ba5d8ed167e2d340f55fcf79f370e9ff67e37097bbe57ad77ec7d68730c1ce65

Analysis

max time kernel
150s
max time network
148s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
23/04/2024, 19:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

VapeV4.exe
Size

82.3MB
MD5

bb568a2a12775e52334ebcb384c4044b
SHA1

fd118c756194d88c398dc5150e728d1ab1aa1165
SHA256

c71282b1b2cd68322ff002532c93d2c7f1decb4292a897e5883a01769ab3fbc0
SHA512

dfe1d183084777d7540c6d794c5f3f4a931f87d72f1831c055c4a8c4bdba75a66d7039db6e2807ddb61068443023ebbe3e8bc1d379174bd044d09834b6564f7b
SSDEEP

1572864:K/WHHr9xtD/d/xxSO2nkjxVm8WPip32O0fry580ghdg+VUEik1J5E3QVbXs7:K/8L9xt/vxOn0xVmkhu680uJL7E7

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
1928	VapeV4.exe
3280	VapeV4.exe
644	VapeV4.exe
8508	VapeV4.exe

Loads dropped DLL 14 IoCs

pid	Process
4144	VapeV4.exe
4144	VapeV4.exe
4144	VapeV4.exe
1928	VapeV4.exe
1928	VapeV4.exe
1928	VapeV4.exe
3280	VapeV4.exe
3280	VapeV4.exe
3280	VapeV4.exe
3280	VapeV4.exe
3280	VapeV4.exe
644	VapeV4.exe
8508	VapeV4.exe
8508	VapeV4.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
14	ipinfo.io

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 12 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	VapeV4.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	VapeV4.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	VapeV4.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	VapeV4.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	VapeV4.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	VapeV4.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	VapeV4.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
6888	WMIC.exe

Enumerates processes with tasklist 1 TTPs 64 IoCs

Process Discovery

T1057

pid	Process
4244	tasklist.exe
596	tasklist.exe
7864	tasklist.exe
7908	tasklist.exe
7952	tasklist.exe
6248	tasklist.exe
4768	tasklist.exe
6908	tasklist.exe
3456	tasklist.exe
2832	tasklist.exe
3976	tasklist.exe
5636	tasklist.exe
7240	tasklist.exe
7568	tasklist.exe
7960	tasklist.exe
7432	tasklist.exe
7380	tasklist.exe
10000	tasklist.exe
6176	tasklist.exe
7128	tasklist.exe
7848	tasklist.exe
7220	tasklist.exe
5516	tasklist.exe
4100	tasklist.exe
7068	tasklist.exe
7608	tasklist.exe
7824	tasklist.exe
7456	tasklist.exe
7408	tasklist.exe
6924	tasklist.exe
6228	tasklist.exe
7620	tasklist.exe
7636	tasklist.exe
7788	tasklist.exe
1120	tasklist.exe
4164	tasklist.exe
6336	tasklist.exe
7256	tasklist.exe
7276	tasklist.exe
7816	tasklist.exe
7736	tasklist.exe
7684	tasklist.exe
7448	tasklist.exe
7396	tasklist.exe
6196	tasklist.exe
5804	tasklist.exe
7472	tasklist.exe
7752	tasklist.exe
7336	tasklist.exe
5820	tasklist.exe
1252	tasklist.exe
968	tasklist.exe
7352	tasklist.exe
7840	tasklist.exe
7832	tasklist.exe
6764	tasklist.exe
7520	tasklist.exe
7728	tasklist.exe
7388	tasklist.exe
7192	tasklist.exe
7156	tasklist.exe
6756	tasklist.exe
4600	tasklist.exe
1472	tasklist.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings	firefox.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
1928	VapeV4.exe
1928	VapeV4.exe
1928	VapeV4.exe
1928	VapeV4.exe
1928	VapeV4.exe
1928	VapeV4.exe
8060	powershell.exe
8060	powershell.exe
8060	powershell.exe
8060	powershell.exe
10196	powershell.exe
10196	powershell.exe
10196	powershell.exe
10196	powershell.exe
8508	VapeV4.exe
8508	VapeV4.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeSecurityPrivilege	4144	VapeV4.exe
Token: SeDebugPrivilege	4244	tasklist.exe
Token: SeShutdownPrivilege	1928	VapeV4.exe
Token: SeCreatePagefilePrivilege	1928	VapeV4.exe
Token: SeIncreaseQuotaPrivilege	1652	WMIC.exe
Token: SeSecurityPrivilege	1652	WMIC.exe
Token: SeTakeOwnershipPrivilege	1652	WMIC.exe
Token: SeLoadDriverPrivilege	1652	WMIC.exe
Token: SeSystemProfilePrivilege	1652	WMIC.exe
Token: SeSystemtimePrivilege	1652	WMIC.exe
Token: SeProfSingleProcessPrivilege	1652	WMIC.exe
Token: SeIncBasePriorityPrivilege	1652	WMIC.exe
Token: SeCreatePagefilePrivilege	1652	WMIC.exe
Token: SeBackupPrivilege	1652	WMIC.exe
Token: SeRestorePrivilege	1652	WMIC.exe
Token: SeShutdownPrivilege	1652	WMIC.exe
Token: SeDebugPrivilege	1652	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1652	WMIC.exe
Token: SeRemoteShutdownPrivilege	1652	WMIC.exe
Token: SeUndockPrivilege	1652	WMIC.exe
Token: SeManageVolumePrivilege	1652	WMIC.exe
Token: 33	1652	WMIC.exe
Token: 34	1652	WMIC.exe
Token: 35	1652	WMIC.exe
Token: 36	1652	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1652	WMIC.exe
Token: SeSecurityPrivilege	1652	WMIC.exe
Token: SeTakeOwnershipPrivilege	1652	WMIC.exe
Token: SeLoadDriverPrivilege	1652	WMIC.exe
Token: SeSystemProfilePrivilege	1652	WMIC.exe
Token: SeSystemtimePrivilege	1652	WMIC.exe
Token: SeProfSingleProcessPrivilege	1652	WMIC.exe
Token: SeIncBasePriorityPrivilege	1652	WMIC.exe
Token: SeCreatePagefilePrivilege	1652	WMIC.exe
Token: SeBackupPrivilege	1652	WMIC.exe
Token: SeRestorePrivilege	1652	WMIC.exe
Token: SeShutdownPrivilege	1652	WMIC.exe
Token: SeDebugPrivilege	1652	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1652	WMIC.exe
Token: SeRemoteShutdownPrivilege	1652	WMIC.exe
Token: SeUndockPrivilege	1652	WMIC.exe
Token: SeManageVolumePrivilege	1652	WMIC.exe
Token: 33	1652	WMIC.exe
Token: 34	1652	WMIC.exe
Token: 35	1652	WMIC.exe
Token: 36	1652	WMIC.exe
Token: SeShutdownPrivilege	1928	VapeV4.exe
Token: SeCreatePagefilePrivilege	1928	VapeV4.exe
Token: SeDebugPrivilege	3456	tasklist.exe
Token: SeDebugPrivilege	1120	tasklist.exe
Token: SeDebugPrivilege	292	tasklist.exe
Token: SeDebugPrivilege	1252	tasklist.exe
Token: SeShutdownPrivilege	1928	VapeV4.exe
Token: SeCreatePagefilePrivilege	1928	VapeV4.exe
Token: SeShutdownPrivilege	1928	VapeV4.exe
Token: SeCreatePagefilePrivilege	1928	VapeV4.exe
Token: SeShutdownPrivilege	1928	VapeV4.exe
Token: SeCreatePagefilePrivilege	1928	VapeV4.exe
Token: SeDebugPrivilege	2832	tasklist.exe
Token: SeDebugPrivilege	3976	tasklist.exe
Token: SeDebugPrivilege	4100	tasklist.exe
Token: SeDebugPrivilege	1328	tasklist.exe
Token: SeDebugPrivilege	4164	tasklist.exe
Token: SeDebugPrivilege	596	tasklist.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
6252	firefox.exe
6252	firefox.exe
6252	firefox.exe
6252	firefox.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
6252	firefox.exe
6252	firefox.exe
6252	firefox.exe

Suspicious use of SetWindowsHookEx 13 IoCs

pid	Process
6252	firefox.exe
6252	firefox.exe
6252	firefox.exe
6252	firefox.exe
6252	firefox.exe
6252	firefox.exe
6252	firefox.exe
6252	firefox.exe
6252	firefox.exe
6252	firefox.exe
6252	firefox.exe
6252	firefox.exe
6252	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4144 wrote to memory of 1928	4144	VapeV4.exe	73
PID 4144 wrote to memory of 1928	4144	VapeV4.exe	73
PID 1928 wrote to memory of 1956	1928	VapeV4.exe	74
PID 1928 wrote to memory of 1956	1928	VapeV4.exe	74
PID 1956 wrote to memory of 4244	1956	cmd.exe	76
PID 1956 wrote to memory of 4244	1956	cmd.exe	76
PID 1928 wrote to memory of 360	1928	VapeV4.exe	78
PID 1928 wrote to memory of 360	1928	VapeV4.exe	78
PID 1928 wrote to memory of 3280	1928	VapeV4.exe	80
PID 1928 wrote to memory of 3280	1928	VapeV4.exe	80
PID 1928 wrote to memory of 3280	1928	VapeV4.exe	80
PID 1928 wrote to memory of 3280	1928	VapeV4.exe	80
PID 1928 wrote to memory of 3280	1928	VapeV4.exe	80
PID 1928 wrote to memory of 3280	1928	VapeV4.exe	80
PID 1928 wrote to memory of 3280	1928	VapeV4.exe	80
PID 1928 wrote to memory of 3280	1928	VapeV4.exe	80
PID 1928 wrote to memory of 3280	1928	VapeV4.exe	80
PID 1928 wrote to memory of 3280	1928	VapeV4.exe	80
PID 1928 wrote to memory of 3280	1928	VapeV4.exe	80
PID 1928 wrote to memory of 3280	1928	VapeV4.exe	80
PID 1928 wrote to memory of 3280	1928	VapeV4.exe	80
PID 1928 wrote to memory of 3280	1928	VapeV4.exe	80
PID 1928 wrote to memory of 3280	1928	VapeV4.exe	80
PID 1928 wrote to memory of 3280	1928	VapeV4.exe	80
PID 1928 wrote to memory of 3280	1928	VapeV4.exe	80
PID 1928 wrote to memory of 3280	1928	VapeV4.exe	80
PID 1928 wrote to memory of 3280	1928	VapeV4.exe	80
PID 1928 wrote to memory of 3280	1928	VapeV4.exe	80
PID 1928 wrote to memory of 3280	1928	VapeV4.exe	80
PID 1928 wrote to memory of 3280	1928	VapeV4.exe	80
PID 1928 wrote to memory of 3280	1928	VapeV4.exe	80
PID 1928 wrote to memory of 3280	1928	VapeV4.exe	80
PID 1928 wrote to memory of 3280	1928	VapeV4.exe	80
PID 1928 wrote to memory of 3280	1928	VapeV4.exe	80
PID 1928 wrote to memory of 3280	1928	VapeV4.exe	80
PID 1928 wrote to memory of 3280	1928	VapeV4.exe	80
PID 1928 wrote to memory of 3280	1928	VapeV4.exe	80
PID 1928 wrote to memory of 3280	1928	VapeV4.exe	80
PID 1928 wrote to memory of 644	1928	VapeV4.exe	81
PID 1928 wrote to memory of 644	1928	VapeV4.exe	81
PID 360 wrote to memory of 1652	360	cmd.exe	158
PID 360 wrote to memory of 1652	360	cmd.exe	158
PID 1928 wrote to memory of 4736	1928	VapeV4.exe	83
PID 1928 wrote to memory of 4736	1928	VapeV4.exe	83
PID 1928 wrote to memory of 1952	1928	VapeV4.exe	85
PID 1928 wrote to memory of 1952	1928	VapeV4.exe	85
PID 1928 wrote to memory of 4092	1928	VapeV4.exe	87
PID 1928 wrote to memory of 4092	1928	VapeV4.exe	87
PID 1928 wrote to memory of 224	1928	VapeV4.exe	89
PID 1928 wrote to memory of 224	1928	VapeV4.exe	89
PID 1952 wrote to memory of 3456	1952	cmd.exe	90
PID 1952 wrote to memory of 3456	1952	cmd.exe	90
PID 1928 wrote to memory of 4260	1928	VapeV4.exe	92
PID 1928 wrote to memory of 4260	1928	VapeV4.exe	92
PID 1928 wrote to memory of 2288	1928	VapeV4.exe	93
PID 1928 wrote to memory of 2288	1928	VapeV4.exe	93
PID 1928 wrote to memory of 4388	1928	VapeV4.exe	96
PID 1928 wrote to memory of 4388	1928	VapeV4.exe	96
PID 1928 wrote to memory of 660	1928	VapeV4.exe	97
PID 1928 wrote to memory of 660	1928	VapeV4.exe	97
PID 1928 wrote to memory of 4948	1928	VapeV4.exe	100
PID 1928 wrote to memory of 4948	1928	VapeV4.exe	100
PID 1928 wrote to memory of 3596	1928	VapeV4.exe	102
PID 1928 wrote to memory of 3596	1928	VapeV4.exe	102

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\VapeV4.exe
"C:\Users\Admin\AppData\Local\Temp\VapeV4.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4144
- C:\Users\Admin\AppData\Local\Temp\2fVx4ZVqMFwjLyegdhYQlHNZOkH\VapeV4.exe
  C:\Users\Admin\AppData\Local\Temp\2fVx4ZVqMFwjLyegdhYQlHNZOkH\VapeV4.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1928
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1956
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4244
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic process where processid=4144 get ExecutablePath"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:360
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic process where processid=4144 get ExecutablePath
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1652
- - C:\Users\Admin\AppData\Local\Temp\2fVx4ZVqMFwjLyegdhYQlHNZOkH\VapeV4.exe
    "C:\Users\Admin\AppData\Local\Temp\2fVx4ZVqMFwjLyegdhYQlHNZOkH\VapeV4.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\bigbrainnv" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1648 --field-trial-handle=1652,i,17435107585027201501,11547179847408949368,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3280
- - C:\Users\Admin\AppData\Local\Temp\2fVx4ZVqMFwjLyegdhYQlHNZOkH\VapeV4.exe
    "C:\Users\Admin\AppData\Local\Temp\2fVx4ZVqMFwjLyegdhYQlHNZOkH\VapeV4.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\bigbrainnv" --mojo-platform-channel-handle=2172 --field-trial-handle=1652,i,17435107585027201501,11547179847408949368,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:644
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4736
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:292
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1952
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3456
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4092
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1120
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:224
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3976
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4260
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1328
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2288
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2832
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4388
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4100
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:660
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1252
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4948
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:4332
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3596
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:968
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2584
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:1472
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4936
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:4656
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3616
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4164
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4416
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:596
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3132
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:5216
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3836
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:4600
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2600
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:5328
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4752
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:5384
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3056
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:5392
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:1720
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:5636
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3048
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:5804
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2068
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:6120
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3460
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:6272
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3576
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:6176
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2972
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:6756
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5032
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:6908
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4132
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:6764
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:1744
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:7060
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5068
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7068
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:620
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7156
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5096
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7128
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:1652
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:7164
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4280
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:4768
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2672
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:5516
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:2180
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:5820
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3964
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:6196
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:32
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:6336
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4192
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:6924
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5188
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:7176
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5228
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7256
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5284
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:6248
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5300
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:6260
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5336
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:7232
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5360
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7220
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5372
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7240
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5400
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:7424
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5408
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7432
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5424
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:7440
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5432
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7448
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5456
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:7464
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5472
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7456
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5504
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7472
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5544
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:6820
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5596
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7520
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5652
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:7508
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5688
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:7628
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5704
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7276
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5736
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7568
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5788
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7636
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5828
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:6228
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5912
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7620
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5924
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7608
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5960
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:7500
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5972
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7380
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5984
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7336
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:6008
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7388
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:6020
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7396
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:6036
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7408
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:6068
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:7344
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:6076
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7728
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:6128
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:7900
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:6136
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7352
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5048
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7684
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5204
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7736
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:1900
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:7944
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5356
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7952
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5884
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7192
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:6152
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7960
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:6160
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7788
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:6208
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:7744
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:6232
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7752
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:6284
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:7892
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:6308
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7908
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:6368
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:7704
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:6388
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7824
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:6400
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:7856
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:6416
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7864
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:6448
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7848
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:6472
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7840
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:6488
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7832
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:6512
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7816
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:6528
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      PID:7692
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "net session"
    3⤵
    PID:6616
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:7968
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:7152
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Users\Admin\AppData\Local\Temp\2fVx4ZVqMFwjLyegdhYQlHNZOkH\resources\app.asar.unpacked\bind\main.exe"
    3⤵
    PID:6784
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic csproduct get uuid"
    3⤵
    PID:6888
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:7976
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic OS get caption, osarchitecture | more +1"
    3⤵
    PID:6968
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic OS get caption, osarchitecture
      4⤵
      PID:8048
  - - C:\Windows\system32\more.com
      more +1
      4⤵
      PID:8148
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic cpu get name | more +1"
    3⤵
    PID:10204
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic cpu get name
      4⤵
      PID:10236
  - - C:\Windows\system32\more.com
      more +1
      4⤵
      PID:5280
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic PATH Win32_VideoController get name | more +1"
    3⤵
    PID:8112
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:7976
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic PATH Win32_VideoController get name
      4⤵
      Detects videocard installed
      PID:6888
  - - C:\Windows\system32\more.com
      more +1
      4⤵
      PID:7080
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
    3⤵
    PID:6644
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:8060
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion' -Name ProductName"
    3⤵
    PID:10204
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion' -Name ProductName
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:10196
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:8140
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:10000
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic process where processid=4144 get ExecutablePath"
    3⤵
    PID:9816
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic process where processid=4144 get ExecutablePath
      4⤵
      PID:4088
- - C:\Users\Admin\AppData\Local\Temp\2fVx4ZVqMFwjLyegdhYQlHNZOkH\VapeV4.exe
    "C:\Users\Admin\AppData\Local\Temp\2fVx4ZVqMFwjLyegdhYQlHNZOkH\VapeV4.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --user-data-dir="C:\Users\Admin\AppData\Roaming\bigbrainnv" --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1640 --field-trial-handle=1652,i,17435107585027201501,11547179847408949368,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:8508

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4512

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:5928
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:6252
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6252.0.368146453\1550553503" -parentBuildID 20221007134813 -prefsHandle 1704 -prefMapHandle 1692 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f35939cc-6bb8-40c8-8fc5-da88b7892712} 6252 "\\.\pipe\gecko-crash-server-pipe.6252" 1796 21a549ba458 gpu
    3⤵
    PID:4180
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6252.1.556502231\2039330126" -parentBuildID 20221007134813 -prefsHandle 2140 -prefMapHandle 2136 -prefsLen 20828 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7a6e5b25-ff75-4bbd-bf69-1f9b3f6538cf} 6252 "\\.\pipe\gecko-crash-server-pipe.6252" 2152 21a49c70158 socket
    3⤵
    PID:8636
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6252.2.680571297\104117571" -childID 1 -isForBrowser -prefsHandle 2720 -prefMapHandle 2896 -prefsLen 20866 -prefMapSize 233444 -jsInitHandle 1268 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {feea3be4-1ef3-4e7f-beb3-5c365f519549} 6252 "\\.\pipe\gecko-crash-server-pipe.6252" 3008 21a58f9ab58 tab
    3⤵
    PID:4620
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6252.3.1469471737\1172313068" -childID 2 -isForBrowser -prefsHandle 3452 -prefMapHandle 3436 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1268 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1d4375e8-0f7d-493e-8b69-36f6622cfea6} 6252 "\\.\pipe\gecko-crash-server-pipe.6252" 3468 21a49c60d58 tab
    3⤵
    PID:6384
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6252.4.1423554458\1818574169" -childID 3 -isForBrowser -prefsHandle 3992 -prefMapHandle 4056 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1268 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a09fe1e1-3c2f-413e-aefc-145ac1282250} 6252 "\\.\pipe\gecko-crash-server-pipe.6252" 4104 21a59e76958 tab
    3⤵
    PID:6868
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6252.5.1708792969\2031144850" -childID 4 -isForBrowser -prefsHandle 4728 -prefMapHandle 4720 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1268 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6db03e9b-628a-4d1a-90ee-64611760c6b7} 6252 "\\.\pipe\gecko-crash-server-pipe.6252" 4700 21a595b8e58 tab
    3⤵
    PID:7868
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6252.6.1612447432\477593980" -childID 5 -isForBrowser -prefsHandle 4868 -prefMapHandle 4872 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1268 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1f763dcf-2dd3-46eb-93af-9581f7c3d0d6} 6252 "\\.\pipe\gecko-crash-server-pipe.6252" 4752 21a5afbf558 tab
    3⤵
    PID:8028
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6252.7.824776744\567622485" -childID 6 -isForBrowser -prefsHandle 5068 -prefMapHandle 5072 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1268 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {af326241-d075-4a0a-bd5e-7825d8186742} 6252 "\\.\pipe\gecko-crash-server-pipe.6252" 5056 21a5afc1f58 tab
    3⤵
    PID:5268
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6252.8.1804348589\1408083030" -childID 7 -isForBrowser -prefsHandle 1608 -prefMapHandle 1612 -prefsLen 26687 -prefMapSize 233444 -jsInitHandle 1268 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1b381293-3472-40b1-bc7e-28061ec89576} 6252 "\\.\pipe\gecko-crash-server-pipe.6252" 4256 21a57595f58 tab
    3⤵
    PID:2312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
17286868c0a043ae5d2ff5798b6a3163

SHA1
b83b23cd57c7fb2c937f5bc18aeb7ddc955b5401

SHA256
40321e18ed0b9eb7e3bc937d3e207ea2039ff45267483ddb4a51f7974475dac6

SHA512
e15c11982c0569a389a7dbd0889edd1ef9a8ffb21c0e8ffadebc10e1353f4485524b18ca8e041c66c98d05fb984544da122755e6c2a25728453aeaf4175bdee1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
7a15a146f4cde783bfde2c7f19ba1441

SHA1
501f9a4d6b80d4e38852dc4b8a7296e28148db16

SHA256
0a1517b1c179130216c596bfbf65bd62f75b57e0cfe14a9757e209e6aef078dd

SHA512
7385211998ded8ddf6048a5b47cbe0679ca23b29c1f7240c1b1e6b1fa080239136443feb34df9cac85ae38a542de9ecc9b7b35e1b961d78d57ea073236c2cf78

Download Submit
C:\Users\Admin\AppData\Local\Temp\2fVx4ZVqMFwjLyegdhYQlHNZOkH\chrome_100_percent.pak

Filesize
132KB

MD5
e4cbb48c438622a4298c7bdd75cc04f6

SHA1
6f756d31ef95fd745ba0e9c22aadb506f3a78471

SHA256
24d92bbeb63d06b01010fe230c1e3a31e667a159be7e570a8efe68f83ed9ad40

SHA512
8d3ea1b5ca74c20a336eaa29630fd76ecd32f5a56bb66e8cef2bce0fa19024ea917562fd31365081f7027dde9c8464742b833d08c8f41fdddc5bd1a74b9bc766

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4kdjnkvq.kzs.ps1

Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsx800E.tmp\7z-out\LICENSE.electron.txt

Filesize
1KB

MD5
4d42118d35941e0f664dddbd83f633c5

SHA1
2b21ec5f20fe961d15f2b58efb1368e66d202e5c

SHA256
5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d

SHA512
3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsx800E.tmp\7z-out\LICENSES.chromium.html

Filesize
8.4MB

MD5
e400cd908b8fb7c13985e2f5cc7a7044

SHA1
bbafebdf5b067a7d7da130025851eaa52ec3c9d7

SHA256
ee3b1ab8794c749673ce9bd2dd302f12d69f0a1a4adfe40a64247746cc311829

SHA512
e7ca440f0e042d7fcfa99367426bf19899a2b227c6d7b6e2c25d4f1a40113250f21ebeaaf91067d8569dfbad1415d4fe3e5626d7254722f2778497fcb22e5d6e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsx800E.tmp\7z-out\VapeV4.exe

Filesize
158.3MB

MD5
6da86f755f2572f73bab8fa9f2d844f6

SHA1
c8c298b6ed677a1eeedc32558cd928f7d54975d8

SHA256
f9d65681f250bb3314dfb563e9cb16086df75e5e7f9ca68f5a6508a6ecef8e85

SHA512
b199719743126b21eca3799e6953d8bc06dfb8a47c9e65e0758157e7980f0e2618a5c1d46241b29717cad075daf22aaf0b67d3b578ec6352031f94a3f7c48a27

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsx800E.tmp\7z-out\chrome_200_percent.pak

Filesize
191KB

MD5
99b95d59d6817b46e9572e3354c97317

SHA1
6809db4ca8e10edd316261a3490d5fc657372c12

SHA256
55d873a9f3ac69bbf6eb6940443df8331ebd7aa57138681d615f3b89902447e7

SHA512
3071cfeb74d5058c4b7c01bfe3c6717d9bb426f3354c4d8a35bd3e16e15cde2f2c48238cb6382b0703b1cc257d87fcecfb84fbf4f597f58e64463ceede4366dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsx800E.tmp\7z-out\d3dcompiler_47.dll

Filesize
4.7MB

MD5
2191e768cc2e19009dad20dc999135a3

SHA1
f49a46ba0e954e657aaed1c9019a53d194272b6a

SHA256
7353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d

SHA512
5adcb00162f284c16ec78016d301fc11559dd0a781ffbeff822db22efbed168b11d7e5586ea82388e9503b0c7d3740cf2a08e243877f5319202491c8a641c970

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsx800E.tmp\7z-out\ffmpeg.dll

Filesize
2.7MB

MD5
750bb5679a709b6037a68951cd7edd49

SHA1
10d3b066ab068500ed3226d0e80cc6778efd5fd9

SHA256
737d37d28b1eb03cb588672896f22fe8fec35b4cad1d2286e86394f1af0b381e

SHA512
d92b28c6f8ce199e85135f5b91bed8b6a8450698adf9bfad6fc26498654ee2a3f9dd8dc74e4235983e67b9ff8e4744f7719f71c74f8b3060421b24f591cc70ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsx800E.tmp\7z-out\icudtl.dat

Filesize
10.1MB

MD5
62880b7d351a9f547b62b8da6c97ce25

SHA1
057f11003013cfb3f1c63e6bdd4f2f9949ff0104

SHA256
7c40c811d30d459dbf04a04c141b60eb4247cd58a008fb836605317df665748f

SHA512
0d6f83175a91d90f4cc3ec4d9071b7acd0cd8ebbcc592322e46fde2adb7198e035af62c45a11a622f2a908e26d4dd8b8d1af023e634a74d0824d02c791ba3c1a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsx800E.tmp\7z-out\libEGL.dll

Filesize
469KB

MD5
fcb51da609bd12c4be7add00d785076e

SHA1
b87e5cd567308fa79f5a51409dc5fbd44c03a16c

SHA256
70b4d7a9c5a6414bae754e9195ce4116c267435d859515a6247d4970e5cfc2a0

SHA512
4c4d4040969cbf6d7bda4e23c6fa41da0cb1ddede0400bee1a2d623e604c71ac812770f41f90c99ae5e6bf5f55ffdca6bd197ca3b1251efbd892c12a7f8581ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsx800E.tmp\7z-out\libGLESv2.dll

Filesize
7.1MB

MD5
b8c51e8dbdeab2339ca9e33885553ff6

SHA1
026c284e7c3ddf3ee491bf3073fe4c54628746da

SHA256
a8ce28ca36e63d0cae939b9a72271bffd44d4df3bee586f884dcdde91353e3ec

SHA512
bb09cf5262c2af7ad369b06346abf66e41c428dc53109083d12fc9cfa969e5499c28afcdb57b66cd5187530319307de8284eea5a211cb5f1b040639fe3f51a9c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsx800E.tmp\7z-out\locales\af.pak

Filesize
425KB

MD5
d16ef573959cf5cf0a6eea20136b9c0b

SHA1
e3384ae3ee92e1dae47a48e45589372e940aab33

SHA256
73a8401e6dc17c4daf86b42c65b81359348f7e6b4d62d8637138e747bb3ff0ae

SHA512
064c2912f766f10ec042adf82709ac9582cb8430e3550690fc17343c380dcbabadc0084e08aa5f3eb6faf79a652d26e1fe2606625a180b7f47808df07a566933

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsx800E.tmp\7z-out\locales\am.pak

Filesize
693KB

MD5
39a396fce4d93f744b3c786d62d2686c

SHA1
7ec8176e652b666b6ab9fffb6cb9b7dcfdd1a2a2

SHA256
0b1d326be9dabcda8e37740017383f2d8f1bec7a8fdb1f11ebe538c3632453fd

SHA512
798063b51f745fc2c9e7f852f72ce55939ed41305d070d1844c790755f7ab42a6830406ba2485237d37a0c46b804512e7dc37c65b7f03249c28741a4f706017a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsx800E.tmp\7z-out\locales\ar.pak

Filesize
758KB

MD5
14b15761cb9d4e1956812df8b42c2aea

SHA1
7c25580d892711b9eff1a3ace4e6699ea64e0706

SHA256
c8d405127b032587e6ae6426a35cb766139bae26170ca08d811354486ab667f8

SHA512
ec9a6e6e715c817726ad744fadca4d1af3015d95421774ccfe54d616225b7a17e862e086fe0aebb3a903d2ebfb27779cffcd713d3042ecdf9761c24c5a56cdcf

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsx800E.tmp\7z-out\locales\bg.pak

Filesize
788KB

MD5
01dfb1a7815613fa0a5411235f45b27b

SHA1
3bf1ea5597ac77b26bd30caa1efea7cb4f7a1b19

SHA256
13d08d2c4972cd18bb8ea8a57587dad29684c2336f73282dd3284b0649377cf8

SHA512
5d8a65e5a17aa163fb679e003e1837ea96e515b105c9977029a5ca4854845289de5d65c0edfd473cb74410c5cacdb5b360f25a69776705fb05f48688d92680da

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsx800E.tmp\7z-out\locales\bn.pak

Filesize
1019KB

MD5
ff4f966849b4107535e41d037d9144c7

SHA1
3a973857b061914e8905bda7e8f2bdafa384588e

SHA256
2dc26dee345271f4606650912b0b7b5df68f621f2920864e0e36c1d1b22459b1

SHA512
98772f266f9553f77f91b11dc4589ec8a0930554e9e0b381bbacd8d23ce794c04f6fe821388a6e87cb14cb59c7522c18c06b1af11fc177c7e40ef71242adcba7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsx800E.tmp\7z-out\locales\ca.pak

Filesize
479KB

MD5
a0b45b122241cf0c11a081eefb9cb4c6

SHA1
91fd660a4688aaa70fee42e783b8b1863b4d11d7

SHA256
7d911cda51564500dd7a6de43a1e347869427c035b15fa25cad0526be9e055b1

SHA512
abcb3bcb96934189cdfd52528cd7c65ea870c9b997bf6349599b7064fe6f4bef0d34809f0f958e4d4e46486e7c0a41f86b5ed0a132bbf20743d41f3af64788b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsx800E.tmp\7z-out\locales\cs.pak

Filesize
494KB

MD5
1101c784521a550b0561b363722086de

SHA1
838f2bfe3432b87b950a2ec5d9862d2f58fde3e5

SHA256
cc6ff937d1c9fec4634db4e2f6c0718d2606fe2d5d25addf1314e110c5b78772

SHA512
eca3ce2075d3c920116c9e34957631e0617a869467bb76b09873ae96f7803f20032a6dd0a0f785f9e59dcfce3a4ccecdab2d445a860bee20d42e140b45e74089

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsx800E.tmp\7z-out\locales\da.pak

Filesize
446KB

MD5
5b033c206820ace5eb4c6f82aed34a5d

SHA1
28017cfc13259273022059f02564ffc99dcd75a4

SHA256
1a51de04cb205c708520f1b013447f1a89f0b1330dbce6d1e71cf355319d1108

SHA512
e423069f7a895179ea17be5774284e9e2e27f02c40bac7d7211cab77348800622796f04c3e6618905364e189ca5ec772ed7dbd285872777d163d3ebec08a64d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsx800E.tmp\7z-out\locales\de.pak

Filesize
477KB

MD5
7ccdc41a3dbdf89058d71629225664ae

SHA1
e15c35b18685d9573349ff4247733b5f5ada8717

SHA256
163ea4c2cf67edd0526a8e18d3810872e92a1d4e17b5cf4f04107fda5967b0c9

SHA512
13b20b0db02a0a7480c56c79304ef594353507e1a30da0130b73aa8e9ec7636f306315a6f40729b10dc725f936642d2e2b282ed3040a079a6f25a7f9f7f1ae28

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsx800E.tmp\7z-out\locales\el.pak

Filesize
865KB

MD5
2b391b2b35f7e096f696faf5dc093366

SHA1
1409134a46fcb84457a0e332edde98f7666246bd

SHA256
f1fe39af50f4bfe9edcea3af6c132e87d464d7277fb491ed95d7189b3157d20d

SHA512
aa640ca41dc9d4f60392b61bbead215345abd32369b0de90ed1d7ca2ff7a838d04689d538789a1adc0324fe4539c34db26b6c245155e51fb0308af13b60bfdae

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsx800E.tmp\7z-out\locales\en-GB.pak

Filesize
389KB

MD5
745918a5a74c7b6f4818a8bb8813f456

SHA1
031f50286d003844425ddac557e13e2ea4554bc2

SHA256
91bdbf5f1f6bcbcaf16e47865f72ec97d72c74174fb929f089d14c00989f91f4

SHA512
5a1eb0231352705bab527ab27543612d75cb00c522620828ce2a0fdb0b47be9daa2dd7a192f8b4bf299007c5af1d9515f900b9586ba44dd2bd9f4cd4436aa681

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsx800E.tmp\7z-out\locales\en-US.pak

Filesize
391KB

MD5
c9c2abcb04e1ad5f1a20244da8d595a8

SHA1
89ca81da21900074a5ccdcdc852768277b2b620b

SHA256
0364c73f320e441b03cb2afcaaca3ffbfac51a3559dcd0ff99a1accf82c7f762

SHA512
96bbf21174f56a111a2fc6ec024ab2f143945306797e77d773367a7fad42b7828ebb7b08d0dab76858d9fa340bf3205be403bc53df9e5e4e390058c94a751ffd

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsx800E.tmp\7z-out\locales\es-419.pak

Filesize
473KB

MD5
c8f488b85c17431360e531aa507be979

SHA1
bea5d66bdcc05869a0389e051a9217fd49e48fcd

SHA256
536339d99dee6e8c01f018d4700ddd92ce063f765766a48073aeb256669680c1

SHA512
1d7f9f84a8d7c055bf705c71efaea817f1b9dedd5ba314fec6ce5324f578d3130b5541bb52fa55db9f6e46efa8e152d50199a61c7e2466844a4414df65d61c22

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsx800E.tmp\7z-out\locales\es.pak

Filesize
473KB

MD5
29cbdcc2168f1bb29532122c39e67a1a

SHA1
f086c79d60daf2b0a7df91916387efa461795dcb

SHA256
232f41ab5996c917687276e82c177de208b36e77aa834bb5d94d6a331f4180fe

SHA512
b603edf2a18f5893ab482b0c34e4126f824fbdd1b669927d7bc30d68e2e5bdf78d7d4b2aabdbe257987e8e19f440d9396a3683340b94c3fd844c70e34e93d8a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsx800E.tmp\7z-out\locales\et.pak

Filesize
428KB

MD5
5b169234895d929930140b4869a0b81a

SHA1
f58ba50d1e19ce191a0f8117f3e70f7f3dcb7362

SHA256
c465da80b14981bdbc687b7c37bf70d2bd4b8e03293c04ae5410f84c91ef980e

SHA512
c4297e272b5c04a0ee0956b873d5246591bee98c3b340e72202f3448381c691096a5bc540fdbcf61fb40d6a69270afa7198c1f0ccf3b2e84cabc906e23eb022c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsx800E.tmp\7z-out\locales\fa.pak

Filesize
703KB

MD5
f7da0d07b54698bf8a213d0ccf1942c0

SHA1
d64fff18274ebe71a4aaa4754f9bb99d616fa000

SHA256
33bdd6eb52f648d475306f35b6103500b864672cbf39cc0fbd8c4ac84c997dec

SHA512
ce7a7b3df4c814a26e3fd9fddafc01ac1a4b2a87ef2d2893db5d0edf8e5b8bfe34afb6e91ff94306248361d57c6b3bd63d116635fb756aab74c4aed38f31c88f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsx800E.tmp\7z-out\locales\fi.pak

Filesize
438KB

MD5
1cbfa553a5b1de642ea4c248dfe1edba

SHA1
5de05b3c11fdd59ff5064a153a6dcbda33350971

SHA256
8f3e8ec0fbb471b45db65a77dc1013e3363f387d3d0c6a458c90f371907d0085

SHA512
ea3b99be7da893be8c3b228d1d3d7b644a1f5425b5380dc3e0ae0ba1bd29cf39dabe73819bcc4fa67f10a488f018e9fa2328995cb78f40ae8fdb66aa514188aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsx800E.tmp\7z-out\locales\fil.pak

Filesize
495KB

MD5
8ce446cac9221f07f912be59534d86ec

SHA1
15cd1b902b26abbe665fed518575748483a9c3e4

SHA256
b6ce37b1aeb4ca17a7f78ebc8f97c2807f588dfc4ad3e0639005c626b5c9b939

SHA512
20be2b5c7e8fca897109b1dc8219931eaaa1c8296b1d26dcc7f9058168fef371d7955fb0f6c5693399b83fa81d27369efac8c3742059eea2333bd66d20b8d0d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsx800E.tmp\7z-out\locales\fr.pak

Filesize
513KB

MD5
a1de4ad3d9b7aa8f122ba00cb983e49c

SHA1
323d6e1b4ed75f9406bb8488d7ffc7e12fa96886

SHA256
a69f52162f6081a06f835ede10818218df6e211f00d0ef24561e6221f4696e61

SHA512
542f0818ea4517fdea929f3d4938f7de75e2a5e6d872607e548f87de7e9cd0737fab3f5e82ab7895f44e809279d81c490999ed055acbddafe84f85e60ce2e23b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsx800E.tmp\7z-out\locales\gu.pak

Filesize
996KB

MD5
02bfa1114fd5b75261c24d6c0e6441f7

SHA1
d48b80339405cb8c8ec7a19b688e8d544938c4c7

SHA256
bbb17268412fb3e13584ca4dc90a94f984177d3c97ee89af2a57324709f8ed1d

SHA512
751b91d381c882a5dc0c0ee6313cf3e7ef51b4d369330a169cf9625de99e6019233109e815fc474fae44d79235940ba2ce68af7033f4c4c994e2774bbd8105be

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsx800E.tmp\7z-out\locales\he.pak

Filesize
616KB

MD5
9fccb330d8b07ca54661407cf737d847

SHA1
2c6f52801b66aac7d08acb60d9736f9149e48ae5

SHA256
bb06d364a91b8641724254822b2eec5d0675e262a4cbf93b92494f601807dbef

SHA512
0cbf36643cc7b1d85dc7cb7825bc816a8538d0cc50b137dd27d5a9703324ae7ff271d38dc0cd6e4a99c6b391070690b90eb8ddb1cc511bc8d84d49a32d36c34c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsx800E.tmp\7z-out\locales\hi.pak

Filesize
1.0MB

MD5
cd91036827739441e4cc849aa30706d6

SHA1
cc8e4c53e18db16876f855c2377f3cf0e2abf95a

SHA256
0936587aa072339f8dc347506e5553159319a686010ca1912bed1d830e107c6e

SHA512
553773bdc11be94f495b88e0587d572455ef68c182d51c9e1ae0e3aa23744f836996a446ed136afc562eb9a110e435b494d5955d2792a364a619111e7b3550e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsx800E.tmp\7z-out\locales\hr.pak

Filesize
477KB

MD5
ef62a50cc098afcf3fab69c7502219e9

SHA1
db474cf332c90de660fc575ef897d5389b65784c

SHA256
07effa557c8bc822626c05a4d299296f88d3da0654248c326d796f7c2de3ec64

SHA512
7ae6f40c7bf404532df0bc2ffa449e0d99debc2b9816450ed0d015b1634dd96cd5650ab6af5a6d44d52d0e3c9c81836ee350210c4f8a13be6cc0cb796a630350

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsx800E.tmp\7z-out\locales\hu.pak

Filesize
513KB

MD5
51b14b96d1b9fa99ed849347a8954133

SHA1
5259b749576a9612e429a665dfc8bf47651c39ea

SHA256
70d4a0724a2e0e80ec047e7683eec7715c0fb5f88795cc97a63e4c2ee2237800

SHA512
b68d4bc792f29df210602a557d0b3333a95e30cd03a0a4cb5f537c9c51da9937119391f2a359c03fb874c1f540c23f44bef121e45f048f32b1db06d67a0bad1b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsx800E.tmp\7z-out\locales\id.pak

Filesize
421KB

MD5
3b5e08406059d1a76566e9a5d4c9b15a

SHA1
6bf45f2647e959ec1b545763180e8f29961ab3e1

SHA256
60409d8b785dd057e3495190b18e6d6d235d8313555341cba5f64327e3d8c3aa

SHA512
6c4150c064edf6ed0b83b216ce62134bbab12137e6b45749dad08d1d1734b3365309414900615137c6acdd12250add5c69a222daa7984a94ee850aaa55af1b8f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsx800E.tmp\7z-out\locales\it.pak

Filesize
466KB

MD5
4e7ab6a5d407bf4d3f96671d65e467f9

SHA1
67f43053ccd167f2ce6d945202f64df29ee1ac49

SHA256
20408c09d9447f44aa920f2529d231072db8bb9c0c8b8fafa2db733561eb6964

SHA512
bf493e1a1c0898f7a54f8a5278dc0ca345e9937efe269b1bd3a3bc90645d767070ec9c117df001f8c3b51b4a383c30f025daf79606ac1840fcc5878ad4c53624

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsx800E.tmp\7z-out\locales\ja.pak

Filesize
570KB

MD5
74e2430cf18db7ecae2a9b1feeb049b5

SHA1
362a5f3e4d8a79b9d0b041d62a8a5233e20fb208

SHA256
1a726c500b5b3efdbc7b9e6626765dcb8957005f9c072c09d1f517587d6b673a

SHA512
324d0ba770c09cccac4c59e0e0605846a4e18f32cc79f14fbd4e5b0172f439ef8dee538f686458b3a07e5e8b4528ef67aa5d339ae25f7c601c9a302caa7970f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsx800E.tmp\7z-out\locales\kn.pak

Filesize
1.1MB

MD5
56c5f63f439cc962b815bbc4f3f12c32

SHA1
c96248cafd869fef11bc37aefb1382d0f60a7855

SHA256
14b332541c2cce0835202372f8cc822aef30b3575b651c96219a88b8d1381648

SHA512
9210759d8e73266381fbf04280aad0bc5006f315ce3fca74fe304b3261af0ba399210f0b84620230d6aa0c667e60c0a6d9e67681fdfac401338e9331475bb7f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsx800E.tmp\7z-out\locales\ko.pak

Filesize
481KB

MD5
a9b446bb79b0e5d0b4af4f7243b1f3e2

SHA1
fcf962506b32b34a6315ed61acdece33df3dbf23

SHA256
507fc8d2a468456f2842b65a111fc0c74fe1f56d5f5ac0d6e743aef186b43b2f

SHA512
e7f281206bd481427a75b581f8b2a435eb8a29bd8b5586a8db78605b1c1bbc20dc1f4b2ff92d04c62fb509dc6e1e062d1d584c195e386c5c2ffda0f764276aa6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsx800E.tmp\7z-out\locales\lt.pak

Filesize
519KB

MD5
49201fae17b715a15fa03c4d89dd2176

SHA1
7c559c174850de48c4a2837fe32c58f74d8150b3

SHA256
4a80792cb9a401ebfa7ec3212182b5024d651ca6a5ead8fc9809d0d3ad4803cd

SHA512
3016f721d77206e13e275e7eea1adc95d403feaccf595eacf933940485031e9aac0c29b6f47a9ff5f73b08c354b7b82c72193c83e1ff09d84cb5b9b72b708166

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsx800E.tmp\7z-out\locales\lv.pak

Filesize
516KB

MD5
335158efe454819a0dc8de0edb0f0e90

SHA1
85871f85f626db1fc597ef24c79c84115a66c17e

SHA256
113073cf60ae3d2bcf8a61df655762e34ba28e4b35b97de33c18e13f959d76ff

SHA512
f81733bca3fa65c789630b55c4f414a8541e71c4e1aba56bdb9d231ce189677b3bff4dc57c92fbe1cbc88f1f2f7fbf1a7e4319a8918c50409fcba958d743ccbc

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsx800E.tmp\7z-out\locales\ml.pak

Filesize
1.2MB

MD5
1030c08ffbbe7366ce5b7d55bc8ecc0f

SHA1
b45b53c1e47a0051560c607874357130c499563d

SHA256
e1f97ce3011d9231f23fe033bdbb0905c173921b18402d362bfc35224ff67db7

SHA512
3b9127a0eec02f75f79c66f5f7845b65c4ebe2e6a33989c7686815ffe0651be47d42f55c2f32a67a221495a8bebf043d853df7b244a68f89390044210e52dd3d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsx800E.tmp\7z-out\locales\mr.pak

Filesize
976KB

MD5
eafb18d633064d0f02a3eff3eff9aadd

SHA1
a8846e473014be80125630f1c5b51366220ff018

SHA256
fcb7c4aeed28ae4d16fa7b82d9571165aab0fdd46eb65d3ab29007231630ccef

SHA512
d332a4b7f4cb1583a5bf5ce08fdb46661a5bccbf0a66f7f5ab6ce04367e9bc589588dcb32f443695a3ab129dc50d2962ed4c138f97858639d4ea37c117e23495

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsx800E.tmp\7z-out\locales\ms.pak

Filesize
442KB

MD5
3d0dc94a638f98d9bf3c0f60f89a0c95

SHA1
a979b04c65832d908305fb0406cb0653271ad744

SHA256
a9f9ae23a3bc2ac919c5b46d16b7e1f3bff73698d2626260196210e101d119c2

SHA512
6d687f1eb9a7fda3791295487063393b8f0a7409b55461b185aaf106c596229de6988114230625d6504b869d25d7a624bc3b90d66a0bdf561cb05a57d5b87c15

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsx800E.tmp\7z-out\locales\nb.pak

Filesize
431KB

MD5
9c18dfa9e69c1d7810132800d084136c

SHA1
bbaa9576e1b012df33d79a5dc7776c00e67295e4

SHA256
4f3babcbec0d138654ec59fd8ab5fd58da2273237a587928b9687928c7ca10ff

SHA512
a82b1e340a25a3858906ded73624bd0be4b3ccd1f5728560480b4a4e3a78529f5a178d20cf7d95fd55ded7ca4fa95a5fff87d89f0520ea08b54e7b99c9057d6b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsx800E.tmp\7z-out\locales\nl.pak

Filesize
444KB

MD5
5cde06a63c9dc07fdbb0fdc94e403d00

SHA1
11be56054908f1f9cd56ab77692fe3717ee91ee8

SHA256
3b9ed5ed0dd07d8fa67412a046ab085137542c156876dbfe6f83376571af91a3

SHA512
2716496dcbf76cc2dece938103813a8dbc17d4c795b4e3459a572de4f62f9ac0e1788de3a21f5fb287ad364decbd541a5e3bddd406e130d2a9c72118ccee5390

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsx800E.tmp\7z-out\locales\pl.pak

Filesize
497KB

MD5
b44fcf9fdc4ec7bb5e72cae30aa15c01

SHA1
daaae4aa7987bcce299995feea5c54f2d77b61d4

SHA256
7f1a8392fe3aff4e6bb4bacbc1f4b395f08ecafda9f81e36b41b77fb4ab0bc76

SHA512
52b46d7affac4949fa19841d26d2f4bf877e36cbda4b75f3ff289a7abe9a80c2a014b1ae23d3079f4d31ed5fa76c320103733284a2c13d99a451810407325674

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsx800E.tmp\7z-out\locales\pt-BR.pak

Filesize
468KB

MD5
de8ff9456ba9ea999d0d1bc9b831e7ce

SHA1
1d67c6dd97fcf221c71137cc8b1946368807aba8

SHA256
b32fe8f602ec9800d59806e097e369fd065d8fbf473da40fd29289493489930c

SHA512
5a3a48ddad801382ec9065c6160698dd746aae810374c2b772d521a1764e7e0fd2c28c5dd1cdccb50834d699ee19441713fe10a91dddead46ba0cff3edbd6984

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsx800E.tmp\7z-out\locales\pt-PT.pak

Filesize
469KB

MD5
002d5b37e68a0725dd7d89fe3fc7ec48

SHA1
545de8047d3f89150516b95031965adc8f17df68

SHA256
1fadff356a7e89a8ff2af3ddf84f70fd0ce69525c7787f8adae10beed9d76d4e

SHA512
abad6cbb30a958bb84a521a66636af4221a9f63774122d3ac3b552503930ad83d343ec4c8109c8031cab17c546ef7549aa0f87746e39a80f6758fad28ecee129

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsx800E.tmp\7z-out\locales\ro.pak

Filesize
486KB

MD5
7056fc61de4a16c7f4f5bf44d2e87f8a

SHA1
99d16dcb3b1aefc472601439f630e1244b1aa277

SHA256
b7ba9435d82f6bedd7005b6e868ee86f0bb6c4d7b312fe5f5d4afbd440ad5b85

SHA512
529152da39f7ade6713206fa9f767b35b9bf03816387579522eea78ac7d0e150bad557fcdbef51e76d52e39f61a0b4e54ff6a3b592eb7e34fafdb98afe460f7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsx800E.tmp\7z-out\locales\ru.pak

Filesize
797KB

MD5
91379a583d22fa9343ed466c261366ff

SHA1
61e8c39235945c4f38807b14ac74da7d3257759a

SHA256
0d4d0b8052519848abd182c44dfbf444a77a0c6994965c4a3001f0a3a4d1459e

SHA512
dde26b59a1e5f94d5b245f47399d7a9d3db8d247037331a471c39b1d7e79e236c5a0732fea4c53b843d8eaff1f54ca155a816a193b7baa870fc458a5aadf76be

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsx800E.tmp\7z-out\locales\sk.pak

Filesize
502KB

MD5
78bc785a75ee512391a9cb462a771c09

SHA1
229d39e017174dc0a8cefcfcc72b0feca94d6208

SHA256
ec15c82956ebddb7b246c78045ad414ed34ca97d890a915070e252c8715096b0

SHA512
96556f6072e69351e1bbce06bbf896b1ad53060c7cbaf7928eebbe0f610f5e8778b2b8b97a5a268b7942a1c8d1adc6bea0403383a2a5bb99049437e95d575ea0

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsx800E.tmp\7z-out\locales\sl.pak

Filesize
483KB

MD5
e76e473c419c25768b08a95a2822918f

SHA1
0fa7e2fcabb03a8788f50f1d4b4eb383c833e9ba

SHA256
fcd27a9f5cb4b4be373da7076a8232006ebe020999fdf90d20745f16cd7ef223

SHA512
e39ae0acbb7d148d6ade676d92e83fa9fb433230bae4339c31693a538198bf0679adef51883b96f8dfbcc8593a982544c64a2b265897f35a693183b27070ea5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsx800E.tmp\7z-out\locales\sr.pak

Filesize
745KB

MD5
48abf758a49e2e8aab013f2bf56091c0

SHA1
ca909bc28b03bf959ac32e218a318289e0badbf0

SHA256
b4cf2d19b5e443b57ca9d1189880458a7cacfe1c8b231265557a3fb58f597617

SHA512
22d65df1cd35a8127296420a699f26edf55813fd6a970050dc9b2b051aaf7da2cf2fe6314a94977587021c02aa7d8b42541e1d08d5940fb7e1af127e87268c68

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsx800E.tmp\7z-out\locales\sv.pak

Filesize
433KB

MD5
06c878c1538813e5938d087770058b44

SHA1
c8ab9b516b8470bdee86483151ae76368646bffc

SHA256
90dc45426bc1302aa05261f136881ddf038272e9ac315297aa8e5dae2b31109b

SHA512
6ddf615bcf0a8c62221233687bae1eeda5cfd749aa8acc179d6650987289201b405edd453fc181a1d250eba9bbdf61ea28fb7c694539fae3d320bfdea56665cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsx800E.tmp\7z-out\locales\sw.pak

Filesize
456KB

MD5
55241312a3aaba14a6b19a9012ca25b8

SHA1
69fadf0817faec3bc6b018f0af5f63378ade0939

SHA256
722c86bd857a93ae06ca0b7cfe2cc04237a7ed5a52586cab7246336c802abe37

SHA512
612f815c25e9f593d1f1c4de8e9016dce048cfe90f21319c4cdbb5772580cb8c71229e9ddba60852cd0bec80a07a783ace24f873d90dc3323e5fdcc44905f2c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsx800E.tmp\7z-out\locales\ta.pak

Filesize
1.2MB

MD5
2c0a9cc4a7c775ff13a6888234265cab

SHA1
497bde42737667fc833bbb9d8a9edaf014d99957

SHA256
1dd55659ef21082b9d58bed50f387c0e1fc0f28d0ede52251b9ada25ed2a657f

SHA512
b862221cf17d3f2ca0495a8a3e1f630ab915fd9b2a46ac16c71deffee9a6f71264a8550233781474d60cc6001a48c7c658c77d4e0dbd5b543e768928119d2f0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsx800E.tmp\7z-out\locales\te.pak

Filesize
1.1MB

MD5
5f9b7a945638b88e75a3175a7923119d

SHA1
6af614f2cbd72da2224f48a203a6430a623fc7ed

SHA256
3b476d2ce7c72c3a10170808020dc3f1a87309f9f725b08217c4716b28d10888

SHA512
3b66c9152ec032d6f2372ae5075cbfe7d0fb398c4bf173a7f8c76d91d9eaa816e6f839b90884533b46a9224e9fb52c4d439b3d1907885b8e9f80c5c55a852b65

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsx800E.tmp\7z-out\locales\th.pak

Filesize
918KB

MD5
84ad3f888c0ec307bb7b8c278cd36757

SHA1
948a5f8b43d059280d5374ca6d66e8dfc6a76d49

SHA256
56665860fe6577fbe00543a47a15e10eceae83458815f2989d179e42af07f81b

SHA512
7001c0607df927145e40a605e2b97914d02712d11e09ca20339cb1aefb042a1f853fd06e78b76f6dc6f19b6df837bca12946a3470c6c064ca767af1db57042e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsx800E.tmp\7z-out\locales\tr.pak

Filesize
465KB

MD5
0aedf5c2f6f4f49074a2adea454df4c9

SHA1
a48d9d8461e61170257897766dbd6906e754a0c3

SHA256
3f4658b3811b36f5cad794e48e6507335abfe78b0bfa0c80d1ef9c5d7bb410d0

SHA512
e359e446330fc154c16e34a7335174f372bce701faf85de8a5f4b432ce3e10c69f42c93b7182deac89bb4d29750d0dd525b6dcd74a5b7bd724f544d14ba44a79

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsx800E.tmp\7z-out\locales\uk.pak

Filesize
798KB

MD5
64aa9344abd9a32f10d6c05a58eda4eb

SHA1
3286ee43f36e2232677b4573e8b4a3303c7df048

SHA256
ca20af5982ae706f5029467901d7d66f90b261f03c7d240d0d1ab2fca2b50a7b

SHA512
dd768b314da50b8ba5a006a4e56d70044c1af79960834722894d930f5347194ae7f9f5697bc4cd0790a79341635cb1df8c74ff45f74d1736049161af5b163efb

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsx800E.tmp\7z-out\locales\ur.pak

Filesize
696KB

MD5
88eef2798dee8a361c3ea9bafaa02a35

SHA1
6f8d4ce422336ca5048ef35d6ece360a9b416d8a

SHA256
91318006c880e427417a2b2fff81fd451769a5536fa16d1dc185972137bc2d6a

SHA512
db36b58186f165ff3f746ac483f75b6fed596fad9b3f335e86b374b359e563407acf58ac7cded9420e4fcb91f31eebc8a91c7777ea59bafced8cff2f1c0e9a53

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsx800E.tmp\7z-out\locales\vi.pak

Filesize
551KB

MD5
4c5c09cb7e6eb120c8019fe94e1ac716

SHA1
f018e7f095605e21db24944b828cc3580cba863f

SHA256
e7319ca18eba379772954132493bbabb448d4e97d755b85360ed337216b48800

SHA512
d171ee83cf02a8904290a74df1224556887e41333b8a01fbd95f0cacc88d230195fbfb6f99f9e02573d4864b3c95b570a77c2a0b1e19324d2599925e40684807

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsx800E.tmp\7z-out\locales\zh-CN.pak

Filesize
398KB

MD5
07b6c43d87dbf93ac8abe6837f3c2103

SHA1
79e033179b445609b3f1756c3f4184d5efacf1c2

SHA256
7f85b35938fadca91bfd8f92ca53613718e375ef010c340947dd27a4ff66594c

SHA512
38ef8f8a8a950b11c18eb7a40da721b888ef792a49e1371dc8c1eb22058a6791f95bf9b25df4ba190a7aa6cb62ce38b0bfaea83c71b62cde6980d12cf9da53f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsx800E.tmp\7z-out\locales\zh-TW.pak

Filesize
394KB

MD5
960e99a171c4ed4b6d787027ba88774d

SHA1
e3869aff0c52841c9df718133e7c4be2977de7fb

SHA256
e42640f5309add2ea7fd5a4db503b93e479ef14807710a06d7e53a0f261da8e6

SHA512
4e51d787aff8f425d101882bd70e71b88b253f2ca61ed54dd7ff77c7e3a1d6570b270f4eb91f2d03869ea4537d09e141f3e32ea3a27537295ec698bf26305cbf

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsx800E.tmp\7z-out\resources.pak

Filesize
5.2MB

MD5
4f1e4a359a66a46eb55313e04090e102

SHA1
e3f971830be08bf10638ec136e7b9a7990abe4d2

SHA256
50dfd64b881b8ff256c7fc4d3743389e6e2f95cf6da453629557812ddc0f7004

SHA512
7762848e8404dacce11a83195ab4e8d1cf391d9916f27e165ee257a6ba7d6a73fc12c855be74c734eacc897cf64655b949557ea12275f3d488cc3680d7fb5e7e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsx800E.tmp\7z-out\resources\app.asar

Filesize
149.2MB

MD5
ec282b5b3ec1d798c5e8408b59d98762

SHA1
9c447f5d8727b63d09c00381cd99a3f3998df67c

SHA256
44b73578b81dd8d199c31cb1942ba203c4cef6d5f0a96296b6d24bbb5f137951

SHA512
d7d42f6d4f6e390d0f5ecb8be07a88214c52b108a58bee27642096891c98b47290b886700ad47ffdae439588ef80a48b57f94d3e53b0d19ebd989b53a796f7ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsx800E.tmp\7z-out\resources\elevate.exe

Filesize
105KB

MD5
792b92c8ad13c46f27c7ced0810694df

SHA1
d8d449b92de20a57df722df46435ba4553ecc802

SHA256
9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37

SHA512
6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsx800E.tmp\7z-out\snapshot_blob.bin

Filesize
262KB

MD5
40a3c2200e4126e8c47a7802532c9236

SHA1
212a4686dea5a467b7b6fa54397e42122b235f1e

SHA256
94aa518fc892ee9a0f1eb5fe35b60123ee61a5f848864b00519b96d8d5d9786d

SHA512
fa1a943822abe3737587d520654078117cae86c58fefe6dd6a09f4a08c09293e9547a0ad79c52f8638dfbb1c496df3d0e828ce414176c8fbb77113be41212866

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsx800E.tmp\7z-out\v8_context_snapshot.bin

Filesize
581KB

MD5
264e3b574e4f86b1fc47b2427402e779

SHA1
4a4f9e7c3da262713e4cf7af6ac51822c56b5ef3

SHA256
ed559c6e81b6003b2057e5c1b0bdb5b28ca094b895ca86c69fe11c5c9e014f06

SHA512
144365d0fb83576aaa02ea6ecea51d7ba2cacb044eea568a08f65b98a83d3e7d7e693738e065e22f94bfd1165d0ea93a749dd1325d829257a9bb6607a9a927db

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsx800E.tmp\7z-out\vk_swiftshader.dll

Filesize
4.9MB

MD5
c055a29d48eded654fc91227af64dfa7

SHA1
2e9dde9c9d1f612dd4ff85d6b9415c2571e20741

SHA256
f34b0949439787926295b2a7c0f45b0c8176c1668d881fd0f9f1f579f9c58295

SHA512
6948c4236394b885ae5a059376d6b78aec039cf6574689d7d8fd0c0ec7965c12e63df19b8d0834e764ad06e8f48cc6f298f7262f3549ea50376f116c7a209767

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsx800E.tmp\7z-out\vk_swiftshader_icd.json

Filesize
106B

MD5
8642dd3a87e2de6e991fae08458e302b

SHA1
9c06735c31cec00600fd763a92f8112d085bd12a

SHA256
32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9

SHA512
f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsx800E.tmp\7z-out\vulkan-1.dll

Filesize
917KB

MD5
71700726c19de427a698771df0305fd9

SHA1
878c75ac6225c269edd26c295489b44cd99bdf31

SHA256
a8c740555266e601857a088ceb9c7c1b07a240fc496ad7f4124c6c7b8a694503

SHA512
cd26f9e050879ba60cbe6acae59d3d424901817775514a018bf23d606ebf52b8b3310bd0bb566dbe8681e4f666c850621ccc699aecede9fe5a827fa76c0e8dce

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
b2820de278693dfa2d676e5fb505aaaf

SHA1
08db2322b161280f279eab05fba325ec37c59b35

SHA256
b1e531855aae32519459e3260f27946d8dcfafe976fff50bb80c3b3b11283fee

SHA512
a6a83d34c4707540b2c71693bb707d98fc263c9884efc12b5a3c2087f30fa62133f1190b5e1670e83d72cb6a4d71abce37249bb81b19a49ebc67fc1714c8e30a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\datareporting\glean\pending_pings\61b78777-b33d-4a39-9ce4-82e6eec7dfbe

Filesize
746B

MD5
5a8c3ca2c7a7b946ffdb89246f623f6f

SHA1
07e66c24e580a666812f6e4b8c7fa951cbe4ebc9

SHA256
85d85977bce9abd9c28e560cf3405f315acfa341a598a41c46611ae8b22c4c02

SHA512
b4642f85def24392237a5614003abccbd0bd6b3caa59194b963b49c89e80cb6111b495b7f8d1c95201043a422b452954a01c1c2593962d628ab36ef4a936df7e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\datareporting\glean\pending_pings\a86d574a-3312-466d-af6c-cfe9dae5dd83

Filesize
10KB

MD5
ac7d51331861dac8b13721728631fb96

SHA1
745dd5579169d873e4340f6702426889b577273a

SHA256
a565ec666610c02c58ffdc56a5ee437220f03345d8bcd56b01d896fd69819c7b

SHA512
a1a6cce89e79d642b2101b2119038aafca7eb3330676989b08ca8f618234d5f86b568aa0c8dbfb4ceef23267238c153b87a1fea418203c05f04c4c0c3fb7957c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\prefs-1.js

Filesize
6KB

MD5
cb9e5b5cf0f8462dc941a626e3935a33

SHA1
ee30d00e830d94a4d4b5b9749d20ab0e897d6664

SHA256
d73adf1fa0c5e7dcfdf8368a0313c78b71d016ba66d07be43dba69fb400b764c

SHA512
6e3d5bb6c2a9c457d3880b9636273cca774eb4009627d1a6ddbd2bc114524bbaec716f25f4bb9e759e1ca9788204a08786bfdfcc9d2c24de96c1a0f06d35b027

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\prefs-1.js

Filesize
6KB

MD5
7e5ad88c0e0205968540532441c360dd

SHA1
9bfd2cd2ac78b469faa5bc9bcc05dae42f569c6d

SHA256
64a3e9b367847a3a01b84956ea5e0288bd7f7c8bff6aa258aa3af829b5fed82e

SHA512
d18337f65c106bd120b297906b54130fd623992881a4cb2b6cff222f2056f635f890bee185a1b27d2137229f71a290e2edfc9e94f9d84264d8e053805e64025a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
d9a4fa32afcd20e7329337729a3b9f70

SHA1
f77b507b8511ffcc0e6e1f7c9483cc170bfac905

SHA256
97e176525c4ff7692f5aa1673ceb2eae38cd0138e6b570e41220ddb3f357a2e3

SHA512
892cd70236c65baff4d6c4398a3662468a6809b232b8ea6090d0170406e0abfdd0a303f20f66a05ddfa1c33f3196dbcd7b1df1b1bbe10f7c812fe2df522db43e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
2eece5d197c2ede7d6f3b3ecd98b0b5a

SHA1
6b3ebd0bbf7bcbc72a0773a26ebd2a80f7e35428

SHA256
95efadbfe44f096f1cd372daa347294425824df3afa8bcde850a4b69ad90192a

SHA512
232d4126fcc501d4eb6513517739c62469ce6f9cec48604dc7c963d50cbf3f8383522dece578a4ff6e18bba874854a4fcd24e98a17e76c5eaa86bbe827d39a67

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
d91c6896bb7ed3aefee485647e823005

SHA1
8b8549ec6166df7963d45b9d36dcb4c6f46844c1

SHA256
1b9c8ccab918e871f8d71968b89b1873258baa73955d9697fc9b155c5c419cb1

SHA512
b4b1bbea5655273b34a7b29a8f3a9000abcf729693235f46c5f7c0a92415eb27b0160b0f1820e9aa244742844be15429e805bd0b1bb80591c4b047564c9774f1

Download Submit
\Users\Admin\AppData\Local\Temp\1ab54b8f-4d97-4667-866a-49697faa715c.tmp.node

Filesize
151KB

MD5
42e1132b8c76beacb22f7d3961ee9c90

SHA1
a6c22028c937bd6afe6d79f8f2b95fcd60026a3d

SHA256
e099e6720a7568f79d0602632653746677ee6e2753639c9f54225101d6d94cf0

SHA512
3e79a9815c2958f8b477d00a527adb3653b939771846fa379b06c0f3438497b242bef357faa270cd4b593b23bef30a1d918bff933845cf11194c81ca61eeb76d

Download Submit
\Users\Admin\AppData\Local\Temp\78f85ae0-7973-428e-821b-e44058567648.tmp.node

Filesize
1.4MB

MD5
56192831a7f808874207ba593f464415

SHA1
e0c18c72a62692d856da1f8988b0bc9c8088d2aa

SHA256
6aa8763714aa5199a4065259af792292c2a7d6a2c381aa27007255421e5c9d8c

SHA512
c82aa1ef569c232b4b4f98a3789f2390e5f7bf5cc7e73d199fe23a3f636817edfdc2fb49ce7f69169c028a9dd5ab9f63e8f64964bb22424fc08db71e85054a33

Download Submit
\Users\Admin\AppData\Local\Temp\nsx800E.tmp\StdUtils.dll

Filesize
100KB

MD5
c6a6e03f77c313b267498515488c5740

SHA1
3d49fc2784b9450962ed6b82b46e9c3c957d7c15

SHA256
b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e

SHA512
9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

Download Submit
\Users\Admin\AppData\Local\Temp\nsx800E.tmp\System.dll

Filesize
12KB

MD5
0d7ad4f45dc6f5aa87f606d0331c6901

SHA1
48df0911f0484cbe2a8cdd5362140b63c41ee457

SHA256
3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

SHA512
c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

Download Submit
\Users\Admin\AppData\Local\Temp\nsx800E.tmp\nsis7z.dll

Filesize
424KB

MD5
80e44ce4895304c6a3a831310fbf8cd0

SHA1
36bd49ae21c460be5753a904b4501f1abca53508

SHA256
b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592

SHA512
c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df

Download Submit
memory/8060-618-0x00007FFF4E460000-0x00007FFF4EE4C000-memory.dmp

Filesize
9.9MB

Download
memory/8060-613-0x0000020876AD0000-0x0000020876AE0000-memory.dmp

Filesize
64KB

Download
memory/8060-605-0x0000020876AD0000-0x0000020876AE0000-memory.dmp

Filesize
64KB

Download
memory/8060-606-0x0000020876AD0000-0x0000020876AE0000-memory.dmp

Filesize
64KB

Download
memory/8060-604-0x00007FFF4E460000-0x00007FFF4EE4C000-memory.dmp

Filesize
9.9MB

Download
memory/8060-595-0x0000020878B30000-0x0000020878BA6000-memory.dmp

Filesize
472KB

Download
memory/8060-592-0x0000020878980000-0x00000208789A2000-memory.dmp

Filesize
136KB

Download
memory/10196-630-0x000001C3E8F00000-0x000001C3E8F10000-memory.dmp

Filesize
64KB

Download
memory/10196-628-0x000001C3E8F00000-0x000001C3E8F10000-memory.dmp

Filesize
64KB

Download
memory/10196-651-0x000001C3E8F00000-0x000001C3E8F10000-memory.dmp

Filesize
64KB

Download
memory/10196-652-0x00007FFF4E460000-0x00007FFF4EE4C000-memory.dmp

Filesize
9.9MB

Download
memory/10196-626-0x00007FFF4E460000-0x00007FFF4EE4C000-memory.dmp

Filesize
9.9MB

Download