Analysis

  • max time kernel
    151s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/11/2024, 17:47

General

  • Target
    Wave-Setup.exe
  • Size 125.7MB
  • Sample241107-wcv6eswlez
  • SHA256 147274d9afc26a3fdfa72ef3449a22300b63705bdea75a879676c9ac2d07435d
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 18 IoCs
  • Checks for any installed AV software in registry 1 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates processes with tasklist 1 TTPs 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 21 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 63 IoCs
  • Suspicious use of SendNotifyMessage 61 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Wave-Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\Wave-Setup.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1124
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq Wave.exe" /FO csv | "C:\Windows\system32\find.exe" "Wave.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4436
      • C:\Windows\SysWOW64\tasklist.exe
        tasklist /FI "USERNAME eq Admin" /FI "IMAGENAME eq Wave.exe" /FO csv
        3⤵
        • Enumerates processes with tasklist
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3460
      • C:\Windows\SysWOW64\find.exe
        "C:\Windows\system32\find.exe" "Wave.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1364
  • C:\Users\Admin\AppData\Local\Programs\Wave\Wave.exe
    "C:\Users\Admin\AppData\Local\Programs\Wave\Wave.exe"
    1⤵
    • Checks computer location settings
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4372
    • C:\Users\Admin\AppData\Local\Programs\Wave\Wave.exe
      "C:\Users\Admin\AppData\Local\Programs\Wave\Wave.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Wave" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1720,i,5289147034322310060,15367512349629629399,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1704 /prefetch:2
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:3304
    • C:\Users\Admin\AppData\Local\Programs\Wave\Wave.exe
      "C:\Users\Admin\AppData\Local\Programs\Wave\Wave.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Wave" --standard-schemes=app --secure-schemes=app --field-trial-handle=2020,i,5289147034322310060,15367512349629629399,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2016 /prefetch:3
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:3544
    • C:\Windows\system32\fsutil.exe
      fsutil dirty query C:
      2⤵
        PID:832
      • C:\Users\Admin\AppData\Local\Programs\Wave\Wave.exe
        "C:\Users\Admin\AppData\Local\Programs\Wave\Wave.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Wave" --standard-schemes=app --secure-schemes=app --app-path="C:\Users\Admin\AppData\Local\Programs\Wave\resources\app.asar" --enable-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=3004,i,5289147034322310060,15367512349629629399,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3000 /prefetch:1
        2⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        PID:5724
      • C:\Users\Admin\AppData\Local\Programs\Wave\resources\node_modules\language-server\wave-luau.exe
        C:\Users\Admin\AppData\Local\Programs\Wave\resources\node_modules\language-server\wave-luau.exe lsp --definitions=C:\Users\Admin\AppData\Local\Programs\Wave\resources\node_modules\language-server\globalTypes.d.luau --definitions=C:\Users\Admin\AppData\Local\Programs\Wave\resources\node_modules\language-server\wave.d.luau --docs=C:\Users\Admin\AppData\Local\Programs\Wave\resources\node_modules\language-server\en-us.json
        2⤵
        • Executes dropped EXE
        PID:6124
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKCU\Software\KasperskyLab" /v Session"
        2⤵
          PID:1488
          • C:\Windows\system32\reg.exe
            C:\Windows\system32\reg.exe QUERY "HKCU\Software\KasperskyLab" /v Session
            3⤵
            • Checks for any installed AV software in registry
            PID:4020
        • C:\Users\Admin\AppData\Local\Programs\Wave\bin\Bloxstrap.exe
          C:\Users\Admin\AppData\Local\Programs\Wave\bin\Bloxstrap.exe
          2⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:4564
        • C:\Users\Admin\AppData\Local\Programs\Wave\Wave.exe
          "C:\Users\Admin\AppData\Local\Programs\Wave\Wave.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\Wave" --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=3060,i,5289147034322310060,15367512349629629399,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=4156 /prefetch:8
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious behavior: EnumeratesProcesses
          PID:1812
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        1⤵
        • Enumerates system info in registry
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:4464
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff897dbcc40,0x7ff897dbcc4c,0x7ff897dbcc58
          2⤵
            PID:1876
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2096,i,315738403189852588,2931346825235010674,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1856 /prefetch:2
            2⤵
              PID:3552
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2016,i,315738403189852588,2931346825235010674,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2152 /prefetch:3
              2⤵
                PID:1188
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2268,i,315738403189852588,2931346825235010674,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2312 /prefetch:8
                2⤵
                  PID:1100
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3180,i,315738403189852588,2931346825235010674,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3200 /prefetch:1
                  2⤵
                    PID:5392
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3352,i,315738403189852588,2931346825235010674,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3296 /prefetch:1
                    2⤵
                      PID:5400
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4640,i,315738403189852588,2931346825235010674,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4652 /prefetch:1
                      2⤵
                        PID:5668
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4732,i,315738403189852588,2931346825235010674,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4724 /prefetch:8
                        2⤵
                          PID:5744
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4728,i,315738403189852588,2931346825235010674,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4860 /prefetch:8
                          2⤵
                            PID:5760
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5016,i,315738403189852588,2931346825235010674,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5028 /prefetch:8
                            2⤵
                              PID:1940
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5104,i,315738403189852588,2931346825235010674,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4944 /prefetch:8
                              2⤵
                                PID:4480
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4920,i,315738403189852588,2931346825235010674,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5028 /prefetch:8
                                2⤵
                                  PID:5092
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5220,i,315738403189852588,2931346825235010674,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5232 /prefetch:8
                                  2⤵
                                    PID:4088
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5100,i,315738403189852588,2931346825235010674,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5324 /prefetch:8
                                    2⤵
                                      PID:2560
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4832,i,315738403189852588,2931346825235010674,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5332 /prefetch:8
                                      2⤵
                                        PID:1580
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=5776,i,315738403189852588,2931346825235010674,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5752 /prefetch:2
                                        2⤵
                                          PID:5296
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=4756,i,315738403189852588,2931346825235010674,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5720 /prefetch:1
                                          2⤵
                                            PID:5844
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=3512,i,315738403189852588,2931346825235010674,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3532 /prefetch:1
                                            2⤵
                                              PID:5248
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=4516,i,315738403189852588,2931346825235010674,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5484 /prefetch:1
                                              2⤵
                                                PID:2216
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5568,i,315738403189852588,2931346825235010674,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5460 /prefetch:8
                                                2⤵
                                                  PID:5272
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5640,i,315738403189852588,2931346825235010674,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5412 /prefetch:8
                                                  2⤵
                                                    PID:5256
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --field-trial-handle=3528,i,315738403189852588,2931346825235010674,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3184 /prefetch:1
                                                    2⤵
                                                      PID:1688
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --field-trial-handle=5736,i,315738403189852588,2931346825235010674,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5928 /prefetch:1
                                                      2⤵
                                                        PID:3408
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --field-trial-handle=3444,i,315738403189852588,2931346825235010674,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5976 /prefetch:1
                                                        2⤵
                                                          PID:6084
                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --field-trial-handle=5428,i,315738403189852588,2931346825235010674,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4104 /prefetch:1
                                                          2⤵
                                                            PID:2288
                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --field-trial-handle=5460,i,315738403189852588,2931346825235010674,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3560 /prefetch:1
                                                            2⤵
                                                              PID:2780
                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --field-trial-handle=5440,i,315738403189852588,2931346825235010674,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3500 /prefetch:1
                                                              2⤵
                                                                PID:4136
                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --field-trial-handle=5368,i,315738403189852588,2931346825235010674,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4952 /prefetch:1
                                                                2⤵
                                                                  PID:3708
                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --field-trial-handle=5024,i,315738403189852588,2931346825235010674,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6132 /prefetch:1
                                                                  2⤵
                                                                    PID:1788
                                                                • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                                                                  "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                                                                  1⤵
                                                                    PID:3792
                                                                  • C:\Windows\system32\svchost.exe
                                                                    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                                                    1⤵
                                                                      PID:4548
                                                                    • C:\Windows\system32\taskmgr.exe
                                                                      "C:\Windows\system32\taskmgr.exe" /4
                                                                      1⤵
                                                                      • Checks SCSI registry key(s)
                                                                      • Checks processor information in registry
                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                      • Suspicious use of FindShellTrayWindow
                                                                      • Suspicious use of SendNotifyMessage
                                                                      PID:5204

                                                                    Network

                                                                          MITRE ATT&CK Enterprise v15

                                                                          Replay Monitor

                                                                          Loading Replay Monitor...

                                                                          Downloads

                                                                          BrowsingTopicsState

                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
                                                                          • Size 649B
                                                                          • SHA256 3dce5b4febc2e6e51055fd29353410ddad8ae8400f4f3b99124cc9aefa194792
                                                                          • MD5 SHA1 SHA512

                                                                          f_000008

                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000008
                                                                          • Size 215KB
                                                                          • SHA256 6e51c7866705bf0098febfaf05cf4652f96e69ac806c837bfb1199b6e21e6aaf
                                                                          • MD5 SHA1 SHA512 SSDEEP

                                                                          messages.json

                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.83.1_0\_locales\en_CA\messages.json
                                                                          • Size 851B
                                                                          • SHA256 6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c
                                                                          • MD5 SHA1 SHA512

                                                                          dasherSettingSchema.json

                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.83.1_0\dasherSettingSchema.json
                                                                          • Size 854B
                                                                          • SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
                                                                          • MD5 SHA1 SHA512

                                                                          Network Persistent State

                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                          • Size 12KB
                                                                          • SHA256 4170e1e55ae7ee8c0f17dc98a65775c89bc809fda09bd3365246f80597b57e31
                                                                          • MD5 SHA1 SHA512 SSDEEP

                                                                          SCT Auditing Pending Reports

                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                                                          • Size 2B
                                                                          • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                          • MD5 SHA1 SHA512

                                                                          TransportSecurity

                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                          • Size 2KB
                                                                          • SHA256 cee14b5c821cf135c31dde228030da8157fc73f63fb3a52ce92ea4aad715f444
                                                                          • MD5 SHA1 SHA512

                                                                          TransportSecurity

                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                          • Size 2KB
                                                                          • SHA256 5501c075f5553350fbc01db8b4771e0395f7a3e96a24d2599031dac5949208f1
                                                                          • MD5 SHA1 SHA512

                                                                          TransportSecurity

                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                          • Size 356B
                                                                          • SHA256 74bcb40a182da33066133b7278b03febb3bb7b3a89cc1d9cca084e290ec1c722
                                                                          • MD5 SHA1 SHA512

                                                                          TransportSecurity

                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                          • Size 2KB
                                                                          • SHA256 70662f6660abd9b932a306afc25283fa2e5665b54a896bfa78ae83eebf64e2e3
                                                                          • MD5 SHA1 SHA512

                                                                          TransportSecurity

                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                          • Size 356B
                                                                          • SHA256 f33b6a86871611008b76795acfed1451290b670aedbc7135a38bf7ca4b3c4231
                                                                          • MD5 SHA1 SHA512

                                                                          CURRENT

                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Platform Notifications\CURRENT
                                                                          • Size 16B
                                                                          • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                                          • MD5 SHA1 SHA512

                                                                          Preferences

                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                          • Size 10KB
                                                                          • SHA256 a8ca9470acd4d58630c35ac8c867c8ecaa9a2544a90fd9f03cc99a457c136604
                                                                          • MD5 SHA1 SHA512 SSDEEP

                                                                          Preferences

                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                          • Size 10KB
                                                                          • SHA256 b02f8a19e45abf2a6864046f531b7169b567156f26929fa64f5f39724f8e6ae0
                                                                          • MD5 SHA1 SHA512 SSDEEP

                                                                          Preferences

                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                          • Size 9KB
                                                                          • SHA256 a0530e652e2302f2b3445864a49c689e7be2402f648d36b70f322f13a5430293
                                                                          • MD5 SHA1 SHA512 SSDEEP

                                                                          Preferences

                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                          • Size 10KB
                                                                          • SHA256 7f07d0f7cabea00e5a054268c899aaecac79a4b82b3fc26874be9a78d6e819ce
                                                                          • MD5 SHA1 SHA512 SSDEEP

                                                                          Preferences

                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                          • Size 9KB
                                                                          • SHA256 7ef50fcedd4249e87ad1c64c562eb9a9e03197f485cc7a6de043548fb232e40c
                                                                          • MD5 SHA1 SHA512 SSDEEP

                                                                          the-real-index

                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                                                          • Size 72B
                                                                          • SHA256 538631b549e37d51adf133ca071a2a68707c5746fbc8c29ab32cd036544f3784
                                                                          • MD5 SHA1 SHA512

                                                                          a1901e4e-87f0-4ba3-8962-a0b755be3ef4.tmp

                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\a1901e4e-87f0-4ba3-8962-a0b755be3ef4.tmp
                                                                          • Size 15KB
                                                                          • SHA256 1acda54761e4a3a31662e52da768f5ca5122dadf51fc828a9b6b641fff07e3b6
                                                                          • MD5 SHA1 SHA512 SSDEEP

                                                                          Local State

                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                          • Size 232KB
                                                                          • SHA256 8a28d618bc7389209eba9b466c2317abafe31eced5a05925e3654564f77bfd88
                                                                          • MD5 SHA1 SHA512 SSDEEP

                                                                          Local State

                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                          • Size 232KB
                                                                          • SHA256 fe2c816fc5baf02641fd56d2609e19d5b82f52bfcc0cf91e64cd05bad1c7a163
                                                                          • MD5 SHA1 SHA512 SSDEEP

                                                                          Bloxstrap.exe

                                                                          • Path C:\Users\Admin\AppData\Local\Programs\Wave\bin\Bloxstrap.exe
                                                                          • Size 11.0MB
                                                                          • SHA256 0ee218fde47582841e22fb4f2c866ec8bdcbeb00f8d636876677b2ecfde50792
                                                                          • MD5 SHA1 SHA512 SSDEEP

                                                                          chrome_100_percent.pak

                                                                          • Path C:\Users\Admin\AppData\Local\Programs\Wave\chrome_100_percent.pak
                                                                          • Size 148KB
                                                                          • SHA256 7dd5485def22a53c0635efdf8ae900f147ec8c8a22b9ed71c24668075dd605d3
                                                                          • MD5 SHA1 SHA512 SSDEEP

                                                                          LICENSE.electron.txt

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\LICENSE.electron.txt
                                                                          • Size 1KB
                                                                          • SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
                                                                          • MD5 SHA1 SHA512

                                                                          LICENSES.chromium.html

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\LICENSES.chromium.html
                                                                          • Size 9.0MB
                                                                          • SHA256 c6737ef4ed9de369077718824f76c5e7026d0e39163e26af8606783e41c93e18
                                                                          • MD5 SHA1 SHA512 SSDEEP

                                                                          chrome_200_percent.pak

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\chrome_200_percent.pak
                                                                          • Size 223KB
                                                                          • SHA256 2408969599d3953aae2fb36008e4d0711e30d0bc86fb4d03f8b0577d43c649fa
                                                                          • MD5 SHA1 SHA512 SSDEEP

                                                                          d3dcompiler_47.dll

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\d3dcompiler_47.dll
                                                                          • Size 4.7MB
                                                                          • SHA256 af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a
                                                                          • MD5 SHA1 SHA512 SSDEEP

                                                                          ffmpeg.dll

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\ffmpeg.dll
                                                                          • Size 2.6MB
                                                                          • SHA256 223448ec1715cb4b1a2abbf1427547956f3ce583092177c287542e6d226319c7
                                                                          • MD5 SHA1 SHA512 SSDEEP

                                                                          icudtl.dat

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\icudtl.dat
                                                                          • Size 10.0MB
                                                                          • SHA256 9ae98c06cbb0ea43c5cd6b5725310c008c65e46072421a1118cb88e1de9a8b92
                                                                          • MD5 SHA1 SHA512 SSDEEP

                                                                          libEGL.dll

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\libEGL.dll
                                                                          • Size 470KB
                                                                          • SHA256 1307025ed98ecfd00770c2d5c74c8a5e498c4e457397f17c3cbd176ca8a62a85
                                                                          • MD5 SHA1 SHA512 SSDEEP

                                                                          libGLESv2.dll

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\libGLESv2.dll
                                                                          • Size 7.7MB
                                                                          • SHA256 8e68245d98bb740f393472938612979a56391f127d1af7683253e9e749e7af41
                                                                          • MD5 SHA1 SHA512 SSDEEP

                                                                          af.pak

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\locales\af.pak
                                                                          • Size 494KB
                                                                          • SHA256 e2470090a09ca500679e68bb5e3b1acc35a5873fea4f93af25a23c82122f2c13
                                                                          • MD5 SHA1 SHA512 SSDEEP

                                                                          am.pak

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\locales\am.pak
                                                                          • Size 800KB
                                                                          • SHA256 4e15946e86a578eeff41feda808bb291d81e240fbdfc96cbe2efe692ad35eef5
                                                                          • MD5 SHA1 SHA512 SSDEEP

                                                                          ar.pak

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\locales\ar.pak
                                                                          • Size 874KB
                                                                          • SHA256 5cc02570e5f61cbca791309985df3a29584e41583b3344f1d9fb6b04ce423e6f
                                                                          • MD5 SHA1 SHA512 SSDEEP

                                                                          bg.pak

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\locales\bg.pak
                                                                          • Size 913KB
                                                                          • SHA256 97ef7984074775282b68dca5d5a469efdb2b22474ee6669fdfb5197d3f1b3768
                                                                          • MD5 SHA1 SHA512 SSDEEP

                                                                          bn.pak

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\locales\bn.pak
                                                                          • Size 1.1MB
                                                                          • SHA256 1aba82aee8c985e5e370e7cf2b35c9ec20cbe5174db5fcb54ec7d19ec5d79587
                                                                          • MD5 SHA1 SHA512 SSDEEP

                                                                          ca.pak

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\locales\ca.pak
                                                                          • Size 556KB
                                                                          • SHA256 b3d5dfae25427596b1f14a8e13d6bcb58532c82554229c2367779ff5c42b28bb
                                                                          • MD5 SHA1 SHA512 SSDEEP

                                                                          cs.pak

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\locales\cs.pak
                                                                          • Size 572KB
                                                                          • SHA256 7d7b701ce510b2e4a18e957e500086db590aad8bf5acd37f82263a676f0b556c
                                                                          • MD5 SHA1 SHA512 SSDEEP

                                                                          da.pak

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\locales\da.pak
                                                                          • Size 518KB
                                                                          • SHA256 3430c0f1946901dfa24190ca3989f72171ec564bc7c523853e6a1f531b61b5ee
                                                                          • MD5 SHA1 SHA512 SSDEEP

                                                                          de.pak

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\locales\de.pak
                                                                          • Size 553KB
                                                                          • SHA256 662496eff49febbe49f0a03cf2c51acaa743cb2237de3c41014556e16f3d8e2b
                                                                          • MD5 SHA1 SHA512 SSDEEP

                                                                          el.pak

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\locales\el.pak
                                                                          • Size 1001KB
                                                                          • SHA256 162e51bc7d682e223e498f4ff8c81f019d136d857bd25a1c982d4a1084a8c840
                                                                          • MD5 SHA1 SHA512 SSDEEP

                                                                          en-GB.pak

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\locales\en-GB.pak
                                                                          • Size 450KB
                                                                          • SHA256 7df934906a61c0ae7a952f9ed058f4a06cd3989663a7d9f50afc3c9f830135bb
                                                                          • MD5 SHA1 SHA512 SSDEEP

                                                                          en-US.pak

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\locales\en-US.pak
                                                                          • Size 454KB
                                                                          • SHA256 41123d72bd8e289e85bd35227aabb4cc61fe1de02b5cd7a7834e5ec200bc2078
                                                                          • MD5 SHA1 SHA512 SSDEEP

                                                                          es-419.pak

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\locales\es-419.pak
                                                                          • Size 547KB
                                                                          • SHA256 ec922f8ca16b7e7642fc73369ba7b75ec950cafb1dcadc6c88426c034382d483
                                                                          • MD5 SHA1 SHA512 SSDEEP

                                                                          es.pak

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\locales\es.pak
                                                                          • Size 547KB
                                                                          • SHA256 0385e6776de5a0d8a3b30b7bad44308ac4cb04e2bcebd573d3c7938b68036573
                                                                          • MD5 SHA1 SHA512 SSDEEP

                                                                          et.pak

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\locales\et.pak
                                                                          • Size 497KB
                                                                          • SHA256 ba4ec85d2306a1f1f178a017fef4d340b77b33e10bbee07bd359a8e0ff8ea461
                                                                          • MD5 SHA1 SHA512 SSDEEP

                                                                          fa.pak

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\locales\fa.pak
                                                                          • Size 813KB
                                                                          • SHA256 f1a7351bf0d8cad475d2761b9edf970c3098836e38aa98106a5e04a41002b7c8
                                                                          • MD5 SHA1 SHA512 SSDEEP

                                                                          fi.pak

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\locales\fi.pak
                                                                          • Size 508KB
                                                                          • SHA256 11b0b9b0f74d01f16db7aa49be9dceeb55fde9da56f17419c4bca159cdcae274
                                                                          • MD5 SHA1 SHA512 SSDEEP

                                                                          fil.pak

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\locales\fil.pak
                                                                          • Size 573KB
                                                                          • SHA256 d7fdc7fd08dcc421bc8aaae3fdc72599c60a3b96f05989a3e46736f0de06e745
                                                                          • MD5 SHA1 SHA512 SSDEEP

                                                                          fr.pak

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\locales\fr.pak
                                                                          • Size 591KB
                                                                          • SHA256 1f6cc56e04bcbd6b6ecbe500bcb0a5702551ec80d79e624642d0c7d9758d4424
                                                                          • MD5 SHA1 SHA512 SSDEEP

                                                                          gu.pak

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\locales\gu.pak
                                                                          • Size 1.1MB
                                                                          • SHA256 087e99953eef9b5fd736e3dbd98d702fdb01dc614593a4c575cb619159688118
                                                                          • MD5 SHA1 SHA512 SSDEEP

                                                                          he.pak

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\locales\he.pak
                                                                          • Size 713KB
                                                                          • SHA256 20b1c80f8b2bd5130a1fb372814fb9c9ceac15305da3da0cb29923960a94a934
                                                                          • MD5 SHA1 SHA512 SSDEEP

                                                                          hi.pak

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\locales\hi.pak
                                                                          • Size 1.2MB
                                                                          • SHA256 9c6d8d93278a6e375405142df9829adefbcc8ae9797a4f589591b9784b2b71c8
                                                                          • MD5 SHA1 SHA512 SSDEEP

                                                                          hr.pak

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\locales\hr.pak
                                                                          • Size 551KB
                                                                          • SHA256 afed35643df24709c8c5cc9b8158b3d9a2266fbfeed132e98ff254ced4086c5f
                                                                          • MD5 SHA1 SHA512 SSDEEP

                                                                          hu.pak

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\locales\hu.pak
                                                                          • Size 595KB
                                                                          • SHA256 b4e6a1135de8bdc42c04f4db4eb1ce48256f18eb46a5146a21010b6165a90e7a
                                                                          • MD5 SHA1 SHA512 SSDEEP

                                                                          id.pak

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\locales\id.pak
                                                                          • Size 490KB
                                                                          • SHA256 a21f9474a19fe2d7f26c59f5ba8d6e72801a8a057b7dbcb8b3f96471043d9059
                                                                          • MD5 SHA1 SHA512 SSDEEP

                                                                          it.pak

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\locales\it.pak
                                                                          • Size 539KB
                                                                          • SHA256 33652aae78a486dc3ce4e5affd1b7f72e1248f6f9f3e62188afe3b5d73bd148e
                                                                          • MD5 SHA1 SHA512 SSDEEP

                                                                          ja.pak

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\locales\ja.pak
                                                                          • Size 659KB
                                                                          • SHA256 c5692ca739c31569ae2431fd58f1028e6c8c01af278b76656ee0bb65b79e9985
                                                                          • MD5 SHA1 SHA512 SSDEEP

                                                                          kn.pak

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\locales\kn.pak
                                                                          • Size 1.3MB
                                                                          • SHA256 a6ecf1dfe4d99f6ba0926c696b5b23b77d234fa8fd03da9825b074ecc640d508
                                                                          • MD5 SHA1 SHA512 SSDEEP

                                                                          ko.pak

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\locales\ko.pak
                                                                          • Size 557KB
                                                                          • SHA256 3fa72d61a997c36f9c093f769f4bba60b290d1fbcb71d5544f85e8e1efe51d07
                                                                          • MD5 SHA1 SHA512 SSDEEP

                                                                          lt.pak

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\locales\lt.pak
                                                                          • Size 597KB
                                                                          • SHA256 a1257d10e673311747363e6929832e70f36668b1fc0d6a5ddd550fe88007aa58
                                                                          • MD5 SHA1 SHA512 SSDEEP

                                                                          lv.pak

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\locales\lv.pak
                                                                          • Size 596KB
                                                                          • SHA256 33fdf706f6d3f06b485c5115a7c73a571296dac41c582fc9d0dbb371d86e8653
                                                                          • MD5 SHA1 SHA512 SSDEEP

                                                                          ml.pak

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\locales\ml.pak
                                                                          • Size 1.3MB
                                                                          • SHA256 87384db1ddcac012b0b40ec89daf47ebbbcf1497705f023a6983fb2470e4abd6
                                                                          • MD5 SHA1 SHA512 SSDEEP

                                                                          mr.pak

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\locales\mr.pak
                                                                          • Size 1.1MB
                                                                          • SHA256 039f4e0176c38867fef57482825d043fa63bf1356c85eab0fc665f118db125e4
                                                                          • MD5 SHA1 SHA512 SSDEEP

                                                                          ms.pak

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\locales\ms.pak
                                                                          • Size 514KB
                                                                          • SHA256 2f0c83b5b3bff8f624d78e0670a31c509e7f1d5330f72aaede471b2e97c956e2
                                                                          • MD5 SHA1 SHA512 SSDEEP

                                                                          nb.pak

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\locales\nb.pak
                                                                          • Size 499KB
                                                                          • SHA256 887a0278971d6ba61e2f24c62029a3087a46c4962c4357412c28ede12ed6da15
                                                                          • MD5 SHA1 SHA512 SSDEEP

                                                                          nl.pak

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\locales\nl.pak
                                                                          • Size 516KB
                                                                          • SHA256 619c61701b3a142733d23ad8c7117bc013867a842d3d1d572faa56895ad8257e
                                                                          • MD5 SHA1 SHA512 SSDEEP

                                                                          pl.pak

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\locales\pl.pak
                                                                          • Size 574KB
                                                                          • SHA256 f2a7dcb69a433c2a898866c555b82c26e3515c089f500e7748b9b11ec3047786
                                                                          • MD5 SHA1 SHA512 SSDEEP

                                                                          pt-BR.pak

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\locales\pt-BR.pak
                                                                          • Size 540KB
                                                                          • SHA256 5ff219be32f9178fee40e8966ac5deff2be1f2ff259a66cb9cdce81c2e90a7e8
                                                                          • MD5 SHA1 SHA512 SSDEEP

                                                                          pt-PT.pak

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\locales\pt-PT.pak
                                                                          • Size 543KB
                                                                          • SHA256 02ea290fac25b414a1d4ed78cdc159cf6c73fe5350824c2f36f032e426a23364
                                                                          • MD5 SHA1 SHA512 SSDEEP

                                                                          ro.pak

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\locales\ro.pak
                                                                          • Size 562KB
                                                                          • SHA256 655c175903a791d0ff56264a487c53f7bd09ed037cf04cfa6e79eb8be5b677e9
                                                                          • MD5 SHA1 SHA512 SSDEEP

                                                                          ru.pak

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\locales\ru.pak
                                                                          • Size 924KB
                                                                          • SHA256 4babe5f20caafca33867ee263aa9dd55ed271704a062e4372fdd133eb359a558
                                                                          • MD5 SHA1 SHA512 SSDEEP

                                                                          sk.pak

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\locales\sk.pak
                                                                          • Size 580KB
                                                                          • SHA256 89f984a67cea3997c704005fbfbacd3f6f5652248626945c2ab1c3bcf24e6623
                                                                          • MD5 SHA1 SHA512 SSDEEP

                                                                          sl.pak

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\locales\sl.pak
                                                                          • Size 556KB
                                                                          • SHA256 458b15bf249c1e6fe9843725c42443274ef6e09dcb15f5288c916c0561aefc47
                                                                          • MD5 SHA1 SHA512 SSDEEP

                                                                          sr.pak

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\locales\sr.pak
                                                                          • Size 859KB
                                                                          • SHA256 4cea4c83b5e887463dadbf470a9953b8175149f31fd07b83406a6fc59acfde41
                                                                          • MD5 SHA1 SHA512 SSDEEP

                                                                          sv.pak

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\locales\sv.pak
                                                                          • Size 501KB
                                                                          • SHA256 105460cb717104d82f99cf8c5e2c51ff252211a605bd1c98bf75981f100d619e
                                                                          • MD5 SHA1 SHA512 SSDEEP

                                                                          sw.pak

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\locales\sw.pak
                                                                          • Size 529KB
                                                                          • SHA256 f0fccf2e3ad332846736d816e254028569f5f84918573872442987a8bc9bba58
                                                                          • MD5 SHA1 SHA512 SSDEEP

                                                                          ta.pak

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\locales\ta.pak
                                                                          • Size 1.3MB
                                                                          • SHA256 1cebac8d758298ed2763e62b9bdfb17351831e691ff3e1ba85252c9a66d66242
                                                                          • MD5 SHA1 SHA512 SSDEEP

                                                                          te.pak

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\locales\te.pak
                                                                          • Size 1.2MB
                                                                          • SHA256 8264244c6de861817f5b19cef282844a18ed8cb7d4e059451489652749fe931e
                                                                          • MD5 SHA1 SHA512 SSDEEP

                                                                          th.pak

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\locales\th.pak
                                                                          • Size 1.0MB
                                                                          • SHA256 647ad394e92e7610bd0f6c4e08d28748408fcd5a816a35e4622ea7f71cfa7a9d
                                                                          • MD5 SHA1 SHA512 SSDEEP

                                                                          tr.pak

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\locales\tr.pak
                                                                          • Size 539KB
                                                                          • SHA256 f58ed19be62706fb4fd797a6bfd3af5c6ad4b39aef994a577cd28968fcac0291
                                                                          • MD5 SHA1 SHA512 SSDEEP

                                                                          uk.pak

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\locales\uk.pak
                                                                          • Size 923KB
                                                                          • SHA256 13e40208e2c9f4f4b83dcf422610dc82314a8f99ba50acdbd286c508f92eb232
                                                                          • MD5 SHA1 SHA512 SSDEEP

                                                                          ur.pak

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\locales\ur.pak
                                                                          • Size 808KB
                                                                          • SHA256 60310f9a3457fae0395b447a30646211ef4160ba84bd7c36d291af4c8ec2b79a
                                                                          • MD5 SHA1 SHA512 SSDEEP

                                                                          vi.pak

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\locales\vi.pak
                                                                          • Size 639KB
                                                                          • SHA256 fb9463d5655e73fa69cace9800d95f8cd077ee9284fef3bfe162d2bfe220c257
                                                                          • MD5 SHA1 SHA512 SSDEEP

                                                                          zh-CN.pak

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\locales\zh-CN.pak
                                                                          • Size 460KB
                                                                          • SHA256 f0c0ba53c954325b3bbefb333ba23f7fb40a7a4e506043e9f7886089f611943b
                                                                          • MD5 SHA1 SHA512 SSDEEP

                                                                          zh-TW.pak

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\locales\zh-TW.pak
                                                                          • Size 455KB
                                                                          • SHA256 d4033cb3264c7c4cd2636ea2a202421650c449e5bfb10f29949e4c44e91ca93b
                                                                          • MD5 SHA1 SHA512 SSDEEP

                                                                          resources.pak

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\resources.pak
                                                                          • Size 5.3MB
                                                                          • SHA256 61216fee0360053988d5be52ab626c89173c86da1cf0b5a697bc32944282fe14
                                                                          • MD5 SHA1 SHA512 SSDEEP

                                                                          app-update.yml

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\resources\app-update.yml
                                                                          • Size 95B
                                                                          • SHA256 f2063da30e10724592fa8e42767f066c34520c4fc8302b6647a1d2a0a039d71f
                                                                          • MD5 SHA1 SHA512

                                                                          package.json

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\resources\app.asar.unpacked\node_modules\@next\swc-win32-x64-msvc\package.json
                                                                          • Size 430B
                                                                          • SHA256 f6b59292c52960efe68cc3813a78bc505d80cae11d632006770059380173cd53
                                                                          • MD5 SHA1 SHA512

                                                                          .prettierrc.json

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\resources\app.asar.unpacked\node_modules\nodemon\.prettierrc.json
                                                                          • Size 26B
                                                                          • SHA256 37055c98043228133ffcc5cad7bba5ef6c8f24698a551cae547b90f51d22e519
                                                                          • MD5 SHA1 SHA512

                                                                          LICENSE

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\resources\app.asar.unpacked\node_modules\nodemon\LICENSE
                                                                          • Size 1KB
                                                                          • SHA256 0fa6b5d2902f7ac42db390dfd2cb3b4ce82ed45cb5ad5dea41c11d1d67e0934d
                                                                          • MD5 SHA1 SHA512

                                                                          nodemon.js

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\resources\app.asar.unpacked\node_modules\nodemon\bin\nodemon.js
                                                                          • Size 436B
                                                                          • SHA256 9bb0e59dfd1cc00fc40bed0ccf10d88414d915d79875b9dee5c1d5009f4e89cf
                                                                          • MD5 SHA1 SHA512

                                                                          windows-kill.exe

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\resources\app.asar.unpacked\node_modules\nodemon\bin\windows-kill.exe
                                                                          • Size 78KB
                                                                          • SHA256 d35c0d3af8f66984b1ead5cb56744049c1d71ef0791383250ad1086c0e21f865
                                                                          • MD5 SHA1 SHA512 SSDEEP

                                                                          authors.txt

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\resources\app.asar.unpacked\node_modules\nodemon\doc\cli\authors.txt
                                                                          • Size 236B
                                                                          • SHA256 e1e0dfdaaed1f025c106731aff67d664b849635cc6cd3b9b08674db8dbcbc5e7
                                                                          • MD5 SHA1 SHA512

                                                                          config.txt

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\resources\app.asar.unpacked\node_modules\nodemon\doc\cli\config.txt
                                                                          • Size 1KB
                                                                          • SHA256 032c4ca3b1814a39579d7a0a00154a3772d89aece9884d135fdef782f36e27c1
                                                                          • MD5 SHA1 SHA512

                                                                          help.txt

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\resources\app.asar.unpacked\node_modules\nodemon\doc\cli\help.txt
                                                                          • Size 1KB
                                                                          • SHA256 d98c56a3cb9643b399fa04c422da35204dc91cd869c47019e9783fb4f7289adc
                                                                          • MD5 SHA1 SHA512

                                                                          logo.txt

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\resources\app.asar.unpacked\node_modules\nodemon\doc\cli\logo.txt
                                                                          • Size 799B
                                                                          • SHA256 cb0c73fe1bc7676104d6a92ca91250cd562b7f37a564edc260de01a3fc636b6d
                                                                          • MD5 SHA1 SHA512

                                                                          options.txt

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\resources\app.asar.unpacked\node_modules\nodemon\doc\cli\options.txt
                                                                          • Size 1KB
                                                                          • SHA256 3c8ec4fa239f82b2b9f427925ac2f75af2af9147eaecc706b1990540b95ae94b
                                                                          • MD5 SHA1 SHA512

                                                                          topics.txt

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\resources\app.asar.unpacked\node_modules\nodemon\doc\cli\topics.txt
                                                                          • Size 325B
                                                                          • SHA256 5f8f41620ccdc1d7298df4ab786abc7edcf049fa7e06fc69bb26b38cbd453643
                                                                          • MD5 SHA1 SHA512

                                                                          usage.txt

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\resources\app.asar.unpacked\node_modules\nodemon\doc\cli\usage.txt
                                                                          • Size 88B
                                                                          • SHA256 844e2d826c59dbd72ad383fe8a23b24373d83e9b184b437f7f04c42487cd5759
                                                                          • MD5 SHA1 SHA512

                                                                          whoami.txt

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\resources\app.asar.unpacked\node_modules\nodemon\doc\cli\whoami.txt
                                                                          • Size 1KB
                                                                          • SHA256 4e7d19dfe1603ca93a0421b1abd4b19cfa5324ef458ff549809c5e66a2efc596
                                                                          • MD5 SHA1 SHA512

                                                                          jsconfig.json

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\resources\app.asar.unpacked\node_modules\nodemon\jsconfig.json
                                                                          • Size 142B
                                                                          • SHA256 87cd1d700216892ba7d388d04f42e373e1abda0b5d407c54a60e67b5dde48ab2
                                                                          • MD5 SHA1 SHA512

                                                                          index.js

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\resources\app.asar.unpacked\node_modules\nodemon\lib\cli\index.js
                                                                          • Size 1KB
                                                                          • SHA256 5c5b008f28d9aa1d6f8c30a30de037b95b50141a20ad0f029d0d79bcd75caa4d
                                                                          • MD5 SHA1 SHA512

                                                                          parse.js

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\resources\app.asar.unpacked\node_modules\nodemon\lib\cli\parse.js
                                                                          • Size 5KB
                                                                          • SHA256 93b9bbbc19e6f0456185d7c9e9ce11e994f41c01e46067959c5168bd345b0313
                                                                          • MD5 SHA1 SHA512 SSDEEP

                                                                          command.js

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\resources\app.asar.unpacked\node_modules\nodemon\lib\config\command.js
                                                                          • Size 1KB
                                                                          • SHA256 50f10478098f06b77a58b351a93bb8fe7a7572bfbfb3e6f0bf668460865da3a7
                                                                          • MD5 SHA1 SHA512

                                                                          defaults.js

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\resources\app.asar.unpacked\node_modules\nodemon\lib\config\defaults.js
                                                                          • Size 979B
                                                                          • SHA256 2b577f3fd8e3d03d64c1ee07ef13db89df04d0a9cf7b69ebf2c17041f7251104
                                                                          • MD5 SHA1 SHA512

                                                                          exec.js

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\resources\app.asar.unpacked\node_modules\nodemon\lib\config\exec.js
                                                                          • Size 6KB
                                                                          • SHA256 fcd713c63326ff75fc44afdcbd2bf63991c3c76169a26a2646defab46ce24155
                                                                          • MD5 SHA1 SHA512 SSDEEP

                                                                          index.js

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\resources\app.asar.unpacked\node_modules\nodemon\lib\config\index.js
                                                                          • Size 2KB
                                                                          • SHA256 be155df5dbc29c88c67c936f2840d2bb3abd09981fdb6db6480d54beeb27e9fe
                                                                          • MD5 SHA1 SHA512

                                                                          load.js

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\resources\app.asar.unpacked\node_modules\nodemon\lib\config\load.js
                                                                          • Size 6KB
                                                                          • SHA256 7329c732d39f8e884c0ec197e1133c536545bf4137417e6d664bbec962990e29
                                                                          • MD5 SHA1 SHA512 SSDEEP

                                                                          index.js

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\resources\app.asar.unpacked\node_modules\nodemon\lib\help\index.js
                                                                          • Size 733B
                                                                          • SHA256 1c1678d18dc75f67bbfae8c92836543af6990bce6b1cf1ad3acfb52285dac393
                                                                          • MD5 SHA1 SHA512

                                                                          index.js

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\resources\app.asar.unpacked\node_modules\nodemon\lib\index.js
                                                                          • Size 38B
                                                                          • SHA256 95111d84575ab36b697d760e130d722daea3d322cf56612f2ae67c7b3e8cef19
                                                                          • MD5 SHA1 SHA512

                                                                          index.js

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\resources\app.asar.unpacked\node_modules\nodemon\lib\monitor\index.js
                                                                          • Size 82B
                                                                          • SHA256 cc16aeb163da6cc7746bf5ced2d11f1436e458c7ee803241e9a9fa1d107450fd
                                                                          • MD5 SHA1 SHA512

                                                                          match.js

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\resources\app.asar.unpacked\node_modules\nodemon\lib\monitor\match.js
                                                                          • Size 6KB
                                                                          • SHA256 d09e469209e55541c8c67fa7ab25b7d4e051ce26d36f737c6264d4ade4b26d63
                                                                          • MD5 SHA1 SHA512 SSDEEP

                                                                          run.js

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\resources\app.asar.unpacked\node_modules\nodemon\lib\monitor\run.js
                                                                          • Size 16KB
                                                                          • SHA256 d93e994fddfcf6c7683976452a3d877a51e68f56ce2a49b821240c93cca86d13
                                                                          • MD5 SHA1 SHA512 SSDEEP

                                                                          signals.js

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\resources\app.asar.unpacked\node_modules\nodemon\lib\monitor\signals.js
                                                                          • Size 488B
                                                                          • SHA256 5c16e2e5f7101eea3f13c19da7c7a9e6fa02f7d1098b170e71f07d14f915e394
                                                                          • MD5 SHA1 SHA512

                                                                          watch.js

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\resources\app.asar.unpacked\node_modules\nodemon\lib\monitor\watch.js
                                                                          • Size 6KB
                                                                          • SHA256 efb0a3f37d9a6279614b29fdbca3f29c1a6d47f2d26067be1c86bb56fbaefcf1
                                                                          • MD5 SHA1 SHA512 SSDEEP

                                                                          nodemon.js

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\resources\app.asar.unpacked\node_modules\nodemon\lib\nodemon.js
                                                                          • Size 8KB
                                                                          • SHA256 3bb0b111682da4977e265b0bc746cd57191e294e0c25bf667f129771897dace4
                                                                          • MD5 SHA1 SHA512 SSDEEP

                                                                          add.js

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\resources\app.asar.unpacked\node_modules\nodemon\lib\rules\add.js
                                                                          • Size 2KB
                                                                          • SHA256 3cc60361f99b1080c66fce4d6ea0390a38c2a49e821e7f21dc43ed2fafa31277
                                                                          • MD5 SHA1 SHA512

                                                                          index.js

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\resources\app.asar.unpacked\node_modules\nodemon\lib\rules\index.js
                                                                          • Size 1KB
                                                                          • SHA256 3e64a2a35a97e41ff8c073299f07c3754d99b0a6e7d42faef7dc02d61d67757f
                                                                          • MD5 SHA1 SHA512

                                                                          parse.js

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\resources\app.asar.unpacked\node_modules\nodemon\lib\rules\parse.js
                                                                          • Size 804B
                                                                          • SHA256 9259995d8e1ca1737ff36cf4f97c80e55d812726ec4ead43b6c0829ce9679df9
                                                                          • MD5 SHA1 SHA512

                                                                          spawn.js

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\resources\app.asar.unpacked\node_modules\nodemon\lib\spawn.js
                                                                          • Size 1KB
                                                                          • SHA256 7804d7450f305b9142af45967be5c96f52be8350dba2a403f4bf79d5e092bc60
                                                                          • MD5 SHA1 SHA512

                                                                          bus.js

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\resources\app.asar.unpacked\node_modules\nodemon\lib\utils\bus.js
                                                                          • Size 946B
                                                                          • SHA256 8ebae78d8d75951b714acaa3e1a3d7f15b382a92b90c8040423e9866d97f1ad9
                                                                          • MD5 SHA1 SHA512

                                                                          clone.js

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\resources\app.asar.unpacked\node_modules\nodemon\lib\utils\clone.js
                                                                          • Size 829B
                                                                          • SHA256 5062a7c87599935fec99e505f3f463c3e0872455da73f8c8054ce0788c513ba2
                                                                          • MD5 SHA1 SHA512

                                                                          colour.js

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\resources\app.asar.unpacked\node_modules\nodemon\lib\utils\colour.js
                                                                          • Size 690B
                                                                          • SHA256 a4969a552701982cd415005d5ce162f955cf26c205229d2f4c75ed4a75bceceb
                                                                          • MD5 SHA1 SHA512

                                                                          index.js

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\resources\app.asar.unpacked\node_modules\nodemon\lib\utils\index.js
                                                                          • Size 2KB
                                                                          • SHA256 c69735d5a8d259dbc87614ae268de4f6581fcadcf6f931dd20b36bc09c0a502c
                                                                          • MD5 SHA1 SHA512

                                                                          log.js

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\resources\app.asar.unpacked\node_modules\nodemon\lib\utils\log.js
                                                                          • Size 1KB
                                                                          • SHA256 dabbcccb1bf0089d96ce9592a575cb64139926d6b899091c1dbd37632e9269c4
                                                                          • MD5 SHA1 SHA512

                                                                          merge.js

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\resources\app.asar.unpacked\node_modules\nodemon\lib\utils\merge.js
                                                                          • Size 1KB
                                                                          • SHA256 c4598a00e91b93b7964bb874e8ceed6d614436335a7fd81aff7f504499e210dd
                                                                          • MD5 SHA1 SHA512

                                                                          version.js

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\resources\app.asar.unpacked\node_modules\nodemon\lib\version.js
                                                                          • Size 2KB
                                                                          • SHA256 5071083e2e09969b2741a46cdedbbfcb2608fa35c1d1237e3bcf134749fb5ecd
                                                                          • MD5 SHA1 SHA512

                                                                          package.json

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\resources\app.asar.unpacked\node_modules\nodemon\package.json
                                                                          • Size 1KB
                                                                          • SHA256 f0051785c8178f10c2b5ebe86edd6949eb9db7b293d9abbb51a857f7e62500aa
                                                                          • MD5 SHA1 SHA512

                                                                          LICENSE

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\resources\app.asar.unpacked\node_modules\win-version-info\LICENSE
                                                                          • Size 1KB
                                                                          • SHA256 fe0982bd7d38ee4cb08b2f111067bdeedb9732a6621c761bcf7dd01aa6211c5a
                                                                          • MD5 SHA1 SHA512

                                                                          bin.js

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\resources\app.asar.unpacked\node_modules\win-version-info\bin.js
                                                                          • Size 247B
                                                                          • SHA256 7f69b31efa09c6e7d442d6229e82e65f38faeafeda1fbed7c5e54324aff062e6
                                                                          • MD5 SHA1 SHA512

                                                                          LICENSE

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\resources\app.asar.unpacked\node_modules\win-version-info\deps\UTF8Conversion\LICENSE
                                                                          • Size 573B
                                                                          • SHA256 7d355d1a2324c2073059ffe7ea4d96852c873e718bcc197374440dc3efc3f7ba
                                                                          • MD5 SHA1 SHA512

                                                                          utf8conv.h

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\resources\app.asar.unpacked\node_modules\win-version-info\deps\UTF8Conversion\utf8conv.h
                                                                          • Size 4KB
                                                                          • SHA256 7340eea1def3c1d832a6f40c5022725f1704a783f7f992b71d5f3ba2dcaeb34c
                                                                          • MD5 SHA1 SHA512 SSDEEP

                                                                          utf8conv_inl.h

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\resources\app.asar.unpacked\node_modules\win-version-info\deps\UTF8Conversion\utf8conv_inl.h
                                                                          • Size 10KB
                                                                          • SHA256 4955fbf455cc29d63f5dc777d3aa5172d6e1e6df221a33808a913bdebf5a1277
                                                                          • MD5 SHA1 SHA512 SSDEEP

                                                                          index.js

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\resources\app.asar.unpacked\node_modules\win-version-info\index.js
                                                                          • Size 514B
                                                                          • SHA256 5e591255fa35fb3650502e648ff51d6d7c7e57ada312bd33058da03cc412efb3
                                                                          • MD5 SHA1 SHA512

                                                                          package.json

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\resources\app.asar.unpacked\node_modules\win-version-info\package.json
                                                                          • Size 947B
                                                                          • SHA256 0f49b6c0282be08a5dba3e98024401a921167974a516b630ce9f9a9f2301df08
                                                                          • MD5 SHA1 SHA512

                                                                          node.napi.node

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\resources\app.asar.unpacked\node_modules\win-version-info\prebuilds\win32-ia32\node.napi.node
                                                                          • Size 198KB
                                                                          • SHA256 053c3100121939dfa1fb936718c6088e4490e72faa3c713310b556ea90155278
                                                                          • MD5 SHA1 SHA512 SSDEEP

                                                                          node.napi.node

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\resources\app.asar.unpacked\node_modules\win-version-info\prebuilds\win32-x64\node.napi.node
                                                                          • Size 251KB
                                                                          • SHA256 462e527de86494f96ed0d42a80c261e46bb57352e86d6175607186c1dcdfc7b0
                                                                          • MD5 SHA1 SHA512 SSDEEP

                                                                          skip.js

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\resources\app.asar.unpacked\node_modules\win-version-info\skip.js
                                                                          • Size 117B
                                                                          • SHA256 c12583530edc83dcc7cacef4a428eaefa84c10bfe4b62c0c9707de015e338859
                                                                          • MD5 SHA1 SHA512

                                                                          showver.h

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\resources\app.asar.unpacked\node_modules\win-version-info\src\showver.h
                                                                          • Size 116B
                                                                          • SHA256 2b561b980e0a01191a6c7cc1cf94c8d5c061f9f299ea256f1e7ca17250ae08bb
                                                                          • MD5 SHA1 SHA512

                                                                          elevate.exe

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\resources\elevate.exe
                                                                          • Size 105KB
                                                                          • SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
                                                                          • MD5 SHA1 SHA512 SSDEEP

                                                                          en-us.json

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\resources\node_modules\language-server\en-us.json
                                                                          • Size 5.5MB
                                                                          • SHA256 c8dd69f4f8f07ebe1c73a433bbf08f67e3bef3047c35251a243c3ac78f500647
                                                                          • MD5 SHA1 SHA512 SSDEEP

                                                                          globalTypes.d.luau

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\resources\node_modules\language-server\globalTypes.d.luau
                                                                          • Size 434KB
                                                                          • SHA256 ae99b7b676e4becb10e6a9b77229e99bdd60e5a91d2e6bbb141c85721962313f
                                                                          • MD5 SHA1 SHA512 SSDEEP

                                                                          wave-luau.exe

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\resources\node_modules\language-server\wave-luau.exe
                                                                          • Size 3.4MB
                                                                          • SHA256 d38d6297b4653f30397b7f45964ed99a70c8ab73d60063f68d3380c309e626a4
                                                                          • MD5 SHA1 SHA512 SSDEEP

                                                                          wave.d.luau

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\resources\node_modules\language-server\wave.d.luau
                                                                          • Size 11KB
                                                                          • SHA256 e58e8b24642a8693b1b1ebad703a7efab1cece9a1b12dcf353c4b4432f23062d
                                                                          • MD5 SHA1 SHA512 SSDEEP

                                                                          snapshot_blob.bin

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\snapshot_blob.bin
                                                                          • Size 302KB
                                                                          • SHA256 22a46de643045805a3e588f9a18ebaa377f9fba3dee46b2d60f3ae300a09cc4e
                                                                          • MD5 SHA1 SHA512 SSDEEP

                                                                          v8_context_snapshot.bin

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\v8_context_snapshot.bin
                                                                          • Size 646KB
                                                                          • SHA256 a8bd22478c4f85afa836c89d3a7f52c606b17872fbbefce268b499bedede10ae
                                                                          • MD5 SHA1 SHA512 SSDEEP

                                                                          vk_swiftshader.dll

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\vk_swiftshader.dll
                                                                          • Size 5.2MB
                                                                          • SHA256 11f24457eb9af084eb845780f3fdc1989605766c2749fce6fb003dd988d5ff65
                                                                          • MD5 SHA1 SHA512 SSDEEP

                                                                          vk_swiftshader_icd.json

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\vk_swiftshader_icd.json
                                                                          • Size 106B
                                                                          • SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
                                                                          • MD5 SHA1 SHA512

                                                                          vulkan-1.dll

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\7z-out\vulkan-1.dll
                                                                          • Size 938KB
                                                                          • SHA256 52bf439424759a84cdcb6d379ed88582a6d6ba58127c44adf1b8379f0e88e5ec
                                                                          • MD5 SHA1 SHA512 SSDEEP

                                                                          SpiderBanner.dll

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\SpiderBanner.dll
                                                                          • Size 9KB
                                                                          • SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
                                                                          • MD5 SHA1 SHA512 SSDEEP

                                                                          StdUtils.dll

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\StdUtils.dll
                                                                          • Size 100KB
                                                                          • SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
                                                                          • MD5 SHA1 SHA512 SSDEEP

                                                                          System.dll

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\System.dll
                                                                          • Size 12KB
                                                                          • SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
                                                                          • MD5 SHA1 SHA512 SSDEEP

                                                                          WinShell.dll

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\WinShell.dll
                                                                          • Size 3KB
                                                                          • SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
                                                                          • MD5 SHA1 SHA512

                                                                          nsExec.dll

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\nsExec.dll
                                                                          • Size 6KB
                                                                          • SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
                                                                          • MD5 SHA1 SHA512 SSDEEP

                                                                          nsis7z.dll

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nscB16F.tmp\nsis7z.dll
                                                                          • Size 424KB
                                                                          • SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
                                                                          • MD5 SHA1 SHA512 SSDEEP

                                                                          messages.json

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4464_1835943540\CRX_INSTALL\_locales\en_CA\messages.json
                                                                          • Size 711B
                                                                          • SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
                                                                          • MD5 SHA1 SHA512

                                                                          b19a5cfe-634a-4455-8e20-ce19eaf3f813.tmp

                                                                          • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4464_1835943540\b19a5cfe-634a-4455-8e20-ce19eaf3f813.tmp
                                                                          • Size 132KB
                                                                          • SHA256 33ae9b8f06dc777bb1a65a6ba6c3f2a01b25cd1afc291426b46d1df27ea6e7e2
                                                                          • MD5 SHA1 SHA512 SSDEEP

                                                                          default.dic

                                                                          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
                                                                          • Size 2B
                                                                          • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
                                                                          • MD5 SHA1 SHA512

                                                                          56287c9d-7898-4906-8c78-d48d550b2e01.tmp

                                                                          • Path C:\Users\Admin\AppData\Roaming\Wave\56287c9d-7898-4906-8c78-d48d550b2e01.tmp
                                                                          • Size 57B
                                                                          • SHA256 be4b8924ab38e8acf350e6e3b9f1f63a1a94952d8002759acd6946c4d5d0b5de
                                                                          • MD5 SHA1 SHA512

                                                                          Network Persistent State

                                                                          • Path C:\Users\Admin\AppData\Roaming\Wave\Network\Network Persistent State
                                                                          • Size 375B
                                                                          • SHA256 d5ba2350c03fce719f414ad75bca44ae4582c23f7219556d754a1012c8c3a45d
                                                                          • MD5 SHA1 SHA512

                                                                          Network Persistent State~RFe590640.TMP

                                                                          • Path C:\Users\Admin\AppData\Roaming\Wave\Network\Network Persistent State~RFe590640.TMP
                                                                          • Size 59B
                                                                          • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
                                                                          • MD5 SHA1 SHA512

                                                                          memory/1812-2083-0x000001DD2B290000-0x000001DD2B291000-memory.dmp

                                                                          memory/1812-2089-0x000001DD2B290000-0x000001DD2B291000-memory.dmp

                                                                          memory/1812-2090-0x000001DD2B290000-0x000001DD2B291000-memory.dmp

                                                                          memory/1812-2091-0x000001DD2B290000-0x000001DD2B291000-memory.dmp

                                                                          memory/1812-2092-0x000001DD2B290000-0x000001DD2B291000-memory.dmp

                                                                          memory/1812-2088-0x000001DD2B290000-0x000001DD2B291000-memory.dmp

                                                                          memory/1812-2087-0x000001DD2B290000-0x000001DD2B291000-memory.dmp

                                                                          memory/1812-2082-0x000001DD2B290000-0x000001DD2B291000-memory.dmp

                                                                          memory/1812-2081-0x000001DD2B290000-0x000001DD2B291000-memory.dmp

                                                                          memory/5204-1837-0x00000245B5900000-0x00000245B5901000-memory.dmp

                                                                          memory/5204-1844-0x00000245B5900000-0x00000245B5901000-memory.dmp

                                                                          memory/5204-1843-0x00000245B5900000-0x00000245B5901000-memory.dmp

                                                                          memory/5204-1836-0x00000245B5900000-0x00000245B5901000-memory.dmp

                                                                          memory/5204-1842-0x00000245B5900000-0x00000245B5901000-memory.dmp

                                                                          memory/5204-1835-0x00000245B5900000-0x00000245B5901000-memory.dmp

                                                                          memory/5204-1841-0x00000245B5900000-0x00000245B5901000-memory.dmp

                                                                          memory/5204-1847-0x00000245B5900000-0x00000245B5901000-memory.dmp

                                                                          memory/5204-1846-0x00000245B5900000-0x00000245B5901000-memory.dmp

                                                                          memory/5204-1845-0x00000245B5900000-0x00000245B5901000-memory.dmp

                                                                          memory/5724-1327-0x00007FF8B4550000-0x00007FF8B4551000-memory.dmp

                                                                          memory/5724-1326-0x00007FF8B4930000-0x00007FF8B4931000-memory.dmp