5276
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8228
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5284
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:7832
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5300
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8088
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5308
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:8608
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5328
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:8200
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5356
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8832
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5372
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:8596
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5384
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:8532
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5404
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8856
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5416
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:8976
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5436
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:8708
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5452
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:8968
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5472
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8348
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5480
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:8732
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5496
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:9020
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5516
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:8864
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5540
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:8744
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5564
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:8872
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5584
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8236
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5616
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:8260
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5644
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:8244
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5660
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:8880
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5680
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8960
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5700
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:8904
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5712
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:8724
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5736
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8928
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5756
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:8888
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5776
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8952
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5800
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:8588
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "net session"
    3⤵
    PID:5824
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:8624
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:9628
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\resources\app.asar.unpacked\bind\main.exe"
    3⤵
    PID:5840
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic csproduct get uuid"
    3⤵
    PID:5876
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:8484
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic OS get caption, osarchitecture | more +1"
    3⤵
    PID:5908
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic OS get caption, osarchitecture
      4⤵
      PID:7896
  - - C:\Windows\system32\more.com
      more +1
      4⤵
      PID:8160
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic cpu get name | more +1"
    3⤵
    PID:1792
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic cpu get name
      4⤵
      PID:8496
  - - C:\Windows\system32\more.com
      more +1
      4⤵
      PID:9004
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic PATH Win32_VideoController get name | more +1"
    3⤵
    PID:8160
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic PATH Win32_VideoController get name
      4⤵
      Detects videocard installed
      PID:8164
  - - C:\Windows\system32\more.com
      more +1
      4⤵
      PID:8688
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
    3⤵
    PID:8164
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
      4⤵
      PID:10724
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion' -Name ProductName"
    3⤵
    PID:11428
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion' -Name ProductName
      4⤵
      PID:11556
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:11596
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:11392
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic process where processid=NaN get ExecutablePath"
    3⤵
    PID:12276
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic process where processid=NaN get ExecutablePath
      4⤵
      PID:7480
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
    3⤵
    PID:10832
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
      4⤵
      PID:6844
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
    3⤵
    PID:9352
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
      4⤵
      PID:7920
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip""
    3⤵
    PID:5260
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip"
      4⤵
      PID:8260
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook""
    3⤵
    PID:6376
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook"
      4⤵
      PID:11528
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager""
    3⤵
    PID:11652
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager"
      4⤵
      PID:10168
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx""
    3⤵
    PID:5984
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx"
      4⤵
      PID:12276
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DXM_Runtime""
    3⤵
    PID:5804
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DXM_Runtime"
      4⤵
      PID:9280
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore""
    3⤵
    PID:9220
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore"
      4⤵
      PID:12244
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE40""
    3⤵
    PID:9860
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE40"
      4⤵
      PID:9108
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data""
    3⤵
    PID:5172
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data"
      4⤵
      PID:9468
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX""
    3⤵
    PID:10524
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX"
      4⤵
      PID:6392
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IEData""
    3⤵
    PID:11884
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IEData"
      4⤵
      PID:7988
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack""
    3⤵
    PID:5788
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack"
      4⤵
      PID:8884
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Firefox 105.0.3 (x64 en-US)""
    3⤵
    PID:2032
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Firefox 105.0.3 (x64 en-US)"
      4⤵
      PID:11372
- - C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\System.exe
    "C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\System.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --user-data-dir="C:\Users\Admin\AppData\Roaming\megamindnva" --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4196 --field-trial-handle=1756,i,16279767411602666515,17610803267872535505,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
    3⤵
    PID:4368

C:\Users\Admin\Desktop\Loader.exe
"C:\Users\Admin\Desktop\Loader.exe"
1⤵
PID:7072
- C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\System.exe
  C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\System.exe
  2⤵
  PID:11424
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:11860
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:12120
- - C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\System.exe
    "C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\System.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\megamindnva" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1656 --field-trial-handle=1660,i,10037874081396486069,3042781243530635302,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
    3⤵
    PID:12064
- - C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\System.exe
    "C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\System.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\megamindnva" --mojo-platform-channel-handle=1888 --field-trial-handle=1660,i,10037874081396486069,3042781243530635302,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
    3⤵
    PID:12132
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic process where processid=NaN get ExecutablePath"
    3⤵
    PID:4756
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic process where processid=NaN get ExecutablePath
      4⤵
      PID:7564
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:8056
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:11952
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:912
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:11840
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2120
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:364
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:11340
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:4164
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:11312
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:5720
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:11304
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:5020
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:11296
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:10816
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:11276
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:2792
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:7900
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:5024
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:10688
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:6108
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:10660
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:4080
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:11332
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:11976
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:11364
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:10796
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:11380
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:10888
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:11396
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:9620
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:7108
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:4744
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:8160
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:5988
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4672
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:2096
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:7024
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:2484
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:7028
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:8668
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:7032
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:1152
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:7152
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:6744
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:11388
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:9228
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5980
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:5224
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:9004
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:11984
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:8624
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:9596
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:10728
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:11880
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:7048
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:1044
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:10724
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:10280
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:7616
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:2332
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:7100
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:5304
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5560
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:2080
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:7140
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:7964
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:6032
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:5612
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5696
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:5336
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5728
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:4508
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5820
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:10860
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:7184
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:3900
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:1976
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:8708
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:7200
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:8092
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:7204
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:5764
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5464
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:10856
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:7232
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:1968
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:7236
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:5504
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:7380
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:10828
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:7392
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:6680
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:7264
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:6092
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:7268
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:5812
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:7476
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:6048
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:7216
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:1400
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:7252
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:5380
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:7560
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:2740
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:7568
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:5344
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:7648
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:5936
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:7592
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:10924
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:7620
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:3376
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:7656
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:9192
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:7904
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:1396
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:7680
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:5044
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:7784
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:5280
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:7888
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:6040
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:8084
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:6752
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:8196
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:8300
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:8308
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:5708
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:8312
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:5624
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:8660
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:1536
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:8480
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:10868
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:8324
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:8188
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:8464
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:3520
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:8716
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:10392
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:8752
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:4532
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:8764
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:11688
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4084
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:8184
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:8604
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:10048
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:11668
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:4088
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3792
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:5808
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:8992
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:5796
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:9008
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:11852
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:9048
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:8404
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:9064
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:9604
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:9096
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:5552
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:9112
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8948
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:9116
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:8952
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:9120
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:10320
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:8372
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:2548
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:9132
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:5868
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:7056
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7332
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:9180
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:10024
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:7612
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7852
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:8116
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:8824
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:9324
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:11844
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:9372
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:6668
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "net session"
    3⤵
    PID:9280
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:1480
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:6900
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\resources\app.asar.unpacked\bind\main.exe"
    3⤵
    PID:9452
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic csproduct get uuid"
    3⤵
    PID:9340
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:5164
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic OS get caption, osarchitecture | more +1"
    3⤵
    PID:9352
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic OS get caption, osarchitecture
      4⤵
      PID:12128
  - - C:\Windows\system32\more.com
      more +1
      4⤵
      PID:3016
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic cpu get name | more +1"
    3⤵
    PID:4836
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic cpu get name
      4⤵
      PID:4540
  - - C:\Windows\system32\more.com
      more +1
      4⤵
      PID:8568
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic PATH Win32_VideoController get name | more +1"
    3⤵
    PID:5180
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic PATH Win32_VideoController get name
      4⤵
      Detects videocard installed
      PID:5748
  - - C:\Windows\system32\more.com
      more +1
      4⤵
      PID:4236
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
    3⤵
    PID:8368
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
      4⤵
      PID:8208
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion' -Name ProductName"
    3⤵
    PID:6312
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion' -Name ProductName
      4⤵
      PID:6448
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:8928
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:9200

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
PID:1840

C:\Users\Admin\Desktop\Loader.exe
"C:\Users\Admin\Desktop\Loader.exe"
1⤵
PID:11932
- C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\System.exe
  C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\System.exe
  2⤵
  PID:10444
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2404
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8472
- - C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\System.exe
    "C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\System.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\megamindnva" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1644 --field-trial-handle=1708,i,1719282973606555827,11328289117110564281,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
    3⤵
    PID:4664
- - C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\System.exe
    "C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\System.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\megamindnva" --mojo-platform-channel-handle=2140 --field-trial-handle=1708,i,1719282973606555827,11328289117110564281,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
    3⤵
    PID:4868

C:\Users\Admin\Desktop\Loader.exe
"C:\Users\Admin\Desktop\Loader.exe"
1⤵
PID:7976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
2c281dc003a8fad959dd60387a5e5d80

SHA1
8a73291cfaf31feeda34d90c5bdc3a0ba53503ba

SHA256
4423af017f7a75b8c1d60853310f24a509f1a424b1ce845e9a701c8af2f59b6f

SHA512
a7dd1ac0854bf4bedd5ffff58ce34df273d83d8c0f66eca32c9a924fcf9e36888c5b7ed119005de24cbe169c057c55aeb45d60d6f100410354135751941a7c92

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\File System\000\t\Paths\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
e9151afee5fe82cd0d5f73ecb5cfbbc3

SHA1
898e50489e46dbf9e5766be315239cc2dcdf2f06

SHA256
07c3962b9fdd292e556221b6b898c1c6412be74297d4d1a1c493cef656df5211

SHA512
cb10ba5061cc249895fa722e94b9ad5ed085ca22a61d63cef7e74d774805130bc227f3490abd5638910a572bbcd229c6ce811c96dd44fc94e70b7d74f8c910cb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\342c532b-209c-4d13-889e-e3d12f7f7f45.tmp

Filesize
2KB

MD5
bd819b3f8d61da327a6db72d24e8500e

SHA1
811a08ecda20cc6c73fc5fa31795072cd67f5a6c

SHA256
dd700a1483ebe69494d0d4ac19debb8eb1d53949094c93edee1a42932a2dbc45

SHA512
6f96b7a66c2df8525de72c629b5ffe0fad2d5f36c8c189013b55b14e4022c3ffe5252a872b1a4975ce05e70cf1d65821075b193994d7382f57e27fe213f2abd8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
128618fb0f0c2c8e6294ad7ecbf1ef29

SHA1
d872548870e10b08707d7bf67e091a3d955df16c

SHA256
5091f858c9082293b78682937bbebbb1fa24dce4f2d664ff07af01df3d66b217

SHA512
6151e822142174964fb6cab731a724946931766a3f80547ae1e4d1e9a586ea28b2be570a5581406c4a820a295c5cc2e982cb09e82409812fe86f221b9e8c0b74

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
75f4625798417bd286ab399673957b82

SHA1
c0d1ddc407de35c5294612a55ce5d02a561094a9

SHA256
8029ac3ccce89b165fcf65c2c9f420b988c71b24d1841a114bc63d4ad300ab6a

SHA512
a472ad9c057c55d51334fcc4545da1e578fc10209503ec79d663f1b989e641711a1af968752e84d2ddc929580db35fbd034827ee85115d53bc1e44d8ba2ab8bf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
2939b48649fb4ef6b89c9dcdaf84ab76

SHA1
9bcbf6e0671a625ca609ecce773cf6f32c66f2cb

SHA256
92e25328dd251993216f12c06e21c92901d66631e858a07c5dfbe0d13393a6e5

SHA512
f7528a257de2ade1b86d9a40d519fc605191d68382059ae097b7455c2a002ce40d47088eac4b62dd8f9d2fe3fdfecb40a88816ce6ceb5d894fa5704347a5e4ad

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
6d4a6e5e9364b444a7bc7d3fb2784d2d

SHA1
2afc45c719dcb471c3957ffb9b4a1661c25810b6

SHA256
e1ae1f14e7ae6aad29cf371cff84b64546f1d3c25337852068113bb370914e74

SHA512
a321eaf10abc46ba5e4ba9ea4a067a530ab2a7bc79197f25a704cd47a7f21105f0fcbf85f181423f855883715cb7ba4c140b3588e57ddaeebcf17e2bf5078071

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
3cf8cbae8800d967ea4d899080e70dbe

SHA1
431643bed359d001fed9bc2c839f31621afa58d1

SHA256
cda0bdc797ef8eee5c2be8fa0ca64b2ead5bec3bb5534914a803a9500b456392

SHA512
adebda90813d77d61516b0b5d8fa6f6f91bd9d6174adaa06e74cdedda63574d7cdf52f9374a4af5f88c3eb3bd1eca7d5ef12c2b5f8bd207415379cfb97fba153

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
0843e6063663a199b21c40a2ab9b8e12

SHA1
92c11c124db032acf95d0eb0b1018f9c231557cf

SHA256
5a3bd6164a2f2e7d9ba612b39b46ddee9d75bf4a44038014977d0c2ab21d10c4

SHA512
535b308cf3231f3bf3adce515f0b810d47d7ac35a1c4d981e3920ca6c4269cab236b4d82b591381a3f225eb1ae42cac1ad721e0f039ef93a0dfc2f11051c9e75

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
22bed572970ebb73571b4673e559542a

SHA1
84b6ade1fd36a3f0c24c0dac4d3b7490cdcbc580

SHA256
f30345afe810db90878bb773aaed5717fee365ef64d1ef59649945228f3430f3

SHA512
6ea6a51fdeb6510634073095d1cf35daf4b11943bda6a749d22a36e730324828005e056c442352e4d007501579b4b6b3fbca1cd0389687604aca7ef6e1a37a08

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
130KB

MD5
1eaf24666631ab302653274dcccf7b0a

SHA1
97ee98cfb51f958a7ad988521339b4bfb18b7268

SHA256
14ff378be5bfd670328e79ded74183e74de6e4858bcaa4eb3f2580e5ae84ebf2

SHA512
6da378ca57d94a596ca79c7071a8dc5e011693433d2ff4b8287a37f74ff12d4d72e525df0d9c5e098dab97eabf989748956864cdfb9f987482fa6e890bc78be2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
130KB

MD5
e78a03e2452745c1348990ddb7410303

SHA1
88cb14884dd885b087869c3fc133b3d188af5b8b

SHA256
47a41c0ae2f5a81e7b4357de2c83296ccf017e2ba31adca3a825e94cbe836236

SHA512
431bb679e0a089c88e3acf7fc0ef8a32b96ec67d144c1f67dd56ca0b76e1e3cdce4488ff0501549400d3854d01beba3d76570570f86c38f503faa3e6b4a810a8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
98KB

MD5
54a3418c0c7c03151f6cab158e9c8b47

SHA1
18aeade9dde1e595031e86e76ea273dc28417be1

SHA256
7e44621bd41d10d580ebf3130e28cf40f38b6f0e597e435cad972b45214e78a2

SHA512
66865785207368bcdc7aec73a4e65ed444a0a71a6f16fec2bb2eb77b6aa19eb354dc5a69a6c194160a205725c094ebeafdb9d5d419c93816dc0269f79fe80f61

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
105KB

MD5
a87d45a4a74cd8e07cba3e3c44cd7b1d

SHA1
79bc28b681401dbd38ac04e9348ebcffa84e1987

SHA256
b46dd55ababff113439f1cb9426cf93f59c20c1e0f662c430170da3a7be41ffd

SHA512
4704f8726cd9cf843abe28b40282d49310b5b5c39deb4194d5e20d4867576b98186d1102dd50aa3bfbfb361ba38ead42a1a01edc85026688c6e0fe9bacf18d69

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe584bf8.TMP

Filesize
93KB

MD5
ba9460cee4149cd333b310ebc573f1bc

SHA1
74cc419ce5653d40b1b8099648305c62a22ff8ff

SHA256
0a5e0aeb96d8f7e868b5c3f7a70dbf8f1a51b3f87b199d8694efcd023d0e4d08

SHA512
563bd4f818c7b13d7c4eb8540ee723ec96235a78cdeb2666ca43646ab363d71ff05ea44dc8ed6a0b395319dda9e8f232a462e9e62f3cade6eb9bbd6de871bb9c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
10KB

MD5
0f137da24a7f95c1f5efc595b7dea47c

SHA1
a92df2e2f6e5a988251ecba9753f8261991c543a

SHA256
d7780e4b261a6039a80cceb18531df7678e321593e5bd5ac0486edc9fae5d5cb

SHA512
e50f48c6cd15d381370356ba1e7425da8d5a57cad875aa9fca73a2c13242f9c64249c2ec1959b46129aee4da2802f357f60526f924b99d433eeceed3c701cd9c

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
10KB

MD5
99054564d65459fba74d35db62b4c5a2

SHA1
8d223d5f2f521cf641f1ac887d53d9faaf42ec14

SHA256
e9cd52d6530d9f8953eb3d4699f1af0d52ddc0dfaa312f5e448fe71362f4e8ab

SHA512
e7b26d4d3bc48265507611f75211700943545273134c458d30355b903359d7e58c24a9dcfeab70ec54964b7eebe50a27a6ba1049d457a8593f5e2d2a84150f9d

Download Submit
C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\D3DCompiler_47.dll

Filesize
2.0MB

MD5
9f68ffdef1516232baabada0a664bda2

SHA1
d3831494b0777dd03d8ad7315bc88833b0308916

SHA256
723fe12bed963062988b91ff4425d4ddc72dc53be6c37fc50b4d069ca884bccc

SHA512
050c47ce6db063fe562b3e912314de59d9b5da054b9fae84914e2ac556d0f61e798ee89bdade1f17fb36adf138e76973a33b3057476826d1125a3cf3c2b6d77b

Download Submit
C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\LICENSES.chromium.html

Filesize
3.6MB

MD5
5bfda7dffe0458f5419fc96a103e5422

SHA1
e4e7e081c0867616510372212f297ab08ef348a3

SHA256
ae8c3f8d8a398836634594cd8d789b6ce62ea1088844463b78884df783b29c09

SHA512
6526b355cdd97e16bab7f75206705226f26c7462c59adb507835b7e83fce663f084d683d524c6bd02e4985315370e19dd1631297bb1ede3a15df800be52e77a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\System.exe

Filesize
384KB

MD5
60ef0bd28675b509a65843937464bf14

SHA1
6321c01ca2cbf6820afb6ec1f47e50fbf661a035

SHA256
ed997081c763e2629b3ca4fa1ee606ddef63644ecdd3bdea9a0181c60d37efb9

SHA512
04114cea8c8cc40a0529ce33e7f29a9c0341010cfc286f5362f0030f36faae017847e92670bb4f60c9c239e2c85f8e87a581a1c93e506eb6ccba4b93157024bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\System.exe

Filesize
320KB

MD5
1addd369d48650725e2e9cafd6c2f4f1

SHA1
8a6c7d725e9b671c4929a0bee2b62c55b555a4c1

SHA256
ea1aa9d7e78c7a22c116c39fc26411b28ad28e944bf13d6c7da6098e34d25ec7

SHA512
9a4cd144030647298180f8c939c9ee2df9d7d7bffafaecd41f87f97a272160edf112bd8d6e2c3e99c0feae4773d2f8dc0d815e0ea08539956d461e6d3d79a71c

Download Submit
C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\System.exe

Filesize
256KB

MD5
2022979c70f0599a3eba7ff479e58e21

SHA1
173610303b6982725b62b31fdd829820264f1400

SHA256
f35dae4b5163b50b4dd206219434d15a8ee7464336a016f7a321f3049a145210

SHA512
ef01056eeda5ed6c036bf871b939d2f031754506844247c77de3ea697f428156b08396ce83cac4604093027d9609982cd66e981aecba97bc3d653eb10e8eafa2

Download Submit
C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\chrome_100_percent.pak

Filesize
132KB

MD5
e4cbb48c438622a4298c7bdd75cc04f6

SHA1
6f756d31ef95fd745ba0e9c22aadb506f3a78471

SHA256
24d92bbeb63d06b01010fe230c1e3a31e667a159be7e570a8efe68f83ed9ad40

SHA512
8d3ea1b5ca74c20a336eaa29630fd76ecd32f5a56bb66e8cef2bce0fa19024ea917562fd31365081f7027dde9c8464742b833d08c8f41fdddc5bd1a74b9bc766

Download Submit
C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\d3dcompiler_47.dll

Filesize
1.6MB

MD5
53f4e2e95b03a5341a881e43189042d1

SHA1
f957aabb2b75da2ec280127713ba4851b7d48f64

SHA256
878aeaa20c5efea33f33f95f0b90772ed77828190422c177f17deb331ea8ffc5

SHA512
e64c914ff8f8bc51b1c0df17ce9e18054a22bf3c8f6d63d21c26358cc880ec68ca1171938a4dcb1bf01ce9415d2aa5931b37ac6175478c8ced0511af1361e7ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\ffmpeg.dll

Filesize
256KB

MD5
de288119bb0a71655c7409f76206445e

SHA1
fcfb8a9ab7027f87ff520d4824f06b01b8fa371e

SHA256
f6f77a6ef9144fc2edb62724f346784b14959c3491b42ba7b1354e6c3550671e

SHA512
50fe5a3f581ba358a97c5ee04f687af8d50173e24e905521819977757198ff093c3c0d2f315cb54685b8fe78719ef56eaf89305d53cb47d659f59fe9ab493826

Download Submit
C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\ffmpeg.dll

Filesize
192KB

MD5
6cefd951c341cd08b24c833d21b621aa

SHA1
51db607102a6b53f18e53b7732bf7c888bc2ce0b

SHA256
0a42062820d62cd679671f4cebef2fbea8c8c0922ab26e0efdf210c54589886a

SHA512
cb87f0447b292e2c6540b43f7093d42931044ceed1120de55aee24fcbcbaf7fb8de413971271178ce2759c578cd426b129656e5689d213914fe4e0bfa2318f44

Download Submit
C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\icudtl.dat

Filesize
3.3MB

MD5
b988fb158d8a944f3b2ce56d658503cd

SHA1
0330c7a94b7b5e8b3593db199bf2b4ec729b58db

SHA256
a26ee706859212f3ad3d71c458268fd6b3d3e856cfcb2357f1c00d55750c1751

SHA512
59be8a28a9ecd01eba5cce13ce0cf7f6643bfe149b2083d6ea77c8412cf0c723b2866f3f6be894a9fd2d9fd15d1f0040598e8f4c33ff74bb7d18c3dd9eb5484e

Download Submit
C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\libGLESv2.dll

Filesize
1.8MB

MD5
a41b4c5f6011b077046391377a8db10b

SHA1
4627826c22e5356d96a5a9949cc6728d7e1b7d4d

SHA256
9f7d589e55f09347440f9e6a7a54cbc039134187341f44ffee0d4f11f2fc31ae

SHA512
bdbd0aafe343508298a5acfa0fde296083ad0e87de6126346ac3950a580ec6c391f3ccee9b7907a31d28f7766eed3c7544411886f352cdad9ef6da2810cf205b

Download Submit
C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\libglesv2.dll

Filesize
1.8MB

MD5
839fb8ab135834c36f6f774747e6b95a

SHA1
01ad205fac68b4a2a11a1a4522a3833e47b1f60c

SHA256
a601359b9ab95c4802e55b9bfd0d628916cfffcd1df2e298e24139a484ccf0e3

SHA512
c35eca896beb0af5286e58983f44efdcc4edf463af94e4f370eb0ece3286e4e6051f12268bf9af5cbf965824b13d5dc62a541388d75379044c32e33f484ec838

Download Submit
C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\locales\am.pak

Filesize
693KB

MD5
39a396fce4d93f744b3c786d62d2686c

SHA1
7ec8176e652b666b6ab9fffb6cb9b7dcfdd1a2a2

SHA256
0b1d326be9dabcda8e37740017383f2d8f1bec7a8fdb1f11ebe538c3632453fd

SHA512
798063b51f745fc2c9e7f852f72ce55939ed41305d070d1844c790755f7ab42a6830406ba2485237d37a0c46b804512e7dc37c65b7f03249c28741a4f706017a

Download Submit
C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\locales\ar.pak

Filesize
758KB

MD5
14b15761cb9d4e1956812df8b42c2aea

SHA1
7c25580d892711b9eff1a3ace4e6699ea64e0706

SHA256
c8d405127b032587e6ae6426a35cb766139bae26170ca08d811354486ab667f8

SHA512
ec9a6e6e715c817726ad744fadca4d1af3015d95421774ccfe54d616225b7a17e862e086fe0aebb3a903d2ebfb27779cffcd713d3042ecdf9761c24c5a56cdcf

Download Submit
C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\locales\bg.pak

Filesize
42KB

MD5
e7be76dd519aade364747efd1dafc131

SHA1
b8a038de01b1e02cc824881cd977d7c59adf6b9e

SHA256
f4194d8c3d7b12d6e956d751921cb657bf319cb443b1b6f3efc3dff7dd20ede4

SHA512
a88abc20baf4ecb595e7973ca2aa6965bcf7b002d8700cd1ca825f55947ff47eede71d38373324681836e836742db84d54f7bd6dbbfa9d373b6944aabbc3a58d

Download Submit
C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\locales\bn.pak

Filesize
1019KB

MD5
ff4f966849b4107535e41d037d9144c7

SHA1
3a973857b061914e8905bda7e8f2bdafa384588e

SHA256
2dc26dee345271f4606650912b0b7b5df68f621f2920864e0e36c1d1b22459b1

SHA512
98772f266f9553f77f91b11dc4589ec8a0930554e9e0b381bbacd8d23ce794c04f6fe821388a6e87cb14cb59c7522c18c06b1af11fc177c7e40ef71242adcba7

Download Submit
C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\locales\ca.pak

Filesize
479KB

MD5
a0b45b122241cf0c11a081eefb9cb4c6

SHA1
91fd660a4688aaa70fee42e783b8b1863b4d11d7

SHA256
7d911cda51564500dd7a6de43a1e347869427c035b15fa25cad0526be9e055b1

SHA512
abcb3bcb96934189cdfd52528cd7c65ea870c9b997bf6349599b7064fe6f4bef0d34809f0f958e4d4e46486e7c0a41f86b5ed0a132bbf20743d41f3af64788b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\locales\es-419.pak

Filesize
473KB

MD5
c8f488b85c17431360e531aa507be979

SHA1
bea5d66bdcc05869a0389e051a9217fd49e48fcd

SHA256
536339d99dee6e8c01f018d4700ddd92ce063f765766a48073aeb256669680c1

SHA512
1d7f9f84a8d7c055bf705c71efaea817f1b9dedd5ba314fec6ce5324f578d3130b5541bb52fa55db9f6e46efa8e152d50199a61c7e2466844a4414df65d61c22

Download Submit
C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\locales\fi.pak

Filesize
14KB

MD5
62a32a5ce4bc31a6b55fd759c8ce90c7

SHA1
07b3e101eb32258e71e03e0ae29c7c7f2cd1db41

SHA256
b2b656257dede3f8e7d11b947c98132a8f4764009cb4bf9540fd47998d8b648d

SHA512
24e46e29bc3182b05dd398829f6154bd1a3ba7dffe654080e2bdd93e1dabc37852bb0d8fc0736b9e5513b95bc7c488a4aa21e516ee80dd37d13e317a9a8ca706

Download Submit
C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\locales\fil.pak

Filesize
14KB

MD5
f11750055fb895f3c2e9222cdba02ce9

SHA1
b843aead065dd90bbc1c66844a937a7adaec28b1

SHA256
1776ac538bb20da5dec1d91e0cb54bc46c23812c57f8b7c579bf81cb2234ad7f

SHA512
f6ea63fae3a4133b1ee9152ca871f0497f868cb97e39bcc4d229ea8843919e8e84fed8b2206c639372af5d00b884d3add5ad5775491a5d36ba5babfdb62c1243

Download Submit
C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\locales\fr.pak

Filesize
41KB

MD5
a87b8ac0e5c805bc0166895ad8843d63

SHA1
ff32ea1175dad9e2d024c32aba939e9728ff546c

SHA256
049ada1106153f7a38ff90e94cce55aa8e47991751273ce1045494a625f3636c

SHA512
5ed36ab57c5de2ffc372727eff6a07303ec7a3ca3fcdeb745895edf870aa04ad22905689fa352b3c4918211657c01e96603001b2404fa5c782af07f8f9bb911e

Download Submit
C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\locales\gu.pak

Filesize
42KB

MD5
e385b39eeffe7b015e2d19ec495f1d0d

SHA1
545651e3b419821d017c19e79e3e556fbffbb084

SHA256
3b8b4be3f27def3fc41410b549a68b01da2e1d4127e700404c4a8a2efe6f1cb2

SHA512
bc00d8c83217ab0530d47b3786e2a7c28c9aeb7a454110ee4644fededcdb9dc9a488d54b4c77efbfa12ef0be586678d93ffa1393d5004818f179db7243ebba0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\locales\he.pak

Filesize
42KB

MD5
4ddd11370aea7f6ed96eb8430e993ae7

SHA1
7585f1da8110a63087065ffe5623822f69d437d9

SHA256
6c6eaf071281ad51d3b20e181e828b8123dfedb5470749f6ef7c52d360f17189

SHA512
7d45d8f7a54e615021b7cc8fc8fd8a61d6d8670129fb2dd66433fa8ac09ee096f90ede3365a98ad2f0d46bf2f1d73e734bd4424718d2a651e7bb1d82d3942daa

Download Submit
C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\resources.pak

Filesize
576KB

MD5
d426dc932bb153e4c0804a910222509a

SHA1
88b679c7fada35d69b09f8f110e5c25a4f22ea4a

SHA256
e4f726ff3fa01d6bb39fbd052e16835563b2eb9f515388a0ee99e34b815c1d96

SHA512
fe5c7682d89ed2eff3c0402bfc8a8079cf94453b604ace9bd45cfc22896613577bf5bb66ec35549c875604d7754d45c8db52467c45b51ee289bd12c15c020bdf

Download Submit
C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\vk_swiftshader.dll

Filesize
1.8MB

MD5
7ac3ddba6d82e86427f8c4a24b2a2544

SHA1
a714cf3123ae80a89b8d2751c824bc537942c7e9

SHA256
eba1ccfeb030a69a7d147a380b967f837ed760ceb8bd2b7db5674480b24a6db2

SHA512
bed6411c551e91112a30b006947b215328cb73776ee3b391adc47f0e2c1fba2ea56ddd6f523fee38017ddb09bff221dc61a63ec65fa8ba5f1be58c8544ce6064

Download Submit
C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\vk_swiftshader.dll

Filesize
1.7MB

MD5
939d765057ef3973e9a266e80c2f3439

SHA1
2c4f7f3165f6bc53a71a10b639cc4737a00ab3b2

SHA256
d56022583613a343e10590584272e28d617500d085daff75cfbe35a7de1f7cad

SHA512
c824cc11364c9b1d915ad50437955754dbf2681c08526d8475d7c0704aee163499f521018817792733de4cbadd736a27fdfc374607529adb6bb7d89806d35c36

Download Submit
C:\Users\Admin\AppData\Local\Temp\3c8961bd-0a0b-4c9b-8b95-c6c1a657cd54.tmp.node

Filesize
154KB

MD5
56c465754297ae8b4a4991d094af1833

SHA1
0695ed545b27842df51fa32d7ad03f6db661afe1

SHA256
9a02d4912fcc6c9195276e200afe8cb64f9f271101f54e24bcfb5519f7bb1e73

SHA512
44a3057df23f63ee58134cd064cdae0c3d4045787f5a589321346711a8778105407364595a6af984f2c82da974965ae1d29586176b70bcf634d55cd213c74509

Download Submit
C:\Users\Admin\AppData\Local\Temp\6b0953e3-4b9f-4d74-bccb-d66f66c6eb01.tmp.node

Filesize
896KB

MD5
2973a1d585418eef660b58b8efdc2e8a

SHA1
b0bad247c607389c9501e6c013b7516241416d16

SHA256
fef7f2c3f09031c6d2dd3cec11b0f63eaa15720350e20f8efdba9eae969a6aeb

SHA512
3bb59d678f4ef0b7addb162e589b4baf9e53c94f5656b8b78d9dfcc8fc19ea0ba4a392503c5b19b94a12c13a9a7d8418a2c5b6678d1b30c1759b073ff39f378e

Download Submit
C:\Users\Admin\AppData\Local\Temp\86634efd-07a9-4a7c-b4d9-65fcb4097941.tmp.node

Filesize
1.4MB

MD5
56192831a7f808874207ba593f464415

SHA1
e0c18c72a62692d856da1f8988b0bc9c8088d2aa

SHA256
6aa8763714aa5199a4065259af792292c2a7d6a2c381aa27007255421e5c9d8c

SHA512
c82aa1ef569c232b4b4f98a3789f2390e5f7bf5cc7e73d199fe23a3f636817edfdc2fb49ce7f69169c028a9dd5ab9f63e8f64964bb22424fc08db71e85054a33

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mdqdlupg.r5w.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr9E84.tmp\app-64.7z

Filesize
2.8MB

MD5
84cd406b18495aebe57dcccf0076d9fb

SHA1
ca30cae742b419807ea257838c0f27cf0a768fbd

SHA256
9eda799faa7057c02e9dc0751c7466064476c505e5fb482bd47dd11f67739138

SHA512
f8ac161a76c85608f5146d73a5d3524b425d729c006dae997daf647b9940029c95eabf91301ac1c974f0d98ce64eb4651c45e4faaa741e5c79f653d0b2af565b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nszA772.tmp\7z-out\LICENSE.electron.txt

Filesize
1KB

MD5
4d42118d35941e0f664dddbd83f633c5

SHA1
2b21ec5f20fe961d15f2b58efb1368e66d202e5c

SHA256
5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d

SHA512
3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63

Download Submit
C:\Users\Admin\AppData\Local\Temp\nszA772.tmp\7z-out\LICENSES.chromium.html

Filesize
2.4MB

MD5
6ee1e3e743a025100adf4c871e6118e9

SHA1
a23ce23aef7ee8f0d63e26744f3b4c7ac8dfedc0

SHA256
17c78c397609f0825f2d9c2830f2de4257b0abf8a4a798bb653355b38d320217

SHA512
ca887f4cffa3fbbaba179f9d11c78863fff1da6daef0f8f1dd8ac4afa2c31165179d2c30ab81eb7cbe101b080351262b78576d5ada7f2e4b9b56bb4c64543b6e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nszA772.tmp\7z-out\System.exe

Filesize
1.2MB

MD5
a29856e0d655a1c7ba9b4ee51b5c1956

SHA1
05293b8a54d484ace4a0031a6c561e2c193dd27e

SHA256
50604b925770d5f96a71141bacca5d3abdfc8fd866af1bf293ff17c245028a8b

SHA512
385ec1d2d07765ca0ae9b991c6181aabe7668f214a8ee518847152574b844d94cedfff72b05d8d72d867a1d8cd2dbe9344b202b4454673c419b91f2a8789e9f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nszA772.tmp\7z-out\chrome_200_percent.pak

Filesize
191KB

MD5
99b95d59d6817b46e9572e3354c97317

SHA1
6809db4ca8e10edd316261a3490d5fc657372c12

SHA256
55d873a9f3ac69bbf6eb6940443df8331ebd7aa57138681d615f3b89902447e7

SHA512
3071cfeb74d5058c4b7c01bfe3c6717d9bb426f3354c4d8a35bd3e16e15cde2f2c48238cb6382b0703b1cc257d87fcecfb84fbf4f597f58e64463ceede4366dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\nszA772.tmp\7z-out\d3dcompiler_47.dll

Filesize
4.6MB

MD5
a714f9784e003bb44b789d1f544d42a9

SHA1
aedde0afa790c626a5a4247a8431b68e5be6602a

SHA256
d4f1d216845a1b11a56a0f9822b02cabc91d825f5def7ccf8e11540062a73caf

SHA512
ea5a4ceef6af0258025303a303b3c167e0ed8ea3724c503e80dfc123846a8b6228849e900ba80f68a65e8791da2c34ca754b0c5dad3dda0421ce39a281be17d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nszA772.tmp\7z-out\ffmpeg.dll

Filesize
2.7MB

MD5
88f6f9d61966ae8b7551b0551a64700b

SHA1
c88dd63397ae431c240570e867b0496a548fed84

SHA256
3eadbb2e0b7cbfbaeea4b89cea57ad05ed7e0d2e2196c3b2e6225a6f99ba9755

SHA512
9666ce9457fb3a9a98666f1cd9c18c5c7eed5baa506a8e9fe262fba714269c7c208dbe12015f248116b60aeab4c3f8260b9ed73f90e71b85bdd972ff27c5f078

Download Submit
C:\Users\Admin\AppData\Local\Temp\nszA772.tmp\7z-out\icudtl.dat

Filesize
4.1MB

MD5
2394e50a211366f71815d59a7512a723

SHA1
371d9ec522a46b3a59a94beae4233f90983dfde7

SHA256
d045f186cd29d502190729a3320a5c5b3ac7b423ddd16fd639ce1dcb842645a9

SHA512
9821976a8f62cb8448c9712bed46feef0397bd21d23d2381535695b2b98a8cc98fa3c604a2391e73317dc0dca38bf0fb8182f35eb55ef280588ebad4dd4620cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\nszA772.tmp\7z-out\libEGL.dll

Filesize
469KB

MD5
83ac3fb31b419b68e20b120077a8a623

SHA1
c9fce6914cd0901ca55bf7db6935ff5313ce1f98

SHA256
c359cf4f88472a3a79313949f15904731de53e18867b155b95105d4ef9d3420c

SHA512
a2937ead5e41ff0f68308fa26335c28ae85d22f53963918661b5882068969adae73341be75b15942c6577967667cab990690c6e4514f9ebeb92a4395ca40f1eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\nszA772.tmp\7z-out\libGLESv2.dll

Filesize
2.6MB

MD5
54e83991fe52cb8c40370293cb05355f

SHA1
0341ea762895596a74ba31f41b412e1727b19c09

SHA256
927baf8c073411d226e5138a498b9f8e41591bc0ddd18f1a78cbdff5398fb231

SHA512
745ab9db4337d34be91b95484569ad3768bd227a6c8b1a7728c572bb86acaa9ca8f5ae9aeead0b55ba33c62ef1f963b9fa8d611c4b6596cd1810885375d9f535

Download Submit
C:\Users\Admin\AppData\Local\Temp\nszA772.tmp\7z-out\locales\af.pak

Filesize
425KB

MD5
d16ef573959cf5cf0a6eea20136b9c0b

SHA1
e3384ae3ee92e1dae47a48e45589372e940aab33

SHA256
73a8401e6dc17c4daf86b42c65b81359348f7e6b4d62d8637138e747bb3ff0ae

SHA512
064c2912f766f10ec042adf82709ac9582cb8430e3550690fc17343c380dcbabadc0084e08aa5f3eb6faf79a652d26e1fe2606625a180b7f47808df07a566933

Download Submit
C:\Users\Admin\AppData\Local\Temp\nszA772.tmp\7z-out\locales\am.pak

Filesize
577KB

MD5
dd06a86f63fe361da3a55f236aa73b58

SHA1
b62953b8afd25ae946d43ea9a6889c18851b91c1

SHA256
a4639eaa67a923aed125a24080c51c1d3fdff65f1705ff4a3011096ca83503b1

SHA512
9ce6ee0ecccab8c029d2c7f9cb381df86874c51b8f69663a2348dc915ce6c4d98741083dd609b51267cc6425e0e1aededaecb637481f3a8a2e9ba36b51d4c0f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\nszA772.tmp\7z-out\locales\ar.pak

Filesize
577KB

MD5
cfa58a4ba04eb67d5a122ebd64477f7f

SHA1
43cde74ccb54b6fc9d4973adf49850aa28f03b31

SHA256
14d68c5cb6053b6fb70c5a0c77f6854b7ee1717f3e12b9e17b33c65324a5b4ac

SHA512
d8e19b3ca605c7a22ccddefe1b6dac252a74f55be8ea5895fd0b559eaaaf29cbb7ad471e4ba23b7e510913c24525d70d5686ef0ea960090ca595d9a894227164

Download Submit
C:\Users\Admin\AppData\Local\Temp\nszA772.tmp\7z-out\locales\bg.pak

Filesize
576KB

MD5
c7d4fc168a19734bf2764f06b21568d0

SHA1
eed0cd7240e09d0a1d0350c1a49904372fa503a8

SHA256
d1ff8517b9bf47573e5911cf12679edbb294f63dc740e3f5b0303667f23e8cc6

SHA512
e731c02874241e7373340cf328b8e51dbf599bb4b7e3e37628b786fdb0694c532b9850b5a5edb8b14207bd2413d3c6fd2bc32d60f49864b3e2dff698687908f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nszA772.tmp\7z-out\locales\bn.pak

Filesize
385KB

MD5
2b56225f7dd50bb1944b2ad7fa0bc103

SHA1
fe0c09392eb7d5a24dbab9675e9d1986d7d7206c

SHA256
649a552349b387717e4006a943b2cc38f73273938da77e4c40ca152a3f3dc4a2

SHA512
0cef0cab315331f66dd7d8b8d4ab924562b2502a39a5512809787e95cef02b1e108c80cf0e4d2c76fdea28d656d5e14dce895cb821321fa3bef8767327909dfa

Download Submit
C:\Users\Admin\AppData\Local\Temp\nszA772.tmp\7z-out\locales\ca.pak

Filesize
385KB

MD5
bd474d1852fbf094a4959ad8ca8182b6

SHA1
8a176eef12fe48b56f1a8935190bf517b10c8b5e

SHA256
fa1909593a62fb43bb7b38a234064fd1b5f77695056402d438aab65ef74a9426

SHA512
8f2f446954961b0a949a0f6533019e3ee03edbb51fd70c47765f82937bb34208e00fdd0636191c9b20703e8543cbda0c31e8ab3471cfdf8d851c37f9094fa42d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nszA772.tmp\7z-out\locales\cs.pak

Filesize
494KB

MD5
1101c784521a550b0561b363722086de

SHA1
838f2bfe3432b87b950a2ec5d9862d2f58fde3e5

SHA256
cc6ff937d1c9fec4634db4e2f6c0718d2606fe2d5d25addf1314e110c5b78772

SHA512
eca3ce2075d3c920116c9e34957631e0617a869467bb76b09873ae96f7803f20032a6dd0a0f785f9e59dcfce3a4ccecdab2d445a860bee20d42e140b45e74089

Download Submit
C:\Users\Admin\AppData\Local\Temp\nszA772.tmp\7z-out\locales\da.pak

Filesize
446KB

MD5
5b033c206820ace5eb4c6f82aed34a5d

SHA1
28017cfc13259273022059f02564ffc99dcd75a4

SHA256
1a51de04cb205c708520f1b013447f1a89f0b1330dbce6d1e71cf355319d1108

SHA512
e423069f7a895179ea17be5774284e9e2e27f02c40bac7d7211cab77348800622796f04c3e6618905364e189ca5ec772ed7dbd285872777d163d3ebec08a64d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nszA772.tmp\7z-out\locales\de.pak

Filesize
477KB

MD5
7ccdc41a3dbdf89058d71629225664ae

SHA1
e15c35b18685d9573349ff4247733b5f5ada8717

SHA256
163ea4c2cf67edd0526a8e18d3810872e92a1d4e17b5cf4f04107fda5967b0c9

SHA512
13b20b0db02a0a7480c56c79304ef594353507e1a30da0130b73aa8e9ec7636f306315a6f40729b10dc725f936642d2e2b282ed3040a079a6f25a7f9f7f1ae28

Download Submit
C:\Users\Admin\AppData\Local\Temp\nszA772.tmp\7z-out\locales\el.pak

Filesize
865KB

MD5
2b391b2b35f7e096f696faf5dc093366

SHA1
1409134a46fcb84457a0e332edde98f7666246bd

SHA256
f1fe39af50f4bfe9edcea3af6c132e87d464d7277fb491ed95d7189b3157d20d

SHA512
aa640ca41dc9d4f60392b61bbead215345abd32369b0de90ed1d7ca2ff7a838d04689d538789a1adc0324fe4539c34db26b6c245155e51fb0308af13b60bfdae

Download Submit
C:\Users\Admin\AppData\Local\Temp\nszA772.tmp\7z-out\locales\en-GB.pak

Filesize
389KB

MD5
745918a5a74c7b6f4818a8bb8813f456

SHA1
031f50286d003844425ddac557e13e2ea4554bc2

SHA256
91bdbf5f1f6bcbcaf16e47865f72ec97d72c74174fb929f089d14c00989f91f4

SHA512
5a1eb0231352705bab527ab27543612d75cb00c522620828ce2a0fdb0b47be9daa2dd7a192f8b4bf299007c5af1d9515f900b9586ba44dd2bd9f4cd4436aa681

Download Submit
C:\Users\Admin\AppData\Local\Temp\nszA772.tmp\7z-out\locales\en-US.pak

Filesize
391KB

MD5
c9c2abcb04e1ad5f1a20244da8d595a8

SHA1
89ca81da21900074a5ccdcdc852768277b2b620b

SHA256
0364c73f320e441b03cb2afcaaca3ffbfac51a3559dcd0ff99a1accf82c7f762

SHA512
96bbf21174f56a111a2fc6ec024ab2f143945306797e77d773367a7fad42b7828ebb7b08d0dab76858d9fa340bf3205be403bc53df9e5e4e390058c94a751ffd

Download Submit
C:\Users\Admin\AppData\Local\Temp\nszA772.tmp\7z-out\locales\es.pak

Filesize
473KB

MD5
29cbdcc2168f1bb29532122c39e67a1a

SHA1
f086c79d60daf2b0a7df91916387efa461795dcb

SHA256
232f41ab5996c917687276e82c177de208b36e77aa834bb5d94d6a331f4180fe

SHA512
b603edf2a18f5893ab482b0c34e4126f824fbdd1b669927d7bc30d68e2e5bdf78d7d4b2aabdbe257987e8e19f440d9396a3683340b94c3fd844c70e34e93d8a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nszA772.tmp\7z-out\locales\et.pak

Filesize
428KB

MD5
5b169234895d929930140b4869a0b81a

SHA1
f58ba50d1e19ce191a0f8117f3e70f7f3dcb7362

SHA256
c465da80b14981bdbc687b7c37bf70d2bd4b8e03293c04ae5410f84c91ef980e

SHA512
c4297e272b5c04a0ee0956b873d5246591bee98c3b340e72202f3448381c691096a5bc540fdbcf61fb40d6a69270afa7198c1f0ccf3b2e84cabc906e23eb022c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nszA772.tmp\7z-out\locales\fa.pak

Filesize
703KB

MD5
f7da0d07b54698bf8a213d0ccf1942c0

SHA1
d64fff18274ebe71a4aaa4754f9bb99d616fa000

SHA256
33bdd6eb52f648d475306f35b6103500b864672cbf39cc0fbd8c4ac84c997dec

SHA512
ce7a7b3df4c814a26e3fd9fddafc01ac1a4b2a87ef2d2893db5d0edf8e5b8bfe34afb6e91ff94306248361d57c6b3bd63d116635fb756aab74c4aed38f31c88f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nszA772.tmp\7z-out\locales\fi.pak

Filesize
438KB

MD5
1cbfa553a5b1de642ea4c248dfe1edba

SHA1
5de05b3c11fdd59ff5064a153a6dcbda33350971

SHA256
8f3e8ec0fbb471b45db65a77dc1013e3363f387d3d0c6a458c90f371907d0085

SHA512
ea3b99be7da893be8c3b228d1d3d7b644a1f5425b5380dc3e0ae0ba1bd29cf39dabe73819bcc4fa67f10a488f018e9fa2328995cb78f40ae8fdb66aa514188aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\nszA772.tmp\7z-out\locales\fil.pak

Filesize
495KB

MD5
8ce446cac9221f07f912be59534d86ec

SHA1
15cd1b902b26abbe665fed518575748483a9c3e4

SHA256
b6ce37b1aeb4ca17a7f78ebc8f97c2807f588dfc4ad3e0639005c626b5c9b939

SHA512
20be2b5c7e8fca897109b1dc8219931eaaa1c8296b1d26dcc7f9058168fef371d7955fb0f6c5693399b83fa81d27369efac8c3742059eea2333bd66d20b8d0d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nszA772.tmp\7z-out\locales\fr.pak

Filesize
513KB

MD5
a1de4ad3d9b7aa8f122ba00cb983e49c

SHA1
323d6e1b4ed75f9406bb8488d7ffc7e12fa96886

SHA256
a69f52162f6081a06f835ede10818218df6e211f00d0ef24561e6221f4696e61

SHA512
542f0818ea4517fdea929f3d4938f7de75e2a5e6d872607e548f87de7e9cd0737fab3f5e82ab7895f44e809279d81c490999ed055acbddafe84f85e60ce2e23b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nszA772.tmp\7z-out\locales\gu.pak

Filesize
996KB

MD5
02bfa1114fd5b75261c24d6c0e6441f7

SHA1
d48b80339405cb8c8ec7a19b688e8d544938c4c7

SHA256
bbb17268412fb3e13584ca4dc90a94f984177d3c97ee89af2a57324709f8ed1d

SHA512
751b91d381c882a5dc0c0ee6313cf3e7ef51b4d369330a169cf9625de99e6019233109e815fc474fae44d79235940ba2ce68af7033f4c4c994e2774bbd8105be

Download Submit
C:\Users\Admin\AppData\Local\Temp\nszA772.tmp\7z-out\locales\he.pak

Filesize
616KB

MD5
9fccb330d8b07ca54661407cf737d847

SHA1
2c6f52801b66aac7d08acb60d9736f9149e48ae5

SHA256
bb06d364a91b8641724254822b2eec5d0675e262a4cbf93b92494f601807dbef

SHA512
0cbf36643cc7b1d85dc7cb7825bc816a8538d0cc50b137dd27d5a9703324ae7ff271d38dc0cd6e4a99c6b391070690b90eb8ddb1cc511bc8d84d49a32d36c34c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nszA772.tmp\7z-out\locales\hi.pak

Filesize
704KB

MD5
2cd96ccbd8b59c87e8364c1d908b80e5

SHA1
2cdf1d7b10823137dea6470a0959773fb7fef48d

SHA256
03464ffaa9f501012763803c8e525e935eb2594f7d4645cf589c9a52a4dc90df

SHA512
fecb5e721cdf4f665464db5519aa0f2a7940d4bea7b8940b0c06d5e20b586cec0ef9a6dac443399594ac20a7f1fc7f1eb97628dbdb1cc9d7f5f6fafaa5db8a3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nszA772.tmp\7z-out\locales\hr.pak

Filesize
477KB

MD5
ef62a50cc098afcf3fab69c7502219e9

SHA1
db474cf332c90de660fc575ef897d5389b65784c

SHA256
07effa557c8bc822626c05a4d299296f88d3da0654248c326d796f7c2de3ec64

SHA512
7ae6f40c7bf404532df0bc2ffa449e0d99debc2b9816450ed0d015b1634dd96cd5650ab6af5a6d44d52d0e3c9c81836ee350210c4f8a13be6cc0cb796a630350

Download Submit
C:\Users\Admin\AppData\Local\Temp\nszA772.tmp\7z-out\locales\hu.pak

Filesize
513KB

MD5
51b14b96d1b9fa99ed849347a8954133

SHA1
5259b749576a9612e429a665dfc8bf47651c39ea

SHA256
70d4a0724a2e0e80ec047e7683eec7715c0fb5f88795cc97a63e4c2ee2237800

SHA512
b68d4bc792f29df210602a557d0b3333a95e30cd03a0a4cb5f537c9c51da9937119391f2a359c03fb874c1f540c23f44bef121e45f048f32b1db06d67a0bad1b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nszA772.tmp\7z-out\locales\id.pak

Filesize
421KB

MD5
3b5e08406059d1a76566e9a5d4c9b15a

SHA1
6bf45f2647e959ec1b545763180e8f29961ab3e1

SHA256
60409d8b785dd057e3495190b18e6d6d235d8313555341cba5f64327e3d8c3aa

SHA512
6c4150c064edf6ed0b83b216ce62134bbab12137e6b45749dad08d1d1734b3365309414900615137c6acdd12250add5c69a222daa7984a94ee850aaa55af1b8f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nszA772.tmp\7z-out\locales\it.pak

Filesize
466KB

MD5
4e7ab6a5d407bf4d3f96671d65e467f9

SHA1
67f43053ccd167f2ce6d945202f64df29ee1ac49

SHA256
20408c09d9447f44aa920f2529d231072db8bb9c0c8b8fafa2db733561eb6964

SHA512
bf493e1a1c0898f7a54f8a5278dc0ca345e9937efe269b1bd3a3bc90645d767070ec9c117df001f8c3b51b4a383c30f025daf79606ac1840fcc5878ad4c53624

Download Submit
C:\Users\Admin\AppData\Local\Temp\nszA772.tmp\7z-out\locales\ja.pak

Filesize
570KB

MD5
74e2430cf18db7ecae2a9b1feeb049b5

SHA1
362a5f3e4d8a79b9d0b041d62a8a5233e20fb208

SHA256
1a726c500b5b3efdbc7b9e6626765dcb8957005f9c072c09d1f517587d6b673a

SHA512
324d0ba770c09cccac4c59e0e0605846a4e18f32cc79f14fbd4e5b0172f439ef8dee538f686458b3a07e5e8b4528ef67aa5d339ae25f7c601c9a302caa7970f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nszA772.tmp\7z-out\locales\kn.pak

Filesize
1.1MB

MD5
56c5f63f439cc962b815bbc4f3f12c32

SHA1
c96248cafd869fef11bc37aefb1382d0f60a7855

SHA256
14b332541c2cce0835202372f8cc822aef30b3575b651c96219a88b8d1381648

SHA512
9210759d8e73266381fbf04280aad0bc5006f315ce3fca74fe304b3261af0ba399210f0b84620230d6aa0c667e60c0a6d9e67681fdfac401338e9331475bb7f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nszA772.tmp\7z-out\locales\ko.pak

Filesize
481KB

MD5
a9b446bb79b0e5d0b4af4f7243b1f3e2

SHA1
fcf962506b32b34a6315ed61acdece33df3dbf23

SHA256
507fc8d2a468456f2842b65a111fc0c74fe1f56d5f5ac0d6e743aef186b43b2f

SHA512
e7f281206bd481427a75b581f8b2a435eb8a29bd8b5586a8db78605b1c1bbc20dc1f4b2ff92d04c62fb509dc6e1e062d1d584c195e386c5c2ffda0f764276aa6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nszA772.tmp\7z-out\locales\lt.pak

Filesize
519KB

MD5
49201fae17b715a15fa03c4d89dd2176

SHA1
7c559c174850de48c4a2837fe32c58f74d8150b3

SHA256
4a80792cb9a401ebfa7ec3212182b5024d651ca6a5ead8fc9809d0d3ad4803cd

SHA512
3016f721d77206e13e275e7eea1adc95d403feaccf595eacf933940485031e9aac0c29b6f47a9ff5f73b08c354b7b82c72193c83e1ff09d84cb5b9b72b708166

Download Submit
C:\Users\Admin\AppData\Local\Temp\nszA772.tmp\7z-out\locales\lv.pak

Filesize
516KB

MD5
335158efe454819a0dc8de0edb0f0e90

SHA1
85871f85f626db1fc597ef24c79c84115a66c17e

SHA256
113073cf60ae3d2bcf8a61df655762e34ba28e4b35b97de33c18e13f959d76ff

SHA512
f81733bca3fa65c789630b55c4f414a8541e71c4e1aba56bdb9d231ce189677b3bff4dc57c92fbe1cbc88f1f2f7fbf1a7e4319a8918c50409fcba958d743ccbc

Download Submit
C:\Users\Admin\AppData\Local\Temp\nszA772.tmp\7z-out\locales\ml.pak

Filesize
1.2MB

MD5
1030c08ffbbe7366ce5b7d55bc8ecc0f

SHA1
b45b53c1e47a0051560c607874357130c499563d

SHA256
e1f97ce3011d9231f23fe033bdbb0905c173921b18402d362bfc35224ff67db7

SHA512
3b9127a0eec02f75f79c66f5f7845b65c4ebe2e6a33989c7686815ffe0651be47d42f55c2f32a67a221495a8bebf043d853df7b244a68f89390044210e52dd3d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nszA772.tmp\7z-out\locales\mr.pak

Filesize
976KB

MD5
eafb18d633064d0f02a3eff3eff9aadd

SHA1
a8846e473014be80125630f1c5b51366220ff018

SHA256
fcb7c4aeed28ae4d16fa7b82d9571165aab0fdd46eb65d3ab29007231630ccef

SHA512
d332a4b7f4cb1583a5bf5ce08fdb46661a5bccbf0a66f7f5ab6ce04367e9bc589588dcb32f443695a3ab129dc50d2962ed4c138f97858639d4ea37c117e23495

Download Submit
C:\Users\Admin\AppData\Local\Temp\nszA772.tmp\7z-out\locales\ms.pak

Filesize
442KB

MD5
3d0dc94a638f98d9bf3c0f60f89a0c95

SHA1
a979b04c65832d908305fb0406cb0653271ad744

SHA256
a9f9ae23a3bc2ac919c5b46d16b7e1f3bff73698d2626260196210e101d119c2

SHA512
6d687f1eb9a7fda3791295487063393b8f0a7409b55461b185aaf106c596229de6988114230625d6504b869d25d7a624bc3b90d66a0bdf561cb05a57d5b87c15

Download Submit
C:\Users\Admin\AppData\Local\Temp\nszA772.tmp\7z-out\locales\nb.pak

Filesize
431KB

MD5
9c18dfa9e69c1d7810132800d084136c

SHA1
bbaa9576e1b012df33d79a5dc7776c00e67295e4

SHA256
4f3babcbec0d138654ec59fd8ab5fd58da2273237a587928b9687928c7ca10ff

SHA512
a82b1e340a25a3858906ded73624bd0be4b3ccd1f5728560480b4a4e3a78529f5a178d20cf7d95fd55ded7ca4fa95a5fff87d89f0520ea08b54e7b99c9057d6b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nszA772.tmp\7z-out\locales\nl.pak

Filesize
320KB

MD5
ef9e3e8a067b03adabf1e6a7ed952e3a

SHA1
8f13cfb86399c9f7e04a5731b1ee034b492819ca

SHA256
06475991435b973bdb2a1eff3b43f1a25beeb3e7644fdd7c023a66a79edc6ccc

SHA512
c556482b5f3bc06db4ec37050dbaf28cee71919d415fb4f92592c5e01da78c733ef1665739a8c550eda13cbc02f804128fceee271f4e70c9db3417e0dc0d9238

Download Submit
C:\Users\Admin\AppData\Local\Temp\nszA772.tmp\7z-out\locales\pl.pak

Filesize
320KB

MD5
1c25a729e9eef8893f44d8bbec64f433

SHA1
0ea85608b1e6df899aaf3df8e552d62e2e75e8c2

SHA256
7fc016cb3102d8a0711c94fd996ceda04a55ccb14ad49bfad76172134f227edc

SHA512
c22cdba971acd61be5720e9fc1822d8348eeaeb19bd71d850bc56249216f1eebd45d6d65581630a029b17ac3773d1cd1a95e83bb99b005f729ebdf2ca6aa4a3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nszA772.tmp\7z-out\locales\pt-BR.pak

Filesize
256KB

MD5
9cefc45cdc454465d67f09227b3afce2

SHA1
f0f847f4b16917f534e56bb338fd9235f220866a

SHA256
79f4407c2b43e64e1754fbb76bd23c570ab56e105c463caf0cf0934d6104132b

SHA512
ae5ccb6fd67103a82fa786177b030ee6e3d2b8647ec3c8e049922dab3c78beac2f6b684286d948fa57289f7fc1d02cf07bb92d0cf1e300ae74fa4f79dced77c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\nszA772.tmp\7z-out\locales\pt-PT.pak

Filesize
320KB

MD5
ee010577e2133cb2f7d8d05ae3dc5271

SHA1
931d98ad4e6896cc2e7b0a9373ce31fba0e11753

SHA256
2332be54703260409ced5621dcf6030919873a4ef7f979eae3a81baaeafd34ea

SHA512
d595612b3b75b0846002ca84804a6a0242d8f7a03c9dee69fb5d53bbfb5a9977714d2acbeeb07c736451fa89039d8165992cbe53fda1e1bb7a2ce7bc96e9b0f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nszA772.tmp\7z-out\locales\ro.pak

Filesize
256KB

MD5
3737a02a09c4d5bd1136cc746e0eaf56

SHA1
6937e41471da73e098a6c6c1aea7a0419af7f7fb

SHA256
9fc258412a7c2de7b8af09fd56142d36b31a7b5e275678fd2ea6539998c50191

SHA512
5c2fb0153cc01cc22c42e6a47dd894d32698137e438b528f75dcaad1c4e59c00e4741122f01e956337b8412c9bfe88f1e1dc4b805bb3e730294db5fdef2a632b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nszA772.tmp\7z-out\locales\ru.pak

Filesize
192KB

MD5
1d20a0e551993afb16dfa0a327de54bb

SHA1
1656db325c1faf4b137b02c14834432ecb76700d

SHA256
c81d48aa810e8816b423106195d6fbf94a430364bf0a60fe3d74840138cabb4a

SHA512
e516e5b097d6b949b6c10abc86f15361ff687330fabadeca670b464ae993924de6a747355ee5ed7f13e9e419d0819a6997b15094ff9cc5b9a1e65ed664ec54ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\nszA772.tmp\7z-out\locales\sk.pak

Filesize
256KB

MD5
98244e65eaaa39cd141c41e0cffb9840

SHA1
f3e64586c1feed829c179007665d502c8886c70f

SHA256
c5587d15d01377cd736045d716e424fec215eab99b081259a6d1bdaf56407b54

SHA512
e896848d87e0073d5dafe5e4ec31aa1f719bf8ad7611acc4afa6a75ec122e4a65dd1972d36d73a193c484f4012bdf0fe15fb740625fa406a7f7954cb470cc4b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nszA772.tmp\7z-out\locales\sl.pak

Filesize
483KB

MD5
e76e473c419c25768b08a95a2822918f

SHA1
0fa7e2fcabb03a8788f50f1d4b4eb383c833e9ba

SHA256
fcd27a9f5cb4b4be373da7076a8232006ebe020999fdf90d20745f16cd7ef223

SHA512
e39ae0acbb7d148d6ade676d92e83fa9fb433230bae4339c31693a538198bf0679adef51883b96f8dfbcc8593a982544c64a2b265897f35a693183b27070ea5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nszA772.tmp\7z-out\locales\sr.pak

Filesize
128KB

MD5
928f08a11741d479bd1c0795e2372294

SHA1
28cabce77a95cb6fe14bf3e4030a6a1e185facc4

SHA256
e1f14c9b968612e4008094a8d91443af24be542454fb1b3df253d04b06527515

SHA512
0a10b3b542a6e60c9fc947e5e52c60f1515ef68d9ec867d89246a4dd3822a22f46d862e7395487e4c3096808ab92379204b2e35834eddf89c983407292611901

Download Submit
C:\Users\Admin\AppData\Local\Temp\nszA772.tmp\7z-out\locales\sv.pak

Filesize
433KB

MD5
06c878c1538813e5938d087770058b44

SHA1
c8ab9b516b8470bdee86483151ae76368646bffc

SHA256
90dc45426bc1302aa05261f136881ddf038272e9ac315297aa8e5dae2b31109b

SHA512
6ddf615bcf0a8c62221233687bae1eeda5cfd749aa8acc179d6650987289201b405edd453fc181a1d250eba9bbdf61ea28fb7c694539fae3d320bfdea56665cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\nszA772.tmp\7z-out\locales\sw.pak

Filesize
456KB

MD5
55241312a3aaba14a6b19a9012ca25b8

SHA1
69fadf0817faec3bc6b018f0af5f63378ade0939

SHA256
722c86bd857a93ae06ca0b7cfe2cc04237a7ed5a52586cab7246336c802abe37

SHA512
612f815c25e9f593d1f1c4de8e9016dce048cfe90f21319c4cdbb5772580cb8c71229e9ddba60852cd0bec80a07a783ace24f873d90dc3323e5fdcc44905f2c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nszA772.tmp\7z-out\locales\ta.pak

Filesize
1.2MB

MD5
2c0a9cc4a7c775ff13a6888234265cab

SHA1
497bde42737667fc833bbb9d8a9edaf014d99957

SHA256
1dd55659ef21082b9d58bed50f387c0e1fc0f28d0ede52251b9ada25ed2a657f

SHA512
b862221cf17d3f2ca0495a8a3e1f630ab915fd9b2a46ac16c71deffee9a6f71264a8550233781474d60cc6001a48c7c658c77d4e0dbd5b543e768928119d2f0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nszA772.tmp\7z-out\locales\te.pak

Filesize
1.1MB

MD5
5f9b7a945638b88e75a3175a7923119d

SHA1
6af614f2cbd72da2224f48a203a6430a623fc7ed

SHA256
3b476d2ce7c72c3a10170808020dc3f1a87309f9f725b08217c4716b28d10888

SHA512
3b66c9152ec032d6f2372ae5075cbfe7d0fb398c4bf173a7f8c76d91d9eaa816e6f839b90884533b46a9224e9fb52c4d439b3d1907885b8e9f80c5c55a852b65

Download Submit
C:\Users\Admin\AppData\Local\Temp\nszA772.tmp\7z-out\locales\th.pak

Filesize
918KB

MD5
84ad3f888c0ec307bb7b8c278cd36757

SHA1
948a5f8b43d059280d5374ca6d66e8dfc6a76d49

SHA256
56665860fe6577fbe00543a47a15e10eceae83458815f2989d179e42af07f81b

SHA512
7001c0607df927145e40a605e2b97914d02712d11e09ca20339cb1aefb042a1f853fd06e78b76f6dc6f19b6df837bca12946a3470c6c064ca767af1db57042e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nszA772.tmp\7z-out\locales\tr.pak

Filesize
42KB

MD5
ff626b19011ad2900feb6e7ea6e786c5

SHA1
7bf626b0a8c0086c96349607635f0e923713e8b8

SHA256
130d4641090672800ce120bfbd4bb3b79a8ba5f6727ddfaa708d0afbe16eb555

SHA512
6ce1154586de986453bbb85359f92d137aeb7ef943bea7afdaaefe142cd1e333000f6e50789db6b438c30bb4555b4005c6114e46993465b5b17c79a1fcccbb6a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nszA772.tmp\7z-out\locales\uk.pak

Filesize
798KB

MD5
64aa9344abd9a32f10d6c05a58eda4eb

SHA1
3286ee43f36e2232677b4573e8b4a3303c7df048

SHA256
ca20af5982ae706f5029467901d7d66f90b261f03c7d240d0d1ab2fca2b50a7b

SHA512
dd768b314da50b8ba5a006a4e56d70044c1af79960834722894d930f5347194ae7f9f5697bc4cd0790a79341635cb1df8c74ff45f74d1736049161af5b163efb

Download Submit
C:\Users\Admin\AppData\Local\Temp\nszA772.tmp\7z-out\locales\ur.pak

Filesize
696KB

MD5
88eef2798dee8a361c3ea9bafaa02a35

SHA1
6f8d4ce422336ca5048ef35d6ece360a9b416d8a

SHA256
91318006c880e427417a2b2fff81fd451769a5536fa16d1dc185972137bc2d6a

SHA512
db36b58186f165ff3f746ac483f75b6fed596fad9b3f335e86b374b359e563407acf58ac7cded9420e4fcb91f31eebc8a91c7777ea59bafced8cff2f1c0e9a53

Download Submit
C:\Users\Admin\AppData\Local\Temp\nszA772.tmp\7z-out\locales\vi.pak

Filesize
551KB

MD5
4c5c09cb7e6eb120c8019fe94e1ac716

SHA1
f018e7f095605e21db24944b828cc3580cba863f

SHA256
e7319ca18eba379772954132493bbabb448d4e97d755b85360ed337216b48800

SHA512
d171ee83cf02a8904290a74df1224556887e41333b8a01fbd95f0cacc88d230195fbfb6f99f9e02573d4864b3c95b570a77c2a0b1e19324d2599925e40684807

Download Submit
C:\Users\Admin\AppData\Local\Temp\nszA772.tmp\7z-out\locales\zh-CN.pak

Filesize
398KB

MD5
07b6c43d87dbf93ac8abe6837f3c2103

SHA1
79e033179b445609b3f1756c3f4184d5efacf1c2

SHA256
7f85b35938fadca91bfd8f92ca53613718e375ef010c340947dd27a4ff66594c

SHA512
38ef8f8a8a950b11c18eb7a40da721b888ef792a49e1371dc8c1eb22058a6791f95bf9b25df4ba190a7aa6cb62ce38b0bfaea83c71b62cde6980d12cf9da53f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nszA772.tmp\7z-out\locales\zh-TW.pak

Filesize
14KB

MD5
488124aa9ef83f6f47140ed6d1d7ff57

SHA1
0f2e604cc23f708facac44d3096754c8140ac37e

SHA256
b8dbadccb66a2f0e7e5336615722158d397be80c8a89a6252149b79c9c96b605

SHA512
e259bd28b3f04dd2d33f9089dc481807d91a7bc546c62bfef6869981fe81ea168f7cc338c17d1f82dd137d2608d27d73b88b5c22d389c6bfede9881758243b2f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nszA772.tmp\7z-out\resources.pak

Filesize
1.8MB

MD5
59a245a242a75fa54e2a2dd673ec7113

SHA1
8f17e6e95e8dfc6c7f305a0237d029b377787270

SHA256
287fa2f0217a256ec49fd1e7e5c9eb2ffea500d87f9c29036429e6017cf26140

SHA512
53dacb01bb4dfa806547b0a7dccd2f2b50d4b979dd6f4bbb26cecc1348e2c59c3fd59c027f0b2290c14f089514339f1cc4973ead84e9fbef13416fcea8802469

Download Submit
C:\Users\Admin\AppData\Local\Temp\nszA772.tmp\7z-out\resources\app.asar

Filesize
3.8MB

MD5
5b02d952dd3dc404cca026ddcbfa8039

SHA1
4a1cc10829c4fe793c5bab87345ea8c61a7f002f

SHA256
75e06017fb89a6330c6ea9eed0f03f475e482d4def21fb6982802d26e6f12ff6

SHA512
8a05b231b2287517d0721c3ece0c5b30a41f6a18b7e42decc48aee4eed9fcfca67bcd435cbedf6c5d72549394f4fc823970a5c2062d078ef8a8ef4ed97a53d86

Download Submit
C:\Users\Admin\AppData\Local\Temp\nszA772.tmp\7z-out\resources\elevate.exe

Filesize
105KB

MD5
792b92c8ad13c46f27c7ced0810694df

SHA1
d8d449b92de20a57df722df46435ba4553ecc802

SHA256
9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37

SHA512
6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40

Download Submit
C:\Users\Admin\AppData\Local\Temp\nszA772.tmp\7z-out\snapshot_blob.bin

Filesize
262KB

MD5
40a3c2200e4126e8c47a7802532c9236

SHA1
212a4686dea5a467b7b6fa54397e42122b235f1e

SHA256
94aa518fc892ee9a0f1eb5fe35b60123ee61a5f848864b00519b96d8d5d9786d

SHA512
fa1a943822abe3737587d520654078117cae86c58fefe6dd6a09f4a08c09293e9547a0ad79c52f8638dfbb1c496df3d0e828ce414176c8fbb77113be41212866

Download Submit
C:\Users\Admin\AppData\Local\Temp\nszA772.tmp\7z-out\v8_context_snapshot.bin

Filesize
581KB

MD5
264e3b574e4f86b1fc47b2427402e779

SHA1
4a4f9e7c3da262713e4cf7af6ac51822c56b5ef3

SHA256
ed559c6e81b6003b2057e5c1b0bdb5b28ca094b895ca86c69fe11c5c9e014f06

SHA512
144365d0fb83576aaa02ea6ecea51d7ba2cacb044eea568a08f65b98a83d3e7d7e693738e065e22f94bfd1165d0ea93a749dd1325d829257a9bb6607a9a927db

Download Submit
C:\Users\Admin\AppData\Local\Temp\nszA772.tmp\7z-out\vk_swiftshader.dll

Filesize
1.2MB

MD5
f29bda2d1a91a26c8c6a2feb82cdfafd

SHA1
daae94b330f566a57414067aa3fe4bc5946792a8

SHA256
12c0255f5eef84ad9ab4f4628f82dc44c486295a4d1220496d66b3dc79655a4d

SHA512
2d8f62fc8403b4cd327f8cf1740bfd721be2aba30bf5aef412a4b0fb3ae92bb00bc968017021369a12846b17141007c782867de46d76bcdb2e3a3d3ba89fcefb

Download Submit
C:\Users\Admin\AppData\Local\Temp\nszA772.tmp\7z-out\vk_swiftshader_icd.json

Filesize
106B

MD5
8642dd3a87e2de6e991fae08458e302b

SHA1
9c06735c31cec00600fd763a92f8112d085bd12a

SHA256
32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9

SHA512
f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nszA772.tmp\7z-out\vulkan-1.dll

Filesize
917KB

MD5
efec2cf9ea038da005cbf1f1887a8207

SHA1
a64f9d2da2c480eccbee21ab6a6401770a965dfd

SHA256
2006ce9d935cf037bb9b8332cd74016c88c96cc727c2e9337eaeea91f8aee5a7

SHA512
ab0d15c34154f0813c993b707871d8e1881975c17c5a2eab3f0ea6492dc9f7eef621786c399d6d7bdaaff91cd09ef6520d6d42d773787ef8dc75c2d9a75b372d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nszA772.tmp\StdUtils.dll

Filesize
100KB

MD5
c6a6e03f77c313b267498515488c5740

SHA1
3d49fc2784b9450962ed6b82b46e9c3c957d7c15

SHA256
b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e

SHA512
9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

Download Submit
C:\Users\Admin\AppData\Local\Temp\nszA772.tmp\System.dll

Filesize
12KB

MD5
0d7ad4f45dc6f5aa87f606d0331c6901

SHA1
48df0911f0484cbe2a8cdd5362140b63c41ee457

SHA256
3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

SHA512
c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nszA772.tmp\nsis7z.dll

Filesize
424KB

MD5
80e44ce4895304c6a3a831310fbf8cd0

SHA1
36bd49ae21c460be5753a904b4501f1abca53508

SHA256
b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592

SHA512
c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df

Download Submit
C:\Users\Admin\Downloads\Neverlose_Free.zip

Filesize
16.9MB

MD5
a948b80de8e4456bf09f185603985fda

SHA1
d2c344d7ea9c2405e5cb9b7f8a92045f87aa7980

SHA256
e9e1a9037d9c48d687d517d0ec6ba1194eb86a0d5339d6ba9fd71f4df6e217aa

SHA512
05691736e327588648acd010b7182fabc7723b9eb5a9425683737bca19d20b78f9dc1cb3583adbc74aed5b083ca1d065002c7d60003e6343000c24fe7a943323

Download Submit
C:\Users\Admin\Downloads\Neverlose_Free.zip:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
memory/6448-2068-0x000001888CB40000-0x000001888CB50000-memory.dmp

Filesize
64KB

Download
memory/6448-2081-0x00007FF9D0110000-0x00007FF9D0BD2000-memory.dmp

Filesize
10.8MB

Download
memory/6448-2067-0x00007FF9D0110000-0x00007FF9D0BD2000-memory.dmp

Filesize
10.8MB

Download
memory/8208-2065-0x00007FF9D0110000-0x00007FF9D0BD2000-memory.dmp

Filesize
10.8MB

Download
memory/8208-2062-0x000001FE30040000-0x000001FE30050000-memory.dmp

Filesize
64KB

Download
memory/8208-2061-0x000001FE30040000-0x000001FE30050000-memory.dmp

Filesize
64KB

Download
memory/8208-2052-0x00007FF9D0110000-0x00007FF9D0BD2000-memory.dmp

Filesize
10.8MB

Download
memory/10724-1012-0x00007FF9CBA60000-0x00007FF9CC522000-memory.dmp

Filesize
10.8MB

Download
memory/10724-1379-0x00007FF9CBA60000-0x00007FF9CC522000-memory.dmp

Filesize
10.8MB

Download
memory/10724-1036-0x00000292DB710000-0x00000292DB720000-memory.dmp

Filesize
64KB

Download
memory/10724-1018-0x00000292DB710000-0x00000292DB720000-memory.dmp

Filesize
64KB

Download
memory/10724-1015-0x00000292DB850000-0x00000292DB872000-memory.dmp

Filesize
136KB

Download
memory/10724-1013-0x00000292DB710000-0x00000292DB720000-memory.dmp

Filesize
64KB

Download
memory/11556-1396-0x00007FF9CBA60000-0x00007FF9CC522000-memory.dmp

Filesize
10.8MB

Download
memory/11556-1383-0x00000256C97B0000-0x00000256C97C0000-memory.dmp

Filesize
64KB

Download
memory/11556-1382-0x00000256C97B0000-0x00000256C97C0000-memory.dmp

Filesize
64KB

Download
memory/11556-1381-0x00007FF9CBA60000-0x00007FF9CC522000-memory.dmp

Filesize
10.8MB

Download