d39f8f45f12d0654d1ec357e88e3b2794ec3ba3fa3a59fe8879debb67ef166d5

Analysis

max time kernel
148s
max time network
358s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
31-03-2023 19:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

VS.exe
Size

501.9MB
MD5

8d2f3562833dbffd2fd130f52bcfe8c3
SHA1

5e2cf3d9eb67b8da239266265cebb989423b50c2
SHA256

d39f8f45f12d0654d1ec357e88e3b2794ec3ba3fa3a59fe8879debb67ef166d5
SHA512

c11f5d80afffad7471535f411d2d3ac166cdd288837329a69d84d6c94beaa989cb48df886cafcd70d6505c969accb967a3aafbc8aedef7cfb9a39938935b5c26
SSDEEP

12582912:ArDcJZsqAHssJfEHW9GhFDVpw7etV2dHPYERilv:UWt69Gh1VW7HuERuv

Score

8^/10

discovery evasion

Malware Config

Signatures

Modifies Windows Firewall 1 TTPs 4 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exenetsh.exenetsh.exenetsh.exe

pid process

2156 netsh.exe
3576 netsh.exe
4664 netsh.exe
2772 netsh.exe
Executes dropped EXE 3 IoCs

Processes:

VS.tmpVS.exeVS.exe

pid process

2560 VS.tmp
4896 VS.exe
2728 VS.exe

pid	process
2156	netsh.exe
3576	netsh.exe
4664	netsh.exe
2772	netsh.exe

pid	process
2560	VS.tmp
4896	VS.exe
2728	VS.exe

Loads dropped DLL 14 IoCs

Processes:

VS.exeVS.exe

pid	process
4896	VS.exe
4896	VS.exe
4896	VS.exe
4896	VS.exe
4896	VS.exe
4896	VS.exe
4896	VS.exe
2728	VS.exe
2728	VS.exe
2728	VS.exe
2728	VS.exe
2728	VS.exe
2728	VS.exe
2728	VS.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082

Processes:

VS.exeVS.exe

description ioc process

File opened (read-only) \??\D: VS.exe
File opened (read-only) \??\D: VS.exe

description	ioc	process
File opened (read-only)	\??\D:	VS.exe
File opened (read-only)	\??\D:	VS.exe

Drops file in Program Files directory 22 IoCs

Processes:

VS.tmp

description	ioc	process
File opened for modification	C:\Program Files\Imaginando\VS\libEGL.dll	VS.tmp
File created	C:\Program Files\Imaginando\VS\is-K2I0Q.tmp	VS.tmp
File created	C:\Program Files\Imaginando\VS\is-M7PC0.tmp	VS.tmp
File created	C:\Program Files\Imaginando\VS\is-Q7C6C.tmp	VS.tmp
File created	C:\Program Files\Imaginando\VS\is-DF8JT.tmp	VS.tmp
File opened for modification	C:\Program Files\Imaginando\VS\VS.exe	VS.tmp
File opened for modification	C:\Program Files\Imaginando\VS\libcrypto-1_1-x64.dll	VS.tmp
File opened for modification	C:\Program Files\Imaginando\VS\libssl-1_1-x64.dll	VS.tmp
File opened for modification	C:\Program Files\Imaginando\VS\libGLESv2.dll	VS.tmp
File created	C:\Program Files\Imaginando\VS\is-LAIK6.tmp	VS.tmp
File created	C:\Program Files\VstPlugins\Imaginando\is-6C84U.tmp	VS.tmp
File created	C:\Program Files\VstPlugins\Imaginando\is-8PDJT.tmp	VS.tmp
File created	C:\Program Files\Imaginando\VS\is-8TLU5.tmp	VS.tmp
File opened for modification	C:\Program Files\Imaginando\VS\SpoutLibrary.dll	VS.tmp
File opened for modification	C:\Program Files\VstPlugins\Imaginando\VSfx.dll	VS.tmp
File created	C:\Program Files\Imaginando\VS\unins000.msg	VS.tmp
File opened for modification	C:\Program Files\Imaginando\VS\Processing.NDI.Lib.Advanced.x64.dll	VS.tmp
File opened for modification	C:\Program Files\VstPlugins\Imaginando\VS.dll	VS.tmp
File created	C:\Program Files\Imaginando\VS\unins000.dat	VS.tmp
File created	C:\Program Files\Imaginando\VS\is-DI5IS.tmp	VS.tmp
File created	C:\Program Files\Imaginando\VS\is-QISFJ.tmp	VS.tmp
File opened for modification	C:\Program Files\Imaginando\VS\unins000.dat	VS.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

VS.exeVS.exe

pid process

4896 VS.exe
2728 VS.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

VS.tmp

pid process

2560 VS.tmp
2560 VS.tmp
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

AUDIODG.EXE

description pid process

Token: 33 4668 AUDIODG.EXE
Token: SeIncBasePriorityPrivilege 4668 AUDIODG.EXE
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

VS.tmp

pid process

2560 VS.tmp

pid	process
2560	VS.tmp
2560	VS.tmp

description	pid	process
Token: 33	4668	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4668	AUDIODG.EXE

pid	process
2560	VS.tmp

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

VS.exeVS.tmpVS.exe

description	pid	process	target process
PID 3540 wrote to memory of 2560	3540	VS.exe	VS.tmp
PID 3540 wrote to memory of 2560	3540	VS.exe	VS.tmp
PID 3540 wrote to memory of 2560	3540	VS.exe	VS.tmp
PID 2560 wrote to memory of 4896	2560	VS.tmp	VS.exe
PID 2560 wrote to memory of 4896	2560	VS.tmp	VS.exe
PID 4896 wrote to memory of 2156	4896	VS.exe	netsh.exe
PID 4896 wrote to memory of 2156	4896	VS.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\VS.exe
"C:\Users\Admin\AppData\Local\Temp\VS.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3540

C:\Users\Admin\AppData\Local\Temp\is-UPDAB.tmp\VS.tmp
"C:\Users\Admin\AppData\Local\Temp\is-UPDAB.tmp\VS.tmp" /SL5="$80060,525523810,721408,C:\Users\Admin\AppData\Local\Temp\VS.exe"
2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2560

C:\Program Files\Imaginando\VS\VS.exe
"C:\Program Files\Imaginando\VS\VS.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of WriteProcessMemory
PID:4896

C:\Windows\SYSTEM32\netsh.exe
netsh.exe advfirewall firewall delete rule name=NDI_00a316f081952c88e86670207b72859ff3e0385a7519af5366feb424ef061781
4⤵
- Modifies Windows Firewall
PID:2156

C:\Windows\SYSTEM32\netsh.exe
netsh.exe advfirewall firewall add rule name=NDI_00a316f081952c88e86670207b72859ff3e0385a7519af5366feb424ef061781 dir=in action=allow program="C:\Program Files\Imaginando\VS\VS.exe" enable=yes
4⤵
- Modifies Windows Firewall
PID:3576

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2f4 0x450
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4668

C:\Program Files\Imaginando\VS\VS.exe
"C:\Program Files\Imaginando\VS\VS.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Suspicious behavior: AddClipboardFormatListener
PID:2728

C:\Windows\SYSTEM32\netsh.exe
netsh.exe advfirewall firewall delete rule name=NDI_00a316f081952c88e86670207b72859ff3e0385a7519af5366feb424ef061781
2⤵
- Modifies Windows Firewall
PID:4664

C:\Windows\SYSTEM32\netsh.exe
netsh.exe advfirewall firewall add rule name=NDI_00a316f081952c88e86670207b72859ff3e0385a7519af5366feb424ef061781 dir=in action=allow program="C:\Program Files\Imaginando\VS\VS.exe" enable=yes
2⤵
- Modifies Windows Firewall
PID:2772

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Imaginando\VS\Processing.NDI.Lib.Advanced.x64.dll
Filesize
37.3MB

MD5
b32c82bbe257f1a7d8fcd30c0541e563

SHA1
0769b8232533d950985606c08392acdc3b5872f0

SHA256
24ca9c281815c0401b80f59ea0ecd41c74622e316e3b6aff278868df49bd024b

SHA512
5d525ad1dc022ef04640b16a7d01302ba5e5cd94f7dd861b27533fcc828516812d1e9f56f7d50ed0760526c051a00663ab1a7816f2145db2ae580b5ae77d3c43

Download Submit
C:\Program Files\Imaginando\VS\Processing.NDI.Lib.Advanced.x64.dll
Filesize
37.3MB

MD5
b32c82bbe257f1a7d8fcd30c0541e563

SHA1
0769b8232533d950985606c08392acdc3b5872f0

SHA256
24ca9c281815c0401b80f59ea0ecd41c74622e316e3b6aff278868df49bd024b

SHA512
5d525ad1dc022ef04640b16a7d01302ba5e5cd94f7dd861b27533fcc828516812d1e9f56f7d50ed0760526c051a00663ab1a7816f2145db2ae580b5ae77d3c43

Download Submit
C:\Program Files\Imaginando\VS\Processing.NDI.Lib.Advanced.x64.dll
Filesize
37.3MB

MD5
b32c82bbe257f1a7d8fcd30c0541e563

SHA1
0769b8232533d950985606c08392acdc3b5872f0

SHA256
24ca9c281815c0401b80f59ea0ecd41c74622e316e3b6aff278868df49bd024b

SHA512
5d525ad1dc022ef04640b16a7d01302ba5e5cd94f7dd861b27533fcc828516812d1e9f56f7d50ed0760526c051a00663ab1a7816f2145db2ae580b5ae77d3c43

Download Submit
C:\Program Files\Imaginando\VS\Processing.NDI.Lib.Advanced.x64.dll
Filesize
37.3MB

MD5
b32c82bbe257f1a7d8fcd30c0541e563

SHA1
0769b8232533d950985606c08392acdc3b5872f0

SHA256
24ca9c281815c0401b80f59ea0ecd41c74622e316e3b6aff278868df49bd024b

SHA512
5d525ad1dc022ef04640b16a7d01302ba5e5cd94f7dd861b27533fcc828516812d1e9f56f7d50ed0760526c051a00663ab1a7816f2145db2ae580b5ae77d3c43

Download Submit
C:\Program Files\Imaginando\VS\Processing.NDI.Lib.Advanced.x64.dll
Filesize
37.3MB

MD5
b32c82bbe257f1a7d8fcd30c0541e563

SHA1
0769b8232533d950985606c08392acdc3b5872f0

SHA256
24ca9c281815c0401b80f59ea0ecd41c74622e316e3b6aff278868df49bd024b

SHA512
5d525ad1dc022ef04640b16a7d01302ba5e5cd94f7dd861b27533fcc828516812d1e9f56f7d50ed0760526c051a00663ab1a7816f2145db2ae580b5ae77d3c43

Download Submit
C:\Program Files\Imaginando\VS\SpoutLibrary.dll
Filesize
428KB

MD5
fa6c0103eebbfb674cd9774cb67ac35e

SHA1
17cad5a111f9e718ff92da8a5e97c38d0ae51084

SHA256
9127580c346ee3dafba0d7e17090e214d0ff9411fb94c97f97f8f387a0803a4f

SHA512
f7e9798d12bc6249834b6f3658deb48bb5942652c0cfef7a03c7159889acc3c89ba3e00a5c0fabeac6d1ada985481fa1a3ee56eb89fc75630c876e89392d05fb

Download Submit
C:\Program Files\Imaginando\VS\SpoutLibrary.dll
Filesize
428KB

MD5
fa6c0103eebbfb674cd9774cb67ac35e

SHA1
17cad5a111f9e718ff92da8a5e97c38d0ae51084

SHA256
9127580c346ee3dafba0d7e17090e214d0ff9411fb94c97f97f8f387a0803a4f

SHA512
f7e9798d12bc6249834b6f3658deb48bb5942652c0cfef7a03c7159889acc3c89ba3e00a5c0fabeac6d1ada985481fa1a3ee56eb89fc75630c876e89392d05fb

Download Submit
C:\Program Files\Imaginando\VS\SpoutLibrary.dll
Filesize
428KB

MD5
fa6c0103eebbfb674cd9774cb67ac35e

SHA1
17cad5a111f9e718ff92da8a5e97c38d0ae51084

SHA256
9127580c346ee3dafba0d7e17090e214d0ff9411fb94c97f97f8f387a0803a4f

SHA512
f7e9798d12bc6249834b6f3658deb48bb5942652c0cfef7a03c7159889acc3c89ba3e00a5c0fabeac6d1ada985481fa1a3ee56eb89fc75630c876e89392d05fb

Download Submit
C:\Program Files\Imaginando\VS\VS.exe
Filesize
86.9MB

MD5
141f6add7ed335f6493cd7eaa0ddd310

SHA1
9e0ab6b3b4f74c7cd8a06e8e6014401455bc915c

SHA256
ad1518d0b90f5580cd849c5cf19eec8f13e4cb46d53a27535936030cb8787d78

SHA512
23ca96a25c9235399d5f7448536430c40f3520e177b9af9e77e275fe9520e477f3e94cdb92f77ffd7f4f54ac3ed22eb2d4d85bd3acde1cc63cbe167031324a83

Download Submit
C:\Program Files\Imaginando\VS\VS.exe
Filesize
86.9MB

MD5
141f6add7ed335f6493cd7eaa0ddd310

SHA1
9e0ab6b3b4f74c7cd8a06e8e6014401455bc915c

SHA256
ad1518d0b90f5580cd849c5cf19eec8f13e4cb46d53a27535936030cb8787d78

SHA512
23ca96a25c9235399d5f7448536430c40f3520e177b9af9e77e275fe9520e477f3e94cdb92f77ffd7f4f54ac3ed22eb2d4d85bd3acde1cc63cbe167031324a83

Download Submit
C:\Program Files\Imaginando\VS\VS.exe
Filesize
86.9MB

MD5
141f6add7ed335f6493cd7eaa0ddd310

SHA1
9e0ab6b3b4f74c7cd8a06e8e6014401455bc915c

SHA256
ad1518d0b90f5580cd849c5cf19eec8f13e4cb46d53a27535936030cb8787d78

SHA512
23ca96a25c9235399d5f7448536430c40f3520e177b9af9e77e275fe9520e477f3e94cdb92f77ffd7f4f54ac3ed22eb2d4d85bd3acde1cc63cbe167031324a83

Download Submit
C:\Program Files\Imaginando\VS\VS.exe
Filesize
86.9MB

MD5
141f6add7ed335f6493cd7eaa0ddd310

SHA1
9e0ab6b3b4f74c7cd8a06e8e6014401455bc915c

SHA256
ad1518d0b90f5580cd849c5cf19eec8f13e4cb46d53a27535936030cb8787d78

SHA512
23ca96a25c9235399d5f7448536430c40f3520e177b9af9e77e275fe9520e477f3e94cdb92f77ffd7f4f54ac3ed22eb2d4d85bd3acde1cc63cbe167031324a83

Download Submit
C:\Program Files\Imaginando\VS\libEGL.DLL
Filesize
97KB

MD5
b853e9f7573ce5aff12c99125527825d

SHA1
a5fd9cc0beff6ff170cf7ca85a1f61ebefed81d6

SHA256
c07538167d765877c7becc154c0f2682e2ff90ac9dd50c07465cfe5ebd6343a6

SHA512
b7c45c221bf2f882d5a81e1ceae55b7961284296c7b65c75fc04ca2a7906f8ca72c6da74acf5ae574bb5751a554acae550033391cd89376321178e3f1ce66d29

Download Submit
C:\Program Files\Imaginando\VS\libEGL.dll
Filesize
97KB

MD5
b853e9f7573ce5aff12c99125527825d

SHA1
a5fd9cc0beff6ff170cf7ca85a1f61ebefed81d6

SHA256
c07538167d765877c7becc154c0f2682e2ff90ac9dd50c07465cfe5ebd6343a6

SHA512
b7c45c221bf2f882d5a81e1ceae55b7961284296c7b65c75fc04ca2a7906f8ca72c6da74acf5ae574bb5751a554acae550033391cd89376321178e3f1ce66d29

Download Submit
C:\Program Files\Imaginando\VS\libEGL.dll
Filesize
97KB

MD5
b853e9f7573ce5aff12c99125527825d

SHA1
a5fd9cc0beff6ff170cf7ca85a1f61ebefed81d6

SHA256
c07538167d765877c7becc154c0f2682e2ff90ac9dd50c07465cfe5ebd6343a6

SHA512
b7c45c221bf2f882d5a81e1ceae55b7961284296c7b65c75fc04ca2a7906f8ca72c6da74acf5ae574bb5751a554acae550033391cd89376321178e3f1ce66d29

Download Submit
C:\Program Files\Imaginando\VS\libGLESv2.dll
Filesize
3.6MB

MD5
db92bb3faabb970b20fc54db2985194f

SHA1
bb62d95757995258cb74a88525ad0ecf12dd575b

SHA256
494c1f063fd151b3e9c8c0efe570fb5d78107238207ae71335b80abcd239d186

SHA512
bb39335859222fdc126cd22dd36e6b3d9da4ca99e2bb2832af6bcb88f58531e1096b3f9126d76f8de92595f6325255a70cb0b61d5eeb41ac1e7bbb27ad79e537

Download Submit
C:\Program Files\Imaginando\VS\libGLESv2.dll
Filesize
3.6MB

MD5
db92bb3faabb970b20fc54db2985194f

SHA1
bb62d95757995258cb74a88525ad0ecf12dd575b

SHA256
494c1f063fd151b3e9c8c0efe570fb5d78107238207ae71335b80abcd239d186

SHA512
bb39335859222fdc126cd22dd36e6b3d9da4ca99e2bb2832af6bcb88f58531e1096b3f9126d76f8de92595f6325255a70cb0b61d5eeb41ac1e7bbb27ad79e537

Download Submit
C:\Program Files\Imaginando\VS\libGLESv2.dll
Filesize
3.6MB

MD5
db92bb3faabb970b20fc54db2985194f

SHA1
bb62d95757995258cb74a88525ad0ecf12dd575b

SHA256
494c1f063fd151b3e9c8c0efe570fb5d78107238207ae71335b80abcd239d186

SHA512
bb39335859222fdc126cd22dd36e6b3d9da4ca99e2bb2832af6bcb88f58531e1096b3f9126d76f8de92595f6325255a70cb0b61d5eeb41ac1e7bbb27ad79e537

Download Submit
C:\Program Files\Imaginando\VS\libcrypto-1_1-x64.dll
Filesize
3.3MB

MD5
dc4ef8fa6aaa91861708dbd55d0043e7

SHA1
7851450e8a5fddce8829e95749858ecc982a0a55

SHA256
ae8fb2faa2f78e9b8067c8403223549ebfa224d7335597b12dcd9d70f9b2d378

SHA512
cd7e5d449d1b5f81f85fd7ea085c6345a6c7432b0801430ed8b2ea0c97048f538ccd5d5fb947c54411216995e4b09b5ed1259765a5312b6c90aa5fe454a25ab3

Download Submit
C:\Program Files\Imaginando\VS\libcrypto-1_1-x64.dll
Filesize
3.3MB

MD5
dc4ef8fa6aaa91861708dbd55d0043e7

SHA1
7851450e8a5fddce8829e95749858ecc982a0a55

SHA256
ae8fb2faa2f78e9b8067c8403223549ebfa224d7335597b12dcd9d70f9b2d378

SHA512
cd7e5d449d1b5f81f85fd7ea085c6345a6c7432b0801430ed8b2ea0c97048f538ccd5d5fb947c54411216995e4b09b5ed1259765a5312b6c90aa5fe454a25ab3

Download Submit
C:\Program Files\Imaginando\VS\libcrypto-1_1-x64.dll
Filesize
3.3MB

MD5
dc4ef8fa6aaa91861708dbd55d0043e7

SHA1
7851450e8a5fddce8829e95749858ecc982a0a55

SHA256
ae8fb2faa2f78e9b8067c8403223549ebfa224d7335597b12dcd9d70f9b2d378

SHA512
cd7e5d449d1b5f81f85fd7ea085c6345a6c7432b0801430ed8b2ea0c97048f538ccd5d5fb947c54411216995e4b09b5ed1259765a5312b6c90aa5fe454a25ab3

Download Submit
C:\Program Files\Imaginando\VS\libssl-1_1-x64.dll
Filesize
671KB

MD5
c4ff13e7ae91efa076d6e9c30a4de696

SHA1
3205dfdd079fa3502b0cf6d1f52c6171fc552553

SHA256
9385b5c12c948e835f3878699ebb7951aca4a941264b562c652ef5006f022d2e

SHA512
b328b32ebecaea8024ecb8382a3d8431c3450ad3834eba85014a95ff73efcb9de90ce7d057251096d6ae92b0a35103dd72aa44d68d848f473c2cc13d3473511b

Download Submit
C:\Program Files\Imaginando\VS\libssl-1_1-x64.dll
Filesize
671KB

MD5
c4ff13e7ae91efa076d6e9c30a4de696

SHA1
3205dfdd079fa3502b0cf6d1f52c6171fc552553

SHA256
9385b5c12c948e835f3878699ebb7951aca4a941264b562c652ef5006f022d2e

SHA512
b328b32ebecaea8024ecb8382a3d8431c3450ad3834eba85014a95ff73efcb9de90ce7d057251096d6ae92b0a35103dd72aa44d68d848f473c2cc13d3473511b

Download Submit
C:\Program Files\Imaginando\VS\libssl-1_1-x64.dll
Filesize
671KB

MD5
c4ff13e7ae91efa076d6e9c30a4de696

SHA1
3205dfdd079fa3502b0cf6d1f52c6171fc552553

SHA256
9385b5c12c948e835f3878699ebb7951aca4a941264b562c652ef5006f022d2e

SHA512
b328b32ebecaea8024ecb8382a3d8431c3450ad3834eba85014a95ff73efcb9de90ce7d057251096d6ae92b0a35103dd72aa44d68d848f473c2cc13d3473511b

Download Submit
C:\Program Files\Imaginando\VS\unins000.exe
Filesize
2.4MB

MD5
7684823435ef7264c3ee6dc36fa72588

SHA1
f69c6cef077f23ad35e219c14c83ae4f3c9533d2

SHA256
50e4211b990b7164500d2f2d643160b4166122c887deec121658990264ccedc6

SHA512
434d3aa89c9c849f86e50151fc66cdb222070845370e3c6d01ae0681a550531d8e4e7e5572510c9cb4c30016ac77055f778818ac46e7ae1ce69738caf3d07ca5

Download Submit
C:\ProgramData\Imaginando\VS\factory_pack.rcc
Filesize
383.5MB

MD5
6da2b35e0bb4d2c7fbf476d10bdf0229

SHA1
2e246434daf2799d566d62161b0b83145cf37363

SHA256
2416bdec88f92dfa900ec5ebc423e3f4cf2d2d3d8a0a77d914f546970f4c94e0

SHA512
bda95e56cb524410545d5bb90ed9653a53607472ebae6116a74f452b7e5d42215cf11610c7d77e3bd7c2244aa5cd7b09be7ecc528f2ea23be9e97911178882e4

Download Submit
C:\Users\Admin\AppData\Local\Imaginando\VS\cache\Factory\another spheriod fractal.frag
Filesize
2KB

MD5
892a10f3678cfcf9e1485641e1045832

SHA1
54a07e72d08cf9142b8dbb82b63958f94dce743a

SHA256
9ad10a1e31f57337f283178c42f9edbcf0c00e2be9a7abdc93ce0385603450fd

SHA512
98b280c63fb90ac97b4d4748fff6588b386d141dbbc74d42a17d5d3fc59f9c948d5e1058a56c58b4742ca6a4ab448fd4adb2b68ad5676e8d0ca6dcb1c4ea6647

Download Submit
C:\Users\Admin\AppData\Local\Imaginando\VS\cache\Factory\ball of fire.frag
Filesize
2KB

MD5
48659ca5adc7a6f4b82c62549ce4d13a

SHA1
e42731033701ea95fb8579ed9a49cd72c4d7bbe1

SHA256
68a46976fdd5182b971c39f1abf37aa3627f615e9567829c2889d7229eab6055

SHA512
659f274946acaa5b86782e50fc6efdeba935c721770e4acc4b57362576c0f12b1c8d47c3cde0c729315d0f76f31ce3cc0a7476f06ba0e9bebe4dad2a3a67764b

Download Submit
C:\Users\Admin\AppData\Local\Imaginando\VS\cache\Factory\bit for bit.frag
Filesize
1KB

MD5
6afc642f1849e4f3f281d88f7809e39c

SHA1
1ee6afbb16ce91e71448ed67cd9d23e5d0fbb5a3

SHA256
d83879390b165d9b8b03c4350040fb7294fee4e47df9380e6976b84cfb780a82

SHA512
aec2bcbfa5906b93077f03cb1a76cf4448537c0bc307a160475b7bb3c0f0fbbc612366939f5761bead559487c6de091912965b4f09a30a91d2810270cde35dd6

Download Submit
C:\Users\Admin\AppData\Local\Imaginando\VS\cache\Factory\black hole sun.frag
Filesize
2KB

MD5
3ee1bc19831405ea65742fdf537a2c68

SHA1
90585f3f2ac958fd20568d54d8a8c1a69c067479

SHA256
3fcfc1cd0280414142dafe94f3a79f6b146fbc7b09db297e471af4c8c65cb052

SHA512
e9fedfdb7b6617e2545757ab4bc781cd2557a2c7ee435c0ae545e7be897f436c9a53dca4394f043c2edd1d35c176068a18d70ff060a9ae9d27e7e240162645c4

Download Submit
C:\Users\Admin\AppData\Local\Imaginando\VS\cache\Factory\blobs.frag
Filesize
1KB

MD5
ef038066ecdf83021cb97df5a1879b90

SHA1
377aa2918a592e6d2f08d6d7426e5e37511c5f98

SHA256
793d7ea36631d6bb0513a7d3b100f1c352db6082b772571fc929caca88135d9e

SHA512
a46bab7e279be5379a2ffb90a49883b996061cd556f10c72ba3f02753d4a0460f5b5d27b278fbfdcc48424722109bf18d42a0a19d889ee4ca7c51cfed40d4b6d

Download Submit
C:\Users\Admin\AppData\Local\Imaginando\VS\cache\Factory\broken tesseract.frag
Filesize
4KB

MD5
1545215ac6a480e95889a8ea2525056b

SHA1
c93ee1252f96d75d92be7261c0f75c3268c143c3

SHA256
3e09b571801f3c5b023ec3d5e0a1db688b6d415e684c021838fa6d289a1e469d

SHA512
ed5f680f87236d25d325da31e2649aee99e3167dc2600fd03a7c5cc780d7cd65b4e3e2510f084191ca77b4196524e8f643b6d112e688b3625aab67d9c75112c6

Download Submit
C:\Users\Admin\AppData\Local\Imaginando\VS\cache\Factory\clouds.frag
Filesize
3KB

MD5
d2902572a64d646a1dcc9afbf4b07618

SHA1
c8f9f9348ad5e42ad742d3615dcd2329b3fc254a

SHA256
629aa30f616ae72e81cc961a4fd7142bb207e927d472af64c097cdedd67e027c

SHA512
220beaf6410a7e648d3bb8564185fbbe15c719c2748985b3c1dd3dd649fe081ab63947fa54014c850b476f725466e3b76a4b34ab155621d6bfd9b4eee4aa1583

Download Submit
C:\Users\Admin\AppData\Local\Imaginando\VS\cache\Factory\color pipe.frag
Filesize
1KB

MD5
62642d1831d5068cca97d24ff84ed187

SHA1
502db8ef7588951c620435555ff78c19ab1f6976

SHA256
a1c8f74e1014524ddd0a2537043b2bc674fc0a5aa1ef255d55db068eb2f6028f

SHA512
d354084f6079d155c8ef6dbee725aa681271501d31783379c15572d5e4934aba21bef30fe2ec1d62d63b3bb47dd2d73f324a1e9c11710fcd4bc28bde9ac525cf

Download Submit
C:\Users\Admin\AppData\Local\Imaginando\VS\cache\Factory\comet.frag
Filesize
2KB

MD5
6cda666dc1f071dc12d0f0bca12d24bb

SHA1
c3bce4f80f4e947e37aa03dfb5be31182d57e127

SHA256
a00ebc03a22b9d05adbb9439cc4ff1f5fc33eeafa414cd714a86258065735f68

SHA512
89948e461d72d46e14e52ca258ae60b66b2f98abf45b3e5e3d72883b8cbb804634bca6ffede9d6194a9496fcb0c95ff6c1cbfc052b92e48c01861f2dec8804b7

Download Submit
C:\Users\Admin\AppData\Local\Imaginando\VS\cache\Factory\cords.frag
Filesize
1KB

MD5
727f5e175170d3acbcd793996b3dbf86

SHA1
3dc0e1ec4f25e631f449e3879ece44434b653f59

SHA256
cfd7e9d5c60d1c7e4aaade5be87f2070b790994960a1a0dfe8fa4fa4160bf688

SHA512
9854499fd49fa7e2eb9eef06c74ee5fe0f79236f7dbd49cf95bf37dad64851f305d9116bd9aee08613a634938869e86c932f8f1bb4c9fec535e409df9967f1ee

Download Submit
C:\Users\Admin\AppData\Local\Imaginando\VS\cache\Factory\cosplay.frag
Filesize
1KB

MD5
81179b239c4975f5113d681a61aa8698

SHA1
6c0cb35a795f90fc05b9222dfd2606dbfb583303

SHA256
18fe9af704c5ed445c457e7944aeff300e5c8f1a7d9a51f795a8aab848d0a675

SHA512
1d793f9b93f0c4a6a9f6021fe8c65712a6334502ce13518d9a545308f33f0b11829af043c6e7ab403b16374c936ec9d30475758837863b4918d28e1e1bb9fb91

Download Submit
C:\Users\Admin\AppData\Local\Imaginando\VS\cache\Factory\cube.frag
Filesize
2KB

MD5
b7c637c662dea2312c817fdddf8c5fd4

SHA1
ed9254c4eb392824a8adaf5ac7a94b0698111a77

SHA256
55482a9a421231e5f3657adc3f4a339dbaecae7b9642f3c6322949cd00e5fdfd

SHA512
a8fb9f2ef8f701c64328f7bd79b113d25d921d45cdd6260c6244139318c7eaae81d6e7b0f56ef94e783b354b818ee1880bb39ef5445b73c050d3805d3603aefd

Download Submit
C:\Users\Admin\AppData\Local\Imaginando\VS\cache\Factory\dark matter.frag
Filesize
1KB

MD5
c87c6c9f6581354c2dd3bc31a4045fdb

SHA1
b63ad3451e19844f1cc737c44f078ee93a8ad5c2

SHA256
c3c6eced14d73ee5bc7d3abd52b53fa4b39d43ad859de26023d0bea0462f2bbb

SHA512
1e7760276a79d951ea68b2382ff450064dfad7665191036724b1a5129afb3cca029d03cf2cb43440648a93ab3462b8e3dd632772f6e4a2952f18647d668241d5

Download Submit
C:\Users\Admin\AppData\Local\Imaginando\VS\cache\Factory\dots.frag
Filesize
1KB

MD5
87189e7a555065d8a4ae37ca80c19c6b

SHA1
812f8dda2376cdc22cf848e8c1f35123c80e1ca6

SHA256
7a1e801ae3a97ff2aea05e0d9ed81da5c04b342b4a60f17ba79f3186cb61e2b7

SHA512
29224b1488812e17230e59ef0e5823d2f81fdf06a2fc9e5c1eb10edf09aacbfbdddd31bdc889b1475f717b2246b4ad668a63a50e58ab36db948416f666d36ce4

Download Submit
C:\Users\Admin\AppData\Local\Imaginando\VS\cache\Factory\eye of agamotto.frag
Filesize
3KB

MD5
abed9d8e051c52b253d1e796f63a377a

SHA1
a463a9273cc32e5b50237c73db22a50d148a8ab6

SHA256
e90ca6a82e59246f013f87893ecaac9b26b9bfe830e6f20ed200cba16ec4b79f

SHA512
1b408ec8bc5c44184d26b8adfe0e3d62822da88fc13ca6e055236f8f6383bd1208f224f579568c6c4856a08d5489e3a77983c711255bb0e60f5259ad11f2d936

Download Submit
C:\Users\Admin\AppData\Local\Imaginando\VS\cache\Factory\ferro fluid.frag
Filesize
1KB

MD5
50c69207c644a0d6745cd355188bb313

SHA1
68582cdc3e42fc347cf6b4aaf556f11cb722f355

SHA256
9a90ff585170399560b502b157fc4ae8c159b4c200d00db1667603943cdc003c

SHA512
89e852c729aac624914e24cf1fd89822c1406ce27f041c18645f9d0aef796bd7837918d2ea35b93d035f01539886faccc2f12d673f34e587d6d4e47b0279b925

Download Submit
C:\Users\Admin\AppData\Local\Imaginando\VS\cache\Factory\fractal 2.frag
Filesize
3KB

MD5
13e1e4810ca9fe56a828339dfed79c6c

SHA1
17727750ec27d44f3279a2b5770c5653a56e3746

SHA256
c5fdbc112b8a230cda9846734fcdd3e4143c93cbc4fbc0501ebd876246c1c7ac

SHA512
248873c6d11f02d60ac5419892d1597e998cda0ab092b519c40366f49b2e21454f0c94bf83a518461d666ea1308ff083bd4ba37dae3b811f2cb4fc160b66b745

Download Submit
C:\Users\Admin\AppData\Local\Imaginando\VS\cache\Factory\galaxy.frag
Filesize
2KB

MD5
edcbcb0eb589b425d9daf7974ff08ea1

SHA1
41314c0045eb04063958e81c645120537580cdba

SHA256
f112ca19a8ba9e883c95e71acf5c478910305e2b7a32fca986ca596c74ef8f00

SHA512
9b3af00de77bda081601a94c1e86c0cbbfb595b34d87a8ee3caa88160960afa4b426c24485059f6da5cef3649df0d9661d2cf0efc49b91f502c30f4f163238b6

Download Submit
C:\Users\Admin\AppData\Local\Imaginando\VS\cache\Factory\glowing circle.frag
Filesize
1KB

MD5
feeeb6600b91feee7eb9cf2ee171b4bc

SHA1
c09eda1eca8068a82207834038cd4ac82e3e4e52

SHA256
bb9a259929919e5d456df50aece96f19cbfd1fea69d964b21ed1c93dccb09cfe

SHA512
e6602a9023ac877a09944e3c6daa430eb9206c249b8a9e3fe73dbfd64e8fedc3bd95c2929421505b73b87016b25c7e889b823a9e58e8d75b11a3d3506a82c008

Download Submit
C:\Users\Admin\AppData\Local\Imaginando\VS\cache\Factory\great ball of fire.frag
Filesize
4KB

MD5
1a36050e18d0dfb3cad6ce358ff2f3c5

SHA1
f8deae7ce2d2e402c1b18c0bcb5917f697471d74

SHA256
e2803eb24c328dd6984fdaa5f0d874e636e48a69cfdc10aa4a86ffdeb2480002

SHA512
71e8186443cfcb6638baad6c0a2454dbc0de752ffcf505d9b19e7cccb1be60a5afae6d394c4a7e3c3bb8958d3e150f132aee7578d420f620474eb3873461b306

Download Submit
C:\Users\Admin\AppData\Local\Imaginando\VS\cache\Factory\grid terrain.frag
Filesize
2KB

MD5
6c5b9138400f11ee3fec2dad52d193fa

SHA1
a961faa6ea25a65233c0b9bd762a69d7cd588498

SHA256
83ff5e552d7cdfc57d6cecb2f94b59a94af0af9475941514dfa0929dcb3bcc11

SHA512
364de6ac639e6b3d1112cf16ee736fc890d20c42f49871d474c180d1f1b170b9ec6a1f3e5803fd713683747f50ed2bb6db15b23966d554d198ee1a5cce4d7eb8

Download Submit
C:\Users\Admin\AppData\Local\Imaginando\VS\cache\Factory\helice.frag
Filesize
1KB

MD5
1481cfe2eb496b80f2a44d69e2511b4b

SHA1
a2043d7b7aae171227f90618c28180900d0ff8fa

SHA256
07138bd1c6a2db33abbbce589a03ab1d1ceb1efba63c691313d32c28e4c3761a

SHA512
6482b718c6586f1e9543f485a218779985b3649905063ee03f69c55e37e86e9a3e62b8c9e5ca331a96bd80ac9f7f7e00da606d79d11ff0374e97f4aface86344

Download Submit
C:\Users\Admin\AppData\Local\Imaginando\VS\cache\Factory\hipno.frag
Filesize
1KB

MD5
fa7fefd804787a47d359925b2098d63a

SHA1
52227f36c883749df7729841817c680d41a687a9

SHA256
537b73d6e9275c6094a593c549f99dd32166ce5801fd2002645897cce5f06f1f

SHA512
e0b7021c0dd276df15713a65bc29b2f4c75970840014484cb0925d934fcf03bf2838f888a347de4b0d698914022934184459e63032f2cd672b02d676f76cbaaf

Download Submit
C:\Users\Admin\AppData\Local\Imaginando\VS\cache\Factory\lines.frag
Filesize
1KB

MD5
db363ec71639ab3b95c4af25829449bf

SHA1
9fd7e48eeadc43cd5267833d3afb8ca7cc91325b

SHA256
bcdd1448401bce87d52ccb2db2d262becb32e735853c0c9466c62b328553d3ab

SHA512
6fa1437bb358dfe4d03ccacd9532baad2053ab9bac729798bbee07c3677e86cee1ced9b685326998b24e3da034c358bd81d9d9a5cf3e8e4780adaad0f2867ca2

Download Submit
C:\Users\Admin\AppData\Local\Imaginando\VS\cache\Factory\matrix rain.frag
Filesize
818B

MD5
c7cab3921e7bde34943061e5d0876a24

SHA1
3de5c12a6a3951ce39a73a83dec6d8a7eeed36d0

SHA256
85479ac4ef42940ac6eba38ec950bd7dc39d46786547cd8346e5e92f8cea22f5

SHA512
7f175bf4a55cef12cde4fd30c10fed1dd9fa942679c3a04273afeffdd21a875bd45884fec92bd4f50e7d581a545ffe7302373049db4a5863300a2fa374c46b92

Download Submit
C:\Users\Admin\AppData\Local\Imaginando\VS\cache\Factory\mirrored pattern.frag
Filesize
1KB

MD5
9268f64528dececd0565babe23aa5980

SHA1
ff3a017875d74992695acf05569e0806ab69be0b

SHA256
611aacd784a8925a139cbe0d11f4d135ebc06acb0038c434291ae7303f1127b8

SHA512
f92f47b10a5a63e3d9bddd391c8d241c81d48867c776a259f793b4df1de894e99770e56f3c6048c2f70e66060c0cdb759d9cb6e425a6a9d110af5fcc10dd5e88

Download Submit
C:\Users\Admin\AppData\Local\Imaginando\VS\cache\Factory\particles.frag
Filesize
1KB

MD5
291c5b2dd73314b314cdfb8be4d21bc7

SHA1
b9aa179eedffcc41c77a22cdcd79eeeba25df468

SHA256
98dbe29e3c685b2d88c6acfa4022ad0dac2fca428ce43a87766f4d2727444793

SHA512
1af2ef4c74d32818c49861c8e412578b8c11f2c006b67027452bc568871bf65465433f193e9a5dec0adfeabc27f816fb6c516288ae36d6401f8cabf40770d8bd

Download Submit
C:\Users\Admin\AppData\Local\Imaginando\VS\cache\Factory\particular vortex.frag
Filesize
1KB

MD5
63e1388193e6ecbc435856af257c415a

SHA1
153883d72bdec1322e1b3b8dee7463dcf2f6ab88

SHA256
471c8d42a266b3233df3201d5de40240b77fe6343e9ff6c74f2d9294219fd9a8

SHA512
bb13c736ee4b5326dc23f09f35c9c6ff7b034449b048197ed2945d84cf854734fe242884661a75673b4e4b72c7da4ff99934dc9e5e5d4c21161a692e22764062

Download Submit
C:\Users\Admin\AppData\Local\Imaginando\VS\cache\Factory\pattern 1.frag
Filesize
2KB

MD5
224125dfc3d2d76d0d99ec572f8d0063

SHA1
b4b02565bcec3f27a6ceda65d8d3f61a77646922

SHA256
20090312db3908ecea9a4f04e2567927bc04f98de04c7140b21a7eb3d40662f3

SHA512
859c9c26c748e7a6d52d123411bc1039fca61cce09eaf8fdba712faaff2ae9c2a80b44ec76d7ee1cb38238ad0b973b7037380a17b78204946f393912fe2c4df8

Download Submit
C:\Users\Admin\AppData\Local\Imaginando\VS\cache\Factory\pattern 4.frag
Filesize
1KB

MD5
3f02ca6b5a390075c782a3d236560b8a

SHA1
1553347269ca275489d67cb7ebf8adb3f5a415a9

SHA256
9fa6db3ab832aabaea4e8ced67c5e1fda10f80dafea1b2bf659aaf906776dfeb

SHA512
bb01fe56e2551b50e152a52f29c8f9f3b430a1276fe9bda2b64eba75b2d6a98099c4d75fc164e2cb52e1798187356abe7a53d4d92a057220a08819dd5aa521e6

Download Submit
C:\Users\Admin\AppData\Local\Imaginando\VS\cache\Factory\pinwheel.frag
Filesize
1KB

MD5
a18dfc850e28364a4d15650a0a02976c

SHA1
be98f65933c9cbebca8a84c169bae9a2df1c1e69

SHA256
8247d24c4b7515201037c1cf8caf25d1564c4b8b1add0ef9aafcd83cd2b74f86

SHA512
1feba80e7df13a5a93f7bd0c37e7893192e7b5e6d389730086cdbd97e6659458ee6812f5170487ece53295cd5ceff8774103bad88dfb79acecd8d74cc49b3272

Download Submit
C:\Users\Admin\AppData\Local\Imaginando\VS\cache\Factory\plain color.frag
Filesize
479B

MD5
a95cdeb87161d0e7fd2c8c4a26319d5b

SHA1
7a5cf9b028c9cef151f6e063abb7c5bb6257f16d

SHA256
7ebf67b155d01b56da86a583827f1b535738f4605449b9e54ee3a29cc1ef3048

SHA512
63d057c4d2e969470b22045393a9910b15e9e09e0be1b8fefc0b273c0075a65e29a73b8bd662e65de5a83b2b3292f378ee711a4c7d235a907d62d2a5e37c2322

Download Submit
C:\Users\Admin\AppData\Local\Imaginando\VS\cache\Factory\plasma particles.frag
Filesize
2KB

MD5
4b75f2a4089c212a91f61b7f377551fa

SHA1
41ec7e96d3dae9c30f08953d61e614111bf668cc

SHA256
4766626ca60a57a8ff055860192d21ab5b35b4d2b8bfc0beab9785f1a41abfbc

SHA512
a95e925ef0ee5eb7dad436cf8bb4fe1ffaf53baec5ccdd0b4caedea0ba6299a02264795a03e3aab810e9fdf0067454852536ed928c217e1bf88084414c3f65c0

Download Submit
C:\Users\Admin\AppData\Local\Imaginando\VS\cache\Factory\raining dots.frag
Filesize
2KB

MD5
61bb8805c70100f41d785cf10a1a223e

SHA1
2c9beeadd54b6883ee0b6d1fa69f4f576787878b

SHA256
f9423b07c20a47ce13d8c48b1ad15a55675eb88a4eff80596ef6bff0cd4107f5

SHA512
cf9155bb00fa03c5e0437d22c8a3401e5731944e0f03afaff23d404f76f73e9b2e7a727f7f507f324ceaba1854c3b81b7d8f77132c4c2c2716b4f824dd7b169d

Download Submit
C:\Users\Admin\AppData\Local\Imaginando\VS\cache\Factory\simple shapes.frag
Filesize
1KB

MD5
e85f6bfbad9b21d873261b2ede21505a

SHA1
478a1f242dc65514a2cbed9187d10c17789a2037

SHA256
1bd768bfe12deb7150ff1b6f0fdde697cffefc5ac0f254079a452f67d7f4f5cd

SHA512
3e47062b2a8b6a124711a46a40aeab68a734b8dd9e8a687b6ea2ffc596b8f1ea92f60fc5468e50eddf96b487b7a4b7a78123656353edd2b5788b9d82aa4d7c0c

Download Submit
C:\Users\Admin\AppData\Local\Imaginando\VS\cache\Factory\smoke.frag
Filesize
1KB

MD5
540a985f23b4cfb051ed0c30da81f9c5

SHA1
944b1546c18be51a6ffc12c939f69e75a7fd445b

SHA256
183162c0b2ddabb1bb88347d70125dd3612f3722ae58feae4ea705ccf2778b91

SHA512
b025e37d6d6a467ad52fb00bd16e08e691771116daae503887e85a1a2f51248d49d6efc6c8a2163b395635c26f1a2b2a3d8d2d37e6ae4b44df4bea1b90018d30

Download Submit
C:\Users\Admin\AppData\Local\Imaginando\VS\cache\Factory\sound waves.frag
Filesize
1KB

MD5
f18f6ae6aa5099173564726120ff277e

SHA1
ebef76d38c7986df1da10b9a7723e1116c1a434f

SHA256
c1f569af339ba5db275e188b78650de7f28d88f9f54f395968e28b0bbde3863d

SHA512
f77d7669569710de0d770642b476001036c25702bfc67b3ca6a34f0c2a3451e0a482edc6fea1416fa21ae1ee077bf94f0c7d340554d7f9dd762e24b6e43f100e

Download Submit
C:\Users\Admin\AppData\Local\Imaginando\VS\cache\Factory\star light.frag
Filesize
4KB

MD5
5404c5cd2fd84416d1db3d613919b394

SHA1
90e98276b5a67fb12015cfbb015a9644f5d804d1

SHA256
141cd1ead11bc044c8feaa6baeb523f4d1395f4332b1a7aab701be3cf8031e2f

SHA512
9cdea2e5d88659a79f9e7615bcb995bd5b0a0bf1ba905d9b4878eb4e185b8ed5fc011b50c70fca353c05bdf768c7bd497abb8207a5cb9627d8c5ab8d4256a54c

Download Submit
C:\Users\Admin\AppData\Local\Temp\UserMaterials\plain color.frag
Filesize
479B

MD5
a95cdeb87161d0e7fd2c8c4a26319d5b

SHA1
7a5cf9b028c9cef151f6e063abb7c5bb6257f16d

SHA256
7ebf67b155d01b56da86a583827f1b535738f4605449b9e54ee3a29cc1ef3048

SHA512
63d057c4d2e969470b22045393a9910b15e9e09e0be1b8fefc0b273c0075a65e29a73b8bd662e65de5a83b2b3292f378ee711a4c7d235a907d62d2a5e37c2322

Download Submit
C:\Users\Admin\AppData\Local\Temp\UserMaterials\wobbly ring.frag
Filesize
2KB

MD5
8156a3311695a2a720729a8455276b75

SHA1
aca77e4a71c2eb038b475da106bbf2715ce87d57

SHA256
4ff38c8e1acc8c909f8a822422d85eca0d918e65ccc1f72a782d9c99c6c83d2c

SHA512
0ff8ea42dc4a3eaab0f7cc37e15dfc8b3c5857d70d3fd0371813848f86b899a44373d52483bd94d614b725e339256b666aec7d5db10fd1e31c73a1d9efc776b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-UPDAB.tmp\VS.tmp
Filesize
2.4MB

MD5
7684823435ef7264c3ee6dc36fa72588

SHA1
f69c6cef077f23ad35e219c14c83ae4f3c9533d2

SHA256
50e4211b990b7164500d2f2d643160b4166122c887deec121658990264ccedc6

SHA512
434d3aa89c9c849f86e50151fc66cdb222070845370e3c6d01ae0681a550531d8e4e7e5572510c9cb4c30016ac77055f778818ac46e7ae1ce69738caf3d07ca5

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-UPDAB.tmp\VS.tmp
Filesize
2.4MB

MD5
7684823435ef7264c3ee6dc36fa72588

SHA1
f69c6cef077f23ad35e219c14c83ae4f3c9533d2

SHA256
50e4211b990b7164500d2f2d643160b4166122c887deec121658990264ccedc6

SHA512
434d3aa89c9c849f86e50151fc66cdb222070845370e3c6d01ae0681a550531d8e4e7e5572510c9cb4c30016ac77055f778818ac46e7ae1ce69738caf3d07ca5

Download Submit
memory/2560-141-0x0000000000400000-0x0000000000679000-memory.dmp

Filesize
2.5MB

Download
memory/2560-149-0x0000000000400000-0x0000000000679000-memory.dmp

Filesize
2.5MB

Download
memory/2560-179-0x0000000000400000-0x0000000000679000-memory.dmp

Filesize
2.5MB

Download
memory/2560-138-0x0000000002610000-0x0000000002611000-memory.dmp

Filesize
4KB

Download
memory/2560-162-0x0000000000400000-0x0000000000679000-memory.dmp

Filesize
2.5MB

Download
memory/2560-208-0x0000000000400000-0x0000000000679000-memory.dmp

Filesize
2.5MB

Download
memory/2560-171-0x0000000000400000-0x0000000000679000-memory.dmp

Filesize
2.5MB

Download
memory/2560-155-0x0000000000400000-0x0000000000679000-memory.dmp

Filesize
2.5MB

Download
memory/2560-194-0x0000000000400000-0x0000000000679000-memory.dmp

Filesize
2.5MB

Download
memory/2560-151-0x0000000000400000-0x0000000000679000-memory.dmp

Filesize
2.5MB

Download
memory/2560-153-0x0000000000400000-0x0000000000679000-memory.dmp

Filesize
2.5MB

Download
memory/2560-142-0x0000000002610000-0x0000000002611000-memory.dmp

Filesize
4KB

Download
memory/2728-1603-0x00000187CE250000-0x00000187D09FE000-memory.dmp

Filesize
39.7MB

Download
memory/2728-1660-0x00000187ECBB0000-0x00000187ECBC0000-memory.dmp

Filesize
64KB

Download
memory/2728-1587-0x00000187CE250000-0x00000187D09FE000-memory.dmp

Filesize
39.7MB

Download
memory/2728-2265-0x00000187CE250000-0x00000187D09FE000-memory.dmp

Filesize
39.7MB

Download
memory/3540-209-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/3540-133-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/3540-140-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/4896-216-0x000001F76D7D0000-0x000001F76FF7E000-memory.dmp

Filesize
39.7MB

Download
memory/4896-470-0x000001F778320000-0x000001F778321000-memory.dmp

Filesize
4KB

Download
memory/4896-480-0x000001F778330000-0x000001F778331000-memory.dmp

Filesize
4KB

Download
memory/4896-486-0x000001F778330000-0x000001F778331000-memory.dmp

Filesize
4KB

Download
memory/4896-485-0x000001F778330000-0x000001F778331000-memory.dmp

Filesize
4KB

Download
memory/4896-484-0x000001F778330000-0x000001F778331000-memory.dmp

Filesize
4KB

Download
memory/4896-469-0x000001F778320000-0x000001F778321000-memory.dmp

Filesize
4KB

Download
memory/4896-444-0x000001F777170000-0x000001F777171000-memory.dmp

Filesize
4KB

Download
memory/4896-438-0x000001F777170000-0x000001F777171000-memory.dmp

Filesize
4KB

Download
memory/4896-442-0x000001F777180000-0x000001F777181000-memory.dmp

Filesize
4KB

Download
memory/4896-443-0x000001F777170000-0x000001F777171000-memory.dmp

Filesize
4KB

Download
memory/4896-441-0x000001F777180000-0x000001F777181000-memory.dmp

Filesize
4KB

Download
memory/4896-439-0x000001F777170000-0x000001F777171000-memory.dmp

Filesize
4KB

Download
memory/4896-413-0x000001F76D7D0000-0x000001F76FF7E000-memory.dmp

Filesize
39.7MB

Download
memory/4896-270-0x000001F776480000-0x000001F776680000-memory.dmp

Filesize
2.0MB

Download
memory/4896-268-0x000001F776040000-0x000001F776480000-memory.dmp

Filesize
4.2MB

Download
memory/4896-267-0x000001F7741A0000-0x000001F7741B0000-memory.dmp

Filesize
64KB

Download
memory/4896-483-0x000001F778330000-0x000001F778331000-memory.dmp

Filesize
4KB

Download
memory/4896-473-0x000001F778320000-0x000001F778321000-memory.dmp

Filesize
4KB

Download
memory/4896-475-0x000001F778330000-0x000001F778331000-memory.dmp

Filesize
4KB

Download
memory/4896-217-0x000001F76D7D0000-0x000001F76FF7E000-memory.dmp

Filesize
39.7MB

Download
memory/4896-982-0x000001F76D7D0000-0x000001F76FF7E000-memory.dmp

Filesize
39.7MB

Download
memory/4896-457-0x000001F777170000-0x000001F777171000-memory.dmp

Filesize
4KB

Download
memory/4896-458-0x000001F777170000-0x000001F777171000-memory.dmp

Filesize
4KB

Download
memory/4896-459-0x000001F777170000-0x000001F777171000-memory.dmp

Filesize
4KB

Download
memory/4896-461-0x000001F778320000-0x000001F778321000-memory.dmp

Filesize
4KB

Download
memory/4896-462-0x000001F777170000-0x000001F777171000-memory.dmp

Filesize
4KB

Download
memory/4896-463-0x000001F778320000-0x000001F778321000-memory.dmp

Filesize
4KB

Download
memory/4896-464-0x000001F778320000-0x000001F778321000-memory.dmp

Filesize
4KB

Download
memory/4896-465-0x000001F778320000-0x000001F778321000-memory.dmp

Filesize
4KB

Download
memory/4896-466-0x000001F778320000-0x000001F778321000-memory.dmp

Filesize
4KB

Download
memory/4896-467-0x000001F778320000-0x000001F778321000-memory.dmp

Filesize
4KB

Download
memory/4896-468-0x000001F778320000-0x000001F778321000-memory.dmp

Filesize
4KB

Download
memory/4896-471-0x000001F778320000-0x000001F778321000-memory.dmp

Filesize
4KB

Download
memory/4896-210-0x000001F76D7D0000-0x000001F76FF7E000-memory.dmp

Filesize
39.7MB

Download
memory/4896-472-0x000001F778320000-0x000001F778321000-memory.dmp

Filesize
4KB

Download
memory/4896-479-0x000001F778330000-0x000001F778331000-memory.dmp

Filesize
4KB

Download
memory/4896-481-0x000001F778330000-0x000001F778331000-memory.dmp

Filesize
4KB

Download
memory/4896-482-0x000001F778330000-0x000001F778331000-memory.dmp

Filesize
4KB

Download
memory/4896-3015-0x000001F76D7D0000-0x000001F76FF7E000-memory.dmp

Filesize
39.7MB

Download