babadeda | hxxps://gitlab[.]com/Binayak7/golden/-/raw/main/Cloud_Stx2[.]msi?inline=false

Analysis

max time kernel
144s
max time network
159s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
13-09-2022 13:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://gitlab.com/Binayak7/golden/-/raw/main/Cloud_Stx2.msi?inline=false

Score

10^/10

babadeda crypter loader persistence

Malware Config

Signatures

Babadeda
Babadeda is a crypter delivered as a legitimate installer and used to drop other malware families.
loader crypter babadeda

Babadeda Crypter 4 IoCs

resource	yara_rule
behavioral1/files/0x00060000000144a3-117.dat	family_babadeda
behavioral1/memory/1000-131-0x000000000BAA0000-0x000000000EFA0000-memory.dmp	family_babadeda
behavioral1/memory/1000-137-0x000000000BAA0000-0x000000000EFA0000-memory.dmp	family_babadeda
behavioral1/memory/472-142-0x000000000B900000-0x000000000EE00000-memory.dmp	family_babadeda

Blocklisted process makes network request 4 IoCs

flow	pid	Process
16	1092	msiexec.exe
18	1092	msiexec.exe
19	1808	msiexec.exe
24	1332	msiexec.exe

Executes dropped EXE 2 IoCs

pid	Process
1000	Snapseed.exe
472	Snapseed.exe

Loads dropped DLL 54 IoCs

pid	Process
1620	MsiExec.exe
1620	MsiExec.exe
1620	MsiExec.exe
1000	Snapseed.exe
1000	Snapseed.exe
1000	Snapseed.exe
1000	Snapseed.exe
1000	Snapseed.exe
1000	Snapseed.exe
1000	Snapseed.exe
1000	Snapseed.exe
1000	Snapseed.exe
1000	Snapseed.exe
1000	Snapseed.exe
1000	Snapseed.exe
1000	Snapseed.exe
1000	Snapseed.exe
1000	Snapseed.exe
1000	Snapseed.exe
1000	Snapseed.exe
1000	Snapseed.exe
1000	Snapseed.exe
1000	Snapseed.exe
1000	Snapseed.exe
1000	Snapseed.exe
1000	Snapseed.exe
1000	Snapseed.exe
280	MsiExec.exe
280	MsiExec.exe
280	MsiExec.exe
472	Snapseed.exe
472	Snapseed.exe
472	Snapseed.exe
472	Snapseed.exe
472	Snapseed.exe
472	Snapseed.exe
472	Snapseed.exe
472	Snapseed.exe
472	Snapseed.exe
472	Snapseed.exe
472	Snapseed.exe
472	Snapseed.exe
472	Snapseed.exe
472	Snapseed.exe
472	Snapseed.exe
472	Snapseed.exe
472	Snapseed.exe
472	Snapseed.exe
472	Snapseed.exe
472	Snapseed.exe
472	Snapseed.exe
472	Snapseed.exe
472	Snapseed.exe
472	Snapseed.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\GUI Interactive Interface = "C:\\Users\\Admin\\AppData\\Local\\Visual GDB Studio\\Visual GDB Studio\\Snapseed.exe"	Snapseed.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe

Maps connected drives based on registry 3 TTPs 4 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	Snapseed.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	Snapseed.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	Snapseed.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	Snapseed.exe

Drops file in Windows directory 17 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI1D90.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC077.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\6cbda5.msi	msiexec.exe
File created	C:\Windows\Installer\6cbda7.ipi	msiexec.exe
File created	C:\Windows\Installer\6cbda9.msi	msiexec.exe
File created	C:\Windows\Installer\6cbdab.ipi	msiexec.exe
File created	C:\Windows\Installer\6cbda5.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC5A8.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\6cbda9.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1D70.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC1FE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\6cbda7.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1CF2.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI93AA.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\6cbdab.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC28B.tmp	msiexec.exe

Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\PhishingFilter	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = 00c5519782c7d801	iexplore.exe

Modifies Internet Explorer settings 1 TTPs 30 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CFD62EC1-3375-11ED-B4BC-4A12BD72B3C7} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "369846636"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Modifies registry class 48 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_Classes\Local Settings	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "2"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "6"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "48"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0c00000050000000a66a63283d95d211b5d600c04fd918d00b0000007800000030f125b7ef471a10a5f102608c9eebac0e00000078000000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f44471a0359723fa74489c55595fe6b30ee0000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlot = "2"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 200000001a00eebbfe230000100090e24d373f126545916439c4925e467b00000000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	iexplore.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
1808	msiexec.exe
1808	msiexec.exe
1808	msiexec.exe
1808	msiexec.exe
1808	msiexec.exe
1808	msiexec.exe
1808	msiexec.exe
1808	msiexec.exe
1332	msiexec.exe
1332	msiexec.exe
1332	msiexec.exe
1332	msiexec.exe
1332	msiexec.exe
1332	msiexec.exe
1808	msiexec.exe
1808	msiexec.exe
1808	msiexec.exe
1808	msiexec.exe
1808	msiexec.exe
1808	msiexec.exe
1332	msiexec.exe
1332	msiexec.exe
1332	msiexec.exe
1332	msiexec.exe
1332	msiexec.exe
1332	msiexec.exe
1808	msiexec.exe
1808	msiexec.exe
1808	msiexec.exe
1808	msiexec.exe
1808	msiexec.exe
1808	msiexec.exe
1808	msiexec.exe
1808	msiexec.exe
1808	msiexec.exe
1808	msiexec.exe
1332	msiexec.exe
1332	msiexec.exe
1332	msiexec.exe
1332	msiexec.exe
1332	msiexec.exe
1332	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1092	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1092	msiexec.exe
Token: SeRestorePrivilege	1808	msiexec.exe
Token: SeTakeOwnershipPrivilege	1808	msiexec.exe
Token: SeSecurityPrivilege	1808	msiexec.exe
Token: SeCreateTokenPrivilege	1092	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1092	msiexec.exe
Token: SeLockMemoryPrivilege	1092	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1092	msiexec.exe
Token: SeMachineAccountPrivilege	1092	msiexec.exe
Token: SeTcbPrivilege	1092	msiexec.exe
Token: SeSecurityPrivilege	1092	msiexec.exe
Token: SeTakeOwnershipPrivilege	1092	msiexec.exe
Token: SeLoadDriverPrivilege	1092	msiexec.exe
Token: SeSystemProfilePrivilege	1092	msiexec.exe
Token: SeSystemtimePrivilege	1092	msiexec.exe
Token: SeProfSingleProcessPrivilege	1092	msiexec.exe
Token: SeIncBasePriorityPrivilege	1092	msiexec.exe
Token: SeCreatePagefilePrivilege	1092	msiexec.exe
Token: SeCreatePermanentPrivilege	1092	msiexec.exe
Token: SeBackupPrivilege	1092	msiexec.exe
Token: SeRestorePrivilege	1092	msiexec.exe
Token: SeShutdownPrivilege	1092	msiexec.exe
Token: SeDebugPrivilege	1092	msiexec.exe
Token: SeAuditPrivilege	1092	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1092	msiexec.exe
Token: SeChangeNotifyPrivilege	1092	msiexec.exe
Token: SeRemoteShutdownPrivilege	1092	msiexec.exe
Token: SeUndockPrivilege	1092	msiexec.exe
Token: SeSyncAgentPrivilege	1092	msiexec.exe
Token: SeEnableDelegationPrivilege	1092	msiexec.exe
Token: SeManageVolumePrivilege	1092	msiexec.exe
Token: SeImpersonatePrivilege	1092	msiexec.exe
Token: SeCreateGlobalPrivilege	1092	msiexec.exe
Token: SeRestorePrivilege	1808	msiexec.exe
Token: SeTakeOwnershipPrivilege	1808	msiexec.exe
Token: SeRestorePrivilege	1808	msiexec.exe
Token: SeTakeOwnershipPrivilege	1808	msiexec.exe
Token: SeRestorePrivilege	1808	msiexec.exe
Token: SeTakeOwnershipPrivilege	1808	msiexec.exe
Token: SeRestorePrivilege	1808	msiexec.exe
Token: SeTakeOwnershipPrivilege	1808	msiexec.exe
Token: SeRestorePrivilege	1808	msiexec.exe
Token: SeTakeOwnershipPrivilege	1808	msiexec.exe
Token: SeRestorePrivilege	1808	msiexec.exe
Token: SeTakeOwnershipPrivilege	1808	msiexec.exe
Token: SeRestorePrivilege	1808	msiexec.exe
Token: SeTakeOwnershipPrivilege	1808	msiexec.exe
Token: SeRestorePrivilege	1808	msiexec.exe
Token: SeTakeOwnershipPrivilege	1808	msiexec.exe
Token: SeShutdownPrivilege	1332	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1332	msiexec.exe
Token: SeCreateTokenPrivilege	1332	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1332	msiexec.exe
Token: SeLockMemoryPrivilege	1332	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1332	msiexec.exe
Token: SeMachineAccountPrivilege	1332	msiexec.exe
Token: SeTcbPrivilege	1332	msiexec.exe
Token: SeSecurityPrivilege	1332	msiexec.exe
Token: SeTakeOwnershipPrivilege	1332	msiexec.exe
Token: SeLoadDriverPrivilege	1332	msiexec.exe
Token: SeSystemProfilePrivilege	1332	msiexec.exe
Token: SeSystemtimePrivilege	1332	msiexec.exe
Token: SeProfSingleProcessPrivilege	1332	msiexec.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
756	iexplore.exe
756	iexplore.exe
1092	msiexec.exe
1092	msiexec.exe
1332	msiexec.exe
1332	msiexec.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
756	iexplore.exe
756	iexplore.exe
1416	IEXPLORE.EXE
1416	IEXPLORE.EXE
756	iexplore.exe
1000	Snapseed.exe
1000	Snapseed.exe
472	Snapseed.exe
472	Snapseed.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 756 wrote to memory of 1416	756	iexplore.exe	29
PID 756 wrote to memory of 1416	756	iexplore.exe	29
PID 756 wrote to memory of 1416	756	iexplore.exe	29
PID 756 wrote to memory of 1416	756	iexplore.exe	29
PID 756 wrote to memory of 1092	756	iexplore.exe	32
PID 756 wrote to memory of 1092	756	iexplore.exe	32
PID 756 wrote to memory of 1092	756	iexplore.exe	32
PID 756 wrote to memory of 1092	756	iexplore.exe	32
PID 756 wrote to memory of 1092	756	iexplore.exe	32
PID 1808 wrote to memory of 1620	1808	msiexec.exe	34
PID 1808 wrote to memory of 1620	1808	msiexec.exe	34
PID 1808 wrote to memory of 1620	1808	msiexec.exe	34
PID 1808 wrote to memory of 1620	1808	msiexec.exe	34
PID 1808 wrote to memory of 1620	1808	msiexec.exe	34
PID 1808 wrote to memory of 1620	1808	msiexec.exe	34
PID 1808 wrote to memory of 1620	1808	msiexec.exe	34
PID 1808 wrote to memory of 1000	1808	msiexec.exe	35
PID 1808 wrote to memory of 1000	1808	msiexec.exe	35
PID 1808 wrote to memory of 1000	1808	msiexec.exe	35
PID 1808 wrote to memory of 1000	1808	msiexec.exe	35
PID 756 wrote to memory of 1332	756	iexplore.exe	36
PID 756 wrote to memory of 1332	756	iexplore.exe	36
PID 756 wrote to memory of 1332	756	iexplore.exe	36
PID 756 wrote to memory of 1332	756	iexplore.exe	36
PID 756 wrote to memory of 1332	756	iexplore.exe	36
PID 1808 wrote to memory of 280	1808	msiexec.exe	37
PID 1808 wrote to memory of 280	1808	msiexec.exe	37
PID 1808 wrote to memory of 280	1808	msiexec.exe	37
PID 1808 wrote to memory of 280	1808	msiexec.exe	37
PID 1808 wrote to memory of 280	1808	msiexec.exe	37
PID 1808 wrote to memory of 280	1808	msiexec.exe	37
PID 1808 wrote to memory of 280	1808	msiexec.exe	37
PID 1808 wrote to memory of 472	1808	msiexec.exe	38
PID 1808 wrote to memory of 472	1808	msiexec.exe	38
PID 1808 wrote to memory of 472	1808	msiexec.exe	38
PID 1808 wrote to memory of 472	1808	msiexec.exe	38

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://gitlab.com/Binayak7/golden/-/raw/main/Cloud_Stx2.msi?inline=false
1⤵
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:756
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:756 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1416
- C:\Windows\System32\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Desktop\Cloud_Stx2.msi"
  2⤵
  - Blocklisted process makes network request
  - Enumerates connected drives
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:1092
- C:\Windows\System32\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Desktop\Cloud_Stx2.msi"
  2⤵
  - Blocklisted process makes network request
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:1332

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1808
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 51DD32A1C9A4A0CEA4156E5C0FD7F512
  2⤵
  - Loads dropped DLL
  PID:1620
- C:\Users\Admin\AppData\Local\Visual GDB Studio\Visual GDB Studio\Snapseed.exe
  "C:\Users\Admin\AppData\Local\Visual GDB Studio\Visual GDB Studio\Snapseed.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Maps connected drives based on registry
  - Suspicious use of SetWindowsHookEx
  PID:1000
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 8CF752A715F1AD0EFC6FC2332703A7AD
  2⤵
  - Loads dropped DLL
  PID:280
- C:\Users\Admin\AppData\Local\Visual GDB Studio\Visual GDB Studio\Snapseed.exe
  "C:\Users\Admin\AppData\Local\Visual GDB Studio\Visual GDB Studio\Snapseed.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Maps connected drives based on registry
  - Suspicious use of SetWindowsHookEx
  PID:472

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
60KB

MD5
6c6a24456559f305308cb1fb6c5486b3

SHA1
3273ac27d78572f16c3316732b9756ebc22cb6ed

SHA256
efc3c579bd619ceab040c4b8c1b821b2d82c64fddd9e80a00ec0d7f6577ed973

SHA512
587d4a9175a6aa82cd8bb1c11ca6508f95cd218f76ac322ddbd1bc7146a0e25f8937ee426a6fb0fb0bb045cedb24d8c8a9edfe9f654112f293d8701220f726b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c8ec27c05ddf756e028a8b21b29cb916

SHA1
a55118c614bee62861bda0e7047e40a8a303c250

SHA256
851dedd3aa18aef71d6aef0da2549a5a6cf3b95b5c0ee8cbfcbf4dc2368dd704

SHA512
286a4425a0c108b889e79c3501e6aa5925a2f22e900e00b7415163b600d91571491bcf35f4d2523da8a5515470e566dabd554ccde3b1d579c580426d11a4a68e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
340B

MD5
f80d55a5333fe516767ab5b6fa6f7387

SHA1
bee6cbd7bfb44b69cd82fecbfdff7dbdf38e2f5a

SHA256
eb0b8dfe7df68cc59a08b12648390e21754bad7ddc904d5cf969f086738a9989

SHA512
976ab99a7fb5143234678b2b18d96ddb64af30212ed1d75ea2f87271dfa7d89a00b72ecf9f926cd2a7893546176dd40597b7727d685a4f7d38eddb2df7afe445

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
653cce212e1e4e1b17b9e5dcb31e75fc

SHA1
b06b9f08c7c9fcf08fcf63b7b2b8330698cda8ed

SHA256
8a19d04d3cb36b7eb202d0627753ad7c445f3bf1029ba7c898effb5e922512da

SHA512
384ff9da1f4b39a4afd447855e16dcc51515cd1a0bc708926be65e0274f50d405a43286b72b61ec1084056937a24a8a075a52e89ac02205d5aed48d855fba914

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5eb19a99fe40001aa18a57bc7866d2e0

SHA1
9e299de6cf7c8abbac2898328bab4456d75d2854

SHA256
feca2ca4f1335fe2124fe69e2415b1c192c20bbbc569a8ecdb96fc071782957e

SHA512
0bc738937706e07e16974bc3799548ba5b8a3f38cdd3b836efae6db054008f0f020716a46ee54461a007e37a1fc26dc8ed2254cc030d8db2a4e82aa20acd3733

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
6499425187b52d174556e9d9e5acde20

SHA1
6eb04992261848b4abe981eefcf0dbfa917e0ab3

SHA256
b5395b5fe1ad3b843b0e82fb778b26c423fe10b24d3a574fba29eede17266838

SHA512
0acbfe293097182368a9a6587b672186e8b2a6fb89e976582e14cc11281ea2e37e1b75afce772c9c804c2d154b973b90ad535548973a03d4ccba73dede02a180

Download Submit
C:\Users\Admin\AppData\Local\Visual GDB Studio\Visual GDB Studio\ColorManager.dll

Filesize
372KB

MD5
4baa06b1ef7109ac18dc9e58a8652ebd

SHA1
41ce03b95114dca46675e096433782fa966dd347

SHA256
78478a574bfce81b4e7742d36fd6012b1b4b9a2d3c45a70c84233bbd4f8c7b4f

SHA512
ce64fdd20e2341271283b6e186114dd3ba2993ce8dd30d7875705922f19f33a96e9f4049d880c03bc62aab9ed57d3af7cf42fd7233cfee9dfc943ea2e088804f

Download Submit
C:\Users\Admin\AppData\Local\Visual GDB Studio\Visual GDB Studio\MemoryManager.dll

Filesize
88KB

MD5
c3a3da9888b3f07002545e959efb13ef

SHA1
3d2e85190eaca92a28134f595e076d6f5a458318

SHA256
f675df6678ae72ff5673d5348e8d186a6a76e0b64a18ad92e57f258d719ee357

SHA512
01a772561db90a76e7edc3f1b378fdd0ffab7c51b83efd65122bfeafdbf2c7273b86176508911873002b9fc196f5956c5d89c1f8168ef624d99574bc2dd592f6

Download Submit
C:\Users\Admin\AppData\Local\Visual GDB Studio\Visual GDB Studio\Snapseed.exe

Filesize
9.3MB

MD5
8afc00988751cfd7ad1669e412f0589a

SHA1
5c5ac38c2e070a4c14fdc873cd6f1a858ea633d9

SHA256
bba4fc0d9e6471dd5e3ca23096883574bc721f727fc1e47ba283c404958007ab

SHA512
2bea08d52a09c5d4db552b3ca4d4f685c714e165f2de6b7582a39485cc4d5f049f5264cf2b36cc11c9ff92730964718f5e07510a53fe29194bdffd9d028498ff

Download Submit
C:\Users\Admin\AppData\Local\Visual GDB Studio\Visual GDB Studio\base.dll

Filesize
3.1MB

MD5
0352aebd6674fdaf9688caae374259e8

SHA1
5616247621cb5ca336242d450f1c0cdf89f49fce

SHA256
7a454f18e0112874b65ef9eb27f7d2f1a9de5ee6af7fb0db39bce0e45d78c135

SHA512
3bffbbe1ca78b7da644d9aadd7c94653928cf52d0aa78682e8cdfd6c438c93d5002a9c2b56b4001241a369642cd7cae94f3778db6ac2adad5f11ad1fa3ea565b

Download Submit
C:\Users\Admin\AppData\Local\Visual GDB Studio\Visual GDB Studio\brotlicommon.dll

Filesize
132KB

MD5
0e868ec6a67e491d43ca20ed71c8345d

SHA1
b45397b8bafa891a04476f7ffa55fb5bba0e57b9

SHA256
441039fe954cfb6e3545aeca5d5750b7e3322eb9efc633508cca1dbefb26b24b

SHA512
45e6588671c65ef5eb39abd5f6db790bf1bc8414bfa9073cc9cbbd2bdcd6b9f82a4c6ba47a059521836c34c0504b86b6aa51a19a12317084459d6a6c544829b0

Download Submit
C:\Users\Admin\AppData\Local\Visual GDB Studio\Visual GDB Studio\brotlidec.dll

Filesize
42KB

MD5
1616310c08ec85ab5f0437fbf82faf84

SHA1
c65cb7266cd21f45728097009147596ca08c0a73

SHA256
d9fce48811df001c7f8fe60361f1ea270fc37df7aa73a06a853fd102317cf49d

SHA512
ddb8a547367cb40d29a5b3ae54edeb157a707d21993b4cbf5f83617d50795fe8c5235e1afe850515f5b3ddd286c5bd704c7a2fec14f5eb6998d4719e79bf9a85

Download Submit
C:\Users\Admin\AppData\Local\Visual GDB Studio\Visual GDB Studio\bz2.dll

Filesize
63KB

MD5
37b38a8e9fbc70f3ed962e5720795a04

SHA1
171692daf0a136154edde6e22c791d238ae8c1d0

SHA256
f004cd4113a8d832fc4a57f0e28a9001c2fddf67b3544590dd36d0f60d0cef8c

SHA512
9d34222337bf50122c613f2132346b7dca0df51990921ff0c7372463f0be69a441eab18122c02e1a94c8fcaa71b533dd477282d74dbc769fb490f4d46aba2607

Download Submit
C:\Users\Admin\AppData\Local\Visual GDB Studio\Visual GDB Studio\eos.dll

Filesize
478KB

MD5
74866b0ad75e124534729ca7d97f7272

SHA1
4a887a54281038c7c7de8b31b76b3d50546a173e

SHA256
f668deb9deb8e2417e278d5397cfcc18f12ab735f37fafc4cca6dde629188d21

SHA512
8393d3957dcb7b765faa2d3092370b0c8474677102c0a6f50440bfbd93e11b1b49411af50295703f67cbe56b331c14029e9ad067153c9b1ca0828df7da56aee5

Download Submit
C:\Users\Admin\AppData\Local\Visual GDB Studio\Visual GDB Studio\filtering.dll

Filesize
4.0MB

MD5
0780fde45d90ef4977183e6fdad7365a

SHA1
418a5992a64032879bfcc6ef7971e7ef27e0f7f0

SHA256
363eb6db63fa7ae11af8a4bd085471461a9d7fde44153f7cb1f34000d700dbe5

SHA512
5cbe3ad35e9548c96d8960531e31b99b73994a065b80e6d7b8d01a374a594a53d44a8ddef544655a45290cc94ff0d8f8e2eabd74fe822847813b42b9d8b840d9

Download Submit
C:\Users\Admin\AppData\Local\Visual GDB Studio\Visual GDB Studio\freetype.dll

Filesize
554KB

MD5
839c270a8ba5444eebddd293c61e6333

SHA1
0fcfab6030a91c722aebea4bfd1bcbe2138c71f9

SHA256
ac40311bc17fc9eaf16f4aaf08c07d8a256e07aa4af081c9db9b552b56119e6e

SHA512
d34c0f4fcd77c70fa131af3ca19ed82a1d991f599ef8bf69295be25618a0c94af859a67cd80d4893ce105559a432202281ea2ee67af352878c69f8438a1e48cd

Download Submit
C:\Users\Admin\AppData\Local\Visual GDB Studio\Visual GDB Studio\glew32.dll

Filesize
208KB

MD5
a39dbd473034b13da00bfb49ff0ae43c

SHA1
4531b806a73716ee4821225b5ba37695387b33c2

SHA256
fa05d852bf3ffc3699783e9e4976c5460c7f604e5daad2cb803410eadb7d8a99

SHA512
a0f4a0100318ec877ae71fdfc7afe6dc41ac0d738182bd0d025fc55fff998c55f1223197f300b105990e0b9946270d89a6a9c9facd170805220c9e9ea8f349cb

Download Submit
C:\Users\Admin\AppData\Local\Visual GDB Studio\Visual GDB Studio\gui.dll

Filesize
3.3MB

MD5
3c4c4681d7cc16752eb4ecaa11ea4d4f

SHA1
5971b2bf7d2076d881921a369262a0f4152852dc

SHA256
7a8f379954953a2b725786cf561fb93b93724f737d72d9e5226ec48a78b07a82

SHA512
f132e9f670a62f9fe9aa5afe3b7c21a3c3570768b4b02dedf994b7aaed329a699b4ca49ab687ff9efc2885d0946251badeadceca44b618e274047e7faed733a3

Download Submit
C:\Users\Admin\AppData\Local\Visual GDB Studio\Visual GDB Studio\guiext.dll

Filesize
4.3MB

MD5
822d2c5afb9429ab2aa1338ab1a84b75

SHA1
61015dd6aef68448ced2dc9e9af221ae8070b4ca

SHA256
ad9f20e4c9345bc6d8b343483bb7cca7da598936dd9131e0061da5dce0748e25

SHA512
2f7a26f62418096746aff594db1448e519172cf5e554eb6e777238f4fbe95683aa23e309809ff4f4449e00e563d85491c383493af69c7a035ef495183144d599

Download Submit
C:\Users\Admin\AppData\Local\Visual GDB Studio\Visual GDB Studio\imaging.dll

Filesize
5.6MB

MD5
d00c8b191db5ab48548709352b543efe

SHA1
ebf9f4742b8455804b7b21ceb2b1815eef1bc36d

SHA256
e216166e10177f62992822a3bd0ed2777c882534d4530e88c01484f58df38603

SHA512
cad10fd01a9dbb52beaa87bd99ee47f3827641a7e4932fe755016cabc60a3eb82dee252f6c24326cb1b9529799ccc1fb7c815a88ab4836cf67037c9edb4738d5

Download Submit
C:\Users\Admin\AppData\Local\Visual GDB Studio\Visual GDB Studio\libgss30.dll

Filesize
18KB

MD5
1661490e175ece1bcc7a3741a81f98b0

SHA1
8bc4d0c74c63683a951edd8c0d8c54200d05a1ac

SHA256
03b1ef42a47f8d007a5362855ed673a9141b87e0e05848eecb23ede788d7062f

SHA512
c37db2c34ce1626df517ed1347ada5631558f7d11664d8783b0a182602dbc8ec3ddb29693f4c263f835100e3502d836ef2e06b1aacc3151a9d1badef86261e3f

Download Submit
C:\Users\Admin\AppData\Local\Visual GDB Studio\Visual GDB Studio\libpng14.dll

Filesize
160KB

MD5
b35c40a45b014d7dd5e900dc119a5dd1

SHA1
ec1f1eb3369b943e7ab7844b603760a508c62523

SHA256
97d27df864ffb4a77c24e4ffd3789b53e77da52012ae2fd1e669b3d438816bee

SHA512
605e4f9a969e38f023b4fbcc140e169847546335827f08dd4c49c862e05e38cbb94cdc58a95c2af91d28ebf28c626971dd1f441afc8a1a30080b03f8d5f7059b

Download Submit
C:\Users\Admin\AppData\Local\Visual GDB Studio\Visual GDB Studio\libpng16.dll

Filesize
162KB

MD5
8bb4c17afdeadb4c81da2f407dcb9809

SHA1
ce2bb6eddedf31e9dee7e43d4535250da442e852

SHA256
1ceae383d27ef1b45d19f7bff2ab8fe02d553c861342ac8c2d6a32f9a6c1b825

SHA512
b944a4b1e0e9a3b5418169429810c8933910bcdfe13b87d01027d0a4786ca7ddd44b4540da07a09b9a56a196f7681d31a878b72766991fa3dddc5221bfee82bd

Download Submit
C:\Users\Admin\AppData\Local\Visual GDB Studio\Visual GDB Studio\mdb

Filesize
1.8MB

MD5
462e6f6de54812637e66628a91fc624a

SHA1
25b9fd51c9c5d6585be86ed514590fbcedd96648

SHA256
f985206df113820164f3a5634e5fe4e8769b1b98d7bd0e5f9fe9cfd245655bf0

SHA512
7053669b8f1c8e4b3f82e22ae71590ad78fcf82fec4acdfbee2e1660dbc68281698695dc2fe7cd3221f0133e7d90454e6316f8b72c16da2cfba964f9025c9725

Download Submit
C:\Users\Admin\AppData\Local\Visual GDB Studio\Visual GDB Studio\metadata.dll

Filesize
982KB

MD5
e2a132f05e3bd76fc9e448b9153599b6

SHA1
37ffae2e2164996e7570a4c1d3d17b8de073acbd

SHA256
091dc816826814418e5745aab6dc35e969a1efe7ddffb2b4aad992e827c7e567

SHA512
b2b2370d316f399aabb3031bf4a509c26a5d56148183a95f2dbffeaf2b9a12881d6ce6d7eb2ba879f41671f05958bf3e56d35bff065bf511352ddc14fe5867ef

Download Submit
C:\Users\Admin\AppData\Local\Visual GDB Studio\Visual GDB Studio\plugin.dll

Filesize
223KB

MD5
49ba917bc43fb958144978f16275aa90

SHA1
cc4e3109a8416fc78b950fbe31a49b86d10facec

SHA256
bc0199f8353bfc3b5fb3435361b0805aada166dacc1fcef5ea432e8e0334f30d

SHA512
fe7b924bc64a08ebf9755bda610d30901a374a0d175d707a8e7d3d9c00c0e2106b371fa8d960102cbce5281ae8e397c59cf723fa94a98bcef1616e658b5b59ce

Download Submit
C:\Users\Admin\AppData\Local\Visual GDB Studio\Visual GDB Studio\plugins\defaultfhm_shared.fhm

Filesize
220KB

MD5
e8c15ea3e27b18c551e47562a599a15f

SHA1
8a95166dc4f54a8d0aafbff69a007e963df2db71

SHA256
94860f9ba968c858ca70d0f55558dae6fcb9b1cc635cf464d055ceee992138cd

SHA512
63339f57b4cccae73050dc75456f23e4018429be914d9a0cfa427de48fd37aa0308d1dfb4e882d17ae122cf3417675142c41bb4ddea6ecfe58a5584e06d86e87

Download Submit
C:\Users\Admin\AppData\Local\Visual GDB Studio\Visual GDB Studio\plugins\jpegfhm_shared.fhm

Filesize
479KB

MD5
62c313351dd3c189cfb78e8c3c6f059d

SHA1
ab542323bbde9bab29671716afd27b0408d0403f

SHA256
1566d5e0d9f46728b4fa832003b1819f65c4917ab0c855ee6b6b8002aa84d2d1

SHA512
d035190f7c8c62164ea1ab068666d94e99beb9f896d7280779205092ccb26c1abbbe59355a88c6a8c5f88de4944e28f250af5df18bbb4f022074c3ab719c99dc

Download Submit
C:\Users\Admin\AppData\Local\Visual GDB Studio\Visual GDB Studio\plugins\libtiff.dll

Filesize
508KB

MD5
5973c2b00e318725bda68eb28815ce7c

SHA1
5bd4b1cfc63752de0f9dcbddb56ab65e33d541b0

SHA256
cc7a8214ea18d7ba39afdce1c7d85377c8fbfe56bdcd68da28dd37aa9873045d

SHA512
6aeadb6d02ccd318d3f31e570effcc8b069382f4177cabf98021420d8669869cda0168a42ef9861648ffa04f0e0e28e84423215036a2610bf0261ae8e6411d08

Download Submit
C:\Users\Admin\AppData\Local\Visual GDB Studio\Visual GDB Studio\plugins\tifffhm_shared.fhm

Filesize
268KB

MD5
bec21a75f6efede7390bae1911cce46f

SHA1
147eac275924d57f55181d46475e4fe05a24569f

SHA256
d16ea3d7ed354c7a65f847b9f021dc0a3f4321b5e75b750ad1b8b726a89fc63f

SHA512
d14dfaf13cd2c28f27c100eb6b3c383bb3d37c95602e1ba39b2564d49d1a26bd858a8b953edf3e97e4ccefe9e0dcda9a0023d2e3d9db46e71a9d355f4f25e58c

Download Submit
C:\Users\Admin\AppData\Local\Visual GDB Studio\Visual GDB Studio\updater.dll

Filesize
135KB

MD5
12ff21a9ffce87b63508550d103a0d7b

SHA1
e750ae4a4521deea17ae2462ab2ec2436a678a1a

SHA256
888a48f9119345e78d5e9fb6c9d0049cd83c19482b01fcf010a8a5be2fa90724

SHA512
09e4a9068ec40f3df4fc30df2aebd3f4db8da873828fc5d90e2862f470fdeaba12565d0b04f8c7df2f555d439144c3f412437bc8153a94b85036ae8b0efc077c

Download Submit
C:\Users\Admin\AppData\Local\Visual GDB Studio\Visual GDB Studio\zlib1.dll

Filesize
76KB

MD5
0ac2236d42d8ced5dbd181bf19637783

SHA1
59e317e893831615b7d338f3c328de42c3a04f2d

SHA256
59281018c70bfec371d593d4bd005f8c52c8a3440d96fdf28ad4881bf3c4d78f

SHA512
3c71c2f83110e51c44a6c79efd83490bbc93f022a937d6759cfed103fc250b46a7d895df5d880247381a74642ab8eb6497463202b455f1935d28b24ae0389183

Download Submit
C:\Users\Admin\Desktop\Cloud_Stx2.msi.jsxhoul.partial

Filesize
27.0MB

MD5
f206c3b7697a84a76b75d77e3dfc2ab6

SHA1
020f216318a60a22c728b9c854701a79cb1c30bf

SHA256
3371d3687e9063f0adfd736bb836da6f07883b504c56c8a620cf9212dc72ba24

SHA512
668b4974ac935e14d0bf2fb97504e40118e989c0c1dbe1b1861c3551bafac3faaf9953c51d575cc7f8e511096330636e8c5d5187d503e9d1899e785ddbd2a90f

Download Submit
C:\Windows\Installer\MSIC077.tmp

Filesize
550KB

MD5
0dd1f1ff906c4d1fc7ad962e994cad7f

SHA1
4d1549cf7ef6a63baf83280143d7797d4df4fa2d

SHA256
140f578569adbf831f87275091af9ca200ed8b2453cbe729a0249b9b6f6b4588

SHA512
8d5622bb299bf6bebf3eaa266a9fcbbc953a729e9d9ca20f8f358d7a14599d0a017feef58aa8d3aadc075c6211478bbac2d38e38e36e34096d4dceb51ffd00cb

Download Submit
C:\Windows\Installer\MSIC1FE.tmp

Filesize
550KB

MD5
0dd1f1ff906c4d1fc7ad962e994cad7f

SHA1
4d1549cf7ef6a63baf83280143d7797d4df4fa2d

SHA256
140f578569adbf831f87275091af9ca200ed8b2453cbe729a0249b9b6f6b4588

SHA512
8d5622bb299bf6bebf3eaa266a9fcbbc953a729e9d9ca20f8f358d7a14599d0a017feef58aa8d3aadc075c6211478bbac2d38e38e36e34096d4dceb51ffd00cb

Download Submit
C:\Windows\Installer\MSIC28B.tmp

Filesize
550KB

MD5
0dd1f1ff906c4d1fc7ad962e994cad7f

SHA1
4d1549cf7ef6a63baf83280143d7797d4df4fa2d

SHA256
140f578569adbf831f87275091af9ca200ed8b2453cbe729a0249b9b6f6b4588

SHA512
8d5622bb299bf6bebf3eaa266a9fcbbc953a729e9d9ca20f8f358d7a14599d0a017feef58aa8d3aadc075c6211478bbac2d38e38e36e34096d4dceb51ffd00cb

Download Submit
\Users\Admin\AppData\Local\Visual GDB Studio\Visual GDB Studio\ColorManager.dll

Filesize
372KB

MD5
4baa06b1ef7109ac18dc9e58a8652ebd

SHA1
41ce03b95114dca46675e096433782fa966dd347

SHA256
78478a574bfce81b4e7742d36fd6012b1b4b9a2d3c45a70c84233bbd4f8c7b4f

SHA512
ce64fdd20e2341271283b6e186114dd3ba2993ce8dd30d7875705922f19f33a96e9f4049d880c03bc62aab9ed57d3af7cf42fd7233cfee9dfc943ea2e088804f

Download Submit
\Users\Admin\AppData\Local\Visual GDB Studio\Visual GDB Studio\MemoryManager.dll

Filesize
88KB

MD5
c3a3da9888b3f07002545e959efb13ef

SHA1
3d2e85190eaca92a28134f595e076d6f5a458318

SHA256
f675df6678ae72ff5673d5348e8d186a6a76e0b64a18ad92e57f258d719ee357

SHA512
01a772561db90a76e7edc3f1b378fdd0ffab7c51b83efd65122bfeafdbf2c7273b86176508911873002b9fc196f5956c5d89c1f8168ef624d99574bc2dd592f6

Download Submit
\Users\Admin\AppData\Local\Visual GDB Studio\Visual GDB Studio\base.dll

Filesize
3.1MB

MD5
0352aebd6674fdaf9688caae374259e8

SHA1
5616247621cb5ca336242d450f1c0cdf89f49fce

SHA256
7a454f18e0112874b65ef9eb27f7d2f1a9de5ee6af7fb0db39bce0e45d78c135

SHA512
3bffbbe1ca78b7da644d9aadd7c94653928cf52d0aa78682e8cdfd6c438c93d5002a9c2b56b4001241a369642cd7cae94f3778db6ac2adad5f11ad1fa3ea565b

Download Submit
\Users\Admin\AppData\Local\Visual GDB Studio\Visual GDB Studio\brotlicommon.dll

Filesize
132KB

MD5
0e868ec6a67e491d43ca20ed71c8345d

SHA1
b45397b8bafa891a04476f7ffa55fb5bba0e57b9

SHA256
441039fe954cfb6e3545aeca5d5750b7e3322eb9efc633508cca1dbefb26b24b

SHA512
45e6588671c65ef5eb39abd5f6db790bf1bc8414bfa9073cc9cbbd2bdcd6b9f82a4c6ba47a059521836c34c0504b86b6aa51a19a12317084459d6a6c544829b0

Download Submit
\Users\Admin\AppData\Local\Visual GDB Studio\Visual GDB Studio\brotlidec.dll

Filesize
42KB

MD5
1616310c08ec85ab5f0437fbf82faf84

SHA1
c65cb7266cd21f45728097009147596ca08c0a73

SHA256
d9fce48811df001c7f8fe60361f1ea270fc37df7aa73a06a853fd102317cf49d

SHA512
ddb8a547367cb40d29a5b3ae54edeb157a707d21993b4cbf5f83617d50795fe8c5235e1afe850515f5b3ddd286c5bd704c7a2fec14f5eb6998d4719e79bf9a85

Download Submit
\Users\Admin\AppData\Local\Visual GDB Studio\Visual GDB Studio\bz2.dll

Filesize
63KB

MD5
37b38a8e9fbc70f3ed962e5720795a04

SHA1
171692daf0a136154edde6e22c791d238ae8c1d0

SHA256
f004cd4113a8d832fc4a57f0e28a9001c2fddf67b3544590dd36d0f60d0cef8c

SHA512
9d34222337bf50122c613f2132346b7dca0df51990921ff0c7372463f0be69a441eab18122c02e1a94c8fcaa71b533dd477282d74dbc769fb490f4d46aba2607

Download Submit
\Users\Admin\AppData\Local\Visual GDB Studio\Visual GDB Studio\eos.dll

Filesize
478KB

MD5
74866b0ad75e124534729ca7d97f7272

SHA1
4a887a54281038c7c7de8b31b76b3d50546a173e

SHA256
f668deb9deb8e2417e278d5397cfcc18f12ab735f37fafc4cca6dde629188d21

SHA512
8393d3957dcb7b765faa2d3092370b0c8474677102c0a6f50440bfbd93e11b1b49411af50295703f67cbe56b331c14029e9ad067153c9b1ca0828df7da56aee5

Download Submit
\Users\Admin\AppData\Local\Visual GDB Studio\Visual GDB Studio\filtering.dll

Filesize
4.0MB

MD5
0780fde45d90ef4977183e6fdad7365a

SHA1
418a5992a64032879bfcc6ef7971e7ef27e0f7f0

SHA256
363eb6db63fa7ae11af8a4bd085471461a9d7fde44153f7cb1f34000d700dbe5

SHA512
5cbe3ad35e9548c96d8960531e31b99b73994a065b80e6d7b8d01a374a594a53d44a8ddef544655a45290cc94ff0d8f8e2eabd74fe822847813b42b9d8b840d9

Download Submit
\Users\Admin\AppData\Local\Visual GDB Studio\Visual GDB Studio\freetype.dll

Filesize
554KB

MD5
839c270a8ba5444eebddd293c61e6333

SHA1
0fcfab6030a91c722aebea4bfd1bcbe2138c71f9

SHA256
ac40311bc17fc9eaf16f4aaf08c07d8a256e07aa4af081c9db9b552b56119e6e

SHA512
d34c0f4fcd77c70fa131af3ca19ed82a1d991f599ef8bf69295be25618a0c94af859a67cd80d4893ce105559a432202281ea2ee67af352878c69f8438a1e48cd

Download Submit
\Users\Admin\AppData\Local\Visual GDB Studio\Visual GDB Studio\glew32.dll

Filesize
208KB

MD5
a39dbd473034b13da00bfb49ff0ae43c

SHA1
4531b806a73716ee4821225b5ba37695387b33c2

SHA256
fa05d852bf3ffc3699783e9e4976c5460c7f604e5daad2cb803410eadb7d8a99

SHA512
a0f4a0100318ec877ae71fdfc7afe6dc41ac0d738182bd0d025fc55fff998c55f1223197f300b105990e0b9946270d89a6a9c9facd170805220c9e9ea8f349cb

Download Submit
\Users\Admin\AppData\Local\Visual GDB Studio\Visual GDB Studio\gui.dll

Filesize
3.3MB

MD5
3c4c4681d7cc16752eb4ecaa11ea4d4f

SHA1
5971b2bf7d2076d881921a369262a0f4152852dc

SHA256
7a8f379954953a2b725786cf561fb93b93724f737d72d9e5226ec48a78b07a82

SHA512
f132e9f670a62f9fe9aa5afe3b7c21a3c3570768b4b02dedf994b7aaed329a699b4ca49ab687ff9efc2885d0946251badeadceca44b618e274047e7faed733a3

Download Submit
\Users\Admin\AppData\Local\Visual GDB Studio\Visual GDB Studio\guiext.dll

Filesize
4.3MB

MD5
822d2c5afb9429ab2aa1338ab1a84b75

SHA1
61015dd6aef68448ced2dc9e9af221ae8070b4ca

SHA256
ad9f20e4c9345bc6d8b343483bb7cca7da598936dd9131e0061da5dce0748e25

SHA512
2f7a26f62418096746aff594db1448e519172cf5e554eb6e777238f4fbe95683aa23e309809ff4f4449e00e563d85491c383493af69c7a035ef495183144d599

Download Submit
\Users\Admin\AppData\Local\Visual GDB Studio\Visual GDB Studio\imaging.dll

Filesize
5.6MB

MD5
d00c8b191db5ab48548709352b543efe

SHA1
ebf9f4742b8455804b7b21ceb2b1815eef1bc36d

SHA256
e216166e10177f62992822a3bd0ed2777c882534d4530e88c01484f58df38603

SHA512
cad10fd01a9dbb52beaa87bd99ee47f3827641a7e4932fe755016cabc60a3eb82dee252f6c24326cb1b9529799ccc1fb7c815a88ab4836cf67037c9edb4738d5

Download Submit
\Users\Admin\AppData\Local\Visual GDB Studio\Visual GDB Studio\libgss30.dll

Filesize
18KB

MD5
1661490e175ece1bcc7a3741a81f98b0

SHA1
8bc4d0c74c63683a951edd8c0d8c54200d05a1ac

SHA256
03b1ef42a47f8d007a5362855ed673a9141b87e0e05848eecb23ede788d7062f

SHA512
c37db2c34ce1626df517ed1347ada5631558f7d11664d8783b0a182602dbc8ec3ddb29693f4c263f835100e3502d836ef2e06b1aacc3151a9d1badef86261e3f

Download Submit
\Users\Admin\AppData\Local\Visual GDB Studio\Visual GDB Studio\libpng14.dll

Filesize
160KB

MD5
b35c40a45b014d7dd5e900dc119a5dd1

SHA1
ec1f1eb3369b943e7ab7844b603760a508c62523

SHA256
97d27df864ffb4a77c24e4ffd3789b53e77da52012ae2fd1e669b3d438816bee

SHA512
605e4f9a969e38f023b4fbcc140e169847546335827f08dd4c49c862e05e38cbb94cdc58a95c2af91d28ebf28c626971dd1f441afc8a1a30080b03f8d5f7059b

Download Submit
\Users\Admin\AppData\Local\Visual GDB Studio\Visual GDB Studio\libpng16.dll

Filesize
162KB

MD5
8bb4c17afdeadb4c81da2f407dcb9809

SHA1
ce2bb6eddedf31e9dee7e43d4535250da442e852

SHA256
1ceae383d27ef1b45d19f7bff2ab8fe02d553c861342ac8c2d6a32f9a6c1b825

SHA512
b944a4b1e0e9a3b5418169429810c8933910bcdfe13b87d01027d0a4786ca7ddd44b4540da07a09b9a56a196f7681d31a878b72766991fa3dddc5221bfee82bd

Download Submit
\Users\Admin\AppData\Local\Visual GDB Studio\Visual GDB Studio\metadata.dll

Filesize
982KB

MD5
e2a132f05e3bd76fc9e448b9153599b6

SHA1
37ffae2e2164996e7570a4c1d3d17b8de073acbd

SHA256
091dc816826814418e5745aab6dc35e969a1efe7ddffb2b4aad992e827c7e567

SHA512
b2b2370d316f399aabb3031bf4a509c26a5d56148183a95f2dbffeaf2b9a12881d6ce6d7eb2ba879f41671f05958bf3e56d35bff065bf511352ddc14fe5867ef

Download Submit
\Users\Admin\AppData\Local\Visual GDB Studio\Visual GDB Studio\plugin.dll

Filesize
223KB

MD5
49ba917bc43fb958144978f16275aa90

SHA1
cc4e3109a8416fc78b950fbe31a49b86d10facec

SHA256
bc0199f8353bfc3b5fb3435361b0805aada166dacc1fcef5ea432e8e0334f30d

SHA512
fe7b924bc64a08ebf9755bda610d30901a374a0d175d707a8e7d3d9c00c0e2106b371fa8d960102cbce5281ae8e397c59cf723fa94a98bcef1616e658b5b59ce

Download Submit
\Users\Admin\AppData\Local\Visual GDB Studio\Visual GDB Studio\plugins\defaultfhm_shared.fhm

Filesize
220KB

MD5
e8c15ea3e27b18c551e47562a599a15f

SHA1
8a95166dc4f54a8d0aafbff69a007e963df2db71

SHA256
94860f9ba968c858ca70d0f55558dae6fcb9b1cc635cf464d055ceee992138cd

SHA512
63339f57b4cccae73050dc75456f23e4018429be914d9a0cfa427de48fd37aa0308d1dfb4e882d17ae122cf3417675142c41bb4ddea6ecfe58a5584e06d86e87

Download Submit
\Users\Admin\AppData\Local\Visual GDB Studio\Visual GDB Studio\plugins\jpegfhm_shared.fhm

Filesize
479KB

MD5
62c313351dd3c189cfb78e8c3c6f059d

SHA1
ab542323bbde9bab29671716afd27b0408d0403f

SHA256
1566d5e0d9f46728b4fa832003b1819f65c4917ab0c855ee6b6b8002aa84d2d1

SHA512
d035190f7c8c62164ea1ab068666d94e99beb9f896d7280779205092ccb26c1abbbe59355a88c6a8c5f88de4944e28f250af5df18bbb4f022074c3ab719c99dc

Download Submit
\Users\Admin\AppData\Local\Visual GDB Studio\Visual GDB Studio\plugins\libtiff.dll

Filesize
508KB

MD5
5973c2b00e318725bda68eb28815ce7c

SHA1
5bd4b1cfc63752de0f9dcbddb56ab65e33d541b0

SHA256
cc7a8214ea18d7ba39afdce1c7d85377c8fbfe56bdcd68da28dd37aa9873045d

SHA512
6aeadb6d02ccd318d3f31e570effcc8b069382f4177cabf98021420d8669869cda0168a42ef9861648ffa04f0e0e28e84423215036a2610bf0261ae8e6411d08

Download Submit
\Users\Admin\AppData\Local\Visual GDB Studio\Visual GDB Studio\plugins\tifffhm_shared.fhm

Filesize
268KB

MD5
bec21a75f6efede7390bae1911cce46f

SHA1
147eac275924d57f55181d46475e4fe05a24569f

SHA256
d16ea3d7ed354c7a65f847b9f021dc0a3f4321b5e75b750ad1b8b726a89fc63f

SHA512
d14dfaf13cd2c28f27c100eb6b3c383bb3d37c95602e1ba39b2564d49d1a26bd858a8b953edf3e97e4ccefe9e0dcda9a0023d2e3d9db46e71a9d355f4f25e58c

Download Submit
\Users\Admin\AppData\Local\Visual GDB Studio\Visual GDB Studio\updater.dll

Filesize
135KB

MD5
12ff21a9ffce87b63508550d103a0d7b

SHA1
e750ae4a4521deea17ae2462ab2ec2436a678a1a

SHA256
888a48f9119345e78d5e9fb6c9d0049cd83c19482b01fcf010a8a5be2fa90724

SHA512
09e4a9068ec40f3df4fc30df2aebd3f4db8da873828fc5d90e2862f470fdeaba12565d0b04f8c7df2f555d439144c3f412437bc8153a94b85036ae8b0efc077c

Download Submit
\Users\Admin\AppData\Local\Visual GDB Studio\Visual GDB Studio\zlib1.dll

Filesize
76KB

MD5
0ac2236d42d8ced5dbd181bf19637783

SHA1
59e317e893831615b7d338f3c328de42c3a04f2d

SHA256
59281018c70bfec371d593d4bd005f8c52c8a3440d96fdf28ad4881bf3c4d78f

SHA512
3c71c2f83110e51c44a6c79efd83490bbc93f022a937d6759cfed103fc250b46a7d895df5d880247381a74642ab8eb6497463202b455f1935d28b24ae0389183

Download Submit
\Windows\Installer\MSIC077.tmp

Filesize
550KB

MD5
0dd1f1ff906c4d1fc7ad962e994cad7f

SHA1
4d1549cf7ef6a63baf83280143d7797d4df4fa2d

SHA256
140f578569adbf831f87275091af9ca200ed8b2453cbe729a0249b9b6f6b4588

SHA512
8d5622bb299bf6bebf3eaa266a9fcbbc953a729e9d9ca20f8f358d7a14599d0a017feef58aa8d3aadc075c6211478bbac2d38e38e36e34096d4dceb51ffd00cb

Download Submit
\Windows\Installer\MSIC1FE.tmp

Filesize
550KB

MD5
0dd1f1ff906c4d1fc7ad962e994cad7f

SHA1
4d1549cf7ef6a63baf83280143d7797d4df4fa2d

SHA256
140f578569adbf831f87275091af9ca200ed8b2453cbe729a0249b9b6f6b4588

SHA512
8d5622bb299bf6bebf3eaa266a9fcbbc953a729e9d9ca20f8f358d7a14599d0a017feef58aa8d3aadc075c6211478bbac2d38e38e36e34096d4dceb51ffd00cb

Download Submit
\Windows\Installer\MSIC28B.tmp

Filesize
550KB

MD5
0dd1f1ff906c4d1fc7ad962e994cad7f

SHA1
4d1549cf7ef6a63baf83280143d7797d4df4fa2d

SHA256
140f578569adbf831f87275091af9ca200ed8b2453cbe729a0249b9b6f6b4588

SHA512
8d5622bb299bf6bebf3eaa266a9fcbbc953a729e9d9ca20f8f358d7a14599d0a017feef58aa8d3aadc075c6211478bbac2d38e38e36e34096d4dceb51ffd00cb

Download Submit
memory/472-140-0x00000000001F0000-0x0000000000226000-memory.dmp

Filesize
216KB

Download
memory/472-142-0x000000000B900000-0x000000000EE00000-memory.dmp

Filesize
53.0MB

Download
memory/472-147-0x0000000002E60000-0x0000000002EA1000-memory.dmp

Filesize
260KB

Download
memory/472-143-0x000000000A170000-0x000000000A22C000-memory.dmp

Filesize
752KB

Download
memory/1000-87-0x00000000002E0000-0x0000000000316000-memory.dmp

Filesize
216KB

Download
memory/1000-131-0x000000000BAA0000-0x000000000EFA0000-memory.dmp

Filesize
53.0MB

Download
memory/1000-132-0x0000000003D20000-0x0000000003DDC000-memory.dmp

Filesize
752KB

Download
memory/1000-136-0x00000000033F0000-0x0000000003431000-memory.dmp

Filesize
260KB

Download
memory/1000-137-0x000000000BAA0000-0x000000000EFA0000-memory.dmp

Filesize
53.0MB

Download
memory/1092-57-0x000007FEFC1B1000-0x000007FEFC1B3000-memory.dmp

Filesize
8KB

Download
memory/1620-65-0x0000000075831000-0x0000000075833000-memory.dmp

Filesize
8KB

Download