18ce929380ab15f9e9d23d156ff3cff56b94e33641a40379f57e7adc91130c3f

Resubmissions

09/04/2024, 22:11

240409-131wtaea38 8

09/04/2024, 21:43

09/04/2024, 21:18

06/04/2024, 10:55

06/04/2024, 10:41

Analysis

max time kernel
689s
max time network
691s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
09/04/2024, 22:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

GalaxiaViva.exe
Size

69.8MB
MD5

62bda6829e7b08bd8f3c5b4057fa238f
SHA1

b3cadccbe3199cf72c8dd110b463137eed013e09
SHA256

18ce929380ab15f9e9d23d156ff3cff56b94e33641a40379f57e7adc91130c3f
SHA512

1966c014c929f8feff29f00aff837769b232890ad572b46d8056ea7b18de9b970ea8cdce0014fc2d040fc62476c1ffce222ad6b9209dfaec0bf535546de25147
SSDEEP

1572864:f85PaKHmqV6kLdNjObU5LwsagSbZFgagYjhSuyDV09arU7:uPaq1VddNaAwsa3bjhHyh09aA7

Score

8^/10

spyware stealer

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 4 IoCs

pid	Process
1608	Installer.exe
1484	Installer.exe
1244	Installer.exe
1932	Installer.exe

Loads dropped DLL 14 IoCs

pid	Process
3256	GalaxiaViva.exe
3256	GalaxiaViva.exe
3256	GalaxiaViva.exe
1608	Installer.exe
1608	Installer.exe
1608	Installer.exe
1484	Installer.exe
1484	Installer.exe
1484	Installer.exe
1484	Installer.exe
1484	Installer.exe
1244	Installer.exe
1932	Installer.exe
1932	Installer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
56	discord.com
63	discord.com
64	discord.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	Taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	Taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	Taskmgr.exe

Checks processor information in registry 2 TTPs 9 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	Installer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	Installer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	Installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Installer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Taskmgr.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Installer.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
2800	tasklist.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\15\Shell	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\15\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "6"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2\2 = 8c0031000000000055584c6d110050524f4752417e310000740009000400efbec552596155584c6d2e0000003f0000000000010000000000000000004a00000000001bf1c900500072006f006700720061006d002000460069006c0065007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370038003100000018000000	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2\2	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2\MRUListEx = 020000000100000000000000ffffffff	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\15\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "4294967295"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2930051783-2551506282-3430162621-1000\{6F66BFB7-0D63-46E1-B2CC-7C69299001A3}	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 01000000000000000300000002000000ffffffff	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "48"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\15\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2\0	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\SniffedFolderType = "Generic"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2\MRUListEx = 000000000200000001000000ffffffff	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "2"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "4"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2\2\NodeSlot = "15"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2\2\MRUListEx = ffffffff	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\15\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202020202020202020202	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\15	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac04000000c8000000354b179bff40d211a27e00c04fc308710300000080000000354b179bff40d211a27e00c04fc308710200000080000000	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\15\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\15\ComDlg	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\15\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\15\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	OpenWith.exe

NTFS ADS 4 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 498992.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 688151.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\DiscordSetup.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\KeePass-2.56-Setup.exe:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
348	msedge.exe
348	msedge.exe
328	msedge.exe
328	msedge.exe
488	msedge.exe
488	msedge.exe
2108	identity_helper.exe
2108	identity_helper.exe
1932	Installer.exe
1932	Installer.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
1124	msedge.exe
1124	msedge.exe
2372	msedge.exe
2372	msedge.exe
1980	msedge.exe
1980	msedge.exe
4228	Taskmgr.exe
4228	Taskmgr.exe
4228	Taskmgr.exe
4228	Taskmgr.exe
4228	Taskmgr.exe
4228	Taskmgr.exe
4228	Taskmgr.exe
4228	Taskmgr.exe
4228	Taskmgr.exe
4228	Taskmgr.exe
4228	Taskmgr.exe
4228	Taskmgr.exe
4228	Taskmgr.exe
4228	Taskmgr.exe
4228	Taskmgr.exe
4228	Taskmgr.exe
4228	Taskmgr.exe
4228	Taskmgr.exe
4228	Taskmgr.exe
4228	Taskmgr.exe
4228	Taskmgr.exe
4228	Taskmgr.exe
4228	Taskmgr.exe
4228	Taskmgr.exe
4228	Taskmgr.exe
4228	Taskmgr.exe
4228	Taskmgr.exe
4228	Taskmgr.exe
4228	Taskmgr.exe
4228	Taskmgr.exe
4228	Taskmgr.exe
4228	Taskmgr.exe
4228	Taskmgr.exe
4228	Taskmgr.exe
4228	Taskmgr.exe
4228	Taskmgr.exe
4228	Taskmgr.exe
4228	Taskmgr.exe
4228	Taskmgr.exe
4228	Taskmgr.exe
4228	Taskmgr.exe
4228	Taskmgr.exe
4228	Taskmgr.exe
4228	Taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
4228	Taskmgr.exe
4684	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 34 IoCs

pid	Process
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeSecurityPrivilege	3256	GalaxiaViva.exe
Token: SeDebugPrivilege	2800	tasklist.exe
Token: SeShutdownPrivilege	1608	Installer.exe
Token: SeCreatePagefilePrivilege	1608	Installer.exe
Token: SeShutdownPrivilege	1608	Installer.exe
Token: SeCreatePagefilePrivilege	1608	Installer.exe
Token: SeShutdownPrivilege	1608	Installer.exe
Token: SeCreatePagefilePrivilege	1608	Installer.exe
Token: SeShutdownPrivilege	1608	Installer.exe
Token: SeCreatePagefilePrivilege	1608	Installer.exe
Token: SeShutdownPrivilege	1608	Installer.exe
Token: SeCreatePagefilePrivilege	1608	Installer.exe
Token: SeShutdownPrivilege	1608	Installer.exe
Token: SeCreatePagefilePrivilege	1608	Installer.exe
Token: SeShutdownPrivilege	1608	Installer.exe
Token: SeCreatePagefilePrivilege	1608	Installer.exe
Token: SeShutdownPrivilege	1608	Installer.exe
Token: SeCreatePagefilePrivilege	1608	Installer.exe
Token: SeShutdownPrivilege	1608	Installer.exe
Token: SeCreatePagefilePrivilege	1608	Installer.exe
Token: SeShutdownPrivilege	1608	Installer.exe
Token: SeCreatePagefilePrivilege	1608	Installer.exe
Token: SeShutdownPrivilege	1608	Installer.exe
Token: SeCreatePagefilePrivilege	1608	Installer.exe
Token: SeShutdownPrivilege	1608	Installer.exe
Token: SeCreatePagefilePrivilege	1608	Installer.exe
Token: SeShutdownPrivilege	1608	Installer.exe
Token: SeCreatePagefilePrivilege	1608	Installer.exe
Token: SeShutdownPrivilege	1608	Installer.exe
Token: SeCreatePagefilePrivilege	1608	Installer.exe
Token: SeShutdownPrivilege	1608	Installer.exe
Token: SeCreatePagefilePrivilege	1608	Installer.exe
Token: SeShutdownPrivilege	1608	Installer.exe
Token: SeCreatePagefilePrivilege	1608	Installer.exe
Token: SeShutdownPrivilege	1608	Installer.exe
Token: SeCreatePagefilePrivilege	1608	Installer.exe
Token: SeShutdownPrivilege	1608	Installer.exe
Token: SeCreatePagefilePrivilege	1608	Installer.exe
Token: SeShutdownPrivilege	1608	Installer.exe
Token: SeCreatePagefilePrivilege	1608	Installer.exe
Token: SeShutdownPrivilege	1608	Installer.exe
Token: SeCreatePagefilePrivilege	1608	Installer.exe
Token: SeShutdownPrivilege	1608	Installer.exe
Token: SeCreatePagefilePrivilege	1608	Installer.exe
Token: SeShutdownPrivilege	1608	Installer.exe
Token: SeCreatePagefilePrivilege	1608	Installer.exe
Token: SeShutdownPrivilege	1608	Installer.exe
Token: SeCreatePagefilePrivilege	1608	Installer.exe
Token: SeShutdownPrivilege	1608	Installer.exe
Token: SeCreatePagefilePrivilege	1608	Installer.exe
Token: SeShutdownPrivilege	1608	Installer.exe
Token: SeCreatePagefilePrivilege	1608	Installer.exe
Token: SeShutdownPrivilege	1608	Installer.exe
Token: SeCreatePagefilePrivilege	1608	Installer.exe
Token: SeShutdownPrivilege	1608	Installer.exe
Token: SeCreatePagefilePrivilege	1608	Installer.exe
Token: SeShutdownPrivilege	1608	Installer.exe
Token: SeCreatePagefilePrivilege	1608	Installer.exe
Token: SeShutdownPrivilege	1608	Installer.exe
Token: SeCreatePagefilePrivilege	1608	Installer.exe
Token: SeShutdownPrivilege	1608	Installer.exe
Token: SeCreatePagefilePrivilege	1608	Installer.exe
Token: SeShutdownPrivilege	1608	Installer.exe
Token: SeCreatePagefilePrivilege	1608	Installer.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
4228	Taskmgr.exe
4228	Taskmgr.exe
4228	Taskmgr.exe
4228	Taskmgr.exe
4228	Taskmgr.exe
4228	Taskmgr.exe
4228	Taskmgr.exe
4228	Taskmgr.exe
4228	Taskmgr.exe
4228	Taskmgr.exe
4228	Taskmgr.exe
4228	Taskmgr.exe
4228	Taskmgr.exe
4228	Taskmgr.exe
4228	Taskmgr.exe
4228	Taskmgr.exe
4228	Taskmgr.exe
4228	Taskmgr.exe
4228	Taskmgr.exe
4228	Taskmgr.exe
4228	Taskmgr.exe
4228	Taskmgr.exe
4228	Taskmgr.exe
4228	Taskmgr.exe
4228	Taskmgr.exe
4228	Taskmgr.exe
4228	Taskmgr.exe
4228	Taskmgr.exe
4228	Taskmgr.exe
4228	Taskmgr.exe
4228	Taskmgr.exe
4228	Taskmgr.exe
4228	Taskmgr.exe
4228	Taskmgr.exe
4228	Taskmgr.exe
4228	Taskmgr.exe
4228	Taskmgr.exe
4228	Taskmgr.exe
4228	Taskmgr.exe
4228	Taskmgr.exe
4228	Taskmgr.exe
4228	Taskmgr.exe
4228	Taskmgr.exe
4228	Taskmgr.exe
4228	Taskmgr.exe
4228	Taskmgr.exe
4228	Taskmgr.exe
4228	Taskmgr.exe
4228	Taskmgr.exe
4228	Taskmgr.exe
4228	Taskmgr.exe
4228	Taskmgr.exe

Suspicious use of SetWindowsHookEx 20 IoCs

pid	Process
2028	MiniSearchHost.exe
4684	OpenWith.exe
4684	OpenWith.exe
4684	OpenWith.exe
4684	OpenWith.exe
4684	OpenWith.exe
4684	OpenWith.exe
4684	OpenWith.exe
4684	OpenWith.exe
4684	OpenWith.exe
4684	OpenWith.exe
4684	OpenWith.exe
4684	OpenWith.exe
4684	OpenWith.exe
4684	OpenWith.exe
4684	OpenWith.exe
4684	OpenWith.exe
4684	OpenWith.exe
4684	OpenWith.exe
4684	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3256 wrote to memory of 1608	3256	GalaxiaViva.exe	76
PID 3256 wrote to memory of 1608	3256	GalaxiaViva.exe	76
PID 1608 wrote to memory of 2564	1608	Installer.exe	78
PID 1608 wrote to memory of 2564	1608	Installer.exe	78
PID 2564 wrote to memory of 2800	2564	cmd.exe	80
PID 2564 wrote to memory of 2800	2564	cmd.exe	80
PID 1608 wrote to memory of 1484	1608	Installer.exe	82
PID 1608 wrote to memory of 1484	1608	Installer.exe	82
PID 1608 wrote to memory of 1484	1608	Installer.exe	82
PID 1608 wrote to memory of 1484	1608	Installer.exe	82
PID 1608 wrote to memory of 1484	1608	Installer.exe	82
PID 1608 wrote to memory of 1484	1608	Installer.exe	82
PID 1608 wrote to memory of 1484	1608	Installer.exe	82
PID 1608 wrote to memory of 1484	1608	Installer.exe	82
PID 1608 wrote to memory of 1484	1608	Installer.exe	82
PID 1608 wrote to memory of 1484	1608	Installer.exe	82
PID 1608 wrote to memory of 1484	1608	Installer.exe	82
PID 1608 wrote to memory of 1484	1608	Installer.exe	82
PID 1608 wrote to memory of 1484	1608	Installer.exe	82
PID 1608 wrote to memory of 1484	1608	Installer.exe	82
PID 1608 wrote to memory of 1484	1608	Installer.exe	82
PID 1608 wrote to memory of 1484	1608	Installer.exe	82
PID 1608 wrote to memory of 1484	1608	Installer.exe	82
PID 1608 wrote to memory of 1484	1608	Installer.exe	82
PID 1608 wrote to memory of 1484	1608	Installer.exe	82
PID 1608 wrote to memory of 1484	1608	Installer.exe	82
PID 1608 wrote to memory of 1484	1608	Installer.exe	82
PID 1608 wrote to memory of 1484	1608	Installer.exe	82
PID 1608 wrote to memory of 1484	1608	Installer.exe	82
PID 1608 wrote to memory of 1484	1608	Installer.exe	82
PID 1608 wrote to memory of 1484	1608	Installer.exe	82
PID 1608 wrote to memory of 1484	1608	Installer.exe	82
PID 1608 wrote to memory of 1484	1608	Installer.exe	82
PID 1608 wrote to memory of 1484	1608	Installer.exe	82
PID 1608 wrote to memory of 1484	1608	Installer.exe	82
PID 1608 wrote to memory of 1484	1608	Installer.exe	82
PID 1608 wrote to memory of 1484	1608	Installer.exe	82
PID 1608 wrote to memory of 1484	1608	Installer.exe	82
PID 1608 wrote to memory of 1484	1608	Installer.exe	82
PID 1608 wrote to memory of 1484	1608	Installer.exe	82
PID 1608 wrote to memory of 1484	1608	Installer.exe	82
PID 1608 wrote to memory of 1484	1608	Installer.exe	82
PID 1608 wrote to memory of 1484	1608	Installer.exe	82
PID 1608 wrote to memory of 1484	1608	Installer.exe	82
PID 1608 wrote to memory of 1244	1608	Installer.exe	83
PID 1608 wrote to memory of 1244	1608	Installer.exe	83
PID 328 wrote to memory of 3404	328	msedge.exe	87
PID 328 wrote to memory of 3404	328	msedge.exe	87
PID 328 wrote to memory of 2824	328	msedge.exe	88
PID 328 wrote to memory of 2824	328	msedge.exe	88
PID 328 wrote to memory of 2824	328	msedge.exe	88
PID 328 wrote to memory of 2824	328	msedge.exe	88
PID 328 wrote to memory of 2824	328	msedge.exe	88
PID 328 wrote to memory of 2824	328	msedge.exe	88
PID 328 wrote to memory of 2824	328	msedge.exe	88
PID 328 wrote to memory of 2824	328	msedge.exe	88
PID 328 wrote to memory of 2824	328	msedge.exe	88
PID 328 wrote to memory of 2824	328	msedge.exe	88
PID 328 wrote to memory of 2824	328	msedge.exe	88
PID 328 wrote to memory of 2824	328	msedge.exe	88
PID 328 wrote to memory of 2824	328	msedge.exe	88
PID 328 wrote to memory of 2824	328	msedge.exe	88
PID 328 wrote to memory of 2824	328	msedge.exe	88
PID 328 wrote to memory of 2824	328	msedge.exe	88

C:\Users\Admin\AppData\Local\Temp\GalaxiaViva.exe
"C:\Users\Admin\AppData\Local\Temp\GalaxiaViva.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3256
- C:\Users\Admin\AppData\Local\Temp\2eh7OsCz34xb9Y2OJiJ9AmLoDxd\Installer.exe
  C:\Users\Admin\AppData\Local\Temp\2eh7OsCz34xb9Y2OJiJ9AmLoDxd\Installer.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1608
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2564
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2800
- - C:\Users\Admin\AppData\Local\Temp\2eh7OsCz34xb9Y2OJiJ9AmLoDxd\Installer.exe
    "C:\Users\Admin\AppData\Local\Temp\2eh7OsCz34xb9Y2OJiJ9AmLoDxd\Installer.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\game" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1684 --field-trial-handle=1880,i,9081154581198253511,12749657007688920140,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1484
- - C:\Users\Admin\AppData\Local\Temp\2eh7OsCz34xb9Y2OJiJ9AmLoDxd\Installer.exe
    "C:\Users\Admin\AppData\Local\Temp\2eh7OsCz34xb9Y2OJiJ9AmLoDxd\Installer.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\game" --mojo-platform-channel-handle=2084 --field-trial-handle=1880,i,9081154581198253511,12749657007688920140,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1244
- - C:\Users\Admin\AppData\Local\Temp\2eh7OsCz34xb9Y2OJiJ9AmLoDxd\Installer.exe
    "C:\Users\Admin\AppData\Local\Temp\2eh7OsCz34xb9Y2OJiJ9AmLoDxd\Installer.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --user-data-dir="C:\Users\Admin\AppData\Roaming\game" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1768 --field-trial-handle=1880,i,9081154581198253511,12749657007688920140,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:1932

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff996a3cb8,0x7fff996a3cc8,0x7fff996a3cd8
  2⤵
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1872,14566338498142053103,7178140769704306312,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1888 /prefetch:2
  2⤵
  PID:2824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1872,14566338498142053103,7178140769704306312,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1872,14566338498142053103,7178140769704306312,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2692 /prefetch:8
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,14566338498142053103,7178140769704306312,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,14566338498142053103,7178140769704306312,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,14566338498142053103,7178140769704306312,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1896 /prefetch:1
  2⤵
  PID:2796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,14566338498142053103,7178140769704306312,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4548 /prefetch:1
  2⤵
  PID:2164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1872,14566338498142053103,7178140769704306312,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3592 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:488
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1872,14566338498142053103,7178140769704306312,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5392 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,14566338498142053103,7178140769704306312,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3000 /prefetch:1
  2⤵
  PID:3832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,14566338498142053103,7178140769704306312,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2716 /prefetch:1
  2⤵
  PID:408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,14566338498142053103,7178140769704306312,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4692 /prefetch:1
  2⤵
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,14566338498142053103,7178140769704306312,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4896 /prefetch:1
  2⤵
  PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,14566338498142053103,7178140769704306312,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:1
  2⤵
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,14566338498142053103,7178140769704306312,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5760 /prefetch:1
  2⤵
  PID:872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,14566338498142053103,7178140769704306312,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5964 /prefetch:1
  2⤵
  PID:1872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1872,14566338498142053103,7178140769704306312,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4904 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1872,14566338498142053103,7178140769704306312,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5764 /prefetch:8
  2⤵
  PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1872,14566338498142053103,7178140769704306312,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=6348 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:1124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,14566338498142053103,7178140769704306312,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:1
  2⤵
  PID:1380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,14566338498142053103,7178140769704306312,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5960 /prefetch:1
  2⤵
  PID:1768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1872,14566338498142053103,7178140769704306312,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6936 /prefetch:8
  2⤵
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,14566338498142053103,7178140769704306312,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7052 /prefetch:1
  2⤵
  PID:1052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1872,14566338498142053103,7178140769704306312,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7044 /prefetch:8
  2⤵
  PID:1144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,14566338498142053103,7178140769704306312,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6780 /prefetch:1
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,14566338498142053103,7178140769704306312,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3572 /prefetch:1
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,14566338498142053103,7178140769704306312,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5812 /prefetch:1
  2⤵
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,14566338498142053103,7178140769704306312,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6032 /prefetch:1
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,14566338498142053103,7178140769704306312,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7120 /prefetch:1
  2⤵
  PID:3660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,14566338498142053103,7178140769704306312,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6156 /prefetch:1
  2⤵
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,14566338498142053103,7178140769704306312,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6712 /prefetch:1
  2⤵
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,14566338498142053103,7178140769704306312,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6632 /prefetch:1
  2⤵
  PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,14566338498142053103,7178140769704306312,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6140 /prefetch:1
  2⤵
  PID:2560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,14566338498142053103,7178140769704306312,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:1
  2⤵
  PID:3148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,14566338498142053103,7178140769704306312,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7412 /prefetch:1
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,14566338498142053103,7178140769704306312,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7512 /prefetch:1
  2⤵
  PID:1052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,14566338498142053103,7178140769704306312,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7368 /prefetch:1
  2⤵
  PID:2632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,14566338498142053103,7178140769704306312,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7544 /prefetch:1
  2⤵
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,14566338498142053103,7178140769704306312,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7136 /prefetch:1
  2⤵
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,14566338498142053103,7178140769704306312,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6744 /prefetch:1
  2⤵
  PID:3608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,14566338498142053103,7178140769704306312,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4884 /prefetch:1
  2⤵
  PID:2972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,14566338498142053103,7178140769704306312,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6408 /prefetch:1
  2⤵
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,14566338498142053103,7178140769704306312,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7016 /prefetch:1
  2⤵
  PID:1496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,14566338498142053103,7178140769704306312,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6764 /prefetch:1
  2⤵
  PID:864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1872,14566338498142053103,7178140769704306312,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5544 /prefetch:8
  2⤵
  PID:3176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1872,14566338498142053103,7178140769704306312,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5716 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1872,14566338498142053103,7178140769704306312,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:1980

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:112

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5060

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1964

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2028

C:\Windows\SysWOW64\Taskmgr.exe
"C:\Windows\SysWOW64\Taskmgr.exe"
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SendNotifyMessage
PID:4228

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
19a8bcb40a17253313345edd2a0da1e7

SHA1
86fac74b5bbc59e910248caebd1176a48a46d72e

SHA256
b8024fbed11683ef4b53f5afac0ff691025b7eecca0f6a95737da1585558227e

SHA512
9f8780f49d30aad01b28189804329aeca6ad2b7ffb6be505d40bb1af7802bb62622f518cb1c43a5815bbbb46638f6c52aead3d68f14fa957d18157edb42e95c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
96899614360333c9904499393c6e3d75

SHA1
bbfa17cf8df01c266323965735f00f0e9e04cd34

SHA256
486e4b4bb11f664c91c675e73cfeabe53b5009ae719459813be17814cd97e43c

SHA512
974735b40a9f92b40a37a698f7f333590f32ff45633c6e619500e74ec274bc20bf7dbc830b1685777b714d37a3ca103d741ee056f4ff45ef08c07b38a7895df7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000064

Filesize
4.2MB

MD5
86a0d58d2ae89c639d940dbda48308df

SHA1
1280f427d149a8c5ca797a9ea29e711a3fa2b5ef

SHA256
92529dc0e6449eca21688601020455505462819217b8e8d51f6e7b1dd05a69ef

SHA512
9fffac37da58215108392f8532a2691b8e556175c0e5d8227aad8ab6a923cacb0e0eeca11911bef79b8ab340196c4cc4400e76300c73dbc7993a60386b8dab6a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
085936170cb45320f9aedb8ece7bdb2c

SHA1
fae1417932f2e66333971204a4cd17608af0a71e

SHA256
7a9dfa31d0d56300e490a8015399f465a5f1441c8af4ff5ce0b6a1b765c8826b

SHA512
fb1f3e4cdbe8895b5309c4511e1ca1bb92f751dd7d9dee978c0d105640f34d7e1477240652e8ab98437705730f34641e281bfd7025fee4c1647834c14b5df430

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
6KB

MD5
3ceba5a6d93945498b5e2406058fffe8

SHA1
72d431e3fef6918ae88b9fb3490f50fa61bf82a9

SHA256
6968bbdbb544356f3601326f2da9ba5972177fdc1209a74c8817bc80bbf0d61b

SHA512
ac9ff9943a4a87dc968c6cb5b81dc56c147c379be820b5cb5b81be9b6cb54e7d2541ece79f9cf7c82b0bb88b6d598fa631263741be5c801bec08e1f84438e49b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
0df9190dd13ca72af31c5cab453ebddf

SHA1
e2ae9c225624696d53149d882daf1b990025d7ed

SHA256
7f6d0a9865e8eb32586f46c2329cf31f5dd4d48e274106bec4d60e96149d2462

SHA512
b5961312df2205e5e09e2c2b98fbb8dfb81b0301015682ecced50f4014fa1905f8e6a57d3bae8e8b14c299432b87d6ac0e733565d48eb31be9272f5afc07fac7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
79c9d016636162567f84f4bef49b77db

SHA1
e249a24ea7df556c81a3b66655a9e80e06768df0

SHA256
db584a6bc8a41ecf648adc695c7bb3305f87db7d923ce8ac294f210986866ea2

SHA512
5ffbf348ee653af16af8c228d78471d53eb024f1a25bf91e74f47b95b11a6b474fb0072a730f2e31b1db8ecab6d4d232dbee3fd0c7b6e8d1ce174ba27ba21759

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
3814b118369f87af4f44ea2e1329aee8

SHA1
a29e4904066911e27b06f01e6a5fdcac3d5960c1

SHA256
fb86b12dac9553e8576f4367b40889b2dd520323d76b0660d764242cc40bf5a6

SHA512
d97abf4ddfa9430b3b9b9e18a2cc5d5f50ddff6aeff39ec3b1cd2b3a54ce6542ca3a38ade7789cf8fba848d2cdc81a469962fa9a72bc3bf6772b023a141fc2e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
05c03d9a39f56b9a8ec87c92d18a8068

SHA1
d18e686e0a3737fe7614adf408c49ccad2a235f2

SHA256
8f2653dce67977ca5dca4f085258d871d841d87e42a9d69989012e80a0a65c4d

SHA512
b0a99a526220e40ed2aa3f78d53cebc7979af047f8504d9ee174456943ac17c5582f621c79127743ab43e86c27ff2d88537a73d6d6bb2c40e61a84e3de1a149d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
6ee0c3e131f82d8b0f2c32d44d47aff8

SHA1
6b199742bf1d2f0f7731ddbc24b4e9a1e31de700

SHA256
cd1bf19b5ffffd9111f15fa5dea56e13c9a95b4239cdfea7928c9bfbd95ff385

SHA512
f1d7495c5832d54722dd13e1ce95f682e483a717d1a907d0e9004fd9c9a472fc67a31949775846b717689c0e28f7507253b45f391dcb04b02846eaa3f8b0dc0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c218bffd483ad7a6ae4bb53d3d9f29d7

SHA1
6b8c177c4be58e452cb8c11cc283e19ebeebab70

SHA256
0f9d3742386981121791cb90a528ea995bc1e81a955e5ade35db9e5914db64c9

SHA512
b1e2b27ec1a4e72f570d4b411757c0b6980bee252b3a113861cfe0aba38b3c0cb2ff25443306c8707a17d124e2e3e8a1b50b771aa5d2493005958953c556bc6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
5637c0dbf96c674743215fa39f4c85f6

SHA1
d3827d5ecbf67a5cd4deb7e391b75c548a589680

SHA256
2c6571d08f7f35eeaf108596eda31883b564d0f74a6d33b6b0e171bb48ce42d2

SHA512
7982b81043d20b83f49b8efc01b59c6aec63461520383911203371107da4567f8c8f0d9601fdc9d09a36d6fac04ec9a55feec318788af397a9e0e1f9c53cc58d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
ee06a6259ddb60e2be987364f69b9a2d

SHA1
bd3bd136196e647791aa707e22dbf93153cdc607

SHA256
97aeab1d3dc88cc32a7cf6a44477f83bc3ff98d36e3566ff8306c80eddb46223

SHA512
e6b9408bee690ddef687357c420e700ba17c7eaa2788ea522dfc8ca483498a85d180ec6a56a607be474e66e09e2c91afc06cac1d5f26f35a6e41a91c71434d70

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5a7253.TMP

Filesize
1KB

MD5
87f10c00db0ede64e85982bec2b29405

SHA1
81fa79d63631896c845a4122caa0e54019ae630c

SHA256
bd1d5103f9cbf1c6f487124237746fb59653c617fe4309ee5a5933ea824c0779

SHA512
d8521ef09829aa53cf53f5b487bbc258c44512160f35cd714d8b02935c01cb3ad8307baf483dbe9d40b622d2f1116cb1c1f37b4ccae0f7458cfad603c0f07b69

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
11cfd20acc6e4681dbf651adc6b799ca

SHA1
bc5e449a4e0e7b62570deb073107906e9c950609

SHA256
6bf4a4d6cfdb02609d98777986f71a9447d301c4f86e63e27474653ca4d15c2b

SHA512
396ef7e61bbb63a9a2e9747222537fee40e53163ca98c0754ad3a3a7362a0a610219f15d505fb157120bc0ccb382f82ce6e479083264fb8fe21a184e677d554d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
4423cc99f8579ecebbc4a13dd4ec3e4f

SHA1
067a0e9f8897fd669aa32a3a3aba36249d405962

SHA256
51895b3ab71606f411b995456e9477a48866941ac91297d6ceac06cefb8c9831

SHA512
dc2825c8c92c7f175d98a8f41cffb1328145b69264c51d6900d2dc5d993aff0e8dd002e316fa4f8c79b29d4ee6d47aae2ece99843b1763c1782191986e464d54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
cdecb0440240719a8dc0fe0233a7270c

SHA1
6bf3e7edda7ecc5b0ef932aaa5ac70b30d396cf1

SHA256
733384f163975be6d4cba310a1f2bf84dd4a380a8a5e65457c04258b8841d944

SHA512
e7d2d3171fc361a7ca3b45fd11b2f27771dac08071d2d48c4eb11fea4d2fa7e69a7f86d366bb9af1810609f160fcc8b6ffb94e742d8998a3dc002e2f8dcd51f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
2180de3a271f353893d8b24a826e1a7c

SHA1
de3f9fd985d21b570ad32e8d62d26d5f41b8e74a

SHA256
c41edfc35af82194a175314f671ccd9b92569b50846faa83dbe63bccfb6922ba

SHA512
0f7715a891c3b6965e1a693b31dab90981ab9c25f37e7cad147f259edc13ffc2493914f6bbb3e75fa1c5257850c7f4ddc759ce0464d20469558fc46003f9b5b9

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
10KB

MD5
eebfb84605e05222e3ad98f4b9f62db2

SHA1
36ddd440df5b2776281ad245a6a57e7a183c09a0

SHA256
4a9b70f7113d5c252937ad9bbfa110031124ffe3643648db3f944111b61bd559

SHA512
90e6f46d36c30783af4032f72beb58eb157849a8197e39945542da8a0c1313cb87e91f18a732f5718ec6a676fcd790458419bcc22c608824416fa6df14bf5ba6

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
10KB

MD5
405fc71d90ddaa1a11a46a82f45ec8a3

SHA1
145d5254a4838d1a93869d23586b9d13362d0895

SHA256
0ea7613fb69bc81d4d2f515d22ac9b132e0a82c227785d225bb2eee0f147fc9d

SHA512
39803466888e1a00257a17dd9651c3c3b8035dda76f3c86d59a83045be87a210f88538c815d2a0076444eaac6140f9e5d5bd133a6a1150abee9907320e78e8fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\2eh7OsCz34xb9Y2OJiJ9AmLoDxd\Installer.exe

Filesize
81.8MB

MD5
f7b22a18f020e7e0af4297210923aa83

SHA1
a4044b459218297e76aa7b63c3fa3b948178e359

SHA256
73b473271ba5fc5b456db372f68042dfd0340a2b9d1c524d952c422e5a173bd8

SHA512
e2c266e8798aa32ab06782b137b81941104ddfdd36cc18cb9920f1cb41890231183b93b216b7c72d1b863e684d4c0369e351e312032ace81d173e57590f06f69

Download Submit
C:\Users\Admin\AppData\Local\Temp\2eh7OsCz34xb9Y2OJiJ9AmLoDxd\Installer.exe

Filesize
79.8MB

MD5
686f4ad8882142fa2c8dc33864f7ff44

SHA1
ec098dfa6436af80e950cb98d8d2babd2dc60cf5

SHA256
1a870002c291419ae729aedbe85e313a5db84a07f7b206f30cf9bfd1c1b4aa4c

SHA512
8bb2f9d6218e0948fa8ff78d4d7f3800e7e3442c1821c22113a7ae71501ef13c06fbaa0573387ae2537eac4256f19f806c26fd17e63ebf66ad19c35aabafebcd

Download Submit
C:\Users\Admin\AppData\Local\Temp\2eh7OsCz34xb9Y2OJiJ9AmLoDxd\Installer.exe

Filesize
82.6MB

MD5
6eca706d9ad3852af6f590d564c85acf

SHA1
5403bb047f8f1033d8eea29fc442245039433440

SHA256
d1ba9760e348629608f5ffc1011c75b9a8b67c4e0059d2d617cef677e564b97e

SHA512
de7e82f51a5f0f9ba83589a90f84af166380a69ca22a6a194ec54caad6a1f11d8943f6fe810e506add8fa9de8caea8b467c2bb07e80ba81ac0e3af12049f846d

Download Submit
C:\Users\Admin\AppData\Local\Temp\2eh7OsCz34xb9Y2OJiJ9AmLoDxd\Installer.exe

Filesize
77.7MB

MD5
e13f0d99e548f13d7f5c621e361caac0

SHA1
13786c3585728fb1891061276fbf0514025ed66e

SHA256
d4175b895b85ba4653673ea76babb3c2c56016ba623cca0138736347aefbb527

SHA512
27e3653f65c8a09df67d0e8b41ca1e40fd6d32e17b506139abd47aa8b6d3330555ab14c29fb3c5516d07fa1959ed83b596797db384c534a0be53edab8187d657

Download Submit
C:\Users\Admin\AppData\Local\Temp\2eh7OsCz34xb9Y2OJiJ9AmLoDxd\Installer.exe

Filesize
1.2MB

MD5
9451cdb3300ca733f1be2d8cd6fce837

SHA1
9a291160236319a00e6a59388510c354b1e785ad

SHA256
4dab3a700d27a5d8bfd8d8e4a2b8deec33bd08ff499a16f8e558ef229b9475d1

SHA512
abbb0503b0ba2b4ed0834e33e6b8c42727ffa6611d8de0d449a0da8073480e9ae3536799058c3d6418012c2e98521f40ce86bbb4f1d83b1fc5346319368eafb3

Download Submit
C:\Users\Admin\AppData\Local\Temp\2eh7OsCz34xb9Y2OJiJ9AmLoDxd\chrome_100_percent.pak

Filesize
126KB

MD5
44a69827d4aa75426f3c577af2f8618e

SHA1
7bdd115425b05414b64dcdb7d980b92ecd3f15b3

SHA256
bca4401b578a6ac0fe793e8519fed82b5444972b7d6c176ec0369ed13beaad7b

SHA512
5c7bdf1f1deb72c79b860bf48f16c19cb19b4d861c0b6beb585512ad58b1bc4b64e24edfcd97233e5b91dcd0f63ed1c7b278d22ec062fd0dfe28fe49cae52049

Download Submit
C:\Users\Admin\AppData\Local\Temp\2eh7OsCz34xb9Y2OJiJ9AmLoDxd\ffmpeg.dll

Filesize
2.1MB

MD5
35d08702d477f18e61e05e2bd534473b

SHA1
d75e4fcb6dc4f96203959725cf1973070b4fd56f

SHA256
502e836706f4fd7bcf2e97496219ecc569df2ce6684e1a27166c7d27188a6d6a

SHA512
8f54e141344d85fef057bb85d6a1f5c1f7c4542af4ea8a7dd0d218bac3d81518767f6fba879df251b8f97fa9123335e259824b2d44911e19392d75459b7fa41e

Download Submit
C:\Users\Admin\AppData\Local\Temp\2eh7OsCz34xb9Y2OJiJ9AmLoDxd\vk_swiftshader.dll

Filesize
3.6MB

MD5
d7fa7998e82001b55ea7ae41fbe85cac

SHA1
7de17938b3f59aa01d31949d189028fe0bd74b82

SHA256
f55cedb0eb0cf7fe1fec1d3aaced1857ba6d39e72221a00fe5182f7c907b81fb

SHA512
d3590d81f011e99dca3c7f4a95678e7d48ffaa1717620265313ac621b2e28683a49d2d576b28bd7cab4e299cb3b7c4edd500660fba6a5d722206b1b68f3ac287

Download Submit
C:\Users\Admin\AppData\Local\Temp\7e4a950d-cb3a-4caa-bb97-c6b10ee9da44.tmp.node

Filesize
654KB

MD5
36e0027f9e250df48c14d0c46cc69df7

SHA1
8c8c4dd7725a0ec877541d48ed5ceda97d8a3bd1

SHA256
1f6a635c64ef5e04826545b78d4796f2f00493c7fd7b06c9cdea956fd71afeaf

SHA512
eba9d6dfe72a7d606159a30968627f6bee22f81f00c722d40058ab6c880c880e040fb9f418e5154f30f20f5f8c9254c3ed9cfa93ea1f2eefa9b5d7ed4e9fea84

Download Submit
C:\Users\Admin\AppData\Local\Temp\b947f082-d383-466c-b3b9-4186d68851ed.tmp.node

Filesize
1.8MB

MD5
beb8d911d40e8fe94770d9d341e0de11

SHA1
d24d31e5b44a4a80969e2a669fb9b0ed42cfd479

SHA256
ec41fc2fee2abcbf0559965501f54aae47cff24a87204fd3a85d86c7d53d53c7

SHA512
079c43c2533fa35411247dd091c5caedb4a0dbdeee7b8f9fbbba6f521d760856822d373f1e6682eff10bebc63168cb4a445aee7b23047e4d784ab28891d07bfe

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr4AB6.tmp\7z-out\Installer.exe

Filesize
81.1MB

MD5
cd3f44418e8704bca54822f1d6c68a6c

SHA1
aa721fc2312ac45cf90e06fc3b6ec0f28f693998

SHA256
7acde697ba4b1ab5dd6bc277e791c510bda88104f2cea24d57fb8a989c7434b8

SHA512
67e53cd738b123315b5841b2afa6bb17f25ce30182f6bb31d88581ecc98902e07adef2c92d94348945ea6bc0338c6ab1eff90f96981c9e928e32861044705234

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr4AB6.tmp\7z-out\LICENSE.electron.txt

Filesize
1KB

MD5
4d42118d35941e0f664dddbd83f633c5

SHA1
2b21ec5f20fe961d15f2b58efb1368e66d202e5c

SHA256
5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d

SHA512
3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr4AB6.tmp\7z-out\LICENSES.chromium.html

Filesize
6.3MB

MD5
6e638956244aaded2c92b77f9d421a81

SHA1
f5269556b6fe04cfca5a1da21af718641708a666

SHA256
652457f1b5ec60a81c8aff095366bcc068402c21eb380ba8286366bc4e9a029e

SHA512
f0e173761a6acd13b6c1b5eb896c361487a770a54f1842ffaa80c8ff780b37a1e801169786776c4afa7d9c75cd968dbaddabff082de55cf75cc4f9d871d08bc1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr4AB6.tmp\7z-out\chrome_200_percent.pak

Filesize
175KB

MD5
9c379fc04a7bf1a853b14834f58c9f4b

SHA1
c105120fd00001c9ebdf2b3b981ecccb02f8eefb

SHA256
b2c25fb30fee5f04ccdb8bf3c937a667502d266e428425feeb5af964f6167d48

SHA512
f28844dba7780e5f5c9d77ac3d29069dfcd6698447d5723886e510eadd51d6285e06adbda06bf4a69f841afc161c764cb2e5b9ad2c92f0a87176709b4acd2c13

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr4AB6.tmp\7z-out\d3dcompiler_47.dll

Filesize
4.7MB

MD5
cb9807f6cf55ad799e920b7e0f97df99

SHA1
bb76012ded5acd103adad49436612d073d159b29

SHA256
5653bc7b0e2701561464ef36602ff6171c96bffe96e4c3597359cd7addcba88a

SHA512
f7c65bae4ede13616330ae46a197ebad106920dce6a31fd5a658da29ed1473234ca9e2b39cc9833ff903fb6b52ff19e39e6397fac02f005823ed366ca7a34f62

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr4AB6.tmp\7z-out\ffmpeg.dll

Filesize
2.6MB

MD5
9eaea9979eaaceb2874e898c753974f7

SHA1
89fd07f1af4a235ea699006d9128b9f071d4cf61

SHA256
96b6556b2130751422b836db4e2a18517733e4d92a6628dd96fed4ef7c335ab2

SHA512
1ea096a2f4f533e9ca648d35e7b10cc1ab6c44f0ec8000fe55f2de187dec8ae0fb6e88a5fdff093ae6ea5334ec66e10b8201becae1ebb7471808b27b0f419247

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr4AB6.tmp\7z-out\icudtl.dat

Filesize
10.0MB

MD5
cf9421b601645bda331c7136a0a9c3f8

SHA1
9950d66df9022f1caa941ab0e9647636f7b7a286

SHA256
8d8a74ca376338623170d59c455476218d5a667d5991a52556aa9c9a70ebc5e5

SHA512
bc9601e2b4ab28130bfadfd6f61b3ed500deb0bd235dc5ca94999c09f59d10bdcbf278869a9802f918830041f620c88e2c3b506608ade661db48ccd84c1977eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr4AB6.tmp\7z-out\libEGL.dll

Filesize
464KB

MD5
504f695201c11a3c3fea7794b2e30438

SHA1
0709b6d703235b945c323fd59f72ccbe5985ab95

SHA256
1b90b893e82dea90caa19eaf773dc989406b8ca518dee803053ea9359d49c0e7

SHA512
dc1b4c633f728eb051adea4c18959cee9ab3900441606055eb565afecc4cba7e3c50c3fed4d058839ad1411c0195d53fdb86281af3159c1faab0a7db70467b4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr4AB6.tmp\7z-out\libGLESv2.dll

Filesize
7.0MB

MD5
549f919f0ba15ba2554a749d19459809

SHA1
88af358173817e6da196be70c0773b4d07b28524

SHA256
ce1ed0fb50875472fb3e0a9a357e243a80f374b18be406dd2d8db90da5e75909

SHA512
0d1473f948737297fa54985b6ea18860cca20d437d4e978c53ca09078f40956f7076ca1671735ade0ac4e3cb24eec0388d015b7fab1a70ca041673865abeab06

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr4AB6.tmp\7z-out\locales\af.pak

Filesize
327KB

MD5
c9312ff081e600e5fb4483b46ddd7c23

SHA1
1ff05a6a06cc73caf2d7545a3821d90c228ac0af

SHA256
b1987cdcbb8d76598422aa1739a246ed6690dc1b211f950fcbf2f040491ed7a8

SHA512
20c136b44770aa0e06259687656675a3e14310ea4e8ba214726b216bc1bcad6026267bf0132cbca642c0b5c49293386d0a1bd93ba40e1c33b648ae70416e8898

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr4AB6.tmp\7z-out\locales\am.pak

Filesize
531KB

MD5
e8bac983607c5432f789afdacdda42ac

SHA1
95c26f47f7102be338263fd7f7e365632651f22e

SHA256
ee363b88697a26d486c77bbf05f5f7f62d4b40c235e1d85e11448083070576f7

SHA512
5e26f40c8dc088d21b9b6a01041ece3bd4b2899ee33fdd85be995545c7a24860fdc9c672da8c9345a08891e0bac04ccf4d65de543f4cfba0bab0ae3fb32354c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr4AB6.tmp\7z-out\locales\ar.pak

Filesize
574KB

MD5
d1d99f4f2045531edc47d37a367402bd

SHA1
825385e524ece779c641a4ce2a57d14ff126d509

SHA256
bfa2a3c3ebb3c6afbca42cb70b4da8f997068d511cf40ee8a952a893b8f9d7cd

SHA512
4255b02c19ed373d711068a2d4639d462372071cc2aadb6afce459d9fe19bda21ffcbf1604e4937617cd5fee996f9b3786be1c2bed4dc4919d849c7a988a6ac0

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr4AB6.tmp\7z-out\locales\bg.pak

Filesize
608KB

MD5
96372403a9ded96f3a699262029a4580

SHA1
07069b20fe303f6eef1fb6c8c0a19266a0c705c9

SHA256
6c10b64d31e0dc2c4befc6703ac17343ca473b4350cfb3c6e01833f505b69590

SHA512
0df60fe13818f0c3c6838e77686c5de9fa03b97cbf0943f7a2a4ae2f3a0890d3d64b3a7652d8c81c23de876ac92e4c6b71d584fb106c3520c96ef76ba30250fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr4AB6.tmp\7z-out\locales\bn.pak

Filesize
780KB

MD5
cb203032925be270222dc2c20fe771e2

SHA1
2f2f20bbbd07ee01cc996247bd9c2f40037dff80

SHA256
297d52b252df0912490ddf26fa58706895e70c2a0f3f09d0dc756706720095ef

SHA512
052be75c51051949c84216566b462733b61026ba74e212b000cbed7d93cb852e74ae83d64d2eaadc3093af4265b6783184cf8e0368a75e077d4b75daba40f9b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr4AB6.tmp\7z-out\locales\ca.pak

Filesize
371KB

MD5
de21c7d001b771d4d59e2acfdd67dd44

SHA1
ef5870e9cf34416edbec6aa76a6feb77b70b9acf

SHA256
78bbee9bf6c95d239418037fd4660d081ebc0f369e727e613b6b652e380e6dd0

SHA512
3276a84a4b4d90b47789a7ce6a3ae34afec187145a438fbdb7f398152b182e97ba10acda4941456ea2387c03c101bc2b1716a8950897ea3be180b3d8c073902e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr4AB6.tmp\7z-out\locales\cs.pak

Filesize
377KB

MD5
3e2c49143f4718ddd9c1c74f8599fac2

SHA1
7cce45de66a3895c3493b998fef7bedf045b29e2

SHA256
08e40f5efc616cdc0588fb4b1a706d997c69d17ddaf97eb91a4aabafaa11cee6

SHA512
a849ca0d09e0d4c025d9de6c8008c13e13581961c321f53a552deeaa210db891914386fd51673615aec8b5d8d68a921a968db5d0fe447963892ceb0948861e3d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr4AB6.tmp\7z-out\locales\da.pak

Filesize
342KB

MD5
f3a47e259c59de0aabef03e6b5a263ca

SHA1
c45bd961c8bb84331d652f4399675b365f5dfe23

SHA256
13c9583127d9d723801c946039e60f72dbbde898dd23fb9f675b9e299d0ce72a

SHA512
4249456e572403249580905f1b4b4471b6a8d84c6c71201c42adc862d4e0d33f957ae1057109e900a10a029a8dfc45257b0e0e283ad9eca21a30498a0795eff2

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr4AB6.tmp\7z-out\locales\de.pak

Filesize
367KB

MD5
cfc9d90273c31ccf66d81739aa76306a

SHA1
ecab570041654b147b3dd118829e2f7ae668f840

SHA256
8bd127d689be65e45bb8d2a2ff66698200da97835809c6b56ec9e2929b70618a

SHA512
c9a5058b34c4045ff1b7ae25f1f47bff14d06b3a97b7b1f30da65618ca7aeb0638d79f4e1cea4773cd92d9dfa7f9d2203e5734d0cfe11ee2d2a460d6cec18380

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr4AB6.tmp\7z-out\locales\el.pak

Filesize
664KB

MD5
8f5a15560710db2af852512b7298b93e

SHA1
30a13ebef10108effbad8c24b680228660658415

SHA256
bc07e403272a4d65305fe24a827404d7b931d01cda547f8c07a840d19e591430

SHA512
e3cedc0eaa82b10a68a40aca8ec1379a6bb924766e1c5abd97e39c621dcbc195d6c1ff80921c2320f0f1c87d160bc2a6258108399876339e5104f98d90a861de

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr4AB6.tmp\7z-out\locales\en-GB.pak

Filesize
299KB

MD5
05ac84aa6987eb1f55021b6fba56d364

SHA1
58cb66bba3af0c6cc742488ccc342d33fc118660

SHA256
e1e357c853eed83fb6c4133f8f4df377a8eda4fe6f0e55395f21c5ab6e38faa8

SHA512
c615e1eb01412c5e2c0402242d442a6cf08965318d1c0d261ca5bc6df9acba5efa2c87ade20e1e4740d2239ea56d1ce4d3fc7a4c3eabe81b876ecb364b3e91b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr4AB6.tmp\7z-out\locales\en-US.pak

Filesize
302KB

MD5
3fef69b20e6f9599e9c2369398e571c0

SHA1
92be2b65b62938e6426ab333c82d70d337666784

SHA256
a99bd31907bbdc12bdfbff7b9da6ddd850c273f3a6ece64ee8d1d9b6ef0c501c

SHA512
3057edfb719c07972fd230514ac5e02f88b04c72356fa4a5e5291677dcbab03297942d5ecdc62c8e58d0088aed4d6ea53806c01f0ea622942feb06584241ad2d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr4AB6.tmp\7z-out\locales\es-419.pak

Filesize
366KB

MD5
13c6d0a268545541f325375d431b41ae

SHA1
5f5c41348f00c5e5539d261c2b76ae6e3ec7af83

SHA256
943fa8774ade38d57349a5d27869097a782bc06bd34c40864a85ba829457d127

SHA512
09cbb2b21304ca8afa8b760b738adb5422e83550085f1aed8e8590eeef04a2b0e131e1ead6723c3e85383630c483d7720e55f71305ff4821d7822fe6d7aa4252

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr4AB6.tmp\7z-out\locales\es.pak

Filesize
367KB

MD5
c8086dc25cf0a3c978b2c3b37edf8d67

SHA1
7b6d2ce8b3cc5a33ab2bcd23114fe65ccc568e7a

SHA256
11ef2c0229c1fe1c10be08e3d5f36c973bc3c272f37b40e05c534a118757461b

SHA512
230e6999a6fea1df3b2708eb331a2c25ca53677b3453745ff9cc7fbbc013b69148af5609166720255a2db7e63b25e2d0c599fb07057a6b47bf61f63ea9db9e01

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr4AB6.tmp\7z-out\locales\et.pak

Filesize
330KB

MD5
054865950b3b9e8312a7f9490268eaca

SHA1
28b0176112eddb7af58386b4f8aed4a49b9a2661

SHA256
3599e7138a24a31839da877cc9718b9c0c9522437ea93a6222a119080f108d14

SHA512
bfc72f19ad1a52c0da82409accb33a27b2844ed29010207268c7d695ad7562a8867a87b70ac50142909b50b81a5c84d6f6a43968353ae7a72bc042aea8cbb59f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr4AB6.tmp\7z-out\locales\fa.pak

Filesize
535KB

MD5
c27431f2de37b9643b83e383f7eae5a8

SHA1
16d068d9738e1aa9b94658299a4eac3972520864

SHA256
bb28ad47e95aefaa2d8d7b6a7f449f9707cfadbcd4c21bad8bd8a6578108d2cd

SHA512
4ccc46dc7756ea0e60e6d278bcac1262a54ba03742fd0eb4d9f1f962486394fa56491844871dacb4cb0501c6f594334d3f23f3db82bfdfa1f938e1ae609d6600

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr4AB6.tmp\7z-out\locales\fi.pak

Filesize
338KB

MD5
aac0554a39bb1ae91e2ed4246e04c30e

SHA1
031785024765eda1534fd9504eccbe1b471ae618

SHA256
df8cefa4831fc2fdf817dd6d49a6373edee4f51f23cf990c690e72ce348f69bb

SHA512
a6afc9464047c75157dcb8ece086c1c5bf4dccb48d33da24e35c43110f300cfea503c4cca093f3d4bcc7a0fdcb306138da5be288ef646881b625751e40d93689

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr4AB6.tmp\7z-out\locales\fil.pak

Filesize
379KB

MD5
f989a7215cac1e3fb4759e5fba9aef67

SHA1
5ecf35f160e1f8242b3bca163673e24cf6d77403

SHA256
448bc8eae353c188ffaa4c2466956598ad807f0f0aae7f12e1bc59584e1aac2d

SHA512
b872beb5b1c2702f4eae616f633318b4575f573c06a3f1f0f1e1ab83585a52caf2f3c788c0c3a0d499c381fb7f06a3ea355b8686ded2ed1e392662f2746db01f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr4AB6.tmp\7z-out\locales\fr.pak

Filesize
395KB

MD5
13968778147dad5af68fdb7464ca517c

SHA1
42abb9873c472a82d400e6896e90731b7cae06b5

SHA256
7af39af49846fba6d6b8ee18b2a212f1323ebc1cff1af0053194d01d8d5433f6

SHA512
c1f54ccf4f82e158173d9db8464adca64a88f8ddee23afbb51d80535b4f25f138dac16a337504ca3ff8c3dbe9aff05ecc2aaa40afe8d77bbbd4f141b07e39100

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr4AB6.tmp\7z-out\locales\gu.pak

Filesize
755KB

MD5
7b476c423ce29e61b0b21d7b6a2a56b2

SHA1
5558dcec5b2580345b0797f1f2ea41952417335a

SHA256
047da4dfadcfc6bec8f4dc7d250b1757caf31a23bcfa2ea3e1f3b1cdbe9a3995

SHA512
a494ab32e45cf74e2b7e0424b4e3740470c5c6cfac8f6cc980a681eb8c21cab76255391b6884134593dc7b1029ffd861f74b47130533232881c137c41ef92cac

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr4AB6.tmp\7z-out\locales\he.pak

Filesize
468KB

MD5
f4dad4f97b5f75d6d7219d43f630c2b9

SHA1
ed8c790b3b5e3faf683aa978895f266eea5b823e

SHA256
6649a844f222cfcec01e75d3de3cb3658f1347ea3851d31b8124597b87e7b57d

SHA512
f00e7e38ec0da1c110b4142dd13b3cae8b912c16518eeb4cfd7f19a0cef2c6601ec1e4959597066703b12b7dffb44fd918c7170231c2b42e40b0d90241b85133

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr4AB6.tmp\7z-out\locales\hi.pak

Filesize
787KB

MD5
1185163466551aacae45329c93e92a91

SHA1
0dcbfed274934991966ce666d6d941cfe8366323

SHA256
eda355e3785313e3d982c1d3652266dce1b6e08832056fe58854b825e0712ca5

SHA512
6fad3e24eb868acf78db0591c7ba77abc84e92cda28e8bffee435ea89940a8607e7628c6c5159349377a8d933f373db2dfa4e5715ca404bc3e67fd4a0f22a606

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr4AB6.tmp\7z-out\locales\hr.pak

Filesize
365KB

MD5
04fdc1dac2cae614b0f566310dc83bd0

SHA1
74e460e19a5e9c8b6181fa37cb9085f93bbc6233

SHA256
bada5828fc0d80c842d1409b54e8da516ae737ca30d86658b3fad5c8ace4722e

SHA512
a07bebd16f00b0b46059a7b80454664757687a59903bc36cb837cfb55e69bf7f683157372f74ff8355ad50c3b747c9674ee942aac95a9804c39acb3841721d24

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr4AB6.tmp\7z-out\locales\hu.pak

Filesize
395KB

MD5
410d8966721ff8817eb3a57f95a4b885

SHA1
f0fbe70c772bd635b0c4a927420e15b96dae05a5

SHA256
688312f38488c7256370b1517b84963a3ff886b31692cc504fe169db241a43f0

SHA512
d0aa167ee919589ff3b80640e8db4c6d11f9159e4a246082f0a564482789011c260f124b9a7102649d998c6a89cbff58cffab5a40e33769b990e64d6cc703378

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr4AB6.tmp\7z-out\locales\id.pak

Filesize
324KB

MD5
0e82cf23475ab7328741670f4dfa3093

SHA1
fd854e31f4ab212d0b3bca676420d5600d8daa83

SHA256
21368245d99265e760b1b57a3169feb72e6b5099c3f1855155d147b2f788eda4

SHA512
52d694afeb3e7272740192e6b4cab9acab460ae6e66912f090b049a1f431a5c17a4c3d037fc9c450b8a224ed793605e234b4d649a95289770997acd43b5dbb32

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr4AB6.tmp\7z-out\locales\it.pak

Filesize
360KB

MD5
9fbb2f5d9c70d9e46368538853929f75

SHA1
45daceb422478c5a7b7b61f5ee68cc08a19f2ac3

SHA256
13dd077e5e8c8b04ac0854e4466ee074df67c74cd29cc48a0c2c9f96f768fad5

SHA512
77d8607ba52190258ed2e7c6e43a44bad1669294a441cc6ee9d91fa28c26c6675225e41cc309200aee01fecc1a0d369a8e4458c0095c297ed237bba50798c4dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr4AB6.tmp\7z-out\locales\ja.pak

Filesize
440KB

MD5
67a379c826f0eb60750bfba0b8e10468

SHA1
62662d8efd773b18c99169752996b11f30a64ca3

SHA256
2c5457b0fa6fe41b7b524aa726dae4dd69e7072864f73f211c731810d00b9323

SHA512
38c44dd6c83362cd118543b7619811c671283618a3081f07a015f8110388d71b7767eb0a7a49c37c8e2e9e900dae6aa7f8560e5494afe6b29e01ede402e4944e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr4AB6.tmp\7z-out\locales\kn.pak

Filesize
872KB

MD5
8a3427385226ab72e8421d84225f7adf

SHA1
701a85bc6bca0ed33dbe1aa3a617ce26576c7421

SHA256
c315e791770cea204c7e49ef5b68fa46fe42864a33e77fa5a1d42f87ba85124f

SHA512
310719fb102c1f892d354f1478bba06e856bd45da08416be970a0a76e44c7d81aaa9ddd878234b2348b625e0d18cfe7c966379115f35d51f4ee78a986c1243b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr4AB6.tmp\7z-out\locales\ko.pak

Filesize
369KB

MD5
3340fd0a5e8f97f122e1d6e9a2052ca6

SHA1
9c8504b78633b6d6e445723b351a08392916c7d0

SHA256
3ee7d79af9ec226bebfdd9d79907f1bc97d528d2009dbd0db23d74ad655e0256

SHA512
07eb8dab24ea8545cdaf38e35bc23a71a33bf87a1c0ac78ac564c103c6ae53357de2d4fd635b22995cefdc9d8e8241c66d78dd44d68a9f2f251be77c0afa7704

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr4AB6.tmp\7z-out\locales\lt.pak

Filesize
395KB

MD5
c037c0d80be2c913c20e3fe96d9cdaff

SHA1
8dfd2a42fb2e0041d6ac9b90c78b3cad0283c757

SHA256
e7c133a8dc438870f97112587f5f223f5fcae4f1510874b95b72cc281fa150fd

SHA512
0a90dd7d39759e1e63205a827ed6611dc6e54b37c668795123de7f35c446ee41174675a0d813974dba7353c0a1cc4320049d4fd1368cdfccb9cf9afa47fcb4f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr4AB6.tmp\7z-out\locales\lv.pak

Filesize
393KB

MD5
b14f9d61e064903bc73d18e40846e1ac

SHA1
5a3da27335194707ffeb07add46662df1fefd76f

SHA256
6e99a3ef823a651f5187c5c549a6885002a2f8523c014f989ec6d53d87e7aac7

SHA512
dab97f5d75d5f60c82969ac01dfc1ffffc0ec5fbe2063c6df0535130ea1432363be1475a440b6075440f68217cd6840a63bcfea0409586d755ff8e57c029baf3

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr4AB6.tmp\7z-out\locales\ml.pak

Filesize
915KB

MD5
fc33673850c17a865cae7695fd3eb5b5

SHA1
72f3241ea35554c881e1849ba53b8f64b04502c1

SHA256
6295eb0b0d05d26b3fdaa19ad390ba30f267b7af7a60a214db558dcdbdb436c4

SHA512
6845293c0cd4ee1aa94972da1d58fd7085da5dd664d4031005200ae38fc4ab20f2c5cf44fe07ff80e003ef072f7f1cb23a452d6ce47124aa1efb3d26ae86b279

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr4AB6.tmp\7z-out\locales\mr.pak

Filesize
743KB

MD5
d1f1c482775f60a868ca094108e3ac3c

SHA1
ba4396e5b585735e8505263ed42884876bdb564f

SHA256
f63460da44e2f71c237b2555eda621c8c211c13ae68927c27ad121f03daa0599

SHA512
2686c406b29750ee39b83247e4a4e6a0ce3325c1284ea11fc986696b43c672eeb0c5259c4834e4419c131941b9d1d35e53b05606168c766d27a614f49e223dae

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr4AB6.tmp\7z-out\locales\ms.pak

Filesize
339KB

MD5
52c793391de0e946616d31f7d5b90761

SHA1
50e014d9715df658221edea402609d7b09c9fb10

SHA256
ad044cb5cc56f8cba19ea3319081c194661f072d6b1193509e3690769bbfc2d3

SHA512
d5db7fb23779bf1b258f949ce6af5115adf3bd93760041ef70f1e2f599ef3be6a7a1ec871b18858a1eaca906b98b0a04348a427d5ecd26bc99d8e6d986843478

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr4AB6.tmp\7z-out\locales\nb.pak

Filesize
332KB

MD5
f15c568a9ed8b2ca497571453ce6bce2

SHA1
957ffec56ce14f33fa75f493936552751e966d16

SHA256
18512064afcc3fb5a0e1f36400e592ff34e8c6c9a7ed0bbe3432255c4759ad8c

SHA512
3bd27f9612b39836e5e7654e6f07c2fd5a31f2c338db36daa51e2c1462986cf4b651d555245ee2e97acd044e44a5beffb8cc9d56c1af11f52fedf9f7fbf7da97

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr4AB6.tmp\7z-out\locales\nl.pak

Filesize
344KB

MD5
ae7b592c5885481f7bd8c382cf90bfa5

SHA1
fccf9ecbc0e9f3259e805a243928d80e8f3fa672

SHA256
bdb8fb52d8032a8f9cf5336698ca715b4beb4d567bf3657e12a47c36020ae256

SHA512
95dba1b426e4c396c4c4730d8cfc3f2fd1430864fae753423799142516c1d424c8534963676a6fad4061887754cc2b24fcbd0327f67de67b39420b96019e11f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr4AB6.tmp\7z-out\locales\pl.pak

Filesize
381KB

MD5
cd2d3406f70bbc5ed427295da14cd92d

SHA1
cb9828b0ecf5db97cadb259b746590f03ed7c013

SHA256
65b6dd63aaba1692f36774413d372f6c6c66088d7ec4009a2dbee1648ca133f1

SHA512
bb18f667991900854d8e021e38b799828117f56c90d4d90bac1675a1786e5d1fa33186850e35f75de433f4c5717ac19cd81a424a692aca8d311d98d748e6e568

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr4AB6.tmp\7z-out\locales\pt-BR.pak

Filesize
360KB

MD5
e4b1fb0229dc7a913012cb5313123c3c

SHA1
6c137b91712593040c6e02bedb82d90d85cc2b84

SHA256
7b171f2a6d46295147a8d10e475048bac4346c6a5162b32a0336334baccad520

SHA512
7224d310713d94f56aafbdb80a4a7ddab5e19dd18a7880f93770b86204e323072aa8e879d2f7e1fea25a6506836e8ca9ed73068e76f4ff9b74c0ecfb807c37cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr4AB6.tmp\7z-out\locales\pt-PT.pak

Filesize
363KB

MD5
1df331064ff162d97dd13a78372487b3

SHA1
8c98bf3d6964f667df6bbc326c8bcb95ac264441

SHA256
f374bd5c54596aacbc35f47bdd4c9ab4045bebdfa479ae386fd2fdd2d0041216

SHA512
0dc4913b56900940d17c0780dccfff344b2b7f918b8c00dd1beb3fe020b7f61bb646ac636c152ef0bcb20a3ee9c4ee9a1ed6e01c9b7efa414022e4da3df5f160

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr4AB6.tmp\7z-out\locales\ro.pak

Filesize
372KB

MD5
efd3112d1eac487bb3dd2839385eed39

SHA1
d7a45ffdc10d24425c8b1590ef1239de34737a2b

SHA256
c50f824e63806e5782b693f7d474c48684b9e5174e93463a9bc2876c94990879

SHA512
f604f37f59c17e7a231ecc55121620138ba3c458f532889cd4b70a6046f0aa3ca0d53e0f342977d5ae0c1edf23706806ed429f72442ff90603b896125243e406

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr4AB6.tmp\7z-out\locales\ru.pak

Filesize
606KB

MD5
ac07a58897f578635b29c5d7bddaad5d

SHA1
d506deb804112aa690c60995613cd9e49496dce8

SHA256
44f0cbb2d5414b6dfca6abb40a435200670e2a71607b158fcbaba67fd6b3ba08

SHA512
ecfa1cd37782e76a5685a385222b87884dd29ef63059f389ce8efce7e814ba50ef8ae03c7bd7b18bd7a8502f29ff6f1fa168ce6395baff2b59cbd434ff400cec

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr4AB6.tmp\7z-out\locales\sk.pak

Filesize
383KB

MD5
989d000fbe286c0fd4bfb35305b52f48

SHA1
5a30a2cc1abe9977b1ffc4c4712452e6d55bc7df

SHA256
dbd82a2a08f8e9ba9581b2672bc49e0fa5c89f073b58f152225f9e2815228ddf

SHA512
ed57c66237d5226d4d5cb63e98248c0df9d381ef86b6d4ef339523f430c54aab14f84121e05e9fedaf273323ec04b8a539c0aeb791245858890126de2ce38283

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr4AB6.tmp\7z-out\locales\sl.pak

Filesize
369KB

MD5
234e628a62f822bd7b3546b91e79cab2

SHA1
10f48382495bdbfa3b30c15b91768817df13d828

SHA256
d0415bfa061b36a6eb93fa2c78563448da8b63c91e0523086c7eb2714933ab99

SHA512
51234fc3fb5199a3a86dcb7ca68d3c471f1b97897b1a9f90139cfff9846a6c6fd039a0c817e7611e0e59637746cc51045f6ce493cd6f2d4e144fec1c6a561456

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr4AB6.tmp\7z-out\locales\sr.pak

Filesize
572KB

MD5
aa4e2e54b648f66794f485318651b730

SHA1
18c1d5badcc5c05dfcf9e68df66f53c69e33e0ab

SHA256
d459c1a781ddc344de76558211983dd07d47e3ca6cacffb518043bd78dc48fbe

SHA512
cda7b189f48f28463d045174f3641f16737288b159adcf41da0c131a05a396a40e562b2f0aa10b08d323290f19d864755f238b074a698efa3c573d2b5512948d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr4AB6.tmp\7z-out\locales\sv.pak

Filesize
334KB

MD5
c5437bb175fed93e85c5e7caf76ff352

SHA1
0d74f7df049ea73a47fe93b75c98e356b9bdd4b7

SHA256
3f0acf6f6319636c3e72cdc392b7b80ab0cfd8ae1a5a8e319624e4b46bcd3c42

SHA512
00af14e7d89a12f4f39fb45a3f9c136e20c06752f98fdedbad426ac9a5b820260a329059659cd82fd089ab1d94c1f51ab4202fb6b142b27538d0139e67877239

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr4AB6.tmp\7z-out\locales\sw.pak

Filesize
351KB

MD5
e37fc1c3dce484bd0ce496f548f14a43

SHA1
02b088a11363b0a4c0527053669af32737f1403b

SHA256
dea6947693fceb6457801d912ea7c716add3c0cfb4c34782a9cfa4c4e06b9402

SHA512
c5c39d54f4eb6b0659903ce9b5c8804a750a254bf88cc7c6e729e7813ecbbcc88df882af9294b5b795ef5b8afe8f1a60fcb46b3929a9b2cdf41c84188e5852b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr4AB6.tmp\7z-out\locales\ta.pak

Filesize
899KB

MD5
5002d84bffb908a2dcc7e1b69836c265

SHA1
4cbbe387a6744aa6c51b15b5a3a223135a3f6115

SHA256
e0421b4cf2736bb465ec02cd85c2df09809f86479cb7624195373f25edbcedd3

SHA512
c2a4a46a27304eb080b066f049d2eae733470dbf0f8107220049eaefdd73fd8b41abd1b02b4a2ee6934b4cae18de97bca5360022a8e295427a0bd63603bec410

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr4AB6.tmp\7z-out\locales\te.pak

Filesize
836KB

MD5
b1a4d471fd8af54dfb8ff252246bfde1

SHA1
2044ee38f8d8d76176a735e726de189feac14985

SHA256
f53e06181c9fa0f6028906a7388fd4e8f000ffb7277330634462433d34572395

SHA512
18248d3fa8f4cc409788d28a244889230b074fff416ba5998f25f3b67ad0c627172a5e7e3947e61e72ce28a5b4cb2134d6627b6252b3d282b54f84b424136c87

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr4AB6.tmp\7z-out\locales\th.pak

Filesize
704KB

MD5
85f59bf2f1167e34ab2b666608805420

SHA1
f0d8e8fc644c15c52c5f9d3419f88e6072799736

SHA256
4fe2b7b6886e3ce068be0b7a0a71d45756eb797eda1e7d4fad52ab8a370e8336

SHA512
86d6061895c996ad1caa3f3871c014b656e7ba7bb91f05c72a591cb5877c3db61965bc1a5094dcf7c4127d11f8106622355464704fd0695372627d8400a16ddd

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr4AB6.tmp\7z-out\locales\tr.pak

Filesize
357KB

MD5
da4c47bef469c086cdb7e5b74310304a

SHA1
9f0569659eb21261003a232d5d92d3aae8d47b7a

SHA256
5df18798a35b502a18fb4f82e9b03b7ca100903ecd5d192ab2a3f0bc7646c366

SHA512
55c745cd8d0aba6f4a2454c494b80eb4cc74f733771e7279b9033d52716551a85154e9eb31eebe17dce05ba71e0213e581c4b98b59a6b88aa8b9569c411e397a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr4AB6.tmp\7z-out\locales\uk.pak

Filesize
605KB

MD5
229325584cd98c8408f7fc5c5603c6de

SHA1
dd31356ede30833a138fc3a6b8838cef89344a00

SHA256
3fb15957c77f3635aa7cfca796b045a1ee1f1abfc0c12c163cfb537364f3c80a

SHA512
3b57f57649877700f03aee73bc6e6e863ad65ec7c13b9851a3fc7e5d06d11ea154ce087d0a64dc689cfc55aca9eb6492154c9eb18130f6d17b8d94ac8c37a6df

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr4AB6.tmp\7z-out\locales\ur.pak

Filesize
532KB

MD5
6310a289e55b1022f12b4f3cc29fe831

SHA1
150d81ec8db4d9aec6c0e83e5577dcb7f1956b38

SHA256
06a0c18d978b54dd163c7f77b7ee0f2ecf3607c5dc14032326f21b4a1f304d81

SHA512
acb538fce25486e6a01401aa0e9204a6f519cd1dfbca48663d6142e1fb6280bab271dfd2b4c5ddc858de6920805e539b791c48eddcad124d0aae298d479dcf48

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr4AB6.tmp\7z-out\locales\vi.pak

Filesize
424KB

MD5
1b1b14f542bb4a9f014d1801fb2e4007

SHA1
0f56c35b2515fc92690126c54d57aa763a5c3288

SHA256
f1602637e7f3e0a908d7a9a3f630b8dd38bfd26704cc64ef432d2c88a1ee7017

SHA512
3e98c44ad74d905fee06851eab16576f6261a15336f1c1f625f646af725988b75957ed89c16876ec6127150e2b28778a5b65f897b9540ad1e4cec98be705cde7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr4AB6.tmp\7z-out\locales\zh-CN.pak

Filesize
308KB

MD5
32b1659c7abe8a01a702e46c69f0a3ce

SHA1
43eba1f94417109834f25006a81653bf635ce9a0

SHA256
97fe793b325d0c27669f62235bd157c51a3e1aeaffba30e7fe028c9d64939c5f

SHA512
72b932cb9e19788a67a1a7beaea0b9b076af0a5f1c568f9d2d6e8653d3c9fd4bc17db1a39db1f12b8184112b8e67125f443b8b2b60f31e62e16ef9c6a8e2c4a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr4AB6.tmp\7z-out\locales\zh-TW.pak

Filesize
305KB

MD5
14f3f547a54713f91251b38459a096b5

SHA1
02ac592a2eb4a7c6631dad5aae83726ef9c33ec0

SHA256
280ba35171dfb6a54efb13fc4ddedc13a0283a9a6eebff4c15275767beb4ba77

SHA512
0ad8c6a6eb0dcbcbbf6f9e114c93bc2cf6004dfa9ad7b68dba31c2a9856c0a56acb66507f65b1823434b1ad362c1ac812b72c254e5329a2858e888a761f45ec1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr4AB6.tmp\7z-out\resources.pak

Filesize
5.2MB

MD5
e0edee97edec5b289b676de680f03b9a

SHA1
d52ee45e0c2342b7df59856c6200ea1f31cd9ed7

SHA256
9d82f0f1edcaa1673e05002453f8e28516d15b5579186f29d8f968c56a38b655

SHA512
1cafb5921b65605ca3d05af863d2367fdfad72e91dd46b973cee1e548984abffe47b87f92237295aed2d5aaf68cfe0fcdc16731204bfe29865610959aaff7a94

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr4AB6.tmp\7z-out\resources\app.asar

Filesize
72.6MB

MD5
35664125ceae5c220d53e620470c4025

SHA1
1317ebf222d45b1f5d8a5eb0350c17945d99c027

SHA256
9f42416459251545464284229560a8ffb46e8dcd48947896deab1b6075dea236

SHA512
612d34be546cde3b18465d7d695efdbe08068cc37b9a49245100ae31ca71b9eb6f33d1dbd6103139d01ec69ff826a8bbdac35dc346b97c4d9bf32e21fe9017b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr4AB6.tmp\7z-out\resources\elevate.exe

Filesize
105KB

MD5
792b92c8ad13c46f27c7ced0810694df

SHA1
d8d449b92de20a57df722df46435ba4553ecc802

SHA256
9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37

SHA512
6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr4AB6.tmp\7z-out\snapshot_blob.bin

Filesize
409KB

MD5
8002a6944aec744f9221dc274351d76d

SHA1
b826d401967c6bc8c10dd951b35d7bd7c6d27cd3

SHA256
bb7f7f750b1ec275a009a96651868c0cbbf7828d80809c5dca945b3ec665a912

SHA512
ce510135d0dcf2a95b524f6000795a3a5a29d396bc8a98e6f1fc9b8f0b92eb5585f6fda956e9380fd4f75e9a1644294f1b354a2bdcf26523cdc305460bb028f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr4AB6.tmp\7z-out\v8_context_snapshot.bin

Filesize
710KB

MD5
e15880fb71f70bd29f9c31d002bfb883

SHA1
9eb1aff0e07ecd0e7624e0c1f8a626eabc7354d6

SHA256
2aa2fdf8da0b239d058ddf13827f4514af2c20ecc8f30fedf0bee8c54a4e7439

SHA512
4121b8d4fa065a1fc06f4a33210fc8a10af349e28906d1dc1c4907aa27fcd89771609319fc8b37bcd024b4fb682f45518cc2fbda5bde05ea9f32fad4fe78f1c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr4AB6.tmp\7z-out\vk_swiftshader.dll

Filesize
4.8MB

MD5
6de7d79b89044a3c307b84b7e77085ce

SHA1
8b8f1b4391b8bd2481314e209b34ca00b0171f10

SHA256
5377dc1e04d1dafc540565c2e82e80066603794e94a433e8cb76cdb2e269ccc7

SHA512
1560accac1185a5ca334373d7521a1834b2d26160fe26797b135badee0f1220ab023bbaee48c69de7d8f869534d772dac31c67e19225d253842c3750a6577121

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr4AB6.tmp\7z-out\vk_swiftshader_icd.json

Filesize
106B

MD5
8642dd3a87e2de6e991fae08458e302b

SHA1
9c06735c31cec00600fd763a92f8112d085bd12a

SHA256
32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9

SHA512
f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr4AB6.tmp\7z-out\vulkan-1.dll

Filesize
858KB

MD5
1fa7e2a7de659abf98500dad8a8559d9

SHA1
e915365296802e1a2556d5b4bc12673e5d98e5e4

SHA256
eb4ed249c3fba6607dccadb24e96f336dfb6106984d1e7b3c49aa00e9dbbb0dd

SHA512
3f93b5495a3247dc9fd760a77d06b952f6cf1217749d9715ab3ecc4ed8816604b535332dd79d89cfa6cfd2c1abffa6a20c5c447e85c078870ccd4fd46d659dcf

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr4AB6.tmp\StdUtils.dll

Filesize
100KB

MD5
c6a6e03f77c313b267498515488c5740

SHA1
3d49fc2784b9450962ed6b82b46e9c3c957d7c15

SHA256
b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e

SHA512
9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr4AB6.tmp\System.dll

Filesize
12KB

MD5
0d7ad4f45dc6f5aa87f606d0331c6901

SHA1
48df0911f0484cbe2a8cdd5362140b63c41ee457

SHA256
3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

SHA512
c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr4AB6.tmp\nsis7z.dll

Filesize
424KB

MD5
80e44ce4895304c6a3a831310fbf8cd0

SHA1
36bd49ae21c460be5753a904b4501f1abca53508

SHA256
b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592

SHA512
c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 731281.crdownload

Filesize
28.8MB

MD5
6ff76fff08ae41c7d71a796d2588b375

SHA1
2a7d94d0057ab5f216b51d6b586d771c23caf5c4

SHA256
3e1d564862eb1c3384a37dec6079a8249b530017765f9d4eb12b86e94acdfffd

SHA512
1e2ff92cf6bf99775970be893de75e26a19064d3828f7f84778a07017bbf409469ee7bc618d6200dd8eb1ac0c7d9ef3e60e4373612c4f3dc28afc27328a4ea34

Download Submit
memory/1484-551-0x00007FFFA8880000-0x00007FFFA8881000-memory.dmp

Filesize
4KB

Download
memory/1932-714-0x00000223C4A00000-0x00000223C4A01000-memory.dmp

Filesize
4KB

Download
memory/1932-709-0x00000223C4A00000-0x00000223C4A01000-memory.dmp

Filesize
4KB

Download
memory/1932-704-0x00000223C4A00000-0x00000223C4A01000-memory.dmp

Filesize
4KB

Download
memory/1932-715-0x00000223C4A00000-0x00000223C4A01000-memory.dmp

Filesize
4KB

Download
memory/1932-710-0x00000223C4A00000-0x00000223C4A01000-memory.dmp

Filesize
4KB

Download
memory/1932-713-0x00000223C4A00000-0x00000223C4A01000-memory.dmp

Filesize
4KB

Download
memory/1932-712-0x00000223C4A00000-0x00000223C4A01000-memory.dmp

Filesize
4KB

Download
memory/1932-711-0x00000223C4A00000-0x00000223C4A01000-memory.dmp

Filesize
4KB

Download
memory/1932-703-0x00000223C4A00000-0x00000223C4A01000-memory.dmp

Filesize
4KB

Download
memory/1932-705-0x00000223C4A00000-0x00000223C4A01000-memory.dmp

Filesize
4KB

Download
memory/4228-1549-0x00000000080C0000-0x00000000080C1000-memory.dmp

Filesize
4KB

Download
memory/4228-1550-0x00000000080C0000-0x00000000080C1000-memory.dmp

Filesize
4KB

Download
memory/4228-1551-0x00000000080C0000-0x00000000080C1000-memory.dmp

Filesize
4KB

Download
memory/4228-1556-0x00000000080C0000-0x00000000080C1000-memory.dmp

Filesize
4KB

Download
memory/4228-1555-0x00000000080C0000-0x00000000080C1000-memory.dmp

Filesize
4KB

Download
memory/4228-1557-0x00000000080C0000-0x00000000080C1000-memory.dmp

Filesize
4KB

Download
memory/4228-1558-0x00000000080C0000-0x00000000080C1000-memory.dmp

Filesize
4KB

Download
memory/4228-1560-0x00000000080C0000-0x00000000080C1000-memory.dmp

Filesize
4KB

Download
memory/4228-1559-0x00000000080C0000-0x00000000080C1000-memory.dmp

Filesize
4KB

Download