popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

BonitSetup.exe

Gen1 RedLine stealer Generic Malware Obsidium protector Malicious Library Admin Tool (Sysinternals etc ...) Malicious Packer UPX Javascript_Blob Anti_VM ftp PE64 PE File OS Processor Check PE32 DLL
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Oct. 4, 2023, 9:31 a.m. Oct. 4, 2023, 9:33 a.m.
Size 64.0MB
Type PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5 22bddfd1a372bb47701d241dcc17660b
SHA256 5f1251f3bc4c36f49b623bef0d45a4805098284753e232263da842fe857793b4
CRC32 C745A176
ssdeep 1572864:P2syXKJyoidBRGQ53ffLogxfj3K3PPAzrvmarBpo4vv7:P2syXFv9UOm3AXSS7
Yara
  • Malicious_Library_Zero - Malicious_Library
  • UPX_Zero - UPX packed file
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • ftp_command - ftp command

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
164.124.101.2 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section .ndata
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
RaiseException+0x3d FreeEnvironmentStringsW-0x373 kernelbase+0xa49d @ 0x7fefd4fa49d
?IsInvalid@V8StackTraceId@v8_inspector@@QEBA_NXZ+0xc0ebb9 Cr_z_adler32_combine-0x79367 bonitsetup+0x594d559 @ 0x144f7d559
?IsInvalid@V8StackTraceId@v8_inspector@@QEBA_NXZ+0xc0ebd9 Cr_z_adler32_combine-0x79347 bonitsetup+0x594d579 @ 0x144f7d579
?IsInvalid@V8StackTraceId@v8_inspector@@QEBA_NXZ+0xc0ebf5 Cr_z_adler32_combine-0x7932b bonitsetup+0x594d595 @ 0x144f7d595
Cr_z_zError+0x322010 TfLiteXNNPackDelegateWeightsCacheCreate-0xc95170 bonitsetup+0x5cea4e0 @ 0x14531a4e0
?DijkstraMarkingBarrierRangeSlow@WriteBarrier@internal@cppgc@@CAXAEAVHeapHandle@3@PEBX_K2P6AXPEAVVisitor@3@1@Z@Z+0x360e14 ?AddThreadSafeEvent@Recorder@metrics@v8@@UEAAXAEBUWasmModulesPerIsolate@23@@Z-0x39000c bonitsetup+0x3d08e94 @ 0x143338e94
?DijkstraMarkingBarrierRangeSlow@WriteBarrier@internal@cppgc@@CAXAEAVHeapHandle@3@PEBX_K2P6AXPEAVVisitor@3@1@Z@Z+0x34d70b ?AddThreadSafeEvent@Recorder@metrics@v8@@UEAAXAEBUWasmModulesPerIsolate@23@@Z-0x3a3715 bonitsetup+0x3cf578b @ 0x14332578b
?DijkstraMarkingBarrierRangeSlow@WriteBarrier@internal@cppgc@@CAXAEAVHeapHandle@3@PEBX_K2P6AXPEAVVisitor@3@1@Z@Z+0x34d0b3 ?AddThreadSafeEvent@Recorder@metrics@v8@@UEAAXAEBUWasmModulesPerIsolate@23@@Z-0x3a3d6d bonitsetup+0x3cf5133 @ 0x143325133
?DijkstraMarkingBarrierRangeSlow@WriteBarrier@internal@cppgc@@CAXAEAVHeapHandle@3@PEBX_K2P6AXPEAVVisitor@3@1@Z@Z+0x699067 ?AddThreadSafeEvent@Recorder@metrics@v8@@UEAAXAEBUWasmModulesPerIsolate@23@@Z-0x57db9 bonitsetup+0x40410e7 @ 0x1436710e7
uv_sleep+0x10f44 GetHandleVerifier-0xac6c bonitsetup+0x1f28cf4 @ 0x141558cf4
uv_sleep+0x10e6f GetHandleVerifier-0xad41 bonitsetup+0x1f28c1f @ 0x141558c1f
uv_sleep+0x10ded GetHandleVerifier-0xadc3 bonitsetup+0x1f28b9d @ 0x141558b9d
?GetEnvironmentIsolateData@node@@YAPEAVIsolateData@1@PEAVEnvironment@1@@Z+0x8a86e6 uv_os_getpid-0xf05a bonitsetup+0x1957586 @ 0x140f87586
?GetEnvironmentIsolateData@node@@YAPEAVIsolateData@1@PEAVEnvironment@1@@Z+0x8a8227 uv_os_getpid-0xf519 bonitsetup+0x19570c7 @ 0x140f870c7
uv_sleep+0x1886d GetHandleVerifier-0x3343 bonitsetup+0x1f3061d @ 0x14156061d
uv_sleep+0x18957 GetHandleVerifier-0x3259 bonitsetup+0x1f30707 @ 0x141560707
?DijkstraMarkingBarrierRangeSlow@WriteBarrier@internal@cppgc@@CAXAEAVHeapHandle@3@PEBX_K2P6AXPEAVVisitor@3@1@Z@Z+0x33bfb8 ?AddThreadSafeEvent@Recorder@metrics@v8@@UEAAXAEBUWasmModulesPerIsolate@23@@Z-0x3b4e68 bonitsetup+0x3ce4038 @ 0x143314038
?DijkstraMarkingBarrierRangeSlow@WriteBarrier@internal@cppgc@@CAXAEAVHeapHandle@3@PEBX_K2P6AXPEAVVisitor@3@1@Z@Z+0x4b4cdd ?AddThreadSafeEvent@Recorder@metrics@v8@@UEAAXAEBUWasmModulesPerIsolate@23@@Z-0x23c143 bonitsetup+0x3e5cd5d @ 0x14348cd5d
?DijkstraMarkingBarrierRangeSlow@WriteBarrier@internal@cppgc@@CAXAEAVHeapHandle@3@PEBX_K2P6AXPEAVVisitor@3@1@Z@Z+0x4b4403 ?AddThreadSafeEvent@Recorder@metrics@v8@@UEAAXAEBUWasmModulesPerIsolate@23@@Z-0x23ca1d bonitsetup+0x3e5c483 @ 0x14348c483
?DijkstraMarkingBarrierRangeSlow@WriteBarrier@internal@cppgc@@CAXAEAVHeapHandle@3@PEBX_K2P6AXPEAVVisitor@3@1@Z@Z+0x5d3d2f ?AddThreadSafeEvent@Recorder@metrics@v8@@UEAAXAEBUWasmModulesPerIsolate@23@@Z-0x11d0f1 bonitsetup+0x3f7bdaf @ 0x1435abdaf
?FatalException@node@@YAXPEAVIsolate@v8@@AEBVTryCatch@3@@Z+0x6aea8 Cr_z_uncompress2-0xff0f8 bonitsetup+0x2c62c18 @ 0x142292c18
uv_os_getpid+0x3ee0 IsSandboxedProcess-0x8f5e0 bonitsetup+0x196a4c0 @ 0x140f9a4c0
BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x76c2652d
RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x76d5c521

exception.instruction_r: 48 81 c4 c8 00 00 00 c3 48 85 f6 74 08 83 3b 00
exception.symbol: RaiseException+0x3d FreeEnvironmentStringsW-0x373 kernelbase+0xa49d
exception.instruction: add rsp, 0xc8
exception.module: KERNELBASE.dll
exception.exception_code: 0xe0000008
exception.offset: 42141
exception.address: 0x7fefd4fa49d
registers.r14: 0
registers.r15: 0
registers.rcx: 1400695584
registers.rsi: 0
registers.r10: 0
registers.rbx: 0
registers.rsp: 1400700448
registers.r11: 1400697200
registers.r8: 0
registers.r9: 0
registers.rdx: 176
registers.r12: 0
registers.rbp: 0
registers.rdi: 0
registers.rax: 630936755
registers.r13: 0
1 0 0
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2644
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73955000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2796
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000000007304c000
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2796
region_size: 241664
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000c0004000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2796
region_size: 241664
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000c0004000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2796
region_size: 241664
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000c0004000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2796
region_size: 241664
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000c0004000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2796
region_size: 241664
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000c0004000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2796
region_size: 241664
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000c0004000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2796
region_size: 241664
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000c0004000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2796
region_size: 241664
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000c0004000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2796
region_size: 241664
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000c0004000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2796
region_size: 241664
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000c0004000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2796
region_size: 241664
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000c0004000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2796
region_size: 241664
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000c0004000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2796
region_size: 241664
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000c0004000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2796
region_size: 241664
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000c0004000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2796
region_size: 241664
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000c0004000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2796
region_size: 241664
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000c0004000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2796
region_size: 241664
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000c0004000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2796
region_size: 241664
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000c0004000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2796
region_size: 241664
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000c0004000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2796
region_size: 241664
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000c0004000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2796
region_size: 241664
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000c0004000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2796
region_size: 241664
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000c0004000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2796
region_size: 241664
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000c0004000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2796
region_size: 241664
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000c0004000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2796
region_size: 241664
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000c0004000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2796
region_size: 241664
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000c0004000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2796
region_size: 241664
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000c0004000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2796
region_size: 241664
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000c0004000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2796
region_size: 241664
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000c0004000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2796
region_size: 241664
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000c0004000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2796
region_size: 241664
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000c0004000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2796
region_size: 241664
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000c0004000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2796
region_size: 241664
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000c0004000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\2LYzSptpSPtrBCmBqiIbdI6Gjc7\resources\elevate.exe
file C:\Users\test22\AppData\Local\Temp\nsoFA9D.tmp\nsis7z.dll
file C:\Users\test22\AppData\Local\Temp\2LYzSptpSPtrBCmBqiIbdI6Gjc7\d3dcompiler_47.dll
file C:\Users\test22\AppData\Local\Temp\2LYzSptpSPtrBCmBqiIbdI6Gjc7\libGLESv2.dll
file C:\Users\test22\AppData\Local\Temp\2LYzSptpSPtrBCmBqiIbdI6Gjc7\ffmpeg.dll
file C:\Users\test22\AppData\Local\Temp\2LYzSptpSPtrBCmBqiIbdI6Gjc7\BonitSetup.exe
file C:\Users\test22\AppData\Local\Temp\nsoFA9D.tmp\System.dll
file C:\Users\test22\AppData\Local\Temp\2LYzSptpSPtrBCmBqiIbdI6Gjc7\libEGL.dll
file C:\Users\test22\AppData\Local\Temp\2LYzSptpSPtrBCmBqiIbdI6Gjc7\vk_swiftshader.dll
file C:\Users\test22\AppData\Local\Temp\2LYzSptpSPtrBCmBqiIbdI6Gjc7\vulkan-1.dll
file C:\Users\test22\AppData\Local\Temp\nsoFA9D.tmp\StdUtils.dll
file C:\Users\test22\AppData\Local\Temp\nsoFA9D.tmp\nsis7z.dll
file C:\Users\test22\AppData\Local\Temp\nsoFA9D.tmp\System.dll
file C:\Users\test22\AppData\Local\Temp\2LYzSptpSPtrBCmBqiIbdI6Gjc7\resources\elevate.exe
file C:\Users\test22\AppData\Local\Temp\nsoFA9D.tmp\StdUtils.dll
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2796
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 32 (PAGE_EXECUTE_READ)
base_address: 0x00000000bfff0000
process_handle: 0xffffffffffffffff
1 0 0
Time & API Arguments Status Return Repeated

GetAdaptersAddresses

 flags: 0
family: 0
1 0 0
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeSecurityPrivilege
1 1 0
file C:\Users\test22\AppData\Local\Temp\2LYzSptpSPtrBCmBqiIbdI6Gjc7\locales\cs.pak
file C:\Users\test22\AppData\Local\Temp\2LYzSptpSPtrBCmBqiIbdI6Gjc7\locales\sr.pak
file C:\Users\test22\AppData\Local\Temp\2LYzSptpSPtrBCmBqiIbdI6Gjc7\locales\fi.pak
file C:\Users\test22\AppData\Local\Temp\2LYzSptpSPtrBCmBqiIbdI6Gjc7\locales\de.pak
file C:\Users\test22\AppData\Local\Temp\2LYzSptpSPtrBCmBqiIbdI6Gjc7\locales\bg.pak
file C:\Users\test22\AppData\Local\Temp\2LYzSptpSPtrBCmBqiIbdI6Gjc7\chrome_100_percent.pak
file C:\Users\test22\AppData\Local\Temp\2LYzSptpSPtrBCmBqiIbdI6Gjc7\locales\hu.pak
file C:\Users\test22\AppData\Local\Temp\2LYzSptpSPtrBCmBqiIbdI6Gjc7\locales\es.pak
file C:\Users\test22\AppData\Local\Temp\2LYzSptpSPtrBCmBqiIbdI6Gjc7\locales\id.pak
file C:\Users\test22\AppData\Local\Temp\2LYzSptpSPtrBCmBqiIbdI6Gjc7\locales\fil.pak
file C:\Users\test22\AppData\Local\Temp\2LYzSptpSPtrBCmBqiIbdI6Gjc7\locales\ro.pak
file C:\Users\test22\AppData\Local\Temp\2LYzSptpSPtrBCmBqiIbdI6Gjc7\locales\ml.pak
file C:\Users\test22\AppData\Local\Temp\2LYzSptpSPtrBCmBqiIbdI6Gjc7\locales\hi.pak
file C:\Users\test22\AppData\Local\Temp\2LYzSptpSPtrBCmBqiIbdI6Gjc7\resources\app.asar
file C:\Users\test22\AppData\Local\Temp\2LYzSptpSPtrBCmBqiIbdI6Gjc7\locales\lt.pak
file C:\Users\test22\AppData\Local\Temp\2LYzSptpSPtrBCmBqiIbdI6Gjc7\locales\nl.pak
file C:\Users\test22\AppData\Local\Temp\2LYzSptpSPtrBCmBqiIbdI6Gjc7\locales\ru.pak
file C:\Users\test22\AppData\Local\Temp\2LYzSptpSPtrBCmBqiIbdI6Gjc7\locales\zh-CN.pak
file C:\Users\test22\AppData\Local\Temp\2LYzSptpSPtrBCmBqiIbdI6Gjc7\locales\ca.pak
file C:\Users\test22\AppData\Local\Temp\2LYzSptpSPtrBCmBqiIbdI6Gjc7\locales\en-US.pak
file C:\Users\test22\AppData\Local\Temp\2LYzSptpSPtrBCmBqiIbdI6Gjc7\locales\el.pak
file C:\Users\test22\AppData\Local\Temp\2LYzSptpSPtrBCmBqiIbdI6Gjc7\locales\lv.pak
file C:\Users\test22\AppData\Local\Temp\2LYzSptpSPtrBCmBqiIbdI6Gjc7\v8_context_snapshot.bin
file C:\Users\test22\AppData\Local\Temp\2LYzSptpSPtrBCmBqiIbdI6Gjc7\locales\sv.pak
file C:\Users\test22\AppData\Local\Temp\2LYzSptpSPtrBCmBqiIbdI6Gjc7\locales\ta.pak
file C:\Users\test22\AppData\Local\Temp\2LYzSptpSPtrBCmBqiIbdI6Gjc7\locales\vi.pak
file C:\Users\test22\AppData\Local\Temp\2LYzSptpSPtrBCmBqiIbdI6Gjc7\locales\af.pak
file C:\Users\test22\AppData\Local\Temp\2LYzSptpSPtrBCmBqiIbdI6Gjc7\locales\am.pak
file C:\Users\test22\AppData\Local\Temp\2LYzSptpSPtrBCmBqiIbdI6Gjc7\resources.pak
file C:\Users\test22\AppData\Local\Temp\2LYzSptpSPtrBCmBqiIbdI6Gjc7\locales\fa.pak
file C:\Users\test22\AppData\Local\Temp\2LYzSptpSPtrBCmBqiIbdI6Gjc7\locales\pt-PT.pak
file C:\Users\test22\AppData\Local\Temp\2LYzSptpSPtrBCmBqiIbdI6Gjc7\locales\hr.pak
file C:\Users\test22\AppData\Local\Temp\2LYzSptpSPtrBCmBqiIbdI6Gjc7\locales\te.pak
file C:\Users\test22\AppData\Local\Temp\2LYzSptpSPtrBCmBqiIbdI6Gjc7\locales\kn.pak
file C:\Users\test22\AppData\Local\Temp\2LYzSptpSPtrBCmBqiIbdI6Gjc7\chrome_200_percent.pak
file C:\Users\test22\AppData\Local\Temp\2LYzSptpSPtrBCmBqiIbdI6Gjc7\locales\ar.pak
file C:\Users\test22\AppData\Local\Temp\2LYzSptpSPtrBCmBqiIbdI6Gjc7\locales\th.pak
file C:\Users\test22\AppData\Local\Temp\2LYzSptpSPtrBCmBqiIbdI6Gjc7\locales\nb.pak
file C:\Users\test22\AppData\Local\Temp\2LYzSptpSPtrBCmBqiIbdI6Gjc7\locales\gu.pak
file C:\Users\test22\AppData\Local\Temp\2LYzSptpSPtrBCmBqiIbdI6Gjc7\locales\ko.pak
file C:\Users\test22\AppData\Local\Temp\2LYzSptpSPtrBCmBqiIbdI6Gjc7\locales\tr.pak
file C:\Users\test22\AppData\Local\Temp\2LYzSptpSPtrBCmBqiIbdI6Gjc7\locales\sk.pak
file C:\Users\test22\AppData\Local\Temp\2LYzSptpSPtrBCmBqiIbdI6Gjc7\locales\es-419.pak
file C:\Users\test22\AppData\Local\Temp\2LYzSptpSPtrBCmBqiIbdI6Gjc7\locales\ms.pak
file C:\Users\test22\AppData\Local\Temp\2LYzSptpSPtrBCmBqiIbdI6Gjc7\locales\it.pak
file C:\Users\test22\AppData\Local\Temp\2LYzSptpSPtrBCmBqiIbdI6Gjc7\locales\en-GB.pak
file C:\Users\test22\AppData\Local\Temp\2LYzSptpSPtrBCmBqiIbdI6Gjc7\locales\uk.pak
file C:\Users\test22\AppData\Local\Temp\2LYzSptpSPtrBCmBqiIbdI6Gjc7\locales\sl.pak
file C:\Users\test22\AppData\Local\Temp\2LYzSptpSPtrBCmBqiIbdI6Gjc7\locales\sw.pak
file C:\Users\test22\AppData\Local\Temp\2LYzSptpSPtrBCmBqiIbdI6Gjc7\snapshot_blob.bin