af277117f93fbe518b20b27504d9607df8389027daa848178dcf24355b33bd82

Analysis

max time kernel
68s
max time network
174s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
15/03/2024, 21:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Loader.exe
Size

81.5MB
MD5

33b0802c9a2a087744f2e5d447e23c55
SHA1

feeb964c052aaf1ca39364217b336d8934901657
SHA256

af277117f93fbe518b20b27504d9607df8389027daa848178dcf24355b33bd82
SHA512

6319912cf946a66bd90c414f7fc7773a72d9f5fa4a0e651c3c06833b6573290d2ed2cb9990886720509625375a1d4f8ac88c88596753b96d94ab288e00f6c778
SSDEEP

1572864:V/WHHr9kDJDEMtDY9TkfCtURGvz3yzPgxTTB0KHP4KkqWTEB7CX7:V/8L9wDEMDmTkHRG73GEHwNqWTEB7CX7

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
3092	System.exe
1048	System.exe
3584	System.exe

Loads dropped DLL 12 IoCs

pid	Process
4596	Loader.exe
4596	Loader.exe
4596	Loader.exe
3092	System.exe
3092	System.exe
3092	System.exe
1048	System.exe
3584	System.exe
1048	System.exe
1048	System.exe
1048	System.exe
1048	System.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
38	ipinfo.io

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 7 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	System.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	System.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	System.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	System.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	System.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	System.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	System.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
11200	WMIC.exe

Enumerates processes with tasklist 1 TTPs 64 IoCs

Process Discovery

T1057

pid	Process
7908	tasklist.exe
7692	tasklist.exe
7252	tasklist.exe
7156	tasklist.exe
7216	tasklist.exe
8076	tasklist.exe
8132	tasklist.exe
7916	tasklist.exe
7760	tasklist.exe
7700	tasklist.exe
7448	tasklist.exe
7932	tasklist.exe
8052	tasklist.exe
7988	tasklist.exe
7868	tasklist.exe
7684	tasklist.exe
7676	tasklist.exe
7376	tasklist.exe
7300	tasklist.exe
6496	tasklist.exe
7956	tasklist.exe
7776	tasklist.exe
7744	tasklist.exe
7624	tasklist.exe
7368	tasklist.exe
6616	tasklist.exe
8116	tasklist.exe
7900	tasklist.exe
7616	tasklist.exe
7464	tasklist.exe
6804	tasklist.exe
7472	tasklist.exe
8004	tasklist.exe
7980	tasklist.exe
7504	tasklist.exe
7328	tasklist.exe
7292	tasklist.exe
7660	tasklist.exe
8212	tasklist.exe
7996	tasklist.exe
7892	tasklist.exe
7876	tasklist.exe
7480	tasklist.exe
7412	tasklist.exe
7352	tasklist.exe
7320	tasklist.exe
6700	tasklist.exe
7580	tasklist.exe
7404	tasklist.exe
7268	tasklist.exe
8124	tasklist.exe
7708	tasklist.exe
7560	tasklist.exe
7456	tasklist.exe
7428	tasklist.exe
7336	tasklist.exe
7964	tasklist.exe
7544	tasklist.exe
7528	tasklist.exe
7360	tasklist.exe
7344	tasklist.exe
7312	tasklist.exe
6676	tasklist.exe
7716	tasklist.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3092	System.exe
3092	System.exe
3092	System.exe
3092	System.exe
3092	System.exe
3092	System.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeSecurityPrivilege	4596	Loader.exe
Token: SeDebugPrivilege	3280	tasklist.exe
Token: SeShutdownPrivilege	3092	System.exe
Token: SeCreatePagefilePrivilege	3092	System.exe
Token: SeShutdownPrivilege	3092	System.exe
Token: SeCreatePagefilePrivilege	3092	System.exe
Token: SeShutdownPrivilege	3092	System.exe
Token: SeCreatePagefilePrivilege	3092	System.exe
Token: SeIncreaseQuotaPrivilege	4828	WMIC.exe
Token: SeSecurityPrivilege	4828	WMIC.exe
Token: SeTakeOwnershipPrivilege	4828	WMIC.exe
Token: SeLoadDriverPrivilege	4828	WMIC.exe
Token: SeSystemProfilePrivilege	4828	WMIC.exe
Token: SeSystemtimePrivilege	4828	WMIC.exe
Token: SeProfSingleProcessPrivilege	4828	WMIC.exe
Token: SeIncBasePriorityPrivilege	4828	WMIC.exe
Token: SeCreatePagefilePrivilege	4828	WMIC.exe
Token: SeBackupPrivilege	4828	WMIC.exe
Token: SeRestorePrivilege	4828	WMIC.exe
Token: SeShutdownPrivilege	4828	WMIC.exe
Token: SeDebugPrivilege	4828	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4828	WMIC.exe
Token: SeRemoteShutdownPrivilege	4828	WMIC.exe
Token: SeUndockPrivilege	4828	WMIC.exe
Token: SeManageVolumePrivilege	4828	WMIC.exe
Token: 33	4828	WMIC.exe
Token: 34	4828	WMIC.exe
Token: 35	4828	WMIC.exe
Token: 36	4828	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4828	WMIC.exe
Token: SeSecurityPrivilege	4828	WMIC.exe
Token: SeTakeOwnershipPrivilege	4828	WMIC.exe
Token: SeLoadDriverPrivilege	4828	WMIC.exe
Token: SeSystemProfilePrivilege	4828	WMIC.exe
Token: SeSystemtimePrivilege	4828	WMIC.exe
Token: SeProfSingleProcessPrivilege	4828	WMIC.exe
Token: SeIncBasePriorityPrivilege	4828	WMIC.exe
Token: SeCreatePagefilePrivilege	4828	WMIC.exe
Token: SeBackupPrivilege	4828	WMIC.exe
Token: SeRestorePrivilege	4828	WMIC.exe
Token: SeShutdownPrivilege	4828	WMIC.exe
Token: SeDebugPrivilege	4828	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4828	WMIC.exe
Token: SeRemoteShutdownPrivilege	4828	WMIC.exe
Token: SeUndockPrivilege	4828	WMIC.exe
Token: SeManageVolumePrivilege	4828	WMIC.exe
Token: 33	4828	WMIC.exe
Token: 34	4828	WMIC.exe
Token: 35	4828	WMIC.exe
Token: 36	4828	WMIC.exe
Token: SeShutdownPrivilege	3092	System.exe
Token: SeCreatePagefilePrivilege	3092	System.exe
Token: SeShutdownPrivilege	3092	System.exe
Token: SeCreatePagefilePrivilege	3092	System.exe
Token: SeShutdownPrivilege	3092	System.exe
Token: SeCreatePagefilePrivilege	3092	System.exe
Token: SeDebugPrivilege	6616	tasklist.exe
Token: SeDebugPrivilege	6676	tasklist.exe
Token: SeDebugPrivilege	6700	tasklist.exe
Token: SeDebugPrivilege	7204	tasklist.exe
Token: SeDebugPrivilege	6496	tasklist.exe
Token: SeDebugPrivilege	6804	tasklist.exe
Token: SeDebugPrivilege	7244	tasklist.exe
Token: SeDebugPrivilege	7156	tasklist.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4596 wrote to memory of 3092	4596	Loader.exe	82
PID 4596 wrote to memory of 3092	4596	Loader.exe	82
PID 3092 wrote to memory of 2164	3092	System.exe	85
PID 3092 wrote to memory of 2164	3092	System.exe	85
PID 2164 wrote to memory of 3280	2164	cmd.exe	87
PID 2164 wrote to memory of 3280	2164	cmd.exe	87
PID 3092 wrote to memory of 1048	3092	System.exe	89
PID 3092 wrote to memory of 1048	3092	System.exe	89
PID 3092 wrote to memory of 1048	3092	System.exe	89
PID 3092 wrote to memory of 1048	3092	System.exe	89
PID 3092 wrote to memory of 1048	3092	System.exe	89
PID 3092 wrote to memory of 1048	3092	System.exe	89
PID 3092 wrote to memory of 1048	3092	System.exe	89
PID 3092 wrote to memory of 1048	3092	System.exe	89
PID 3092 wrote to memory of 1048	3092	System.exe	89
PID 3092 wrote to memory of 1048	3092	System.exe	89
PID 3092 wrote to memory of 1048	3092	System.exe	89
PID 3092 wrote to memory of 1048	3092	System.exe	89
PID 3092 wrote to memory of 1048	3092	System.exe	89
PID 3092 wrote to memory of 1048	3092	System.exe	89
PID 3092 wrote to memory of 1048	3092	System.exe	89
PID 3092 wrote to memory of 1048	3092	System.exe	89
PID 3092 wrote to memory of 1048	3092	System.exe	89
PID 3092 wrote to memory of 1048	3092	System.exe	89
PID 3092 wrote to memory of 1048	3092	System.exe	89
PID 3092 wrote to memory of 1048	3092	System.exe	89
PID 3092 wrote to memory of 1048	3092	System.exe	89
PID 3092 wrote to memory of 1048	3092	System.exe	89
PID 3092 wrote to memory of 1048	3092	System.exe	89
PID 3092 wrote to memory of 1048	3092	System.exe	89
PID 3092 wrote to memory of 1048	3092	System.exe	89
PID 3092 wrote to memory of 1048	3092	System.exe	89
PID 3092 wrote to memory of 1048	3092	System.exe	89
PID 3092 wrote to memory of 1048	3092	System.exe	89
PID 3092 wrote to memory of 1048	3092	System.exe	89
PID 3092 wrote to memory of 1048	3092	System.exe	89
PID 3092 wrote to memory of 3584	3092	System.exe	90
PID 3092 wrote to memory of 3584	3092	System.exe	90
PID 3092 wrote to memory of 1284	3092	System.exe	91
PID 3092 wrote to memory of 1284	3092	System.exe	91
PID 1284 wrote to memory of 4828	1284	cmd.exe	93
PID 1284 wrote to memory of 4828	1284	cmd.exe	93
PID 3092 wrote to memory of 2712	3092	System.exe	94
PID 3092 wrote to memory of 2712	3092	System.exe	94
PID 3092 wrote to memory of 4736	3092	System.exe	95
PID 3092 wrote to memory of 4736	3092	System.exe	95
PID 3092 wrote to memory of 1136	3092	System.exe	96
PID 3092 wrote to memory of 1136	3092	System.exe	96
PID 3092 wrote to memory of 4748	3092	System.exe	97
PID 3092 wrote to memory of 4748	3092	System.exe	97
PID 3092 wrote to memory of 2136	3092	System.exe	98
PID 3092 wrote to memory of 2136	3092	System.exe	98
PID 3092 wrote to memory of 580	3092	System.exe	99
PID 3092 wrote to memory of 580	3092	System.exe	99
PID 3092 wrote to memory of 236	3092	System.exe	100
PID 3092 wrote to memory of 236	3092	System.exe	100
PID 3092 wrote to memory of 4952	3092	System.exe	101
PID 3092 wrote to memory of 4952	3092	System.exe	101
PID 3092 wrote to memory of 4224	3092	System.exe	102
PID 3092 wrote to memory of 4224	3092	System.exe	102
PID 3092 wrote to memory of 2364	3092	System.exe	103
PID 3092 wrote to memory of 2364	3092	System.exe	103
PID 3092 wrote to memory of 4760	3092	System.exe	104
PID 3092 wrote to memory of 4760	3092	System.exe	104

C:\Users\Admin\AppData\Local\Temp\Loader.exe
"C:\Users\Admin\AppData\Local\Temp\Loader.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4596
- C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\System.exe
  C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\System.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3092
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2164
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3280
- - C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\System.exe
    "C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\System.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\megamindnva" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1628 --field-trial-handle=1632,i,1252599630956352281,14337944732740076774,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1048
- - C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\System.exe
    "C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\System.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\megamindnva" --mojo-platform-channel-handle=1672 --field-trial-handle=1632,i,1252599630956352281,14337944732740076774,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3584
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic process where processid=NaN get ExecutablePath"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1284
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic process where processid=NaN get ExecutablePath
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4828
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2712
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:7156
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4736
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7328
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:1136
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:7260
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4748
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7312
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2136
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7320
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:580
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7268
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:236
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7336
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4952
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7412
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4224
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:7516
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2364
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7560
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4760
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7352
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2204
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7472
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4724
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7528
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2144
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7368
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4048
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7456
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:1404
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7464
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2184
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7376
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4464
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7428
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4984
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7624
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3968
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:7440
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5016
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7252
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2876
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:7384
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3736
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7660
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3324
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7404
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3300
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7616
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2112
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:7552
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3916
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:7420
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:1412
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:7496
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2212
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:7592
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3676
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7360
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5048
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7684
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2988
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7692
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:1204
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7964
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3484
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7676
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4192
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:7860
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4516
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7708
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4352
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7344
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:1440
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:7244
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2816
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:7768
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:1460
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8052
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:1684
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7580
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2684
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7448
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:652
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:7948
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4588
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:6676
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2340
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7916
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2612
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7544
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2496
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7216
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2012
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:7836
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4332
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7504
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:1328
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8132
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:640
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:7752
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2220
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:8028
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4948
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:2652
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2844
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7300
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:904
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7876
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4744
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:8248
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3264
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:7204
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:956
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7892
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3436
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:7844
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:968
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8004
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:1612
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7700
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:1560
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7908
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4196
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7776
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4208
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:5044
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2360
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7980
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:1052
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7760
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:1408
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:7940
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2572
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:7284
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3284
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:6804
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4124
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:6700
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4256
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7900
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3332
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:7924
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:1956
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7956
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:1828
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:6616
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:780
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7868
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2820
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7480
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3268
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7292
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4028
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:7488
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3996
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8116
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:1748
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7988
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3424
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7996
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3476
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8124
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3220
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:7884
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3520
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8212
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2668
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:7604
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:1288
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:7972
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:1152
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:6496
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4248
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7744
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5032
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7716
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2920
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:8076
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3592
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7932
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4864
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:7536
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "net session"
    3⤵
    PID:3492
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:8316
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:9064
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\resources\app.asar.unpacked\bind\main.exe"
    3⤵
    PID:4976
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic csproduct get uuid"
    3⤵
    PID:4536
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:7852
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic OS get caption, osarchitecture | more +1"
    3⤵
    PID:5128
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic OS get caption, osarchitecture
      4⤵
      PID:7648
  - - C:\Windows\system32\more.com
      more +1
      4⤵
      PID:7784
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic cpu get name | more +1"
    3⤵
    PID:6132
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic cpu get name
      4⤵
      PID:6156
  - - C:\Windows\system32\more.com
      more +1
      4⤵
      PID:6164
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic PATH Win32_VideoController get name | more +1"
    3⤵
    PID:7036
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic PATH Win32_VideoController get name
      4⤵
      Detects videocard installed
      PID:11200
  - - C:\Windows\system32\more.com
      more +1
      4⤵
      PID:11248
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
    3⤵
    PID:10524
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
      4⤵
      PID:5996
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion' -Name ProductName"
    3⤵
    PID:2752
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion' -Name ProductName
      4⤵
      PID:5760
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:7040
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:11228
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic process where processid=NaN get ExecutablePath"
    3⤵
    PID:6552
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic process where processid=NaN get ExecutablePath
      4⤵
      PID:7036

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4924

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
PID:10040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb4c9f9758,0x7ffb4c9f9768,0x7ffb4c9f9778
  2⤵
  PID:10200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1720 --field-trial-handle=2612,i,8732774845152909454,15656681264264222699,131072 /prefetch:2
  2⤵
  PID:11116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1832 --field-trial-handle=2612,i,8732774845152909454,15656681264264222699,131072 /prefetch:8
  2⤵
  PID:11124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1940 --field-trial-handle=2612,i,8732774845152909454,15656681264264222699,131072 /prefetch:8
  2⤵
  PID:11132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2380 --field-trial-handle=2612,i,8732774845152909454,15656681264264222699,131072 /prefetch:1
  2⤵
  PID:11140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2388 --field-trial-handle=2612,i,8732774845152909454,15656681264264222699,131072 /prefetch:1
  2⤵
  PID:11148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3912 --field-trial-handle=2612,i,8732774845152909454,15656681264264222699,131072 /prefetch:1
  2⤵
  PID:4012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4660 --field-trial-handle=2612,i,8732774845152909454,15656681264264222699,131072 /prefetch:1
  2⤵
  PID:1580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4928 --field-trial-handle=2612,i,8732774845152909454,15656681264264222699,131072 /prefetch:1
  2⤵
  PID:4300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5348 --field-trial-handle=2612,i,8732774845152909454,15656681264264222699,131072 /prefetch:8
  2⤵
  PID:2376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1184 --field-trial-handle=2612,i,8732774845152909454,15656681264264222699,131072 /prefetch:8
  2⤵
  PID:2392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5340 --field-trial-handle=2612,i,8732774845152909454,15656681264264222699,131072 /prefetch:8
  2⤵
  PID:7060

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
PID:10360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb4c9f9758,0x7ffb4c9f9768,0x7ffb4c9f9778
  2⤵
  PID:10376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1712 --field-trial-handle=1960,i,12078485048603351322,2414376038508575911,131072 /prefetch:2
  2⤵
  PID:10420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1852 --field-trial-handle=1960,i,12078485048603351322,2414376038508575911,131072 /prefetch:8
  2⤵
  PID:10488

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:11228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
b27a3955e2a7fa8e448d67cdf20c08d2

SHA1
26842f19c00e3ad818ebc2ecdb60f47a09fc4f1a

SHA256
8121e8c1d1048ad611d1f870ffa15991f00a63061cb4b879120f5b7712d4fcc2

SHA512
e68f4c7cd5951d5561e0c3ecae0f6a727af68778805982bd4540f04433f4abd857cd11b151c1b7cc44d532ce9cb8aef2bb6664a776d1c0f75f5e3eda2fd7ba3e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
5a72aff360c0ba78a8ce4095f2724497

SHA1
62b74a922ec6dae2f9a0bae6a01e0690f36f678f

SHA256
c0cd1611be6d490aa8d07ac0faf2a09c6a0a078885350fd79524b86cca77698a

SHA512
6a010cdbc95d6af71a99cc67fad8ff3c78c44f2d357a3c42a61c611e1cbcca37193ea3b1a249924c66d73ab1ee2b8fee78ac1ab42450b2eaa101b09e190da976

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
1cd4ed09ac436df0b5d494a6190280e5

SHA1
f5084ec2fcf7482c24a0e32ac01e381bf5b4d34a

SHA256
1db615869aa69bde0a33721760ad3e5d55ba38c9b52f6a40c75ea1ca9aa8527c

SHA512
701afda4aa57c432bab89e32093893232d1e155436a13dab542407e169c71a22f925925dc2b2ffa30c50966e61d84bf152dd8c105fc45c8bb0051a19349969c9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
fe99dac5b199a29f6d93fdf56301becc

SHA1
e9f081f19cd266d74e5dcf04cdbeb89c38a3ad76

SHA256
8e7cb74dc99204f2a94d671d4e9befc26bd3a5a49158d6d25aa1aaf56936d16c

SHA512
ed7ffa298e50ff13f8e9cad92ff142d8afde2bf5a67ae4525b1c429b5f5ed575e52325a065c138b69e680c20b086fb0928e57d1e77c38f9788195e5ccfc243a4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
ec7a15138d724c139910c2088b08376c

SHA1
7e4db8ef346e8c9420e6bfb934a4bc1a0f6f1da1

SHA256
2b1d59accdffc1e5070923115ce389531ebdacf6a88ddeb0a47dfe1d1c8f2b4e

SHA512
7d5414b99306b22c2c81386da88d66ee074bce5ab542fc6f81397af50af5535ea4de6814d0471d7ef48fd3bfb24b06e9af43080e7299fecc3829699200cfabf0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
130KB

MD5
4e5b5e08ae9e6ba9e609ccdbb25b0ae0

SHA1
44f7308ca472e3d831521805bd8e886545ef2242

SHA256
6dc7779f2bd27fd72fea96db7f5124bcbfc205b8dc84b0be4ca3eb2150aebd25

SHA512
10fab29a54cc11af08fce4c63327b2aba2f562fdbbb7e78d3258401bbb188744904321437ec0fb181db9bc58c570d1f027be7c4032e23cb901693e1d0ed7ab37

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
130KB

MD5
f73a32416ff00b7ccca22d7d79a4f4bb

SHA1
ed40885dd3e946b6637dcf7b20270f070f236585

SHA256
3ec3c920d0b193044a15201fab1127cd67e9a94b86eae0905b4f965da614c348

SHA512
d35f50548eb461728b66e3cc335f69c8c48d9e930fedd49550a8fab0ea18f344dec2197609d938206941b99c02ae4a71f78ede6a59295c806c210d81cc91b9c2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
260KB

MD5
7092a6e83e8fe2872c5a8d271e190002

SHA1
74424ef6d988e12decc2e561c497c01d871d775d

SHA256
99d0910059b69bf3baae73d41a6588526fb7ce37ba3830fecb1f3cfd69bc3301

SHA512
e0203971839114846026f4e20368ec42e24b2ef6631c1f5df32734daea0ebf9e5446687921c243d0687958df53eb8ba35ef797dc4d750192837919639843e71f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
130KB

MD5
acc475f6d7584b749ea049c256dac8e9

SHA1
cbd33c4ee91c863165e70a59aa09afbe3285a918

SHA256
7d0fca4cc021afc57f898f474c7c8414c5c649a012d0fa9a7d543d03bc9898fc

SHA512
ba6868e30779c0cdc8af29147678f700640912ac48e3b021183091578f16fa40c504d0858c03545aeeb54f140283efa1fe998b9ace408605b7e42437b9648105

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations

Filesize
86B

MD5
f732dbed9289177d15e236d0f8f2ddd3

SHA1
53f822af51b014bc3d4b575865d9c3ef0e4debde

SHA256
2741df9ee9e9d9883397078f94480e9bc1d9c76996eec5cfe4e77929337cbe93

SHA512
b64e5021f32e26c752fcba15a139815894309b25644e74ceca46a9aa97070bca3b77ded569a9bfd694193d035ba75b61a8d6262c8e6d5c4d76b452b38f5150a4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
88dc70c361a22feac57b031dd9c1f02f

SHA1
a9b4732260c2a323750022a73480f229ce25d46d

SHA256
43244c0820ec5074e654ecd149fa744f51b2c1522e90285567713dae64b62f59

SHA512
19c0532741ebc9751390e6c5ca593a81493652f25c74c8cab29a8b5b1f1efef8d511254a04f50b0c4a20724bae10d96d52af7a76b0c85ddc5f020d4cac41100c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
50a8221b93fbd2628ac460dd408a9fc1

SHA1
7e99fe16a9b14079b6f0316c37cc473e1f83a7e6

SHA256
46e488628e5348c9c4dfcdeed5a91747eae3b3aa49ae1b94d37173b6609efa0e

SHA512
27dda53e7edcc1a12c61234e850fe73bf3923f5c3c19826b67f2faf9e0a14ba6658001a9d6a56a7036409feb9238dd452406e88e318919127b4a06c64dba86f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\1905dca5-b385-4e40-96db-c80ce7b9d46c.tmp.node

Filesize
154KB

MD5
56c465754297ae8b4a4991d094af1833

SHA1
0695ed545b27842df51fa32d7ad03f6db661afe1

SHA256
9a02d4912fcc6c9195276e200afe8cb64f9f271101f54e24bcfb5519f7bb1e73

SHA512
44a3057df23f63ee58134cd064cdae0c3d4045787f5a589321346711a8778105407364595a6af984f2c82da974965ae1d29586176b70bcf634d55cd213c74509

Download Submit
C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\D3DCompiler_47.dll

Filesize
896KB

MD5
dc1a4034effea250b2c888f334601c66

SHA1
7f3268282930dd558a14a90b9ee0e274be17bfe0

SHA256
315afecddab7fdfa0b8b8c969b38690e6f0f1ee98f547d1ee8aa40d581032393

SHA512
6fe4e2b1119ed0d99e2a0e02e72a0e378a1ef5dc1f1058e09d8c9cd95204e294e98684f5db61feb3a41d41533f97644b3ac11bb5115aea4931747415795be66d

Download Submit
C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\System.exe

Filesize
448KB

MD5
84e7cd0b746bcd81e0fc5fe299dd81cf

SHA1
2f68b5433c721889f1fd4f703bc92b22b82acde9

SHA256
f6c847d334d54471533dba88305a573be07b513cc348e0741ea670a9651ef802

SHA512
2e146e0d29886eaac096c2e17834e0aa4154c47f5be26754fee928ec5da7415ca4612b3cabbf36b73f6b985e699ae8eae5caef1d21ef91a98371e0d7c37f7505

Download Submit
C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\System.exe

Filesize
1.1MB

MD5
f8e918188020b8313a19b19a028fdd5c

SHA1
5652ef53869510c31fdc18a8ab14b0a07eebffb5

SHA256
02e9f00a5a08f571e8083a885810f14c6d6e08a8a1c459968b4ab558f626ad40

SHA512
678ed20af7922588f31d0773c7f9cec005e2b094d93393ecd9b1ba417ec7bc30eb3631254ff1f2f6246fddb39ac50bc01fed454ae025f45cb6ed7dc84746e0f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\System.exe

Filesize
896KB

MD5
12532688bc4035b4b4095c2863404406

SHA1
03a341ec95d4a54ea857b37621299a1867d8a244

SHA256
d8bb182b5b2b650a3c833d45c1b6fbc6ec40dc887b22b3b6981051b632bc67e0

SHA512
7ca1e9d77a43981ab03417cae8893bd517f74f17b04ff5ca5e5099b64d53184abc38034b242aa299f31615b734366374ecfcf929623bf74957373c82218e4b9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\chrome_100_percent.pak

Filesize
132KB

MD5
e4cbb48c438622a4298c7bdd75cc04f6

SHA1
6f756d31ef95fd745ba0e9c22aadb506f3a78471

SHA256
24d92bbeb63d06b01010fe230c1e3a31e667a159be7e570a8efe68f83ed9ad40

SHA512
8d3ea1b5ca74c20a336eaa29630fd76ecd32f5a56bb66e8cef2bce0fa19024ea917562fd31365081f7027dde9c8464742b833d08c8f41fdddc5bd1a74b9bc766

Download Submit
C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\d3dcompiler_47.dll

Filesize
832KB

MD5
bfb1a8fb64c723579709c1b80fc3283a

SHA1
b3438cdeb9b41d5829f3535dcb63c128db9d68e3

SHA256
7333403309318945364bc20683a13e63bff66cce5d0e2a8616b8768485283c3c

SHA512
0461bcc5f75fd80474ab5ef10da9c300cfc6a83636363a163081214816b1f747c43538943fdaddc7ee06cc11415eda31e0ca18cb60340a0870d6d418aa9fdda7

Download Submit
C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\ffmpeg.dll

Filesize
293KB

MD5
20dd0acbb872faefde9ea88995620729

SHA1
3605f3984c7f6876a7d982e5edcd60e0baa92d9d

SHA256
1fceed6093431f6de7b21e34ac3f5793a454f78289d5e2a36bdc9b92d4ccff25

SHA512
c4cc44aa2217ec2b5eebbf2ec7f810f80ed13571614312412be1e16719c25d7b29aed1de2d8ca30e7af39bf3ce8919abf650986f185e40f99a5b048d621adc41

Download Submit
C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\ffmpeg.dll

Filesize
192KB

MD5
6cefd951c341cd08b24c833d21b621aa

SHA1
51db607102a6b53f18e53b7732bf7c888bc2ce0b

SHA256
0a42062820d62cd679671f4cebef2fbea8c8c0922ab26e0efdf210c54589886a

SHA512
cb87f0447b292e2c6540b43f7093d42931044ceed1120de55aee24fcbcbaf7fb8de413971271178ce2759c578cd426b129656e5689d213914fe4e0bfa2318f44

Download Submit
C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\ffmpeg.dll

Filesize
1.1MB

MD5
5495efc377b90dc1ffa81311a6e513ed

SHA1
bd2786320f7f50ad269c4a4f89f115fdfb66474a

SHA256
0851550a49b3f4b02d39e2f623a80773e0151d917bf85979fb270f0ad999a634

SHA512
969e9749d04d28b94f3820630e4aa38c25db47eb0f88841244c2202e89a7d71514d5918beb8b36c163bbb59947bc80c4097ef7b5d4dff189031a45d1ee738a63

Download Submit
C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\ffmpeg.dll

Filesize
896KB

MD5
85a2d49b65d9274d415e74d2a2582e06

SHA1
889373443a39fb974fed2f204afa1d1dcaff376f

SHA256
43166fcddbe776d69e47d4a2bffcdd9e5392753fa35406c1e7bac8b9ede3e3d8

SHA512
72cbc4d4ca55c89fea7ddb1cc16549b3b34da7b781b837c826bc59be765c0b54e6508d126a2d8a41a6427ec84e41ef43aea14b92368823dabbf304def74ee3bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\icudtl.dat

Filesize
128KB

MD5
5eccc4d7968e56bb363a8d0ae1cd7953

SHA1
f1d7e2b25c8a2c33025deaaf0839e9ca587b7837

SHA256
b7f2a7df81ae0b139caf33ffa585aa4a5db585f8a5751f4b14f4fd0fead47876

SHA512
0ef2cbf18c3348a6d3380d323b00292b5e5cbdb3719c9b9c0c95d2c02bed10ecda02d0180cd27ae2620e766ac1ba9a3c817a6c6a5c8e0393649606dbda3310f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\libGLESv2.dll

Filesize
768KB

MD5
fe65cc5865b2d35147bdda81651cd34a

SHA1
eb8332bf064426e4b8b741fa678a0c09adf769d9

SHA256
a447584b150bd678e0134a2b56eb607e8e9635e312e054800d46197a06a0bf00

SHA512
b4b3cb544aab998367c2677dc627226beba8e7ff7d34510b2a92713b51109272c1dcad6f75cb0e797281f9d2a7c42c1f5a8ecc19ba1ce3b3908927332b5ad65f

Download Submit
C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\libglesv2.dll

Filesize
832KB

MD5
708aa55b12ba166afd7e660de80d1ce0

SHA1
436e8681930ef79b751f638d3642387a0b6c791c

SHA256
a83f0bf171ead8ae4e36cfa58770c4c854ae0230e4388f2589e5f0c0a0276df5

SHA512
422233f2349d71d25002d9d97a21796da9aa604bfaeb8eeb1d829105111d9d35bb1799964750556d562d63170b4f8c9109a5c31377633dd39d71b8b38dbde09c

Download Submit
C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\resources.pak

Filesize
1.6MB

MD5
8c3ca0634c3270a5e966e0d00bcaa36d

SHA1
e7fc31611fc80f7df726750200103039df916299

SHA256
c957502735d6f1724d5b509493c8c960d1c38049489fd2ef5aaf8253061fbe10

SHA512
07e5a756e134caf060e75648918528a439f05f19ec15fa04608fcf3db05d6e39665d0f7ee4eedd7d211801e16d5a604729eaa02cd862263c8243e5b7c86b421f

Download Submit
C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\resources\app.asar

Filesize
3.8MB

MD5
2b7509be7e573e794cc0bf19c99df640

SHA1
f96602e45d84bc54b4d65ef79fb54248bcb9b0e2

SHA256
04a33adbe70089922e2a428d0043ad669efd734a47c186c71a11149d42071d49

SHA512
656b11cd532f00e305a07e983476c059a1f0c0127921abfed25523d92fd4863d256e9b2ff510cf655075abc05b1c4438e931da7559f926c53b08156de5ffe3c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\2deAPxRCmaTHkxGBz7te5NojV4p\v8_context_snapshot.bin

Filesize
128KB

MD5
ae4c6d6dcecf451b283d19048b251a57

SHA1
e26adcf237ac1caf755e7e5d4663e54b0cc18ee2

SHA256
f7b8bbbc195076fb569c2b57143e38236d966fc2c1e7414dddadef7c753d38aa

SHA512
1d20ed7c887ace340e9a5ab2a7a22750cc59a6633c018668712f88c6178603b850dced491c628a3c3aed7bc16cd5157818d46030af58bdfaf99a63a988b110f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\3d7e49ff-082c-4239-a3ac-ea6d07f99f61.tmp.node

Filesize
1.4MB

MD5
56192831a7f808874207ba593f464415

SHA1
e0c18c72a62692d856da1f8988b0bc9c8088d2aa

SHA256
6aa8763714aa5199a4065259af792292c2a7d6a2c381aa27007255421e5c9d8c

SHA512
c82aa1ef569c232b4b4f98a3789f2390e5f7bf5cc7e73d199fe23a3f636817edfdc2fb49ce7f69169c028a9dd5ab9f63e8f64964bb22424fc08db71e85054a33

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_syejwpdl.gkk.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz928C.tmp\7z-out\LICENSE.electron.txt

Filesize
1KB

MD5
4d42118d35941e0f664dddbd83f633c5

SHA1
2b21ec5f20fe961d15f2b58efb1368e66d202e5c

SHA256
5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d

SHA512
3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz928C.tmp\7z-out\LICENSES.chromium.html

Filesize
2.7MB

MD5
ce49fac822f558278c17d5da51ac1437

SHA1
247e38ed5b767b642cf43cd0a79022786c2ab992

SHA256
c6c812c03d4363506391176525e83cb1facd67124b597fd82f942f3bf191c51c

SHA512
7039f91532c48701ac50727e1ab296aa50c164a918f85ab0d04d1dc02bf988708bf8c407d510b34e20bbd3bc04721fbfaf5cf8d469bead26dedd2b04bbe1592f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz928C.tmp\7z-out\System.exe

Filesize
960KB

MD5
a53111cfef1ec3f56fb92bf1fb42caff

SHA1
1fbfbfdf48ad41a72d680e9f346a5d1af24f8d45

SHA256
1b53d2c27e9707c7016c470c7bca08a43d8d4a1fc5e64e5bfed4aeb3f0a267c6

SHA512
39d686e80d65fe037d4007eb0faea4f29692e6165eb83d8137d87766c1a6728a1b379f69d8e0190b40a6b89e07cb61295c4978e21fe11762e18049821a285aaf

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz928C.tmp\7z-out\chrome_200_percent.pak

Filesize
191KB

MD5
99b95d59d6817b46e9572e3354c97317

SHA1
6809db4ca8e10edd316261a3490d5fc657372c12

SHA256
55d873a9f3ac69bbf6eb6940443df8331ebd7aa57138681d615f3b89902447e7

SHA512
3071cfeb74d5058c4b7c01bfe3c6717d9bb426f3354c4d8a35bd3e16e15cde2f2c48238cb6382b0703b1cc257d87fcecfb84fbf4f597f58e64463ceede4366dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz928C.tmp\7z-out\d3dcompiler_47.dll

Filesize
3.1MB

MD5
a4849b10be277cc9ecaf783e4d3d7e6b

SHA1
d6a45220eeade7d663623b0a1f2fb6c2f32f9c36

SHA256
93fd6aa6f117cb49e1d93ccd6b839ce87eceea57aea4a37020101682d7674547

SHA512
e3a4af1bbbe35d9bbba955ab9b673668da55c870fc2c0399494b6a3276ff9eee6ac3d122eb574190b04cba0ba46d74132cca08887e76536b5cf3527454022b7d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz928C.tmp\7z-out\ffmpeg.dll

Filesize
2.7MB

MD5
35e69884a0a746e4010c4ca7693b2bb0

SHA1
5d4fddaf115dd7208fb6f0b2af473e0b3de8a7a7

SHA256
137b179d6ade7763cb1be6526452cbfcd726777a2518129576883c2bdadd4969

SHA512
de786d513ea93c0de737165d3c079c443fc303c561460a9d59aa1116c015cad42a582470ab0dc203378cc2ada02ca5ddb9f186d98a69cbe3843f7c44b0c10068

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz928C.tmp\7z-out\icudtl.dat

Filesize
2.7MB

MD5
03b14564be79900a75ed5e2224ff914b

SHA1
d807ea3cab0c57026f88975964b9c4b67e7174b0

SHA256
e5b815e8eced9fac9afa606b883b11f71523cd785794eee7e84623eb2a87ff3b

SHA512
49a14e82e3dab6008d9f1faa08eca4894a5b3c17473a733ba7d2b85c54f5abefef0841c306ab5fd2446b86eb673af07a1aa894d832df30287e95fee46e7dd3c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz928C.tmp\7z-out\libEGL.dll

Filesize
469KB

MD5
83ac3fb31b419b68e20b120077a8a623

SHA1
c9fce6914cd0901ca55bf7db6935ff5313ce1f98

SHA256
c359cf4f88472a3a79313949f15904731de53e18867b155b95105d4ef9d3420c

SHA512
a2937ead5e41ff0f68308fa26335c28ae85d22f53963918661b5882068969adae73341be75b15942c6577967667cab990690c6e4514f9ebeb92a4395ca40f1eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz928C.tmp\7z-out\libGLESv2.dll

Filesize
2.7MB

MD5
82df358c1dfcdc44af87c5a5caa8bfbb

SHA1
6c251b92ec66ed33974979948b1a79c100682aa3

SHA256
dd45ab10f14a8a540c5cedbe3989a9d4ab573f72d1c4faab5b56859db3d581ee

SHA512
a09a307e935edbf2534ab69546db00b702f5d91e31ebb081609cc288d61c27df73c265a1c7669ce693974cafda717199aabe0e3ff459f956523f47c823568ab4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz928C.tmp\7z-out\locales\af.pak

Filesize
425KB

MD5
d16ef573959cf5cf0a6eea20136b9c0b

SHA1
e3384ae3ee92e1dae47a48e45589372e940aab33

SHA256
73a8401e6dc17c4daf86b42c65b81359348f7e6b4d62d8637138e747bb3ff0ae

SHA512
064c2912f766f10ec042adf82709ac9582cb8430e3550690fc17343c380dcbabadc0084e08aa5f3eb6faf79a652d26e1fe2606625a180b7f47808df07a566933

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz928C.tmp\7z-out\locales\am.pak

Filesize
576KB

MD5
16dfccaf8d02d60102830d33716a300f

SHA1
b1948cae75a1281202605fa34ff2e441685403a9

SHA256
b9fa27c23d74076a0eb7dafb2e33f6cbbe3c437620f126d3d05dce5630600813

SHA512
fac738114c0b616d65e21ef88ded96c08d97d5f7533ee1b70b528b8b8b6d23664b94ff4f98ed748606a63edb8f2e4c8b0e529f9f8e3a35c3375f666bb5d32578

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz928C.tmp\7z-out\locales\ar.pak

Filesize
576KB

MD5
d0acb62d7dabd29db162853872145805

SHA1
5af72d6dd6f2e13adaa052799855d5300554f1f7

SHA256
40116fa2b1337fd0bb3c10df41ab7b1c54c8b8d6a255df61bacf1dc3d5feb456

SHA512
078f032df0ac9eaf180843eed7471cc1a123a1681c891742978c8db6bd26d81dfed51578adeb421f427ee1e765ee40292b5957ccda5df962af22bf2abf185899

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz928C.tmp\7z-out\locales\bg.pak

Filesize
788KB

MD5
01dfb1a7815613fa0a5411235f45b27b

SHA1
3bf1ea5597ac77b26bd30caa1efea7cb4f7a1b19

SHA256
13d08d2c4972cd18bb8ea8a57587dad29684c2336f73282dd3284b0649377cf8

SHA512
5d8a65e5a17aa163fb679e003e1837ea96e515b105c9977029a5ca4854845289de5d65c0edfd473cb74410c5cacdb5b360f25a69776705fb05f48688d92680da

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz928C.tmp\7z-out\locales\bn.pak

Filesize
1019KB

MD5
ff4f966849b4107535e41d037d9144c7

SHA1
3a973857b061914e8905bda7e8f2bdafa384588e

SHA256
2dc26dee345271f4606650912b0b7b5df68f621f2920864e0e36c1d1b22459b1

SHA512
98772f266f9553f77f91b11dc4589ec8a0930554e9e0b381bbacd8d23ce794c04f6fe821388a6e87cb14cb59c7522c18c06b1af11fc177c7e40ef71242adcba7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz928C.tmp\7z-out\locales\ca.pak

Filesize
479KB

MD5
a0b45b122241cf0c11a081eefb9cb4c6

SHA1
91fd660a4688aaa70fee42e783b8b1863b4d11d7

SHA256
7d911cda51564500dd7a6de43a1e347869427c035b15fa25cad0526be9e055b1

SHA512
abcb3bcb96934189cdfd52528cd7c65ea870c9b997bf6349599b7064fe6f4bef0d34809f0f958e4d4e46486e7c0a41f86b5ed0a132bbf20743d41f3af64788b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz928C.tmp\7z-out\locales\cs.pak

Filesize
320KB

MD5
0525e7f12fb656f08d9e9bfd0e213937

SHA1
822c1a4b3ad6957f478e407cf4b69316a0a78a28

SHA256
b56b171e120e54253763222442818fe14c80dd9934c84526c6190212e64fa5c7

SHA512
8ea5a69d88894cb101404db588202c01b8bc3909fe42f3ccee87939ac40a89b4273cc5cd9760dd71364ee75661fa7032411ea44fe10c6c3d3218f9d59c1e77c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz928C.tmp\7z-out\locales\da.pak

Filesize
446KB

MD5
5b033c206820ace5eb4c6f82aed34a5d

SHA1
28017cfc13259273022059f02564ffc99dcd75a4

SHA256
1a51de04cb205c708520f1b013447f1a89f0b1330dbce6d1e71cf355319d1108

SHA512
e423069f7a895179ea17be5774284e9e2e27f02c40bac7d7211cab77348800622796f04c3e6618905364e189ca5ec772ed7dbd285872777d163d3ebec08a64d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz928C.tmp\7z-out\locales\de.pak

Filesize
477KB

MD5
7ccdc41a3dbdf89058d71629225664ae

SHA1
e15c35b18685d9573349ff4247733b5f5ada8717

SHA256
163ea4c2cf67edd0526a8e18d3810872e92a1d4e17b5cf4f04107fda5967b0c9

SHA512
13b20b0db02a0a7480c56c79304ef594353507e1a30da0130b73aa8e9ec7636f306315a6f40729b10dc725f936642d2e2b282ed3040a079a6f25a7f9f7f1ae28

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz928C.tmp\7z-out\locales\el.pak

Filesize
865KB

MD5
2b391b2b35f7e096f696faf5dc093366

SHA1
1409134a46fcb84457a0e332edde98f7666246bd

SHA256
f1fe39af50f4bfe9edcea3af6c132e87d464d7277fb491ed95d7189b3157d20d

SHA512
aa640ca41dc9d4f60392b61bbead215345abd32369b0de90ed1d7ca2ff7a838d04689d538789a1adc0324fe4539c34db26b6c245155e51fb0308af13b60bfdae

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz928C.tmp\7z-out\locales\en-GB.pak

Filesize
389KB

MD5
745918a5a74c7b6f4818a8bb8813f456

SHA1
031f50286d003844425ddac557e13e2ea4554bc2

SHA256
91bdbf5f1f6bcbcaf16e47865f72ec97d72c74174fb929f089d14c00989f91f4

SHA512
5a1eb0231352705bab527ab27543612d75cb00c522620828ce2a0fdb0b47be9daa2dd7a192f8b4bf299007c5af1d9515f900b9586ba44dd2bd9f4cd4436aa681

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz928C.tmp\7z-out\locales\en-US.pak

Filesize
391KB

MD5
c9c2abcb04e1ad5f1a20244da8d595a8

SHA1
89ca81da21900074a5ccdcdc852768277b2b620b

SHA256
0364c73f320e441b03cb2afcaaca3ffbfac51a3559dcd0ff99a1accf82c7f762

SHA512
96bbf21174f56a111a2fc6ec024ab2f143945306797e77d773367a7fad42b7828ebb7b08d0dab76858d9fa340bf3205be403bc53df9e5e4e390058c94a751ffd

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz928C.tmp\7z-out\locales\es-419.pak

Filesize
473KB

MD5
c8f488b85c17431360e531aa507be979

SHA1
bea5d66bdcc05869a0389e051a9217fd49e48fcd

SHA256
536339d99dee6e8c01f018d4700ddd92ce063f765766a48073aeb256669680c1

SHA512
1d7f9f84a8d7c055bf705c71efaea817f1b9dedd5ba314fec6ce5324f578d3130b5541bb52fa55db9f6e46efa8e152d50199a61c7e2466844a4414df65d61c22

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz928C.tmp\7z-out\locales\es.pak

Filesize
473KB

MD5
29cbdcc2168f1bb29532122c39e67a1a

SHA1
f086c79d60daf2b0a7df91916387efa461795dcb

SHA256
232f41ab5996c917687276e82c177de208b36e77aa834bb5d94d6a331f4180fe

SHA512
b603edf2a18f5893ab482b0c34e4126f824fbdd1b669927d7bc30d68e2e5bdf78d7d4b2aabdbe257987e8e19f440d9396a3683340b94c3fd844c70e34e93d8a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz928C.tmp\7z-out\locales\et.pak

Filesize
428KB

MD5
5b169234895d929930140b4869a0b81a

SHA1
f58ba50d1e19ce191a0f8117f3e70f7f3dcb7362

SHA256
c465da80b14981bdbc687b7c37bf70d2bd4b8e03293c04ae5410f84c91ef980e

SHA512
c4297e272b5c04a0ee0956b873d5246591bee98c3b340e72202f3448381c691096a5bc540fdbcf61fb40d6a69270afa7198c1f0ccf3b2e84cabc906e23eb022c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz928C.tmp\7z-out\locales\fa.pak

Filesize
703KB

MD5
f7da0d07b54698bf8a213d0ccf1942c0

SHA1
d64fff18274ebe71a4aaa4754f9bb99d616fa000

SHA256
33bdd6eb52f648d475306f35b6103500b864672cbf39cc0fbd8c4ac84c997dec

SHA512
ce7a7b3df4c814a26e3fd9fddafc01ac1a4b2a87ef2d2893db5d0edf8e5b8bfe34afb6e91ff94306248361d57c6b3bd63d116635fb756aab74c4aed38f31c88f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz928C.tmp\7z-out\locales\fi.pak

Filesize
438KB

MD5
1cbfa553a5b1de642ea4c248dfe1edba

SHA1
5de05b3c11fdd59ff5064a153a6dcbda33350971

SHA256
8f3e8ec0fbb471b45db65a77dc1013e3363f387d3d0c6a458c90f371907d0085

SHA512
ea3b99be7da893be8c3b228d1d3d7b644a1f5425b5380dc3e0ae0ba1bd29cf39dabe73819bcc4fa67f10a488f018e9fa2328995cb78f40ae8fdb66aa514188aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz928C.tmp\7z-out\locales\fil.pak

Filesize
192KB

MD5
7c02492bcaa6e34ea39fd58a42c80b45

SHA1
6162fa077cd3a71886972e61ca174f8b031869bf

SHA256
71d29787545c3e9a9b805da2c859278534e2133d6715a1370688a02580dd4c8b

SHA512
d9e960a9355d1cc971799e29d39533dde15ccdcfc443ed6c3e80d62ef861e885593373f98577659ef786128951516a18164e89a13c64b5aeb5c174783dd593c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz928C.tmp\7z-out\locales\fr.pak

Filesize
513KB

MD5
a1de4ad3d9b7aa8f122ba00cb983e49c

SHA1
323d6e1b4ed75f9406bb8488d7ffc7e12fa96886

SHA256
a69f52162f6081a06f835ede10818218df6e211f00d0ef24561e6221f4696e61

SHA512
542f0818ea4517fdea929f3d4938f7de75e2a5e6d872607e548f87de7e9cd0737fab3f5e82ab7895f44e809279d81c490999ed055acbddafe84f85e60ce2e23b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz928C.tmp\7z-out\locales\gu.pak

Filesize
192KB

MD5
a40c4bd57463c30a5869046b5bce2f9f

SHA1
04f9f95586c536e49570e9a379c62f7059efc0ab

SHA256
89f15d0d86a31e94bd2985b9c40bdfb0cbedbe01f943aab7c52e68bc2deaf1a3

SHA512
e641716a59e739a70c6c27bf324d0455de0536777c113f2ea245ad6df9af796186fcaf44d3965ef322cf74d26315ca12cc058eb60a727e47e5d984751ed7e54b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz928C.tmp\7z-out\locales\he.pak

Filesize
256KB

MD5
8704562ed2ba3446df54d6e3a4c94645

SHA1
6f34861384744e6182b79c1c5baa71f66c129f54

SHA256
a00fbecc5fe365e70d411ea6bf81a593287bb06f77f1b776f182d3060c2840d5

SHA512
d8d84e8a0fcb726e79e81ea20f5a56d87da7023f09795ea005e3ec4f50cca9c26573740084828bfb8621d894b5aa0d4d604b28fa66048e8670f6d86aa06b78f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz928C.tmp\7z-out\locales\hi.pak

Filesize
256KB

MD5
6e6de47276f822e40ceb58f5c706128e

SHA1
e82284785b4460d358e1a1884e702a5f93e680ae

SHA256
c5f862e229d5694b879b3594d9fae2bcbbf3f5560187fdc8a0b0283bd9c77753

SHA512
67f5798cc6f5769ff1bb3c565f756156fd77e0f38ee15e88907bb7ee903c4887ff8d3ad41b00b43960f9b7d2dd66558961695615c9a77a8a5346ec34d44c0225

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz928C.tmp\7z-out\locales\hr.pak

Filesize
256KB

MD5
92ef0f2e433a7c4529bb89b9793f5e8a

SHA1
1b49e4a25432a5e4a06fb9cc336f50dc34bb1bea

SHA256
409b1651279d44ac9533306c7759146c08f2a965130c4d8edcb47667ade59ef0

SHA512
37d3decc550f6b774ebea255a3fc24cae11286df2d883201647f1b7a33cfadfc3b2e93ebf6d4c57524c8bbeaa5a25f170eda2f96066488ef24e7942efb9ef238

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz928C.tmp\7z-out\locales\hu.pak

Filesize
192KB

MD5
97a05f5bebc35abd6756f02e504a276d

SHA1
12299748b7091d1a679a1209ebe775fa4526d4e0

SHA256
864b1a05fb1772bf2d12a96e07f28efc399f2757dba1e60da195fd52985d6e30

SHA512
e2dfc0ae3f30e817a8ebcd006b560536fab5f326d0108d9f0c6dcc6ea6a422eaecb33fde7c4f9c978b153cb3fe8722838d74a5f44c3bb0d38e3c374ed6ad3d53

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz928C.tmp\7z-out\locales\id.pak

Filesize
421KB

MD5
3b5e08406059d1a76566e9a5d4c9b15a

SHA1
6bf45f2647e959ec1b545763180e8f29961ab3e1

SHA256
60409d8b785dd057e3495190b18e6d6d235d8313555341cba5f64327e3d8c3aa

SHA512
6c4150c064edf6ed0b83b216ce62134bbab12137e6b45749dad08d1d1734b3365309414900615137c6acdd12250add5c69a222daa7984a94ee850aaa55af1b8f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz928C.tmp\7z-out\locales\it.pak

Filesize
466KB

MD5
4e7ab6a5d407bf4d3f96671d65e467f9

SHA1
67f43053ccd167f2ce6d945202f64df29ee1ac49

SHA256
20408c09d9447f44aa920f2529d231072db8bb9c0c8b8fafa2db733561eb6964

SHA512
bf493e1a1c0898f7a54f8a5278dc0ca345e9937efe269b1bd3a3bc90645d767070ec9c117df001f8c3b51b4a383c30f025daf79606ac1840fcc5878ad4c53624

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz928C.tmp\7z-out\locales\ja.pak

Filesize
570KB

MD5
74e2430cf18db7ecae2a9b1feeb049b5

SHA1
362a5f3e4d8a79b9d0b041d62a8a5233e20fb208

SHA256
1a726c500b5b3efdbc7b9e6626765dcb8957005f9c072c09d1f517587d6b673a

SHA512
324d0ba770c09cccac4c59e0e0605846a4e18f32cc79f14fbd4e5b0172f439ef8dee538f686458b3a07e5e8b4528ef67aa5d339ae25f7c601c9a302caa7970f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz928C.tmp\7z-out\locales\kn.pak

Filesize
1.1MB

MD5
56c5f63f439cc962b815bbc4f3f12c32

SHA1
c96248cafd869fef11bc37aefb1382d0f60a7855

SHA256
14b332541c2cce0835202372f8cc822aef30b3575b651c96219a88b8d1381648

SHA512
9210759d8e73266381fbf04280aad0bc5006f315ce3fca74fe304b3261af0ba399210f0b84620230d6aa0c667e60c0a6d9e67681fdfac401338e9331475bb7f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz928C.tmp\7z-out\locales\ko.pak

Filesize
481KB

MD5
a9b446bb79b0e5d0b4af4f7243b1f3e2

SHA1
fcf962506b32b34a6315ed61acdece33df3dbf23

SHA256
507fc8d2a468456f2842b65a111fc0c74fe1f56d5f5ac0d6e743aef186b43b2f

SHA512
e7f281206bd481427a75b581f8b2a435eb8a29bd8b5586a8db78605b1c1bbc20dc1f4b2ff92d04c62fb509dc6e1e062d1d584c195e386c5c2ffda0f764276aa6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz928C.tmp\7z-out\locales\lt.pak

Filesize
519KB

MD5
49201fae17b715a15fa03c4d89dd2176

SHA1
7c559c174850de48c4a2837fe32c58f74d8150b3

SHA256
4a80792cb9a401ebfa7ec3212182b5024d651ca6a5ead8fc9809d0d3ad4803cd

SHA512
3016f721d77206e13e275e7eea1adc95d403feaccf595eacf933940485031e9aac0c29b6f47a9ff5f73b08c354b7b82c72193c83e1ff09d84cb5b9b72b708166

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz928C.tmp\7z-out\locales\lv.pak

Filesize
516KB

MD5
335158efe454819a0dc8de0edb0f0e90

SHA1
85871f85f626db1fc597ef24c79c84115a66c17e

SHA256
113073cf60ae3d2bcf8a61df655762e34ba28e4b35b97de33c18e13f959d76ff

SHA512
f81733bca3fa65c789630b55c4f414a8541e71c4e1aba56bdb9d231ce189677b3bff4dc57c92fbe1cbc88f1f2f7fbf1a7e4319a8918c50409fcba958d743ccbc

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz928C.tmp\7z-out\locales\ml.pak

Filesize
1.2MB

MD5
1030c08ffbbe7366ce5b7d55bc8ecc0f

SHA1
b45b53c1e47a0051560c607874357130c499563d

SHA256
e1f97ce3011d9231f23fe033bdbb0905c173921b18402d362bfc35224ff67db7

SHA512
3b9127a0eec02f75f79c66f5f7845b65c4ebe2e6a33989c7686815ffe0651be47d42f55c2f32a67a221495a8bebf043d853df7b244a68f89390044210e52dd3d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz928C.tmp\7z-out\locales\mr.pak

Filesize
976KB

MD5
eafb18d633064d0f02a3eff3eff9aadd

SHA1
a8846e473014be80125630f1c5b51366220ff018

SHA256
fcb7c4aeed28ae4d16fa7b82d9571165aab0fdd46eb65d3ab29007231630ccef

SHA512
d332a4b7f4cb1583a5bf5ce08fdb46661a5bccbf0a66f7f5ab6ce04367e9bc589588dcb32f443695a3ab129dc50d2962ed4c138f97858639d4ea37c117e23495

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz928C.tmp\7z-out\locales\ms.pak

Filesize
442KB

MD5
3d0dc94a638f98d9bf3c0f60f89a0c95

SHA1
a979b04c65832d908305fb0406cb0653271ad744

SHA256
a9f9ae23a3bc2ac919c5b46d16b7e1f3bff73698d2626260196210e101d119c2

SHA512
6d687f1eb9a7fda3791295487063393b8f0a7409b55461b185aaf106c596229de6988114230625d6504b869d25d7a624bc3b90d66a0bdf561cb05a57d5b87c15

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz928C.tmp\7z-out\locales\nb.pak

Filesize
431KB

MD5
9c18dfa9e69c1d7810132800d084136c

SHA1
bbaa9576e1b012df33d79a5dc7776c00e67295e4

SHA256
4f3babcbec0d138654ec59fd8ab5fd58da2273237a587928b9687928c7ca10ff

SHA512
a82b1e340a25a3858906ded73624bd0be4b3ccd1f5728560480b4a4e3a78529f5a178d20cf7d95fd55ded7ca4fa95a5fff87d89f0520ea08b54e7b99c9057d6b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz928C.tmp\7z-out\locales\nl.pak

Filesize
444KB

MD5
5cde06a63c9dc07fdbb0fdc94e403d00

SHA1
11be56054908f1f9cd56ab77692fe3717ee91ee8

SHA256
3b9ed5ed0dd07d8fa67412a046ab085137542c156876dbfe6f83376571af91a3

SHA512
2716496dcbf76cc2dece938103813a8dbc17d4c795b4e3459a572de4f62f9ac0e1788de3a21f5fb287ad364decbd541a5e3bddd406e130d2a9c72118ccee5390

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz928C.tmp\7z-out\locales\pl.pak

Filesize
497KB

MD5
b44fcf9fdc4ec7bb5e72cae30aa15c01

SHA1
daaae4aa7987bcce299995feea5c54f2d77b61d4

SHA256
7f1a8392fe3aff4e6bb4bacbc1f4b395f08ecafda9f81e36b41b77fb4ab0bc76

SHA512
52b46d7affac4949fa19841d26d2f4bf877e36cbda4b75f3ff289a7abe9a80c2a014b1ae23d3079f4d31ed5fa76c320103733284a2c13d99a451810407325674

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz928C.tmp\7z-out\locales\pt-BR.pak

Filesize
256KB

MD5
9cefc45cdc454465d67f09227b3afce2

SHA1
f0f847f4b16917f534e56bb338fd9235f220866a

SHA256
79f4407c2b43e64e1754fbb76bd23c570ab56e105c463caf0cf0934d6104132b

SHA512
ae5ccb6fd67103a82fa786177b030ee6e3d2b8647ec3c8e049922dab3c78beac2f6b684286d948fa57289f7fc1d02cf07bb92d0cf1e300ae74fa4f79dced77c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz928C.tmp\7z-out\locales\pt-PT.pak

Filesize
469KB

MD5
002d5b37e68a0725dd7d89fe3fc7ec48

SHA1
545de8047d3f89150516b95031965adc8f17df68

SHA256
1fadff356a7e89a8ff2af3ddf84f70fd0ce69525c7787f8adae10beed9d76d4e

SHA512
abad6cbb30a958bb84a521a66636af4221a9f63774122d3ac3b552503930ad83d343ec4c8109c8031cab17c546ef7549aa0f87746e39a80f6758fad28ecee129

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz928C.tmp\7z-out\locales\ro.pak

Filesize
486KB

MD5
7056fc61de4a16c7f4f5bf44d2e87f8a

SHA1
99d16dcb3b1aefc472601439f630e1244b1aa277

SHA256
b7ba9435d82f6bedd7005b6e868ee86f0bb6c4d7b312fe5f5d4afbd440ad5b85

SHA512
529152da39f7ade6713206fa9f767b35b9bf03816387579522eea78ac7d0e150bad557fcdbef51e76d52e39f61a0b4e54ff6a3b592eb7e34fafdb98afe460f7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz928C.tmp\7z-out\locales\ru.pak

Filesize
797KB

MD5
91379a583d22fa9343ed466c261366ff

SHA1
61e8c39235945c4f38807b14ac74da7d3257759a

SHA256
0d4d0b8052519848abd182c44dfbf444a77a0c6994965c4a3001f0a3a4d1459e

SHA512
dde26b59a1e5f94d5b245f47399d7a9d3db8d247037331a471c39b1d7e79e236c5a0732fea4c53b843d8eaff1f54ca155a816a193b7baa870fc458a5aadf76be

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz928C.tmp\7z-out\locales\sk.pak

Filesize
502KB

MD5
78bc785a75ee512391a9cb462a771c09

SHA1
229d39e017174dc0a8cefcfcc72b0feca94d6208

SHA256
ec15c82956ebddb7b246c78045ad414ed34ca97d890a915070e252c8715096b0

SHA512
96556f6072e69351e1bbce06bbf896b1ad53060c7cbaf7928eebbe0f610f5e8778b2b8b97a5a268b7942a1c8d1adc6bea0403383a2a5bb99049437e95d575ea0

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz928C.tmp\7z-out\locales\sl.pak

Filesize
483KB

MD5
e76e473c419c25768b08a95a2822918f

SHA1
0fa7e2fcabb03a8788f50f1d4b4eb383c833e9ba

SHA256
fcd27a9f5cb4b4be373da7076a8232006ebe020999fdf90d20745f16cd7ef223

SHA512
e39ae0acbb7d148d6ade676d92e83fa9fb433230bae4339c31693a538198bf0679adef51883b96f8dfbcc8593a982544c64a2b265897f35a693183b27070ea5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz928C.tmp\7z-out\locales\sr.pak

Filesize
320KB

MD5
9f48ff494bb7b73d086402e991d90a36

SHA1
d0b01a8ded0ad44a029e5a2fba0009f8185800e9

SHA256
1636797c49836672e27fbf1f9b610284503751001999a3bc821da52e8279401e

SHA512
07b301d7c65ed7227dc5d25e8d937a217102703e734853c502ae9f3376408a35d50a6dd44fb06a1aca678332a35ebdd36ec0204c4202f65141507280c2e8151b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz928C.tmp\7z-out\locales\sv.pak

Filesize
320KB

MD5
d2e1be1dc912f445a3599ba985f42596

SHA1
4bd42eb12f5116d0a2b14366ebd533de8cef5f0c

SHA256
303923925d224c09b04f01756b339583871d5271be6164075de206dede443760

SHA512
c8e297a6f0274ed1796f4969a45c6651fc694191906967d434b0fd0ea189663840bed2bd059bd08b7c6ae7455946755fa27557f02cfb53511752061aff2bc9fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz928C.tmp\7z-out\locales\sw.pak

Filesize
192KB

MD5
c36d6bb692466233fbdcb56e9daa2910

SHA1
eca7408062142005905ab8375956232d3ca3b89e

SHA256
c61d402ab161705916dd72ffe8a224cdb85566c61adfd22b6f7706c737928781

SHA512
b8c10c1075b0ec677161d9694ff427cb19e1ebea8a5fb20138259c822006f8f7dd75c2044ee8331918a7443a8f00bbb77b1027a2d6226201eaa2cb1d70aea2fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz928C.tmp\7z-out\locales\ta.pak

Filesize
192KB

MD5
2ad8b7075463d1df9ff0c52359243bc8

SHA1
dad95a43ecb8eccdc546c1e7f2b7effa6ed48c5e

SHA256
d3d2bcc77bc94562232453f82d900e809b107f448a01f03082a0d0e414c66368

SHA512
f6909fcd97642fb7648ec3cc4879085619f5fcb0e63548248fa814557db2a71968cf59565b5d37de3b1d40e3858a02236e6ab79bfdb497a6543008951cfd114f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz928C.tmp\7z-out\locales\te.pak

Filesize
1.1MB

MD5
5f9b7a945638b88e75a3175a7923119d

SHA1
6af614f2cbd72da2224f48a203a6430a623fc7ed

SHA256
3b476d2ce7c72c3a10170808020dc3f1a87309f9f725b08217c4716b28d10888

SHA512
3b66c9152ec032d6f2372ae5075cbfe7d0fb398c4bf173a7f8c76d91d9eaa816e6f839b90884533b46a9224e9fb52c4d439b3d1907885b8e9f80c5c55a852b65

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz928C.tmp\7z-out\locales\th.pak

Filesize
918KB

MD5
84ad3f888c0ec307bb7b8c278cd36757

SHA1
948a5f8b43d059280d5374ca6d66e8dfc6a76d49

SHA256
56665860fe6577fbe00543a47a15e10eceae83458815f2989d179e42af07f81b

SHA512
7001c0607df927145e40a605e2b97914d02712d11e09ca20339cb1aefb042a1f853fd06e78b76f6dc6f19b6df837bca12946a3470c6c064ca767af1db57042e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz928C.tmp\7z-out\locales\tr.pak

Filesize
465KB

MD5
0aedf5c2f6f4f49074a2adea454df4c9

SHA1
a48d9d8461e61170257897766dbd6906e754a0c3

SHA256
3f4658b3811b36f5cad794e48e6507335abfe78b0bfa0c80d1ef9c5d7bb410d0

SHA512
e359e446330fc154c16e34a7335174f372bce701faf85de8a5f4b432ce3e10c69f42c93b7182deac89bb4d29750d0dd525b6dcd74a5b7bd724f544d14ba44a79

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz928C.tmp\7z-out\locales\uk.pak

Filesize
798KB

MD5
64aa9344abd9a32f10d6c05a58eda4eb

SHA1
3286ee43f36e2232677b4573e8b4a3303c7df048

SHA256
ca20af5982ae706f5029467901d7d66f90b261f03c7d240d0d1ab2fca2b50a7b

SHA512
dd768b314da50b8ba5a006a4e56d70044c1af79960834722894d930f5347194ae7f9f5697bc4cd0790a79341635cb1df8c74ff45f74d1736049161af5b163efb

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz928C.tmp\7z-out\locales\ur.pak

Filesize
696KB

MD5
88eef2798dee8a361c3ea9bafaa02a35

SHA1
6f8d4ce422336ca5048ef35d6ece360a9b416d8a

SHA256
91318006c880e427417a2b2fff81fd451769a5536fa16d1dc185972137bc2d6a

SHA512
db36b58186f165ff3f746ac483f75b6fed596fad9b3f335e86b374b359e563407acf58ac7cded9420e4fcb91f31eebc8a91c7777ea59bafced8cff2f1c0e9a53

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz928C.tmp\7z-out\locales\vi.pak

Filesize
64KB

MD5
d3e32af45b3f2024791484a8f1e089e6

SHA1
54dbc4e0d9e024487003f381df5fb68d2389c910

SHA256
eb248cf28fee81032cedb108249d7e8885c341b5ba9f6440d397218723428c22

SHA512
9ffa69ea98a1a23785feec6e5132e497e6a71bb3a1954a77d16aae3bc2fe24d6330be70891875e50d2037e1eec9ba1ad5970ca1e4db42d30228eef98c7d3015d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz928C.tmp\7z-out\locales\zh-CN.pak

Filesize
64KB

MD5
bdddb0e4b51904092be45b626d9784c3

SHA1
1fe687090f6c463b4c59994f9d2695b8a8359653

SHA256
6b7b84f03617074a6c80aa2b2fb93cfe3decc34620904a2fe5e3a1ae38b4e0a3

SHA512
6d7ed724a89aae8bbfcdff2bf14f14723a7c33470a43371ef854ae2e32dd91e6c1555c33a82d4a84cc6b93b353bd52c36b00a1f1f2821002eb052ec38bb100b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz928C.tmp\7z-out\locales\zh-TW.pak

Filesize
42KB

MD5
d95e73a32fe7671e60788d0b2f592c0d

SHA1
ab387f11a5d6b63bf570d2eec3d961dc6135531a

SHA256
49c5d76753b1ce4c40df33f957097bdab470ae49c1d3ff46726cdddc31201cba

SHA512
d495b4847400ad6597f592126d9da0dffe58bc3a2706c6cd4b2662b59d3c751bd83cb9cbc9a53a4695ed2dbc709be46562a0fb3087ccb6724d6a716aadd5264c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz928C.tmp\7z-out\resources.pak

Filesize
2.6MB

MD5
a08fed44d651e253002bd51ad0af2a66

SHA1
65d695fd74527d320564938de170c4c5a019b662

SHA256
ecc772ce692c9a73c7c62bb647b96127a7ecdfc0bb1f3a754b3a1b17b5186bc5

SHA512
559ebdd3909dd000f312ea2726914a3aa780247db39a400f0a7adf860558b29e48ff666255f7047d3d7fffe402173430209fc4e49505280a164f22375c4fa29d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz928C.tmp\7z-out\resources\app.asar

Filesize
4.7MB

MD5
03bfeb2323e43cb530b2eac095fbdb2d

SHA1
2a693dd37f5e1a9b0c6187f43667e2a8f455604b

SHA256
75dfb3cd49a5aff63a92dd38e2a13db5f5d1d2becc46866dbd28aee4029147c6

SHA512
48a438e93b2d69dd33bbf6174f09f711c83183c32fb266e9c69e579d51b13569ffce76871965d5d42ddf68f7a08f8236b5a4169759604ea062818c0fc3658bce

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz928C.tmp\7z-out\resources\elevate.exe

Filesize
105KB

MD5
792b92c8ad13c46f27c7ced0810694df

SHA1
d8d449b92de20a57df722df46435ba4553ecc802

SHA256
9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37

SHA512
6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz928C.tmp\7z-out\snapshot_blob.bin

Filesize
262KB

MD5
40a3c2200e4126e8c47a7802532c9236

SHA1
212a4686dea5a467b7b6fa54397e42122b235f1e

SHA256
94aa518fc892ee9a0f1eb5fe35b60123ee61a5f848864b00519b96d8d5d9786d

SHA512
fa1a943822abe3737587d520654078117cae86c58fefe6dd6a09f4a08c09293e9547a0ad79c52f8638dfbb1c496df3d0e828ce414176c8fbb77113be41212866

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz928C.tmp\7z-out\v8_context_snapshot.bin

Filesize
581KB

MD5
264e3b574e4f86b1fc47b2427402e779

SHA1
4a4f9e7c3da262713e4cf7af6ac51822c56b5ef3

SHA256
ed559c6e81b6003b2057e5c1b0bdb5b28ca094b895ca86c69fe11c5c9e014f06

SHA512
144365d0fb83576aaa02ea6ecea51d7ba2cacb044eea568a08f65b98a83d3e7d7e693738e065e22f94bfd1165d0ea93a749dd1325d829257a9bb6607a9a927db

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz928C.tmp\7z-out\vk_swiftshader.dll

Filesize
640KB

MD5
8fa447be30ae6c4b8fc4d6a9512973d0

SHA1
4ae2588a5a93764c80954d86c6e73d8e78237849

SHA256
237b5a9b32ed67a8b47f35896a40394acf63eb87502eedc2421eef84aa782d92

SHA512
7defcce0edf44c441613ba68ba71a11f23a0720d275cc22fff29f49b0be6bd5de983152e0f09f011e7524ae1b03839bbf80d772746dbb8c3cfbab6ffd31927a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz928C.tmp\7z-out\vk_swiftshader_icd.json

Filesize
106B

MD5
8642dd3a87e2de6e991fae08458e302b

SHA1
9c06735c31cec00600fd763a92f8112d085bd12a

SHA256
32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9

SHA512
f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz928C.tmp\7z-out\vulkan-1.dll

Filesize
640KB

MD5
893096a952fc37f391566fc7df2deedd

SHA1
8615af24becbafebaedd5fab004da44a509af1c9

SHA256
cf04ff47d15ac4085091ee9e3d654acbe83678759db0bb8825950bf5a61cbbf4

SHA512
8b72182c43a21ba920dab88e567d35c0910f0214cc312b78237b0b54f5a0140c81e506e7d42dc2d6fe0c7ebad0398c18f85bdee57d75751a0355ca27883b3858

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz928C.tmp\StdUtils.dll

Filesize
100KB

MD5
c6a6e03f77c313b267498515488c5740

SHA1
3d49fc2784b9450962ed6b82b46e9c3c957d7c15

SHA256
b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e

SHA512
9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz928C.tmp\System.dll

Filesize
12KB

MD5
0d7ad4f45dc6f5aa87f606d0331c6901

SHA1
48df0911f0484cbe2a8cdd5362140b63c41ee457

SHA256
3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

SHA512
c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz928C.tmp\nsis7z.dll

Filesize
424KB

MD5
80e44ce4895304c6a3a831310fbf8cd0

SHA1
36bd49ae21c460be5753a904b4501f1abca53508

SHA256
b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592

SHA512
c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df

Download Submit
memory/5760-664-0x00007FFB48750000-0x00007FFB49212000-memory.dmp

Filesize
10.8MB

Download
memory/5760-638-0x00007FFB48750000-0x00007FFB49212000-memory.dmp

Filesize
10.8MB

Download
memory/5760-639-0x000001C0FEEA0000-0x000001C0FEEB0000-memory.dmp

Filesize
64KB

Download
memory/5760-640-0x000001C0FEEA0000-0x000001C0FEEB0000-memory.dmp

Filesize
64KB

Download
memory/5760-650-0x000001C0FEEA0000-0x000001C0FEEB0000-memory.dmp

Filesize
64KB

Download
memory/5996-630-0x000002322EBC0000-0x000002322EBD0000-memory.dmp

Filesize
64KB

Download
memory/5996-628-0x00007FFB48750000-0x00007FFB49212000-memory.dmp

Filesize
10.8MB

Download
memory/5996-627-0x000002322EB30000-0x000002322EB52000-memory.dmp

Filesize
136KB

Download
memory/5996-629-0x000002322EBC0000-0x000002322EBD0000-memory.dmp

Filesize
64KB

Download
memory/5996-635-0x00007FFB48750000-0x00007FFB49212000-memory.dmp

Filesize
10.8MB

Download
memory/5996-631-0x000002322EBC0000-0x000002322EBD0000-memory.dmp

Filesize
64KB

Download