Analysis

  • max time kernel
    45s
  • max time network
    70s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    26-06-2022 19:06

General

  • Target

    582d3ef01508bca442c17fe30103052762c517978ce51e23346e6a1f7dc2e2e1.msi

  • Size

    33.1MB

  • MD5

    a01326f71161ff1c61298c3e5e880f4f

  • SHA1

    d95fe7c087d1075d94cb09d8278ab90497b32713

  • SHA256

    582d3ef01508bca442c17fe30103052762c517978ce51e23346e6a1f7dc2e2e1

  • SHA512

    0e5d514ef09cdafdec5739146edd4e6a3289e4a47f269ba6e051a412bcb09709c52c15c314653efd9a71211cdd4dfaba2163bc502ab947647ec18490b8d63bbc

Malware Config

Extracted

Family

arkei

Botnet

Default

C2

http://93.159.221.78/EpkC2Ze5OX.php

Signatures

  • Arkei

    Arkei is an infostealer written in C++.

  • Babadeda

    Babadeda is a crypter delivered as a legitimate installer and used to drop other malware families.

  • Babadeda Crypter 1 IoCs
  • Blocklisted process makes network request 3 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 64 IoCs
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 9 IoCs
  • Detects BABADEDA Crypter 1 IoCs

    Detects BABADEDA Crypter.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 50 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\582d3ef01508bca442c17fe30103052762c517978ce51e23346e6a1f7dc2e2e1.msi
    1⤵
    • Blocklisted process makes network request
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:1644
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Blocklisted process makes network request
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1064
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 5F29549FFCF4DCA7D9248E15AD5C96C0
      2⤵
      • Loads dropped DLL
      PID:1888
    • C:\Users\Admin\AppData\Roaming\VintaSoft Ltd\VintaSoft Imaging .NET SDK 11.0\CRLogTransport.exe
      "C:\Users\Admin\AppData\Roaming\VintaSoft Ltd\VintaSoft Imaging .NET SDK 11.0\CRLogTransport.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:1224
    • C:\Users\Admin\AppData\Roaming\VintaSoft Ltd\VintaSoft Imaging .NET SDK 11.0\CRWindowsClientService.exe
      "C:\Users\Admin\AppData\Roaming\VintaSoft Ltd\VintaSoft Imaging .NET SDK 11.0\CRWindowsClientService.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:1928
    • C:\Users\Admin\AppData\Roaming\VintaSoft Ltd\VintaSoft Imaging .NET SDK 11.0\CoreSync.exe
      "C:\Users\Admin\AppData\Roaming\VintaSoft Ltd\VintaSoft Imaging .NET SDK 11.0\CoreSync.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetWindowsHookEx
      PID:2040

Network

MITRE ATT&CK Matrix ATT&CK v6

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
    Filesize

    60KB

    MD5

    308336e7f515478969b24c13ded11ede

    SHA1

    8fb0cf42b77dbbef224a1e5fc38abc2486320775

    SHA256

    889b832323726a9f10ad03f85562048fdcfe20c9ff6f9d37412cf477b4e92ff9

    SHA512

    61ad97228cd6c3909ef3ac5e4940199971f293bdd0d5eb7916e60469573a44b6287c0fa1e0b6c1389df35eb6c9a7d2a61fdb318d4a886a3821ef5a9dab3ac24f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F2E248BEDDBB2D85122423C41028BFD4
    Filesize

    1KB

    MD5

    78f2fcaa601f2fb4ebc937ba532e7549

    SHA1

    ddfb16cd4931c973a2037d3fc83a4d7d775d05e4

    SHA256

    552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988

    SHA512

    bcad73a7a5afb7120549dd54ba1f15c551ae24c7181f008392065d1ed006e6fa4fa5a60538d52461b15a12f5292049e929cffde15cc400dec9cdfca0b36a68dd

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    137cbf1be9fd4c2821efc6585e313188

    SHA1

    0c1078b9cb532192792a18b78f081d9df3df2353

    SHA256

    c3a0ba1a4234672e77c44ad164160b41f405d2ae97b78723b49a834f9a2e5a41

    SHA512

    36f9a58ed9445842afda8ea46d3fcf33316e36278ba0b5e72f05851d9890ce68126a26ac1d05baa9b66a539288091ee7d9e7037f7daabc8fa68c05c9cfd3cf38

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F2E248BEDDBB2D85122423C41028BFD4
    Filesize

    254B

    MD5

    c5e0c0012305ba995f35387fbe883f41

    SHA1

    7187c8f95d51296bbfa347d2d6331e69c14cb372

    SHA256

    83b8f1b98f7a3d202c08f40a411fd9dbb072fcf2596870b95027f0360c2bff36

    SHA512

    eccdfb4be3777516d151f7422fe07797547140f84a32723e2406e7ae3bc13777572ae41c08bdfafd818c0885283daa391d5e433d3e6b0d68963a106c5eb7be69

  • C:\Users\Admin\AppData\Roaming\VintaSoft Ltd\VintaSoft Imaging .NET SDK 11.0\CRLogTransport.exe
    Filesize

    203KB

    MD5

    2bcb48e8be0872eaa87e5c180b29d589

    SHA1

    bdb1f1b09e774f68b148bf3843771a27f04531c2

    SHA256

    f6ba8405774e1df6c2e4b411d195169abec578af5306906af85fad729756dced

    SHA512

    04f969eb0c5493ad754e774ce94d409a49e0b2884415fd6264fe02001f561bef323a7f35809cdbb11010e41b979fd236545878f14ba31b14d96ed7de0cb97bee

  • C:\Users\Admin\AppData\Roaming\VintaSoft Ltd\VintaSoft Imaging .NET SDK 11.0\CRWindowsClientService.exe
    Filesize

    308KB

    MD5

    fbdc40b60036a6ea191c20884bbce061

    SHA1

    152541b911367b64f0de0051b73436558530ecd9

    SHA256

    96b282bdbbaf82563f49ba8af8089a8b9a121149c52de0211e1a9c8bb8c066fd

    SHA512

    f46ac7cee271adb68b2abb8664a0d601be72823230d1a10940bec1056dca2735d3b4cb978ec7c851078e9df3f31c71c4f032dc4e44b2f4e7708d75ff7272bc84

  • C:\Users\Admin\AppData\Roaming\VintaSoft Ltd\VintaSoft Imaging .NET SDK 11.0\MSVCP140.dll
    Filesize

    439KB

    MD5

    5ff1fca37c466d6723ec67be93b51442

    SHA1

    34cc4e158092083b13d67d6d2bc9e57b798a303b

    SHA256

    5136a49a682ac8d7f1ce71b211de8688fce42ed57210af087a8e2dbc8a934062

    SHA512

    4802ef62630c521d83a1d333969593fb00c9b38f82b4d07f70fbd21f495fea9b3f67676064573d2c71c42bc6f701992989742213501b16087bb6110e337c7546

  • C:\Users\Admin\AppData\Roaming\VintaSoft Ltd\VintaSoft Imaging .NET SDK 11.0\VCRUNTIME140.dll
    Filesize

    78KB

    MD5

    a37ee36b536409056a86f50e67777dd7

    SHA1

    1cafa159292aa736fc595fc04e16325b27cd6750

    SHA256

    8934aaeb65b6e6d253dfe72dea5d65856bd871e989d5d3a2a35edfe867bb4825

    SHA512

    3a7c260646315cf8c01f44b2ec60974017496bd0d80dd055c7e43b707cadba2d63aab5e0efd435670aa77886ed86368390d42c4017fc433c3c4b9d1c47d0f356

  • C:\Users\Admin\AppData\Roaming\VintaSoft Ltd\VintaSoft Imaging .NET SDK 11.0\api-ms-win-core-file-l1-2-0.dll
    Filesize

    11KB

    MD5

    75614f411dec3bff7a4c3443fb06eebe

    SHA1

    bb77b493f3329284437f2173e5031908f080d68f

    SHA256

    196c741e12fe57d9fd3c274af8a93d95e148ac91ada451b31b78923bcea77b17

    SHA512

    f03b71cee885140edc53463132e1d736978ebb0c5e76f2db8c1f7cfd61afa1bf925109f2721cc796ffad4619ca69605c37db496d444c9d34616de5f95c7c9623

  • C:\Users\Admin\AppData\Roaming\VintaSoft Ltd\VintaSoft Imaging .NET SDK 11.0\api-ms-win-core-file-l2-1-0.dll
    Filesize

    11KB

    MD5

    4f361342b691aedc577e1bbbd16a14ae

    SHA1

    b249050dc506fd4199bc2d6a00b2fac61e13842b

    SHA256

    2eb1e71d1112913f09cb372eaaeb19c0b849c81a50649da0e4a66b2c83ad9f32

    SHA512

    4efd2c4ca0e9a7e38c59d9ca797b0efecbf3d8f33e83f3b49b81f5a2b47fdfcc494abc88c634660783861d50087a106ffc713f19d7cc609e9be38e2250e2940a

  • C:\Users\Admin\AppData\Roaming\VintaSoft Ltd\VintaSoft Imaging .NET SDK 11.0\api-ms-win-core-localization-l1-2-0.dll
    Filesize

    14KB

    MD5

    a5ef3ecb8ece8f31bfe429316281d64b

    SHA1

    13b0679242a262ecbda857b163c7db5a4b473c5b

    SHA256

    8678396666040b289999e82d1a0bb2175a6b5543922f05394252f7b3e986d0e7

    SHA512

    6f8da1d0c0122c10051a699cd77c1a21864ab14ba1cd485bd6d4c041e45591024254e642d0ae6310a9e1d1ad32e77183a62dab9dfc8ff050cce9e96d398e7ec2

  • C:\Users\Admin\AppData\Roaming\VintaSoft Ltd\VintaSoft Imaging .NET SDK 11.0\api-ms-win-core-processthreads-l1-1-1.dll
    Filesize

    11KB

    MD5

    a37708eae8e652d16c4af5895cdd3a3d

    SHA1

    94e478d6568f07603e4d509e374b72a5c8b5ec7c

    SHA256

    abe2a6d988bfabb567874495f7fce79878967ccc00fea759597861f3fc73e349

    SHA512

    aa63684bc29bc4eb16a024944a02f4a55a595d7a651f56716ebc635d91474dcf1ed758a9218401ec1ea6610aa881036c3675909f14a37bcc4bd7157da44e21fc

  • C:\Users\Admin\AppData\Roaming\VintaSoft Ltd\VintaSoft Imaging .NET SDK 11.0\api-ms-win-core-synch-l1-2-0.dll
    Filesize

    11KB

    MD5

    a4a4e69a8f18b329a93da1f83fc2f65c

    SHA1

    3bbf6f29e1cd7e4272f01872ad149c7619324fdf

    SHA256

    783ff8abbcbc36d0b3c6c36a19484e60903fbbbbf68122e3883b587336c9f397

    SHA512

    5646e690ca5728bdba7bda0347389df5f3f42e5ed915ef6056c039af8029b0797270d96c43bb754dfd4b8210f65a797f821aa9b0c20e59cd038be23f2cc27320

  • C:\Users\Admin\AppData\Roaming\VintaSoft Ltd\VintaSoft Imaging .NET SDK 11.0\api-ms-win-core-timezone-l1-1-0.dll
    Filesize

    11KB

    MD5

    14d9b19e5b801439fe7f34e195b30306

    SHA1

    8e3c156e9c2fa7054d0456ff8f7e3104fb2694fe

    SHA256

    2004a8a13c016c92b63404b882ad945f21a86e36000b9cb5ba24cf3acedb0de3

    SHA512

    1bb0d5eb3a8fd3173da0f5df1f8d9ae045ce2a21dc73bb2af4b57e537d0b8761711527fedcbc2378b8df300baa317ed2608952de0cad3eb37a9886645f6d94db

  • C:\Users\Admin\AppData\Roaming\VintaSoft Ltd\VintaSoft Imaging .NET SDK 11.0\api-ms-win-crt-convert-l1-1-0.dll
    Filesize

    14KB

    MD5

    88f89d0f2bd5748ed1af75889e715e6a

    SHA1

    8ada489b9ff33530a3fb7161cc07b5b11dfb8909

    SHA256

    02c78781bf6cc5f22a0ecedc3847bfd20bed4065ac028c386d063dc2318c33cc

    SHA512

    1f5a00284ca1d6dc6ae2dfce306febfa6d7d71d421583e4ce6890389334c2d98291e98e992b58136f5d1a41590553e3ad42fb362247ae8adf60e33397afbb5df

  • C:\Users\Admin\AppData\Roaming\VintaSoft Ltd\VintaSoft Imaging .NET SDK 11.0\api-ms-win-crt-filesystem-l1-1-0.dll
    Filesize

    12KB

    MD5

    a1b6cebd3d7a8b25b9a9cbc18d03a00c

    SHA1

    5516de099c49e0e6d1224286c3dc9b4d7985e913

    SHA256

    162ccf78fa5a4a2ee380f72fbd54d17a73c929a76f6e3659f537fa8f42602362

    SHA512

    a322fb09e6faaff0daabb4f0284e4e90ccacff27161dbfd77d39a9a93dbf30069b9d86bf15a07fc2006a55af2c35cd8ea544895c93e2e1697c51f2dafad5a9d7

  • C:\Users\Admin\AppData\Roaming\VintaSoft Ltd\VintaSoft Imaging .NET SDK 11.0\api-ms-win-crt-heap-l1-1-0.dll
    Filesize

    11KB

    MD5

    a6a9dfb31be2510f6dbfedd476c6d15a

    SHA1

    cdb6d8bd1fbd1c71d85437cff55ddeb76139dbe7

    SHA256

    150d32b77b2d7f49c8d4f44b64a90d7a0f9df0874a80fc925daf298b038a8e4c

    SHA512

    b4f0e8fa148fac8a94e04bf4b44f2a26221d943cc399e7f48745ed46e8b58c52d9126110cdf868ebb723423fb0e304983d24fe6608d3757a43ad741bddb3b7ec

  • C:\Users\Admin\AppData\Roaming\VintaSoft Ltd\VintaSoft Imaging .NET SDK 11.0\api-ms-win-crt-locale-l1-1-0.dll
    Filesize

    11KB

    MD5

    755d68cb04411f8c6f86842484b6e38b

    SHA1

    60fc150591e644eaa14d77e6bdedf125f94c14fd

    SHA256

    7e659c94c28f575d8ac20add7cecf421136ff19ce91916d255dc98b5ba16d57b

    SHA512

    b0cc16effb8fbc26bf58e121836e1d95d25e0438b16a21001e6e61173108d206355145d7ac005fd40e40a2ae3bccf24685844322af667754e6d057ba073d5b61

  • C:\Users\Admin\AppData\Roaming\VintaSoft Ltd\VintaSoft Imaging .NET SDK 11.0\api-ms-win-crt-math-l1-1-0.dll
    Filesize

    21KB

    MD5

    461d5af3277efb5f000b9df826581b80

    SHA1

    935b00c88c2065f98746e2b4353d4369216f1812

    SHA256

    f9ce464b89dd8ea1d5e0b852369fe3a8322b4b9860e5ae401c9a3b797aed17bf

    SHA512

    229bf31a1de1e84cf238a0dfe0c3a13fee86da94d611fbc8fdb65086dee6a8b1a6ba37c44c5826c3d8cfa120d0fba9e690d31c5b4e73f98c8362b98be1ee9600

  • C:\Users\Admin\AppData\Roaming\VintaSoft Ltd\VintaSoft Imaging .NET SDK 11.0\api-ms-win-crt-runtime-l1-1-0.dll
    Filesize

    16KB

    MD5

    b3b04c457159e1a174eee384eb8deec7

    SHA1

    09971b91bf45ae9f84475c6565aaf1c40b34079d

    SHA256

    59d0de4eecdb196d8be3856894967f38fea60d3afdd2d42ee7dd61d4638680fd

    SHA512

    e28bdd2a889110e6235f02eb50ee7da2c49dc7dd8373077518f82bc9fd42bf915fedac9ba0dd2b702879da2e8ab99840b7c65011d66a4a296eb8afc3930531c0

  • C:\Users\Admin\AppData\Roaming\VintaSoft Ltd\VintaSoft Imaging .NET SDK 11.0\api-ms-win-crt-stdio-l1-1-0.dll
    Filesize

    16KB

    MD5

    5765103e1f5412c43295bd752ccaea03

    SHA1

    6913bf1624599e55680a0292e22c89cab559db81

    SHA256

    8f7ace43040fa86e972cc74649d3e643d21e4cad6cb86ba78d4c059ed35d95e4

    SHA512

    5844ac30bc73b7ffba75016abefb8a339e2f2822fc6e1441f33f70b6eb7114f828167dfc34527b0fb5460768c4de7250c655bc56efd8ba03115cd2dd6f6c91c0

  • C:\Users\Admin\AppData\Roaming\VintaSoft Ltd\VintaSoft Imaging .NET SDK 11.0\api-ms-win-crt-string-l1-1-0.dll
    Filesize

    17KB

    MD5

    a18e20d0362d9da9a4ed8038938c5d74

    SHA1

    bb07e6e5149ec644eedb850f41039c558c670e4c

    SHA256

    6f7d536bc81d5a395d8b52f4bd448e36349b8ad4854df5e90e55700487ffaf92

    SHA512

    dbf8eb5a2069d248305f0c4e61bf1d718b47dfff539cae37ceb47ad73dae431c96d705fa1b17d85cdb984de89c01e38c12e9e7454519f5723550d2af5e4110f6

  • C:\Users\Admin\AppData\Roaming\VintaSoft Ltd\VintaSoft Imaging .NET SDK 11.0\api-ms-win-crt-time-l1-1-0.dll
    Filesize

    13KB

    MD5

    f575a0246f350985fa8f320c1fb988e4

    SHA1

    a3673d65222205372abcd05bfc1c660d704a16dd

    SHA256

    49fc5116b92695b2437c36d17ffdc5fbde99cf3e48ddc9c1a4beb0e396f0d950

    SHA512

    4b06e54d83e5b42761d16c26a6c19a8a611ae165de94d9d2b8d98915030c0512b068e5c08fcc78cea6fae71d16d29b45bb9a248adf88f5132cea6bed062ed60e

  • C:\Users\Admin\AppData\Roaming\VintaSoft Ltd\VintaSoft Imaging .NET SDK 11.0\ucrtbase.DLL
    Filesize

    1.1MB

    MD5

    2040cdcd779bbebad36d36035c675d99

    SHA1

    918bc19f55e656f6d6b1e4713604483eb997ea15

    SHA256

    2ad9a105a9caa24f41e7b1a6f303c07e6faeceaf3aaf43ebd644d9d5746a4359

    SHA512

    83dc3c7e35f0f83e1224505d04cdbaee12b7ea37a2c3367cb4fccc4fff3e5923cf8a79dd513c33a667d8231b1cc6cfb1e33f957d92e195892060a22f53c7532f

  • C:\Windows\Installer\MSI131B.tmp
    Filesize

    495KB

    MD5

    cfab78ac0d042a1d8ad7085a94328ef6

    SHA1

    b3070cc847ba2739450dc9bd05040df83e7d85d2

    SHA256

    17b10df05b4b92735b673914fe2bf0c0d7bbda5b4a8f9a7fc81a0efaa4380168

    SHA512

    647b909f1e833dd08d99aaa29a3404e64c58356dfa0a3abeb788768d74abb0948d2b612a6da62f2617270cd85110e8aa2b26e5e4558af0d0b84f920c40533438

  • C:\Windows\Installer\MSI14C1.tmp
    Filesize

    495KB

    MD5

    cfab78ac0d042a1d8ad7085a94328ef6

    SHA1

    b3070cc847ba2739450dc9bd05040df83e7d85d2

    SHA256

    17b10df05b4b92735b673914fe2bf0c0d7bbda5b4a8f9a7fc81a0efaa4380168

    SHA512

    647b909f1e833dd08d99aaa29a3404e64c58356dfa0a3abeb788768d74abb0948d2b612a6da62f2617270cd85110e8aa2b26e5e4558af0d0b84f920c40533438

  • C:\Windows\Installer\MSI155E.tmp
    Filesize

    495KB

    MD5

    cfab78ac0d042a1d8ad7085a94328ef6

    SHA1

    b3070cc847ba2739450dc9bd05040df83e7d85d2

    SHA256

    17b10df05b4b92735b673914fe2bf0c0d7bbda5b4a8f9a7fc81a0efaa4380168

    SHA512

    647b909f1e833dd08d99aaa29a3404e64c58356dfa0a3abeb788768d74abb0948d2b612a6da62f2617270cd85110e8aa2b26e5e4558af0d0b84f920c40533438

  • \Users\Admin\AppData\Roaming\VintaSoft Ltd\VintaSoft Imaging .NET SDK 11.0\api-ms-win-core-file-l1-2-0.dll
    Filesize

    11KB

    MD5

    75614f411dec3bff7a4c3443fb06eebe

    SHA1

    bb77b493f3329284437f2173e5031908f080d68f

    SHA256

    196c741e12fe57d9fd3c274af8a93d95e148ac91ada451b31b78923bcea77b17

    SHA512

    f03b71cee885140edc53463132e1d736978ebb0c5e76f2db8c1f7cfd61afa1bf925109f2721cc796ffad4619ca69605c37db496d444c9d34616de5f95c7c9623

  • \Users\Admin\AppData\Roaming\VintaSoft Ltd\VintaSoft Imaging .NET SDK 11.0\api-ms-win-core-file-l1-2-0.dll
    Filesize

    11KB

    MD5

    75614f411dec3bff7a4c3443fb06eebe

    SHA1

    bb77b493f3329284437f2173e5031908f080d68f

    SHA256

    196c741e12fe57d9fd3c274af8a93d95e148ac91ada451b31b78923bcea77b17

    SHA512

    f03b71cee885140edc53463132e1d736978ebb0c5e76f2db8c1f7cfd61afa1bf925109f2721cc796ffad4619ca69605c37db496d444c9d34616de5f95c7c9623

  • \Users\Admin\AppData\Roaming\VintaSoft Ltd\VintaSoft Imaging .NET SDK 11.0\api-ms-win-core-file-l2-1-0.dll
    Filesize

    11KB

    MD5

    4f361342b691aedc577e1bbbd16a14ae

    SHA1

    b249050dc506fd4199bc2d6a00b2fac61e13842b

    SHA256

    2eb1e71d1112913f09cb372eaaeb19c0b849c81a50649da0e4a66b2c83ad9f32

    SHA512

    4efd2c4ca0e9a7e38c59d9ca797b0efecbf3d8f33e83f3b49b81f5a2b47fdfcc494abc88c634660783861d50087a106ffc713f19d7cc609e9be38e2250e2940a

  • \Users\Admin\AppData\Roaming\VintaSoft Ltd\VintaSoft Imaging .NET SDK 11.0\api-ms-win-core-file-l2-1-0.dll
    Filesize

    11KB

    MD5

    4f361342b691aedc577e1bbbd16a14ae

    SHA1

    b249050dc506fd4199bc2d6a00b2fac61e13842b

    SHA256

    2eb1e71d1112913f09cb372eaaeb19c0b849c81a50649da0e4a66b2c83ad9f32

    SHA512

    4efd2c4ca0e9a7e38c59d9ca797b0efecbf3d8f33e83f3b49b81f5a2b47fdfcc494abc88c634660783861d50087a106ffc713f19d7cc609e9be38e2250e2940a

  • \Users\Admin\AppData\Roaming\VintaSoft Ltd\VintaSoft Imaging .NET SDK 11.0\api-ms-win-core-localization-l1-2-0.dll
    Filesize

    14KB

    MD5

    a5ef3ecb8ece8f31bfe429316281d64b

    SHA1

    13b0679242a262ecbda857b163c7db5a4b473c5b

    SHA256

    8678396666040b289999e82d1a0bb2175a6b5543922f05394252f7b3e986d0e7

    SHA512

    6f8da1d0c0122c10051a699cd77c1a21864ab14ba1cd485bd6d4c041e45591024254e642d0ae6310a9e1d1ad32e77183a62dab9dfc8ff050cce9e96d398e7ec2

  • \Users\Admin\AppData\Roaming\VintaSoft Ltd\VintaSoft Imaging .NET SDK 11.0\api-ms-win-core-localization-l1-2-0.dll
    Filesize

    14KB

    MD5

    a5ef3ecb8ece8f31bfe429316281d64b

    SHA1

    13b0679242a262ecbda857b163c7db5a4b473c5b

    SHA256

    8678396666040b289999e82d1a0bb2175a6b5543922f05394252f7b3e986d0e7

    SHA512

    6f8da1d0c0122c10051a699cd77c1a21864ab14ba1cd485bd6d4c041e45591024254e642d0ae6310a9e1d1ad32e77183a62dab9dfc8ff050cce9e96d398e7ec2

  • \Users\Admin\AppData\Roaming\VintaSoft Ltd\VintaSoft Imaging .NET SDK 11.0\api-ms-win-core-processthreads-l1-1-1.dll
    Filesize

    11KB

    MD5

    a37708eae8e652d16c4af5895cdd3a3d

    SHA1

    94e478d6568f07603e4d509e374b72a5c8b5ec7c

    SHA256

    abe2a6d988bfabb567874495f7fce79878967ccc00fea759597861f3fc73e349

    SHA512

    aa63684bc29bc4eb16a024944a02f4a55a595d7a651f56716ebc635d91474dcf1ed758a9218401ec1ea6610aa881036c3675909f14a37bcc4bd7157da44e21fc

  • \Users\Admin\AppData\Roaming\VintaSoft Ltd\VintaSoft Imaging .NET SDK 11.0\api-ms-win-core-processthreads-l1-1-1.dll
    Filesize

    11KB

    MD5

    a37708eae8e652d16c4af5895cdd3a3d

    SHA1

    94e478d6568f07603e4d509e374b72a5c8b5ec7c

    SHA256

    abe2a6d988bfabb567874495f7fce79878967ccc00fea759597861f3fc73e349

    SHA512

    aa63684bc29bc4eb16a024944a02f4a55a595d7a651f56716ebc635d91474dcf1ed758a9218401ec1ea6610aa881036c3675909f14a37bcc4bd7157da44e21fc

  • \Users\Admin\AppData\Roaming\VintaSoft Ltd\VintaSoft Imaging .NET SDK 11.0\api-ms-win-core-synch-l1-2-0.dll
    Filesize

    11KB

    MD5

    a4a4e69a8f18b329a93da1f83fc2f65c

    SHA1

    3bbf6f29e1cd7e4272f01872ad149c7619324fdf

    SHA256

    783ff8abbcbc36d0b3c6c36a19484e60903fbbbbf68122e3883b587336c9f397

    SHA512

    5646e690ca5728bdba7bda0347389df5f3f42e5ed915ef6056c039af8029b0797270d96c43bb754dfd4b8210f65a797f821aa9b0c20e59cd038be23f2cc27320

  • \Users\Admin\AppData\Roaming\VintaSoft Ltd\VintaSoft Imaging .NET SDK 11.0\api-ms-win-core-synch-l1-2-0.dll
    Filesize

    11KB

    MD5

    a4a4e69a8f18b329a93da1f83fc2f65c

    SHA1

    3bbf6f29e1cd7e4272f01872ad149c7619324fdf

    SHA256

    783ff8abbcbc36d0b3c6c36a19484e60903fbbbbf68122e3883b587336c9f397

    SHA512

    5646e690ca5728bdba7bda0347389df5f3f42e5ed915ef6056c039af8029b0797270d96c43bb754dfd4b8210f65a797f821aa9b0c20e59cd038be23f2cc27320

  • \Users\Admin\AppData\Roaming\VintaSoft Ltd\VintaSoft Imaging .NET SDK 11.0\api-ms-win-core-timezone-l1-1-0.dll
    Filesize

    11KB

    MD5

    14d9b19e5b801439fe7f34e195b30306

    SHA1

    8e3c156e9c2fa7054d0456ff8f7e3104fb2694fe

    SHA256

    2004a8a13c016c92b63404b882ad945f21a86e36000b9cb5ba24cf3acedb0de3

    SHA512

    1bb0d5eb3a8fd3173da0f5df1f8d9ae045ce2a21dc73bb2af4b57e537d0b8761711527fedcbc2378b8df300baa317ed2608952de0cad3eb37a9886645f6d94db

  • \Users\Admin\AppData\Roaming\VintaSoft Ltd\VintaSoft Imaging .NET SDK 11.0\api-ms-win-core-timezone-l1-1-0.dll
    Filesize

    11KB

    MD5

    14d9b19e5b801439fe7f34e195b30306

    SHA1

    8e3c156e9c2fa7054d0456ff8f7e3104fb2694fe

    SHA256

    2004a8a13c016c92b63404b882ad945f21a86e36000b9cb5ba24cf3acedb0de3

    SHA512

    1bb0d5eb3a8fd3173da0f5df1f8d9ae045ce2a21dc73bb2af4b57e537d0b8761711527fedcbc2378b8df300baa317ed2608952de0cad3eb37a9886645f6d94db

  • \Users\Admin\AppData\Roaming\VintaSoft Ltd\VintaSoft Imaging .NET SDK 11.0\api-ms-win-crt-convert-l1-1-0.dll
    Filesize

    14KB

    MD5

    88f89d0f2bd5748ed1af75889e715e6a

    SHA1

    8ada489b9ff33530a3fb7161cc07b5b11dfb8909

    SHA256

    02c78781bf6cc5f22a0ecedc3847bfd20bed4065ac028c386d063dc2318c33cc

    SHA512

    1f5a00284ca1d6dc6ae2dfce306febfa6d7d71d421583e4ce6890389334c2d98291e98e992b58136f5d1a41590553e3ad42fb362247ae8adf60e33397afbb5df

  • \Users\Admin\AppData\Roaming\VintaSoft Ltd\VintaSoft Imaging .NET SDK 11.0\api-ms-win-crt-convert-l1-1-0.dll
    Filesize

    14KB

    MD5

    88f89d0f2bd5748ed1af75889e715e6a

    SHA1

    8ada489b9ff33530a3fb7161cc07b5b11dfb8909

    SHA256

    02c78781bf6cc5f22a0ecedc3847bfd20bed4065ac028c386d063dc2318c33cc

    SHA512

    1f5a00284ca1d6dc6ae2dfce306febfa6d7d71d421583e4ce6890389334c2d98291e98e992b58136f5d1a41590553e3ad42fb362247ae8adf60e33397afbb5df

  • \Users\Admin\AppData\Roaming\VintaSoft Ltd\VintaSoft Imaging .NET SDK 11.0\api-ms-win-crt-filesystem-l1-1-0.dll
    Filesize

    12KB

    MD5

    a1b6cebd3d7a8b25b9a9cbc18d03a00c

    SHA1

    5516de099c49e0e6d1224286c3dc9b4d7985e913

    SHA256

    162ccf78fa5a4a2ee380f72fbd54d17a73c929a76f6e3659f537fa8f42602362

    SHA512

    a322fb09e6faaff0daabb4f0284e4e90ccacff27161dbfd77d39a9a93dbf30069b9d86bf15a07fc2006a55af2c35cd8ea544895c93e2e1697c51f2dafad5a9d7

  • \Users\Admin\AppData\Roaming\VintaSoft Ltd\VintaSoft Imaging .NET SDK 11.0\api-ms-win-crt-filesystem-l1-1-0.dll
    Filesize

    12KB

    MD5

    a1b6cebd3d7a8b25b9a9cbc18d03a00c

    SHA1

    5516de099c49e0e6d1224286c3dc9b4d7985e913

    SHA256

    162ccf78fa5a4a2ee380f72fbd54d17a73c929a76f6e3659f537fa8f42602362

    SHA512

    a322fb09e6faaff0daabb4f0284e4e90ccacff27161dbfd77d39a9a93dbf30069b9d86bf15a07fc2006a55af2c35cd8ea544895c93e2e1697c51f2dafad5a9d7

  • \Users\Admin\AppData\Roaming\VintaSoft Ltd\VintaSoft Imaging .NET SDK 11.0\api-ms-win-crt-heap-l1-1-0.dll
    Filesize

    11KB

    MD5

    a6a9dfb31be2510f6dbfedd476c6d15a

    SHA1

    cdb6d8bd1fbd1c71d85437cff55ddeb76139dbe7

    SHA256

    150d32b77b2d7f49c8d4f44b64a90d7a0f9df0874a80fc925daf298b038a8e4c

    SHA512

    b4f0e8fa148fac8a94e04bf4b44f2a26221d943cc399e7f48745ed46e8b58c52d9126110cdf868ebb723423fb0e304983d24fe6608d3757a43ad741bddb3b7ec

  • \Users\Admin\AppData\Roaming\VintaSoft Ltd\VintaSoft Imaging .NET SDK 11.0\api-ms-win-crt-heap-l1-1-0.dll
    Filesize

    11KB

    MD5

    a6a9dfb31be2510f6dbfedd476c6d15a

    SHA1

    cdb6d8bd1fbd1c71d85437cff55ddeb76139dbe7

    SHA256

    150d32b77b2d7f49c8d4f44b64a90d7a0f9df0874a80fc925daf298b038a8e4c

    SHA512

    b4f0e8fa148fac8a94e04bf4b44f2a26221d943cc399e7f48745ed46e8b58c52d9126110cdf868ebb723423fb0e304983d24fe6608d3757a43ad741bddb3b7ec

  • \Users\Admin\AppData\Roaming\VintaSoft Ltd\VintaSoft Imaging .NET SDK 11.0\api-ms-win-crt-locale-l1-1-0.dll
    Filesize

    11KB

    MD5

    755d68cb04411f8c6f86842484b6e38b

    SHA1

    60fc150591e644eaa14d77e6bdedf125f94c14fd

    SHA256

    7e659c94c28f575d8ac20add7cecf421136ff19ce91916d255dc98b5ba16d57b

    SHA512

    b0cc16effb8fbc26bf58e121836e1d95d25e0438b16a21001e6e61173108d206355145d7ac005fd40e40a2ae3bccf24685844322af667754e6d057ba073d5b61

  • \Users\Admin\AppData\Roaming\VintaSoft Ltd\VintaSoft Imaging .NET SDK 11.0\api-ms-win-crt-locale-l1-1-0.dll
    Filesize

    11KB

    MD5

    755d68cb04411f8c6f86842484b6e38b

    SHA1

    60fc150591e644eaa14d77e6bdedf125f94c14fd

    SHA256

    7e659c94c28f575d8ac20add7cecf421136ff19ce91916d255dc98b5ba16d57b

    SHA512

    b0cc16effb8fbc26bf58e121836e1d95d25e0438b16a21001e6e61173108d206355145d7ac005fd40e40a2ae3bccf24685844322af667754e6d057ba073d5b61

  • \Users\Admin\AppData\Roaming\VintaSoft Ltd\VintaSoft Imaging .NET SDK 11.0\api-ms-win-crt-math-l1-1-0.dll
    Filesize

    21KB

    MD5

    461d5af3277efb5f000b9df826581b80

    SHA1

    935b00c88c2065f98746e2b4353d4369216f1812

    SHA256

    f9ce464b89dd8ea1d5e0b852369fe3a8322b4b9860e5ae401c9a3b797aed17bf

    SHA512

    229bf31a1de1e84cf238a0dfe0c3a13fee86da94d611fbc8fdb65086dee6a8b1a6ba37c44c5826c3d8cfa120d0fba9e690d31c5b4e73f98c8362b98be1ee9600

  • \Users\Admin\AppData\Roaming\VintaSoft Ltd\VintaSoft Imaging .NET SDK 11.0\api-ms-win-crt-math-l1-1-0.dll
    Filesize

    21KB

    MD5

    461d5af3277efb5f000b9df826581b80

    SHA1

    935b00c88c2065f98746e2b4353d4369216f1812

    SHA256

    f9ce464b89dd8ea1d5e0b852369fe3a8322b4b9860e5ae401c9a3b797aed17bf

    SHA512

    229bf31a1de1e84cf238a0dfe0c3a13fee86da94d611fbc8fdb65086dee6a8b1a6ba37c44c5826c3d8cfa120d0fba9e690d31c5b4e73f98c8362b98be1ee9600

  • \Users\Admin\AppData\Roaming\VintaSoft Ltd\VintaSoft Imaging .NET SDK 11.0\api-ms-win-crt-runtime-l1-1-0.dll
    Filesize

    16KB

    MD5

    b3b04c457159e1a174eee384eb8deec7

    SHA1

    09971b91bf45ae9f84475c6565aaf1c40b34079d

    SHA256

    59d0de4eecdb196d8be3856894967f38fea60d3afdd2d42ee7dd61d4638680fd

    SHA512

    e28bdd2a889110e6235f02eb50ee7da2c49dc7dd8373077518f82bc9fd42bf915fedac9ba0dd2b702879da2e8ab99840b7c65011d66a4a296eb8afc3930531c0

  • \Users\Admin\AppData\Roaming\VintaSoft Ltd\VintaSoft Imaging .NET SDK 11.0\api-ms-win-crt-runtime-l1-1-0.dll
    Filesize

    16KB

    MD5

    b3b04c457159e1a174eee384eb8deec7

    SHA1

    09971b91bf45ae9f84475c6565aaf1c40b34079d

    SHA256

    59d0de4eecdb196d8be3856894967f38fea60d3afdd2d42ee7dd61d4638680fd

    SHA512

    e28bdd2a889110e6235f02eb50ee7da2c49dc7dd8373077518f82bc9fd42bf915fedac9ba0dd2b702879da2e8ab99840b7c65011d66a4a296eb8afc3930531c0

  • \Users\Admin\AppData\Roaming\VintaSoft Ltd\VintaSoft Imaging .NET SDK 11.0\api-ms-win-crt-stdio-l1-1-0.dll
    Filesize

    16KB

    MD5

    5765103e1f5412c43295bd752ccaea03

    SHA1

    6913bf1624599e55680a0292e22c89cab559db81

    SHA256

    8f7ace43040fa86e972cc74649d3e643d21e4cad6cb86ba78d4c059ed35d95e4

    SHA512

    5844ac30bc73b7ffba75016abefb8a339e2f2822fc6e1441f33f70b6eb7114f828167dfc34527b0fb5460768c4de7250c655bc56efd8ba03115cd2dd6f6c91c0

  • \Users\Admin\AppData\Roaming\VintaSoft Ltd\VintaSoft Imaging .NET SDK 11.0\api-ms-win-crt-stdio-l1-1-0.dll
    Filesize

    16KB

    MD5

    5765103e1f5412c43295bd752ccaea03

    SHA1

    6913bf1624599e55680a0292e22c89cab559db81

    SHA256

    8f7ace43040fa86e972cc74649d3e643d21e4cad6cb86ba78d4c059ed35d95e4

    SHA512

    5844ac30bc73b7ffba75016abefb8a339e2f2822fc6e1441f33f70b6eb7114f828167dfc34527b0fb5460768c4de7250c655bc56efd8ba03115cd2dd6f6c91c0

  • \Users\Admin\AppData\Roaming\VintaSoft Ltd\VintaSoft Imaging .NET SDK 11.0\api-ms-win-crt-string-l1-1-0.dll
    Filesize

    17KB

    MD5

    a18e20d0362d9da9a4ed8038938c5d74

    SHA1

    bb07e6e5149ec644eedb850f41039c558c670e4c

    SHA256

    6f7d536bc81d5a395d8b52f4bd448e36349b8ad4854df5e90e55700487ffaf92

    SHA512

    dbf8eb5a2069d248305f0c4e61bf1d718b47dfff539cae37ceb47ad73dae431c96d705fa1b17d85cdb984de89c01e38c12e9e7454519f5723550d2af5e4110f6

  • \Users\Admin\AppData\Roaming\VintaSoft Ltd\VintaSoft Imaging .NET SDK 11.0\api-ms-win-crt-string-l1-1-0.dll
    Filesize

    17KB

    MD5

    a18e20d0362d9da9a4ed8038938c5d74

    SHA1

    bb07e6e5149ec644eedb850f41039c558c670e4c

    SHA256

    6f7d536bc81d5a395d8b52f4bd448e36349b8ad4854df5e90e55700487ffaf92

    SHA512

    dbf8eb5a2069d248305f0c4e61bf1d718b47dfff539cae37ceb47ad73dae431c96d705fa1b17d85cdb984de89c01e38c12e9e7454519f5723550d2af5e4110f6

  • \Users\Admin\AppData\Roaming\VintaSoft Ltd\VintaSoft Imaging .NET SDK 11.0\msvcp140.dll
    Filesize

    439KB

    MD5

    5ff1fca37c466d6723ec67be93b51442

    SHA1

    34cc4e158092083b13d67d6d2bc9e57b798a303b

    SHA256

    5136a49a682ac8d7f1ce71b211de8688fce42ed57210af087a8e2dbc8a934062

    SHA512

    4802ef62630c521d83a1d333969593fb00c9b38f82b4d07f70fbd21f495fea9b3f67676064573d2c71c42bc6f701992989742213501b16087bb6110e337c7546

  • \Users\Admin\AppData\Roaming\VintaSoft Ltd\VintaSoft Imaging .NET SDK 11.0\msvcp140.dll
    Filesize

    439KB

    MD5

    5ff1fca37c466d6723ec67be93b51442

    SHA1

    34cc4e158092083b13d67d6d2bc9e57b798a303b

    SHA256

    5136a49a682ac8d7f1ce71b211de8688fce42ed57210af087a8e2dbc8a934062

    SHA512

    4802ef62630c521d83a1d333969593fb00c9b38f82b4d07f70fbd21f495fea9b3f67676064573d2c71c42bc6f701992989742213501b16087bb6110e337c7546

  • \Users\Admin\AppData\Roaming\VintaSoft Ltd\VintaSoft Imaging .NET SDK 11.0\ucrtbase.dll
    Filesize

    1.1MB

    MD5

    2040cdcd779bbebad36d36035c675d99

    SHA1

    918bc19f55e656f6d6b1e4713604483eb997ea15

    SHA256

    2ad9a105a9caa24f41e7b1a6f303c07e6faeceaf3aaf43ebd644d9d5746a4359

    SHA512

    83dc3c7e35f0f83e1224505d04cdbaee12b7ea37a2c3367cb4fccc4fff3e5923cf8a79dd513c33a667d8231b1cc6cfb1e33f957d92e195892060a22f53c7532f

  • \Users\Admin\AppData\Roaming\VintaSoft Ltd\VintaSoft Imaging .NET SDK 11.0\ucrtbase.dll
    Filesize

    1.1MB

    MD5

    2040cdcd779bbebad36d36035c675d99

    SHA1

    918bc19f55e656f6d6b1e4713604483eb997ea15

    SHA256

    2ad9a105a9caa24f41e7b1a6f303c07e6faeceaf3aaf43ebd644d9d5746a4359

    SHA512

    83dc3c7e35f0f83e1224505d04cdbaee12b7ea37a2c3367cb4fccc4fff3e5923cf8a79dd513c33a667d8231b1cc6cfb1e33f957d92e195892060a22f53c7532f

  • \Users\Admin\AppData\Roaming\VintaSoft Ltd\VintaSoft Imaging .NET SDK 11.0\vcruntime140.dll
    Filesize

    78KB

    MD5

    a37ee36b536409056a86f50e67777dd7

    SHA1

    1cafa159292aa736fc595fc04e16325b27cd6750

    SHA256

    8934aaeb65b6e6d253dfe72dea5d65856bd871e989d5d3a2a35edfe867bb4825

    SHA512

    3a7c260646315cf8c01f44b2ec60974017496bd0d80dd055c7e43b707cadba2d63aab5e0efd435670aa77886ed86368390d42c4017fc433c3c4b9d1c47d0f356

  • \Users\Admin\AppData\Roaming\VintaSoft Ltd\VintaSoft Imaging .NET SDK 11.0\vcruntime140.dll
    Filesize

    78KB

    MD5

    a37ee36b536409056a86f50e67777dd7

    SHA1

    1cafa159292aa736fc595fc04e16325b27cd6750

    SHA256

    8934aaeb65b6e6d253dfe72dea5d65856bd871e989d5d3a2a35edfe867bb4825

    SHA512

    3a7c260646315cf8c01f44b2ec60974017496bd0d80dd055c7e43b707cadba2d63aab5e0efd435670aa77886ed86368390d42c4017fc433c3c4b9d1c47d0f356

  • \Windows\Installer\MSI131B.tmp
    Filesize

    495KB

    MD5

    cfab78ac0d042a1d8ad7085a94328ef6

    SHA1

    b3070cc847ba2739450dc9bd05040df83e7d85d2

    SHA256

    17b10df05b4b92735b673914fe2bf0c0d7bbda5b4a8f9a7fc81a0efaa4380168

    SHA512

    647b909f1e833dd08d99aaa29a3404e64c58356dfa0a3abeb788768d74abb0948d2b612a6da62f2617270cd85110e8aa2b26e5e4558af0d0b84f920c40533438

  • \Windows\Installer\MSI14C1.tmp
    Filesize

    495KB

    MD5

    cfab78ac0d042a1d8ad7085a94328ef6

    SHA1

    b3070cc847ba2739450dc9bd05040df83e7d85d2

    SHA256

    17b10df05b4b92735b673914fe2bf0c0d7bbda5b4a8f9a7fc81a0efaa4380168

    SHA512

    647b909f1e833dd08d99aaa29a3404e64c58356dfa0a3abeb788768d74abb0948d2b612a6da62f2617270cd85110e8aa2b26e5e4558af0d0b84f920c40533438

  • \Windows\Installer\MSI155E.tmp
    Filesize

    495KB

    MD5

    cfab78ac0d042a1d8ad7085a94328ef6

    SHA1

    b3070cc847ba2739450dc9bd05040df83e7d85d2

    SHA256

    17b10df05b4b92735b673914fe2bf0c0d7bbda5b4a8f9a7fc81a0efaa4380168

    SHA512

    647b909f1e833dd08d99aaa29a3404e64c58356dfa0a3abeb788768d74abb0948d2b612a6da62f2617270cd85110e8aa2b26e5e4558af0d0b84f920c40533438

  • memory/1224-68-0x0000000000000000-mapping.dmp
  • memory/1644-54-0x000007FEFC331000-0x000007FEFC333000-memory.dmp
    Filesize

    8KB

  • memory/1888-61-0x0000000076781000-0x0000000076783000-memory.dmp
    Filesize

    8KB

  • memory/1888-60-0x0000000000000000-mapping.dmp
  • memory/1928-70-0x0000000000000000-mapping.dmp
  • memory/2040-126-0x0000000000000000-mapping.dmp
  • memory/2040-128-0x0000000004770000-0x00000000047AC000-memory.dmp
    Filesize

    240KB

  • memory/2040-133-0x0000000007260000-0x000000000BB60000-memory.dmp
    Filesize

    73.0MB