remcos | 00e5e4c53c99d62c722b309b6e394e3c53d47a23406730433b4aaf928e06512d

Analysis

max time kernel
93s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
27-11-2024 16:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

00e5e4c53c99d62c722b309b6e394e3c53d47a23406730433b4aaf928e06512d.exe
Size

80.3MB
MD5

bf7683904bb19284aee2e0c904f23ca4
SHA1

a7083e29405e575194b1705a035afc5868fb4db3
SHA256

00e5e4c53c99d62c722b309b6e394e3c53d47a23406730433b4aaf928e06512d
SHA512

1034657661165ce7d48cf5f72536b0e590fc8e17f579365e2b24be6ed52f9559ece09817cb96f10680daf5216fcd0c7513810013c2da9fca45eab268060ccd63
SSDEEP

1572864:GP2/ebAbWUFFLC0oabh+XJhXhQiB1dJdYVkq7U4hmfiJZeK:G70bLhCrOh01VJY+qw0uijeK

Score

10^/10

remcos remotehost discovery execution ransomware rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

65.108.68.57:2404

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-PYIE9F
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid	Process
2544	powershell.exe
788	powershell.exe
4136	powershell.exe
2880	powershell.exe
2416	powershell.exe
788	powershell.exe

Drops startup file 1 IoCs

Processes:

powershell.exe

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk	powershell.exe

Executes dropped EXE 6 IoCs

Processes:

ClickOnce.exeClickOnce.exeClickOnce.exewinSAT.exewinSAT.exeBginfo.exe

pid	Process
4548	ClickOnce.exe
232	ClickOnce.exe
3572	ClickOnce.exe
4160	winSAT.exe
696	winSAT.exe
1652	Bginfo.exe

Loads dropped DLL 15 IoCs

Processes:

00e5e4c53c99d62c722b309b6e394e3c53d47a23406730433b4aaf928e06512d.exeClickOnce.exeClickOnce.exeClickOnce.exewinSAT.exewinSAT.exeBginfo.exe

pid	Process
700	00e5e4c53c99d62c722b309b6e394e3c53d47a23406730433b4aaf928e06512d.exe
700	00e5e4c53c99d62c722b309b6e394e3c53d47a23406730433b4aaf928e06512d.exe
700	00e5e4c53c99d62c722b309b6e394e3c53d47a23406730433b4aaf928e06512d.exe
700	00e5e4c53c99d62c722b309b6e394e3c53d47a23406730433b4aaf928e06512d.exe
700	00e5e4c53c99d62c722b309b6e394e3c53d47a23406730433b4aaf928e06512d.exe
4548	ClickOnce.exe
232	ClickOnce.exe
3572	ClickOnce.exe
232	ClickOnce.exe
232	ClickOnce.exe
232	ClickOnce.exe
232	ClickOnce.exe
4160	winSAT.exe
696	winSAT.exe
1652	Bginfo.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

Processes:

tasklist.exe

pid	Process
3024	tasklist.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

Bginfo.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\BGInfo.bmp"	Bginfo.exe

Drops file in Windows directory 2 IoCs

Processes:

winSAT.exewinSAT.exe

description	ioc	Process
File opened for modification	C:\Windows\Performance\WinSAT\winsat.log	winSAT.exe
File opened for modification	C:\Windows\Performance\WinSAT\winsat.log	winSAT.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

00e5e4c53c99d62c722b309b6e394e3c53d47a23406730433b4aaf928e06512d.execmd.exefind.exetasklist.exeBginfo.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	00e5e4c53c99d62c722b309b6e394e3c53d47a23406730433b4aaf928e06512d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bginfo.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Bginfo.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Bginfo.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Bginfo.exe

Modifies Control Panel 2 IoCs

evasion

Processes:

Bginfo.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Desktop\TileWallpaper = "1"	Bginfo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Desktop\WallpaperStyle = "0"	Bginfo.exe

Modifies registry class 10 IoCs

Processes:

Bginfo.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\.bgi	Bginfo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\.bgi\ = "BGInfo.Config.1"	Bginfo.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\BGInfo.Config.1\shell\open\command	Bginfo.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\BGInfo.Config.1	Bginfo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\BGInfo.Config.1\ = "BGInfo Configuration File"	Bginfo.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\BGInfo.Config.1\shell	Bginfo.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\BGInfo.Config.1\shell\open	Bginfo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\BGInfo.Config.1\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\MyElectronApp\\Bginfo.exe\" \"%1\""	Bginfo.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\BGInfo.Config.1\DefaultIcon	Bginfo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\BGInfo.Config.1\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\MyElectronApp\\Bginfo.exe\",0"	Bginfo.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

Processes:

00e5e4c53c99d62c722b309b6e394e3c53d47a23406730433b4aaf928e06512d.exetasklist.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid	Process
700	00e5e4c53c99d62c722b309b6e394e3c53d47a23406730433b4aaf928e06512d.exe
700	00e5e4c53c99d62c722b309b6e394e3c53d47a23406730433b4aaf928e06512d.exe
3024	tasklist.exe
3024	tasklist.exe
2416	powershell.exe
2416	powershell.exe
2544	powershell.exe
2544	powershell.exe
2416	powershell.exe
2544	powershell.exe
788	powershell.exe
788	powershell.exe
788	powershell.exe
4136	powershell.exe
4136	powershell.exe
4136	powershell.exe
2880	powershell.exe
2880	powershell.exe

Suspicious use of AdjustPrivilegeToken 29 IoCs

Processes:

tasklist.exe00e5e4c53c99d62c722b309b6e394e3c53d47a23406730433b4aaf928e06512d.exeClickOnce.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeBginfo.exe

description	pid	Process
Token: SeDebugPrivilege	3024	tasklist.exe
Token: SeSecurityPrivilege	700	00e5e4c53c99d62c722b309b6e394e3c53d47a23406730433b4aaf928e06512d.exe
Token: SeShutdownPrivilege	4548	ClickOnce.exe
Token: SeCreatePagefilePrivilege	4548	ClickOnce.exe
Token: SeDebugPrivilege	2416	powershell.exe
Token: SeDebugPrivilege	2544	powershell.exe
Token: SeShutdownPrivilege	4548	ClickOnce.exe
Token: SeCreatePagefilePrivilege	4548	ClickOnce.exe
Token: SeDebugPrivilege	788	powershell.exe
Token: SeShutdownPrivilege	4548	ClickOnce.exe
Token: SeCreatePagefilePrivilege	4548	ClickOnce.exe
Token: SeShutdownPrivilege	4548	ClickOnce.exe
Token: SeCreatePagefilePrivilege	4548	ClickOnce.exe
Token: SeShutdownPrivilege	4548	ClickOnce.exe
Token: SeCreatePagefilePrivilege	4548	ClickOnce.exe
Token: SeDebugPrivilege	4136	powershell.exe
Token: SeShutdownPrivilege	4548	ClickOnce.exe
Token: SeCreatePagefilePrivilege	4548	ClickOnce.exe
Token: SeDebugPrivilege	2880	powershell.exe
Token: SeShutdownPrivilege	4548	ClickOnce.exe
Token: SeCreatePagefilePrivilege	4548	ClickOnce.exe
Token: SeBackupPrivilege	1652	Bginfo.exe
Token: SeSecurityPrivilege	1652	Bginfo.exe
Token: SeShutdownPrivilege	4548	ClickOnce.exe
Token: SeCreatePagefilePrivilege	4548	ClickOnce.exe
Token: SeShutdownPrivilege	4548	ClickOnce.exe
Token: SeCreatePagefilePrivilege	4548	ClickOnce.exe
Token: SeShutdownPrivilege	4548	ClickOnce.exe
Token: SeCreatePagefilePrivilege	4548	ClickOnce.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

Bginfo.exe

pid	Process
1652	Bginfo.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

00e5e4c53c99d62c722b309b6e394e3c53d47a23406730433b4aaf928e06512d.execmd.exeClickOnce.execmd.execmd.exepowershell.exewinSAT.execmd.exepowershell.exewinSAT.exepowershell.exe

description	pid	Process	procid_target
PID 700 wrote to memory of 216	700	00e5e4c53c99d62c722b309b6e394e3c53d47a23406730433b4aaf928e06512d.exe	83
PID 700 wrote to memory of 216	700	00e5e4c53c99d62c722b309b6e394e3c53d47a23406730433b4aaf928e06512d.exe	83
PID 700 wrote to memory of 216	700	00e5e4c53c99d62c722b309b6e394e3c53d47a23406730433b4aaf928e06512d.exe	83
PID 216 wrote to memory of 3024	216	cmd.exe	85
PID 216 wrote to memory of 3024	216	cmd.exe	85
PID 216 wrote to memory of 3024	216	cmd.exe	85
PID 216 wrote to memory of 1832	216	cmd.exe	86
PID 216 wrote to memory of 1832	216	cmd.exe	86
PID 216 wrote to memory of 1832	216	cmd.exe	86
PID 4548 wrote to memory of 232	4548	ClickOnce.exe	99
PID 4548 wrote to memory of 232	4548	ClickOnce.exe	99
PID 4548 wrote to memory of 232	4548	ClickOnce.exe	99
PID 4548 wrote to memory of 232	4548	ClickOnce.exe	99
PID 4548 wrote to memory of 232	4548	ClickOnce.exe	99
PID 4548 wrote to memory of 232	4548	ClickOnce.exe	99
PID 4548 wrote to memory of 232	4548	ClickOnce.exe	99
PID 4548 wrote to memory of 232	4548	ClickOnce.exe	99
PID 4548 wrote to memory of 232	4548	ClickOnce.exe	99
PID 4548 wrote to memory of 232	4548	ClickOnce.exe	99
PID 4548 wrote to memory of 232	4548	ClickOnce.exe	99
PID 4548 wrote to memory of 232	4548	ClickOnce.exe	99
PID 4548 wrote to memory of 232	4548	ClickOnce.exe	99
PID 4548 wrote to memory of 232	4548	ClickOnce.exe	99
PID 4548 wrote to memory of 232	4548	ClickOnce.exe	99
PID 4548 wrote to memory of 232	4548	ClickOnce.exe	99
PID 4548 wrote to memory of 232	4548	ClickOnce.exe	99
PID 4548 wrote to memory of 232	4548	ClickOnce.exe	99
PID 4548 wrote to memory of 232	4548	ClickOnce.exe	99
PID 4548 wrote to memory of 232	4548	ClickOnce.exe	99
PID 4548 wrote to memory of 232	4548	ClickOnce.exe	99
PID 4548 wrote to memory of 232	4548	ClickOnce.exe	99
PID 4548 wrote to memory of 232	4548	ClickOnce.exe	99
PID 4548 wrote to memory of 232	4548	ClickOnce.exe	99
PID 4548 wrote to memory of 232	4548	ClickOnce.exe	99
PID 4548 wrote to memory of 232	4548	ClickOnce.exe	99
PID 4548 wrote to memory of 232	4548	ClickOnce.exe	99
PID 4548 wrote to memory of 232	4548	ClickOnce.exe	99
PID 4548 wrote to memory of 232	4548	ClickOnce.exe	99
PID 4548 wrote to memory of 232	4548	ClickOnce.exe	99
PID 4548 wrote to memory of 3508	4548	ClickOnce.exe	100
PID 4548 wrote to memory of 3508	4548	ClickOnce.exe	100
PID 4548 wrote to memory of 704	4548	ClickOnce.exe	101
PID 4548 wrote to memory of 704	4548	ClickOnce.exe	101
PID 4548 wrote to memory of 3572	4548	ClickOnce.exe	102
PID 4548 wrote to memory of 3572	4548	ClickOnce.exe	102
PID 704 wrote to memory of 2544	704	cmd.exe	107
PID 704 wrote to memory of 2544	704	cmd.exe	107
PID 3508 wrote to memory of 2416	3508	cmd.exe	108
PID 3508 wrote to memory of 2416	3508	cmd.exe	108
PID 2544 wrote to memory of 4160	2544	powershell.exe	109
PID 2544 wrote to memory of 4160	2544	powershell.exe	109
PID 4160 wrote to memory of 788	4160	winSAT.exe	111
PID 4160 wrote to memory of 788	4160	winSAT.exe	111
PID 4548 wrote to memory of 4912	4548	ClickOnce.exe	112
PID 4548 wrote to memory of 4912	4548	ClickOnce.exe	112
PID 4912 wrote to memory of 4136	4912	cmd.exe	114
PID 4912 wrote to memory of 4136	4912	cmd.exe	114
PID 4136 wrote to memory of 696	4136	powershell.exe	115
PID 4136 wrote to memory of 696	4136	powershell.exe	115
PID 696 wrote to memory of 2880	696	winSAT.exe	117
PID 696 wrote to memory of 2880	696	winSAT.exe	117
PID 2880 wrote to memory of 1652	2880	powershell.exe	118
PID 2880 wrote to memory of 1652	2880	powershell.exe	118
PID 2880 wrote to memory of 1652	2880	powershell.exe	118

C:\Users\Admin\AppData\Local\Temp\00e5e4c53c99d62c722b309b6e394e3c53d47a23406730433b4aaf928e06512d.exe
"C:\Users\Admin\AppData\Local\Temp\00e5e4c53c99d62c722b309b6e394e3c53d47a23406730433b4aaf928e06512d.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:700
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq ClickOnce.exe" /FO csv | "C:\Windows\system32\find.exe" "ClickOnce.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:216
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "USERNAME eq Admin" /FI "IMAGENAME eq ClickOnce.exe" /FO csv
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3024
- - C:\Windows\SysWOW64\find.exe
    "C:\Windows\system32\find.exe" "ClickOnce.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1832

C:\Users\Admin\AppData\Local\Programs\ClickOnce\ClickOnce.exe
"C:\Users\Admin\AppData\Local\Programs\ClickOnce\ClickOnce.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4548
- C:\Users\Admin\AppData\Local\Programs\ClickOnce\ClickOnce.exe
  "C:\Users\Admin\AppData\Local\Programs\ClickOnce\ClickOnce.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\ClickOnce" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1780,i,7218510048961835784,7404321520797029590,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1772 /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:232
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\Admin\AppData\Local\Programs\ClickOnce\ClickOnce.exe';$s.Save()""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3508
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyElectronApp.lnk');$s.TargetPath='C:\Users\Admin\AppData\Local\Programs\ClickOnce\ClickOnce.exe';$s.Save()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops startup file
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2416
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Start-Process -Filepath 'C:\Windows \System32\winSAT.exe' -WindowStyle Hidden"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:704
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Start-Process -Filepath 'C:\Windows \System32\winSAT.exe' -WindowStyle Hidden
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2544
  - - C:\Windows \System32\winSAT.exe
      "C:\Windows \System32\winSAT.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in Windows directory
      Suspicious use of WriteProcessMemory
      PID:4160
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "& {$UserProfile = [Environment]::GetFolderPath('UserProfile'); $TargetPath = Join-Path $UserProfile 'AppData\Roaming\MyElectronApp'; Add-MpPreference -ExclusionPath $TargetPath; }"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:788
- C:\Users\Admin\AppData\Local\Programs\ClickOnce\ClickOnce.exe
  "C:\Users\Admin\AppData\Local\Programs\ClickOnce\ClickOnce.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\ClickOnce" --field-trial-handle=2016,i,7218510048961835784,7404321520797029590,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1968 /prefetch:3
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3572
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Start-Process -Filepath 'C:\Windows \System32\winSAT.exe' -WindowStyle Hidden"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4912
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Start-Process -Filepath 'C:\Windows \System32\winSAT.exe' -WindowStyle Hidden
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4136
  - - C:\Windows \System32\winSAT.exe
      "C:\Windows \System32\winSAT.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in Windows directory
      Suspicious use of WriteProcessMemory
      PID:696
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "& {$UserProfile = [Environment]::GetFolderPath('UserProfile'); $TargetPath = Join-Path $UserProfile 'AppData\Roaming\MyElectronApp'; $BginfoPath = Join-Path $TargetPath 'Bginfo.exe'; Start-Process -FilePath $BginfoPath -ArgumentList '/NOLICPROMPT /timer:300' -WorkingDirectory $TargetPath -WindowStyle Hidden; }"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2880
      - C:\Users\Admin\AppData\Roaming\MyElectronApp\Bginfo.exe
        
        "C:\Users\Admin\AppData\Roaming\MyElectronApp\Bginfo.exe" /NOLICPROMPT /timer:300
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Sets desktop wallpaper using registry
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Modifies Control Panel
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:1652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
2f57fde6b33e89a63cf0dfdd6e60a351

SHA1
445bf1b07223a04f8a159581a3d37d630273010f

SHA256
3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55

SHA512
42857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
d8b9a260789a22d72263ef3bb119108c

SHA1
376a9bd48726f422679f2cd65003442c0b6f6dd5

SHA256
d69d47e428298f194850d14c3ce375e7926128a0bfb62c1e75940ab206f8fddc

SHA512
550314fab1e363851a7543c989996a440d95f7c9db9695cce5abaad64523f377f48790aa091d66368f50f941179440b1fa94448289ee514d5b5a2f4fe6225e9b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
e5ea61f668ad9fe64ff27dec34fe6d2f

SHA1
5d42aa122b1fa920028b9e9514bd3aeac8f7ff4b

SHA256
8f161e4c74eb4ca15c0601ce7a291f3ee1dc0aa46b788181bfe1d33f2b099466

SHA512
cb308188323699eaa2903424527bcb40585792f5152aa7ab02e32f94a0fcfe73cfca2c7b3cae73a9df3e307812dbd18d2d50acbbfeb75d87edf1eb83dd109f34

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
d9fbd004c6ef009dc296538cdd0062a6

SHA1
b805fe342d545a92c2a92f9f0867a104fd78c275

SHA256
053ce5ffa45ec806bddb8865aabbf20315a598cb53022eeeab1e7ffc53b5c6ac

SHA512
78457addba78fb3c99015a776fd715fec2e4e4e3fe6df8b534490d40af3666536b3eb0cf59768f6ea70e3e5a511edaf6c8a8cc295f6f59c1b7ee0917700c3cf0

Download Submit
C:\Users\Admin\AppData\Local\Programs\ClickOnce\chrome_100_percent.pak

Filesize
148KB

MD5
83ec43f2af9fc52025f3f807b185d424

SHA1
ea432f7571d89dd43a76d260cb5853cada253aa0

SHA256
a659ee9eb38636f85f5336587c578fb29740d3effaff9b92852c8a210e92978c

SHA512
6ddca85215bf6f7f9b17c5d52bd7395702515bc2354a8cd8fa6c1ccd7355a23b17828853ceabeef597b5bca11750dc7c9f6ec3c45a33c2106f816fec74963d86

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_f4ig1msw.1xl.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz9135.tmp\7z-out\LICENSE.electron.txt

Filesize
1KB

MD5
4d42118d35941e0f664dddbd83f633c5

SHA1
2b21ec5f20fe961d15f2b58efb1368e66d202e5c

SHA256
5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d

SHA512
3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz9135.tmp\7z-out\LICENSES.chromium.html

Filesize
8.7MB

MD5
6ff57c0aeccdf44c39c95dee9ecea805

SHA1
c76669a1354067a1c3ddbc032e66c323286a8d43

SHA256
0ba4c7b781e9f149195a23d3be0f704945f858a581871a9fedd353f12ce839ca

SHA512
d6108e1d1d52aa3199ff051c7b951025dbf51c5cb18e8920304116dcef567367ed682245900fda3ad354c5d50aa5a3c4e6872570a839a3a55d3a9b7579bdfa24

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz9135.tmp\7z-out\chrome_200_percent.pak

Filesize
223KB

MD5
dc48a33bd20bfc7cacfc925a84b015b6

SHA1
8dfee88fd1dc77f89ad88c19146fe3ab45e43f3c

SHA256
2c1b3e4b8a0cf837ae0a390fca54f45d7d22418e040f1dfea979622383acced6

SHA512
1d54eb5d2ba06af0ba8f6b491b0d43f178a48ac82cdf383beb265e732ddfc06bca9692003fdfce56f7f00af97f29acf046c73b891b8c561610098f9626eaf05a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz9135.tmp\7z-out\d3dcompiler_47.dll

Filesize
4.7MB

MD5
a7b7470c347f84365ffe1b2072b4f95c

SHA1
57a96f6fb326ba65b7f7016242132b3f9464c7a3

SHA256
af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a

SHA512
83391a219631f750499fd9642d59ec80fb377c378997b302d10762e83325551bb97c1086b181fff0521b1ca933e518eab71a44a3578a23691f215ebb1dce463d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz9135.tmp\7z-out\ffmpeg.dll

Filesize
2.8MB

MD5
5a168cb3ea9d0e7400baabf60f6ab933

SHA1
82a86cb7f42294ab4ad6669c19b92605d960b676

SHA256
af5f1bc9f6a73750fa0c7bf17439700cfb3ab23e1393f0c9899825417e319b54

SHA512
7c1441ecd049543e38297a7b6929e9f3eb978422d0ce508fbe6350ffebd297f947b8d9ec75bd2054142dcd8461eef1bf110e040d0830da977fde8944bece843d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz9135.tmp\7z-out\icudtl.dat

Filesize
10.0MB

MD5
ffd67c1e24cb35dc109a24024b1ba7ec

SHA1
99f545bc396878c7a53e98a79017d9531af7c1f5

SHA256
9ae98c06cbb0ea43c5cd6b5725310c008c65e46072421a1118cb88e1de9a8b92

SHA512
e1a865e685d2d3bacd0916d4238a79462519d887feb273a251120bb6af2b4481d025f3b21ce9a1a95a49371a0aa3ecf072175ba756974e831dbfde1f0feaeb79

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz9135.tmp\7z-out\libEGL.dll

Filesize
481KB

MD5
39ccf402a62f068a8c573b45ea96154d

SHA1
57ceb915ea6f88c7fcca35339bf951659c0338ab

SHA256
8649d77ace8e5753b9a10e7ae3349aafa9d8e3406ba9c8c36a59633a84b3c41b

SHA512
c4f9225c54d413176cb3dd2b26d429493fd056c7c283bc7a1c52b4a2059dbb11380daf5d847be1ff29f058ba0ef44d4bf66a3d9e9a600000dc8f6d20dfb2ed03

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz9135.tmp\7z-out\libGLESv2.dll

Filesize
8.0MB

MD5
f055a130c79bd517bdb53b1f8a38bd3b

SHA1
9fba0ad4ba973bb285b23cc125004baf61a98b5a

SHA256
45b53759392b81ce7d916b3f1cf02be30289809bd31d09fc1524ef2609183b17

SHA512
d9dcb217f268862c577cacf4e9f84c63e02b647113d484338a74eb0b24fadd6d87b4e7a551dd1ef692bb38e44562bff848982acb62840d4f49f91a7751320e34

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz9135.tmp\7z-out\locales\af.pak

Filesize
520KB

MD5
d9bec09b6c523dc3bca9a81264b1beed

SHA1
ea4ae9dff554c59994632f85af25b36c049fb5b2

SHA256
0b5a45de223ce8522cc296af1e93477540eaa74867428307cc3a5cd21921b022

SHA512
6e7677f86f73edffb5d6162ca19bb7464465f0f485ce2971fb20ad3f57d9fac56b7a21d378701f80e85fb185c3af6a238f8c8707f5874bffffd79d881a54dd6e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz9135.tmp\7z-out\locales\am.pak

Filesize
840KB

MD5
e3933de22dc7fb98215b083d8a379f40

SHA1
68ddbd9bcc931f0d4a172fa65af35b823c7c9e37

SHA256
eaa747075e5a62be8b7df5908e167ccc5314c9c6a8b890059d00284a3c496fef

SHA512
7beb80fa029f41cb21536b15c604e2ae9dfc20b4a3ec4f5cc04e2b105d4b2c251830624957197084761f9686f95d332e25d4f6178509ad58257af90d96a9e7d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz9135.tmp\7z-out\locales\ar.pak

Filesize
921KB

MD5
ac865ff462f341b4317c3d16eeb40460

SHA1
1e971d97f09884b23595f17534227ea43cf99090

SHA256
0557bc17eb1d134bd52f203836551b55579114708e2df51f653972951567513d

SHA512
a935b91a2c053303e941866cfc151f28053faf364aeece98d61fcd68fef6c6f1d3b73de01cd602c8a4a081cce452d1ce87f8166ba3c0e8b81e91d932f84737f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz9135.tmp\7z-out\locales\bg.pak

Filesize
959KB

MD5
7c37c8c9b4215089b6c16d22838d256b

SHA1
8f2afdc21353685353a0562452f4a79180e58829

SHA256
2ebd582dfaa3139cd6a03e9892a94a3d9bb6936e0b04085b8f2d27e1dec0bc8a

SHA512
beadd70e9d706576bfb6725617385f776e9f68c84d116b01187354d377e2c860899da34f8c5a054c4bde41a57e9aac56445f6ac0b8da8c75a424641a86fdd718

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz9135.tmp\7z-out\locales\bn.pak

Filesize
1.2MB

MD5
fc66adf3deac72fd39105540dd2daeff

SHA1
a53b54efcc1285a226d605116f87d12f69942482

SHA256
ef50cfebaf9e32edeec25d30197ac5899b3db8a0676671f639d32bc48f3b3bd8

SHA512
0b77daa056451d01a8cfb3ff1acc08d34e64e0a32bb119c8837ae3d6e3d5195311427c6101efd7e7bc9104aa369832bb12aab3d4080c00dc39edc98b6c0b949e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz9135.tmp\7z-out\locales\ca.pak

Filesize
584KB

MD5
e1ac7f4c28177f68fac3be2375a9368c

SHA1
3d7738699087468a748f9b1189d2f7621187d03b

SHA256
efa1ba906f8abce91ebb9d6442b64e0d5ae7dab78dda8a49a6fed1a342c71b9b

SHA512
aee8cb28eb02e2fb2155c8d093cf678284e3571f46b913f743de3c6d0215c18b80866ff446f46ada160860ed9c18ae9a4209424e7e0f0ba97c78a3fe9815ca5a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz9135.tmp\7z-out\locales\cs.pak

Filesize
602KB

MD5
92e3fd1eb47767a0cb5f6e734de4eec1

SHA1
33053bfead1fa67160b6a3c417ec4559bfdcdcfb

SHA256
d269e16fbd9b2afe95b148ece22b2ac803768fb53ee42e1fad0181f9dec84544

SHA512
916d73d9b28b0600878418a06388c2ed61bfaf17807a16e1c157a30e5da136c6b6f194e99d151c43b9aa35d101de755caa6da69e1c8a50dd134f27a7f2adc016

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz9135.tmp\7z-out\locales\da.pak

Filesize
545KB

MD5
43029018648d558f9bbf7a74c59eb281

SHA1
90c6618cccb4db85d7485ae8d809ec3af4763e70

SHA256
4bd88f6ab82842358987aad384775b35198dd75c2cce4cae783208ed69296a7e

SHA512
9e8ef9d4367ad01f2f4e7dd6f9884e463729ee5a0f678fd16a3ce093c21efc1d78041d5c6e45037f37bfd732e4833744485b00acfda2313a1d1e947993129a3d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz9135.tmp\7z-out\locales\de.pak

Filesize
582KB

MD5
3a8de004b3a610271e1d1913b6d4b53b

SHA1
236893c3f7b450e6ad8b4d54e1a62b2e635b42d6

SHA256
43c060182c92caf4aebf8fd7b913dfe017beea71e796e862ebf8746575948364

SHA512
b70f849ccf7dd9e72d71522591420e0baa03ff74763b44563b0b3800ba3a88cb8b973fabb90bbb6653819947eca47f70e347958e3c31ab226957f7313bc03554

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz9135.tmp\7z-out\locales\el.pak

Filesize
1.0MB

MD5
58d6eaf71b9b73f5f7f057c73d0d92ec

SHA1
16e0587753e7d2834f4cbb24fed45e7bd2f8f2f4

SHA256
8474879de21c414d34c44cf0a8c91356a66dbd647308a4f994be25bd1f93a89f

SHA512
ab24c9655bd68e4a64e257914a35dc84b5f791c58b396ae004bf5da61df19c02ef9ca572b8e63f15baf3694ae1e540adf74586f10d28d7ef90edeec982bcf28d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz9135.tmp\7z-out\locales\en-GB.pak

Filesize
474KB

MD5
985558de03bf486aec1daadd39cb508d

SHA1
b693ddef983e8af212936202ddca92d908378404

SHA256
1956d448a4d333638f3601d0da976710cbe0a795504eb694ba18311fe586d195

SHA512
13d1c82b797ad4ff25a94a996f9fb52b530643a0e735f96e32b9e0698962770148d95db7beb91343d781fb84378a3e334ac0c1c913d8dbae20f425bf0dc364d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz9135.tmp\7z-out\locales\en-US.pak

Filesize
478KB

MD5
752a3feed3ab6c127767c8fabc9a40b6

SHA1
4af9f9c19904d3bef154b469858dc44b1e630a75

SHA256
c6a6c5d7ab6119bba712d6fe45fd385506d4d0dd8e4156cca3925062f4502ac5

SHA512
ae96d4f391e36f8f741671b72ebd4b1ab2d049b2a99b95737fb9f81743b9e414b46022b65194af5616eb354056addf0e46ef090f56b7d945ef2cb5f4d100d64f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz9135.tmp\7z-out\locales\es-419.pak

Filesize
575KB

MD5
85e9b056e3ac3f6a5b113ed9f460e202

SHA1
dcceef6ea85d71a85dd24d17ec65371dce76f480

SHA256
16fe83762ed578c49685868418325920a72cd457907bc4e5264f2c172d53b27b

SHA512
e4dfde9c1260df1f77b7ec1797658f8cfeaab98142a8d512ed3bfac054933a4583f20091b97985b4ba9cf93f9faca3e7b0986cb4a3eb12fe0bc04ee1c45d3e0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz9135.tmp\7z-out\locales\es.pak

Filesize
575KB

MD5
3db06ea954c83343bd333c15947f521a

SHA1
ddde6ab9f9085e83ec8bf7a37df3389040acea42

SHA256
45df7340fe3c8560b11ffba2219de1b5c45dbfe57b6db90bd6c246244fae338a

SHA512
cc29f1075c119daddaa108c17abb6d572925cac1ed2237ed2fd45364bfb2a00c1144fccdd22c6728c954af2cdd1b9477f39968ba25354bca2b9dca07f5c53dde

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz9135.tmp\7z-out\locales\et.pak

Filesize
523KB

MD5
8e2c2cc8c516d8b7181c0c712ca24513

SHA1
e0ccd9ed8de6640379f822a067dcf97d4bbe44a7

SHA256
c96937f46fb1b1182b201f5c48fe1da4d3f94a68a0e6e0699ccc0944cd0a5a33

SHA512
339bc655f22068f2ee9352a670325865265e4279197430214f7e3fba575415318110cccb03aed2c0e7ac673d4629bd495dc34a56cefbcaab62e1c4a1a87ed8c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz9135.tmp\7z-out\locales\fa.pak

Filesize
855KB

MD5
caee902136579f4bac72a6f0f75d171b

SHA1
cbbaf988a499005e21fd86652e1f48af8bce2c35

SHA256
e86f677e9654f6a16a7738e85a5a5d467a09cb18e47654f079506a00affad70c

SHA512
c0f2e8457f71789da8ce207aaae2f83196daac868fcaa7a84de04dd38730f8831b9643b8a404a7aa59c5b726da02090bba414529019f5eb9c94ac5a5af61bc9d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz9135.tmp\7z-out\locales\fi.pak

Filesize
534KB

MD5
125a121c22dfc2b1a1c759cad9123e42

SHA1
d0282af9ec311c406ecccdfdd7216b7d883e94c3

SHA256
b733460f039dcb3795077ba91dafa3b9b8163dfd0f15168b250630f7de21ed0a

SHA512
c6e0ea8fab8115a632d4c74141efc46ea546f43e0b806d5bd95a1ecd3b8fe37a44565a2f79c43e0bc50dbdadc5d16054e07485fad83c99bd3550a907c852e724

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz9135.tmp\7z-out\locales\fil.pak

Filesize
604KB

MD5
eaf43729e9bbd8004ef1ff56a3d85a48

SHA1
34b31ab8ea2ce6bd263f00acc50d5af8d0222d9a

SHA256
8559cc35335bb2c249297f4c7506df95cef899ef5f7ad942d2d511ae074d41b0

SHA512
010f8e5c3b969be0db4baec3acffdd69be25662387968e15e11af0da68ec2f45dc9edb83cafe7c92234e1e4e4aae1682223235af04d99e8b5238379e022e3d35

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz9135.tmp\7z-out\locales\fr.pak

Filesize
622KB

MD5
651e4cb14c4f784d36d0a1715c52dcf3

SHA1
540f6090e3223ad8e6424a9db78305f2db9974bf

SHA256
6d547cbc3304627d14aeb138aebd40786c30a4192e071d80bcecdb77a13ac80a

SHA512
1fe93058ec434c06ef4aa1519333ebd831311971b06d7279ddc4d86dfa860bbd6ea6d127b2a07425c3e78bd6d41c11eb2a76cf25b20c6a7de74d1f0ceec87079

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz9135.tmp\7z-out\locales\gu.pak

Filesize
1.2MB

MD5
6c949199eaaad8fcb12c38ec6c02d758

SHA1
ce4dbd5e6a37f25354ec6849f7008956ef3568ba

SHA256
966591a74e44c75c7f0114bb8e36b0e9f5502aebdc96c714c8a8f6d45bc863c8

SHA512
3344e0083969de6f4913893a14586b441f65cb5d45f913f1cea61b8d5abbdb3b1c18a48731870282174263c1f306ed6b99c279627bd269e89cd4e15dc3d88313

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz9135.tmp\7z-out\locales\he.pak

Filesize
751KB

MD5
16562c59fba469e1dd2f3b0b87a64645

SHA1
9a6863205fca8ea6d09a98b8e8dab543ff6198a1

SHA256
64fa2e98a9056e23c3a934ff39fef81c306cec5844d56dda17ec6c25fcdb1b5a

SHA512
dbb6e1a5e52a005386007f88b53109037792bc7b65fb95ace3e8cc5ae3ebd8320c7e406381c375bf751a9265ace84e0bbe1301d4bf3aa79200ec789dc3b3bc0b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz9135.tmp\7z-out\locales\hi.pak

Filesize
1.3MB

MD5
6aa92c296ed09fe2aa94dc060b25774a

SHA1
7619ed3dc5b1e04c55b0ee7280ac2d0135eb9c80

SHA256
0c771c66db4f80a62912564944c4e239f8dac8381a06483ecab512e0d75744a1

SHA512
9255a4ffef7be07ceab5dd8f46365b9a52d621ae175c1022bb4685fe4f3ea63425f45aa9ef824b467b9c33c51a7104258e888e8ec15c88fea126bf0b5337ff14

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz9135.tmp\7z-out\locales\hr.pak

Filesize
581KB

MD5
fda338824b4171b10dcc3395a549fa9f

SHA1
ea42c8b18228e0ca57b8ed7ed48e3a2aebe08486

SHA256
43f370368b322cd1236632c82aa0e231965dc58fdd497f8aeae6b40eef9ee611

SHA512
9115f805f51f45839e0a87cf44c1cce311cecaf717c0da7db3b6da85cea95f24638af29da43bc01056994b22049daa0387cd4371c13b8e5399fe8f4e38771d57

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz9135.tmp\7z-out\locales\hu.pak

Filesize
625KB

MD5
7add28fbbba1ce87972f6433862dcbaa

SHA1
8b4b0053663c0b69beca59faca79854a89ab9c97

SHA256
dd86976d72f3cb644b90c1863e29e2f8616b09ac4acfe9301fb346fa0d87bd78

SHA512
efed0891b0202bae9396df54f141a73bb6ccadd7947330fd9e6a3a8911e9e037454238c4bd2bb9075af3218230c9e4e394f83a70878396911faa282d99fdd884

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz9135.tmp\7z-out\locales\id.pak

Filesize
516KB

MD5
cfc848689a25f5e2e6ba9a06e09b6ee0

SHA1
35131e775d98a57ffcbd6a75e69f6f67437636c3

SHA256
ec1d7bbe064656dc53f70e3a612a582f5d5d0af5f0c2d6a783796cffa5bf7f57

SHA512
d5a027e35dd3846f5255b81eed36a3498ac9d809367692b2da216b5771c2d54fad35fc15c15705a2bbb4a7b35dd2245661882734998f9bc3ad8d62d2273b6577

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz9135.tmp\7z-out\locales\it.pak

Filesize
567KB

MD5
6aa3bc3ee4999c324b82e50940e62c74

SHA1
10af8030fc2f875e133c9417e0221528160ad8b5

SHA256
73cc8422643a65753b2c3672c8f8331ee92c9bddc912576554e95b0986cf990d

SHA512
f039ef32002e55d09a4f567cc81fe2b3b329d517c985436a5da121ff0e6ac7e258b5d1fdda81e6c1578daf7078b91abcfb7da98cdba6693d4fbe7f28115e6971

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz9135.tmp\7z-out\locales\ja.pak

Filesize
691KB

MD5
5a69547f56dc61e482dcda1ce704c5ac

SHA1
5b7bbc8e9b14d78f2105136afb7728050128c02e

SHA256
a286a5faf9021927ec09fd8cbf30ed14ad59c3baa36d29e5491ad27b957915e5

SHA512
2b9d020544201e2d0b0b44b0977fcbab858563969ce02be65689c5f5b780adc4560df523589293cd66f42903322ed61d781da093adfa44aa0681a28d97de4556

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz9135.tmp\7z-out\locales\kn.pak

Filesize
1.4MB

MD5
52a0707a70b939bcd75b0838a5dc5357

SHA1
eb9e1350d9d217580b1939302d008dc07c3b781c

SHA256
b177eda102b1be8c53127e3bb47970a3c1e2032be24900d8a126c5f0f077ef3d

SHA512
d5fe69035338c4308f661fa0ac25c4a811a6014f6bd85ccc7ad947f76aecf76f67208512e1266e249ec067a5fb22fb74a3550b0f3aeb1bc50fadb3a9d3cc67e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz9135.tmp\7z-out\locales\ko.pak

Filesize
585KB

MD5
4b563eb612d4fadc6bd8a4c918006ab1

SHA1
4b9e414af0c044c4487d1439d23ef11b0169d308

SHA256
e0d4461452607e0f4a619efe653ec9ec39f7d34a742ae98374b2bce0b821adc9

SHA512
b8c56d69fa41ad14f7197acab1ba987ebb06c5b15748e21cec27861721545e30fb20f76f2c3a752c8ea94cca1e6b4fab7fb0727b679a8fb8e94db2d5c028e7a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz9135.tmp\7z-out\locales\lt.pak

Filesize
629KB

MD5
7cef6e31d76861db4d7d622fdd89e5aa

SHA1
31fa45c3b7666259d4d8a13518ece423a97edcca

SHA256
2f1e1c69da5cad8f47e45af0ac47cec90c20fe2897a43cb496c7feed1ec5d1ab

SHA512
df66a739f3a8da62a942b56b23f71a2b68469e87dc44eb8ce1a9a859a609f1db4bee2497defef06fa48e14cf461e61410668a5216459c94c79f4b69a3cf092f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz9135.tmp\7z-out\locales\lv.pak

Filesize
628KB

MD5
00b517ce675a3089823708776c6f9302

SHA1
2bc24f150adaafd2604c5d95bbaaf8dc983d7da2

SHA256
0adedd1eaaf902feebb208220d9f21ae1b0175e74f6a966cd7ed226146d86ae8

SHA512
6c19a0d779185141fb050369f9fbfe60d0b838e55e2674e3f14a67e1a6970727e329656e458ca8516a41c97b20e67eb1789587af957129b3d32c94a3536ab12e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz9135.tmp\7z-out\locales\ml.pak

Filesize
1.4MB

MD5
d32a29a61e8afaba6b42d236257d9929

SHA1
9664f50ea7590a47c2eb8eb4a3e49be556d08f7a

SHA256
a59fd15c969ee8ffd7e72f5a2245c6a5a4fc048f7899fca489d78c8f6394ca1e

SHA512
2668976853b26b22859f8c20afaeb4d641845e94779b8994b49f240302420279e3f9a99666b8f551495b7d5a8c3c83609b7ecf276fabd8345cc8c787319ea3d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz9135.tmp\7z-out\locales\mr.pak

Filesize
1.2MB

MD5
0e5b29b6ae74a1f94ca4f880f131a79f

SHA1
6ac5089ace05847480d2aeec89954124caa781aa

SHA256
25bf8e86f7c9e88f68d4c40c4f124c16f60daf22e7a87f55ba2c560a0f640bc9

SHA512
30717c0aef4458bbcf7472316727981829edada8be3003afd9d65cb01d4cf309f601b1c41539343d6239cb2e9157554c95cf966a4156458a2fd78d2464075c98

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz9135.tmp\7z-out\locales\ms.pak

Filesize
541KB

MD5
6149507c3aa99c4012d9d7cfe4bc30c8

SHA1
51a2bb5cbae64f3877afc342ea0f43915702f8f4

SHA256
dd75481d67d9be36ecb2e421117395fbb75b7623164f13a09be1cf3ce76d588f

SHA512
71f8dc03618d46be7b036353526bf20a61e648ef50adeeec057d314e9a4536899c37ef691164bf9de9e10a3867749f8d3d6f4038e16c82cf6122e7ab4a1c7732

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz9135.tmp\7z-out\locales\nb.pak

Filesize
525KB

MD5
2a0ec73d03d4d7fcec71ad66cc0d4b30

SHA1
bb8df6e11b02086726ecede97d5f729f4197323c

SHA256
d44ef5e644b1b8f7c056d5e20651515fcc8565befec575091735fb39c6d63554

SHA512
cdcb4e436270156e263d731ce243d821c5361b18b6d7b8259875c9d895301d478a87feb7cafc3376d09d18d27f32dc403fd2cbd034d68736cb968bbefebd642b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz9135.tmp\7z-out\locales\nl.pak

Filesize
543KB

MD5
e8b790166d701f63a60c3b322fcce234

SHA1
61ec318aa8030f7d29c3258126b156d1d3eefa2c

SHA256
3d73b0110e5832b6a7c7b7e64018368464ef8552d6a98592d0adbf713eb9755e

SHA512
4e4b299cb55cbb5906ff974bb5e5078d2018298b5ee6d9ca0e40aab8db542aaedc4bd7a5db242a2c5194bc90c07631f627043dcc1a9f2d095a28c3e35f212dd9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz9135.tmp\7z-out\locales\pl.pak

Filesize
604KB

MD5
8a4354163ff3b0978a568f781bdac289

SHA1
45de421f35af79adf962809cf8d0e6d2adbcb553

SHA256
2f6de0f9a46ae0b75beb67e09ffeee12483842a7cd6f2a2382ccbe36fbfc17e3

SHA512
5760f20228afe74e9ff2a916a168e8cc2d4a64d8e76065e61a7a60616a473c7dc3da4805125b270f179b7a0f291071e81d761d82eec3b130d552b57abd76c127

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz9135.tmp\7z-out\locales\pt-BR.pak

Filesize
568KB

MD5
b1ab7d7aa67a7b61bfa9aebad0b812af

SHA1
95eff4be517c0a25c34578def10d48c77021de1a

SHA256
5bd503c413aaf8fa87fd47c341d437accc25397a50b082068bcf2f3bb4fb27c7

SHA512
8498fe7727771df3c1eb34560c1e25b0c30690c7c921104b4adcf04cc5753462bac513a60a5833cb6f57733201d4883605f8a4ec4a457f3ebc7c952090b1a9e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz9135.tmp\7z-out\locales\pt-PT.pak

Filesize
571KB

MD5
cbe5e35f844f5f1400df3685cc847694

SHA1
e60cdb0a813a97c8548c878276bfae155350bb42

SHA256
6b9bd714d217d596183894ffed3174a617e1c8cfae292231d4b967183b589c6b

SHA512
96046c97436a3dbf5aac479b9eaa9dfdcfc81f1edcaee9cd65d59beb0ce6b6b42828e0d170aaef2ef1d68988f7916ac1dbac0d84218de83fedcca8592de4c1f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz9135.tmp\7z-out\locales\ro.pak

Filesize
592KB

MD5
5db10edf772656c0808dd8da698334bf

SHA1
3caf7c9d5a3b44e06e0588daba698b6970ea06f5

SHA256
73b6a63352906d77196f38a1df937ec0770160fb7a93321867c7994ed3e7967b

SHA512
eb253b548c7f574943136764a23818f9dedea17ff42f92dc8591f4b7c297accdde9f6b2c0ad96f1fd0815c53940c0102a90c603f9f4d6d9c8fb053b559cc7a62

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz9135.tmp\7z-out\locales\ru.pak

Filesize
972KB

MD5
e9af20a6226511cd535888846a2bb16f

SHA1
739a46269f334ecc291bae6777f0b7c8e271e4c0

SHA256
5db640c6c288d9fc79012a7670301a3bc463359c17ba200aedaa56260ef8d955

SHA512
7897c500718382f08d55f3cddd96d1451524b5c2b8febc65e1700a645598b622c819ec66e4a21c119f044faaa525a2abdddf66d0c9800af6ecea9ceb217a88bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz9135.tmp\7z-out\locales\sk.pak

Filesize
611KB

MD5
b0bbb6661370d27b6600ebe98cadb9ac

SHA1
1139852da47048f15c16eb101dac86dfc8f652ba

SHA256
e0fe4130e668ac659d5334c5bc8cde70bba8742273b5965836860b5a8b1b016a

SHA512
c8eac323552f873ec088f77b8c46522387b0298b6d566cf8aa173fa9b2d66389068bb26e46044af2faa4224b39dc748164843b58b99e9dde093fcb32afb5fed0

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz9135.tmp\7z-out\locales\sl.pak

Filesize
587KB

MD5
aa7c0f35b61a230d65e498daab67388c

SHA1
f60cb1c7128a1fb1cfd9aa029f96df36033777d0

SHA256
03afc83cdba98c08af169c8ae111aa916f3ee6d5a2fee4954ef35ecc063f2b21

SHA512
048d03c490f18d22f4900363f9c4abee037a2029f226c90806064ffedc85b07a1d86225b9c534311b08f588632a84221d7e4fa355e7b768cfdfd6102c5ffe705

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz9135.tmp\7z-out\locales\sr.pak

Filesize
903KB

MD5
abdd9eb966d915c1896b31cba0b2656b

SHA1
cb0080e5f2c168cd0f3edc6ed6c47734ffd67790

SHA256
3913d3be5016ce873ac68af376d5fcf558bb5f5f29a9bc56df0099ba47e52486

SHA512
bcb258d6da766bb6f00dfdbb03bc878000d9cf28b2b707375ce52485db9c530a34d1528a1473f09b5765bc57abd847f191bde55646eb707443cd0e40509b70e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz9135.tmp\7z-out\locales\sv.pak

Filesize
528KB

MD5
cc0806219798e3ade0437219457a37ab

SHA1
dd6ba47e14b7b0d08159fbca2409b013dc2e17de

SHA256
79a7260c8651ff3024e21f9263543bf4e9d5f3574e81cf96edf6388f8da85cd1

SHA512
df3da02bb2fecbbaf1ab80af8ef8b1a7ae9f6c7ed01f94c5a502720376924132c344dd716fc5b4ddc03733a6c3581ed8d8a577154c619ba85c527dc67f4a48c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz9135.tmp\7z-out\locales\sw.pak

Filesize
557KB

MD5
a63ef2c4676dfbee98e29a84a7ad9d27

SHA1
2f0f4b33acf5e63f3159c62c74deaa9a361203f4

SHA256
7b8c51b247dea72d68cb0ef4292800c13209da6f859a9ad289c996582f19e65c

SHA512
cd65fd2c49d35757de648f21dec748fb4a1d13d2308552774fe9c859ad5748b21f5db449f8b380520f27dc868a3ebaafd58d4c45aba34033785777d342e17e6f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz9135.tmp\7z-out\locales\ta.pak

Filesize
1.4MB

MD5
aa06ead1200f01c9460399f0abe2d54f

SHA1
9b852c4691209c0ae9edf94a5dec4b902fec7b3e

SHA256
1946d903918c57836d2f898ef93cd1d575da1a464e358c399dfde73ea2ef057e

SHA512
6e556b962c16aee22695d93b62b308d95b0695873fb33d13a147b3d8b6791c9599daa6e3bf424a1897212a018ab36dd8c8214c2eb03457048c6931686be40e04

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz9135.tmp\7z-out\locales\te.pak

Filesize
1.3MB

MD5
a4accc25dd8a00bc57df4fca12e41295

SHA1
9466888034c9e6ecf4113ddda63d363ed20e3156

SHA256
157d646525f6a9ac267466631671e65e9b5c3e55b008b564186e64c6853e52aa

SHA512
f19116655b6c2bb5c572b45f1d712fa1f9d57d9e8963fb3d654ed3781bd34a4e937b590bcc1119a318e28632da12a0ef8b36f6426791de833898cf7f30189567

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz9135.tmp\7z-out\locales\th.pak

Filesize
1.1MB

MD5
b18e4574db917920eccfb8e6900d0662

SHA1
554206b9e639135074b0946fb28b6ffe2d934159

SHA256
c14fa1bb30c880216d6cfea6fb738235cf72a3fe8be919c3d61321d5a5883211

SHA512
5f427f9ed85bb368b45bafd523c634e18596e430fdc380563878d2ca897cf2580d0405f7c0d8e10abba389bb7125978a81d335263bb777e0ee0bfe3d47c8c65f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz9135.tmp\7z-out\locales\tr.pak

Filesize
567KB

MD5
82c6a14ba1b28f947bee67bc3feab091

SHA1
25023b22eaed29d0817ec95d5bcb4ad3d724f5ad

SHA256
099507f6f2a2c98ecce275f8ad956eeeeaada65b7788356301af04a0cd7d431e

SHA512
988a9275b7a05d100ca9242dd05969d2363a42938d47db37a1f62ec1874e96b640c14b272f1829ab5c6e0d2763c22fbf0af99894d4d9d32726925eabbc02c05e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz9135.tmp\7z-out\locales\uk.pak

Filesize
973KB

MD5
ec3aa18a9d9c989b1025dddb0fa52b55

SHA1
ab3b0834cabee34bc2f9fd04104b10e5f9c102ca

SHA256
ee67744c26e0c69fbed8b102add339070aabc70c2d8ca9ea037c6c9d23b66d3b

SHA512
90d40424b050c6c7ace113e85b0b0a58472967c50a14fbc6637cd3b2db8ff3f521cc94dcd256fa017684256e8a9c19b158aaa57f6d3094fab970578d3b1c6847

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz9135.tmp\7z-out\locales\ur.pak

Filesize
850KB

MD5
cb228cc41981e8bcbd2768da20026912

SHA1
c55bb999c4c1fbee5e38b6c986fbce2b128f3880

SHA256
a7d825fe348700528800ef9ea7940ee8027373e9c05a4e51e526d0a213c05429

SHA512
85308806be53494683f32520e181dd9c8c9abac0b92bc439d4e30eef22d4af993794a9719dd9a4eeed0bbcaf61c0e2342e7d4ed5d30b504572bd2bc269100e2e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz9135.tmp\7z-out\locales\vi.pak

Filesize
673KB

MD5
045241a62232bae57f1d57c6c3af7c55

SHA1
5c2a1a677a8bdfa20f3577335131bd4b89a46355

SHA256
56758c918bbfe6a9d5b20e8b4a7248bdf2d43e0bf5f98e85a9892ff03dbc2d99

SHA512
8e30af44a53a36a194da16a756dff0f90efbef164277bdcde683c89a3cdc04ae5e1298475e8a098d19dab73eb0a71637f676d49d237c5480e1f7aca1765166bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz9135.tmp\7z-out\locales\zh-CN.pak

Filesize
484KB

MD5
798bc7d8b63906c5b1c67e89ad17dc58

SHA1
b39c86d6d3fd9d8b8da90d86f827a0c0803fba8c

SHA256
1c05280d8dcdfe99619695b76dd054292a90c1a93a5cfb92cdc4a5b0068a7092

SHA512
7a21af438823d562b889d7c99f639421e01f0536e95f3206dd53d2c8ded82b7a4ab74bb9b4262b2fa27e50efd8dd7719827ad2e6b6d4c2e0d0811930027ed982

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz9135.tmp\7z-out\locales\zh-TW.pak

Filesize
479KB

MD5
0be25a48eecee48f428fe56fbfa683fd

SHA1
94c0e8c99beb592ebab9ea5b8758aa414bbe7048

SHA256
a5e276bdfe4cf87832eee153596ccde9cf9193e81f29a4295c8335525da64295

SHA512
423033e67654820ab9f9773f45f70908511aeb8228c59126757885e0bbe0bd960257324d405d27526d61b541b1e6323de16bef29d4dcb94f39fd5e92fa811cc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz9135.tmp\7z-out\resources.pak

Filesize
5.5MB

MD5
6772b597bf68622d934f207570e771b1

SHA1
f2a80fbfa034cb1fa07dc9aa37bf9f5b2280ff13

SHA256
268de4d99ab7c4f4ee32c8e8cb2b058a2c8d0d839f468ae8e8c0605feaa736ea

SHA512
a2be67df09951c9ef9200dcccbdff13736921522191f0001da539d5c7f26b5b26a6b810be6963908f216768c98d21e52486c7e00538cc0730e8c78e78811b85b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz9135.tmp\7z-out\resources\app.asar

Filesize
10.7MB

MD5
d01653f3a3ec61de9189a994dd02bb95

SHA1
1fa22003b6483930b030252e860a4302151e05a9

SHA256
e8d538b7af9c5fdda8a0542faa9a06e56bdffb511adced49601dc1367fd49876

SHA512
e32fc1ec98c9b9eda2331c6a9bb2e890903b9531957d8ebf79e4251366df7b10afd6ebea59d9068c37b6723c8d09c145560d54b0bf333f6cb53d8c66a92a1645

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz9135.tmp\7z-out\resources\elevate.exe

Filesize
105KB

MD5
792b92c8ad13c46f27c7ced0810694df

SHA1
d8d449b92de20a57df722df46435ba4553ecc802

SHA256
9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37

SHA512
6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz9135.tmp\7z-out\snapshot_blob.bin

Filesize
309KB

MD5
c8950b01f336b05609976546b1a007e6

SHA1
f04d0b0369007bbe6a7fe129b31b19dd1822f32f

SHA256
9b3a75a713e41bc73f219858fcac8e3031ba22732285ed3a64dc48074c725cc2

SHA512
b7db4277290e849a52ad5d31ff65ab5d2b75c2125d67eeee02b09e4e7001aa46d10bf89429c65695c7560d1c45b898c20275eb9e36cd8b259707ffb8b298f103

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz9135.tmp\7z-out\v8_context_snapshot.bin

Filesize
671KB

MD5
bf2976da5086b48d74eb36f56f5deb83

SHA1
5aa7669a3e2166fdd7534241a0e7a9bd3ff5748b

SHA256
9f1614328e18becb4adf96de98bc91ce2a69274abe6621327cc0fc8503a1ab20

SHA512
c44deeb96597b4498604ecf2060ee0520e84a00308ca1f47ffdf8e3ed3e676b27b622ff7dbd4b6f1a14ce60b05cc2ad9b8d7562bb362c1b12a885ea7fbe50e0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz9135.tmp\7z-out\vk_swiftshader.dll

Filesize
5.3MB

MD5
6720d5dcda6737eb0cc5a352a47414dc

SHA1
03d9a8e350f485dd955f7dee06bfc46371753032

SHA256
d8f36b089d83157abc271d9fe125919c3237943fa9789a511ac5ef1d41e2e3af

SHA512
de5ade6ce14b14957fce669c4181af1e6a6f540798d1c6720b56ff281f813a6ce4446bde33a8f175d2484e07f4911f93a773cac1d372cbe3b26be634b3fa1686

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz9135.tmp\7z-out\vk_swiftshader_icd.json

Filesize
106B

MD5
8642dd3a87e2de6e991fae08458e302b

SHA1
9c06735c31cec00600fd763a92f8112d085bd12a

SHA256
32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9

SHA512
f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz9135.tmp\7z-out\vulkan-1.dll

Filesize
874KB

MD5
b6d3af84e8be0027741aa6077768789e

SHA1
e525f2434dc56f79644695f5841e91dd5f80eec4

SHA256
376ff6892ec7b406acd8c455ac82f8541e59e3757195488ff04cd9f20d554562

SHA512
f03b8792a740679c8a1a8ce0615b7876cc811130085f3ffb42182e0cb846519603804da97fc93a8abebee01e03fd257df289c54575da8faaad018f4f4bae606a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz9135.tmp\SpiderBanner.dll

Filesize
9KB

MD5
17309e33b596ba3a5693b4d3e85cf8d7

SHA1
7d361836cf53df42021c7f2b148aec9458818c01

SHA256
996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93

SHA512
1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz9135.tmp\StdUtils.dll

Filesize
100KB

MD5
c6a6e03f77c313b267498515488c5740

SHA1
3d49fc2784b9450962ed6b82b46e9c3c957d7c15

SHA256
b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e

SHA512
9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz9135.tmp\System.dll

Filesize
12KB

MD5
0d7ad4f45dc6f5aa87f606d0331c6901

SHA1
48df0911f0484cbe2a8cdd5362140b63c41ee457

SHA256
3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

SHA512
c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz9135.tmp\nsExec.dll

Filesize
6KB

MD5
ec0504e6b8a11d5aad43b296beeb84b2

SHA1
91b5ce085130c8c7194d66b2439ec9e1c206497c

SHA256
5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962

SHA512
3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz9135.tmp\nsis7z.dll

Filesize
424KB

MD5
80e44ce4895304c6a3a831310fbf8cd0

SHA1
36bd49ae21c460be5753a904b4501f1abca53508

SHA256
b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592

SHA512
c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df

Download Submit
C:\Users\Admin\AppData\Roaming\MyElectronApp\Bginfo.exe

Filesize
2.1MB

MD5
3aef228fb7ee187160482084d36c9726

SHA1
8b76990c5061890c94f81f504c5782912a58d8a6

SHA256
c885df88693496d5c28ad16a1ecde259e191f54ad76428857742af843b846c53

SHA512
e659a7cf12c6b41879e4ce987e4cd1cefce2ffc74e06817667fa833764f36f25cc5f8374dbc844b68b787acac011c7b8c8f2b74563bf8a96f623ebb110a593da

Download Submit
C:\Users\Admin\AppData\Roaming\MyElectronApp\VERSION.dll

Filesize
315KB

MD5
797c95197e636714a6dd27097f080775

SHA1
fdbb456970b87372a87836346efe39004f64b99f

SHA256
bca40ec33acd2fcb680b4d39a9641888ce7b4546f41c526cc755f0a15a50e0f4

SHA512
f210d43af49ec20fc443820136c7c706fab03021cf471bc6825ce29d92d6b743205be9be7cbd015de6f12d3fb98e894df7a7165644976be47a49055ec26c10ef

Download Submit
C:\Users\Admin\AppData\Roaming\MyElectronApp\data.bin

Filesize
467KB

MD5
c23cda11129a0ed2722ff928b832f9bf

SHA1
bb7579a62924a4c6e3c9d8d4e8d09491c1981890

SHA256
e5338e0ad8f140989c5c3bc9b4ab178eb9c01b584e709aa079e134faaabc0fdf

SHA512
0396fbf7ff3826552ba3efdb4adc597d96539a0c084aa074504e147b3d0bc915ba50cad16b846f56ffa14d78227a263184a84b72cb3f70fa860ada7075b10d14

Download Submit
C:\Windows \System32\VERSION.dll

Filesize
105KB

MD5
a3cb17567bcb27217a5c2cf7609733c7

SHA1
558cb0f479ebdd0ab15289215edab9cdddfe4aee

SHA256
48a7ae5a3ae288641a14df0da499b39a5b70432601af251ff5786d7784361b43

SHA512
d80678dd2c51b3f15c37dd5717bd106533ca1d256239608fb227863099cbde9ebc91f25082e17685aeb033557ca6e5fa0f0dc59a909ef7e36a35ed61c0b45a62

Download Submit
C:\Windows \System32\VERSION.dll

Filesize
105KB

MD5
aa7457a9f158e53fa634ab3d10da9404

SHA1
2cde249d40d9ba78a46d44223fac0df0180dfd38

SHA256
cfa4d681ddbf7f90fec56e7bfa7ce4fdc7e6815471bda7dfdd4b6e41e3f7a1bd

SHA512
9da8d90a715ccfb2ad557db134301d0eaabdef34000ada10c0745a528cb3b550c69eca3782b3cfc0c766a93bd44f52ee00320dc9038ebca4dceb7e0054c6aefc

Download Submit
C:\Windows \System32\winSAT.exe

Filesize
2.7MB

MD5
715db53a8064c6deccf68b7501df3386

SHA1
99acd12c3600ad3a7c478e49126db520bc136304

SHA256
cc31fdcdce05144ef750b01233d57614cda7364a73ca26ff68886ebdc650e367

SHA512
9ba9eaefa1e2e4da2d14f12b81f2ed0597ab6eb6b32d85851b69bc86d77a6b38810a04aa35ffcbf64484d544f52960f05f4eaca4740cd3674a1d09d8b373ce3c

Download Submit
C:\Windows\Performance\WinSAT\winsat.log

Filesize
574B

MD5
2d1e378f004fcb0f510f9621144f184b

SHA1
5024c5d134c895f056edfb37d58d0cc1390e55e6

SHA256
d001b3dd897d520f5e6e7a8f3ce5eb91f9125b4ac991c7b83f059aa141fd3c00

SHA512
b8c795558f00e4e730b836ce839753bb4e18dd3489a422e21ba08fb71cb3fe850a6110a4dc8f66be6d409c3c855d472d98fe2af83ac8eb6e4be7e36e911afed5

Download Submit
memory/1652-815-0x0000000000FC0000-0x000000000103D000-memory.dmp

Filesize
500KB

Download
memory/1652-816-0x0000000000FC0000-0x000000000103D000-memory.dmp

Filesize
500KB

Download
memory/1652-817-0x0000000000FC0000-0x000000000103D000-memory.dmp

Filesize
500KB

Download
memory/1652-820-0x0000000000FC0000-0x000000000103D000-memory.dmp

Filesize
500KB

Download
memory/1652-821-0x0000000000FC0000-0x000000000103D000-memory.dmp

Filesize
500KB

Download
memory/1652-828-0x0000000000FC0000-0x000000000103D000-memory.dmp

Filesize
500KB

Download
memory/2544-752-0x0000025FCEA70000-0x0000025FCEA92000-memory.dmp

Filesize
136KB

Download