dcrat | 3e58b22fc7a8ea15b27d578e4f6add3ff90405bce8577b1bcbfac561994b194f

Analysis

max time kernel
153s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
28-11-2024 15:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NewLauncher Installer.exe
Size

274.0MB
MD5

57ec89a694aa9f06e258bf8d464c3dbb
SHA1

4ea00ac498ee8cd9b06321638c3f214fde0e7c17
SHA256

3e58b22fc7a8ea15b27d578e4f6add3ff90405bce8577b1bcbfac561994b194f
SHA512

1d36c6c42e1132e29ac7f8bb24764c52b2dececef4dc0e51febf7cdc5229604fa0dce7ebe1d28b7920f0cea38dfb85d12ecb40db29d38ec6fce6a36f90f6cd8f
SSDEEP

6291456:7C4P7RCav2Fsjjn0C4P7RCav2FmUduzez4tL9qul+q0C4P7RCav2Fc6Zu5WCmnO:+4jRCa2sj4jRCa2Lduu4ZB94jRCa2Lw

Score

10^/10

dcrat discovery evasion infostealer rat spyware stealer

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 33 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4132	3748	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2224	3748	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2888	3748	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3372	3748	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4424	3748	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2448	3748	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1428	3748	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5108	3748	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3684	3748	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4492	3748	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1196	3748	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4372	3748	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4344	3748	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2456	3748	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4456	3748	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1388	3748	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5056	3748	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2444	3748	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4788	3748	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1884	3748	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3504	3748	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2624	3748	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3532	3748	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2880	3748	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1948	3748	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1316	3748	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4760	3748	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4816	3748	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4600	3748	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4876	3748	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	968	3748	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3372	3748	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1176	3748	schtasks.exe	90

DCRat payload 4 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
behavioral1/files/0x000c000000023b37-4.dat	dcrat
behavioral1/files/0x000b000000023baa-18.dat	dcrat
behavioral1/memory/4688-20-0x0000000000DE0000-0x0000000001030000-memory.dmp	dcrat
behavioral1/memory/880-56-0x0000000000400000-0x0000000001400000-memory.dmp	dcrat

Disables Task Manager via registry modification
evasion

Checks computer location settings 2 TTPs 8 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

NewLauncher.exeNewLauncher.exeNewLauncher.exeNewLauncher.exeNewLauncher Installer.exeDCRatBuild.exeWScript.exechainrefHost.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	NewLauncher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	NewLauncher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	NewLauncher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	NewLauncher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	NewLauncher Installer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	DCRatBuild.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	chainrefHost.exe

Executes dropped EXE 14 IoCs

Processes:

DCRatBuild.exechainrefHost.exeNewLauncher-1.6.17-windows.exeNewLauncher Installer.exeNewLauncher.exeNewLauncher.exeNewLauncher.exeNewLauncher.exeNewLauncher-1.6.19-windows-x64.exeold-uninstaller.exeNewLauncher.exeNewLauncher.exeNewLauncher.exeNewLauncher.exe

pid	Process
4036	DCRatBuild.exe
4688	chainrefHost.exe
4216	NewLauncher-1.6.17-windows.exe
4596	NewLauncher Installer.exe
3800	NewLauncher.exe
3156	NewLauncher.exe
5016	NewLauncher.exe
2472	NewLauncher.exe
5560	NewLauncher-1.6.19-windows-x64.exe
1204	old-uninstaller.exe
2888	NewLauncher.exe
5632	NewLauncher.exe
312	NewLauncher.exe
1212	NewLauncher.exe

Loads dropped DLL 35 IoCs

Processes:

NewLauncher-1.6.17-windows.exeNewLauncher.exeNewLauncher.exeNewLauncher.exeNewLauncher.exeNewLauncher-1.6.19-windows-x64.exeold-uninstaller.exeNewLauncher.exeNewLauncher.exeNewLauncher.exeNewLauncher.exe

pid	Process
4216	NewLauncher-1.6.17-windows.exe
4216	NewLauncher-1.6.17-windows.exe
4216	NewLauncher-1.6.17-windows.exe
4216	NewLauncher-1.6.17-windows.exe
4216	NewLauncher-1.6.17-windows.exe
4216	NewLauncher-1.6.17-windows.exe
4216	NewLauncher-1.6.17-windows.exe
4216	NewLauncher-1.6.17-windows.exe
4216	NewLauncher-1.6.17-windows.exe
4216	NewLauncher-1.6.17-windows.exe
3800	NewLauncher.exe
3156	NewLauncher.exe
3156	NewLauncher.exe
5016	NewLauncher.exe
3156	NewLauncher.exe
3156	NewLauncher.exe
3156	NewLauncher.exe
2472	NewLauncher.exe
5560	NewLauncher-1.6.19-windows-x64.exe
5560	NewLauncher-1.6.19-windows-x64.exe
5560	NewLauncher-1.6.19-windows-x64.exe
5560	NewLauncher-1.6.19-windows-x64.exe
1204	old-uninstaller.exe
1204	old-uninstaller.exe
1204	old-uninstaller.exe
1204	old-uninstaller.exe
5560	NewLauncher-1.6.19-windows-x64.exe
2888	NewLauncher.exe
5632	NewLauncher.exe
5632	NewLauncher.exe
5632	NewLauncher.exe
5632	NewLauncher.exe
5632	NewLauncher.exe
312	NewLauncher.exe
1212	NewLauncher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 7 IoCs

Processes:

chainrefHost.exe

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\7a73b78f679a6f	chainrefHost.exe
File created	C:\Program Files\Crashpad\wininit.exe	chainrefHost.exe
File created	C:\Program Files\Crashpad\56085415360792	chainrefHost.exe
File created	C:\Program Files\Crashpad\reports\sihost.exe	chainrefHost.exe
File created	C:\Program Files\Crashpad\reports\66fc9ff0ee96c2	chainrefHost.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\chrome.exe	chainrefHost.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\chrome.exe	chainrefHost.exe

Drops file in Windows directory 6 IoCs

Processes:

chainrefHost.exe

description	ioc	Process
File created	C:\Windows\Prefetch\ReadyBoot\NewLauncher Installer.exe	chainrefHost.exe
File created	C:\Windows\Prefetch\ReadyBoot\9934998069e5a2	chainrefHost.exe
File created	C:\Windows\Help\en-US\RuntimeBroker.exe	chainrefHost.exe
File created	C:\Windows\Help\en-US\9e8d7a4ca61bd9	chainrefHost.exe
File created	C:\Windows\DiagTrack\winlogon.exe	chainrefHost.exe
File created	C:\Windows\DiagTrack\cc11b995f2a76d	chainrefHost.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

old-uninstaller.exeNewLauncher Installer.exeDCRatBuild.exeWScript.execmd.exeNewLauncher-1.6.17-windows.exereg.exeNewLauncher-1.6.19-windows-x64.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	old-uninstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NewLauncher Installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DCRatBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NewLauncher-1.6.17-windows.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NewLauncher-1.6.19-windows-x64.exe

Modifies registry class 1 IoCs

Processes:

DCRatBuild.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	DCRatBuild.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

Processes:

reg.exe

pid	Process
892	reg.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 33 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

Processes:

pid	Process
2224	schtasks.exe
4788	schtasks.exe
3504	schtasks.exe
4760	schtasks.exe
4132	schtasks.exe
5108	schtasks.exe
1316	schtasks.exe
1428	schtasks.exe
2456	schtasks.exe
1388	schtasks.exe
4424	schtasks.exe
1196	schtasks.exe
4372	schtasks.exe
4816	schtasks.exe
4600	schtasks.exe
2888	schtasks.exe
2624	schtasks.exe
2444	schtasks.exe
4344	schtasks.exe
3372	schtasks.exe
1176	schtasks.exe
3684	schtasks.exe
4456	schtasks.exe
5056	schtasks.exe
1884	schtasks.exe
4876	schtasks.exe
968	schtasks.exe
2448	schtasks.exe
4492	schtasks.exe
3532	schtasks.exe
2880	schtasks.exe
1948	schtasks.exe
3372	schtasks.exe

Suspicious behavior: EnumeratesProcesses 36 IoCs

Processes:

chainrefHost.exeNewLauncher Installer.exeNewLauncher-1.6.17-windows.exeNewLauncher-1.6.19-windows-x64.exeold-uninstaller.exechrome.exe

pid	Process
4688	chainrefHost.exe
4688	chainrefHost.exe
4688	chainrefHost.exe
4688	chainrefHost.exe
4688	chainrefHost.exe
4688	chainrefHost.exe
4688	chainrefHost.exe
4688	chainrefHost.exe
4688	chainrefHost.exe
4688	chainrefHost.exe
4688	chainrefHost.exe
4688	chainrefHost.exe
4596	NewLauncher Installer.exe
4596	NewLauncher Installer.exe
4596	NewLauncher Installer.exe
4596	NewLauncher Installer.exe
4596	NewLauncher Installer.exe
4596	NewLauncher Installer.exe
4596	NewLauncher Installer.exe
4596	NewLauncher Installer.exe
4596	NewLauncher Installer.exe
4596	NewLauncher Installer.exe
4596	NewLauncher Installer.exe
4596	NewLauncher Installer.exe
4596	NewLauncher Installer.exe
4596	NewLauncher Installer.exe
4216	NewLauncher-1.6.17-windows.exe
4216	NewLauncher-1.6.17-windows.exe
5560	NewLauncher-1.6.19-windows-x64.exe
5560	NewLauncher-1.6.19-windows-x64.exe
1204	old-uninstaller.exe
1204	old-uninstaller.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe
2964	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

NewLauncher Installer.exe

pid	Process
4596	NewLauncher Installer.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chainrefHost.exeNewLauncher Installer.exeNewLauncher-1.6.17-windows.exeNewLauncher.exe

description	pid	Process
Token: SeDebugPrivilege	4688	chainrefHost.exe
Token: SeDebugPrivilege	4596	NewLauncher Installer.exe
Token: SeSecurityPrivilege	4216	NewLauncher-1.6.17-windows.exe
Token: SeShutdownPrivilege	3800	NewLauncher.exe
Token: SeCreatePagefilePrivilege	3800	NewLauncher.exe
Token: SeShutdownPrivilege	3800	NewLauncher.exe
Token: SeCreatePagefilePrivilege	3800	NewLauncher.exe
Token: SeShutdownPrivilege	3800	NewLauncher.exe
Token: SeCreatePagefilePrivilege	3800	NewLauncher.exe
Token: SeShutdownPrivilege	3800	NewLauncher.exe
Token: SeCreatePagefilePrivilege	3800	NewLauncher.exe
Token: SeShutdownPrivilege	3800	NewLauncher.exe
Token: SeCreatePagefilePrivilege	3800	NewLauncher.exe
Token: SeShutdownPrivilege	3800	NewLauncher.exe
Token: SeCreatePagefilePrivilege	3800	NewLauncher.exe
Token: SeShutdownPrivilege	3800	NewLauncher.exe
Token: SeCreatePagefilePrivilege	3800	NewLauncher.exe
Token: SeShutdownPrivilege	3800	NewLauncher.exe
Token: SeCreatePagefilePrivilege	3800	NewLauncher.exe
Token: SeShutdownPrivilege	3800	NewLauncher.exe
Token: SeCreatePagefilePrivilege	3800	NewLauncher.exe
Token: SeShutdownPrivilege	3800	NewLauncher.exe
Token: SeCreatePagefilePrivilege	3800	NewLauncher.exe
Token: SeShutdownPrivilege	3800	NewLauncher.exe
Token: SeCreatePagefilePrivilege	3800	NewLauncher.exe
Token: SeShutdownPrivilege	3800	NewLauncher.exe
Token: SeCreatePagefilePrivilege	3800	NewLauncher.exe
Token: SeShutdownPrivilege	3800	NewLauncher.exe
Token: SeCreatePagefilePrivilege	3800	NewLauncher.exe
Token: SeShutdownPrivilege	3800	NewLauncher.exe
Token: SeCreatePagefilePrivilege	3800	NewLauncher.exe
Token: SeShutdownPrivilege	3800	NewLauncher.exe
Token: SeCreatePagefilePrivilege	3800	NewLauncher.exe
Token: SeShutdownPrivilege	3800	NewLauncher.exe
Token: SeCreatePagefilePrivilege	3800	NewLauncher.exe
Token: SeShutdownPrivilege	3800	NewLauncher.exe
Token: SeCreatePagefilePrivilege	3800	NewLauncher.exe
Token: SeShutdownPrivilege	3800	NewLauncher.exe
Token: SeCreatePagefilePrivilege	3800	NewLauncher.exe
Token: SeShutdownPrivilege	3800	NewLauncher.exe
Token: SeCreatePagefilePrivilege	3800	NewLauncher.exe
Token: SeShutdownPrivilege	3800	NewLauncher.exe
Token: SeCreatePagefilePrivilege	3800	NewLauncher.exe
Token: SeShutdownPrivilege	3800	NewLauncher.exe
Token: SeCreatePagefilePrivilege	3800	NewLauncher.exe
Token: SeShutdownPrivilege	3800	NewLauncher.exe
Token: SeCreatePagefilePrivilege	3800	NewLauncher.exe
Token: SeShutdownPrivilege	3800	NewLauncher.exe
Token: SeCreatePagefilePrivilege	3800	NewLauncher.exe
Token: SeShutdownPrivilege	3800	NewLauncher.exe
Token: SeCreatePagefilePrivilege	3800	NewLauncher.exe
Token: SeShutdownPrivilege	3800	NewLauncher.exe
Token: SeCreatePagefilePrivilege	3800	NewLauncher.exe
Token: SeShutdownPrivilege	3800	NewLauncher.exe
Token: SeCreatePagefilePrivilege	3800	NewLauncher.exe
Token: SeShutdownPrivilege	3800	NewLauncher.exe
Token: SeCreatePagefilePrivilege	3800	NewLauncher.exe
Token: SeShutdownPrivilege	3800	NewLauncher.exe
Token: SeCreatePagefilePrivilege	3800	NewLauncher.exe
Token: SeShutdownPrivilege	3800	NewLauncher.exe
Token: SeCreatePagefilePrivilege	3800	NewLauncher.exe
Token: SeShutdownPrivilege	3800	NewLauncher.exe
Token: SeCreatePagefilePrivilege	3800	NewLauncher.exe
Token: SeShutdownPrivilege	3800	NewLauncher.exe

Suspicious use of FindShellTrayWindow 10 IoCs

Processes:

NewLauncher-1.6.17-windows.exeNewLauncher.exe

pid	Process
4216	NewLauncher-1.6.17-windows.exe
2888	NewLauncher.exe
2888	NewLauncher.exe
2888	NewLauncher.exe
2888	NewLauncher.exe
2888	NewLauncher.exe
2888	NewLauncher.exe
2888	NewLauncher.exe
2888	NewLauncher.exe
2888	NewLauncher.exe

Suspicious use of SendNotifyMessage 8 IoCs

Processes:

NewLauncher.exe

pid	Process
2888	NewLauncher.exe
2888	NewLauncher.exe
2888	NewLauncher.exe
2888	NewLauncher.exe
2888	NewLauncher.exe
2888	NewLauncher.exe
2888	NewLauncher.exe
2888	NewLauncher.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

NewLauncher Installer.exeDCRatBuild.exeWScript.execmd.exechainrefHost.exeNewLauncher.exeNewLauncher-1.6.19-windows-x64.exeNewLauncher.exe

description	pid	Process	procid_target
PID 880 wrote to memory of 4036	880	NewLauncher Installer.exe	96
PID 880 wrote to memory of 4036	880	NewLauncher Installer.exe	96
PID 880 wrote to memory of 4036	880	NewLauncher Installer.exe	96
PID 4036 wrote to memory of 1316	4036	DCRatBuild.exe	97
PID 4036 wrote to memory of 1316	4036	DCRatBuild.exe	97
PID 4036 wrote to memory of 1316	4036	DCRatBuild.exe	97
PID 1316 wrote to memory of 2472	1316	WScript.exe	103
PID 1316 wrote to memory of 2472	1316	WScript.exe	103
PID 1316 wrote to memory of 2472	1316	WScript.exe	103
PID 2472 wrote to memory of 4688	2472	cmd.exe	105
PID 2472 wrote to memory of 4688	2472	cmd.exe	105
PID 880 wrote to memory of 4216	880	NewLauncher Installer.exe	107
PID 880 wrote to memory of 4216	880	NewLauncher Installer.exe	107
PID 880 wrote to memory of 4216	880	NewLauncher Installer.exe	107
PID 4688 wrote to memory of 4596	4688	chainrefHost.exe	142
PID 4688 wrote to memory of 4596	4688	chainrefHost.exe	142
PID 2472 wrote to memory of 892	2472	cmd.exe	143
PID 2472 wrote to memory of 892	2472	cmd.exe	143
PID 2472 wrote to memory of 892	2472	cmd.exe	143
PID 3800 wrote to memory of 3156	3800	NewLauncher.exe	156
PID 3800 wrote to memory of 3156	3800	NewLauncher.exe	156
PID 3800 wrote to memory of 3156	3800	NewLauncher.exe	156
PID 3800 wrote to memory of 3156	3800	NewLauncher.exe	156
PID 3800 wrote to memory of 3156	3800	NewLauncher.exe	156
PID 3800 wrote to memory of 3156	3800	NewLauncher.exe	156
PID 3800 wrote to memory of 3156	3800	NewLauncher.exe	156
PID 3800 wrote to memory of 3156	3800	NewLauncher.exe	156
PID 3800 wrote to memory of 3156	3800	NewLauncher.exe	156
PID 3800 wrote to memory of 3156	3800	NewLauncher.exe	156
PID 3800 wrote to memory of 3156	3800	NewLauncher.exe	156
PID 3800 wrote to memory of 3156	3800	NewLauncher.exe	156
PID 3800 wrote to memory of 3156	3800	NewLauncher.exe	156
PID 3800 wrote to memory of 3156	3800	NewLauncher.exe	156
PID 3800 wrote to memory of 3156	3800	NewLauncher.exe	156
PID 3800 wrote to memory of 3156	3800	NewLauncher.exe	156
PID 3800 wrote to memory of 3156	3800	NewLauncher.exe	156
PID 3800 wrote to memory of 3156	3800	NewLauncher.exe	156
PID 3800 wrote to memory of 3156	3800	NewLauncher.exe	156
PID 3800 wrote to memory of 3156	3800	NewLauncher.exe	156
PID 3800 wrote to memory of 3156	3800	NewLauncher.exe	156
PID 3800 wrote to memory of 3156	3800	NewLauncher.exe	156
PID 3800 wrote to memory of 3156	3800	NewLauncher.exe	156
PID 3800 wrote to memory of 3156	3800	NewLauncher.exe	156
PID 3800 wrote to memory of 3156	3800	NewLauncher.exe	156
PID 3800 wrote to memory of 3156	3800	NewLauncher.exe	156
PID 3800 wrote to memory of 3156	3800	NewLauncher.exe	156
PID 3800 wrote to memory of 3156	3800	NewLauncher.exe	156
PID 3800 wrote to memory of 3156	3800	NewLauncher.exe	156
PID 3800 wrote to memory of 3156	3800	NewLauncher.exe	156
PID 3800 wrote to memory of 5016	3800	NewLauncher.exe	157
PID 3800 wrote to memory of 5016	3800	NewLauncher.exe	157
PID 3800 wrote to memory of 2472	3800	NewLauncher.exe	158
PID 3800 wrote to memory of 2472	3800	NewLauncher.exe	158
PID 3800 wrote to memory of 5560	3800	NewLauncher.exe	160
PID 3800 wrote to memory of 5560	3800	NewLauncher.exe	160
PID 3800 wrote to memory of 5560	3800	NewLauncher.exe	160
PID 5560 wrote to memory of 1204	5560	NewLauncher-1.6.19-windows-x64.exe	161
PID 5560 wrote to memory of 1204	5560	NewLauncher-1.6.19-windows-x64.exe	161
PID 5560 wrote to memory of 1204	5560	NewLauncher-1.6.19-windows-x64.exe	161
PID 2888 wrote to memory of 5632	2888	NewLauncher.exe	164
PID 2888 wrote to memory of 5632	2888	NewLauncher.exe	164
PID 2888 wrote to memory of 5632	2888	NewLauncher.exe	164
PID 2888 wrote to memory of 5632	2888	NewLauncher.exe	164
PID 2888 wrote to memory of 5632	2888	NewLauncher.exe	164

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\NewLauncher Installer.exe
"C:\Users\Admin\AppData\Local\Temp\NewLauncher Installer.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:880
- C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe
  "C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4036
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\comAgentProviderBrowserHost\Nhiwm2aj1jfzULheVbkmLVGWtKQXyI.vbe"
    3⤵
    - Checks computer location settings
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1316
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\comAgentProviderBrowserHost\sjSBqrd847yf9OT2lEyuTEhLo.bat" "
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2472
    - - C:\comAgentProviderBrowserHost\chainrefHost.exe
        
        "C:\comAgentProviderBrowserHost\chainrefHost.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in Program Files directory
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4688
      - C:\Windows\Prefetch\ReadyBoot\NewLauncher Installer.exe
        
        "C:\Windows\Prefetch\ReadyBoot\NewLauncher Installer.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        
        PID:4596
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:892
- C:\Users\Admin\AppData\Local\Temp\NewLauncher-1.6.17-windows.exe
  "C:\Users\Admin\AppData\Local\Temp\NewLauncher-1.6.17-windows.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:4216

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --field-trial-handle=3148,i,13540518249905691238,2783204355644180518,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3168 /prefetch:1
1⤵
PID:2480

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --field-trial-handle=3204,i,13540518249905691238,2783204355644180518,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3300 /prefetch:1
1⤵
PID:5084

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:3760

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --field-trial-handle=4456,i,13540518249905691238,2783204355644180518,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4504 /prefetch:1
1⤵
PID:2940

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4664,i,13540518249905691238,2783204355644180518,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4692 /prefetch:8
1⤵
PID:1684

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4856,i,13540518249905691238,2783204355644180518,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4736 /prefetch:8
1⤵
PID:4428

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "chromec" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Microsoft\Edge\Application\chrome.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4132

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "chrome" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft\Edge\Application\chrome.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "chromec" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Microsoft\Edge\Application\chrome.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "chainrefHostc" /sc MINUTE /mo 12 /tr "'C:\Users\Default User\chainrefHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "chainrefHost" /sc ONLOGON /tr "'C:\Users\Default User\chainrefHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4424

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "chainrefHostc" /sc MINUTE /mo 9 /tr "'C:\Users\Default User\chainrefHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\comAgentProviderBrowserHost\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\comAgentProviderBrowserHost\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\comAgentProviderBrowserHost\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 14 /tr "'C:\Program Files\Crashpad\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files\Crashpad\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1196

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 13 /tr "'C:\Program Files\Crashpad\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\comAgentProviderBrowserHost\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4344

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\comAgentProviderBrowserHost\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2456

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\comAgentProviderBrowserHost\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4456

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Users\Admin\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 11 /tr "'C:\Program Files\Crashpad\reports\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4788

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Program Files\Crashpad\reports\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 14 /tr "'C:\Program Files\Crashpad\reports\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3504

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "chromec" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\Recent\chrome.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "chrome" /sc ONLOGON /tr "'C:\Users\Admin\Recent\chrome.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "chromec" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\Recent\chrome.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 12 /tr "'C:\Windows\DiagTrack\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\DiagTrack\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1316

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 13 /tr "'C:\Windows\DiagTrack\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "NewLauncher InstallerN" /sc MINUTE /mo 7 /tr "'C:\Windows\Prefetch\ReadyBoot\NewLauncher Installer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "NewLauncher Installer" /sc ONLOGON /tr "'C:\Windows\Prefetch\ReadyBoot\NewLauncher Installer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "NewLauncher InstallerN" /sc MINUTE /mo 6 /tr "'C:\Windows\Prefetch\ReadyBoot\NewLauncher Installer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Windows\Help\en-US\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\Help\en-US\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Windows\Help\en-US\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1176

C:\Users\Admin\AppData\Local\Programs\NewLauncher\NewLauncher.exe
"C:\Users\Admin\AppData\Local\Programs\NewLauncher\NewLauncher.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3800
- C:\Users\Admin\AppData\Local\Programs\NewLauncher\NewLauncher.exe
  "C:\Users\Admin\AppData\Local\Programs\NewLauncher\NewLauncher.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\NewLauncher" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1736,i,17766923347578060977,9188322908642549415,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1728 /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3156
- C:\Users\Admin\AppData\Local\Programs\NewLauncher\NewLauncher.exe
  "C:\Users\Admin\AppData\Local\Programs\NewLauncher\NewLauncher.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\NewLauncher" --field-trial-handle=2108,i,17766923347578060977,9188322908642549415,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2104 /prefetch:3
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:5016
- C:\Users\Admin\AppData\Local\Programs\NewLauncher\NewLauncher.exe
  "C:\Users\Admin\AppData\Local\Programs\NewLauncher\NewLauncher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\NewLauncher" --app-user-model-id=NewLauncher --app-path="C:\Users\Admin\AppData\Local\Programs\NewLauncher\resources\app.asar" --no-sandbox --no-zygote --node-integration-in-worker --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=2384,i,17766923347578060977,9188322908642549415,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2380 /prefetch:1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2472
- C:\Users\Admin\AppData\Local\newlauncher-updater\pending\NewLauncher-1.6.19-windows-x64.exe
  C:\Users\Admin\AppData\Local\newlauncher-updater\pending\NewLauncher-1.6.19-windows-x64.exe --updated /S --force-run
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5560
- - C:\Users\Admin\AppData\Local\Temp\nsr4686.tmp\old-uninstaller.exe
    "C:\Users\Admin\AppData\Local\Temp\nsr4686.tmp\old-uninstaller.exe" /S /KEEP_APP_DATA /currentuser --keep-shortcuts --updated _?=C:\Users\Admin\AppData\Local\Programs\NewLauncher
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:1204

C:\Users\Admin\AppData\Local\Programs\NewLauncher\NewLauncher.exe
"C:\Users\Admin\AppData\Local\Programs\NewLauncher\NewLauncher.exe" --updated
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Users\Admin\AppData\Local\Programs\NewLauncher\NewLauncher.exe
  "C:\Users\Admin\AppData\Local\Programs\NewLauncher\NewLauncher.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\NewLauncher" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1764,i,6466781363793873258,1939962262147552832,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1756 /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:5632
- C:\Users\Admin\AppData\Local\Programs\NewLauncher\NewLauncher.exe
  "C:\Users\Admin\AppData\Local\Programs\NewLauncher\NewLauncher.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\NewLauncher" --field-trial-handle=2232,i,6466781363793873258,1939962262147552832,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:3
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:312
- C:\Users\Admin\AppData\Local\Programs\NewLauncher\NewLauncher.exe
  "C:\Users\Admin\AppData\Local\Programs\NewLauncher\NewLauncher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\NewLauncher" --app-user-model-id=NewLauncher --app-path="C:\Users\Admin\AppData\Local\Programs\NewLauncher\resources\app.asar" --no-sandbox --no-zygote --node-integration-in-worker --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=2424,i,6466781363793873258,1939962262147552832,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2420 /prefetch:1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1212

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=4792,i,13540518249905691238,2783204355644180518,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5044 /prefetch:8
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Programs\NewLauncher\Uninstall NewLauncher.exe

Filesize
182KB

MD5
fdedada1ad50f603f75da305db9f257d

SHA1
f621a412ad982ae3944e0d0d82944f1a50a62141

SHA256
51f2fa3659bfd0dcfe71d0254542e6c3e918bb6be572b07f44d5dbac6fbccef9

SHA512
47cfddd50637cbcf22027296a8ff5768c26c47b70785bb685cfaee5cbf599aa39ddc4b1ebccc73cad0d5b01861b229571aafd510a65f56fcd22c06aa74f25f1e

Download Submit
C:\Users\Admin\AppData\Local\Programs\NewLauncher\Uninstall NewLauncher.exe

Filesize
182KB

MD5
8d75e8fddd1392a1c62cc73431d6399b

SHA1
ee0e765057e4bf62576e844bf594768bcaafadc9

SHA256
4512a67343cf23ee36a154614d72bc93df8ee658cd9018ad569fb4afa1f7b350

SHA512
40903c81f635dd7cd8f014ed5a829a068c3c143667cffdaf662e1889cf8ff336fe7b4cdee08f33c55563d93a80aa49f2ad646ca944efe8df432ab78b8afc8632

Download Submit
C:\Users\Admin\AppData\Local\Programs\NewLauncher\chrome_100_percent.pak

Filesize
146KB

MD5
6c2827fe702f454c8452a72ea0faf53c

SHA1
881f297efcbabfa52dd4cfe5bd2433a5568cc564

SHA256
2fb9826a1b43c84c08f26c4b4556c6520f8f5eef8ab1c83011031eb2d83d6663

SHA512
5619ad3fca8ea51b24ea759f42685c8dc7769dd3b8774d8be1917e0a25fa17e8a544f6882617b4faa63c6c4f29844b515d07db965c8ea50d5d491cdda7281fc5

Download Submit
C:\Users\Admin\AppData\Local\Programs\NewLauncher\image_cache\0241a9307cf94fb3674635b222db87d4f0f6385b

Filesize
158KB

MD5
0508fec44e930eac596a5338b5c6240b

SHA1
a1993a0222bb93744c18b7f95fde170cc36e3bd1

SHA256
db7d037c98b435f4001027ad6946f1a26a7695a6e2dcab2fa07c0c887c18efc3

SHA512
4e2fe844e72d154b844a5fae89c13e70ca820a65d3bed7633ac87f6b139dff0ad3885bbf609bafd0c87575dc75c335754ff6f1d8f4ad8e075b231ad834321c8f

Download Submit
C:\Users\Admin\AppData\Local\Programs\NewLauncher\image_cache\0f3e4105df1a93e3f9f2b5acc2814cec5fc34da7

Filesize
230KB

MD5
09f5b658ef9826f1f5a1ecec50780414

SHA1
4ed9c0c692bb62c704b092666e41524dde785533

SHA256
beba5d659e34c3ae31201b5b625b39bd31b38eb5abc0e52a457eee7fbabc36f4

SHA512
a865ef717de5239355daa7ce702cc6f75ed3ed32b325c408ab85ffde347caf880df877bf5c90c3aa6dd8e61f33d52d3f8de3cb6676a0a121ad05a4d68d012a84

Download Submit
C:\Users\Admin\AppData\Local\Programs\NewLauncher\image_cache\1f84c4f9e702ba84006a9192ec7c7a7fb326b491

Filesize
1.4MB

MD5
bde6f0c235f7c492113ee9dd9f1b9523

SHA1
5a9dc7a4b0046ae56a4b6183bf96b8024b5e92ff

SHA256
9dec774408909e7ed904140b6ed2bdc3b33109c17c072284f29d552de4a61217

SHA512
736d786769df10dfd22e843ffe74a86a88539e2706773a834ff04002595dcb5497397bd19fadfe7ac92ac4b257a5228d4ddce10680ea24cfcbb69deddddc9a81

Download Submit
C:\Users\Admin\AppData\Local\Programs\NewLauncher\image_cache\22919adab24f50242bef7a4f1fb78f5cfd897406

Filesize
97KB

MD5
f2e9faaddd982108ecad2f26a8121736

SHA1
bfdae8ad7aefa01e5610ec41b924eae51d9d8b19

SHA256
ab38f985ec2f787c712478f91cb238b3a27190cba1c88b9e80623b0d709526ae

SHA512
9fbc87328c1ec0b4c4edaf988bc2db69b991a481c44905f0bd7c604e42ca98e487bafd191772ed09389add04273d271caf1504d5f844d2f836676dfbe016d65a

Download Submit
C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe

Filesize
2.6MB

MD5
ad019806ebf343b37932ff8d83ffdf81

SHA1
e8ec5ec4ac030c61daaadfb8e3e040a10315e6f7

SHA256
362e68637f7e3be96e5a360e9cef586edd90ae74bd91a6517e0e20d15db4df27

SHA512
4a73e9f5c788b1971b7f83aa4b197aa6d1c5ce627dfd19c4c42260a9e9acd42f0eb2205a8c671d6bfd6536a028a35769190cd6579f458c6451d26e9737f949f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoDD41.tmp\7z-out\LICENSE.electron.txt

Filesize
1KB

MD5
4d42118d35941e0f664dddbd83f633c5

SHA1
2b21ec5f20fe961d15f2b58efb1368e66d202e5c

SHA256
5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d

SHA512
3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoDD41.tmp\7z-out\LICENSES.chromium.html

Filesize
9.8MB

MD5
0ff177fbf2a3873dd573077840e0b8f5

SHA1
03d06bc7cd894399a5fc6600a0210f6e3226f92a

SHA256
c4771c9158e31855293ee565db76c9b2c52f84c8a37eda4700cfb149a17fd7eb

SHA512
3264becd3103c905ab7f9cc034320885f18cbecaa45f582a4a9567ca4bcd620d64dc59fb03532964e775c35f07928a4497f5529cf1b9dc18379e4e9cff02ff8a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoDD41.tmp\7z-out\chrome_200_percent.pak

Filesize
220KB

MD5
77088f98a0f7ea522795baec5c930d03

SHA1
9b272f152e19c478fcbd7eacf7356c3d601350ed

SHA256
83d9243037b2f7e62d0fdfce19ca72e488c18e9691961e2d191e84fb3f2f7a5d

SHA512
5b19115422d3133e81f17eedbacee4c8e140970120419d6bbfe0e99cf5528d513eea6583548fa8a6259b260d73fab77758ad95137b61fe9056101dd5772e8f4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoDD41.tmp\7z-out\d3dcompiler_47.dll

Filesize
4.7MB

MD5
a7b7470c347f84365ffe1b2072b4f95c

SHA1
57a96f6fb326ba65b7f7016242132b3f9464c7a3

SHA256
af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a

SHA512
83391a219631f750499fd9642d59ec80fb377c378997b302d10762e83325551bb97c1086b181fff0521b1ca933e518eab71a44a3578a23691f215ebb1dce463d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoDD41.tmp\7z-out\ffmpeg.dll

Filesize
2.6MB

MD5
4be348449b9bcc9283d01a816202d3a7

SHA1
bacc9d93307ce382f800c4df693b24c9d00504af

SHA256
12febd3193d4e9b2fc5cc4839f468cd758f01aa358a04186c08f073b860d790c

SHA512
f567805ec2905d15bf3afc908478bc6243b3df2f118453a81362b10fdf4ed699e1d5d05687116c95698588d942a14d18f69ac1cda4a45cd2a09266c7b53176e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoDD41.tmp\7z-out\icudtl.dat

Filesize
10.2MB

MD5
74bded81ce10a426df54da39cfa132ff

SHA1
eb26bcc7d24be42bd8cfbded53bd62d605989bbf

SHA256
7bf96c193befbf23514401f8f6568076450ade52dd1595b85e4dfcf3de5f6fb9

SHA512
bd7b7b52d31803b2d4b1fd8cb76481931ed8abb98d779b893d3965231177bdd33386461e1a820b384712013904da094e3cd15ee24a679ddc766132677a8be54a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoDD41.tmp\7z-out\libEGL.dll

Filesize
469KB

MD5
9a13227a19d53f979ba43abefd64902e

SHA1
8432ea0550e72037dca3bc082f279e2178ba5154

SHA256
06bedf39f0f3369bbb0d97139cb0c899e7e0c040ffecd5f14d4e3383daa83005

SHA512
cf25b50132d820f6880f4dfeea2943d1d46b3dcab62529b0d13f8240b06400d30a8435eef6caa844e25ff5732469fa08c78723cc881d025bb0c3dc0d4f58a01e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoDD41.tmp\7z-out\libGLESv2.dll

Filesize
7.6MB

MD5
f9dbec54c402358bc32335d276c61a11

SHA1
915d3d2c3e34613b92c659d06616aae7fc92b0b2

SHA256
3621053e97fe245f77faab032ead47295219e17731f6114d6bc8109b756a8012

SHA512
5b0cb208bb9758af6b03b3becc765c9cea7325d333cfc957f3902be4547a8fdbcf40fba1911efe8e728020d83edceb4e40c6da7df9ea746f4c458e6cd3aa83f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoDD41.tmp\7z-out\locales\af.pak

Filesize
481KB

MD5
94af96b7f60a4cfb9d596cd8927ba37d

SHA1
556833517bc6ad77b5427000f2c3dccad91b92e6

SHA256
716e296c2f663ad90cdde85c5134582fc2305e5ebe10649fc9653bea533500a6

SHA512
6605688a373a358ff1dfbeda1c09dd031e4a63de662555f5304843c31eb3afcedbc8ffa4dae8ddc1483b04ea24cb709ecc639a9902caa68731d8e44d04cdbd83

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoDD41.tmp\7z-out\locales\am.pak

Filesize
782KB

MD5
34b24f035bad74764b7cc57420488180

SHA1
fac3fdba1a94d7676ac4d71447178cfbd1fa4e82

SHA256
9cff5c4af5997b45fb2a384bd73560e56bcb7710149e1a7e3e172d64e6eda025

SHA512
a01da4c45c6295a57248603f01a6b6231c4ce400aa3ec94e4228b26e8cea995c31d52b2008f99d0f17482aad80f1d67725c32e0f37cad6b012b1022ecde998f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoDD41.tmp\7z-out\locales\ar.pak

Filesize
855KB

MD5
38b30dfa8ccd369c747c46bef204e2f2

SHA1
047976a9b0aad536cc61ac3dfbc37b20f39ecbf4

SHA256
516584da5741e7bb49ba6a70c9cf2ac47ff190ca9c4f692c3a30bc03a4560f50

SHA512
5396af2e915808abb6f0ff8c4a1c3a7675e620687d717193d5e69905a070accce08925b7e243b54b922e1b022fd6210884fd12b18681e1b7d08f28c542cc4c3c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoDD41.tmp\7z-out\locales\bg.pak

Filesize
892KB

MD5
d08e8e493f0b3c8ab19070ab05a78af8

SHA1
c5fa430269dc2d32baa6885de2453fa84c36f2fc

SHA256
d223e994ad1aa6e747507187f724cdede8c369d2e8e0def50c4a6c912dba3880

SHA512
4b415fa2ae6ba399674f90ea67e571d90a35fff1ce93df77f20bf692b52c92bfc41e5a3622776e3979b1662fecd2d9665209d5d1d53ece1bff3ed01a28e499d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoDD41.tmp\7z-out\locales\bn.pak

Filesize
1.1MB

MD5
696016f43190747d63befa354d76e50b

SHA1
3399e641930b820b627a4e28dea0a79fc457f929

SHA256
1e49980f89360b395a70e844ccd0c43b3a34eab84461b1499e7621f757149e3e

SHA512
3966fcc5988ceeb4dca79c0053fb428e5180029d44704faa4723334c69413a6eacf622e637857c1dcc096e129dd84e2369e4595ea50316cf8eb68696611a8430

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoDD41.tmp\7z-out\locales\ca.pak

Filesize
542KB

MD5
1ef1e76e7028cf6e0b1f93b3218feddd

SHA1
20c76258573d7499889147b5532a919a827f6de7

SHA256
7e8b5bd0a7a9835f20130ed17fb68242d7eb277cfaa2be6407f08c8d0dfcd500

SHA512
7e1a7e8cc5e5a2d32192dd38005553961037501a3b000210d92a8796cf65e025c60674d206bd9ca6a9dea5007ae322b2f87b233046d5dc1b838ad3e5b5ad91bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoDD41.tmp\7z-out\locales\cs.pak

Filesize
558KB

MD5
c942efb2a8c25205b66a056028a8bda7

SHA1
30b74bd9398e330ce5e4f4d3eb343a4e67ee0a41

SHA256
21916011c2668389727c8970e1407b9c0806812effab9552106da963951d9f27

SHA512
319fbdb304912b5628c0e5330416f000c6e0090e26a60ed8005a66aa5ba698892415ed3dd0e4f4ff8afce7986566d8557b76eed15e493f01f889b7a664180cf6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoDD41.tmp\7z-out\locales\da.pak

Filesize
505KB

MD5
4345285a4690b023767e352aa2a587f3

SHA1
9646a3a5662f2bf233e553e51e7cddf6212f8fd9

SHA256
10dfa841d08a3ab094f83e151fdc1edbd66bf8f2392f1511e325628e4e9c7a0d

SHA512
2d466e285b44eb0c30f1847015c0056a517dc1dddd4d49c907f070eef5f071d81286cb0834c2a30253d8da9eebb6c6f34271f49850e9bc0cfa7dab0eebdad52e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoDD41.tmp\7z-out\locales\de.pak

Filesize
539KB

MD5
be9b3438f622428f971c92cd84681750

SHA1
80278ec6889973ba0fa47e542fb3e85ee52a3534

SHA256
400f965d457e958b063e60131d88eaacd74fdb6213ae14cf84c4b6b45809e04d

SHA512
8ec4388dd11829324f72b2828a4282cad5205488d4d47d90da83e25fd9f4b43d1aca1d67f9470a93fb0a23b21094b4c17dc68247fb285317dfd2b01f8e312cac

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoDD41.tmp\7z-out\locales\el.pak

Filesize
979KB

MD5
271c3234e3a07223e6db8f6ab1c18f92

SHA1
dbc1ecc686eda75627f3fa60d034ea4021da0acf

SHA256
58ca76aa55e11a475c830ac89010d4431f455f531079c1e8a0943490b4dd8e4b

SHA512
50e6fab168889a283e26eacd7731367032db41841f39fef0f99543b98266c3784ee62a956cd4415c83a6fb7451b3f618f4f3dcf9807cf9b0f2f595ce26e24aac

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoDD41.tmp\7z-out\locales\en-GB.pak

Filesize
439KB

MD5
b98c06126d26961d99a7ee6e397afc94

SHA1
bb5249dda1029597c461564798b77efc1fc0d402

SHA256
a672387f6fb84ade1b0c44c456ff1a19dcd464c4a9e65e439ca95a115455340f

SHA512
ad3783d03e3e7bb343eac48f179a3e3f799146a8ba7b25e2a02e860c53738b01518dbf5e66097366f0b7202e6c02dc046c6b51c116115cffc02aca3ed962951a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoDD41.tmp\7z-out\locales\en-US.pak

Filesize
443KB

MD5
88bbc725e7eedf18ef1e54e98f86f696

SHA1
831d6402443fc366758f478e55647a9baa0aa42f

SHA256
95fd54494d992d46e72dad420ceee86e170527b94d77bfaaa2bfc01f83902795

SHA512
92a5c6cfc2d88272bb5144e7ee5c48337f2c42083bc9777506b738e3bcb8f5a2c34af00c4ccc63b24fb158c79f69e7205b398c9e22634dae554410450978a2c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoDD41.tmp\7z-out\locales\es-419.pak

Filesize
534KB

MD5
aa187b593ff0784db94718e4bb7aad2d

SHA1
fd0a95dcfb08cc6e85a4b61e13e2be705f7cac8a

SHA256
dba56ab390a959dc40cb79db195e4ed6b17d4009235063f738b9ebcf41c4b5cf

SHA512
66f38fd0c6c6c2f87d00a46c41df57e82c11f260a1cf247e95182628b62f143a6707034f77577348f46a21d633966ff96e5a568cc9da587ae6bda77715c3fd1e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoDD41.tmp\7z-out\locales\es.pak

Filesize
534KB

MD5
fe679a1a0332b0f36183421a0a41a478

SHA1
7230d8646db57466b07a0d700db35838e5030481

SHA256
ea54cbe126cdd85b2799ad9600b86ca98c994e69251344163037139296ecea7c

SHA512
8b5da5c0e2c55a2dc849050a7d092c78d4bf4975c885ce69d360a0245b1f40bcc9c4cc6eac67d83a6e98f77eb84e1401fc025ccba058be94e962e6f6627c37fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoDD41.tmp\7z-out\locales\et.pak

Filesize
485KB

MD5
818d154524c0c900d15a8a25b3659c14

SHA1
4121be86ee3869c3c884e3467d82ca6b8f4ae0cc

SHA256
3610615dcac844cc9a64b843da606f4f8d29b1c945ecc19b288b54829d0e92e4

SHA512
1bffdc771102997bc16b3b5fb01ba009a61a85e7d9c53f32a2b2e713ff70f396a9be9431cc45ebdd28dc5eda43490b8d8d82866b42acd32f49e6368ec0b779ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoDD41.tmp\7z-out\locales\fa.pak

Filesize
794KB

MD5
08fcd4a7e857c8b42e61152e437566e8

SHA1
018c041227f307fdef2fc38b42a598b73992667f

SHA256
34d79e8a7fa478bf3b350412160a59249e87d31932d728f0167cee89aeff2bad

SHA512
8405365949f31aeedfea0ecc7634abc81147b0dc163ee432f294926acfed3a71af469e2f4427dfed2877bee5fd38f5ffda6793d564f11c8ed4a6e64a78529d35

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoDD41.tmp\7z-out\locales\fi.pak

Filesize
495KB

MD5
32391a1b0d1bf56bca591971974e8fb7

SHA1
b578f82db8f42d9bae763320abf7c8bec886ca07

SHA256
01f9669cd2fa17965f882e2cd81c39fa2face2f13ba4f024c3799f1841111ffc

SHA512
06e066ab26ceb75d157b35bd283a55f40e2d15698c3f1b62c6596586975e09f5f3fee7d765b10a667b98b347d92883124bbb0f436edf7addea77871542f44bf1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoDD41.tmp\7z-out\locales\fil.pak

Filesize
559KB

MD5
4990033756bc1b2410e77a607bb62f8c

SHA1
a02c0f347606bf50aa6f281e42d2d66ce6155299

SHA256
3265ae5b6c16a09b1ec9ea53181de78df75e951c3ce28f33d4c483088a9ab37b

SHA512
3d45c6dd30eea6d6929039c0cdaa7bb6f7b665fe67fc7a5ca79567d4fd3f907011857e5cb43c16cce9c558d4f669618bc5378f05fa583b19360df58b12b5f913

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoDD41.tmp\7z-out\locales\fr.pak

Filesize
577KB

MD5
1aea0f212cb96575b119da1f7b84633e

SHA1
3d540d9f7fccd4a5ab03824e3b4894aea6b7ea48

SHA256
8a283001240c59a552945d0466e3118dc125fbc9f1a10bdea4ca4197460102ba

SHA512
be10aadf5a127e7cd354cc2620e162e377e7263ae7c97ba1f026e9711cc8e9655d7a0bb2327ec1f09eb287f68ad4df9ecb133bc6d72adf9d8a5cd6929fec51f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoDD41.tmp\7z-out\locales\gu.pak

Filesize
1.1MB

MD5
86b829b3cdcf383f11ffa787a32446a0

SHA1
c9f626a97bcf00541876caa7a49d23e0b84b83ef

SHA256
74c62dca0b7a310aa593d1dcca8b0b0b382b052837e7cae6b87cf05b8b346b1b

SHA512
72b69cc9846fb078a8c03afd60154a3b55bc828b9e13b5124a473c0ee528e3cb3ed67f67d7d763ec8e78883640c53d4c88a7a14552b851d493abf65e269353f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoDD41.tmp\7z-out\locales\he.pak

Filesize
696KB

MD5
8cac9a900616961967ba5d0c9b3317d4

SHA1
2fd04055155222a1b220238edb3a20a908e7947f

SHA256
25281efad59a66f310cabb92da67198451567da553f2c437e52388e8fd25b9a9

SHA512
337deee8affc46670d3263ca17c2f8b7aef8450010d4ff2eb39a4bf66e2c6f639643639b2e576961e24a7fc772f331d9ef23085f557e605cd499f6992000c0da

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoDD41.tmp\7z-out\locales\hi.pak

Filesize
1.2MB

MD5
3ddd4ae85a39fe6675365404dca77bf5

SHA1
2a3c2fc24612938edd46738f127098496262125b

SHA256
4b5585a8cc1a21e2dfcbd0d33f6cea87b7a583b8690f0f3635bd74bb5cbd2ed0

SHA512
fbbf103af336eceba0855f341c9e424bcb09c0527a63ce6ceb4773ddc228fdd5996b2b3bfbc2d11c77d82d012f9f4650317044cfbe50fa5adc0acb71c26e7da9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoDD41.tmp\7z-out\locales\hr.pak

Filesize
538KB

MD5
427d00ead5500f7480cd6ef8de88b0cb

SHA1
4f271a9009201f00959a3eab337130ca9fad7557

SHA256
d1f8093b91663d061bc2fa20426e2c430d53b06fc605ac1b0b2279d446dc9317

SHA512
93190a72013d7fe155404585080c12b64f57948e829888a75d60284ea93cf59b6771956eb325b00eac484c7b424f8b8a1d5d293d90b221b7440ecc63c2899faf

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoDD41.tmp\7z-out\locales\hu.pak

Filesize
581KB

MD5
92995b10868e466811b909c9702f1727

SHA1
6cd34086b876bf07dc1222cbd33e8fac60e401ae

SHA256
0a62d168c0f6d9d651dedb4e01be5b533b94e8617535cd70ad22717748fbbc64

SHA512
412d0f253d31eff5819fc05ed0da6284a39cd5dbc3f8dac81153511c69aef9cd3f1170d3c6a74616e3d9c51bc457045e9715456b1ef50e139f68f667d5662f53

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoDD41.tmp\7z-out\locales\id.pak

Filesize
478KB

MD5
fb42de6be21c78da1b05c518c5625882

SHA1
7d8d4e28ea196e3e48df4999d94a04c0be31de16

SHA256
d9fc19e683240404a60d57037f24e1d8b20cfda4c8bcacfed577b86cd8988517

SHA512
63885e8c82dbef4902c75ae7bc4c3f953057236b07d6919bf3a9f8d1e6ec0ae2cb94cbe0366e56e1272653087faf2fb07b92b18bd312e8e1b38fc76ff5eb3922

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoDD41.tmp\7z-out\locales\it.pak

Filesize
527KB

MD5
d7c45df7f6d29d9a2775f531817b2fad

SHA1
f8a11fc014007e7ce2fd0ff137df117146a48a5d

SHA256
f38e6b6d975f8148f46dbeda89563cf71bf07af98e9b79c1a8d158b5f8f1309f

SHA512
c09b0f026077eb1f0be2206aabfc4bcf201fb2d8c6bb9072f27b7b95ab7fec18a837ecfcdefee2256b2508326e577e6e098572c4d3b0bba4852a79585d4bd522

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoDD41.tmp\7z-out\locales\ja.pak

Filesize
644KB

MD5
ace3fef3bcb086a6caafbdfc9562ecee

SHA1
ac86efa1b8fe88f050a8936926b96b055485a8b9

SHA256
6df72da472ee171acc440c20a2a194a2a4af4839b6a88323c4654c50ff8b492b

SHA512
da5425b10b239ce941733781b6994581d37c8b683946b97d759c2915e96808e18ba967849354687b2ba5ba492387b740dc8e6e67badccbd1a812e349693eb9ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoDD41.tmp\7z-out\locales\kn.pak

Filesize
1.3MB

MD5
a48fa9762b3504adc3fe4ec828c75149

SHA1
043f6ced7e30cee906eb15dcdd3ae59b9574fb1a

SHA256
333725ea1045d44acf2c19efc765bffc38cc5cea6e9977fe583ad6e203442582

SHA512
40d983b3df4b6cd8e3df855f4062e163bdbdd5142882088e6e8d5ca30bc538af44044f61803d33e94f4527cceafc44059c5de67c847567190767d3246bb93396

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoDD41.tmp\7z-out\locales\ko.pak

Filesize
544KB

MD5
c524ce72c7049c1c401d8685772e8d74

SHA1
56d28e03538e2fca873ac453ef2698fabda75a4a

SHA256
3ad0012db772293073acb05d24b8dfb26697d6cc5dd1612150df023dbc31b674

SHA512
ab764fa9b9f82c7146e1b108a2af792c35cba91b0e3be9accba48bac87a13612a61ec026705b77f006519d65a6415a5978139898239093b249ff583af0dc6aa3

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoDD41.tmp\7z-out\locales\lt.pak

Filesize
583KB

MD5
1bab0f6c08b1cb26db455aaf581490dc

SHA1
3a32246b812e8ed35ddf0a6842b8bf26b19be9d3

SHA256
946351ed2d74f247dea0f2742fc36d89225355480f0cec99d71599ccce3ea9e1

SHA512
c6e4502fda62e2606e31a7c67679d59d21a04342c507e1fa39ac59156a4d1e1cab1923de4bcf30b735d5bcf89824d4283b57db11af9673b5b956c2f883a3bc7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoDD41.tmp\7z-out\locales\lv.pak

Filesize
582KB

MD5
e4993f39d6fa671658aa3ce037aec60d

SHA1
2db9bfc42b07060f6e256c74a01c348cd6c2ac0a

SHA256
1e6f9a40f4fa1206117063234399bd7c1e7d198cbf6c4ad633e5e18ad0929836

SHA512
4192274330be238a93e370fc3fc8ada444b38fa1464889f0e3d0f6c5e548f7f7de14248937d45f8aa84c043078a69174ac1c9a5894fc9b4ff8f10deef6f77e5e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoDD41.tmp\7z-out\locales\ml.pak

Filesize
1.3MB

MD5
9f0422326953a0c48c1db82ca2a9d639

SHA1
2305bc895e9ccc5b9a3d661e891c4f06d8a503ff

SHA256
f2fb440eb0518dc695810fcb854b20b72aa47e5ffc75c803aacf05861d35a94f

SHA512
a899dd975a56a53503b5cbc7448f54423b18bfbd917f73f0871840d6cf6a574bbaac8d735ae8de6a074cd78c43b6640e3e46be1550dcef8f8cfd1971cc1513d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoDD41.tmp\7z-out\locales\mr.pak

Filesize
1.1MB

MD5
b0e1f36587445f28f22777d555683a0f

SHA1
42f7cd3c596c2f52662b86df9d9096bf822a80f3

SHA256
a674db4e60152fc17a32d4b92add129adaebfc02a1a783a12653f984447c535e

SHA512
575fdea827497ceab51df5fc8783f960b87d180f6031f0947525279d224189a6299943df37a014f7bcefc637ee23327fb1ae82eb77c175d63c515b29947ac0d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoDD41.tmp\7z-out\locales\ms.pak

Filesize
502KB

MD5
c8d605a91b2b66603b379f5557783afe

SHA1
d6f294eb91675182f658158ff9399592935c779a

SHA256
7707f79a2a4aec553e68af87802a0f19d3714a25311fb7b8afdc6ff4a5b6c5ff

SHA512
a9f100dc1fe0a19a0a0a4360fff392af4e07eaed6613ab6dc61548d36afe55e4c9183e6584ca4e15feb477947ee8a79a96775718197129a555319a162281b9c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoDD41.tmp\7z-out\locales\nb.pak

Filesize
487KB

MD5
4914ceee005991ad76c7cd75ed8bb645

SHA1
61d2732f5d5a20467d7f667b54ab654849d23289

SHA256
53b12866e7265661c0088b89653d2c1cb9220e1ec0ce0049f3095d53356b3f1c

SHA512
fdb51c9239eb894bc807d56a6afeaa06cabdbaa25cedf3d0b3763c6670321ef7087a35258737c0627b450932aceb7b6859224735bcf53b4b12f6f531fb066f99

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoDD41.tmp\7z-out\locales\nl.pak

Filesize
503KB

MD5
ed94cd5fe4846c197ebcdc3fb3dec939

SHA1
3239425517ebc508a449f3998036c21370685e32

SHA256
4736b7ec56cb845c14795e6e4fa98ddaba47c75aecec86e931f61222dff45ad9

SHA512
0f0a79ae99e8f74aab18c3673e640d4ea5f24d8b88a3ba63ea262da77ee3fe630296a818337c7b36b6603365f43c6f60720336fab9f594eb755f9c7efcdb8fe7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoDD41.tmp\7z-out\locales\pl.pak

Filesize
560KB

MD5
12c3e7597522f09e87ff438ff2cf5c23

SHA1
e634c8bcd7d5f77fdb227f7428c146cac3e87b81

SHA256
2191f77aabe75522166a3325e2660395479633b936d5173d150120367ed501a4

SHA512
fd58c466458496316c659dea6afcd8dd8269b312c56a506d65db4bbcbd28d37edd137947f3c78e783cd1b3fbe9014480f3c625dc707ec4c27a63115ff8d877b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoDD41.tmp\7z-out\locales\pt-BR.pak

Filesize
527KB

MD5
576c1c0bbac545348532ffe36bf27fc1

SHA1
55c614f9d31c5e6466080afdaca79b6daf8ab10a

SHA256
1deee32edff320827dbfbe22aa42e83d8caf79f95f7cf18013424da7cdadb975

SHA512
11caaa048778e258fdf2af5b442eaeadf3412921d2e50065b7217de2277980a5fde086b7d6749cb918090daf4feaeb5e89ad7876ded2fba9f62d9e809593ccda

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoDD41.tmp\7z-out\locales\pt-PT.pak

Filesize
530KB

MD5
e4565bfa531c9c4344f84dc8be207c93

SHA1
5d1084ad5bff80383129850a853fe1319c23199f

SHA256
fcd194e5caf36be4958c559acbde4f28a957083bf2aceac893f9e5c9e65d8a95

SHA512
531a318e8ef1683abe4bc7b44e7d3a4d6ef907d5e7ddfa1f5cea20414dd33060981afdb8d1f4813b05be90985f10fb892f9060f6c1f2b975984f12acc8cdce6a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoDD41.tmp\7z-out\locales\ro.pak

Filesize
549KB

MD5
8c922129bfb61fe14fa035d965108823

SHA1
aa8d8dac978053163a303c1f1206480144d4b330

SHA256
06c6486e8a42b447a55bd789bf2bc794354fa4be062139481e4612550f16c755

SHA512
25f9c2b75febfe607cbdd872a82338aecb5f277ed2d3d80fe0ec01289e3361445102392ea23207658ac347a774a7f47bbe19672d49f080cd6aea220da5ac3618

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoDD41.tmp\7z-out\locales\ru.pak

Filesize
902KB

MD5
dbd513d5ff195a0068677ba4aa417648

SHA1
9d6304911c1bfd9449a661baab44518f17ba64a3

SHA256
6e53b1b54bac43c07798ee6507bd05806fbd2146ac0f987a7f03aae3cf5d9985

SHA512
58b903eab4e0c769245c56f1d92dc020690b617d30495e8b436e0e052978c23d38219ad6a89493c116443e8ec4556f59de782326e567088d866751415abde40e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoDD41.tmp\7z-out\locales\sk.pak

Filesize
566KB

MD5
b74b01d80d6edcf13ba6514dcb1bf3f7

SHA1
405ddedaa9e3c9f3b5ddfeae6f440085c155a6f8

SHA256
7a1db23a5b4f8e4c7cbc80a832f4f4c33fe29e31d4ae78a814bd8ca85620968f

SHA512
2f649b116eb297c7ee7248a35858506f5329094c14be2e6c2cf52bca42170c519ef0446773be096c1571d1cb4502a5a840c3c934710c4900c8cd8344e4e9bd1c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoDD41.tmp\7z-out\locales\sl.pak

Filesize
544KB

MD5
998585ed4b877e6cb29bef5ec5675004

SHA1
d82e9c2127062187a0ad3906579cdc491f6ecf04

SHA256
7235e631afff75cad9d25b2e5a0e74696ea6b7f4b2a05753331bbd719a0699cb

SHA512
b0d4ad73c4e1aaddd156cd115dbadcda692e314e6f5629e26aa13144e2bac5fdb432db345b68eb79f732e6e102674ebf8cb90c06570ea4d49e4045fbd8cedba4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoDD41.tmp\7z-out\locales\sr.pak

Filesize
839KB

MD5
044954b860180caff2b57af02aa4e1ec

SHA1
c006f910386d7a11c9d074586c60b629131caf0b

SHA256
35e57d972a60e161f123a5783e67e250f5cae1f66a2c11b119c10b81c43bd03f

SHA512
33d8a0fb6c76364b756eb199f629f930d419ea31f631b8e6935b2efdefeca7f755a87bc3ec5422f9ca9f00da7ed5564fd90e228b0f1e9951a82cd1a4deb9b2b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoDD41.tmp\7z-out\locales\sv.pak

Filesize
489KB

MD5
d5925395fb791adebe0d06ce055ce976

SHA1
73163c7420f6a70ac7fcb52bb8cd97f4828a3ded

SHA256
bcd070d70a4284fd3144bf37c5e56994ca3a69c8f65aa72a9231748b30210e00

SHA512
6e0bf0f4d488eaf388431f05effced112e597be52b9c8f199c88ebb6e7e6a28d06f9a180ba3a9e7bf9da5166570077ed895249af7806db74343a64bb598a4260

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoDD41.tmp\7z-out\locales\sw.pak

Filesize
515KB

MD5
0787972a076c6690e7938758c2a92e24

SHA1
dbf02e5a3ae26acb060b533bb006756c19122bfe

SHA256
eb96ab83e2e08e811928742590178e97454863bc581dd8574d6a644fd3c6615a

SHA512
9f3560a3b648b1a7025cd8a98c39ec7634883aade1ac2c7836fde890cc04bd009aa5c1bca8354ee1259ebcd9482326c51a7d21bdee3caf92984ecbefab35d34c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoDD41.tmp\7z-out\locales\ta.pak

Filesize
1.3MB

MD5
85403cab968fbdcbf7f92f3a4d49a4b4

SHA1
eacf6ecf2bef4ed5275ed237d3830754db9e1149

SHA256
e213c963248c93fcb4b88b1a45936dda28a5fe39cc0428a16556c6d737fc9940

SHA512
b49bcd260c38f302fa9fa83a2b17d2f7bf576bae14b64882ce9b38152141504a69fbb73d1f9ef8b47ae1a7a995a41e1127df3689c1e043e3b110cc35b73c0fb0

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoDD41.tmp\7z-out\locales\te.pak

Filesize
1.2MB

MD5
d251d089aa789bccc27a0b473d39e46c

SHA1
283d8fb6b6195b3427144773ffc4691c82e31f0e

SHA256
8dd7d206379445bd9afa4e01ab986c439cf70841d080fca6e152b453e94fcc49

SHA512
27e6f13f6c7937c8121451d70ee90d2a2ce5e519d17e882a86b29a6a78764427022c36b6a99178e9933e01500b55bcbfd0dc79a6f028a046967c2c53f78424fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoDD41.tmp\7z-out\locales\th.pak

Filesize
1.0MB

MD5
f30b74c4203bc2cdf830681b14651943

SHA1
47f541c0b5ca948dd371e657ac24f7e61b402ceb

SHA256
a4c2c305aa9d3df52d988c4da2bda398e8ee81d320e9da1de7d4d366e826dbc2

SHA512
a92ac611d43287060fafc66070d7b40d4d253d32cec9cfd01c15fd7892eabbc49c1ba63d03c39919bb2ba94e974f93c73f6e455263ce4e0080fc8161587f09c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoDD41.tmp\7z-out\locales\tr.pak

Filesize
527KB

MD5
a4520237e44d35110e003a26cac98052

SHA1
8e50c8f88200a417d2d792c67e52ca115340902a

SHA256
f842b56ddc4145e4474c5cfc67893900b577c131a4b123cb16cfcad48ed0f338

SHA512
b08e577ebe680383f9fb228162ab21e8aaa38abc3e5d0b95326cd579454571738845f4bd86ccd316643f45bf5b6b619dd3f77f67b68b056dde68ee1697029b03

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoDD41.tmp\7z-out\locales\uk.pak

Filesize
902KB

MD5
8f894b4972b41dc4c7b65847ba856ff1

SHA1
63ce84840a90485fd376908c39a4125dfd53fc2d

SHA256
5dd2fcc64ef09be0775c2efe7e07dddfc18f5ba6059f878d0c22b9b0c2207cdc

SHA512
77ecdfcfd31803f308da51e6b2bbd47b7c0848104925b642cbcf877c6ee228c5c7e9dc7746a208d0640455daeeb6dfcbe954d7268119b9c096588deab3c2b53f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoDD41.tmp\7z-out\locales\ur.pak

Filesize
790KB

MD5
7b5fed5150135b728bf8865246f7c8fc

SHA1
214b0f507ff6384b1b305f1718db43023499eeaa

SHA256
a0c752a805da7dd6608ad04625734f4d27cb75b682f51b2dc8ef08350cc7a2cc

SHA512
81fc55db4b0635e09057fd060d9eb72bda5a5fd2d2e1e4284e1b45098b287c609526c766b030dd0eaebc0836a32bcbf6dc0aae94327c103f3f736b5cd051a8a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoDD41.tmp\7z-out\locales\vi.pak

Filesize
624KB

MD5
d910fb70771f06c64f6a2d78ca25d340

SHA1
2b1ba5cf58c552984164e65e30cc05744d8ec419

SHA256
d7f676cf557d43db07b14a22b0b20ca761ced59285cadd75c07c68613486e909

SHA512
4e3626cd558cc75b8833308c816c45ca106203cc054e214a08ceccd3214aa296097153ad69635f584dbab9def2440ea2aed79c0e02464c164bbced572840f264

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoDD41.tmp\7z-out\locales\zh-CN.pak

Filesize
450KB

MD5
6617a2bfccc344c5dc0dfe03762d219d

SHA1
9f9d5059515af878d273a9b74f32ecddd4a93f83

SHA256
48e32f53d07cad6e6dc12040619f7021fa8f0b3254cc6945905b7c6748acb787

SHA512
9ad87e1f4b404cfaa80ba4bd617217bd638cdf7255da0c74d03b8b3123e2afe9f1077f27dda07e5dc71edf82d08c69ac20a415157b12519731e1ebd45fc3b5c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoDD41.tmp\7z-out\locales\zh-TW.pak

Filesize
445KB

MD5
197d88a99d2348c9539d388f4b825c4c

SHA1
7b634dcd2cd27b2f8592eacfe314cf23a37f316d

SHA256
a8b11c74a0512fed29b11748181ef4b1de84dc99197c48d9eecf316aceb425fa

SHA512
da7acb060d14f87743ed788df4e2c6ff3ca18a633e46f4d84c4619802edfc23b363f45cec8d2cb23c3e12bbaa547f6df1f5b60ce7ec7d770f689346b0e06a977

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoDD41.tmp\7z-out\resources.pak

Filesize
5.1MB

MD5
97770ebb513490dfb038bed3bc444128

SHA1
2e459ca458879ac8f427080764bb5d668a912235

SHA256
75e03df55d7d23c840c09288da270285f17d067cef8709252451c0a8aa1254f4

SHA512
7f41708f8f29f0a9730e461c7a5a6780824ec31dac6278abb2c42a50919c10e01ce00aa7e4cdef680d667c467bab4683df90d5db2c61aef8dfdf77c2eb3d8d24

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoDD41.tmp\7z-out\resources\app-update.yml

Filesize
92B

MD5
bdb13b611efbb4951b5ad4668ba84634

SHA1
4600b7281301496fd0bd1d15291cb96d5bb5e520

SHA256
63a2182ce940dc6b92e1f7591384c731200b59b7a20d51764a22dec88ad0e5d3

SHA512
8dd24ffcb9b49c187bb1ec948e0fad4df6d4a03bbdffd270d481303549a25d37b1cc56f46f5d35f15e0e44c26ab444a826e72c7a4baf80e8617530872e2481c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoDD41.tmp\7z-out\resources\elevate.exe

Filesize
105KB

MD5
792b92c8ad13c46f27c7ced0810694df

SHA1
d8d449b92de20a57df722df46435ba4553ecc802

SHA256
9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37

SHA512
6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoDD41.tmp\7z-out\snapshot_blob.bin

Filesize
300KB

MD5
0c13aba4e77dd56e5f7ec8f8fdd6c9a8

SHA1
e17eb5b549ac1389cf3761da7d2b2aede1c93fd9

SHA256
ca7012d6e1478bdd112c485844253e48ef43168c4267ba19be229f0ba2bd6994

SHA512
f7d49048af8f2dd58c4af0602bda888b948aeb0846f7f27dd7db873f4b185debf5edf3869f8e311e31865e2408aa93af4f0f67a4f1ca0554ff8a8f2fb9a1214a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoDD41.tmp\7z-out\v8_context_snapshot.bin

Filesize
641KB

MD5
228cb75c5b14fb790ec913a34c12b4d6

SHA1
aa6dbfb6cd403be3110f85c2a3ae72ab575645fb

SHA256
bb9c5a66316280c3d90ad63e20e34a7311972632bfd927f9d192407c13714444

SHA512
ab6b94de633b71a99b58f3924b0b8a351e0899ccff0fdab35e06938ad22ed62548a331b0b296a886f67941a642fd32d00ec2297b0d687139c0e57d2919739c19

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoDD41.tmp\7z-out\vk_swiftshader.dll

Filesize
5.1MB

MD5
eefa4c51a9ed3cf259a5ce20c3a8dd23

SHA1
16b8fb4f71df65f6ce8bed17ed8b5622bd9e8155

SHA256
23a307dc2d3848513827aae01b0dc51363f6c33e96a32860f6e397bb851b11a1

SHA512
7762f4bc0981f21048d0476e7875dbf43522eb786f0004c67bd6dfa00d70dd425687ca87dfb3a03ba80211fb25ba3acec24c5d101d8e2cb99f1dcb262b7cb12e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoDD41.tmp\7z-out\vk_swiftshader_icd.json

Filesize
106B

MD5
8642dd3a87e2de6e991fae08458e302b

SHA1
9c06735c31cec00600fd763a92f8112d085bd12a

SHA256
32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9

SHA512
f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoDD41.tmp\7z-out\vulkan-1.dll

Filesize
935KB

MD5
57c1f36ece26d225f8bbf67abb5182db

SHA1
1b884a41c02c4cfc7f9dd74a9b31cc988ceace1b

SHA256
70c45cd778bacd5865fe20b478b2c259fc8651e41939216689c5f6fdc38bf8b2

SHA512
3b1e3ac0ab5563d001b8d72c53383a02bc20da1875deb1f5dbbeaccc4c4aa2392a1f768b13401d912ce91dfee2820886baf792a83c3343657a5b533436f4ee8b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoDD41.tmp\StdUtils.dll

Filesize
100KB

MD5
c6a6e03f77c313b267498515488c5740

SHA1
3d49fc2784b9450962ed6b82b46e9c3c957d7c15

SHA256
b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e

SHA512
9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoDD41.tmp\System.dll

Filesize
12KB

MD5
0d7ad4f45dc6f5aa87f606d0331c6901

SHA1
48df0911f0484cbe2a8cdd5362140b63c41ee457

SHA256
3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

SHA512
c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoDD41.tmp\UAC.dll

Filesize
14KB

MD5
adb29e6b186daa765dc750128649b63d

SHA1
160cbdc4cb0ac2c142d361df138c537aa7e708c9

SHA256
2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08

SHA512
b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoDD41.tmp\WinShell.dll

Filesize
3KB

MD5
1cc7c37b7e0c8cd8bf04b6cc283e1e56

SHA1
0b9519763be6625bd5abce175dcc59c96d100d4c

SHA256
9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6

SHA512
7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoDD41.tmp\nsDialogs.dll

Filesize
9KB

MD5
466179e1c8ee8a1ff5e4427dbb6c4a01

SHA1
eb607467009074278e4bd50c7eab400e95ae48f7

SHA256
1e40211af65923c2f4fd02ce021458a7745d28e2f383835e3015e96575632172

SHA512
7508a29c722d45297bfb090c8eb49bd1560ef7d4b35413f16a8aed62d3b1030a93d001a09de98c2b9fea9acf062dc99a7278786f4ece222e7436b261d14ca817

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoDD41.tmp\nsExec.dll

Filesize
6KB

MD5
ec0504e6b8a11d5aad43b296beeb84b2

SHA1
91b5ce085130c8c7194d66b2439ec9e1c206497c

SHA256
5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962

SHA512
3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoDD41.tmp\nsis7z.dll

Filesize
424KB

MD5
80e44ce4895304c6a3a831310fbf8cd0

SHA1
36bd49ae21c460be5753a904b4501f1abca53508

SHA256
b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592

SHA512
c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\NewLauncher\Cache\Cache_Data\f_000025

Filesize
1.0MB

MD5
677a827dcda17c8c6660b03fb9bfb90d

SHA1
ce386045206a43a15e996ac7ccd2422c695b0925

SHA256
db992027ef1e5412f881c8925a413c28bbb3e6fcda885d5ccbdff13b4eca9e4c

SHA512
d97ba6e489f0123570bf77bd012f045e53117d87587c63c00f273a9c9bbbd41e07be1649ec6c2a35d4c78dba3b5185a696f3e2cb3bb5dd52f6de17e1a31645ff

Download Submit
C:\Users\Admin\AppData\Roaming\NewLauncher\Cache\Cache_Data\f_000026

Filesize
203KB

MD5
0d69509d709dbe1afce376d8da8eeaa5

SHA1
4b6e67188ce4d51042997fe308de2378a29172fc

SHA256
4e6f3a89a3fb7b3d14d3628bc11cfd3b3bea53fe70d5dc675b631af5c698d84f

SHA512
6738ccc002133154b96daaac697ff12c44a1eefe84e9f41a101762cabd31b5aa2fa634942ae6f9ae54d4d03d513a45a91766e7bdff035703cf85c6c6092de199

Download Submit
C:\Users\Admin\AppData\Roaming\NewLauncher\Cache\Cache_Data\f_000027

Filesize
223KB

MD5
85a5ef35923602dbf485437fd6ba478a

SHA1
d4912a022e28055ec3db142fb43a0c21dc43d02c

SHA256
cc2654c4948e052eafdcd27f5d11ecdeb42748cbfaa294edc2639beeabd10946

SHA512
01aa0e67d9da260bb6962b7f4213ccb022675cd00acd5541e4601f50eca800768e816282402eec509e2c56256fe4e15bd61fd948ff8949aab2c69f33fcef91ee

Download Submit
C:\Users\Admin\AppData\Roaming\NewLauncher\Cache\Cache_Data\f_000028

Filesize
134KB

MD5
3b60d6101e7bb9c7bcfe4af5d4c05def

SHA1
ee7e64da47cad2cc81689896998541a224b21a5f

SHA256
6c612df9133121ec25cefbd41c2b2f1d7ff4b0bb217f1235b8efb6cb0c9ab23b

SHA512
2224440a0f94fbfa60d7c523e595000edaf7c349c117abb707d299007f964c84674037e310ef4adde96e214995d353b26a748a54d481765520f0cdddecb94c84

Download Submit
C:\Users\Admin\AppData\Roaming\NewLauncher\Cache\Cache_Data\f_00002a

Filesize
200KB

MD5
a9e3c7a75bc2e02a8e885f8eb9276bd4

SHA1
97a3a82127ef2fafdeeb4c0ab4ab0d2963512b6c

SHA256
83e2b267e0ab7a7377f786c1eb26dff0266f2f51e95eb286b4bd50e507f488a5

SHA512
5f3d2ddb711ca6db9411e3593221b7ef1b1aaa0b03d36dede12deacc85d64bf53b38bffdc856b0a012172cd7253c52dc98af0564633cb5ad4d2c3d88a61faa33

Download Submit
C:\Users\Admin\AppData\Roaming\NewLauncher\Cache\Cache_Data\f_00002b

Filesize
205KB

MD5
7ab8582ad95335ce897a644269caf299

SHA1
11e818762784f0c651c7613e5d7d2d0d26f635e0

SHA256
66dd3b8f69acab2b1a848fdb7f7738e6981c81614d82036c344a521664cabf31

SHA512
f0ba48885ec1ea2989218ebed921ff5705777a4da16db9501599aac9040f9d245656de2bf2841ba4a9310ef4dc09bcea916183278b75afb083d5a8675f84dde3

Download Submit
C:\Users\Admin\AppData\Roaming\NewLauncher\Cache\Cache_Data\f_00002c

Filesize
41KB

MD5
6b374ee384581fd95c3fc3492b417561

SHA1
6b8b62e30c61d8a1a1e4ca0706fe06fe6e6e9bf8

SHA256
4bf0498d301c73bc0e46f53053148c0434b188a88c996ced602d703dd4ee407c

SHA512
e57a0fac45a6d9426550a185908e8a551cfefe8ab6caa492a34910949fea4fc06aef8f9e56e221741a46ea361960f26582438c243eb46ec0b3e75808c290c7f1

Download Submit
C:\Users\Admin\AppData\Roaming\NewLauncher\Cache\Cache_Data\f_00002d

Filesize
150KB

MD5
8a7670f3d46d902c412343a56934a3a9

SHA1
f5f051c47d4ecbb10335c53afdfdd677de3fe6a8

SHA256
db4711d4d730aac1277331e20b181be3cacfc27701117811337f1fc373bdebeb

SHA512
722356803cfb8d74da80769338d5b85a713d6933ca03cca40e310e6f15500023da3edc8cc9b6c25841fb2f9c4352c5cb56ec18cace925021fada1d09fe2914a7

Download Submit
C:\Users\Admin\AppData\Roaming\NewLauncher\Cache\Cache_Data\f_00002e

Filesize
80KB

MD5
09b291c535da0868f3ba6983d5763427

SHA1
5881c8e22e3fb400e15aeca329a4409cff1e23c8

SHA256
1ae4aa25730bb4ebb3520d7a9a71212f6ceeefcf96f601d6b2058e04cbd9ba13

SHA512
b958de220f9b0eda580c4e2fb564ba07955e647346505447cd5dfdc348ed6df77764accbe1e90a365918cfce654004b3bc9af9688eab3e9da96eba4a30938b20

Download Submit
C:\Users\Admin\AppData\Roaming\NewLauncher\Cache\Cache_Data\f_00002f

Filesize
188KB

MD5
d72b98123e0faa308db7f4b36e987d04

SHA1
fadf991e36622976cd733e3a0a96723cfa1732e6

SHA256
e8445efc1535b591f7c4bc392ff2ff95e160e0047f9336c77e0192de47d8c6d8

SHA512
4262adb2ca6fdbfada15482d2efc0d125ac428cf0a7785199521763075e70c50847c5e71c1be1250d03271d1758a615ded15c70b32154560d2b29ec091232aea

Download Submit
C:\Users\Admin\AppData\Roaming\NewLauncher\Cache\Cache_Data\f_000030

Filesize
182KB

MD5
6174b424c36f62955cf27e0a258159fb

SHA1
9ca766b7bec13eae94d55ba2b39b5a9a3f627d0b

SHA256
a991e774b9156c581047f49709f276fa944eaaba39cb302469699f1d8a18f212

SHA512
18d5d88bbced147d71aa1b35e3437556aebf91c40bca06ae35a3d90bb74e7fd8376fe291dac31e82bc9fd460b8faf1983e8f434472694b5daa16dbd0e42ee2af

Download Submit
C:\Users\Admin\AppData\Roaming\NewLauncher\Cache\Cache_Data\f_000031

Filesize
193KB

MD5
ffb05624388d1f1eed9199c80d633a74

SHA1
1155666317d653cf5fbda9755eb7a65d4456c868

SHA256
ee4e09c05e394529b8cb91d00ac03d53a452cf9915e3edde33dddac59868ef92

SHA512
10b35b8bf1a03dd9168ba996783f738ac5b3558102797f86bc33bff23a9765fa6c3488721684e3389f999c81b2adf74b452f25fd81030dca3e08c777bcbe7f7c

Download Submit
C:\Users\Admin\AppData\Roaming\NewLauncher\Cache\Cache_Data\f_000032

Filesize
170KB

MD5
9fc126a2b1d50320d5589d816a078fbd

SHA1
2ad12ef138794558c7632701e0b59b7508465db3

SHA256
03892d338a986fe1b1a7fa548246790a1101bc28791916d2b1e7333580a5c482

SHA512
8aa6c54331f635768609ddaf458a36da1a1f60d67165f4bc0a70a90db444c0b2505ab52ec4d69617aa92a1e8b38a4e42f72b0a8b7cdee76e9e95f00d20055898

Download Submit
C:\Users\Admin\AppData\Roaming\NewLauncher\Cache\Cache_Data\f_000034

Filesize
156KB

MD5
d186986d95317954e77b89c935f250bf

SHA1
c1bc2c90809f5775c0754f6a5d88b370165ea3b2

SHA256
3e515fcb9fd28cc3dacde7d28a7f25ecbea418600b6c3ad203db11a4b1244821

SHA512
74b83204e936d6ca4b195165188a8b472e8e6a04a98192199d5ceca3ca9b5fb82a819b333a8aba968a88b3dd4a8ce923401e05d839ff0ec115f7a6d2d4ed5e54

Download Submit
C:\Users\Admin\AppData\Roaming\NewLauncher\Cache\Cache_Data\f_000035

Filesize
180KB

MD5
e8535b1c2f434b5f1e09ee3067293d7d

SHA1
19eac46891a2a6125bc9300dd70e039da6adbe2c

SHA256
8e309e3feb615b3005276ae09a0d600ac4a2313c840acfe1c3a2123de1e99d59

SHA512
075bea88aee0e74539d084825c635afe781b65c283a4734954fb08af8f7ddab12c9012d289738f01b4180faeb3e33249f7dc57054b40eefdfff03747aebe480c

Download Submit
C:\Users\Admin\AppData\Roaming\NewLauncher\Cache\Cache_Data\f_000046

Filesize
30KB

MD5
7bef5b764c5c7bb034e3fb5ac9af5345

SHA1
397bb5834306ef38002e3408a3ccc4e35bb102fb

SHA256
94e82c25e558d0d23db249b7e9a2264e8ec7ded27884e5991deb48ef55ccd929

SHA512
0b60e1521a0262096e944f12910105ee429400e4c7c83e8dfbba439237f295f0691af99d8fdcaa81c4024b17f7085d0ceea08ba0dc9821c1e05b420bfb3fb63f

Download Submit
C:\Users\Admin\AppData\Roaming\NewLauncher\DawnWebGPUCache\data_0

Filesize
8KB

MD5
cf89d16bb9107c631daabf0c0ee58efb

SHA1
3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

SHA256
d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

SHA512
8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

Download Submit
C:\Users\Admin\AppData\Roaming\NewLauncher\DawnWebGPUCache\data_1

Filesize
264KB

MD5
723a7da3502ffe74d53c63beb9413e78

SHA1
27ed638e50d4cfdb2f68fcdfb55aa5e3462c5f96

SHA256
5189d5a99c8bfba5eebee0e4bc6a907522bdc890f431c3d2d234b69700f8b10d

SHA512
ec13b344f481f11c02ebae4dd8d67fde6d8249cb6213a3ce4e1a241f1ba7365ddca7786eb4b98156dc6092439ef4cbb2698e77af4c8d5ea7dfb5955173748134

Download Submit
C:\Users\Admin\AppData\Roaming\NewLauncher\DawnWebGPUCache\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Roaming\NewLauncher\DawnWebGPUCache\data_3

Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\AppData\Roaming\NewLauncher\Local Storage\leveldb\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Roaming\NewLauncher\Network\Network Persistent State

Filesize
567B

MD5
fc11f491ddafb4a32c0942452b82f80b

SHA1
c58eca5ff0f6ab17a78b7b648d62b1b297236ecd

SHA256
815880242c57002202b04a23a50de7812d17fd02aa2b8d320b507e7b3383ee85

SHA512
77415fabbd03020b0d72d18febe7660d42db1d9ea48ba3906a1f2c51f01c2fa1510253fdfd72382f40fc33a5866ca84dd19994425a28bdeb5aa2824041b0bd4a

Download Submit
C:\Users\Admin\AppData\Roaming\NewLauncher\Network\Network Persistent State~RFe5945ba.TMP

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Users\Admin\AppData\Roaming\NewLauncher\Network\TransportSecurity

Filesize
188B

MD5
b1190b7ee718f47c11c150e0b92e78f7

SHA1
6e48a6824541603d7c696e3ee5d02257dd74beb6

SHA256
601211392f7c781cb0dae05c8cbca579d5d76b73163f27c36673c7ca1bfcaf67

SHA512
2c507db58455f7fe6bf9738037ed598c2d1be16d4e937b46685ecbfd50ff149077d7b258ef56d60f05650959d5bd70ae996042c8a0feeb7ec90756c546dc3bbe

Download Submit
C:\Users\Admin\AppData\Roaming\NewLauncher\Preferences

Filesize
57B

MD5
58127c59cb9e1da127904c341d15372b

SHA1
62445484661d8036ce9788baeaba31d204e9a5fc

SHA256
be4b8924ab38e8acf350e6e3b9f1f63a1a94952d8002759acd6946c4d5d0b5de

SHA512
8d1815b277a93ad590ff79b6f52c576cf920c38c4353c24193f707d66884c942f39ff3989530055d2fade540ade243b41b6eb03cd0cc361c3b5d514cca28b50a

Download Submit
C:\Users\Admin\AppData\Roaming\NewLauncher\Preferences~RFe58da6d.TMP

Filesize
86B

MD5
d11dedf80b85d8d9be3fec6bb292f64b

SHA1
aab8783454819cd66ddf7871e887abdba138aef3

SHA256
8029940de92ae596278912bbbd6387d65f4e849d3c136287a1233f525d189c67

SHA512
6b7ec1ca5189124e0d136f561ca7f12a4653633e2d9452d290e658dfe545acf6600cc9496794757a43f95c91705e9549ef681d4cc9e035738b03a18bdc2e25f0

Download Submit
C:\Users\Admin\AppData\Roaming\NewLauncher\Session Storage\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Roaming\NewLauncher\logs\main.log

Filesize
4KB

MD5
525f8aab56b31bc62f573f3d80dbc676

SHA1
6cf77d76fc65d0d2139e15ba59aa48437ea4ab27

SHA256
a43f0b2918ca70d9cfaf6506ebb0713a10823769616f4d3a1ee9d28b870c5969

SHA512
7e49955dc702bef29439ce99f7f19c6a1fbbab9b0d098f381335754f5526cc1a7b39e3876c55c526f7c641076265b5572af6e96c12b2333b532414512439ee09

Download Submit
C:\comAgentProviderBrowserHost\Nhiwm2aj1jfzULheVbkmLVGWtKQXyI.vbe

Filesize
229B

MD5
bec1a86a86b50a1214465d7ebb47f7ec

SHA1
a0b02b3c99169f29776973de6317177e0a75cddf

SHA256
55aa205e4274246497bd0b87a42452815560ea13e5e4c91ff94f35fa3e778d48

SHA512
1e10ae09886731b13cfd7139e9bb99bd4dc9cf753b2211e539731e736ce7f8b86f59f068208d52be5be3edb351c6a64d18198160281090cb9ff13248d77d60bd

Download Submit
C:\comAgentProviderBrowserHost\chainrefHost.exe

Filesize
2.3MB

MD5
6c9726962e2483df103ecbcb83aea91d

SHA1
f82931af900c03218d77dac855996327da1be20a

SHA256
f60c1797b78f5cf76edf632b88a28338f58526551d1b5888b998a05cc4087ab1

SHA512
d350cfc0027a013b38d6c67cb588b224e7f47b7e6238e81a7754a2832460ff58d10ecb68ac7ba4dbf18ad17a94056d0be849876ded06b4bb6a3c0d1533a93d32

Download Submit
C:\comAgentProviderBrowserHost\sjSBqrd847yf9OT2lEyuTEhLo.bat

Filesize
161B

MD5
81af5dd5899993017b3df167150afc37

SHA1
4272cdd3a5c1536a76c7db253bd4466e11da1fe2

SHA256
e32b3b0e9ece8931fd47700036d084185993083d23871ee79312049f81cc8bea

SHA512
621082b0b70a5ee3a2141284d830bcb10b39b78cf20d32e94183c7e4c4dbb9830ea6fed067e99507164a49124a2e7ec2b100e7f0d739b1d1d6c825c9708b3446

Download Submit
memory/880-56-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/4596-96-0x000000001B5B0000-0x000000001B606000-memory.dmp

Filesize
344KB

Download
memory/4596-97-0x0000000001110000-0x0000000001122000-memory.dmp

Filesize
72KB

Download
memory/4688-20-0x0000000000DE0000-0x0000000001030000-memory.dmp

Filesize
2.3MB

Download
memory/4688-21-0x0000000003240000-0x000000000325C000-memory.dmp

Filesize
112KB

Download
memory/4688-22-0x000000001C200000-0x000000001C250000-memory.dmp

Filesize
320KB

Download
memory/4688-24-0x000000001BB60000-0x000000001BBB6000-memory.dmp

Filesize
344KB

Download
memory/4688-23-0x000000001BB40000-0x000000001BB56000-memory.dmp

Filesize
88KB

Download
memory/4688-25-0x000000001BCC0000-0x000000001BCD2000-memory.dmp

Filesize
72KB

Download
memory/4688-26-0x000000001CB10000-0x000000001D038000-memory.dmp

Filesize
5.2MB

Download
memory/4688-28-0x000000001C250000-0x000000001C25E000-memory.dmp

Filesize
56KB

Download
memory/4688-29-0x000000001C260000-0x000000001C268000-memory.dmp

Filesize
32KB

Download