b1d3214d094f13957cf4cfaa04f6cbd5d621ddc5f4aee5a64d686740f063c76e

Resubmissions

05/08/2026, 00:30

260805-atlgnaba278

05/08/2026, 00:07

260805-aer1wstdmf8

Analysis

user interaction
yes
max time kernel
54s
max time network
61s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/08/2026, 00:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LostInWinter Setup 2.1.1.exe
Size 85.9MB
Sample260805-aer1wstdmf
SHA256 b1d3214d094f13957cf4cfaa04f6cbd5d621ddc5f4aee5a64d686740f063c76e
MD5 9ec1867bf0b580abae462efa239b214c
SHA1 fe96359803d7a4c2de4f900f95b0fc9d76e299f2
SHA512 cd5f90618ac15c937f567305e7fe77f1fb2dbf96bdfa11623ca54b8511f61a0a37ff5587963fe441601f4eb97741bcadf669232a69fa03214b41a28a02aab880
SSDEEP 1572864:cX+BWMFDe45kQsab5o6hDRVOl+7IQSnNa1hItzM1gMnOC6e/RsB65IFJKsKd3Iys:cOBFle459NjhDRVMJGOtzMpnf7R956Aa
TLSH
T15218335D2FC0E846E01DE2FF7A6623A11E59B9CB6BF3F257546C806E2C58770A940363
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 55 IoCs

Run Powershell to get system information as a root user.

execution

PowerShell

T1059.001

pid	Process
6780	powershell.exe
4388	powershell.exe
6496	powershell.exe
6236	powershell.exe
1204	powershell.exe
640	powershell.exe
5368	powershell.exe
4544	powershell.exe
1228	powershell.exe
2564	powershell.exe
6536	powershell.exe
1392	powershell.exe
2696	powershell.exe
3096	powershell.exe
6008	powershell.exe
4424	powershell.exe
5480	powershell.exe
3376	powershell.exe
6760	powershell.exe
6516	powershell.exe
6756	powershell.exe
3856	powershell.exe
7136	powershell.exe
5956	powershell.exe
3440	powershell.exe
3440	powershell.exe
4952	powershell.exe
7092	powershell.exe
4344	powershell.exe
820	powershell.exe
5048	powershell.exe
7032	powershell.exe
6304	powershell.exe
1536	powershell.exe
6312	powershell.exe
2460	powershell.exe
5432	powershell.exe
1232	powershell.exe
5444	powershell.exe
3948	powershell.exe
6412	powershell.exe
6180	powershell.exe
4140	powershell.exe
3368	powershell.exe
2988	powershell.exe
6052	powershell.exe
6344	powershell.exe
6336	powershell.exe
6292	powershell.exe
540	powershell.exe
3748	powershell.exe
4660	powershell.exe
6692	powershell.exe
4444	powershell.exe
4620	powershell.exe

Modifies Windows Firewall 2 TTPs 2 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
1040	netsh.exe
3648	netsh.exe

Executes dropped EXE 3 IoCs

pid	Process
2168	LostInWinter.exe
1076	LostInWinter.exe
5128	LostInWinter.exe

Loads dropped DLL 17 IoCs

pid	Process
3988	LostInWinter Setup 2.1.1.exe
3988	LostInWinter Setup 2.1.1.exe
3988	LostInWinter Setup 2.1.1.exe
3988	LostInWinter Setup 2.1.1.exe
3988	LostInWinter Setup 2.1.1.exe
3988	LostInWinter Setup 2.1.1.exe
3988	LostInWinter Setup 2.1.1.exe
2168	LostInWinter.exe
2168	LostInWinter.exe
2168	LostInWinter.exe
1076	LostInWinter.exe
5128	LostInWinter.exe
1076	LostInWinter.exe
1076	LostInWinter.exe
1076	LostInWinter.exe
1076	LostInWinter.exe
1076	LostInWinter.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
36	ipapi.co

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Discovers running processes 1 TTPs 1 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
2504	tasklist.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 2 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
4444	powershell.exe
4620	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2300	cmd.exe
5736	cmd.exe
5056	cmd.exe
7104	cmd.exe
2996	cmd.exe
2260	cmd.exe
640	cmd.exe
2124	cmd.exe
6252	cmd.exe
3028	cmd.exe
5224	cmd.exe
6096	cmd.exe
7112	cmd.exe
2128	cmd.exe
3060	cmd.exe
5264	cmd.exe
3932	cmd.exe
7072	cmd.exe
1844	cmd.exe
6232	cmd.exe
5244	cmd.exe
1028	cmd.exe
3652	cmd.exe
4944	cmd.exe
5176	cmd.exe
3856	cmd.exe
5684	cmd.exe
4684	cmd.exe
6000	cmd.exe
4316	cmd.exe
5296	cmd.exe
5716	cmd.exe
4492	cmd.exe
5316	cmd.exe
2256	cmd.exe
6456	cmd.exe
6236	cmd.exe
5544	cmd.exe
3412	cmd.exe
3936	cmd.exe
912	cmd.exe
1456	cmd.exe
5860	cmd.exe
3700	cmd.exe
5280	cmd.exe
4224	cmd.exe
1792	cmd.exe
4324	cmd.exe
5408	cmd.exe
208	cmd.exe
6720	cmd.exe
5972	cmd.exe
6016	cmd.exe
5836	cmd.exe
5776	cmd.exe
5644	cmd.exe
5584	cmd.exe
6300	cmd.exe
4672	cmd.exe
6024	cmd.exe
456	cmd.exe
1408	cmd.exe
5836	cmd.exe
1012	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LostInWinter Setup 2.1.1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 8 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
4716	cmd.exe
4124	netsh.exe
5684	cmd.exe
6048	netsh.exe
6752	cmd.exe
6900	netsh.exe
7104	cmd.exe
5888	netsh.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5052	ipconfig.exe

Kills process with taskkill 36 IoCs

defense_evasion

pid	Process
4792	taskkill.exe
6084	taskkill.exe
1800	taskkill.exe
5580	taskkill.exe
7024	taskkill.exe
2500	taskkill.exe
4320	taskkill.exe
6384	taskkill.exe
7100	taskkill.exe
5248	taskkill.exe
5080	taskkill.exe
6104	taskkill.exe
4596	taskkill.exe
6448	taskkill.exe
3336	taskkill.exe
5804	taskkill.exe
980	taskkill.exe
3368	taskkill.exe
820	taskkill.exe
4028	taskkill.exe
4440	taskkill.exe
5572	taskkill.exe
7044	taskkill.exe
2120	taskkill.exe
5100	taskkill.exe
5456	taskkill.exe
5344	taskkill.exe
4684	taskkill.exe
2780	taskkill.exe
4484	taskkill.exe
6608	taskkill.exe
2128	taskkill.exe
6680	taskkill.exe
6400	taskkill.exe
440	taskkill.exe
6684	taskkill.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
3988	LostInWinter Setup 2.1.1.exe
3988	LostInWinter Setup 2.1.1.exe
2504	tasklist.exe
2504	tasklist.exe
5048	powershell.exe
5048	powershell.exe
5048	powershell.exe
1228	powershell.exe
1228	powershell.exe
3368	powershell.exe
3368	powershell.exe
3748	powershell.exe
3748	powershell.exe
4140	powershell.exe
4140	powershell.exe
1392	powershell.exe
1392	powershell.exe
4140	powershell.exe

Suspicious use of AdjustPrivilegeToken 53 IoCs

description	pid	Process
Token: SeDebugPrivilege	2504	tasklist.exe
Token: SeSecurityPrivilege	3988	LostInWinter Setup 2.1.1.exe
Token: SeIncreaseQuotaPrivilege	4040	WMIC.exe
Token: SeSecurityPrivilege	4040	WMIC.exe
Token: SeTakeOwnershipPrivilege	4040	WMIC.exe
Token: SeLoadDriverPrivilege	4040	WMIC.exe
Token: SeSystemProfilePrivilege	4040	WMIC.exe
Token: SeSystemtimePrivilege	4040	WMIC.exe
Token: SeProfSingleProcessPrivilege	4040	WMIC.exe
Token: SeIncBasePriorityPrivilege	4040	WMIC.exe
Token: SeCreatePagefilePrivilege	4040	WMIC.exe
Token: SeBackupPrivilege	4040	WMIC.exe
Token: SeRestorePrivilege	4040	WMIC.exe
Token: SeShutdownPrivilege	4040	WMIC.exe
Token: SeDebugPrivilege	4040	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4040	WMIC.exe
Token: SeRemoteShutdownPrivilege	4040	WMIC.exe
Token: SeUndockPrivilege	4040	WMIC.exe
Token: SeManageVolumePrivilege	4040	WMIC.exe
Token: 33	4040	WMIC.exe
Token: 34	4040	WMIC.exe
Token: 35	4040	WMIC.exe
Token: 36	4040	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4040	WMIC.exe
Token: SeSecurityPrivilege	4040	WMIC.exe
Token: SeTakeOwnershipPrivilege	4040	WMIC.exe
Token: SeLoadDriverPrivilege	4040	WMIC.exe
Token: SeSystemProfilePrivilege	4040	WMIC.exe
Token: SeSystemtimePrivilege	4040	WMIC.exe
Token: SeProfSingleProcessPrivilege	4040	WMIC.exe
Token: SeIncBasePriorityPrivilege	4040	WMIC.exe
Token: SeCreatePagefilePrivilege	4040	WMIC.exe
Token: SeBackupPrivilege	4040	WMIC.exe
Token: SeRestorePrivilege	4040	WMIC.exe
Token: SeShutdownPrivilege	4040	WMIC.exe
Token: SeDebugPrivilege	4040	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4040	WMIC.exe
Token: SeRemoteShutdownPrivilege	4040	WMIC.exe
Token: SeUndockPrivilege	4040	WMIC.exe
Token: SeManageVolumePrivilege	4040	WMIC.exe
Token: 33	4040	WMIC.exe
Token: 34	4040	WMIC.exe
Token: 35	4040	WMIC.exe
Token: 36	4040	WMIC.exe
Token: SeDebugPrivilege	5048	powershell.exe
Token: SeDebugPrivilege	1228	powershell.exe
Token: SeDebugPrivilege	3368	powershell.exe
Token: SeDebugPrivilege	3748	powershell.exe
Token: SeDebugPrivilege	4140	powershell.exe
Token: SeDebugPrivilege	1392	powershell.exe
Token: SeShutdownPrivilege	2168	LostInWinter.exe
Token: SeCreatePagefilePrivilege	2168	LostInWinter.exe
Token: SeDebugPrivilege	5804	taskkill.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5796	java.exe

Suspicious use of WriteProcessMemory 55 IoCs

description	pid	Process	procid_target
PID 3988 wrote to memory of 3512	3988	LostInWinter Setup 2.1.1.exe	87
PID 3512 wrote to memory of 2504	3512	cmd.exe	89
PID 3512 wrote to memory of 3364	3512	cmd.exe	90
PID 2168 wrote to memory of 4944	2168	LostInWinter.exe	102
PID 4944 wrote to memory of 1948	4944	cmd.exe	104
PID 2168 wrote to memory of 4716	2168	LostInWinter.exe	105
PID 4716 wrote to memory of 4124	4716	cmd.exe	107
PID 2168 wrote to memory of 1632	2168	LostInWinter.exe	108
PID 1632 wrote to memory of 4040	1632	cmd.exe	110
PID 2168 wrote to memory of 3776	2168	LostInWinter.exe	111
PID 3776 wrote to memory of 5048	3776	cmd.exe	113
PID 2168 wrote to memory of 1720	2168	LostInWinter.exe	114
PID 2168 wrote to memory of 2256	2168	LostInWinter.exe	115
PID 2168 wrote to memory of 4136	2168	LostInWinter.exe	116
PID 2168 wrote to memory of 1984	2168	LostInWinter.exe	117
PID 2168 wrote to memory of 1368	2168	LostInWinter.exe	118
PID 2168 wrote to memory of 1028	2168	LostInWinter.exe	119
PID 2168 wrote to memory of 2300	2168	LostInWinter.exe	120
PID 2168 wrote to memory of 1032	2168	LostInWinter.exe	121
PID 2168 wrote to memory of 4324	2168	LostInWinter.exe	122
PID 2168 wrote to memory of 1456	2168	LostInWinter.exe	123
PID 2168 wrote to memory of 1664	2168	LostInWinter.exe	124
PID 2168 wrote to memory of 2924	2168	LostInWinter.exe	125
PID 2168 wrote to memory of 2260	2168	LostInWinter.exe	126
PID 2168 wrote to memory of 2124	2168	LostInWinter.exe	127
PID 2168 wrote to memory of 912	2168	LostInWinter.exe	128
PID 2168 wrote to memory of 4672	2168	LostInWinter.exe	129
PID 2168 wrote to memory of 820	2168	LostInWinter.exe	130
PID 2168 wrote to memory of 2128	2168	LostInWinter.exe	131
PID 2168 wrote to memory of 4992	2168	LostInWinter.exe	132
PID 2168 wrote to memory of 2460	2168	LostInWinter.exe	133
PID 2168 wrote to memory of 520	2168	LostInWinter.exe	136
PID 2168 wrote to memory of 4860	2168	LostInWinter.exe	138
PID 2168 wrote to memory of 1308	2168	LostInWinter.exe	141
PID 2168 wrote to memory of 1792	2168	LostInWinter.exe	144
PID 2168 wrote to memory of 2408	2168	LostInWinter.exe	147
PID 2168 wrote to memory of 3888	2168	LostInWinter.exe	150
PID 2168 wrote to memory of 640	2168	LostInWinter.exe	153
PID 2168 wrote to memory of 3752	2168	LostInWinter.exe	155
PID 2168 wrote to memory of 208	2168	LostInWinter.exe	158
PID 2168 wrote to memory of 3096	2168	LostInWinter.exe	160
PID 2168 wrote to memory of 3936	2168	LostInWinter.exe	164
PID 2168 wrote to memory of 1228	2168	LostInWinter.exe	165
PID 2168 wrote to memory of 1392	2168	LostInWinter.exe	166
PID 2168 wrote to memory of 3368	2168	LostInWinter.exe	167
PID 2168 wrote to memory of 3748	2168	LostInWinter.exe	169
PID 2168 wrote to memory of 4140	2168	LostInWinter.exe	170
PID 2168 wrote to memory of 1012	2168	LostInWinter.exe	172
PID 2168 wrote to memory of 1076	2168	LostInWinter.exe	188
PID 2168 wrote to memory of 1076	2168	LostInWinter.exe	188
PID 2168 wrote to memory of 5128	2168	LostInWinter.exe	189
PID 2168 wrote to memory of 5684	2168	LostInWinter.exe	190
PID 1308 wrote to memory of 5796	1308	cmd.exe	192
PID 1012 wrote to memory of 5804	1012	cmd.exe	193
PID 5684 wrote to memory of 6048	5684	cmd.exe	194

C:\Users\Admin\AppData\Local\Temp\LostInWinter Setup 2.1.1.exe
"C:\Users\Admin\AppData\Local\Temp\LostInWinter Setup 2.1.1.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3988
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq LostInWinter.exe" /FO csv | "C:\Windows\system32\find.exe" "LostInWinter.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3512
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "USERNAME eq Admin" /FI "IMAGENAME eq LostInWinter.exe" /FO csv
    3⤵
    - Discovers running processes
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2504
- - C:\Windows\SysWOW64\find.exe
    "C:\Windows\system32\find.exe" "LostInWinter.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3364

C:\Users\Admin\AppData\Local\Programs\lostinwinter\LostInWinter.exe
"C:\Users\Admin\AppData\Local\Programs\lostinwinter\LostInWinter.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "chcp"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4944
- - C:\Windows\system32\chcp.com
    chcp
    3⤵
    PID:1948
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "netsh wlan show profiles"
  2⤵
  - System Network Configuration Discovery: Wi-Fi Discovery
  - Suspicious use of WriteProcessMemory
  PID:4716
- - C:\Windows\system32\netsh.exe
    netsh wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:4124
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName,productState,instanceGuid /format:list"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1632
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName,productState,instanceGuid /format:list
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4040
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-MpComputerStatus | ConvertTo-Json -Depth 10""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3776
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-MpComputerStatus | ConvertTo-Json -Depth 10"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5048
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "openssl version"
  2⤵
  PID:1720
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "npm -v"
  2⤵
  - Executes a command shell one-liner
  PID:2256
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "pm2.cmd -v"
  2⤵
  PID:4136
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "yarn --version"
  2⤵
  PID:1984
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "gulp.cmd --version"
  2⤵
  PID:1368
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "brew --version"
  2⤵
  - Executes a command shell one-liner
  PID:1028
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tsc.cmd --version"
  2⤵
  - Executes a command shell one-liner
  PID:2300
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "grunt.cmd --version"
  2⤵
  PID:1032
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "git --version"
  2⤵
  - Executes a command shell one-liner
  PID:4324
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "apachectl -v 2>&1"
  2⤵
  - Executes a command shell one-liner
  PID:1456
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "nginx -v 2>&1"
  2⤵
  PID:1664
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "mysql -V"
  2⤵
  PID:2924
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "php -v"
  2⤵
  - Executes a command shell one-liner
  PID:2260
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "redis-server --version"
  2⤵
  - Executes a command shell one-liner
  PID:2124
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "docker --version"
  2⤵
  - Executes a command shell one-liner
  PID:912
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "postconf -d | grep mail_version"
  2⤵
  - Executes a command shell one-liner
  PID:4672
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "mongod --version"
  2⤵
  PID:820
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "perl -v"
  2⤵
  - Executes a command shell one-liner
  PID:2128
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "python -V 2>&1"
  2⤵
  PID:4992
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "python3 -V 2>&1"
  2⤵
  PID:2460
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "pip -V 2>&1"
  2⤵
  PID:520
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "pip3 -V 2>&1"
  2⤵
  PID:4860
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "java -version 2>&1"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1308
- - C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
    java -version
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:5796
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "gcc -dumpversion"
  2⤵
  - Executes a command shell one-liner
  PID:1792
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""undefined\VBoxManage.exe" -v 2>&1"
  2⤵
  PID:2408
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "bash --version"
  2⤵
  PID:3888
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "zsh --version"
  2⤵
  - Executes a command shell one-liner
  PID:640
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "fish --version"
  2⤵
  PID:3752
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "bun -v"
  2⤵
  PID:208
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "deno -v"
  2⤵
  PID:3096
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "node -v"
  2⤵
  - Executes a command shell one-liner
  PID:3936
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_Service | select caption | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1228
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command $PSVersionTable
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1392
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "gci \"HKLM:\SOFTWARE\Microsoft\NET Framework Setup\NDP\" -recurse | gp -name Version,Release -EA 0 | where { $_.PSChildName -match \"^(?!S)\p{L}\"} | select PSChildName, Version, Release"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3368
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_Process | select-Object ProcessId,ParentProcessId,ExecutionState,Caption,CommandLine,ExecutablePath,UserModeTime,KernelModeTime,WorkingSetSize,Priority,PageFileUsage, @{n=\"CreationDate\";e={$_.CreationDate.ToString(\"yyyy-MM-dd HH:mm:ss\")}} | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3748
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_Process | select-Object ProcessId,ParentProcessId,ExecutionState,Caption,CommandLine,ExecutablePath,UserModeTime,KernelModeTime,WorkingSetSize,Priority,PageFileUsage, @{n=\"CreationDate\";e={$_.CreationDate.ToString(\"yyyy-MM-dd HH:mm:ss\")}} | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4140
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1012
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM chrome.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5804
- C:\Users\Admin\AppData\Local\Programs\lostinwinter\LostInWinter.exe
  "C:\Users\Admin\AppData\Local\Programs\lostinwinter\LostInWinter.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\lostinwinter" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2592 --field-trial-handle=2596,i,17874308681287658515,16196722869359860792,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1076
- C:\Users\Admin\AppData\Local\Programs\lostinwinter\LostInWinter.exe
  "C:\Users\Admin\AppData\Local\Programs\lostinwinter\LostInWinter.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\lostinwinter" --mojo-platform-channel-handle=3048 --field-trial-handle=2596,i,17874308681287658515,16196722869359860792,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:5128
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "netsh wlan show profiles"
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Wi-Fi Discovery
  - Suspicious use of WriteProcessMemory
  PID:5684
- - C:\Windows\system32\netsh.exe
    netsh wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:6048
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM msedge.exe"
  2⤵
  - Executes a command shell one-liner
  PID:5316
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM msedge.exe
    3⤵
    - Kills process with taskkill
    PID:4792
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "gcc --version"
  2⤵
  - Executes a command shell one-liner
  PID:5176
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM brave.exe"
  2⤵
  PID:2516
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM brave.exe
    3⤵
    - Kills process with taskkill
    PID:5248
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM firefox.exe"
  2⤵
  PID:5292
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM firefox.exe
    3⤵
    - Kills process with taskkill
    PID:980
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM opera.exe"
  2⤵
  PID:4964
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM opera.exe
    3⤵
    - Kills process with taskkill
    PID:2120
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM kometa.exe"
  2⤵
  PID:1104
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM kometa.exe
    3⤵
    - Kills process with taskkill
    PID:440
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM orbitum.exe"
  2⤵
  PID:5452
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM orbitum.exe
    3⤵
    - Kills process with taskkill
    PID:5080
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "openssl version"
  2⤵
  PID:876
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "npm -v"
  2⤵
  PID:5560
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "pm2.cmd -v"
  2⤵
  PID:5520
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "yarn --version"
  2⤵
  PID:5268
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "gulp.cmd --version"
  2⤵
  PID:1580
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "brew --version"
  2⤵
  PID:5820
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tsc.cmd --version"
  2⤵
  PID:5828
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "grunt.cmd --version"
  2⤵
  - Executes a command shell one-liner
  PID:5836
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "git --version"
  2⤵
  PID:5848
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "apachectl -v 2>&1"
  2⤵
  - Executes a command shell one-liner
  PID:5408
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "nginx -v 2>&1"
  2⤵
  PID:1684
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "mysql -V"
  2⤵
  - Executes a command shell one-liner
  PID:3652
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "php -v"
  2⤵
  PID:5876
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "redis-server --version"
  2⤵
  PID:5884
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "docker --version"
  2⤵
  PID:5892
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "postconf -d | grep mail_version"
  2⤵
  PID:5908
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "mongod --version"
  2⤵
  PID:5932
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "perl -v"
  2⤵
  PID:5940
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "python -V 2>&1"
  2⤵
  PID:5956
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "python3 -V 2>&1"
  2⤵
  PID:5964
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "pip -V 2>&1"
  2⤵
  PID:5976
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "pip3 -V 2>&1"
  2⤵
  PID:5980
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "java -version 2>&1"
  2⤵
  PID:5992
- - C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
    java -version
    3⤵
    PID:2304
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "gcc -dumpversion"
  2⤵
  PID:6008
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""undefined\VBoxManage.exe" -v 2>&1"
  2⤵
  - Executes a command shell one-liner
  PID:6016
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "bash --version"
  2⤵
  - Executes a command shell one-liner
  PID:6024
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "zsh --version"
  2⤵
  PID:6040
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "fish --version"
  2⤵
  PID:5912
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "bun -v"
  2⤵
  PID:6044
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "deno -v"
  2⤵
  PID:5808
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "node -v"
  2⤵
  - Executes a command shell one-liner
  PID:5860
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_Service | select caption | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5480
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command $PSVersionTable
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5444
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "gci \"HKLM:\SOFTWARE\Microsoft\NET Framework Setup\NDP\" -recurse | gp -name Version,Release -EA 0 | where { $_.PSChildName -match \"^(?!S)\p{L}\"} | select PSChildName, Version, Release"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4660
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_Process | select-Object ProcessId,ParentProcessId,ExecutionState,Caption,CommandLine,ExecutablePath,UserModeTime,KernelModeTime,WorkingSetSize,Priority,PageFileUsage, @{n=\"CreationDate\";e={$_.CreationDate.ToString(\"yyyy-MM-dd HH:mm:ss\")}} | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2988
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName,productState,instanceGuid /format:list"
  2⤵
  PID:2636
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName,productState,instanceGuid /format:list
    3⤵
    PID:6160
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-MpComputerStatus | ConvertTo-Json -Depth 10""
  2⤵
  - Executes a command shell one-liner
  PID:6456
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-MpComputerStatus | ConvertTo-Json -Depth 10"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:6516
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_Process | select-Object ProcessId,ParentProcessId,ExecutionState,Caption,CommandLine,ExecutablePath,UserModeTime,KernelModeTime,WorkingSetSize,Priority,PageFileUsage, @{n=\"CreationDate\";e={$_.CreationDate.ToString(\"yyyy-MM-dd HH:mm:ss\")}} | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6692
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName,productState,instanceGuid /format:list"
  2⤵
  PID:6700
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName,productState,instanceGuid /format:list
    3⤵
    PID:6808
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-MpComputerStatus | ConvertTo-Json -Depth 10""
  2⤵
  PID:6976
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-MpComputerStatus | ConvertTo-Json -Depth 10"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:7032
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_Process | select-Object ProcessId,ParentProcessId,ExecutionState,Caption,CommandLine,ExecutablePath,UserModeTime,KernelModeTime,WorkingSetSize,Priority,PageFileUsage, @{n=\"CreationDate\";e={$_.CreationDate.ToString(\"yyyy-MM-dd HH:mm:ss\")}} | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6052
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "gcc --version"
  2⤵
  PID:1344
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM centbrowser.exe"
  2⤵
  - Executes a command shell one-liner
  PID:456
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM centbrowser.exe
    3⤵
    - Kills process with taskkill
    PID:2128
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM 7star.exe"
  2⤵
  - Executes a command shell one-liner
  PID:3060
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM 7star.exe
    3⤵
    - Kills process with taskkill
    PID:3368
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM sputnik.exe"
  2⤵
  PID:3892
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM sputnik.exe
    3⤵
    - Kills process with taskkill
    PID:2500
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM vivaldi.exe"
  2⤵
  PID:5780
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM vivaldi.exe
    3⤵
    - Kills process with taskkill
    PID:6084
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM epicprivacybrowser.exe"
  2⤵
  PID:5704
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM epicprivacybrowser.exe
    3⤵
    - Kills process with taskkill
    PID:820
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM uran.exe"
  2⤵
  PID:5428
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM uran.exe
    3⤵
    - Kills process with taskkill
    PID:1800
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM yandex.exe"
  2⤵
  - Executes a command shell one-liner
  PID:5644
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM yandex.exe
    3⤵
    - Kills process with taskkill
    PID:6104
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM iridium.exe"
  2⤵
  PID:6500
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM iridium.exe
    3⤵
    - Kills process with taskkill
    PID:4028
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM tor.exe"
  2⤵
  PID:5224
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM tor.exe
    3⤵
    - Kills process with taskkill
    PID:6680
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM waterfox.exe"
  2⤵
  PID:6284
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM waterfox.exe
    3⤵
    - Kills process with taskkill
    PID:4596
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM arc.exe"
  2⤵
  - Executes a command shell one-liner
  PID:4316
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM arc.exe
    3⤵
    - Kills process with taskkill
    PID:7024
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Cryptography" /v MachineGuid"
  2⤵
  PID:5976
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Cryptography" /v MachineGuid
    3⤵
    PID:5484
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "netsh advfirewall show allprofiles state"
  2⤵
  PID:6360
- - C:\Windows\system32\netsh.exe
    netsh advfirewall show allprofiles state
    3⤵
    - Modifies Windows Firewall
    PID:1040
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-MpComputerStatus | Select-Object -ExpandProperty AntivirusEnabled""
  2⤵
  PID:1028
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-MpComputerStatus | Select-Object -ExpandProperty AntivirusEnabled"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:7092
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 1 | Select-Object -ExpandProperty InstalledOn""
  2⤵
  PID:1984
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 1 | Select-Object -ExpandProperty InstalledOn"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:6756
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA"
  2⤵
  - Executes a command shell one-liner
  PID:1844
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA
    3⤵
    PID:6688
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-VpnConnection | Where-Object {$_.ConnectionStatus -eq 'Connected'} | Select-Object -First 1""
  2⤵
  - Executes a command shell one-liner
  PID:5836
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-VpnConnection | Where-Object {$_.ConnectionStatus -eq 'Connected'} | Select-Object -First 1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3948
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  PID:5304
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:6448
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:6104
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "[bool](([System.Security.Principal.WindowsIdentity]::GetCurrent()).groups -match 'S-1-5-32-544')""
  2⤵
  - Executes a command shell one-liner
  PID:5584
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "[bool](([System.Security.Principal.WindowsIdentity]::GetCurrent()).groups -match 'S-1-5-32-544')"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2564
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAnACAAJABwAD0AQAAoACkAIAB0AHIAeQAgAHsAIAAgACAAJABjAD0ARwBlAHQALQBDAGkAbQBJAG4AcwB0AGEAbgBjAGUAIAAtAE4AYQBtAGUAcwBwAGEAYwBlACAAcgBvAG8AdAAvAFMAZQBjAHUAcgBpAHQAeQBDAGUAbgB0AGUAcgAyACAALQBDAGwAYQBzAHMATgBhAG0AZQAgAEEAbgB0AGkAVgBpAHIAdQBzAFAAcgBvAGQAdQBjAHQAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIAAgACAAaQBmACAAKAAkAGMAKQAgAHsAIABmAG8AcgBlAGEAYwBoACAAKAAkAHgAIABpAG4AIABAACgAJABjACkAKQAgAHsAIAAkAHAAKwA9AFsAUABTAEMAdQBzAHQAbwBtAE8AYgBqAGUAYwB0AF0AQAB7AE4APQBbAHMAdAByAGkAbgBnAF0AJAB4AC4AZABpAHMAcABsAGEAeQBOAGEAbQBlADsAUwA9AFsAaQBuAHQANgA0AF0AJAB4AC4AcAByAG8AZAB1AGMAdABTAHQAYQB0AGUAfQAgAH0AIAB9ACAAfQAgAGMAYQB0AGMAaAAgAHsAfQAgAGkAZgAgACgAJABwAC4AQwBvAHUAbgB0ACAALQBlAHEAIAAwACkAIAB7ACAAdAByAHkAIAB7ACAAIAAgACQAdwA9AEcAZQB0AC0AVwBtAGkATwBiAGoAZQBjAHQAIAAtAE4AYQBtAGUAcwBwAGEAYwBlACAAcgBvAG8AdABcAFMAZQBjAHUAcgBpAHQAeQBDAGUAbgB0AGUAcgAyACAALQBDAGwAYQBzAHMAIABBAG4AdABpAFYAaQByAHUAcwBQAHIAbwBkAHUAYwB0ACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACAAIAAgAGkAZgAgACgAJAB3ACkAIAB7ACAAZgBvAHIAZQBhAGMAaAAgACgAJAB4ACAAaQBuACAAQAAoACQAdwApACkAIAB7ACAAJABwACsAPQBbAFAAUwBDAHUAcwB0AG8AbQBPAGIAagBlAGMAdABdAEAAewBOAD0AWwBzAHQAcgBpAG4AZwBdACQAeAAuAGQAaQBzAHAAbABhAHkATgBhAG0AZQA7AFMAPQBbAGkAbgB0ADYANABdACQAeAAuAHAAcgBvAGQAdQBjAHQAUwB0AGEAdABlAH0AIAB9ACAAfQAgAH0AIABjAGEAdABjAGgAIAB7AH0AIAB9ACAAJABkAD0AJABuAHUAbABsACAAdAByAHkAIAB7ACAAIAAgACQAbQA9AEcAZQB0AC0ATQBwAEMAbwBtAHAAdQB0AGUAcgBTAHQAYQB0AHUAcwAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAgACAAIABpAGYAIAAoACQAbQApACAAewAgACAAIAAgACAAJABkAD0AWwBQAFMAQwB1AHMAdABvAG0ATwBiAGoAZQBjAHQAXQBAAHsAQQBFAD0AJABtAC4AQQBuAHQAaQB2AGkAcgB1AHMARQBuAGEAYgBsAGUAZAA7AFIAVAA9ACQAbQAuAFIAZQBhAGwAVABpAG0AZQBQAHIAbwB0AGUAYwB0AGkAbwBuAEUAbgBhAGIAbABlAGQAOwBBAE0APQAkAG0ALgBBAE0AUwBlAHIAdgBpAGMAZQBFAG4AYQBiAGwAZQBkADsAUgBNAD0AWwBzAHQAcgBpAG4AZwBdACQAbQAuAEEATQBSAHUAbgBuAGkAbgBnAE0AbwBkAGUAfQAgACAAIAB9ACAAfQAgAGMAYQB0AGMAaAAgAHsAfQAgAFsAUABTAEMAdQBzAHQAbwBtAE8AYgBqAGUAYwB0AF0AQAB7AFAAPQAkAHAAOwBEAD0AJABkAH0AfABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAtAEMAbwBtAHAAcgBlAHMAcwAgAC0ARABlAHAAdABoACAANgA="
  2⤵
  - Executes a command shell one-liner
  PID:6232
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAnACAAJABwAD0AQAAoACkAIAB0AHIAeQAgAHsAIAAgACAAJABjAD0ARwBlAHQALQBDAGkAbQBJAG4AcwB0AGEAbgBjAGUAIAAtAE4AYQBtAGUAcwBwAGEAYwBlACAAcgBvAG8AdAAvAFMAZQBjAHUAcgBpAHQAeQBDAGUAbgB0AGUAcgAyACAALQBDAGwAYQBzAHMATgBhAG0AZQAgAEEAbgB0AGkAVgBpAHIAdQBzAFAAcgBvAGQAdQBjAHQAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIAAgACAAaQBmACAAKAAkAGMAKQAgAHsAIABmAG8AcgBlAGEAYwBoACAAKAAkAHgAIABpAG4AIABAACgAJABjACkAKQAgAHsAIAAkAHAAKwA9AFsAUABTAEMAdQBzAHQAbwBtAE8AYgBqAGUAYwB0AF0AQAB7AE4APQBbAHMAdAByAGkAbgBnAF0AJAB4AC4AZABpAHMAcABsAGEAeQBOAGEAbQBlADsAUwA9AFsAaQBuAHQANgA0AF0AJAB4AC4AcAByAG8AZAB1AGMAdABTAHQAYQB0AGUAfQAgAH0AIAB9ACAAfQAgAGMAYQB0AGMAaAAgAHsAfQAgAGkAZgAgACgAJABwAC4AQwBvAHUAbgB0ACAALQBlAHEAIAAwACkAIAB7ACAAdAByAHkAIAB7ACAAIAAgACQAdwA9AEcAZQB0AC0AVwBtAGkATwBiAGoAZQBjAHQAIAAtAE4AYQBtAGUAcwBwAGEAYwBlACAAcgBvAG8AdABcAFMAZQBjAHUAcgBpAHQAeQBDAGUAbgB0AGUAcgAyACAALQBDAGwAYQBzAHMAIABBAG4AdABpAFYAaQByAHUAcwBQAHIAbwBkAHUAYwB0ACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACAAIAAgAGkAZgAgACgAJAB3ACkAIAB7ACAAZgBvAHIAZQBhAGMAaAAgACgAJAB4ACAAaQBuACAAQAAoACQAdwApACkAIAB7ACAAJABwACsAPQBbAFAAUwBDAHUAcwB0AG8AbQBPAGIAagBlAGMAdABdAEAAewBOAD0AWwBzAHQAcgBpAG4AZwBdACQAeAAuAGQAaQBzAHAAbABhAHkATgBhAG0AZQA7AFMAPQBbAGkAbgB0ADYANABdACQAeAAuAHAAcgBvAGQAdQBjAHQAUwB0AGEAdABlAH0AIAB9ACAAfQAgAH0AIABjAGEAdABjAGgAIAB7AH0AIAB9ACAAJABkAD0AJABuAHUAbABsACAAdAByAHkAIAB7ACAAIAAgACQAbQA9AEcAZQB0AC0ATQBwAEMAbwBtAHAAdQB0AGUAcgBTAHQAYQB0AHUAcwAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAgACAAIABpAGYAIAAoACQAbQApACAAewAgACAAIAAgACAAJABkAD0AWwBQAFMAQwB1AHMAdABvAG0ATwBiAGoAZQBjAHQAXQBAAHsAQQBFAD0AJABtAC4AQQBuAHQAaQB2AGkAcgB1AHMARQBuAGEAYgBsAGUAZAA7AFIAVAA9ACQAbQAuAFIAZQBhAGwAVABpAG0AZQBQAHIAbwB0AGUAYwB0AGkAbwBuAEUAbgBhAGIAbABlAGQAOwBBAE0APQAkAG0ALgBBAE0AUwBlAHIAdgBpAGMAZQBFAG4AYQBiAGwAZQBkADsAUgBNAD0AWwBzAHQAcgBpAG4AZwBdACQAbQAuAEEATQBSAHUAbgBuAGkAbgBnAE0AbwBkAGUAfQAgACAAIAB9ACAAfQAgAGMAYQB0AGMAaAAgAHsAfQAgAFsAUABTAEMAdQBzAHQAbwBtAE8AYgBqAGUAYwB0AF0AQAB7AFAAPQAkAHAAOwBEAD0AJABkAH0AfABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAtAEMAbwBtAHAAcgBlAHMAcwAgAC0ARABlAHAAdABoACAANgA=
    3⤵
    PID:5192
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-MpComputerStatus).AntivirusEnabled""
  2⤵
  - Executes a command shell one-liner
  PID:5716
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-MpComputerStatus).AntivirusEnabled"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:7136
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-WmiObject Win32_logicaldisk | select Access,Caption,FileSystem,FreeSpace,Size | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1232
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance win32_VideoController | fl *"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6412
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "gp \"HKLM:\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\*\" -ErrorAction SilentlyContinue | where MatchingDeviceId $null -NE | select MatchingDeviceId,HardwareInformation.qwMemorySize | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Hide Artifacts: Ignore Process Interrupts
  PID:4444
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance win32_desktopmonitor | fl *"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3376
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance -Namespace root\wmi -ClassName WmiMonitorBasicDisplayParams | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4388
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.Screen]::AllScreens"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5956
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance -Namespace root\wmi -ClassName WmiMonitorConnectionParams | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6780
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "gwmi WmiMonitorID -Namespace root\wmi | ForEach-Object {(($_.ManufacturerName -notmatch 0 | foreach {[char]$_}) -join \"\") + \"|\" + (($_.ProductCodeID -notmatch 0 | foreach {[char]$_}) -join \"\") + \"|\" + (($_.UserFriendlyName -notmatch 0 | foreach {[char]$_}) -join \"\") + \"|\" + (($_.SerialNumberID -notmatch 0 | foreach {[char]$_}) -join \"\") + \"|\" + $_.InstanceName}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3096
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0" /v FeatureSet"
  2⤵
  PID:6020
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0" /v FeatureSet
    3⤵
    PID:5940
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "ipconfig /all"
  2⤵
  PID:5404
- - C:\Windows\system32\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:5052
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "route print"
  2⤵
  PID:2460
- - C:\Windows\system32\ROUTE.EXE
    route print
    3⤵
    PID:6888
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic service get name,displayName,state,startMode,pathName /format:list"
  2⤵
  PID:7048
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic service get name,displayName,state,startMode,pathName /format:list
    3⤵
    PID:672
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0" /v FeatureSet"
  2⤵
  - Executes a command shell one-liner
  PID:6096
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0" /v FeatureSet
    3⤵
    PID:7044
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName,productState,instanceGuid /format:list"
  2⤵
  PID:6820
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName,productState,instanceGuid /format:list
    3⤵
    PID:6104
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-MpComputerStatus | ConvertTo-Json -Depth 10""
  2⤵
  - Executes a command shell one-liner
  PID:7112
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-MpComputerStatus | ConvertTo-Json -Depth 10"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:6536
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_Process | select-Object ProcessId,ParentProcessId,ExecutionState,Caption,CommandLine,ExecutablePath,UserModeTime,KernelModeTime,WorkingSetSize,Priority,PageFileUsage, @{n=\"CreationDate\";e={$_.CreationDate.ToString(\"yyyy-MM-dd HH:mm:ss\")}} | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:540
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_processor | select Name, Revision, L2CacheSize, L3CacheSize, Manufacturer, MaxClockSpeed, Description, UpgradeMethod, Caption, NumberOfLogicalProcessors, NumberOfCores | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4952
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_CacheMemory | select CacheType,InstalledSize,Level | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4424
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "(Get-CimInstance Win32_ComputerSystem).HypervisorPresent"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5368
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_PageFileUsage | Select AllocatedBaseSize, CurrentUsage"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6008
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_processor | select Name, Revision, L2CacheSize, L3CacheSize, Manufacturer, MaxClockSpeed, Description, UpgradeMethod, Caption, NumberOfLogicalProcessors, NumberOfCores | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3440
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_CacheMemory | select CacheType,InstalledSize,Level | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6760
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "(Get-CimInstance Win32_ComputerSystem).HypervisorPresent"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4544
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic product get name,version,vendor,installDate /format:list"
  2⤵
  PID:6420

C:\Users\Admin\AppData\Local\Programs\lostinwinter\LostInWinter.exe
"C:\Users\Admin\AppData\Local\Programs\lostinwinter\LostInWinter.exe"
1⤵
PID:1396
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "chcp"
  2⤵
  PID:6628
- - C:\Windows\system32\chcp.com
    chcp
    3⤵
    PID:6668
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "netsh wlan show profiles"
  2⤵
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:6752
- - C:\Windows\system32\netsh.exe
    netsh wlan show profiles
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:6900
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName,productState,instanceGuid /format:list"
  2⤵
  PID:7144
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName,productState,instanceGuid /format:list
    3⤵
    PID:3084
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-MpComputerStatus | ConvertTo-Json -Depth 10""
  2⤵
  PID:2924
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-MpComputerStatus | ConvertTo-Json -Depth 10"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2696
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "openssl version"
  2⤵
  PID:4596
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "npm -v"
  2⤵
  PID:3508
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "pm2.cmd -v"
  2⤵
  PID:1720
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "yarn --version"
  2⤵
  PID:5384
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "gulp.cmd --version"
  2⤵
  PID:4544
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "brew --version"
  2⤵
  PID:640
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tsc.cmd --version"
  2⤵
  - Executes a command shell one-liner
  PID:5224
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "grunt.cmd --version"
  2⤵
  - Executes a command shell one-liner
  PID:3932
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "git --version"
  2⤵
  PID:4672
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "apachectl -v 2>&1"
  2⤵
  PID:5228
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "nginx -v 2>&1"
  2⤵
  - Executes a command shell one-liner
  PID:5056
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "mysql -V"
  2⤵
  PID:5692
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "php -v"
  2⤵
  - Executes a command shell one-liner
  PID:4492
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "redis-server --version"
  2⤵
  - Executes a command shell one-liner
  PID:3856
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "docker --version"
  2⤵
  - Executes a command shell one-liner
  PID:5736
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "postconf -d | grep mail_version"
  2⤵
  PID:556
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "mongod --version"
  2⤵
  PID:2164
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "perl -v"
  2⤵
  - Executes a command shell one-liner
  PID:4224
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "python -V 2>&1"
  2⤵
  - Executes a command shell one-liner
  PID:4684
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "python3 -V 2>&1"
  2⤵
  - Executes a command shell one-liner
  PID:5264
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "pip -V 2>&1"
  2⤵
  - Executes a command shell one-liner
  PID:5544
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "pip3 -V 2>&1"
  2⤵
  - Executes a command shell one-liner
  PID:3028
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "java -version 2>&1"
  2⤵
  - Executes a command shell one-liner
  PID:5280
- - C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
    java -version
    3⤵
    PID:5680
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "gcc -dumpversion"
  2⤵
  - Executes a command shell one-liner
  PID:5776
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""undefined\VBoxManage.exe" -v 2>&1"
  2⤵
  - Executes a command shell one-liner
  PID:208
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "bash --version"
  2⤵
  PID:2440
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "zsh --version"
  2⤵
  PID:5124
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "fish --version"
  2⤵
  - Executes a command shell one-liner
  PID:6252
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "bun -v"
  2⤵
  - Executes a command shell one-liner
  PID:6236
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "deno -v"
  2⤵
  PID:6228
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "node -v"
  2⤵
  PID:6272
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_Service | select caption | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1536
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command $PSVersionTable
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6304
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "gci \"HKLM:\SOFTWARE\Microsoft\NET Framework Setup\NDP\" -recurse | gp -name Version,Release -EA 0 | where { $_.PSChildName -match \"^(?!S)\p{L}\"} | select PSChildName, Version, Release"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6292
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_Process | select-Object ProcessId,ParentProcessId,ExecutionState,Caption,CommandLine,ExecutablePath,UserModeTime,KernelModeTime,WorkingSetSize,Priority,PageFileUsage, @{n=\"CreationDate\";e={$_.CreationDate.ToString(\"yyyy-MM-dd HH:mm:ss\")}} | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6336
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_Process | select-Object ProcessId,ParentProcessId,ExecutionState,Caption,CommandLine,ExecutablePath,UserModeTime,KernelModeTime,WorkingSetSize,Priority,PageFileUsage, @{n=\"CreationDate\";e={$_.CreationDate.ToString(\"yyyy-MM-dd HH:mm:ss\")}} | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6344
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe"
  2⤵
  PID:5928
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM chrome.exe
    3⤵
    - Kills process with taskkill
    PID:2780
- C:\Users\Admin\AppData\Local\Programs\lostinwinter\LostInWinter.exe
  "C:\Users\Admin\AppData\Local\Programs\lostinwinter\LostInWinter.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\lostinwinter" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2996 --field-trial-handle=3000,i,6957369415773103674,12253053106617482383,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
  2⤵
  PID:6900
- C:\Users\Admin\AppData\Local\Programs\lostinwinter\LostInWinter.exe
  "C:\Users\Admin\AppData\Local\Programs\lostinwinter\LostInWinter.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\lostinwinter" --mojo-platform-channel-handle=3052 --field-trial-handle=3000,i,6957369415773103674,12253053106617482383,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
  2⤵
  PID:6764
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "gcc --version"
  2⤵
  - Executes a command shell one-liner
  PID:6000
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "netsh wlan show profiles"
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:7104
- - C:\Windows\system32\netsh.exe
    netsh wlan show profiles
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:5888
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM msedge.exe"
  2⤵
  PID:7064
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM msedge.exe
    3⤵
    - Kills process with taskkill
    PID:4320
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM brave.exe"
  2⤵
  PID:3728
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM brave.exe
    3⤵
    - Kills process with taskkill
    PID:4484
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM firefox.exe"
  2⤵
  - Executes a command shell one-liner
  PID:6720
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM firefox.exe
    3⤵
    - Kills process with taskkill
    PID:5580
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM opera.exe"
  2⤵
  PID:6600
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM opera.exe
    3⤵
    - Kills process with taskkill
    PID:6608
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM kometa.exe"
  2⤵
  PID:5728
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM kometa.exe
    3⤵
    - Kills process with taskkill
    PID:6384
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM orbitum.exe"
  2⤵
  PID:7052
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM orbitum.exe
    3⤵
    - Kills process with taskkill
    PID:4440
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM centbrowser.exe"
  2⤵
  - Executes a command shell one-liner
  PID:5296
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM centbrowser.exe
    3⤵
    - Kills process with taskkill
    PID:5572
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM 7star.exe"
  2⤵
  - Executes a command shell one-liner
  PID:5972
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM 7star.exe
    3⤵
    - Kills process with taskkill
    PID:5100
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM sputnik.exe"
  2⤵
  PID:1064
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM sputnik.exe
    3⤵
    - Kills process with taskkill
    PID:7100
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM vivaldi.exe"
  2⤵
  PID:6988
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM vivaldi.exe
    3⤵
    - Kills process with taskkill
    PID:5456
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM epicprivacybrowser.exe"
  2⤵
  PID:2780
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM epicprivacybrowser.exe
    3⤵
    - Kills process with taskkill
    PID:6448
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM uran.exe"
  2⤵
  PID:4852
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM uran.exe
    3⤵
    - Kills process with taskkill
    PID:7044
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM yandex.exe"
  2⤵
  - Executes a command shell one-liner
  PID:7072
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM yandex.exe
    3⤵
    - Kills process with taskkill
    PID:5344
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM iridium.exe"
  2⤵
  PID:6652
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM iridium.exe
    3⤵
    - Kills process with taskkill
    PID:6684
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM tor.exe"
  2⤵
  PID:4740
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM tor.exe
    3⤵
    - Kills process with taskkill
    PID:4684
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM waterfox.exe"
  2⤵
  PID:5916
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM waterfox.exe
    3⤵
    - Kills process with taskkill
    PID:3336
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM arc.exe"
  2⤵
  PID:6376
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM arc.exe
    3⤵
    - Kills process with taskkill
    PID:6400
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Cryptography" /v MachineGuid"
  2⤵
  PID:6932
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Cryptography" /v MachineGuid
    3⤵
    PID:7024
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "netsh advfirewall show allprofiles state"
  2⤵
  - Executes a command shell one-liner
  PID:3412
- - C:\Windows\system32\netsh.exe
    netsh advfirewall show allprofiles state
    3⤵
    - Modifies Windows Firewall
    PID:3648
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-MpComputerStatus | Select-Object -ExpandProperty AntivirusEnabled""
  2⤵
  - Executes a command shell one-liner
  PID:1408
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-MpComputerStatus | Select-Object -ExpandProperty AntivirusEnabled"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:6312
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 1 | Select-Object -ExpandProperty InstalledOn""
  2⤵
  PID:5196
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 1 | Select-Object -ExpandProperty InstalledOn"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2460
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA"
  2⤵
  - Executes a command shell one-liner
  PID:2996
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA
    3⤵
    PID:1720
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-VpnConnection | Where-Object {$_.ConnectionStatus -eq 'Connected'} | Select-Object -First 1""
  2⤵
  PID:6160
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-VpnConnection | Where-Object {$_.ConnectionStatus -eq 'Connected'} | Select-Object -First 1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5432
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  PID:2712
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:2512
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:2484
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "[bool](([System.Security.Principal.WindowsIdentity]::GetCurrent()).groups -match 'S-1-5-32-544')""
  2⤵
  - Executes a command shell one-liner
  PID:3700
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "[bool](([System.Security.Principal.WindowsIdentity]::GetCurrent()).groups -match 'S-1-5-32-544')"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4344
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAnACAAJABwAD0AQAAoACkAIAB0AHIAeQAgAHsAIAAgACAAJABjAD0ARwBlAHQALQBDAGkAbQBJAG4AcwB0AGEAbgBjAGUAIAAtAE4AYQBtAGUAcwBwAGEAYwBlACAAcgBvAG8AdAAvAFMAZQBjAHUAcgBpAHQAeQBDAGUAbgB0AGUAcgAyACAALQBDAGwAYQBzAHMATgBhAG0AZQAgAEEAbgB0AGkAVgBpAHIAdQBzAFAAcgBvAGQAdQBjAHQAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIAAgACAAaQBmACAAKAAkAGMAKQAgAHsAIABmAG8AcgBlAGEAYwBoACAAKAAkAHgAIABpAG4AIABAACgAJABjACkAKQAgAHsAIAAkAHAAKwA9AFsAUABTAEMAdQBzAHQAbwBtAE8AYgBqAGUAYwB0AF0AQAB7AE4APQBbAHMAdAByAGkAbgBnAF0AJAB4AC4AZABpAHMAcABsAGEAeQBOAGEAbQBlADsAUwA9AFsAaQBuAHQANgA0AF0AJAB4AC4AcAByAG8AZAB1AGMAdABTAHQAYQB0AGUAfQAgAH0AIAB9ACAAfQAgAGMAYQB0AGMAaAAgAHsAfQAgAGkAZgAgACgAJABwAC4AQwBvAHUAbgB0ACAALQBlAHEAIAAwACkAIAB7ACAAdAByAHkAIAB7ACAAIAAgACQAdwA9AEcAZQB0AC0AVwBtAGkATwBiAGoAZQBjAHQAIAAtAE4AYQBtAGUAcwBwAGEAYwBlACAAcgBvAG8AdABcAFMAZQBjAHUAcgBpAHQAeQBDAGUAbgB0AGUAcgAyACAALQBDAGwAYQBzAHMAIABBAG4AdABpAFYAaQByAHUAcwBQAHIAbwBkAHUAYwB0ACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACAAIAAgAGkAZgAgACgAJAB3ACkAIAB7ACAAZgBvAHIAZQBhAGMAaAAgACgAJAB4ACAAaQBuACAAQAAoACQAdwApACkAIAB7ACAAJABwACsAPQBbAFAAUwBDAHUAcwB0AG8AbQBPAGIAagBlAGMAdABdAEAAewBOAD0AWwBzAHQAcgBpAG4AZwBdACQAeAAuAGQAaQBzAHAAbABhAHkATgBhAG0AZQA7AFMAPQBbAGkAbgB0ADYANABdACQAeAAuAHAAcgBvAGQAdQBjAHQAUwB0AGEAdABlAH0AIAB9ACAAfQAgAH0AIABjAGEAdABjAGgAIAB7AH0AIAB9ACAAJABkAD0AJABuAHUAbABsACAAdAByAHkAIAB7ACAAIAAgACQAbQA9AEcAZQB0AC0ATQBwAEMAbwBtAHAAdQB0AGUAcgBTAHQAYQB0AHUAcwAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAgACAAIABpAGYAIAAoACQAbQApACAAewAgACAAIAAgACAAJABkAD0AWwBQAFMAQwB1AHMAdABvAG0ATwBiAGoAZQBjAHQAXQBAAHsAQQBFAD0AJABtAC4AQQBuAHQAaQB2AGkAcgB1AHMARQBuAGEAYgBsAGUAZAA7AFIAVAA9ACQAbQAuAFIAZQBhAGwAVABpAG0AZQBQAHIAbwB0AGUAYwB0AGkAbwBuAEUAbgBhAGIAbABlAGQAOwBBAE0APQAkAG0ALgBBAE0AUwBlAHIAdgBpAGMAZQBFAG4AYQBiAGwAZQBkADsAUgBNAD0AWwBzAHQAcgBpAG4AZwBdACQAbQAuAEEATQBSAHUAbgBuAGkAbgBnAE0AbwBkAGUAfQAgACAAIAB9ACAAfQAgAGMAYQB0AGMAaAAgAHsAfQAgAFsAUABTAEMAdQBzAHQAbwBtAE8AYgBqAGUAYwB0AF0AQAB7AFAAPQAkAHAAOwBEAD0AJABkAH0AfABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAtAEMAbwBtAHAAcgBlAHMAcwAgAC0ARABlAHAAdABoACAANgA="
  2⤵
  PID:4228
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAnACAAJABwAD0AQAAoACkAIAB0AHIAeQAgAHsAIAAgACAAJABjAD0ARwBlAHQALQBDAGkAbQBJAG4AcwB0AGEAbgBjAGUAIAAtAE4AYQBtAGUAcwBwAGEAYwBlACAAcgBvAG8AdAAvAFMAZQBjAHUAcgBpAHQAeQBDAGUAbgB0AGUAcgAyACAALQBDAGwAYQBzAHMATgBhAG0AZQAgAEEAbgB0AGkAVgBpAHIAdQBzAFAAcgBvAGQAdQBjAHQAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIAAgACAAaQBmACAAKAAkAGMAKQAgAHsAIABmAG8AcgBlAGEAYwBoACAAKAAkAHgAIABpAG4AIABAACgAJABjACkAKQAgAHsAIAAkAHAAKwA9AFsAUABTAEMAdQBzAHQAbwBtAE8AYgBqAGUAYwB0AF0AQAB7AE4APQBbAHMAdAByAGkAbgBnAF0AJAB4AC4AZABpAHMAcABsAGEAeQBOAGEAbQBlADsAUwA9AFsAaQBuAHQANgA0AF0AJAB4AC4AcAByAG8AZAB1AGMAdABTAHQAYQB0AGUAfQAgAH0AIAB9ACAAfQAgAGMAYQB0AGMAaAAgAHsAfQAgAGkAZgAgACgAJABwAC4AQwBvAHUAbgB0ACAALQBlAHEAIAAwACkAIAB7ACAAdAByAHkAIAB7ACAAIAAgACQAdwA9AEcAZQB0AC0AVwBtAGkATwBiAGoAZQBjAHQAIAAtAE4AYQBtAGUAcwBwAGEAYwBlACAAcgBvAG8AdABcAFMAZQBjAHUAcgBpAHQAeQBDAGUAbgB0AGUAcgAyACAALQBDAGwAYQBzAHMAIABBAG4AdABpAFYAaQByAHUAcwBQAHIAbwBkAHUAYwB0ACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACAAIAAgAGkAZgAgACgAJAB3ACkAIAB7ACAAZgBvAHIAZQBhAGMAaAAgACgAJAB4ACAAaQBuACAAQAAoACQAdwApACkAIAB7ACAAJABwACsAPQBbAFAAUwBDAHUAcwB0AG8AbQBPAGIAagBlAGMAdABdAEAAewBOAD0AWwBzAHQAcgBpAG4AZwBdACQAeAAuAGQAaQBzAHAAbABhAHkATgBhAG0AZQA7AFMAPQBbAGkAbgB0ADYANABdACQAeAAuAHAAcgBvAGQAdQBjAHQAUwB0AGEAdABlAH0AIAB9ACAAfQAgAH0AIABjAGEAdABjAGgAIAB7AH0AIAB9ACAAJABkAD0AJABuAHUAbABsACAAdAByAHkAIAB7ACAAIAAgACQAbQA9AEcAZQB0AC0ATQBwAEMAbwBtAHAAdQB0AGUAcgBTAHQAYQB0AHUAcwAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAgACAAIABpAGYAIAAoACQAbQApACAAewAgACAAIAAgACAAJABkAD0AWwBQAFMAQwB1AHMAdABvAG0ATwBiAGoAZQBjAHQAXQBAAHsAQQBFAD0AJABtAC4AQQBuAHQAaQB2AGkAcgB1AHMARQBuAGEAYgBsAGUAZAA7AFIAVAA9ACQAbQAuAFIAZQBhAGwAVABpAG0AZQBQAHIAbwB0AGUAYwB0AGkAbwBuAEUAbgBhAGIAbABlAGQAOwBBAE0APQAkAG0ALgBBAE0AUwBlAHIAdgBpAGMAZQBFAG4AYQBiAGwAZQBkADsAUgBNAD0AWwBzAHQAcgBpAG4AZwBdACQAbQAuAEEATQBSAHUAbgBuAGkAbgBnAE0AbwBkAGUAfQAgACAAIAB9ACAAfQAgAGMAYQB0AGMAaAAgAHsAfQAgAFsAUABTAEMAdQBzAHQAbwBtAE8AYgBqAGUAYwB0AF0AQAB7AFAAPQAkAHAAOwBEAD0AJABkAH0AfABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAtAEMAbwBtAHAAcgBlAHMAcwAgAC0ARABlAHAAdABoACAANgA=
    3⤵
    PID:2940
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-MpComputerStatus).AntivirusEnabled""
  2⤵
  - Executes a command shell one-liner
  PID:6300
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-MpComputerStatus).AntivirusEnabled"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3440
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-WmiObject Win32_logicaldisk | select Access,Caption,FileSystem,FreeSpace,Size | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3856
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance win32_VideoController | fl *"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:640
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "gp \"HKLM:\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\*\" -ErrorAction SilentlyContinue | where MatchingDeviceId $null -NE | select MatchingDeviceId,HardwareInformation.qwMemorySize | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Hide Artifacts: Ignore Process Interrupts
  PID:4620
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance win32_desktopmonitor | fl *"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:820
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance -Namespace root\wmi -ClassName WmiMonitorBasicDisplayParams | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6236
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.Screen]::AllScreens"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1204
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance -Namespace root\wmi -ClassName WmiMonitorConnectionParams | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6496
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "gwmi WmiMonitorID -Namespace root\wmi | ForEach-Object {(($_.ManufacturerName -notmatch 0 | foreach {[char]$_}) -join \"\") + \"|\" + (($_.ProductCodeID -notmatch 0 | foreach {[char]$_}) -join \"\") + \"|\" + (($_.UserFriendlyName -notmatch 0 | foreach {[char]$_}) -join \"\") + \"|\" + (($_.SerialNumberID -notmatch 0 | foreach {[char]$_}) -join \"\") + \"|\" + $_.InstanceName}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6180
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0" /v FeatureSet"
  2⤵
  PID:720
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0" /v FeatureSet
    3⤵
    PID:5044
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic product get name,version,vendor,installDate /format:list"
  2⤵
  - Executes a command shell one-liner
  PID:5244
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic product get name,version,vendor,installDate /format:list
    3⤵
    PID:2324

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 76f5738a18ad55c6fee5fee44af7fb915cfb39cdf02ba5063adfadd915cdbcfe
MD5 9caa5c8f184b70795c0a2e9d9c931329
SHA1 77b5adf88c3046469f9efb594f6c29d5d94b5798
SHA512 496b8c89ab4a598c734c3631bf5ef7e96cbbbca359e147bd45c414c1d755711d2caae80e79f1497e199b1ead137874bdeaa6525ea82cf63129f15da71ac5823d
MD5 SHA1 SHA512

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
TLSH
T1CE51EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 948B
SHA256 efb112f579616e7e8161092a898f39d984e84340cd5b5dd560e6babbd99051bd
MD5 379e50dabc1ded4976cd0fdcff56dc38
SHA1 0ced88a92da575102adfa534032bf0a7e0949c76
SHA512 fae80d885d1e855e8783dc04702b23870b21ec267f6c4f806200be614fac06428fdf8b6193c79410e62c8ea94e3779747165970c9f1ec223ecb35b5c89bff18c
TLSH
T1F6112663F78C8960CC861639509DAC51727686CB819EDF9F7FC0C210E1BF584CB61294
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 39319b925401a80d0ae21f4939bef240b502cc3d5c7888d6b129e46e9725b766
MD5 617d85ff0f001d274e6288cda18ca5a6
SHA1 8c3a77941cd63b213d47e35774f4a21ef4ff92ed
SHA512 ab580aa49f4c7f85afef78a24824b313148910c4e062e8bcde093c547bcbd04e1abff8b45a2740663c7483d1f938e9d70a5ede00ab0b11594fa15b343f8f170f
TLSH
T194215627B3DC8921CC96163A109D9C1176B683C7819EDF9F6BC4D614A07F999CB61290
MD5 SHA1 SHA512 TLSH

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Local\Programs\lostinwinter\chrome_100_percent.pak
Size 132KB
SHA256 86f6b8ffa8788603a433d425a4bc3c4031e5d394762fd53257b0d4b1cfb2ffa2
MD5 a0e681fdd4613e0fff6fb8bf33a00ef1
SHA1 6789bacfe0b244ab6872bd3acc1e92030276011e
SHA512 6f6a1a8bfe3d33f3fa5f6134dac7cd8c017e38e5e2a75a93a958addbb17a601c5707d99a2af67e52c0a3d5206142209703701cd3fab44e0323a4553caee86196
SSDEEP 3072:tezwJCGIekwf9W2bg3yhPaL2o418Gb0+VRLf0ld0GY3cQ3ERVm2I:tezw1Iek+42k3yMK18Gb0OV8ld0GecQJ
TLSH
T185D3D0D7B3F4EE7DCA6756F7A62540B1ECB386280691434B078BD8752A26748DCC8783
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_3ni0lq3b.qlo.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3ni0lq3b.qlo.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE.electron.txt

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\LICENSE.electron.txt
Size 1KB
SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
MD5 4d42118d35941e0f664dddbd83f633c5
SHA1 2b21ec5f20fe961d15f2b58efb1368e66d202e5c
SHA512 3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63
TLSH
T1B511861E726453721C56136055766C84F12F725FBAAF2784246EF384233746CE5FF844
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSES.chromium.html

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\LICENSES.chromium.html
Size 8.8MB
SHA256 6a717038f81271f62318212f00b1a2173b9cb0cc435f984710ac8355eb409081
MD5 2675b30d524b6c79b6cee41af86fc619
SHA1 407716c1bb83c211bcb51efbbcb6bf2ef1664e5b
SHA512 3214341da8bf3347a6874535bb0ff8d059ee604e779491780f2b29172f9963e23acbe3c534d888f7a3b99274f46d0628962e1e72a5d3fc6f18ca2b62343df485
SSDEEP 24576:cpD6826x5kSWSsRinoHnmfm646a6N6z68SH4SApTJ:cHSek
TLSH
T17B96A52F7F48037306C642627B8B65CAF21E903F3B561A54345CD1681F6BA2983FF699
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\chrome_200_percent.pak
Size 190KB
SHA256 8c1ae81d19fd6323a02eb460e075e2f25aba322bc7d46f2e6edb1c4600e6537a
MD5 c37bd7a6b677a37313b7ecc4ff01b6f5
SHA1 79db970c44347bd3566cefb6cabd1995e8e173df
SHA512 a7b07133fa05593b102a0e5e5788b29488cb74656c5ee25de897c2ba2b2a7b05c0663ade74a003f7d6df2134d0b75f0ad25e15e9c9e0969e9453b7fc40b9f8bb
SSDEEP 3072:ADQYaE/N6Mrvy/3JP29W2bg3yhPaafR54x5GMR+F44ffbdZnYw9p4AbIVGYoDd+y:ADQYaSN6svyd242k3yxgx5GMRejnbdZR
TLSH
T1ED14E1C7A3B8DD7DC9670AB3662501F1ECB211395AB6525B03DFDC357A56BC888C8283
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dcompiler_47.dll

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\d3dcompiler_47.dll
Size 4.7MB
SHA256 7353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d
MD5 2191e768cc2e19009dad20dc999135a3
SHA1 f49a46ba0e954e657aaed1c9019a53d194272b6a
SHA512 5adcb00162f284c16ec78016d301fc11559dd0a781ffbeff822db22efbed168b11d7e5586ea82388e9503b0c7d3740cf2a08e243877f5319202491c8a641c970
SSDEEP 49152:KCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvhiD0N+YEzI4og/RfzHLeHTRhFRNc:xG2QCwmHPnog/pzHAo/A6l
TLSH
T1AA367C5673EA40B9C1ABD178CE479213EBB1781403345BEB4190C669AF73BE16A3E734
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffmpeg.dll

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\ffmpeg.dll
Size 2.8MB
SHA256 9db39b8556ef7cd73a8f600c931b833fba4be852f9af388795768d2d8df85806
MD5 04349fd7adc69df3157cb68b4f5e255a
SHA1 8c9f2085ffcccedbab7396e98f25784abf53ddda
SHA512 719fa88aba80aa4b3bbc7de2987398ecef2be20ac819caf4191e821771396f07db8575a47dd1a9db4b7dde28c839ed3c29bfcb02553f757376c2c7b15d7a48fb
SSDEEP 49152:kdJI9P5iic3mTBxXo2EUkT0v98gTf6yfJrhvO/FLl/6UjiGO:kL1IXoTPT0iqUjZO
TLSH
T12AD5AE07E6DA40D9D01AC070879FA233F62134468B24A7EF1B9196252F7BFD46E3E764
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\icudtl.dat
Size 10.2MB
SHA256 f5170aa2b388d23bebf98784dd488a9bcb741470384a6a9a8d7a2638d768defb
MD5 e0f1ad85c0933ecce2e003a2c59ae726
SHA1 a8539fc5a233558edfa264a34f7af6187c3f0d4f
SHA512 714ed5ae44dfa4812081b8de42401197c235a4fa05206597f4c7b4170dd37e8360cc75d176399b735c9aec200f5b7d5c81c07b9ab58cbca8dc08861c6814fb28
SSDEEP 196608:hpgPBhORiuQwCliXUxbblHa93Whli6Z86WOH:n8wkDliXUxbblHa93Whli6Z8I
TLSH
T1B8B63803A2FB4EC2F9F76F31D8F452679527BD496E32805A11042F3B5C336908A65BB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libEGL.dll

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\libEGL.dll
Size 477KB
SHA256 f1430eb55200da71a1d4be09c4f17b4c04f17ab87ca1b2b3a114592e3ea8044a
MD5 f9b98e961f078fc52a741182c5a3e016
SHA1 671f226b0eace259c6db219128f51bd6add920d0
SHA512 66e09d9605908feb456a170a40547ad97208ae5bb23bf4012d23fa6353a3f5e0af0d327a9b2ede2d0d8a92f43176f80aae72e0f01067d5887e76447f252747d2
SSDEEP 6144:30eGPBF+ef1YO/RzkMzVy+wMIaNlCf9TCIKdyQqmlNCcyQ:30xJF+C1YO/RzkEpNYfJCI2qmlNCcyQ
TLSH
T11CA47B15B79854A9E06BC470CA534652EE72B4960F21FADF0394D2392F7BBF85B39320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libGLESv2.dll

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\libGLESv2.dll
Size 7.3MB
SHA256 be6bc168af3bd1aa9a54f46f4c63043c8a9894247699957a46c96fdca646aac0
MD5 3c47cfecb8f182fcbaf09bec244f690f
SHA1 7812fce226d6dc1d64b915ceb3be49e2ce8442e9
SHA512 74fd1155cd195866326272e6f9d2a6ee83c68ce99860b36f76acc33c4bd4ebd636624c6b35f27edf3d1427ce13231da97a9606d57cc2fbafd78b67dcaf15667f
SSDEEP 98304:W25fwjauRFQiVcm7upOyPQtivn0TiVPHP2Z3M1o:W2pfIFQA7upZvZMM
TLSH
T10B767D13F69640D9D05DC2B8DB5B9533FA31B8950B20B2CF2A9417212F7BBE06B7A714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

af.pak

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\locales\af.pak
Size 446KB
SHA256 2b7a1625342c2b34fd220dba6b416786595dbf625948f5be7ddc52bf7e7116d2
MD5 6b8c0f6213208fe201ffc8218a51fc20
SHA1 12bc414da10964c11c31a3a44f0a76352b94724f
SHA512 9544568bae24a193f81ca84f5c4041d8c69f4b05c73ed5a4e216d4f3a948de8c28c66ef93d21e0c80763c13ff35197969cbf18d4759a0dc3e2f8c57ad56ade48
SSDEEP 12288:+R2loaNOk0o+wZqSMKVQ2uM2Z12JynAyPIVfNdgSTCSQ2fs37KvOb5t/tn6Abiay:VDck0ofcSMaTuM2Z12JynAyPIVfNdgS3
TLSH
T19EA42C06DB91273D09A07696BB0846F7BF9CA26CD770B2BADD9D82360562EFC017D1C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

am.pak

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\locales\am.pak
Size 726KB
SHA256 fd0d603e89b2514572f8c03f7479f395b2012bd5ccbeb89366b813e8f02a557f
MD5 cad8ef0ed379d74fac45391c6dcbb14d
SHA1 7085b80b08bf88ba5cb4d634f2e1a5be6a4f2b91
SHA512 1f91700d06d30db22821a9ccbf1e743d1490588e0ccdef08fcb18d9444d75593e98ea35e5d69f20ac921bf4ae2b385cdf8f2e7610f0968be36dae78cfdc708be
SSDEEP 12288:ewwXTZou7fVIx2TERZ3ej5dMNzLY5t9ZSVrBO0Pcx30jH8+F:epXTZlVIxJRZuj5dMNzLY5t9ZSVrBO0d
TLSH
T183F499547EF9F7570F8E8A19A4320E4E9594AD4652813C38C35AD3FC2B2EF1B4DDA218
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ar.pak

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\locales\ar.pak
Size 793KB
SHA256 c141fab5d80ef650198ee0e396d14f96cab75c39299e396788efaab5e8543e87
MD5 a5b81a0af153899c92bf6966b778fafd
SHA1 bf18447f668bd284bc37116a0e9018e446642cc2
SHA512 693d94eda17ee0b3d9865557071b5632e15bfc3180f7c78195d961e5825ad13bc0f35645f0c2ea52d46a4cfe5815d06211a6d61ad9162851926c10e06e244ada
SSDEEP 12288:zGnCr1B0h5/N/REWH4LzWvwU5Twik9b5uNiH+32qeTT:zECIER75D+w
TLSH
T19C059BE21B2984720B96DF0FD1E23668D872BD23EB4BFC3124934A2156D7513E74E678
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bg.pak

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\locales\bg.pak
Size 827KB
SHA256 bc7047b3d87646a5350cbdf983ea859b97a49a82e5a13d91ec1c410de6ee087b
MD5 47891446a74834aabd2c5d6e5eea7c9a
SHA1 0e0b36a3afda165df00f3bb10624e3d2591c15de
SHA512 d4802b616779cd5a204be5fc439778afa86192aaea0b94cf10bde3afb2ef3774076c30e6aa5d6edbd3dd7368b9ae0401eab1d4e75bdae5d02774826b591bcb45
SSDEEP 24576:64uChsqfaElYMdAs1axUjHh373Zj93aAK5kVDgQwRunpKd2ao51JqueRSnQFwN/e:64uChsqfaElYtUjHh373Z53a1kVDgQw3
TLSH
T13C0524A15B9A68DF0101F45F98087E093CEB94FE3FE7879241642DBD39F10B486BA64D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bn.pak

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\locales\bn.pak
Size 1.0MB
SHA256 8ad04a66e23db319fe3195d1309569b9b35e65571c69376bf39a4e79460b557c
MD5 bbd111c6479de0c6753e5e29a41ada10
SHA1 eb29c2ba8ced9e060a1ae4efa435f9b4b273ef13
SHA512 055b565c990cb2f5b21558595fc0968d99c102595aa9a53ece7be5a61d3c474c74daca7ad3c24d534e9ea2404350e71d9bbcb698353c202537f782c3db07e498
SSDEEP 3072:Tc2mIp84RjQJFQPFESdYObWEKNm2EadKZ0ZfQ0/QeIyTEPukkBBbpUDDM5ciXldW:wbIqqVF9d9KN+2IyoPubBbf5FlI
TLSH
T15935EE209C6E91B2A8C5CDC9434C6370C5236E9B9B61F74DDC17A24938ADC3C8DADDB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ca.pak

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\locales\ca.pak
Size 503KB
SHA256 3666b428ed75fa7ad06d812fbfef6b7c9d80300da4bf1d8b0f78a52046c43f4d
MD5 ba3a70c271a87c53d7f36483e11dd035
SHA1 962680e8825ef25463658fc74b660d5315c3458e
SHA512 b6a5764d70e9b2e55f2609477f1bb2d568ea7eb8e51ce7bdec54b6b5221646e5927db5bdac0e3bfe61542eba0109ac05b6a0a2c4788d3674511316c37ca992a6
SSDEEP 12288:AuZS8LVt4Y7kcELygV3z5PAF4N3Mw2juwHzejm0t3lvq8E9oCRaIs3cmlLEY2CJX:3S8LvP4V8R2S9lMN4MZRg5/5Uiq
TLSH
T16DB409239FC93B6744D2320AFB46C217F48CA9847B06D254F5AE1B1622CCADCC677AD5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cs.pak

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\locales\cs.pak
Size 517KB
SHA256 359b49b141d15256b76cc1fa50eda0829abac7f0e8cc20e41455dd65e87e20e2
MD5 208a0b0f999e2e835f986b062f7786bf
SHA1 d76a82f148e8eb29ec384768ab1cd4648022f7d2
SHA512 8e54294f8c58c9ed597e74a3c9c656977c59a051f3229b97029da5d082e8dd9a75b9ef1e3bc64e0964530b67dfcfe9b65a08d50ce6fcac377948aaf4aa45d6b4
SSDEEP 12288:NH5FlUsvD1PyvJQ5QW50K8VPDNOQ3SCmPs:Fqw16vJ2950K8V5ObCmPs
TLSH
T15DB44A1EEEA26435888002497FBE4128BC1E83540B6FB5AB6CCF9D91217577ECEF4D58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

da.pak

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\locales\da.pak
Size 468KB
SHA256 45f036a650bb91a3812646b8fac57df10956d75e1bdb85a8067cc16c7d56c428
MD5 9aa3750deb43d8432ca826523a831f11
SHA1 a8f97b978ea43f47b2c471bf6ec451901bd9ac7f
SHA512 e4bba53992f482b75fc394d813dccd04f83fcec8e5040d640e37ef9ea3eba6d93feb96399bc174d2b74a6c37ff057272ecba2db02b8aa5f3bf0113134d3b6d7a
SSDEEP 6144:TiOAtdgpzV0qV5cU3HVEs7a7wlTwUJwa7obRR2vJub5/NrXBDUd4vTGqfwI:TibkzHzaoQR5Vr3Tpz
TLSH
T14EA44A4B9C9C732F89AD4B65F3108DA7EB5D543CC680264FA5D8943A0ACFC6097BE1C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

de.pak

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\locales\de.pak
Size 499KB
SHA256 e92b111a23bfac2ffe3cd0603ab31096a296343059dfdb606c4f71600ad00807
MD5 b29e2350901a6e9b5db5c43abb9e6ffd
SHA1 f7bd8f2674de562c0fe48b9a6efbb1168169c7ed
SHA512 e359d964deb19a3b2a634cc35bb78b951bd249097e9e4f7eed1ab8448b8bb7c5f976a3a2e5501813fe4bf0dd4a3fa92a1b6ca7431c8ce04a5be992b8006a4715
SSDEEP 6144:NbDzb9EkvgnfsMuxRnY43K7Up7aD3gXra/n3RaILL3AnO1a265iM5vRvmTzMRTIZ:NbxxvKsde43K7UpugbaPBSwS56m8CCga
TLSH
T13AB40703ADDF625EC78673613305CDB77B19E26BC346312688EDD13B660B5B282AC536
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

el.pak

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\locales\el.pak
Size 907KB
SHA256 aa71a264558696cc04ab62c6c6ecb0a0c307a98d2ae5755b8cff2bea5ed255cd
MD5 ef13645b41573efa9ecb292cde3cc64e
SHA1 39e12854334d96b25a61a1e4f7cd9f5f39fb1a8d
SHA512 335b77e3adbb7e6329a2614634a5c2ef9fea705414b57bd380147863df3fd7c6dd5d809419ad3e1469319621edfdd4fef048fbd1f36737ea1da08515baa6ecea
SSDEEP 24576:TBtbxYcXPdFgx11KxiMc9u2JXDsSYSmqHMuD2fpBLOj3BAVH8+Vdc7tNDQo3sEtP:nbxYcXPdFgx11KxiMc9u2JXDsSYSmqH5
TLSH
T15B15BFEFB4542DED8086950785D8F07C6BC62D6CE749CBD86629CB60BDF80718A22D1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-GB.pak

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\locales\en-GB.pak
Size 408KB
SHA256 2ffb3d6354131844f41a629697b8bfff23ad53d4f849a30f1426a7de31cec56d
MD5 a3f73c57754239c916314067aeec7e7d
SHA1 f20a2781daf583906054c0e1b7f7004a4a99a234
SHA512 ecb2fbbd66322c9802e507c50f4bad0ad8f266d616cf13f00df7293adeadd7297de56dcadc6348caf2af0fd520745dc2ebc01ae7e9a73c0833527387d0003e67
SSDEEP 6144:pZWq7hqlh7GMP9eRn/LfaY1+/845pDSQBE0RbhU:z3uGMun/7o5pSsU
TLSH
T1B3943C1FF744226A069312627B0AA6A2FF26D06CB35116563CBD802C33B6756C3777E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\locales\en-US.pak
Size 411KB
SHA256 e4f1a09dd11cd6686aabe1cf51e6ede6028667725471fc59ff38354cd9590c9d
MD5 bfbe0fa420b8db37cb9aeb78bb65f3b5
SHA1 73b75d327238abaf25b13525aa9bd5f52c822d4d
SHA512 4d73bb4054aeda3a5feb69018cba636e9192306bc2787778a03c8d829437d6f1ee90087b1a3e57c230469e68fa232a87469546040f6495bdf9d8c4b99fb22758
SSDEEP 6144:Oa7qHeKLe9gOmUp/9meKMP9e7X9ifaY3yzq5JdSKn0F/lOSwH:9Boe/bKMwX9cj5nSwSwH
TLSH
T16C945C1FF744226A069352627F0996B2BF32D06CA35112563CBD812C33B7B66C3776E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

es-419.pak

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\locales\es-419.pak
Size 496KB
SHA256 e8b21712259df34917149cb3c7804a93d80065f95c35512a7c0ae55c3613773a
MD5 28933b5595a54ca306b49c91f6a2670b
SHA1 b47e8ca0c81fd23b284b11a6b93b74b589c79f45
SHA512 4df2efd6527d320963f8faf825f4a8a32bf4abc84b90ff2cf6f0e48c25f6e859522312abcae5aab06f4c14d4bcd536ef8345e605629455cf6cfcb3076fca1465
SSDEEP 6144:DvhPA15FxN8P4i8lRp5YrmB5mLFENIKYA:xU5Ow7p9B58Fx7A
TLSH
T19EB41A22BAC81F5310E2A389B783D753E4989545F408C29BE9EB876512CCF8CC977ED5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

es.pak

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\locales\es.pak
Size 495KB
SHA256 4db78987dd4a4d6c508aa9322a67d110926618aefba14fd5ec0c4f7bbf38cae5
MD5 c8c72e965d87c26773feb74fb4a73cf7
SHA1 1d5c0f9d8fbaaed95203d9c92547db7211ab293c
SHA512 66a2077fb1f37ee9b8ec80677a066934eec6ebd9be57a460d708a322018cf07f3986b798e178c1b44d5d9a2ea6a91d0fdff4a701e59ec0a83387679d546975cf
SSDEEP 6144:bC8D08xLQrx1+hM73RgTEqpF+E8y1w4Fj05farw3osZQ6PZjHu:+8X0riq7Wnp4y1wEj05Cr2osPO
TLSH
T105B40922AACC1F6350D39389B783D753E4989585B408C29BD8EF876612CCF8CC967ED5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

et.pak

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\locales\et.pak
Size 449KB
SHA256 53be055fb30bc22f428d965ed909b241e995080cbce9d6a763ca7db561ea48a8
MD5 fa3d0a2f957adfc4edab17a3da985da1
SHA1 5b4e9ba195495e53e782a187c621cfa097a4aee0
SHA512 94db969c063781004cc4cd2bf70665acd840b7f29b1e21298c355aee341a112f8ea832fe0421d59142e0a5ae9048a722371920196ea4300bc0dd5c190fd8dae3
SSDEEP 6144:iRTh/T/LituCJ1ONRCOeP+DEmThFC0jmFohH7fSpY0lgtim0DM52ju43sPZCfLab:cTh/bLOunrewtHmFoh09M52j+x
TLSH
T146A43B42617E771B182452F9D337AD23CC9EE7D8B4000D97AC964A1D61EEF8C38B6B58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fa.pak

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\locales\fa.pak
Size 737KB
SHA256 31fb604cd4e35d749e2f6f5d72422190209f6fc705e48dbb9bfba115d4c172c8
MD5 c33e3c9efca7ddcffb36bc1133e6095a
SHA1 e32f4eddb322fa0d870028a1aba71119907d35f6
SHA512 83b830b1540f919b6d661fa3c7f261bd840974057decefdc348bc10eb0383b6b0b9bafb49a0f746b4b0735dd77583df4d0bec6a4ae6012dab3510df2b7ea1517
SSDEEP 12288:1/iwNb+38u313uyqoe+slXcfqEdvRmXzoT4WmdAQifaQ2XxFvGk62BtMX9OxRdp7:db+38u313uyqoe+seqIvRmXzoT4WmdA8
TLSH
T1E1F4C3956AAC9AB16757CA0341D33834C773EF12D34DFE40ACA1076609A5B139F4EA3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fi.pak

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\locales\fi.pak
Size 459KB
SHA256 3f4917da84f78778a81e5f5b64b2c206e511fcbc942dacd22348c82ffa7e2dd4
MD5 d5555b9c7c0b230ed10520b4439be774
SHA1 724677b758376485f40e0064474c2530ecca17de
SHA512 240d1e6ff9e35d8a28780756dc35ccf5ed515f20fc8dee01cc4561db9ed9969545452cebc9584beba0c3fcb657be2cdb76789ca9f6a98793c6e2ec7742c4852c
SSDEEP 6144:3KlTy119i//8e36LTFh2TRtrZs6TIOEysaIuLL5RYWyHrE5WacpoPWmMWO4AMTX0:38y119S/r50a35RYdHrE5WaipKYn
TLSH
T158A45D915219C22137C4D28E7DB0903EF5E9E3DCCC288D9AE943C7D949E99883D7276E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fil.pak

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\locales\fil.pak
Size 519KB
SHA256 98293378007df4fb9a842de7608fef8580f59419d5778ebb5879d6997f1a095d
MD5 24858a34de2b52a57b13fa3212c112ba
SHA1 0cd8ff86d2cacb6201115edc30059f339b905794
SHA512 87308776c125f92f862211b420413d0802e509dbf3cc6873b4458ec3e2dbe1faabcf86d2bffc4b9fc8e8ec772147bf54543b79e8a22a522c59b5ed7ac13607c9
SSDEEP 6144:87Pn6vThIccitD/ty3DQZIbpiWFevNnGFZ338mC5rVms68ARrq8:87PnoFBodn7C5Zm7
TLSH
T1E2B4B611B7402748DBC352E52360682F66E560BC3F827C6E4FBF269B6BA7CD5D270192
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\locales\fr.pak
Size 537KB
SHA256 cdbf514aaaa4f1dd044a2cfb48211273ad11d67fe1a0a11d26a93460ffdeba0d
MD5 a21baa41409b6d326d9607d427ae0510
SHA1 add97bf646fb0a1e4e935d4b56c3715d87dfe22b
SHA512 b08838f09e4d4f14947590171e09aa7f1f29a55e9a74219e5ed5d4f589fdbc009cb11ef9493d53e0f6acf2ac280c4188bbd13572f32771465c58e7ea85a081e0
SSDEEP 12288:LRu4f6FZLiQphDDq6QuaMV5wKzQOtX1Z/MYnYtY2XfyzYi5Qx0JSWkv40wCm7x+Q:VDjsVIv56
TLSH
T162C4E55FADC432CB19C612B3FB12D663DD348248F216E340D89F4695129A8ECD39F6E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gu.pak

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\locales\gu.pak
Size 1.0MB
SHA256 016b9b8154eb0bfa301b9274054d2f6b58da0672821b419a3ffc6ab968f885c8
MD5 b2737893aca922c953fe3084fb343001
SHA1 ce19960333445aba648c323b6d3adaa831d83680
SHA512 5a5407395208bed986484c0d6adc1cb4e04af596c1d117888115a1f7bceb15e3bb9e0cd298556bb00b7a832d9c0c380a071ffcd212346300f3d14d9ba7909793
SSDEEP 3072:9Ran/YMJtXW5zQaX/HIwjAwREJKVMjNiT7llj63rFWlPvpMi5eQWiYJ+WR6/GQoL:9MQ8yzQaza4/WP5c/h6vHX
TLSH
T1633518D0D3B9F07119DA9F7E819E512086695343D67E230051CEEE898801DDF3EEEA9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

he.pak

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\locales\he.pak
Size 643KB
SHA256 1fe1bb311e0d0df953d10c4a2e29b3b9748ea7cce4de35fa43236c5bc702e88f
MD5 e7b9c68284a8fc5cbd5d3f2685fdae9e
SHA1 60cdb64db8112146482b51288efe1bb7c3208cae
SHA512 8cb3d573f67f338270e5d7b3087aa5e2dcc1a1fc344b352a987e929d45242fd359f6ec7debad37612d731f7c88c20593ead153f5c4210d9d8c9e307b9d60227e
SSDEEP 12288:0WaVwLhOxS28YeqhCTrNzmnpWqo/IkXOl60pAC2XbheQCap125rV5o9zX5plm7oR:0WUwcp5/or
TLSH
T15AE4ACC4B2D452255131AAC39FA8FA286FF3CAB53CA27512CB14526CAC774F4BE530B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hi.pak

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\locales\hi.pak
Size 1.1MB
SHA256 ef7cd76edf1892f50baf5ea15911538112d267bb0a22cc2b2bee8e0d9325e879
MD5 e97e1642586fc34c7113f02b39b5d0b0
SHA1 2864882fa0f9a26a2a5a455a9116fe8af031955f
SHA512 b37d970703e40c49e2f1368f9a7460e441e88fec27194b4cef401e3193513bbd34896d9bdb20ee295ba229b1774fb93f24ae016d6aa89b2ed1cd8acb02eb653d
SSDEEP 3072:h+JghtiGrD78pIF8V/BB0ZV1dsuOlRLXW3XHij0TByntDPtDlSp1s4u/8WLw3kw9:hh3isiI5r5MhvM
TLSH
T19C35060CEBBEF3B55DEC3C8A32890D37D59D3674A3E5525348D5B3EB9844CB4046A2A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\locales\hr.pak
Size 500KB
SHA256 1e073014f52a7ab6a3af811a491a5cbdb3ba71e3bea883967012dd266d8144af
MD5 750ed183ac9bc6bd7b3ffb6af2f68105
SHA1 f5cd9a8f6e1c7a3a0f7a188c83b61725753ae375
SHA512 265febfa3a92859d7520bf9c3d6a803a5456f1ee3f6f5550f8b26d9306ce478899ad7f60c34f86b79c7aa96df0029cd719e238159cf81291bc4a09ecbe00e048
SSDEEP 3072:qV+nqkZ2lNoeJr67Bnua/oaBV08Icuo+wvxr0Xcp/A/SOSAqb+HicHE0uP1z4NUl:qV+q7lXYB3BcwJPFd75br76lU4c
TLSH
T165B41A7CB9F3A7090996A346EFA6434479BE08CCE52597BB7C4F572E0003F4D2AB8159
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hu.pak

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\locales\hu.pak
Size 538KB
SHA256 7ea7c32fc2b691dfc83deb5b4605e35f9c272d6e30f3cf917b91ae1b2eea89bd
MD5 39f01e0e0072f5cffce782eb7df5825a
SHA1 d920b978dc58b313b66ff5c654dbf7a04e2ca513
SHA512 c572a2400f0b8aabef4ded9c90cc07b26a938a2acc3ee740b58eeb205845aae3c592fdb73c558d2aeb93a0c36d5f53636d9d99c3951b6b2ce557b3d37b59a797
SSDEEP 6144:BQuXSwcayJnOL42HPs2P3Ar7ky1XB5VwFZfpaRYGDuU1gGse33a5gRdrztGatePI:BQodGQ5AXB5VwABj/3a55+D
TLSH
T1E0C44B7793B69059B8AC179378647F25592E581BAE3B35F728C3886D30A078D0D83CDE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

id.pak

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\locales\id.pak
Size 443KB
SHA256 7054cc583c09d0efb4e3e46091719a5424e73a9ec434ec598d3da011ca61f208
MD5 8d2fd22edd348b36abc30f9046c02a39
SHA1 ebb5dae4615c86eb78069cc51d234d6e2a0de822
SHA512 9374cdc0d999041bc81422956e89843460502126e3be8a5036b291a81011244ca5a7bdff5792a3e3c60800284b920bba5c1c12203797b9d9e3497f5759113e2c
SSDEEP 6144:E2gSI+w8QabK6s1o8Ff+eVnjHF26miZ4FZ5vVhrwkK5R3SzP7IEji40Hf:ngS4iu6F8lVnjHFXmM4b5vVhAf
TLSH
T145A409632ECD310C494803D5A2CDAA1E7CCD233BAF05B76E8E748F7055A67692726BD4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

it.pak

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\locales\it.pak
Size 489KB
SHA256 28f8c622ff191300fc52f1a88f0f5fd8311e952cfdf32d7960c5cb46b8a58dc0
MD5 b5da12711e5287baec9bd36b01af8440
SHA1 dfcc75ae4f218bbdadef18b676bc6bec2f69f4f4
SHA512 5c7c8b5fc2a99db5e0bc520a9ff557d9fcb0ccd6d60ed811af2a8942d6e0490e5d8ead18efb0891d42d452e3c9b58ff532c928f865ba95a088883875ef42bab3
SSDEEP 6144:IvmWOlVzdZTax92+fMiMNDYISIqRRRsO1StBWRT9Tjex6qipELqb2pzHi9fLwsQO:I+WOlVzdZOH6mZD38NG4KUp05Ccoi
TLSH
T13FB42C36A5D621155A976359E621B045FBAEF8CCFE417218C99B031C23CFE40E2EDB87
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ja.pak

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\locales\ja.pak
Size 598KB
SHA256 b2cd05443b760cc4aeee1a26d602bb7699c6c679c671e56ec1e877c6596c083f
MD5 c896a7bf01490fa3155e7ea89aa43f0f
SHA1 3ee08e8d7f5403e9cf689d878de922e0736c5a04
SHA512 81375d0190806c4f74586f3375c1809e39938b3f7632931c952e6be348b30ba991b1b15cf1e36a7783d6b154667e6ee390d1d9e96e28718830bb5cdf4dbff5b0
SSDEEP 6144:/VdC9MyQWz3tDTNJL+i4+tZKQ2wM9bU5BLYxVD:zNl6tDh9jtZKQ2wMO5BLm
TLSH
T1EAD4407CE3C569369D6193A22C0E76E57606AC5FFCA2363A442DC034B970BCEE415AF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kn.pak

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\locales\kn.pak
Size 1.2MB
SHA256 19a3d8589d950c0740a3415972d88717632771df291582f99eee6baeace798d6
MD5 b91772d30d2455bc23948dd8eef24ed0
SHA1 6cbf8da94febbb9cedf5fc10699ff1bac43c6006
SHA512 028d6432a5889f24c3c1bf20d54d2d2cfb656422234a652c2a45a907030d1ed5cf9dbc2fffb12b4eec34b039fd26568d1f2c137e9b2a2d585370c5025a8d712b
SSDEEP 6144:SLVNh8y1u5+oO0MgtE5HRriE4GCpz4eAHZjcgkKX632ryGqujNlBfDPVOUhfQ5Ql:snfkA6GtYQAaC25E67c5oaUic+E+hPyR
TLSH
T13345CF186DBA7D301BD5106B24EC603ECFF16BD29CAA07D2F4DDD7802C66C6A90869DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ko.pak

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\locales\ko.pak
Size 504KB
SHA256 fecf0a0de6161a13fc0cbd0197ed229efd5a12e43e8f28425d5052909c5a9bd9
MD5 e642c879a311503795a476ae40abb2f7
SHA1 4530121a0f75a60fda8806b9a0c98afa8c7c04a8
SHA512 82322e4d6560fd9a009c895c761ec79e815656bfc327d649d4ef7cdfc80fabe911b114064560a391642a969c84fa51b327bed0b0390131ba547336e6c17f16e6
SSDEEP 12288:wBH4+J83zNWTNTjX9cat8OQ4EVh31KACqX5y7GGp+8Bt3q7hUomrOehlO:wBHFPQ35B8q8lO
TLSH
T1EEB4C7F238DB23CD1193CD82AEF4FA198382D976F7530294ED44CE549E645C74886ABE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lt.pak

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\locales\lt.pak
Size 542KB
SHA256 4210fe468edcbac2a77edee244a25dba7d08cf2fb5520d0196442f74ca44dbe3
MD5 45d769870ded1a4fa1229cc4d967a9f7
SHA1 200c40ce4c39cce57a7ad872c78a87a28ab78474
SHA512 daf99509fbbf2625213eecbb40fdc743398aaf6f3e3a8eb34304c23f07ed2db49001784d8d184bc7e06437cd7693456d788779f3971bb336317e174743953d92
SSDEEP 6144:QnJoa3vjXReMK5xeL4r3SP5MIsE63jEV705jmz+hxaB7zrWCrFz2I16SNU:QlLXReMAg8mmI963AS56z+arWCB56SNU
TLSH
T183C43B0069E3AEFB9B4453CA82E48A78CEFE50005727BC61EC69C79AC43BF452564F75
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lv.pak

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\locales\lv.pak
Size 540KB
SHA256 fd7000f43ec37827cd15b5d361711513b2dbec7a2e3bc98661f2590e261808ed
MD5 00f4e1048dba0364d3158ff9883400a8
SHA1 c1d092bb495ee3c324634d141bf56740be99606f
SHA512 92a1dfc584b327185fc7c6d176b3b7f972a9d3030caa265e4057174a089813acd9be1be064ef5c0d077a6a61d3fd75ef63f275acb05583afda82d3e6366438f8
SSDEEP 6144:m2KHU4XpKbe28DZyJxyNGtVF2GPlz7c4YbUSZbb3n5JygNXE9J5gosRyEAY0SC7s:m2OXcY8i2lzw4XkXn5XE350ypO19
TLSH
T16AC41B959EC68FAA4D909DCB7326D132ADCCD740FE07E112ED6D4B3A510F12422B5EE2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ml.pak

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\locales\ml.pak
Size 1.2MB
SHA256 5186f5a242dec13e9bba20a959dbddf1d71a10287401fe98af3a2a432a0d871e
MD5 d8b90751082791b3bfab2685b3118f7c
SHA1 48fd3985c91da2d4cb92042c992bb8a78d1e1f62
SHA512 ef74be41e12cf7b341822af2a1db2ebdc9030f97237536d8602406cc07d26dfeeeb38a4119b218a1955ffcd763e0b49f813fa78e4a36f3d379f93829c3af2090
SSDEEP 12288:TVRz9A2cMmsbbAxqInxb/D/xn9mMRTAr6DuhQA+tHxy3ewh+5qR7dCds/fv38C:Tfz9zozXry3e75qR7qs/X3X
TLSH
T1B8559D1BA036CD3B0FD102257B4E2FABCD5B9F9140AF668B5869F2628C59F7D0C99431
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\locales\mr.pak
Size 1.0MB
SHA256 8e2ec996c5c4cd36bc5ecb3e611989e86ddefaa9c5279fcc376615162aadc5ad
MD5 57e7bdecf1b4f519112b8150f2475798
SHA1 a8f4b09acab2ef8d82859f8472877fb7c0bbd0c8
SHA512 810421356764b75845a517077eecc753f682ad093f38baaf0930578187a8e462482bdee7783a4b6789aa835a96fe5cc4a4b57957133a2337b5ee2fb75a4ff1be
SSDEEP 3072:hGM+OANY7c6RtEp721ViQm0vLJuVXrMHwrNf3FaMUCyGR93RkR3bntOubz1hzudE:hGcANNaE721A0pJvC3SGINa58pC7t2
TLSH
T17825C24CF7BAF3685DECBC9E36540D3BD8FD21B1C3E9925648E1B3A74884CB401596A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ms.pak

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\locales\ms.pak
Size 464KB
SHA256 ba41290d3895815e066d2d748996310780b9a605bbf5922dfdd8a9fe89db3051
MD5 8766cecd298f53d900c36e9f062f1499
SHA1 0983602cf9308e3f2e6bae944b943a35c4d7c82c
SHA512 7fae11d9e30eda0c9d8bb6a9ea4585523502dbe1d173b03645c9ef784dd0bc7a0b83852d7a60bd8fed3fede0afde5daa0df7f36f639fa448000c0addaba8ff79
SSDEEP 6144:1QIX0oJ3isZU+JsxJwCuRlO0j2sUcSP5slwKsMSYlEFh:tkE3iuU9xJqlOu2j5fhMM
TLSH
T16CA4B5069EDE3118045843D9D2DE691B7CDD3333B706AB2B8DA08FB0126E7A53756F89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb.pak

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\locales\nb.pak
Size 452KB
SHA256 5d1e5e3ad44a50d926cb2687d0c774068bd5f7a100bd65201d03fdf4860c8842
MD5 b4d70a8807830d92548bfc2042914636
SHA1 d360e8859838773f35eff7264ed16ac06d3b2177
SHA512 dcab345551f3566ab90559a211555e350f666c1af9922895f58719619da86af34e4dc55e1b81e7149e926a592c4f1f4b25d85930ae2dccd17d6e4a1e75522a4f
SSDEEP 6144:KTWZXOyXKgtRskL45hz+/DAwOp7fbB9g5moO7HeO5x69422/pjdC84vj:TXpK4CM/DAwOp7fbB4a+O5s9424z4vj
TLSH
T14BA40883EE86B72EF6A44794F01886579B7D942CCD98199B94CCC63E09C7EF092BD1C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nl.pak

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\locales\nl.pak
Size 466KB
SHA256 db0b49131c59385fc616c30885274f3db3353a6ea2afecd8f372948b91a91026
MD5 0e50d897bc342dd0a9b001f3634dbe7f
SHA1 873a7000942b1c88108e3bf85351009ae6771bf8
SHA512 392f24f035494729a347f831aa39649a3c8893a612cbf86e3ed294403af6a779279d11f5970ca381e5f5a533ecdce03d39fa7c79ba2758265dc9bc7f517296ed
SSDEEP 6144:ySgCUcgQ2C6EnCik3gihngHh9gog5HHnp7hh459tCxDGpF9u+58OTn:ySIqtnCieagog5nR459tCxDGpF9uNOTn
TLSH
T12AA4F917AD9E253E19C0A389F6084FBBBF2ED22CC26CE67D94DDD1341443FA941AD489
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pl.pak

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\locales\pl.pak
Size 521KB
SHA256 708a8199432d94a7f70d0412c87c99ecdc589a68d04f0265d364824c4389c9a5
MD5 bb513f086e0e13f38d2727492b59201e
SHA1 9815d9eca3862d0a8b4996e88bfd6fb0df3b9ae7
SHA512 ae65d4d9f7268aa1fe1a230cf7dabeac49467d65bad1f26657b707dc65a09900ea882ee28111897c6fbcfcd7d83dafdaafccc75c47e094673ba6c13e55c43cd6
SSDEEP 12288:b9FZWoOB/ohU/FmXgvh6HA7b0mPeCUd0e3mbUbEmw1QhWRH5EuL4fqiJ:bPntN01Qhc5Py
TLSH
T1EAB46C0D96E59A0E4DB008E6F2E70B3CACDCC848F109D35FE46F452AA15B19EC9BE5D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pt-BR.pak

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\locales\pt-BR.pak
Size 490KB
SHA256 bc99a4bd3520ff278facaecac063eac823339caec9fdf7995eef9a56b0a9774a
MD5 7f10838752b77f50c90328292a30efed
SHA1 5695aa62a326a0b20671cd741fb3f0ca1c249666
SHA512 1015ecb9987931a45756376049083e2981f893850f7371c67c550909c771d0a8f0458fb228ae04c5ccd96a3abeacb21422d6603534699583c5c2a97642337d14
SSDEEP 6144:8Tj47wAJ3EymNBXBLiURlMyET5azJutbjsRhk87p:tcyr5kJ0sRK8N
TLSH
T1EEB43B2A6DCA136605225351B74EDB43E58C0646FD0ACA87DDFF4F06A3DCE40DA33AA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pt-PT.pak

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\locales\pt-PT.pak
Size 491KB
SHA256 9e7e8fab4556b907c915ba6322077c2776d3e1ea5a0915d837e24097d47f3904
MD5 d07542b225fee3c26e56a77fd3586edb
SHA1 851830d67dab5ddc3beec40db609abfdd18cd34e
SHA512 4aabcd14a4977e984254a95fe07612e987397f0515c906da70e45b5fce38d4beb667e6cca2e28c09c5f4fb77e716216b7af6c3fd1eeeede8947211e6e3fa1c34
SSDEEP 6144:BZc5YbB2VzwfieJVJJxhoNzlCOfVY35sKimSRri:GVg35sKtSR2
TLSH
T1BDB419286EDA136605135341770ADB03FAC86645F80ACAC7DAEF0B0672CDF94D6B6F61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ro.pak

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\locales\ro.pak
Size 510KB
SHA256 c6a7ee8c8a0bf9b4b3025bd5bb926462a929c7612fa197acd545ab793ab59342
MD5 e497a97b23a5cf9c3d2c91767c929750
SHA1 798d56dfd663074ff857b4e9c52c20a81c7b0193
SHA512 05276772bb74a8bb6f853a4f362b25e69fc50f068f73c7f0bfa4625176a95cb834337203c9c504b81cc41ed5d71e95a396a587293ab126c551921b39eab1af68
SSDEEP 6144:DFY154JdJYnux4R7XTLH/7FSmo/xOfinKdoGN5GBoC1s2e/m7O3:DF3iueR7XTLjFSmo5OqKdN5mop/53
TLSH
T156B43D2391C82A97299152B2B73634D3EC8E105DF641D28DA1EEC97D10CD9DB852EECF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ru.pak

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\locales\ru.pak
Size 835KB
SHA256 beec322e330c92484a3110b4e17e06ef755a7d6bb0fc8be2645c1838cdbb4a36
MD5 1be652cc23d7b3715eb43e0fd92e5715
SHA1 a4e05dfcaa19685645173a60bfdffe07e47120c4
SHA512 486f7402ab52e755d60e60b1885bb648f42ebd1951ddc65a44a2bb7dd2b782a3cb88cc48cc8b66a2ee00ae9254e95babfd635927ed5c08928360c0b32fd8b22d
SSDEEP 12288:DGCiGVQfQjRo4YS7yMhNKgNzJ9fx+aAka2qSGsN8zqcnYH8eXN2hPO3j/zpbzvM5:DFhhZ5j6dT
TLSH
T1DA058660669E64DE1201F01BDD08BE0D7CEB45FE3FABA35619642D7E35F2024C63E61A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sk.pak

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\locales\sk.pak
Size 526KB
SHA256 a4619eb695409a92b20e0c80a9b3bcccc3162d949df0f8f13148591501639b2b
MD5 69434aa0845d8de0307945a4afbcfe79
SHA1 66f2d80e364e1a1ac87f4ba0581f11c863316980
SHA512 ef2ccfc920c5ce091e36578a0a0f33a178df32805ea203e38067af119e239b97d5303a7dec4369219492573b1fb656d8e3882476ecc4a675b5f133f6bb9f84a5
SSDEEP 12288:sZcnWxNdqsGk2RsNyzir+e/5CvuQLg3HXLPxt9R:HWxNdqshNyk/5lQLIltD
TLSH
T17BB44D3FDBE6581E8F8D0148EFEA7110FDAE4650894EB0A5D40F368724E26EDCA74E45
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sl.pak

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\locales\sl.pak
Size 506KB
SHA256 d7c3a9618c2a527b84717b553639de8eae307a2310e46a7f23fdb6d076cb5b0b
MD5 18f9adf7013e2bafad91567ddf89d1ab
SHA1 e67fa8fff26c6185586f598d4aa6d162e1fa1b91
SHA512 74c8725b0c3cb29ba4fa1685ff73f4b0ad1c72bf4efbf8322d0f7d306937ebcc94cc7b9be70222210975678395c106e78c469823984e9a703daef6821021487c
SSDEEP 6144:2jw4yb07QLr32zTMCB29i2iM8nnbrNjSdRm4ocyxPbPD+DTubVmavfDszt5j34w9:Ww0roCB2TZE+p5LPc2JHjcGi/fzzCqc
TLSH
T12FB41B357BA79E0F0DAAA2CBFEA602107FDC045CD252A2A1FC4F336D5015A3817BD599
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\locales\sr.pak
Size 779KB
SHA256 5cc6b15a276eddbbff6520fcc6e2d6758c8530687e9c31b68eac586adf93d2a4
MD5 4f4fbceea93a61e380b45eec1b95121b
SHA1 0a882e614b483b5a31b66576b53d44b1d1ef1db8
SHA512 771289e10356bf792ba39a3166c6dba86078a1eb0305ef5330fd411a1511124d7a9ad510b19716d11787173cbf8d2dea48887c0296acfd5df58ab1c9c947ed3b
SSDEEP 12288:J6Bgl9zA74ddLYbeHIdN4SGdEDWeUnLYA1785sWMx5xMd8G37gjemS/k/C:6gl91+0x85AxQP
TLSH
T1B60568A19B9E64DB0501F41BD808BE093DAF41FE3FAB975215601DBD34E20B847B939E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sv.pak

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\locales\sv.pak
Size 454KB
SHA256 3788d7e497c95e0336a5b5ed552d752dac6b710d6ab0a16182a80937cf3d5859
MD5 ef3919b004b91e585ad55e50c6a21ede
SHA1 fd6da4cfd71240b118b29c9f6373a1ceac870f96
SHA512 30c02eb9f489b87376481dbd55eeab9468a7a3a394c4593f525c085f686613c2198d46a7d5433f2661323666416d51da5371a7384ad0d005891aae022c769b8d
SSDEEP 6144:mbEWb5XJW9y2wZ820N11OBIrknaItFwxrf1fhn4RFcmi8G96iMjSOwDE/xWcqVRJ:UZ5XJaS05wIrAFAn5v5Fc6
TLSH
T175A41B438A20F526FB72170DB608115B0AEDE25CE7E2958DB8D9C83DAD8BD5805FE347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sw.pak

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\locales\sw.pak
Size 478KB
SHA256 02a7f49c1860304103327389f63b3dc7e95efd1ff1f3076b2fa41b8346854a27
MD5 eadf81c1729a27895dedad5af83c8b02
SHA1 1967845eebd88bd05efc3475b27a2086739ec9a3
SHA512 d0161a4ef9459fb8a8d808f1d5c29148e189204196d7b3194ba568e8eb9ccfe660c76869947bda3b9f9a7572c375402cbe3085a4fbfd3d6248460cbbc156a390
SSDEEP 12288:wqcd3IzbIcvt5cuCERdyU7bQg9Wo97pJ8zvgu35Oib95Z4sKPe/BrufA:TKYza5pn
TLSH
T1DFA4E7629871E0181233518603DDFF731BDCED5C2D2B29A35A46BF4F218F98C56ABE49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ta.pak

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\locales\ta.pak
Size 1.2MB
SHA256 4dfbadff61ab2815a9d723d1dab6b6a8ae4e209547cfa824ff19eb21f640ef9b
MD5 88574f5e972676cdd63c7db6456b6b8c
SHA1 e968cfc2d7d247d95a7f4d2659cb3eae7aacb697
SHA512 134524922ca6c25b2669efd36785edf651f27763acfccaad6edafa6483841bbcd05c8d869e2d58a7700496ad6405b129cdb8e3eb3e40113fab5e29f7142b9b2e
SSDEEP 6144:OSKwklOQTyzvh54P5hzotR1cA25tm1vYpiMyl:OGkrT4zy5hzccA25tm1vYpiMyl
TLSH
T12A450CCE923EEE890F93288F0319536912996155C07BE3A67C766E1198ECC5DCF3427E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

te.pak

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\locales\te.pak
Size 1.1MB
SHA256 002e38131d5f817f0e78e8dbb75fd8a5788e153960918c67a2a397805295bdc4
MD5 ec1593abaa1eeeb1d2d2259249ee6cf6
SHA1 b224d299b4bdcec19f2895eaa00ce20fda0f4712
SHA512 716498992ff7168efc49affd7e12defa652f6174f5419100066906fff0dfad90b25a01df98d0e228476652272477639e4d7b4a131d6dc1e4a2ae48c24557ee2a
SSDEEP 12288:qE19s1l7McKN9CRWtgd49+agb0DQWp5Bi3p1Fm6OiTlC2pFg+NFqPZrOIoXAofQK:x1TW35jM9q
TLSH
T1A44591023A6AD310DAE70273752CF66C49781B8161D6732C1EAFA357EB87D7E0843676
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

th.pak

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\locales\th.pak
Size 963KB
SHA256 fd9ebf10934592d30f81135c485b0e82cc0d6379f5feef03bf41fed5c718ead8
MD5 b248aa1b24968778bde4df23b91665ba
SHA1 d6137a0b3da8c4a1b32910d82e8f846506bfc293
SHA512 9f063f7ca9c9352dffa22d2a90c3969e450c99ec187d3bdb878ae83ec18bb3678cac1c7a06b7b1e27fda0a4edfa70c9eaead1c936822852f23e521693c0e4e6e
SSDEEP 12288:wccSN9LyZYA1T6z1L/LLftDjsAnILwgv1V5UBGsL3fBj8BlzEdq3Ro9lGdI9uLAS:AgV5C5V
TLSH
T12E255C737247D9D479441B5B262A77896B3DAE693F73F8E00089215A73F071A8422EF3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tr.pak

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\locales\tr.pak
Size 488KB
SHA256 9ed3cc6ced3413cdc988bbcd44a73e9780ea08dedab8ee570ac904477b0b39f6
MD5 e7c8e48e531bb5b104a51ee30616d9b7
SHA1 af0988be239591a45f1ff706fb6c184dbe8dd3b4
SHA512 6ed805c98301f13e749a743e5a5081e541050b5a8146741d67aefb2cc00e54ba12ce176ba7ea045dd8e473d2af86a1dbb63a99590ff2085c28ad3fa35adc46bc
SSDEEP 6144:KKQZrFRquxFX50LZhiEqPOdspXHG4lge+54F/R+Pi1h2vdFAMTwAKUb6m:8ZRqUq4FHGz54F/8
TLSH
T1E6B4E98178EF381C8BB9278BD3E90616F89F0766F331F4469A2A9636774535703E660C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uk.pak

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\locales\uk.pak
Size 835KB
SHA256 3e38984a2e08d5c7618075b2a9b348bd3561180ed58684ecfc09a4aa0b8e63a3
MD5 cb6c7cd0e746008997e022359edf3ed4
SHA1 96ed3b52c2dba4745678b35c5a6e38b68b0f4eaf
SHA512 a07c9d9ca1b62fa2e9f4c52cd71ab3891d166cf0a70100357a80a00fffd2d81a5b399b36e4861807dc388052a54ed245010e3009d3513bca96602ed37fad3253
SSDEEP 12288:BjRzrc3Cgnbz/T0hoCiJI/t5CB3IjeAOmEFIOujLNiXEqqbTU/d:5RxAi5PEJ
TLSH
T12A05A9A19A9D58DF0105F05BE84C7A0D7DA741FE7FA6871625A43DBF38F20248A3C35A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ur.pak

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\locales\ur.pak
Size 731KB
SHA256 169bfcdb002f99450eae27784a19a2c298448e84a4015074e3e7a778137b2576
MD5 d2c8cb9b16f23a3a455c596aef373da6
SHA1 2fcbf455ad194287d94a3eff39841f06578ec83c
SHA512 2e5c6f67485ddc5a9cca81cea5978c2f16f73ca79a57212e521f01ffd1e55c11bc1f464876a7d282a82906e399b629c7df1cee24cbf1e5a28b430b7672d675d4
SSDEEP 12288:ExGqYsg5HD8P4WrDD6yACLUj5gDPEFYW7BYcQYriwadcJKwUxuvco/9NjjFpvxR:mGsgwG5KWp
TLSH
T143F40FD2E6BC96B24A21D92780D33C34CB635F13D34BF286E56106C54E9A0139F6DE7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vi.pak

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\locales\vi.pak
Size 578KB
SHA256 33f141beda6f660cfa3eb54eb02f926e0c2c9c0ba78118efafd3dda5af62313e
MD5 86425fe2a6b473486231c1d7b6bb2d9d
SHA1 1346b56f015767447300aa8f97f98be1ba8279c6
SHA512 6e94e07fae6284b7cfb953248c6c79063a86751f530344405267a629de7721ea1a216bdef246d8d20892893c893e24361ecab6e15daa3e708c8f8210d6c69e36
SSDEEP 12288:oe/EnH+crwJ2roEw/aBuAZgsHeW0oEEDOr9g/C508xUmhnAi/wziMHzmwtmd:zEH+crwJ2iafZgsHL0o7C508imii/KiH
TLSH
T11EC4841116E0702680AC553EC6CD540E6FCAE42FF7C18FE56FE529787A221A45F21BAF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zh-CN.pak

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\locales\zh-CN.pak
Size 418KB
SHA256 0962bcf949dc0429d8c3ad77a58a3773d4689c10d1bc1addbf6e5869131c6386
MD5 cf2c96a2475da01b12b77f28aba51c80
SHA1 89ee3552c14fccac540c0179e9daea9c6de45ff2
SHA512 bae513ff9a51a6dc4c4745d51d3aedf946acecf07e6371183215a22fc4b420c90ea0fa820e3a03cbcac639152b17662909c8991e92d5bb3fc07f7f62c7d78a53
SSDEEP 6144:kcF8ku4uTrmzvFkNzh9aG/7C5ccJ67kzDg5CkLNu6ooHH8lW:k5k/u4t2znaJ5ccJ6Ag5VLNu6ooN
TLSH
T163948FA915E8BDEC044640D03729627D7C40B20BF667EF766ED244ED1BA2F9E0717A0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zh-TW.pak

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\locales\zh-TW.pak
Size 414KB
SHA256 4e3532b560076efb7e944a3a1e4817235cf8baef54243d92b974c6b4b7b34149
MD5 1bf9b06b16781e960f148c0d486a1a3a
SHA1 5be97f520de0819b5ae46a24d2e3b703976540dd
SHA512 2531e58cb4e6736c08106422fc7bb1a6e0358d91eea54022c0fa3c20b5bf56b33d1e5ce622898a1c4bd240ecf23379b4b5a71cc6e50e89df3d1ef6528d23f86a
SSDEEP 6144:t7LnNTFwmc/kGE0Jxv232/urm4hmv50Gnzq1Hs0yn7zyRTs:9wmccGt6m4hmv50Gnz+4n7X
TLSH
T1BA947CA608FFDAEF0901F984B7CD062E7C8B746CDD377636FC8918D91E6AB540A52049
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\resources.pak
Size 5.2MB
SHA256 c529aaf037a3bed39e7c5aff8e5999decfc5d8d7b785a2427adbcfb98059d41e
MD5 115fb2bcdf1aea804807abfba6ab49fb
SHA1 38ff655b1b73feed9ec49dfe8b0f7e15a34046aa
SHA512 c57f6753a8e3f4e5301e9e19c71511a6e736ff0ef7ba9ab64cd46c36b74dd8cc4c0ad695c3c9b7dadf091c47b858e647131cd291ac51f1efd0cfebd341e97e7a
SSDEEP 98304:4PjNXMmWPVctFCZISEhyzxh1Z/p6uNXrwrXxVunEVvXjNSfz3hIkrT7s:4PjNXMddCMwhKhz/xpkrXWnEVvXJAqkQ
TLSH
T1B8463322F7245D3AD194A3B6C5BD22336B3655830A70382DB0CF511D0FAC72E5AB5BB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\resources\app.asar.unpacked\node_modules\@primno\dpapi\LICENSE
Size 1KB
SHA256 455dda47a3fc2f58ab06d8e526f490ec43d0fc23a5ea80dd0942644397316d9b
MD5 7bd114b023fa6209fb7b02150a202ccc
SHA1 4451515f9d7b16ce8983abb4e85609fe4162c4d4
SHA512 87ee4dc1da13937055eade250f1f8a357f549c709b9659258c137009060080aca5cfd979890a7b2d662083f4c646cce9af6e20774b58541af9e712fb5f4f1c60
TLSH
T15F11861F72950363189257615569ECC5F12BB14A7FAB1A84346DF209132605CC5FFC64
MD5 SHA1 SHA512 TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\resources\app.asar.unpacked\node_modules\@primno\dpapi\dist\index.js
Size 412B
SHA256 a7ff0225cb5ebcbef8499c6c8ac2be924f584eb375dacb1d8bd3dc6540b510f2
MD5 0b33e83d33b01a51625a0fdcbef42ce3
SHA1 1c29d999ff7da39426b97f2eb31a3d83db8f5fc7
SHA512 1d04caf4fc2e876bdf2a089ae938a41fe4d3f2928aa846709bafd2de236fa8c754fcc84d7e8a5f5734bc1cecc04b395ab9d2114945b35e8c85cd3b9ee8f9799c
TLSH
T1BFE02B177EF5E8EAC64082CA4736D4531EE98CBB3600781AE2CA8AF25315984E490D24
MD5 SHA1 SHA512 TLSH

Submit Download

package.json

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\resources\app.asar.unpacked\node_modules\@primno\dpapi\package.json
Size 934B
SHA256 59f4704391d2247b2a8d029d7338566d47d2ff0cd7477c49343efe93475f7a12
MD5 83a6b767cd4ade2116654eb0a90fec3c
SHA1 07a0f29ddb1c8a48947ee05bb4d6ec3d2abe1df9
SHA512 404ed15686b7d611ba8aeac12e706af75a876502c51e40e48a598d05a9ac89f88902b2830a5c679f9bb7931f5c33bb10da3a32753fdb8c71a9d7b4346a1be8d0
TLSH
T134112336C928C9630BC819D5EC391252A6224C1B8D58FE0D37D2836C8B1D1BF32BD66C
MD5 SHA1 SHA512 TLSH

Submit Download

node.napi.node

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\resources\app.asar.unpacked\node_modules\@primno\dpapi\prebuilds\win32-x64\node.napi.node
Size 137KB
SHA256 da2172ce055fa47d6a0ea1c90654f530abed33f69a74d52fab06c4c7653b48fd
MD5 04bfbfec8db966420fe4c7b85ebb506a
SHA1 939bb742a354a92e1dcd3661a62d69e48030a335
SHA512 4ea97a9a120ed5bee8638e0a69561c2159fc3769062d7102167b0e92b4f1a5c002a761bd104282425f6cee8d0e39dbe7e12ad4e4a38570c3f90f31b65072dd65
SSDEEP 3072:94PTD6FEzMju6bzJKjpEPeTOKvJhEnww+YbRYvPuq:94jQju6b9KilKvJurR8W
TLSH
T1B3D37D4BB3A500BBE176C639C8934A05E776B81517619B9F03A0475B1F237D1EE3EB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dpapi_addon.h

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\resources\app.asar.unpacked\node_modules\@primno\dpapi\src\dpapi_addon.h
Size 206B
SHA256 18280b1135123aff82fbf4188a5aadfc9a5d6fffad9309f72f347f380f2da550
MD5 ea1e5899ec0210d7de4ce325d1d94022
SHA1 464da48d40547cb08a67a1ed38cb0ae8369f2f42
SHA512 6dae672ea822a7dc5e42914def21c019c0fa8aeaf1c27c155b78312d8a33a63ae9a1910dd32b72760578671780b8c37b91ff5e1f6588f08c7fbaaff80d8fb6fd
TLSH
T1C8D022088978380B67E481A73A23FC04BC1CA38D399DA0917D9962893A1AAD0634AA85
MD5 SHA1 SHA512 TLSH

Submit Download

dpapi_not_supported.cpp

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\resources\app.asar.unpacked\node_modules\@primno\dpapi\src\dpapi_not_supported.cpp
Size 327B
SHA256 7c03cec11c438b6d2512239477d9f1b45d6e16763122a3a36458ab339f50d3c4
MD5 c510e65ebcb2fa7c00712e770ec8c692
SHA1 ca1ea3c8340dcf69f344d5eaa884631eef37472b
SHA512 b0b312426b4409c80b45a0f3337069be9870e050dc8b55184fb2bc63532c247089c8d35cbd1f12f0bd2bd38d581566faa74a6469b548a1ad7d837285ad37c178
TLSH
T180E02D8E9229321B53F1819BF213EC10FC0C020A29ADB58032AD908D7B273E2228198E
MD5 SHA1 SHA512 TLSH

Submit Download

dpapi_win.cpp

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\resources\app.asar.unpacked\node_modules\@primno\dpapi\src\dpapi_win.cpp
Size 2KB
SHA256 da37b02fb0babb651244479ea019d229fff1c41ecde74bc06335b5e603d9b30e
MD5 4a55597a2c7466278439452bb708b822
SHA1 eaadcda8f410f2dd1fd9522fd7a2221624dd1713
SHA512 b20efe8026de41dd8c13c6f844455cacc13fa80bc3dd41fef422fb178054a7c8d6f14af8b1d6928e52648ab95a793aee1f996dc2aceead3aa8d317a99aad23bb
TLSH
T154519856BD3A760B18D010477936DC012A94D80503FE71F4B8C20A59B6506FD7EFEBDA
MD5 SHA1 SHA512 TLSH

Submit Download

main.cpp

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\resources\app.asar.unpacked\node_modules\@primno\dpapi\src\main.cpp
Size 698B
SHA256 1ada21451bab629832372d519e366bfb08c80facfefe5a40c76a4f10a697c905
MD5 88934cc736b505ada3d07afe22083568
SHA1 6d1d112f4e7fc943dc5c9ce5ad2f32154aeb2f3a
SHA512 9f45386cba32d13a50360916b0c2f240e43cba5983a86ad80f85c75cd8e6ac2c6b931992842a736e84e234b91fc46a7a66824a3a2748f474cf1bbd22ec138a99
TLSH
T154019E8EA672B44F53D241B61313EC8C7D1D290D1EA8F4746684C3C9F5826DEE1159D7
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\LICENSE
Size 1KB
SHA256 09856b52897c91ab67e7456ef43067019f31dfd3b87fda72e655736b1ebdee55
MD5 daaa6378e66cac5c1de3eabc51c6020f
SHA1 af2953c8dc440c83d917e16ca36146363a283af0
SHA512 ab76e13a535d397ddd8e33caf39fcc9cbdc8b63cb8c5de70e4df328d4a85d19978b1da0a52bd795a2eb77a897ac2ede8aa2e65d17bf286e1eccfcd8ccbffcd4d
TLSH
T1FD11B91E73510B72189A13A055786CD9F23B715F7A5F2E84246DF341233B06CC1FB840
MD5 SHA1 SHA512 TLSH

Submit Download

better_sqlite3.node

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\build\Release\better_sqlite3.node
Size 1.8MB
SHA256 12ec9b3a27810b53168a3ff3014e98062392f7bd511d66138772ae5fc9ee5102
MD5 b14d6d7f6a137c8fa37a38acad01ae43
SHA1 84716092acac22d8be9788eebc8eb70da0cffc3e
SHA512 1fb1e040e1c04faf29e0f64a5ea49150fbbd120b41a0cd517827af03b5b158c70bb6ed9cf6cce8bfc77b8115b45e94471d532e02c4c5c9b925584cc262830644
SSDEEP 49152:PdH8lpFw3VG5qIN1XSL8fxPnsf8cga2gzYHzcSJx4nV9Z9PuW:1HYzw3VGfN1XcwWfReDXW
TLSH
T154958D4BF2B800FDC1A7C079851B160BE776B4051774ABDB1590CA6A6F63FE217BA324
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

common.gypi

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\deps\common.gypi
Size 1KB
SHA256 e71a565cd7733e05efc3a2792b54e260126f03f490325aa2a201202acbbdb315
MD5 bc44eafb20590feef28f6382e0db7ea7
SHA1 db26781b95d0b3e5d97371b8be96d842f3e7c365
SHA512 c8bb9777d8ba552668cda8e21bd5b7dfd57077b1d944b3ff2ea36502d2f2883374824f0e01ac57f9ceb98c9dcdbec3cd8a6c6d0cb8c79bc627c0d20cd34f8f26
TLSH
T17B3187B404BB098FD0AB663F905E6448A52985A30D3C3F74B15D048D0FDD48E83BA1B8
MD5 SHA1 SHA512 TLSH

Submit Download

copy.js

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\deps\copy.js
Size 897B
SHA256 05a2bd41dbd96e33e2fc6cf4bcbc722b4bc8c529813b882f92113d7dbbbece67
MD5 722c2b2dbeee143a14c7ba04edf8e3f7
SHA1 88321c5c15ed00c72570b28e8183b2440bbf6419
SHA512 0537a881c397d0bb0836ff74a881d650d59fc151f0e4ccb1c4f5a9fe84549dc9753b886b3e14534c551c167ff702fae71b58fe4fe90c78b43ef05a4cb2761855
TLSH
T11C115CCF4B4A2678E3F2B7C1EE21E94E046442E47A5A0824C0CC1DC139AB15A78C6DB6
MD5 SHA1 SHA512 TLSH

Submit Download

defines.gypi

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\deps\defines.gypi
Size 1KB
SHA256 1ffa84b8af99780a293dcb7a9031c2dccc8b0d013aef434a35c283cc6c984f2e
MD5 524999771bd340108ce2231797e6eea8
SHA1 3363fb9d4780686c16b0c24fcff6909213fc56fb
SHA512 4b21116b1e0d3ca35c661538d564b392bf39eb4c3bfe3876c3fc935514404028ad1a7c517883fccd45d788743b3bc39f4aafa379b413162ac9e044d6efdff291
TLSH
T1F32167B51B575A0D36BA1417E43C450A7B84E2AB0F3730407050AA684FFC8FE08364BF
MD5 SHA1 SHA512 TLSH

Submit Download

download.sh

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\deps\download.sh
Size 3KB
SHA256 8501c2c20079610f4e1258eec8860502f8b61aa7f444731dedf0c4e561e76947
MD5 7024ae62aaff2df13629bf590f8ba22c
SHA1 abbaceda43d85552d4400ddaedcc9e0b48af4fe7
SHA512 41be27f9dd6455c3a58bce09c06a0a1e983e1b6754c7edd0d869bd5840ce316eb855d6b061237403bb6f2826505b09af3ceceea9f179ba6737fc8f320ff663a1
TLSH
T1238161F7A789067D24C70029A12D61CABA23C32F8B7478484089566C0530AE45FBACFF
MD5 SHA1 SHA512 TLSH

Submit Download

1208.patch

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\deps\patches\1208.patch
Size 597B
SHA256 5d1f22d69fee3551b70a7b7b9b14be43fcfd04dbc8683233667abfa75905011a
MD5 c26f21402ea045fee5214a2af12b8d25
SHA1 9adc0b47f388eaeb40685151ed8e67da4d3382ef
SHA512 3f149123d9000f1e3e285125ace919a25eeb776343c4336671a40b752aec513099976e3b0342faaf306997139d445050e456554dbe05a70fe3e775f57ca97750
TLSH
T198F0F68255F66B9371EDD170811B3DC643DA222CAAF3088E364C5BEF1F4D28D8759C96
MD5 SHA1 SHA512 TLSH

Submit Download

sqlite3.gyp

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\deps\sqlite3.gyp
Size 2KB
SHA256 a009b8f80cf0a944eacaf71a84e590504f353fbd8f8b341138d0c3094e372d18
MD5 ec4186a11866324c718f05aa7070de29
SHA1 78f251a963af25d039dcd82c38deb31723b04a88
SHA512 659279f346bdcea623d26c0619b088852137dd598677f3abf6798fa086292fac6d78b90071d116133162ffb5bf3c275220468727a8e2c8a3ed0ca3aad7dc037f
TLSH
T14F5142A8197F1309A5CA6A7FF95D82C20428A117CEBA3D35B88E44492FED1CC1233F74
MD5 SHA1 SHA512 TLSH

Submit Download

sqlite3.c

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\deps\sqlite3\sqlite3.c
Size 8.9MB
SHA256 90b7189566ea710ee18361b25d893f5cda3fcf43033223a16384762f53e99a85
MD5 2518ed9fc03772d8e6fc3dd4f7d6132e
SHA1 447b1497f7cd89b0b92b02375895409d0645bf05
SHA512 4a9d81dde207a8a1f1279bc7684dd0e148b44430980d773b1a370c9f5c53e431b920ce34b70b0252cd629c63f8f156af374db40155191cabdea4d868bdf610af
SSDEEP 98304:YVhk52MEM6n5Dd6tP6bOuAqgJCltAvNkeVGgbgLACuqFDIoZGOC/yukUYkeZTj9W:GkWItP6Hmukv
TLSH
T161961AF53BC30E2760D39175A76F32D0A219C02F67B4D0947C5CA1382F48AA5967ABF9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqlite3.h

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\deps\sqlite3\sqlite3.h
Size 646KB
SHA256 abd1514e0351f79393d1be882830afdb40a8099e8257f311f0bfdf8486f11bea
MD5 c4411c6ec5c500cc6a3084b90e576d7c
SHA1 12523117df944d1678226af7f36a09bcaf227734
SHA512 b3866dddbced06ac57715358967ed1b522aa5e99f85f2c6438cdc8f26f0b3fcf6e054fa71d9c5ee31ae6729bd8e512d35ddd2402986546c6aa6aaa32fa62dff6
SSDEEP 6144:E+uxMvmZUS9CM+f2ytxt0U7ubWe2KV5FXXUDBlZOYrxMD+u3Qezi2fJ7LdKwlYp8:/ahIJuyr1UT2KV3kjZO28+Hci5i
TLSH
T1B1E4B5B737032B3A20D341C1D16F53E49729E0ADAB715064BC5CC1682B25DA5A37BAFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqlite3ext.h

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\deps\sqlite3\sqlite3ext.h
Size 37KB
SHA256 9a91de0d5e5ccc04ec59041275c67972d6f8894f7543a10033e387b69987beb5
MD5 b6d3948f6fb2a1837f88cdbb74cf7ab7
SHA1 1c212ce9eff02eb9ab8d47abf9ec2ee5bfd64c8d
SHA512 866d3aad278742910ee9a038bee7e3e02b9e2a4de04dd8b41c168e488a901ec6e84365d55988e1024361b94ac4a16564f2d96d592eda898f43b4ec7082082531
SSDEEP 384:Tuz4G/SLqcMgCimTgVYmLEjMhN0/kvINuYY04vFJzIbx:TC4NH7cT4YmeM7nIYYYAl
TLSH
T1770365D36B93005E74FBC541C19B20D1401AEA33FEB3A7E4FE5DA8280F52665A0B65ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

test_extension.c

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\deps\test_extension.c
Size 587B
SHA256 948af88dbf356835f5496c1a3d047fdbcc58f3717aa9bc94d0943d7de2b7cf5b
MD5 e5338de97cb9fffe3bafc7534c249be8
SHA1 9430bda15ed8d152f41f1ee83c096da50c80d00a
SHA512 f336c5bf5f2f93e13864e0f7b71034009592ebe3504f6bc4822983ba304cf71d1040ebb484e155c7b03c43f999908e8fbc25182681ef69edcb5169a94975c3df
TLSH
T119F0ACF2270F24E934DA8421C4BF90DDA220D11CEF30A459E84601C00E741AD003BE75
MD5 SHA1 SHA512 TLSH

Submit Download

database.js

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\database.js
Size 4KB
SHA256 02ea23bdd23d7ac5de0675a2f32fc686e76d5c6a32bd3e3891f360e72e07f61f
MD5 952ebcfa3d8727e8b1d7b681c9f5bf32
SHA1 6168b5f5ed77669b3c6c1f1d526f0eb116bd3a43
SHA512 d2dc310d2e4a491903988ed88228d35e9688e48c9b6180c797fb58f84d1105724ab3933ade92be0e73c8a27fb6f3064449bfe00cfa1dc92919ad53a81af2680e
SSDEEP 48:+FzYIUZFeVxWy3h9zxIEXMOK0ZHQZ27euTqQaqE8E+LC7yIGrtRxtjFvcLd3s03M:ac1ZFjQBG1oQZi9qSvNRBkLveomRz
TLSH
T1EA818388DBF5611247EB30D4A674A48D6234D27971AD08E0D8CBC3F531E60C9BBE3B66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\index.js
Size 110B
SHA256 82db11c4ee43a41d859988c5db42c3771dff565371f94bacbd1e4d8d6ceb47cd
MD5 26660b3078523a953ee252b4e86e1c8b
SHA1 f7c22bdc8183f6a9cb73a9b4a735a5bab7ca01b4
SHA512 d4f32ba712ff15e8b6a1634eee089057a4716318b90e932b95a1c1cd30945ba708e7e725316fc824107637d2e97a2a64193ae81c0a3d2484651f52122bace99f
TLSH
T16EB012CF1BF0B18F26A44184E9618493D8C2E466841A40208F05CFFFA484CC42FE2DE1
MD5 SHA1 SHA512 TLSH

Submit Download

aggregate.js

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\aggregate.js
Size 1KB
SHA256 e9f74eb919ec93fe089c95ddf25a98f1f631c80418fa34fb2346ca1bc29f1b82
MD5 25fdd950809b2b22d0ba6917fe014c35
SHA1 5555b3223918668b5bf244e892b1d6a258f0099a
SHA512 50516a2d2265513dd7ee727cf9cf21d118601a0ee2b9de61111c6f5fd8933915f3029ef6f764f7803cf5438725c6017002d7f58cc36988d97cc1bdb805dd42c1
TLSH
T142412121E2D2221605DB24E07097F909EA7ED720B54DB4F0C92EA7E910D1DCDE9E7A80
MD5 SHA1 SHA512 TLSH

Submit Download

backup.js

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\backup.js
Size 2KB
SHA256 ea29d34992bb02e006d0fdeda9675ac5d2bb227aaf57468decd997e9fc9c7dbf
MD5 69638dc10c19961a0c05350ae333d6a4
SHA1 5941988b67c6fa083358002ba36538f1e39ad03b
SHA512 495ecffdadbc8c9bb2e886f9f7a93668fa5b2192a0ba79a7e1a9d3c2640e0520e39f2d2c6f3a26b55c72ff882bff43ed6439c0ad7c7622461e6ccaf1ee8f119a
TLSH
T171413158F39E5169436734C04490E00EE93DD6B6313E09F1AC8953F022C66CDE9DBBC5
MD5 SHA1 SHA512 TLSH

Submit Download

function.js

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\function.js
Size 1KB
SHA256 f431d49303b8bbdc044b1f1b455bdad21fc9b74b007de0acb22f08f25b4febd3
MD5 1036ce624efbb9fbbb387fec25fd1bcb
SHA1 35395f7ef4c18b845582b9289bc802d87c9e3c11
SHA512 7d65a4bc5bf5c9b97dce021cdb8c888cf975ad24613b12b239db1e03a98dda89faf7b1b204c906f6dde5439d22414d9b4410554d01eea8fc121287ed8821f9a0
TLSH
T1E021C911F2A6214246DB24E0B0ABF909E97AD765B44C74F0C58B97FC40A1DCED8E3A81
MD5 SHA1 SHA512 TLSH

Submit Download

inspect.js

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\inspect.js
Size 174B
SHA256 4975a78daee850adee62ba98719d0f223819a0ec135a07c0e302994bd8dbff61
MD5 21784edff107eaec0e9ef7e66e83552b
SHA1 6b59caa4cc8a568a8ed3f184a075d66c68f17d08
SHA512 9bf6d36dbc01dbad11d5d01c0b662620bf6c0cebd85c0065882e8ec57e3304bc4d301add25bf57ea425a270f3ace6a44fcb958dcc8bf993f411eb81a5369adfa
TLSH
T125C0800973F1B465554F30D5955FD00451E5F0242CC450420D1DC684CD708697F3790F
MD5 SHA1 SHA512 TLSH

Submit Download

pragma.js

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\pragma.js
Size 536B
SHA256 8b1c54475bd4340b15e25c50d53d06308be65f8f919ecbe4aa9d285ca859ad5a
MD5 9354074a096ee1cf58905ca8dabfd60c
SHA1 63e6c02339c45c252ae3bb24267610a636117eb6
SHA512 32bdf8866d1c4e3db8a2ca65df2c1bd0d33c064d4cc526e264587cbf9c09ba7b97c8adc430a9dc019d9863e0e90b4318442ffb5cd08e0de52cdd4f081b5150b5
TLSH
T155F0C91602F245530BFF14C094E5F534F4B7C668B50E94F0D99E83FE41808DAEA83E95
MD5 SHA1 SHA512 TLSH

Submit Download

serialize.js

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\serialize.js
Size 625B
SHA256 7a10ee5c2735384b7f0c361811bc6d017db29f62b203fd3c68a35f667e2c2605
MD5 41cfeffe67a2975f68aeeaaed0bf384c
SHA1 321f3f817bc095c34b76d060d706ed2cc48f204d
SHA512 8a0ad9732b5a07866eee742b2e884e521111f213af9ae39ebd92fa029d88f087c43f8826672d1fac5c571d14b284f20ae25e12aa4058a7881d6fd5e93c0b0a0c
TLSH
T1F5F0783A3365564B0997A0C050E1B429E9B5D324312D68A0E989C3F511D48CEEAF7B9F
MD5 SHA1 SHA512 TLSH

Submit Download

table.js

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\table.js
Size 6KB
SHA256 97c42d9ded1aa96c7d916b5b92f96b4e59581d50eaf629cd2c7afb78ff26a9ea
MD5 43137a36158617045d106a2ff534edaa
SHA1 f365ee98f7e36d1bab09e58187d467dd5f73b6f3
SHA512 f4330d881ae76d41083d3ba9d0056697abd634638a9951a4ebe4044fb79eceff4da034d22d9ba2ad4cd1a208fb0ec1c47855da781d9c9dabc34979f6f7f9eff3
SSDEEP 96:bJx7JBAUU6VtWpzwukGy2K3rN6gYMNEXxulo+yrgrm+IttSXFJ:bJx7J25PUyKb0+UklovOQk1J
TLSH
T18BE12308A7E17A13404B7095BC58605EEDBC98B27C1C48F5B8DC45E92491CBEF9EAF26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

transaction.js

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\transaction.js
Size 2KB
SHA256 bc8624a3ef689d8f78e5669020ad121e17acbc93b1d5ee5afe26860b1084c66c
MD5 6b77badde74e5a5b854041134e62041d
SHA1 47f5883e26f1aedb2bc1557cef9dd21c26e0e0ef
SHA512 d5be3aed74a9c9a948afbf6f03c19e21ec6d5a86f5f277de85d9d7374136fab4cf68bca1a6e752e5d41ba6b48c00577ca26ebacabd5bec51491da28affb3719d
TLSH
T1EB514312F67ADE7063E23088FA0B630EF5299A49E03494B0E760EB4A3A958CD8117D53
MD5 SHA1 SHA512 TLSH

Submit Download

wrappers.js

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\wrappers.js
Size 1KB
SHA256 a150a6271d23f4e5f8953b129f370ff096c7cdc4b812afbf080a6cf4ab741bcf
MD5 9e2ba6058f66127065c27ea3e81b8e68
SHA1 92346423dab9536ca4afa50e7ef171843d5eba5d
SHA512 2b6644404fea27117b74f904bc608fa42e36e3b100f51010394ef917df7c48f40af018e5b06243d31d7ccba5ab05cb32541566e79775df482e09a107524d091d
TLSH
T187213A8A72E6F162D31530309DCFD184FCF9B861694C64BCE47497922DE007942DEDB8
MD5 SHA1 SHA512 TLSH

Submit Download

sqlite-error.js

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\sqlite-error.js
Size 717B
SHA256 2582d61c27680dead168543f392eb102be621dfbef282a4ca4c7c21aa5e7c75d
MD5 e1372372ca8f94dd66666d886a81f9b5
SHA1 437034e71dedf15013967b540db157cbe3eac3ef
SHA512 5bbfce635aa1b10b30f1703eded4256224500705e3b14c7cefcd522ad703596d15d6cfee7914dd70700827afd01a50d61bef1954d29b8788bf6347f96e9cd8d4
TLSH
T1660168C69F7099BB01E15884FC116806996C5678C021B5E4B6C8DD9F2DF0087CDA56A0
MD5 SHA1 SHA512 TLSH

Submit Download

util.js

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\util.js
Size 331B
SHA256 92b2e39e2151b43a2252e10b6d6de876ecaf0008336a4fa1dfe1317b20f1916f
MD5 a5d75fb36bedb4938a8b9dc6525fd515
SHA1 b5270aef455a7de04d31d19713ed7dfceb55fa06
SHA512 c181b25f5b991826159125a4f7af8ec0f8a7bbceba674121f144f401295670136daa64598d4e0f48cb8ea2849000ac8e7f59881220f6a30a4905ce9309db8067
TLSH
T1E6E0261BDAD2876511AB30862E8EE404DE6CD2A6746854F0682AB64970C84B4EA8B25A
MD5 SHA1 SHA512 TLSH

Submit Download

package.json

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\package.json
Size 927B
SHA256 ac189a42eefe280418bd6a312270dbc5e8ed184d7146f1a483fd16f5d07538c0
MD5 24f65878b5ee6dead6042fadbcbb8288
SHA1 e5143067cf0211a68fe89b337b659a6c32ade9ab
SHA512 e3b4816872678f48d68bf64c7c87835ce65a4f7bea054ffd5c1d856d14a2044178cc3e85a321583b4d1195fc4a3ab591ccf02746498e1999270e1645364e45ff
TLSH
T116110A60CE258DA32EC569D5ACB91082A22148578CA4FC5C3387466D8F4E5BF21BD67D
MD5 SHA1 SHA512 TLSH

Submit Download

addon.cpp

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\src\addon.cpp
Size 1KB
SHA256 20f19f480ce060900521cf9510922e5ca1c8e76936f07ac2916f316e549a0190
MD5 209775309a8c12a8943c64d77c91413d
SHA1 c3938ab2752829cc5570416beb44a1d02f0e9b03
SHA512 859c54263a2192e6322a212091ab64e909a5fa48e1c861d385966401c080a32603354219aeca796f70c13411892c90607c2a075492376a9cba71a4c897a93dc7
TLSH
T1FD2101E2EFEE981B2EB96058C967C19DCC1896755BB90C57CC13E1182C74059D53C865
MD5 SHA1 SHA512 TLSH

Submit Download

better_sqlite3.cpp

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\src\better_sqlite3.cpp
Size 2KB
SHA256 5a0fa5cff411e2cf0a767099720dce11f62de00a1b08f0db1c1163942d833be6
MD5 4988b659262592f8c30673dc103ff3a0
SHA1 9058aa1cdb3bc81b3295fdb3a371a5a851fd1e74
SHA512 b3479020003a049ed4e7a263e66649e18bb95a8dfa680e22dc4688a9eb809e604a32bc287f23046ddb5d20392b26aada33009d147dc2c89ec8f3343d8a6e2957
TLSH
T1F751D21BEA3C04E38B5F59F176A7858099087088D34978250C9AD6E0F6C9CE8F4DF714
MD5 SHA1 SHA512 TLSH

Submit Download

backup.cpp

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\src\objects\backup.cpp
Size 4KB
SHA256 16a67102c49c9312eb1deecd08c27064325840df51d6957fe134b871f5d8798c
MD5 4b3e383a7b8cb932613fc836964ed647
SHA1 d927d4f59b26ab6d2a46209bc9687b3c74cc6d6c
SHA512 f7b7cb2a9f588afd2d9a80e14a34434fb40a1e884f5cd3144391301cb2eac0dc2565aee94b651af3aa9ee4960da840b10a8c03c987a6d24a85035851a112df51
SSDEEP 96:plUB3byOOHClL+W4Pi8E/wFZpqsORzXNQ6v:uboHe6W4I6qsORz+6v
TLSH
T18681975EF75BA81A3CB3149DED66478DCC2C5A08623D1E47CC66F2EC1170860947E53E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

backup.hpp

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\src\objects\backup.hpp
Size 705B
SHA256 02d57e03a1a03b3f8bb2fc503fc1704d4143b76d939fe37230fbb3b44177c44a
MD5 0d7b7cf24a841a0cc3a158ca68ecbeda
SHA1 f9a013e3857a45341d97d492b7f7fc1594e2155a
SHA512 cbef3f70327be6f57d1c46bcee1bb403a3b02885bf5725f921f622cebaf8e3783be4f4f670db5967ae149b3ecb1ea51c4632cac4e3a466a57606f3ac84156753
TLSH
T1EE019C6CFF1AC47478F228CBDE8B4191B81E03253ABD9EC1D81CF6C42C52050A507057
MD5 SHA1 SHA512 TLSH

Submit Download

database.cpp

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\src\objects\database.cpp
Size 13KB
SHA256 0e5806c8d74bcf66ef596516227479f4ae921e58f76c742e564abb15e4360720
MD5 85aaefe026dbfcbba82306847acfe896
SHA1 e43180b81beb3ce1a19937e0862e12cf577266b7
SHA512 fbc0cb4447f56f13fbeef391780381e7730aaf306cf0542f9f310c22674eb6894d5a03da180899407d0e8f3cf910732815ed49de6808758bb2184ff64f4f1561
SSDEEP 192:0ARvJtwI6MnQGhrb7pSHZizMgY03hoPPcnKucjFK4aIaYd+ex40m9FPRkz9nWiEa:HJtndQMrb7s7XLLXX95oy
TLSH
T16D52A541EFB77E1731BBC098E8664D5ECC24F24C62BC1D258C7AE62924B5894B03CB76
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

database.hpp

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\src\objects\database.hpp
Size 3KB
SHA256 f47ab5d6bb775cadd0b2b73c4fcb6faf5cb2ae783a049ff4691fafc5d29a0bca
MD5 e433d5ac95084876861c6e6d5d718017
SHA1 cfaeb9f5821d31fe0d0202ba400ae8889821195a
SHA512 cabb79f8a4e4277bbb5c69b6db6a9394bafc5562f51bfb37ea4006fe4429d923b4e996c786060da203c18c8bc4709defcb538173bd755dfdc68dc9f47064bf04
TLSH
T1E2513F59F72AC5657CED14DA8F4B01E1FD26126936B14E91CC2EF9A4BCB3084A53F092
MD5 SHA1 SHA512 TLSH

Submit Download

statement-iterator.cpp

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\src\objects\statement-iterator.cpp
Size 3KB
SHA256 6ac791fbb786fc498450e843f2a043eddeb03093eb6b31012a04ae7b84a8d7ab
MD5 3280ce9231eeaa600041c81a5de41e1c
SHA1 0eb4ef8d4d569798b0fb6a00ccdcaca0d2683fca
SHA512 b62341b5bd701096012bf3a34539dacf21d0622ed8c3fd201181c8d631ef8abaa0e79b5c1d368aba7ad681b5da043e432097c44b8b8c67c6846ee0c8ffacc42e
TLSH
T166613163FAF3EC1998ADA129DC9D4AA54C9601C5FD4C5C05846D086AFA7B8F0473CC36
MD5 SHA1 SHA512 TLSH

Submit Download

statement-iterator.hpp

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\src\objects\statement-iterator.hpp
Size 1KB
SHA256 c064f10ad6bca99154d4f5325e187978d4c6d6cc6fedaa047a4d2f3b4b4f9655
MD5 547a24e1556aeb48907aea0148be644b
SHA1 41880fb8b27c927ce3f70fefad22ab1599df422b
SHA512 43c7cb7ce7cd3fce3956e4c306336b56d80b78468b90deedd9c524b9256a8f93339140f234908e4c083ae766c57a6b7b983a0a0b9aeef6337e020dade647e999
TLSH
T150216315FFB7C185AAEC8198DC1F06D2EE06019D7F6CBE6CD81FD4C46D56891217C422
MD5 SHA1 SHA512 TLSH

Submit Download

statement.cpp

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\src\objects\statement.cpp
Size 12KB
SHA256 4625dc26594004c168f011982b51c1c039ada1eb360e8ab11c4c006270e988fb
MD5 309235693efaecf2711e86d5e15d881a
SHA1 4edccfe79480c192f244bd4d4f965563e2e402ce
SHA512 55c6fdd4012114ea977f8f414827fbfc8874c0a6b2795e61e1811042108d52cb758b5fc1c3092ae163f8860988beb18f365aba8a8143c1df2f903fadd37780c7
SSDEEP 384:g+H4AbnE06iZoku8ZRulF74U8XmNRPat937kk/nUC:8AoCokoAruiHIPC
TLSH
T11F42B743FF7B382A74FEA058F86E09C9CC18629DF5682C58AC94D13C5868C75ECBC612
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

statement.hpp

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\src\objects\statement.hpp
Size 1KB
SHA256 3dca186418c62d81f4b9170904fdc02e624c3d76a0c0c61e6aa95486799808e9
MD5 6754aca58cbac788c26e6b41bebde25d
SHA1 10c91fc0c3ffd1c87671b21d4a606da581929141
SHA512 7abb1eea05f1913607b269f27d8c3616be14a29200432e8a67123ec4a7fc5e68de3c18c99b48529044ebb3226b7c6b13ddff924c06ffb3a8ce1c8f62a497dc95
TLSH
T1CB215929FE63D124BCED60CE8F8A80D0B91623A43FB65D81DD2CDD842C26445AD6E19F
MD5 SHA1 SHA512 TLSH

Submit Download

bind-map.cpp

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\src\util\bind-map.cpp
Size 1KB
SHA256 7026e107a7f662b6460fbd05e91d9594f5114ffa69de7a8ddb082911f6e90876
MD5 c50b45c62d55f5e31d5184c53d386a61
SHA1 685b072ff47470c7ef87cf0c54d47a6008909c88
SHA512 853639a90d1f924e0aabbde488d5c38ab7a31b00776170b77d35deb41273ef282e9695482a4b022ce6776862dd31d73232c58af3c24ff4e582f7cba2fa6a972f
TLSH
T17F31CD23FFFC59A51181D1AEE73E0AC0693D017673982D8E6C6E013495C3A31D2BDA99
MD5 SHA1 SHA512 TLSH

Submit Download

binder.cpp

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\src\util\binder.cpp
Size 5KB
SHA256 dcc9fc44f05e61724efef30af48f027c6bf41deeb56db7d0e707158d7b34ac53
MD5 e4b13dbae9c1b03fc2d2d8db3785bc64
SHA1 b33863ac5666acac587701012b2e6bc043273fca
SHA512 99b10438c24860dd3c3b1c37ab573d3af4af019dc1d76d788c837fb63d00a90d26d2b2f19a649fcf436fb2d320e59b7d2c81d34fb3e42b865f6f26877649fb1e
SSDEEP 96:vxbmP1gU/TNAReKJxCUxJBNOU0EmMNW5TrdlILDY7aNTMqJSCCJ3+ocC:Zo2U/GReKmUx1OU0EmMUcvY7eT++K
TLSH
T140C18451FFDD838B059051849D140DCEFB4D5EB5B2B82CEEECD8D224B4A683CA5BCA52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

constants.cpp

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\src\util\constants.cpp
Size 8KB
SHA256 bbf4a3f983631f01f723627ee0e897f92b12cd6ca3e8b8b965318931bba0f2b4
MD5 822fb4c51a7e189f7c82b7ad01f86f21
SHA1 0445b00e224a9ea5be2a34f75cfec292999036c0
SHA512 f55639a101c23101be488bd9788f0cbca42048839dc1871e157eb78a17143443c84c93e34094f831d59cb4f234068fe2aa07c08343158d337b42ec0775dbc68f
SSDEEP 192:HbPdxtZ3Blf/DT/73zH/qwt9yKyg/mXdqv+j:HbPdxtZ3Blf/DT/73zH/OK5/mXsv+
TLSH
T196128A78DB39141D24EB8969F07109ABF569C44F0BBDADACED5B5C4001B58F0609CA7F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

custom-aggregate.cpp

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\src\util\custom-aggregate.cpp
Size 3KB
SHA256 742d03187a7b8483c9f42bb7b77ed29d0f6877450584fba2662164d2b8dd11b6
MD5 26327392f1f0d4df88116c7fe3439a26
SHA1 779cfb5958e3bd6666a700069c22eb249ded4a13
SHA512 70197f62f344b362be10cfe7d0c900ae4d3605b49b39fc93698e03aac720f7cf18d3a8d86329ae19a60ff0c0855bdc45dc1ecf6e1385b30f46e05b161f713771
TLSH
T1528175DAFFF9C057BBF1E82AD42F0E85CA5544DDA2B92D19ED8AC5113CD053C02BA860
MD5 SHA1 SHA512 TLSH

Submit Download

custom-function.cpp

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\src\util\custom-function.cpp
Size 1KB
SHA256 6a1f826df2cc2c402d8a3dd747a57dbcedb52fe9220a2bbda6a5e01f038b13d1
MD5 561ec79937afc2e00954777f6847243b
SHA1 2f0d56ea528bfe088af8dc11edf6206a1bcf1d8c
SHA512 a23c7709ee0d3182445b8f253a44f11efc04184610ca1f0b47fa00f3c171f7c4664a50132cc3aa9cc34e4741df4d243dc3b38369a14ac2cd8fa7e8fb41a7d762
TLSH
T18831316AFFF5D09B37A1A439C02F5E81CC35809E76A85F48C85FC41428F043C9475D60
MD5 SHA1 SHA512 TLSH

Submit Download

custom-table.cpp

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\src\util\custom-table.cpp
Size 14KB
SHA256 7549b38f24b7e69e78d407534a5cde8814a8a08628a421b122644a43940e0aaf
MD5 a8be17a9e4c7c88a42182f479265c764
SHA1 d9b02a6c6e378f44fc55401e4e7b80ec34c244d2
SHA512 4cf37ac03b85f73dbd8eecad2b97e46cda06f7d82b891c74b99e16f4a9ba36232972c90f66880c61c786ec817a1731dc7bae42c55bba084acf769cfb8e6dc01f
SSDEEP 384:LcRMEixEROtOBKt6Qb4z1okopMP1IJpDV8Sp6LioUBcD:5EOACyKt6ZK7pM9upB8Sp6t
TLSH
T1FB62D874BFEE993B2A527014A15D08DFEA2CD06CB3986E8DFC1F8558972587C81788F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data-converter.cpp

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\src\util\data-converter.cpp
Size 460B
SHA256 3cb73d0911e92893abf840752e9cfd6baded604d49b39ec4000599eec7c8c594
MD5 93da4fad536f5cc2f37e76b158ac93e0
SHA1 57068a0b0f7af70d7176811c2b69c6346adf92b5
SHA512 2aacba638b1734e7a27048db3a7e6d9182b3ce496f550103238815401c7622c42871993cba630fabc793775e2c248b7a0a497bf79f047c5992b9be1674f964b3
TLSH
T1B6F09E3B935C096F91A1D089CB54D81B8127DCA52FD18D31754A000E2CD069D94B17D2
MD5 SHA1 SHA512 TLSH

Submit Download

data.cpp

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\src\util\data.cpp
Size 9KB
SHA256 3ecc8175ae0b99769ee890d8e7e22c362b47f68b3bb5e3a283c51cc26aaefd52
MD5 95afedec021d9a657d0f1f348aec25cd
SHA1 f56fa740f4f15a8987f1029a417f6ff061a405ea
SHA512 a58cba99b213ccebb7b9252a9138395e758a2a6e10c8be20e5d533bb76ff8a504f5113e2fc536a661a036c88af05f8aa4ecab4dcb47085243216e16401c949b3
SSDEEP 96:CpDQUtMf55t1TOP3iwNiLGOOY8urCarE9otGOOYx1eWiOOYE46vt2+t/t625O7Zz:mUAMOnNhu2ao7qMYLZkJCaNOet18
TLSH
T1D4123363EFBE948E1AE690399C7A0DC5DD045BDAB6A46CECFC0DE2044B11835C4BDE64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

helpers.cpp

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\src\util\helpers.cpp
Size 4KB
SHA256 4d273c4ee67337fbe3440ec49058a2ee5cbe6a627b14917dc1e1c98fda8178f1
MD5 93b545407916acc32e2e9d6ccd1e077b
SHA1 c7ab97be9ad3b8b96faab4415b76a6f85140bb71
SHA512 a31ad0cd0c9523dc0bdf8af9022a983dd053694b89ead08a790069e8d36074bfea214dabdc67c354e43aca42c71aa6bb873a4d4e9d776f9292a02a8dd43335a4
SSDEEP 96:mbPAGiA4+ePoShsb3hqkfQyMeyEtGyRy3u0TzDyAu0Wdyl90gUoP4PDopwe:yPTi5+ePXsVHoO5UyRMTnJSMugjgopwe
TLSH
T125915F02EFB646D605D281A5E03B0EC5DE14A57E73B53EB98C8FB3A002B943DE179745
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

macros.cpp

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\src\util\macros.cpp
Size 3KB
SHA256 19c0a65cf803bcf98f9b79a1739e60916084366fb75fa553c3b82e432e6eb312
MD5 b923439fe74ac27d7fffab78a732a847
SHA1 c1d7f99fc2287a817c95c955e1090b68f9e8909b
SHA512 67d1c72822aec2808b8df9f2c18b7c5dd06239b5dabd0cd0a74dfa5f9927df6d8cd5cd331177bff7383dcc034c8975c6877f3f8c9dbd13886e192351698c7c96
TLSH
T1D1619B00AFD26A062B3B8168AC3D64B58D55ECF7605804BC752EE99C5FB00A095FD3EC
MD5 SHA1 SHA512 TLSH

Submit Download

query-macros.cpp

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\src\util\query-macros.cpp
Size 4KB
SHA256 0dcf68c3ff527398ebe0a6b874b38aa23b3fb87f285b9701636c3b19282dde8c
MD5 45ff28d1ab5f73c8bc7f8caec7c10421
SHA1 2fc19e7f000e09deb9c5c8f2f7bed9cf0259b332
SHA512 568f9256e04cf400da1a640e45043e83f93cb5fa6604dbf85d9d5e98088a75370b372abb4b7009b096a4cd5cd81d390d3506e82acd5aff6eb80bbba7d060b414
SSDEEP 48:kLdmms8UOosyen7XDt5B+8v0Dc1+JsSW/dBvv4PMyncFGB28dBaEqp9gg:Adf+ygv+1eMyr28CPzgg
TLSH
T11181EC11FEDB345E53AB80356FBD4092A855B9E7F02C10A8B8DD65181B398349CFD2FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

row-builder.cpp

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\src\util\row-builder.cpp
Size 1018B
SHA256 34572742d4fd208f434165c723ec4e6c2edd8b1d033c2e35774ee282d692a314
MD5 1069999c138b254f56aa796df9ea90a0
SHA1 96f7c62bc0dcc13c67d7d22e98bcc6403552446c
SHA512 917d6de023df6eb5546fd811b27ef3644197e3cd0a5fe524400816ef2308c002ff9b5364e394bffea18043e236b311a06266ef9e08b03ee074e05a54872f5ed1
TLSH
T1CE117B63FF6C45CA28F26006B47E0BC68C1D562F76C42ADDBC88A2225551926C4B8A29
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\resources\app.asar.unpacked\node_modules\sqlite3\LICENSE
Size 1KB
SHA256 7686f81e580cd6774f609a2d8a41b2cebdf79bc30e6b46c3efff5a656158981c
MD5 79558839a9db3e807e4ae6f8cd100c1c
SHA1 ae3dbcee04c86fbc589fcf2547d4aaaeb41db3c2
SHA512 b42c93f2b097afa6e09d79ed045b4dd293df2c29d91dda5dda04084d3329b721a6aa92a6ad6714564386a7928e9af9195ac310deecd37a93bb04b6a6f744be46
TLSH
T13B31A75B12404BF709E21692756679C0B48DD02D3B275E051CBDF34467BB42FC8BB454
MD5 SHA1 SHA512 TLSH

Submit Download

node_sqlite3.node

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\resources\app.asar.unpacked\node_modules\sqlite3\build\Release\node_sqlite3.node
Size 1.8MB
SHA256 f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c
MD5 66a65322c9d362a23cf3d3f7735d5430
SHA1 ed59f3e4b0b16b759b866ef7293d26a1512b952e
SHA512 0a44d12852fc4c74658a49f886c4bc7c715c48a7cb5a3dcf40c9f1d305ca991dd2c2cb3d0b5fd070b307a8f331938c5213188cbb2d27d47737cc1c4f34a1ea21
SSDEEP 49152:lVtIA1xRrGLYLn9M+BMPPivsICK9rzoNEqt:7tH4X3inMZt
TLSH
T12B958D4BA2B400FDC1ABC179891B5A0BE7B27405177497DF15E08A696F23FE356BE320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

common-sqlite.gypi

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\resources\app.asar.unpacked\node_modules\sqlite3\deps\common-sqlite.gypi
Size 1KB
SHA256 4d65f2899fb54955218f28ec358a2cad2c2074a7b43f862933c6a35e69ae0632
MD5 0ad55ae01864df3767d7b61678bd326e
SHA1 ffedcc19095fd54f8619f00f55074f275ceddfd6
SHA512 aaee895d110d67e87ed1e8ed6557b060a0575f466a947a4f59cc9d111381e1af6aa54d432233716c78f146168d548a726fed1eab2b3f09bb71e0ae7f4fdc69e3
TLSH
T1BA2166A040AF079BD096AB3F94DCA88490BA84E30D2CBE68789C594C0FDD05E42FD2B1
MD5 SHA1 SHA512 TLSH

Submit Download

extract.js

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\resources\app.asar.unpacked\node_modules\sqlite3\deps\extract.js
Size 224B
SHA256 5be353d29c0fabea29cfd34448c196da9506009c0b20fde55e01d4191941dd74
MD5 f0a82a6a6043bf87899114337c67df6c
SHA1 a906c146eb0a359742ff85c1d96a095bd0dd95fd
SHA512 d26879f890226808d9bd2644c5ca85cc339760e86b330212505706e5749464fafad1cb5f018c59a8f034d68d327cd3fa5234ceac0677de1ac9ae09039f574240
TLSH
T13FD0A71002D514F489B0BF80E49F0B163DC781E33B026450DC8888512BD72A3608AD9F
MD5 SHA1 SHA512 TLSH

Submit Download

sqlite-autoconf-3440200.tar.gz

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\resources\app.asar.unpacked\node_modules\sqlite3\deps\sqlite-autoconf-3440200.tar.gz
Size 3.1MB
SHA256 1c6719a148bc41cf0f2bbbe3926d7ce3f5ca09d878f1246fcc20767b175bb407
MD5 c02f40fd4f809ced95096250adc5764a
SHA1 8398dd159f3a1fd8f1c5edf02c687512eaab69e4
SHA512 59ad55df15eb84430f5286db2e5ceddd6ca1fc207a6343546a365c0c1baf20258e96c53d2ad48b50385608d03de09a692ae834cb78a39d1a48cb36a05722e402
SSDEEP 49152:ZROqVtTXPm/3DfYnW3vYkidsYIzCD8BJXKU0UzHOu67Rs5q9CVxaPdWKAz:/mDsWfYkfO8JXZzHuW5qqx8h0
TLSH
T16DE533AE6B8BF96135E0B6FF236B0AD5003E5F87F2C4D1BB5C9694C181C4972252DAC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqlite3.gyp

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\resources\app.asar.unpacked\node_modules\sqlite3\deps\sqlite3.gyp
Size 2KB
SHA256 8793f62b1133892ba376d18a15f552ef12b1e016f7e5df32ffb7279b760c11bd
MD5 0e4d1d898d697ec33a9ad8a27f0483bf
SHA1 1505f707a17f35723cd268744c189d8df47bb3a3
SHA512 c530aba70e5555a27d547562d8b826b186540068af9b4ccd01483ec39f083a991ac11d0cc66f40acaa8b03d774080f227ee705a38995f356a14abe6e5f97b545
TLSH
T1F6518AB4057F451AE2DA1A3FE16E41806624E1A78E7E3D34348DA5881FEC0DD067A77D
MD5 SHA1 SHA512 TLSH

Submit Download

sqlite3-binding.js

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\resources\app.asar.unpacked\node_modules\sqlite3\lib\sqlite3-binding.js
Size 59B
SHA256 762c7a74d7f92860a3873487b68e89f654a21d2aaeae9524eab5de9c65e66a9c
MD5 8582b2dcaed9c5a6f3b7cfe150545254
SHA1 14667874e0bfbe4ffc951f3e4bec7c5cf44e5a81
SHA512 22ec4df7697322b23ae2e73c692ed5c925d50fde2b7e72bfc2d5dd873e2da51834b920dea7c67cca5733e8a3f5e603805762e8be238c651aa40290452843411d
TLSH
T1D1A002D1B590B39576E44054E5D486821C91C1E1A5535AA0C14986A51C4888055159A0
MD5 SHA1 SHA512 TLSH

Submit Download

sqlite3.js

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\resources\app.asar.unpacked\node_modules\sqlite3\lib\sqlite3.js
Size 6KB
SHA256 8d6b400ae7f69a80d0cdd37a968d7b9a913661fa53475e5b8de49dda21684973
MD5 275019a4199a84cfd18abd0f1ae497aa
SHA1 8601683f9b6206e525e4a087a7cca40d07828fd8
SHA512 6422249ccd710973f15d1242a8156d98fa8bdea820012df669e5363c50c5d8492d21ffefcdfa05b46c3c18033dde30f03349e880a4943feda8d1ee3c00f952b0
SSDEEP 192:QoM2Wd0WmO6pM+tPtVRhoh3hG/h1goWPQfAcCy7gPQbQwZQiR893+9dY:npM0I6aPkd/K
TLSH
T1A3D1514DEAE36434962F76E9861FA65930398547347C8A417D8EC3901FB5C2036ABFBC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trace.js

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\resources\app.asar.unpacked\node_modules\sqlite3\lib\trace.js
Size 1KB
SHA256 d06caec6136120c6fb7ee3681b1ca949e8b634e747ea8d3080c90f35aeb7728f
MD5 e5c2de3c74bc66d4906bb34591859a5f
SHA1 37ec527d9798d43898108080506126b4146334e7
SHA512 e250e53dae618929cbf3cb2f1084a105d3a78bdfb6bb29e290f63a1fd5fbb5b2fab934ad16bc285e245d749a90c84bdc72fdc1a77af912b7356c18b0b197fbe5
TLSH
T14421C18C5CD370A59B63F0AC636BA00C7579191330A4C590758CC350DFD1D6A87A3E9D
MD5 SHA1 SHA512 TLSH

Submit Download

package.json

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\resources\app.asar.unpacked\node_modules\sqlite3\package.json
Size 1KB
SHA256 91008a93e604674024bd65569670af5b01f1e4caf86cde50835ee58f59a5dc61
MD5 174bf28fccd7fdb6f0766f31fac3060d
SHA1 655f465658957fbdf935fcb7df0b97c93807147b
SHA512 fa1be386a3d74767731aa5ad44ff4d89fb456e7feabde2a6e6f238ed4608a80962cadd6b7ff96f15e306a8e819221b66051fa5a7b0658ad52a2efb488492ff83
TLSH
T1C4116AA1C4344EB32AC935E9CC694186E12198838C687C1873EB815C8F1C56B20FE5AD
MD5 SHA1 SHA512 TLSH

Submit Download

async.h

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\resources\app.asar.unpacked\node_modules\sqlite3\src\async.h
Size 1KB
SHA256 cce55c56b41cb493ebd43b232ff8ffc9f5a180f5bab2d10372eca6780eb105f6
MD5 e8c5e5c02d87e6af4455ff2c59c3588b
SHA1 a0de928c621bb9a71ba9cf002e0f0726e4db7c0e
SHA512 ed96889e0d1d5263fb8fed7a4966905b9812c007fbb04b733cadbe84edc7179015b9967ff5f48816ff2c97acf4a5b4792a35cee1f8fce23e5fdc797f8ee0c762
TLSH
T1BA41E151A29A43AAE9F37B37827761903017D5730E2DDA42349D93C02F370A405E1676
MD5 SHA1 SHA512 TLSH

Submit Download

backup.h

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\resources\app.asar.unpacked\node_modules\sqlite3\src\backup.h
Size 6KB
SHA256 556ba9af78010f41bc6b5b806743dc728bc181934bf8a7c6e5d606f9b8c7a2e9
MD5 29dd2fca11a4e0776c49140ecac95ce9
SHA1 837cfbc391c7faad304e745fc48ae9693afaf433
SHA512 5785667b9c49d4f4320022c98e0567a412b48a790c99569261c12b8738bde0b4949d3998e2b375540ede2ff1d861cad859780ade796b71d4d1d692e1ed449021
SSDEEP 192:jXmQS7rRLcxPsPVHXmIXYIyx15kPhw0Io:j2QS7rRLOPs5e0
TLSH
T1E9E1A46EE77301AA193351A2976313B05F2D540B2E3CD163BADF43E16F826CA1764DAC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

database.h

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\resources\app.asar.unpacked\node_modules\sqlite3\src\database.h
Size 5KB
SHA256 8521f458b206ed8f9bf79e2bd869da0a35054b4be44d6ea8c371db207eccb283
MD5 de31ab62b7068aea6cffb22b54a435bb
SHA1 7fd98864c970caa9c60cfc4ce1e77d736b5b5231
SHA512 598491103564b024012da39ac31f54cf39f10da789cd5b17af44e93042d9526b9ffd4867112c5f9755cb4ada398bf5429f01dda6c1bbc5137bea545c3c88453b
SSDEEP 96:HWEP0L0TnYvyVH0GmPnsM8plenrnxiNn5hVB4KTRDpLzysrPrWr7xaqan4qi7lgj:vPivyVHfmPjrcN5h/4KVVr43lUZtX
TLSH
T1C5B152D96BF7A4515879B157CB9301306C26A0172F2CEAB0B89F83E41FD425962A5F38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gcc-preinclude.h

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\resources\app.asar.unpacked\node_modules\sqlite3\src\gcc-preinclude.h
Size 861B
SHA256 9d4264bb1dcbef8d927bb3a1809a01b0b89d726c217cee99ea9ccfdc7d456b6f
MD5 55a9165c6720727b6ec6cb815b026deb
SHA1 e737e117bdefa5838834f342d2c51e8009011008
SHA512 79ed80377bfb576f695f271ed5200bb975f2546110267d264f0ab917f56c26abf6d3385878285fe3e378b254af99b59bdb8bbcab7427788c90a0460eb2ee5b77
TLSH
T14D1129A81F8AF43A06B9C7A9B0481042D59CBB771FDC4251262DECA7FC4396968BDC19
MD5 SHA1 SHA512 TLSH

Submit Download

macros.h

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\resources\app.asar.unpacked\node_modules\sqlite3\src\macros.h
Size 10KB
SHA256 c25be1861bd8e8457300b218f5fa0bba734f9d1f92b47d3b6ab8ee7c1862ccbe
MD5 b60768ed9dd86a1116e3bcc95ff9387d
SHA1 c057a7eebba8ce61e27267930a8526ab54920aa3
SHA512 84e0670128f1d8712e703b6e4b684b904a8081886c9739c63b71962e5d465ac569b16cb0db74cb41dc015a64dcc1e3a9a20b0cf7f54d4320713cc0f49e0f7363
SSDEEP 192:SOxrBErYr4hnxlEPTZFkGdyrKL7h7K0d06I7SFcMWFtOj5Lk8wJfbZh720J0x7YY:95ZHdFvh+84DE5o8wJfbZhKUMFAUn
TLSH
T11F32534DAFA2344603A310394C7995609E195BF32834AD94F59C465CAFF52FE4CF86F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

statement.h

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\resources\app.asar.unpacked\node_modules\sqlite3\src\statement.h
Size 6KB
SHA256 605633ba0fb1922c16aa5fbfffed52a097f29bf31cee7190d810c24c02de515b
MD5 0b81c9be1dc0ff314182399cdc301aea
SHA1 7433b86711d132a4df826bae80e58801a3eb74c9
SHA512 9cf986538d048a48b9f020fc51f994f25168540db35bdb0314744fdec80a45ba99064bc35fe76b35918753c2886d4466fdd7e36b25838c6039f712e5ac7d81b3
SSDEEP 192:T2kHmSF3oPvmPVD6LjmbaXCYG4hqY21nyi6BF1pcDoF/+InO:1Gw4PvmlQjRNL21+BSDt
TLSH
T1BCE1624976B7818068F36167C71B11A17C27A0933B18CB95BEEF03E41F9186D97A8FB1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

threading.h

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\resources\app.asar.unpacked\node_modules\sqlite3\src\threading.h
Size 388B
SHA256 e0ab4f798bccb877548b0ab0f3d98c051b36cde240fdf424c70ace7daf0ffd36
MD5 f2a075d3101c2bf109d94f8c65b4ecb5
SHA1 d48294aec0b7aeb03cf5d56a9912e704b9e90bf6
SHA512 d95b5fda6cb93874fe577439f7bd16b10eae37b70c45ae2bd914790c1e3ba70dfb6bda7be79d196f2c40837d98f1005c3ed209cab9ba346ada9ce2ed62a87f13
TLSH
T147E0ED682A55404FFAB1A724143B21E63457CEB31EBAC349A969D47865D788440F44FE
MD5 SHA1 SHA512 TLSH

Submit Download

elevate.exe

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\resources\elevate.exe
Size 105KB
SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
MD5 792b92c8ad13c46f27c7ced0810694df
SHA1 d8d449b92de20a57df722df46435ba4553ecc802
SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
SSDEEP 3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
TLSH
T1EBB37C1274C0C471E5732A361974CAB14AADFD700E759FAF6398127A4FA01D09A3AFB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snapshot_blob.bin

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\snapshot_blob.bin
Size 261KB
SHA256 b21d129deaff12c8e2ec7eb50e8318a5937a11523b2d63bfc676285e2fa382d6
MD5 4ff1d3e683619d499200f14ad8980ca3
SHA1 3600005aad16eeb5ab888dce3990439716f69c1a
SHA512 3af344a4a2558999198786c231196088ba6ed8527451de40143a42f30a065256a76278f29efb1c15e0f3a4661eeb6c5be7d73f880594ca8e60541a51f0b16a9f
SSDEEP 3072:hLuAqiYp4bhaz8Lv7ICHKJsqdzpJq/p2Vy:eiHbhaMTIy4sqxKp2Q
TLSH
T1ED447111B160DF2BD527B671DCD68CD9B234B3084FA65A8B728813BE3D757B20E2918D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\v8_context_snapshot.bin
Size 611KB
SHA256 40d955781ef6cdbc58ddfdf77839fb8750af31ce000b24c1380d3127868df038
MD5 c7d05cd94396d5c2ef3e69d2c4722866
SHA1 d99ed0b461e5f4dfcaee65f8a42bcf020c38dd23
SHA512 7476fb04c787e10515a08eee254071c44a9652d8d57b18ee05889301cb21e8ea818111aa6195422ba6e5e4af9c256be23ee52c5d5bb739209a5f2858af20c889
SSDEEP 6144:gMWiyz4J+1BFZ4sXbJ8tPO4hXvKwvrBTbvUyMR/GLrOp:g2+lBFMh/DvNHvUiap
TLSH
T156D49412B656DF2BC8697DB14CD388E87630B6448F03645772A847BF2CBB7A11E3D198
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader.dll

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\vk_swiftshader.dll
Size 4.9MB
SHA256 10411f9a38ee2df37d8f12fc8adb47eb653abff5b3cd8a80260ff55490698a21
MD5 2f6472bde9564b1d724921030c1ac0ee
SHA1 ed7d36bf40baeba966f10622898cf062980e7b09
SHA512 cc18004095dcf80f974a5f1668ed05f9ef7f04a70376fd4c4874f6cfecc3c8e768a6cc83b93272862ed76b221f08b87f8050b1f4af16286fa3e3fb9ad84a1284
SSDEEP 49152:ECmSoph1oXdU3quTN+f6x/o6j/PESEekzcgtlTRHAdOf75MZfEy0gUZVthW5C1Zp:lmSoAal17OrHKkz6VA2oyLe
TLSH
T18E363803B28581D9F05DD5B94B4BA632F631F8811B62B6DF52A41F192E37FE02B39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader_icd.json

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\vk_swiftshader_icd.json
Size 106B
SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
MD5 8642dd3a87e2de6e991fae08458e302b
SHA1 9c06735c31cec00600fd763a92f8112d085bd12a
SHA512 f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f
TLSH
T1A6B01211430088B36062AF3C41811F468765411C36020D491040540E83BBDB6A102394
MD5 SHA1 SHA512 TLSH

Submit Download

vulkan-1.dll

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\7z-out\vulkan-1.dll
Size 931KB
SHA256 982d9aedc579a34035e15b3a425e605676937843e65f3b7157f805d434902ca6
MD5 0e2052834469221a5128ed56eed861a3
SHA1 cd6bdbfb65dfb70086613df584b60b8929ecdca3
SHA512 66f331e523de113c2117d64e9542e3acb9fba170d2a3294179bda27c9b07fb7796cd16afefa4fe2f3aa51f961fa3ca69b1f251fca0258f45f6b3efe779121714
SSDEEP 24576:GPZePxVv0mdcSoDCraWwIQ6Z5WoDYsHY6g3P0zAk7sD:GPYnv5oDCrQJ6Z5WoDYsHY6g3P0zAk7s
TLSH
T1E8156D13AA980569D476C034C9C28707C9B578921726B9CF03E81B196F6BFF4773DB2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SpiderBanner.dll

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\SpiderBanner.dll
Size 9KB
SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
MD5 17309e33b596ba3a5693b4d3e85cf8d7
SHA1 7d361836cf53df42021c7f2b148aec9458818c01
SHA512 1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298
SSDEEP 192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY
TLSH
T1FF12D6861F9044F7E510607CA896B7EF93177B2AA382ADCBCE73849429115E32F79347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StdUtils.dll

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\StdUtils.dll
Size 100KB
SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
MD5 c6a6e03f77c313b267498515488c5740
SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
TLSH
T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\System.dll
Size 12KB
SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
MD5 0d7ad4f45dc6f5aa87f606d0331c6901
SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
TLSH
T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinShell.dll

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\WinShell.dll
Size 3KB
SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
TLSH
T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
MD5 SHA1 SHA512 TLSH

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\nsExec.dll
Size 6KB
SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
MD5 ec0504e6b8a11d5aad43b296beeb84b2
SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
SSDEEP 96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
TLSH
T173D109B836C20CF3D54E46743E22381713FEE4761B7502A18B976ED61D92AE2FE20781
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis7z.dll

Path C:\Users\Admin\AppData\Local\Temp\nsw5659.tmp\nsis7z.dll
Size 424KB
SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
MD5 80e44ce4895304c6a3a831310fbf8cd0
SHA1 36bd49ae21c460be5753a904b4501f1abca53508
SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
TLSH
T1E9949E22B6D2C036C56E02309918F77921AEB3B1592DDB1B73985B6F7FB44C19E24B07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2304-1382-0x0000029ABE770000-0x0000029ABE771000-memory.dmp

Download

memory/4140-1322-0x0000019B22430000-0x0000019B2245A000-memory.dmp

Download

memory/4140-1323-0x0000019B22430000-0x0000019B22454000-memory.dmp

Download

memory/5048-1263-0x0000025259520000-0x000002525968A000-memory.dmp

Download

memory/5048-1260-0x00000252587E0000-0x0000025258802000-memory.dmp

Download

memory/5680-1473-0x000001C93F290000-0x000001C93F291000-memory.dmp

Download

memory/5796-1336-0x0000029676BD0000-0x0000029676BD1000-memory.dmp

Download