Resubmissions

05-05-2023 21:47

230505-1m95jseg45 7

05-05-2023 20:43

230505-zhy12sgc8s 1

Analysis

  • max time kernel
    902s
  • max time network
    1006s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-es
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-eslocale:es-esos:windows10-2004-x64systemwindows
  • submitted
    05-05-2023 21:47

General

  • Target

    Slay.the.Spire-pivigames.blog/plaza-slay.the.spire.iso

  • Size

    870.0MB

  • MD5

    4287357fc23b9d1627ef60363f5b241e

  • SHA1

    09cb3654390ee12a47c9f2cdcde0e4859d1f82f8

  • SHA256

    f6077c8ce85c56b8be376e3b66d964a4741e12d26f1d6466f381f7d6fa8de340

  • SHA512

    79c72e3a9ecd8ea7288398750dd904e9b9818c20c441c09d1d0250fc62cbca48746693be4513b2a895a28e8803d8eb5dd34561dabcb48762309253023b526464

  • SSDEEP

    25165824:wf/kPpDiU+EwFwh5jRViBRTMrZ368CUomBZ9WtTl:2/S1NOkVyTC15d0T

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 39 IoCs
  • Modifies file permissions 1 TTPs 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 20 IoCs
  • Suspicious behavior: EnumeratesProcesses 54 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\Slay.the.Spire-pivigames.blog\plaza-slay.the.spire.iso
    1⤵
    • Modifies registry class
    PID:4356
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:460
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:2500
    • \??\E:\setup.exe
      "E:\setup.exe"
      1⤵
      • Enumerates connected drives
      • Suspicious use of WriteProcessMemory
      PID:2332
      • \??\E:\Win64\setup.exe
        "E:\Win64\setup.exe"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1160
        • C:\Users\Admin\AppData\Local\Temp\is-CB1O6.tmp\setup.tmp
          "C:\Users\Admin\AppData\Local\Temp\is-CB1O6.tmp\setup.tmp" /SL5="$170356,7031558,168448,E:\Win64\setup.exe"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in Program Files directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          PID:1972
    • C:\Windows\system32\AUDIODG.EXE
      C:\Windows\system32\AUDIODG.EXE 0x4a0 0x2f8
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2084
    • C:\Program Files (x86)\Slay the Spire\SlayTheSpire.exe
      "C:\Program Files (x86)\Slay the Spire\SlayTheSpire.exe"
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1324
      • C:\Windows\SYSTEM32\icacls.exe
        icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
        2⤵
        • Modifies file permissions
        PID:1668
      • C:\Windows\SYSTEM32\icacls.exe
        icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage\8bf0643894bb1f0d.timestamp /grant "everyone":(OI)(CI)M
        2⤵
        • Modifies file permissions
        PID:1948
    • C:\Program Files (x86)\Slay the Spire\SlayTheSpire.exe
      "C:\Program Files (x86)\Slay the Spire\SlayTheSpire.exe"
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:4836
    • C:\Program Files (x86)\Slay the Spire\SlayTheSpire.exe
      "C:\Program Files (x86)\Slay the Spire\SlayTheSpire.exe"
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:2528

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\Slay the Spire\SlayTheSpire.exe

      Filesize

      364KB

      MD5

      e9061c7339782046aee895b677eb55e4

      SHA1

      e3fe2c144d74fbd49dcdfb5b43a6f51349847270

      SHA256

      44b8eacfd3843a8666e980dc9c71a50a069ef58610fb134464d1b606434c9603

      SHA512

      1599159b17708c1293dbf26f9983edc4d93a9a86342fa9aa9f00196a47b499e39d68316c1a2c16a107c38457fe3ad64fa697ffcb9af81b62164c2067130d2df2

    • C:\Program Files (x86)\Slay the Spire\SlayTheSpire.exe

      Filesize

      364KB

      MD5

      e9061c7339782046aee895b677eb55e4

      SHA1

      e3fe2c144d74fbd49dcdfb5b43a6f51349847270

      SHA256

      44b8eacfd3843a8666e980dc9c71a50a069ef58610fb134464d1b606434c9603

      SHA512

      1599159b17708c1293dbf26f9983edc4d93a9a86342fa9aa9f00196a47b499e39d68316c1a2c16a107c38457fe3ad64fa697ffcb9af81b62164c2067130d2df2

    • C:\Program Files (x86)\Slay the Spire\SlayTheSpire.exe

      Filesize

      364KB

      MD5

      e9061c7339782046aee895b677eb55e4

      SHA1

      e3fe2c144d74fbd49dcdfb5b43a6f51349847270

      SHA256

      44b8eacfd3843a8666e980dc9c71a50a069ef58610fb134464d1b606434c9603

      SHA512

      1599159b17708c1293dbf26f9983edc4d93a9a86342fa9aa9f00196a47b499e39d68316c1a2c16a107c38457fe3ad64fa697ffcb9af81b62164c2067130d2df2

    • C:\Program Files (x86)\Slay the Spire\SlayTheSpire.exe

      Filesize

      364KB

      MD5

      e9061c7339782046aee895b677eb55e4

      SHA1

      e3fe2c144d74fbd49dcdfb5b43a6f51349847270

      SHA256

      44b8eacfd3843a8666e980dc9c71a50a069ef58610fb134464d1b606434c9603

      SHA512

      1599159b17708c1293dbf26f9983edc4d93a9a86342fa9aa9f00196a47b499e39d68316c1a2c16a107c38457fe3ad64fa697ffcb9af81b62164c2067130d2df2

    • C:\Program Files (x86)\Slay the Spire\config.json

      Filesize

      177B

      MD5

      f32b0866294aaf9f98d25c7d39f9e745

      SHA1

      0f4d503a244acd19acc75a1284becef2ecf209c6

      SHA256

      a05b138bd4535504bb171939df16760ce65095eef4ea5fdca66adef3afe6010a

      SHA512

      d71d9db84f02ec902a7cd2246e32fb9cb1f9fc2ae8329e9b04e240febfadd4d9262e2d01fe93a5d8d4c19aa48742bc84bfa9c9c5b96d6c8f8bdb4e6b383d76ab

    • C:\Program Files (x86)\Slay the Spire\desktop-1.0.jar

      Filesize

      325.9MB

      MD5

      0aee5d1e9471325fab54ccf86c61d44b

      SHA1

      92ba406bef174d1a4fc05b2fc68cecc2d3907c7a

      SHA256

      5c45c926025044e58e6e3c56285af596167eb291ffb97fb7d3975b89e51e1abc

      SHA512

      54dea16c2c60f0e1fbe9245686b0528314b8bd71d699587d1a46448e10c0b9c1235ed7bd4fcce9f203c6a237add2eddccb65293c92c67fdfb178e4ff9b89a2a6

    • C:\Program Files (x86)\Slay the Spire\info.displayconfig

      Filesize

      35B

      MD5

      6657fe735e5e4b2b1d39266cbf0d388f

      SHA1

      36b654a7bf40d3181eed2f06af3b1d8c1ab5e581

      SHA256

      8e4c3e26d4ebbd6911fb8483a31236f228ebfc6f41198fbfcf2ab3e71159ba45

      SHA512

      698c7254be3836f121cd2b567073dbc703d443215db87ea81ab844a193ec4aeeb2859a79c1e756c72d889595b4c148583468716b5463cc3662604937aa50c043

    • C:\Program Files (x86)\Slay the Spire\jre\bin\java.dll

      Filesize

      156KB

      MD5

      97da34ac97e3e37ff58815838891129a

      SHA1

      d0d576a14c80311a0e06d63dc58683e583f6685c

      SHA256

      e78b12c013e22869d8649454f1c65cc7d0484f1c840f0b37e53563d48a5614fa

      SHA512

      83de81283b170f587c64b621475c4006fae3be06a670359632448182f78cf558a8d17b8e92c6deb22c14505fc3b8995c8e8e5be32f5743c0726ac6b95eee34a4

    • C:\Program Files (x86)\Slay the Spire\jre\bin\java.dll

      Filesize

      156KB

      MD5

      97da34ac97e3e37ff58815838891129a

      SHA1

      d0d576a14c80311a0e06d63dc58683e583f6685c

      SHA256

      e78b12c013e22869d8649454f1c65cc7d0484f1c840f0b37e53563d48a5614fa

      SHA512

      83de81283b170f587c64b621475c4006fae3be06a670359632448182f78cf558a8d17b8e92c6deb22c14505fc3b8995c8e8e5be32f5743c0726ac6b95eee34a4

    • C:\Program Files (x86)\Slay the Spire\jre\bin\java.dll

      Filesize

      156KB

      MD5

      97da34ac97e3e37ff58815838891129a

      SHA1

      d0d576a14c80311a0e06d63dc58683e583f6685c

      SHA256

      e78b12c013e22869d8649454f1c65cc7d0484f1c840f0b37e53563d48a5614fa

      SHA512

      83de81283b170f587c64b621475c4006fae3be06a670359632448182f78cf558a8d17b8e92c6deb22c14505fc3b8995c8e8e5be32f5743c0726ac6b95eee34a4

    • C:\Program Files (x86)\Slay the Spire\jre\bin\management.dll

      Filesize

      36KB

      MD5

      ceaa262c548332d18ba734ec5b31123f

      SHA1

      f41b0fa99e11d7873800d7f1339db8677e9cf9b0

      SHA256

      de55ebae4768cc60253a8238a195b31edd9d8816365fb5fdb680ce8fe4b81711

      SHA512

      1e088102e07bf28a8765219e93947f5b894ecd44251a0073485a6a1f5c44085890610969fa4d1de6ad4621d9e74d8119177881d8bf6a3dd4bf6a7c04dda5d6c3

    • C:\Program Files (x86)\Slay the Spire\jre\bin\management.dll

      Filesize

      36KB

      MD5

      ceaa262c548332d18ba734ec5b31123f

      SHA1

      f41b0fa99e11d7873800d7f1339db8677e9cf9b0

      SHA256

      de55ebae4768cc60253a8238a195b31edd9d8816365fb5fdb680ce8fe4b81711

      SHA512

      1e088102e07bf28a8765219e93947f5b894ecd44251a0073485a6a1f5c44085890610969fa4d1de6ad4621d9e74d8119177881d8bf6a3dd4bf6a7c04dda5d6c3

    • C:\Program Files (x86)\Slay the Spire\jre\bin\management.dll

      Filesize

      36KB

      MD5

      ceaa262c548332d18ba734ec5b31123f

      SHA1

      f41b0fa99e11d7873800d7f1339db8677e9cf9b0

      SHA256

      de55ebae4768cc60253a8238a195b31edd9d8816365fb5fdb680ce8fe4b81711

      SHA512

      1e088102e07bf28a8765219e93947f5b894ecd44251a0073485a6a1f5c44085890610969fa4d1de6ad4621d9e74d8119177881d8bf6a3dd4bf6a7c04dda5d6c3

    • C:\Program Files (x86)\Slay the Spire\jre\bin\msvcr100.dll

      Filesize

      809KB

      MD5

      df3ca8d16bded6a54977b30e66864d33

      SHA1

      b7b9349b33230c5b80886f5c1f0a42848661c883

      SHA256

      1d1a1ae540ba132f998d60d3622f0297b6e86ae399332c3b47462d7c0f560a36

      SHA512

      951b2f67c2f2ef1cfcd4b43bd3ee0e486cdba7d04b4ea7259df0e4b3112e360aefb8dcd058becccacd99aca7f56d4f9bd211075bd16b28c2661d562e50b423f0

    • C:\Program Files (x86)\Slay the Spire\jre\bin\net.dll

      Filesize

      94KB

      MD5

      8ee9eb118c2f7e4b4a8ab664444a16ee

      SHA1

      d7296eea2774aafa79ee645c03dd91e0ea7a5dc0

      SHA256

      dd13df8c9560ca76bcb48580f2965695fa4b105d4f066568a9249dbdf1179303

      SHA512

      65d632b290835f84b5cb6ee3f00f07930d49b3c1093aea9db6d26f86ffdbc9e0dcefab15daaada89e68cd1bada2f5d93edd93a0b2870967788fc0e51073fbbe4

    • C:\Program Files (x86)\Slay the Spire\jre\bin\net.dll

      Filesize

      94KB

      MD5

      8ee9eb118c2f7e4b4a8ab664444a16ee

      SHA1

      d7296eea2774aafa79ee645c03dd91e0ea7a5dc0

      SHA256

      dd13df8c9560ca76bcb48580f2965695fa4b105d4f066568a9249dbdf1179303

      SHA512

      65d632b290835f84b5cb6ee3f00f07930d49b3c1093aea9db6d26f86ffdbc9e0dcefab15daaada89e68cd1bada2f5d93edd93a0b2870967788fc0e51073fbbe4

    • C:\Program Files (x86)\Slay the Spire\jre\bin\net.dll

      Filesize

      94KB

      MD5

      8ee9eb118c2f7e4b4a8ab664444a16ee

      SHA1

      d7296eea2774aafa79ee645c03dd91e0ea7a5dc0

      SHA256

      dd13df8c9560ca76bcb48580f2965695fa4b105d4f066568a9249dbdf1179303

      SHA512

      65d632b290835f84b5cb6ee3f00f07930d49b3c1093aea9db6d26f86ffdbc9e0dcefab15daaada89e68cd1bada2f5d93edd93a0b2870967788fc0e51073fbbe4

    • C:\Program Files (x86)\Slay the Spire\jre\bin\nio.dll

      Filesize

      59KB

      MD5

      5f0c98f09a8120e5dacbd2c86f69ce6c

      SHA1

      465a32071a11f2ec5e669a08e037a1565d3749ce

      SHA256

      43c97c4cf488f6c9cabfe0eabcddaf1acb3861c5fce1752ed64873752d8b7ef5

      SHA512

      f18c21b88bd0d0e3815405f1c3ec73bfe0a7d2306056c487bb886f16323c521ef83eac89eea23e363e6145574312505c9657286974f472da7a94ef50a12da0ac

    • C:\Program Files (x86)\Slay the Spire\jre\bin\nio.dll

      Filesize

      59KB

      MD5

      5f0c98f09a8120e5dacbd2c86f69ce6c

      SHA1

      465a32071a11f2ec5e669a08e037a1565d3749ce

      SHA256

      43c97c4cf488f6c9cabfe0eabcddaf1acb3861c5fce1752ed64873752d8b7ef5

      SHA512

      f18c21b88bd0d0e3815405f1c3ec73bfe0a7d2306056c487bb886f16323c521ef83eac89eea23e363e6145574312505c9657286974f472da7a94ef50a12da0ac

    • C:\Program Files (x86)\Slay the Spire\jre\bin\nio.dll

      Filesize

      59KB

      MD5

      5f0c98f09a8120e5dacbd2c86f69ce6c

      SHA1

      465a32071a11f2ec5e669a08e037a1565d3749ce

      SHA256

      43c97c4cf488f6c9cabfe0eabcddaf1acb3861c5fce1752ed64873752d8b7ef5

      SHA512

      f18c21b88bd0d0e3815405f1c3ec73bfe0a7d2306056c487bb886f16323c521ef83eac89eea23e363e6145574312505c9657286974f472da7a94ef50a12da0ac

    • C:\Program Files (x86)\Slay the Spire\jre\bin\server\jvm.dll

      Filesize

      8.4MB

      MD5

      1819ad5cb6d8d46a80004e1f8db88242

      SHA1

      dba7031c7c60dd1f3ca9a59122cf1e805815506c

      SHA256

      129535efdcddb260522f0a982729f845c7a94ba0cb5eccdc199df3d490e46f21

      SHA512

      ac7b0425b796b2ab75c31cc9ae39a027609f138525423880dc75d35bcedfd3bc1396091847c3fe7b0005bb17fd72217d9330e0c93300caa1cedbd6116987f863

    • C:\Program Files (x86)\Slay the Spire\jre\bin\server\jvm.dll

      Filesize

      8.4MB

      MD5

      1819ad5cb6d8d46a80004e1f8db88242

      SHA1

      dba7031c7c60dd1f3ca9a59122cf1e805815506c

      SHA256

      129535efdcddb260522f0a982729f845c7a94ba0cb5eccdc199df3d490e46f21

      SHA512

      ac7b0425b796b2ab75c31cc9ae39a027609f138525423880dc75d35bcedfd3bc1396091847c3fe7b0005bb17fd72217d9330e0c93300caa1cedbd6116987f863

    • C:\Program Files (x86)\Slay the Spire\jre\bin\server\jvm.dll

      Filesize

      8.4MB

      MD5

      1819ad5cb6d8d46a80004e1f8db88242

      SHA1

      dba7031c7c60dd1f3ca9a59122cf1e805815506c

      SHA256

      129535efdcddb260522f0a982729f845c7a94ba0cb5eccdc199df3d490e46f21

      SHA512

      ac7b0425b796b2ab75c31cc9ae39a027609f138525423880dc75d35bcedfd3bc1396091847c3fe7b0005bb17fd72217d9330e0c93300caa1cedbd6116987f863

    • C:\Program Files (x86)\Slay the Spire\jre\bin\verify.dll

      Filesize

      48KB

      MD5

      6b2772a9bbc8024c1a5e0c3f8adc1448

      SHA1

      5d65b933698d3ff305cf2d265aac8d05d46f831f

      SHA256

      51d8650fd3728f264fb301c00bf88f762d7758716d60cfa44c3cfadc9439dd46

      SHA512

      f417ab70154a13a7084a98cf962d6b37d215f9ab6ab60c38df23f309f8a9ee33328d3356b95be39ac0ac3f63e3388613c40eeb25624d6566bf7f177fd10bcaa8

    • C:\Program Files (x86)\Slay the Spire\jre\bin\verify.dll

      Filesize

      48KB

      MD5

      6b2772a9bbc8024c1a5e0c3f8adc1448

      SHA1

      5d65b933698d3ff305cf2d265aac8d05d46f831f

      SHA256

      51d8650fd3728f264fb301c00bf88f762d7758716d60cfa44c3cfadc9439dd46

      SHA512

      f417ab70154a13a7084a98cf962d6b37d215f9ab6ab60c38df23f309f8a9ee33328d3356b95be39ac0ac3f63e3388613c40eeb25624d6566bf7f177fd10bcaa8

    • C:\Program Files (x86)\Slay the Spire\jre\bin\verify.dll

      Filesize

      48KB

      MD5

      6b2772a9bbc8024c1a5e0c3f8adc1448

      SHA1

      5d65b933698d3ff305cf2d265aac8d05d46f831f

      SHA256

      51d8650fd3728f264fb301c00bf88f762d7758716d60cfa44c3cfadc9439dd46

      SHA512

      f417ab70154a13a7084a98cf962d6b37d215f9ab6ab60c38df23f309f8a9ee33328d3356b95be39ac0ac3f63e3388613c40eeb25624d6566bf7f177fd10bcaa8

    • C:\Program Files (x86)\Slay the Spire\jre\bin\zip.dll

      Filesize

      76KB

      MD5

      6e6c3abaf959c9b29947047366a9d1be

      SHA1

      6a2e309c85c719dc94084a170563a7f5cada2fca

      SHA256

      29833c5e3eb3aa5cb3c1243ba1bceef66e32442e07718b775dcccb04100d776a

      SHA512

      ca2f141c6777423a9fad3a148813b6143fd9dbfd66fd2e40844e76558ea2528ed5f8a21c195fde74463a111fa6bcb243ac25c4cf7757681f83d5dbc586dbc9f6

    • C:\Program Files (x86)\Slay the Spire\jre\bin\zip.dll

      Filesize

      76KB

      MD5

      6e6c3abaf959c9b29947047366a9d1be

      SHA1

      6a2e309c85c719dc94084a170563a7f5cada2fca

      SHA256

      29833c5e3eb3aa5cb3c1243ba1bceef66e32442e07718b775dcccb04100d776a

      SHA512

      ca2f141c6777423a9fad3a148813b6143fd9dbfd66fd2e40844e76558ea2528ed5f8a21c195fde74463a111fa6bcb243ac25c4cf7757681f83d5dbc586dbc9f6

    • C:\Program Files (x86)\Slay the Spire\jre\bin\zip.dll

      Filesize

      76KB

      MD5

      6e6c3abaf959c9b29947047366a9d1be

      SHA1

      6a2e309c85c719dc94084a170563a7f5cada2fca

      SHA256

      29833c5e3eb3aa5cb3c1243ba1bceef66e32442e07718b775dcccb04100d776a

      SHA512

      ca2f141c6777423a9fad3a148813b6143fd9dbfd66fd2e40844e76558ea2528ed5f8a21c195fde74463a111fa6bcb243ac25c4cf7757681f83d5dbc586dbc9f6

    • C:\Program Files (x86)\Slay the Spire\jre\lib\currency.data

      Filesize

      4KB

      MD5

      f6258230b51220609a60aa6ba70d68f3

      SHA1

      b5b95dd1ddcd3a433db14976e3b7f92664043536

      SHA256

      22458853da2415f7775652a7f57bb6665f83a9ae9fb8bd3cf05e29aac24c8441

      SHA512

      b2dfcfdebf9596f2bb05f021a24335f1eb2a094dca02b2d7dd1b7c871d5eecda7d50da7943b9f85edb5e92d9be6b6adfd24673ce816df3960e4d68c7f894563f

    • C:\Program Files (x86)\Slay the Spire\jre\lib\deploy\messages_zh_HK.properties

      Filesize

      3KB

      MD5

      880baacb176553deab39edbe4b74380d

      SHA1

      37a57aad121c14c25e149206179728fa62203bf0

      SHA256

      ff4a3a92bc92cb08d2c32c435810440fd264edd63e56efa39430e0240c835620

      SHA512

      3039315bb283198af9090bd3d31cfae68ee73bc2b118bbae0b32812d4e3fd0f11ce962068d4a17b065dab9a66ef651b9cb8404c0a2defce74bb6b2d1d93646d5

    • C:\Program Files (x86)\Slay the Spire\jre\lib\ext\cldrdata.jar

      Filesize

      3.7MB

      MD5

      71bd097e418e494b6c76526f004a9e84

      SHA1

      f7eb06cc03499db9abd08ca922361a0bd8831959

      SHA256

      26beedf955cbbae1098bad6516a254197a6bb0ce76f8b52022f97fdc04e697b8

      SHA512

      be21d8475de1c8d29f00d9be71903b50681a874527a85d29f5aeba23cbbdefde153ad6488df175fa7db00f01bc0a96a3d9c503a843c0844a6f04f4d83109e97d

    • C:\Program Files (x86)\Slay the Spire\jre\lib\ext\localedata.jar

      Filesize

      1.1MB

      MD5

      d85e97c5c88bb175059fedf12994bc2e

      SHA1

      a5cdf5670e417c387f7b603def50bc6c437f93b5

      SHA256

      a3c4232a911b9985b2da0917daf517f0afb8b52b871f121a44e128ef7ec2f77a

      SHA512

      ec0074abac43c3c1bbde354b4bf8f6d64b0bd76a0d672a343e3b6533e83aa2bd774131a2a29d4d0fcb6f926174eab84c85bd6f9997af05c05659398399aaccd8

    • C:\Program Files (x86)\Slay the Spire\jre\lib\ext\meta-index

      Filesize

      1KB

      MD5

      005faac2118450bfcd46ae414da5f0e5

      SHA1

      9f5c887e0505e1bb06bd1fc7975a3219709d061d

      SHA256

      f0bce718f8d2b38247ce0ac814a1470c826602f4251d86369c2359ff60676bd8

      SHA512

      8b618c74b359ab3c9d3c8a4864f8e48fe4054514a396352a829a84c9b843a2028c6c31eb53e857e03c803294e05f69c5bf586e261312264e7607b2efd14f78a9

    • C:\Program Files (x86)\Slay the Spire\jre\lib\ext\nashorn.jar

      Filesize

      1.9MB

      MD5

      374c4731861586a3584e973b029b8639

      SHA1

      272730147235fd0108dca0f47e11c2a70237c1c2

      SHA256

      49e3ddf0c696469dd2b4610fb1707c38d242822d28fa10f23fe123f06a98ae5b

      SHA512

      e4930a1fa1c7a4ad5ac32d5fbd0394acb80d9ce2607cf1e14b52760f8eb346fd34836c3fbad746aa2535fa79d9ad3360e52b5fc25d8474ad9491cb95ac3a018d

    • C:\Program Files (x86)\Slay the Spire\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif

      Filesize

      153B

      MD5

      1e9d8f133a442da6b0c74d49bc84a341

      SHA1

      259edc45b4569427e8319895a444f4295d54348f

      SHA256

      1a1d3079d49583837662b84e11d8c0870698511d9110e710eb8e7eb20df7ae3b

      SHA512

      63d6f70c8cab9735f0f857f5bf99e319f6ae98238dc7829dd706b7d6855c70be206e32e3e55df884402483cf8bebad00d139283af5c0b85dc1c5bf8f253acd37

    • C:\Program Files (x86)\Slay the Spire\jre\lib\jsse.jar

      Filesize

      633KB

      MD5

      9deb9764751b7d0f638a1886ed84a53f

      SHA1

      e9eafc254f29d5662485a84e1d93b2a8c33881a7

      SHA256

      4472e41b57222efc224ec85046650bd3ecdfbf73e507d39f45fbe6479ec482fd

      SHA512

      fa49fa61138fbbc547c96243452f13192119c33801893310d51e5578749f74c74360302b67c482e51330b3249b5d240e1925fedf5157b843a1cce9b9441233bf

    • C:\Program Files (x86)\Slay the Spire\jre\lib\logging.properties

      Filesize

      2KB

      MD5

      809c50033f825eff7fc70419aaf30317

      SHA1

      89da8094484891f9ec1fa40c6c8b61f94c5869d0

      SHA256

      ce1688fe641099954572ea856953035b5188e2ca228705001368250337b9b232

      SHA512

      c5aa71ad9e1d17472644eb43146edf87caa7bccf0a39e102e31e6c081cd017e01b39645f55ee87f4ea3556376f7cad3953ce3f3301b4b3af265b7b4357b67a5c

    • C:\Program Files (x86)\Slay the Spire\jre\lib\meta-index

      Filesize

      2KB

      MD5

      91aa6ea7320140f30379f758d626e59d

      SHA1

      3be2febe28723b1033ccdaa110eaf59bbd6d1f96

      SHA256

      4af21954cdf398d1eae795b6886ca2581dac9f2f1d41c98c6ed9b5dbc3e3c1d4

      SHA512

      03428803f1d644d89eb4c0dcbdea93acaac366d35fc1356ccabf83473f4fef7924edb771e44c721103cec22d94a179f092d1bfd1c0a62130f076eb82a826d7cb

    • C:\Program Files (x86)\Slay the Spire\jre\lib\rt.jar

      Filesize

      60.8MB

      MD5

      121f688b441c76457791330621040ab7

      SHA1

      17f633f04841c3fa68be884447901d493c5115ae

      SHA256

      49b25e6b1265d2308c72fc26d72fe34a81f49ce54ffce3fb5db4d5097cbbea01

      SHA512

      717d1a1fff6fec317845b0c176d69d3c1d30100ef0b0fa981ad2f742cb437037f53248706808f8a726834d9ecaa5ef28133f7bda0d2c1506f1053217bb5607d6

    • C:\Program Files (x86)\Slay the Spire\jre\lib\security\java.security

      Filesize

      35KB

      MD5

      6de3c3f9aad0301642710db5281b045f

      SHA1

      80ddc0b2d3424519b0534705b52d18cd528942d8

      SHA256

      3e365b94e94dd81c9e97d6d15b3a3223d8f32000e3a82101cfb0af4ce018ea20

      SHA512

      801bd5ff9e547b51a94d061d20543b774424a02f81cba9894be409d081cba7be4576d7ec09d1689e2defb9b18b11342dc1fed693cb5e560504a16d324307abff

    • C:\Program Files (x86)\Slay the Spire\jre\lib\tzdb.dat

      Filesize

      103KB

      MD5

      4b31c64d61eaef49b8140bbd5457a937

      SHA1

      e75e1640369790825f5648bf4b7b761a5b54dcee

      SHA256

      a46a8bf58bc55784fa07e23f01ad46c9cb161a02b6a7cd8e035bb718c92e758b

      SHA512

      acde7e2bd46ce5fbb85ab8b409d75e892c9bc5b451351c3ee0c37650779637ae1855a6877baa61d52e812b2e3684d628ea4ba1497571211f08598b164cebe5a3

    • C:\Program Files (x86)\Slay the Spire\jre\lib\tzmappings

      Filesize

      8KB

      MD5

      7d4abbcfb06d083f349e27d7e6972f3c

      SHA1

      eb91253590526f7be7415839ccbf702683639c8c

      SHA256

      d936ee24810b747c54192b4b5a279f21179fe3ceb42d113d025a368ebb7cb5a7

      SHA512

      e5c2fbbc07cd53baf14f3cc239b56b42b73de47f9b7904aabf7d97695d2ab8866d0c8179235cbf022245949b9b8e419985e328aa5ed333b14b8b4de2c82b225e

    • C:\Program Files (x86)\Slay the Spire\sendToDevs\logs\SlayTheSpire.log

      Filesize

      1KB

      MD5

      de929d4150ac0f0058604fb8f3e81bce

      SHA1

      80925692c90f3d5059e9390e7914f21ab3e5da74

      SHA256

      06beba435326b59a3ab2d9be4d5f0ae63dfb71f87cc4f0f8669e5e8064bf24ef

      SHA512

      21343a7253856a7a6d2ab5bd86d65c07ecc8a726eab194aa35d79b6df51f7fe3f9dee51026f81e9985ef5a2e1ae3f7201777168397cb2b652b92a8cd2a5c7d90

    • C:\ProgramData\Oracle\Java\.oracle_jre_usage\8bf0643894bb1f0d.timestamp

      Filesize

      58B

      MD5

      d597569d727533399abff62ea4056327

      SHA1

      5c1f9b92e2bdca8c2bc4265b839266469984b8d9

      SHA256

      f3906a1799d38bbae55fbdab56f13c94167646092aa5024a9bec6fbbfcd8d6d7

      SHA512

      4005d4c3690136bfe0b7345c012549e6865d9943be1b401e83af1f54a3585870884bf0443740a3b65baae4e9b01bd18b6566f33a4988d0c90452d236a39e6b26

    • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{0A6AC72E-ED8C-C16F-38B6-05831557CF24}

      Filesize

      36KB

      MD5

      8aaad0f4eb7d3c65f81c6e6b496ba889

      SHA1

      231237a501b9433c292991e4ec200b25c1589050

      SHA256

      813c66ce7dec4cff9c55fb6f809eab909421e37f69ff30e4acaa502365a32bd1

      SHA512

      1a83ce732dc47853bf6e8f4249054f41b0dea8505cda73433b37dfa16114f27bfed3b4b3ba580aa9d53c3dcc8d48bf571a45f7c0468e6a0f2a227a7e59e17d62

    • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Windows_ControlPanel

      Filesize

      36KB

      MD5

      fb5f8866e1f4c9c1c7f4d377934ff4b2

      SHA1

      d0a329e387fb7bcba205364938417a67dbb4118a

      SHA256

      1649ec9493be27f76ae7304927d383f8a53dd3e41ea1678bacaff33120ea4170

      SHA512

      0fbe2843dfeab7373cde0643b20c073fdc2fcbefc5ae581fd1656c253dfa94e8bba4d348e95cc40d1e872456ecca894b462860aeac8b92cedb11a7cad634798c

    • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133278052640548150.txt

      Filesize

      75KB

      MD5

      124429943293a1f6986188ab9d82cd66

      SHA1

      104054023ff1b26b18ce2981faf0c9190e7b4f2c

      SHA256

      21e80222ed227f8998d21ce1fb5819302fa03eca201a7f6634dfc520332c1edb

      SHA512

      194e0d1f68a8e934f1d71198bb71bfa83d0176abf8d17cf55fb4ee11fd57b2c0c8aebc602bcabd26a158dd227d366bf39bbd3ccc12762f71b9eb4f4ed1d8052d

    • C:\Users\Admin\AppData\Local\Temp\is-BTMR0.tmp\BASS.dll

      Filesize

      107KB

      MD5

      c0b11a7e60f69241ddcb278722ab962f

      SHA1

      ff855961eb5ed8779498915bab3d642044fc9bb1

      SHA256

      a8d979460e970e84eacce36b8a68ae5f6b9cc0fe16e05a6209b4ead52b81b021

      SHA512

      cb040aca6592310bffb72c898b8eb3ca8a46ff2df50212634c637593c58683c8ab62e0188da7aea362e1b063ae5db55cf4bf474295922af0ab94a526465cc472

    • C:\Users\Admin\AppData\Local\Temp\is-BTMR0.tmp\ISDone.dll

      Filesize

      446KB

      MD5

      dce6d68da86f44ba0cb70fa7718e2e84

      SHA1

      58cd39196abfc70b5b9bcc964f41a21024a61480

      SHA256

      b9bdc4a0309aa47613a7b5a680c55839aa7ba28e28f96e6b9316d4d5fe1dbe9d

      SHA512

      bd2f559640b63a46e15a2af90719c10e53e1c30020685163ed6b3bb669197d20d5dd76c7fd1052cf0841e3e1fdbd5a365a4bdb519d2f8fcad9122e77d923e8d6

    • C:\Users\Admin\AppData\Local\Temp\is-BTMR0.tmp\ISDone.dll

      Filesize

      446KB

      MD5

      dce6d68da86f44ba0cb70fa7718e2e84

      SHA1

      58cd39196abfc70b5b9bcc964f41a21024a61480

      SHA256

      b9bdc4a0309aa47613a7b5a680c55839aa7ba28e28f96e6b9316d4d5fe1dbe9d

      SHA512

      bd2f559640b63a46e15a2af90719c10e53e1c30020685163ed6b3bb669197d20d5dd76c7fd1052cf0841e3e1fdbd5a365a4bdb519d2f8fcad9122e77d923e8d6

    • C:\Users\Admin\AppData\Local\Temp\is-BTMR0.tmp\VclStylesInno.dll

      Filesize

      1.9MB

      MD5

      64101d65027abe80025028af0cfdb6b3

      SHA1

      ad1fa0b6f9abd2df8193ace3c058c6aab6565a2f

      SHA256

      c2debfb2a38bc839365f000878fa4561ddebf4955616feeb812d5adf3094b721

      SHA512

      58caf74ec58dd9a0e7ab3ff11ba89622376ff165cef225c00597ba0522adc42910f53c7b5e2f29fa72ab236b3c4347483fe960acb4f7f9c796162fd6a80b0ab8

    • C:\Users\Admin\AppData\Local\Temp\is-BTMR0.tmp\VclStylesInno.dll

      Filesize

      1.9MB

      MD5

      64101d65027abe80025028af0cfdb6b3

      SHA1

      ad1fa0b6f9abd2df8193ace3c058c6aab6565a2f

      SHA256

      c2debfb2a38bc839365f000878fa4561ddebf4955616feeb812d5adf3094b721

      SHA512

      58caf74ec58dd9a0e7ab3ff11ba89622376ff165cef225c00597ba0522adc42910f53c7b5e2f29fa72ab236b3c4347483fe960acb4f7f9c796162fd6a80b0ab8

    • C:\Users\Admin\AppData\Local\Temp\is-BTMR0.tmp\bp.dll

      Filesize

      129KB

      MD5

      70cd1d226553f3c0546664d76373fe67

      SHA1

      509d03b6fce1e35b6e848ae88af52b7b9ff42d48

      SHA256

      65a7e7fb213007ba2e285bb2c3e2df1a553990a2a3e26a0a6591f01ce6c87bc0

      SHA512

      5b2487bfffb26ff76988f175e4aa97f7ae83b9dd747bd61ae7d3b338f04447a345186a715bfe0bb86c07cd5c3c829540fc4099254cfee20d873700573ef5826f

    • C:\Users\Admin\AppData\Local\Temp\is-BTMR0.tmp\bp.dll

      Filesize

      129KB

      MD5

      70cd1d226553f3c0546664d76373fe67

      SHA1

      509d03b6fce1e35b6e848ae88af52b7b9ff42d48

      SHA256

      65a7e7fb213007ba2e285bb2c3e2df1a553990a2a3e26a0a6591f01ce6c87bc0

      SHA512

      5b2487bfffb26ff76988f175e4aa97f7ae83b9dd747bd61ae7d3b338f04447a345186a715bfe0bb86c07cd5c3c829540fc4099254cfee20d873700573ef5826f

    • C:\Users\Admin\AppData\Local\Temp\is-BTMR0.tmp\unarc.dll

      Filesize

      368KB

      MD5

      06a9571ff4789cf4aec6fda08992a9dc

      SHA1

      3c6591535c240c80bcd7194ecba321d036eb88bb

      SHA256

      461e262189717c32ef0d7b559137b4f37d0eea1f7010a564adb11a06927938c4

      SHA512

      d48a89b8ace3bf36dc8d6270038a47b122d34c2d3561963701441e7e1f950c824b9552525f1a53f23d1c9f1d599025ff6fef81e3d9b2368157d5e5c6a4301b27

    • C:\Users\Admin\AppData\Local\Temp\is-BTMR0.tmp\wintb.dll

      Filesize

      27KB

      MD5

      39a339e9c9ecc529202508c9c89a9956

      SHA1

      92e697882abb90cba6a783aef98d3d05deb8e4b9

      SHA256

      88160915cd065e25bc0b9b89099663ccbcca606a5707a28a5df12e9c118d4f16

      SHA512

      b96e3bac6da4e3812f09d21d575642beac47338c026f3bc116d42b09cfb492b1e51cc74cbb9d1724e744ec2129619b196247ca1ddc03d8c0a27a2613890cbef3

    • C:\Users\Admin\AppData\Local\Temp\is-BTMR0.tmp\wintb.dll

      Filesize

      27KB

      MD5

      39a339e9c9ecc529202508c9c89a9956

      SHA1

      92e697882abb90cba6a783aef98d3d05deb8e4b9

      SHA256

      88160915cd065e25bc0b9b89099663ccbcca606a5707a28a5df12e9c118d4f16

      SHA512

      b96e3bac6da4e3812f09d21d575642beac47338c026f3bc116d42b09cfb492b1e51cc74cbb9d1724e744ec2129619b196247ca1ddc03d8c0a27a2613890cbef3

    • C:\Users\Admin\AppData\Local\Temp\is-CB1O6.tmp\setup.tmp

      Filesize

      1.5MB

      MD5

      5e4772b71ba057c189708d2a7d377cc3

      SHA1

      80659fbcad0a71b41342b306558eff4d38cfdd47

      SHA256

      31c25e9a2680456f969ee231fb383b6e379faeda32a308009013332076383e7a

      SHA512

      866597cd13182232acd9e7f8e760ff72e3472d6a3f3895659b31e176a9d47032dac97db0e7f569777bd65b8f5b0580871d2f84062325d30f483a1c6bf6fc3556

    • C:\Users\Admin\AppData\Local\Temp\is-CB1O6.tmp\setup.tmp

      Filesize

      1.5MB

      MD5

      5e4772b71ba057c189708d2a7d377cc3

      SHA1

      80659fbcad0a71b41342b306558eff4d38cfdd47

      SHA256

      31c25e9a2680456f969ee231fb383b6e379faeda32a308009013332076383e7a

      SHA512

      866597cd13182232acd9e7f8e760ff72e3472d6a3f3895659b31e176a9d47032dac97db0e7f569777bd65b8f5b0580871d2f84062325d30f483a1c6bf6fc3556

    • C:\Users\Admin\AppData\Local\Temp\libgdxAdmin\a9daadd6\gdx64.dll

      Filesize

      653KB

      MD5

      35d6049e5c2627eed63ec75c0268ee59

      SHA1

      980d5059bd4ab7125ff215a421f2d150314e6e51

      SHA256

      d1af53dfcb03d102ab0c2461da25f27b9e4c2014e6c9c27da0554611ca0b91c8

      SHA512

      c60fb50f13f4bafeab68895bd1bbe149bb7fef268568f1884c154b5a9abd86ca0b9242568cecb7c50a72ca15c92068dee8a3767ce027996b36c588b8b8073edc

    • C:\Users\Admin\AppData\Local\Temp\libgdxAdmin\a9daadd6\gdx64.dll

      Filesize

      653KB

      MD5

      35d6049e5c2627eed63ec75c0268ee59

      SHA1

      980d5059bd4ab7125ff215a421f2d150314e6e51

      SHA256

      d1af53dfcb03d102ab0c2461da25f27b9e4c2014e6c9c27da0554611ca0b91c8

      SHA512

      c60fb50f13f4bafeab68895bd1bbe149bb7fef268568f1884c154b5a9abd86ca0b9242568cecb7c50a72ca15c92068dee8a3767ce027996b36c588b8b8073edc

    • C:\Users\Admin\AppData\Local\Temp\libgdxAdmin\a9daadd6\gdx64.dll

      Filesize

      653KB

      MD5

      35d6049e5c2627eed63ec75c0268ee59

      SHA1

      980d5059bd4ab7125ff215a421f2d150314e6e51

      SHA256

      d1af53dfcb03d102ab0c2461da25f27b9e4c2014e6c9c27da0554611ca0b91c8

      SHA512

      c60fb50f13f4bafeab68895bd1bbe149bb7fef268568f1884c154b5a9abd86ca0b9242568cecb7c50a72ca15c92068dee8a3767ce027996b36c588b8b8073edc

    • C:\Users\Admin\AppData\Local\Temp\libgdxAdmin\dc0f0009\OpenAL64.dll

      Filesize

      373KB

      MD5

      89021c218a3f6feb807a664f852ffbd3

      SHA1

      97362fba53dfb6d9581b8c64829f4b1d98a97855

      SHA256

      9261b66010a845ddef9f61d5e4266fe2f08a53f3605da002e9e8f8d202bdbc5e

      SHA512

      e511c707c4453016cdeefcbc863fbf2750ad9cda12ad31f27369d5a396f9c98d9ef37fafb4030c683f17b1e2cdcfce924015fe49dd6652c3060bb0ba77ea3064

    • C:\Users\Admin\AppData\Local\Temp\libgdxAdmin\dc0f0009\OpenAL64.dll

      Filesize

      373KB

      MD5

      89021c218a3f6feb807a664f852ffbd3

      SHA1

      97362fba53dfb6d9581b8c64829f4b1d98a97855

      SHA256

      9261b66010a845ddef9f61d5e4266fe2f08a53f3605da002e9e8f8d202bdbc5e

      SHA512

      e511c707c4453016cdeefcbc863fbf2750ad9cda12ad31f27369d5a396f9c98d9ef37fafb4030c683f17b1e2cdcfce924015fe49dd6652c3060bb0ba77ea3064

    • C:\Users\Admin\AppData\Local\Temp\libgdxAdmin\dc0f0009\OpenAL64.dll

      Filesize

      373KB

      MD5

      89021c218a3f6feb807a664f852ffbd3

      SHA1

      97362fba53dfb6d9581b8c64829f4b1d98a97855

      SHA256

      9261b66010a845ddef9f61d5e4266fe2f08a53f3605da002e9e8f8d202bdbc5e

      SHA512

      e511c707c4453016cdeefcbc863fbf2750ad9cda12ad31f27369d5a396f9c98d9ef37fafb4030c683f17b1e2cdcfce924015fe49dd6652c3060bb0ba77ea3064

    • C:\Users\Admin\AppData\Local\Temp\libgdxAdmin\dc0f0009\OpenAL64.dll

      Filesize

      373KB

      MD5

      89021c218a3f6feb807a664f852ffbd3

      SHA1

      97362fba53dfb6d9581b8c64829f4b1d98a97855

      SHA256

      9261b66010a845ddef9f61d5e4266fe2f08a53f3605da002e9e8f8d202bdbc5e

      SHA512

      e511c707c4453016cdeefcbc863fbf2750ad9cda12ad31f27369d5a396f9c98d9ef37fafb4030c683f17b1e2cdcfce924015fe49dd6652c3060bb0ba77ea3064

    • C:\Users\Admin\AppData\Local\Temp\libgdxAdmin\dc0f0009\OpenAL64.dll

      Filesize

      373KB

      MD5

      89021c218a3f6feb807a664f852ffbd3

      SHA1

      97362fba53dfb6d9581b8c64829f4b1d98a97855

      SHA256

      9261b66010a845ddef9f61d5e4266fe2f08a53f3605da002e9e8f8d202bdbc5e

      SHA512

      e511c707c4453016cdeefcbc863fbf2750ad9cda12ad31f27369d5a396f9c98d9ef37fafb4030c683f17b1e2cdcfce924015fe49dd6652c3060bb0ba77ea3064

    • C:\Users\Admin\AppData\Local\Temp\libgdxAdmin\dc0f0009\lwjgl64.dll

      Filesize

      310KB

      MD5

      174dfb16141abb34d52a4c47b6e222b0

      SHA1

      c00425cc1077cf6ba5a031f958b23a9273e9eb52

      SHA256

      cae073ec7e459b950202974bb8011398fdebf800542f709e6a7cb5b6f1dc98ac

      SHA512

      c8aad767dcdc4b807440009c56aa49b2a3032055af182cb421ca25bbe91c4d8c1a3a2dfb9d3088bf3ab1abe370f0b9ae21664758a2fc183842cd1793354e1c3a

    • C:\Users\Admin\AppData\Local\Temp\libgdxAdmin\dc0f0009\lwjgl64.dll

      Filesize

      310KB

      MD5

      174dfb16141abb34d52a4c47b6e222b0

      SHA1

      c00425cc1077cf6ba5a031f958b23a9273e9eb52

      SHA256

      cae073ec7e459b950202974bb8011398fdebf800542f709e6a7cb5b6f1dc98ac

      SHA512

      c8aad767dcdc4b807440009c56aa49b2a3032055af182cb421ca25bbe91c4d8c1a3a2dfb9d3088bf3ab1abe370f0b9ae21664758a2fc183842cd1793354e1c3a

    • C:\Users\Admin\AppData\Local\Temp\libgdxAdmin\dc0f0009\lwjgl64.dll

      Filesize

      310KB

      MD5

      174dfb16141abb34d52a4c47b6e222b0

      SHA1

      c00425cc1077cf6ba5a031f958b23a9273e9eb52

      SHA256

      cae073ec7e459b950202974bb8011398fdebf800542f709e6a7cb5b6f1dc98ac

      SHA512

      c8aad767dcdc4b807440009c56aa49b2a3032055af182cb421ca25bbe91c4d8c1a3a2dfb9d3088bf3ab1abe370f0b9ae21664758a2fc183842cd1793354e1c3a

    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1675742406-747946869-1029867430-1000\83aa4cc77f591dfc2374580bbd95f6ba_8d6935fa-0795-4a6f-bfd9-e755f1917fa0

      Filesize

      45B

      MD5

      c8366ae350e7019aefc9d1e6e6a498c6

      SHA1

      5731d8a3e6568a5f2dfbbc87e3db9637df280b61

      SHA256

      11e6aca8e682c046c83b721eeb5c72c5ef03cb5936c60df6f4993511ddc61238

      SHA512

      33c980d5a638bfc791de291ebf4b6d263b384247ab27f261a54025108f2f85374b579a026e545f81395736dd40fa4696f2163ca17640dd47f1c42bc9971b18cd

    • memory/460-142-0x0000025A25B60000-0x0000025A25B80000-memory.dmp

      Filesize

      128KB

    • memory/460-139-0x0000025A25BA0000-0x0000025A25BC0000-memory.dmp

      Filesize

      128KB

    • memory/460-146-0x0000025A25F70000-0x0000025A25F90000-memory.dmp

      Filesize

      128KB

    • memory/1160-364-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/1160-346-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/1972-394-0x00000000033F0000-0x0000000003530000-memory.dmp

      Filesize

      1.2MB

    • memory/1972-370-0x00000000033F0000-0x0000000003530000-memory.dmp

      Filesize

      1.2MB

    • memory/1972-439-0x0000000002330000-0x0000000002331000-memory.dmp

      Filesize

      4KB

    • memory/1972-438-0x0000000009B10000-0x0000000009B28000-memory.dmp

      Filesize

      96KB

    • memory/1972-443-0x000000000C6B0000-0x000000000C6C0000-memory.dmp

      Filesize

      64KB

    • memory/1972-427-0x00000000740C0000-0x0000000074110000-memory.dmp

      Filesize

      320KB

    • memory/1972-395-0x00000000035B0000-0x00000000035B1000-memory.dmp

      Filesize

      4KB

    • memory/1972-451-0x000000000C6A0000-0x000000000C6A1000-memory.dmp

      Filesize

      4KB

    • memory/1972-452-0x0000000000730000-0x0000000000731000-memory.dmp

      Filesize

      4KB

    • memory/1972-455-0x0000000002330000-0x0000000002331000-memory.dmp

      Filesize

      4KB

    • memory/1972-454-0x0000000009B10000-0x0000000009B28000-memory.dmp

      Filesize

      96KB

    • memory/1972-396-0x00000000033F0000-0x0000000003530000-memory.dmp

      Filesize

      1.2MB

    • memory/1972-393-0x00000000033F0000-0x0000000003530000-memory.dmp

      Filesize

      1.2MB

    • memory/1972-392-0x00000000035A0000-0x00000000035A1000-memory.dmp

      Filesize

      4KB

    • memory/1972-391-0x00000000033F0000-0x0000000003530000-memory.dmp

      Filesize

      1.2MB

    • memory/1972-389-0x0000000003590000-0x0000000003591000-memory.dmp

      Filesize

      4KB

    • memory/1972-390-0x00000000033F0000-0x0000000003530000-memory.dmp

      Filesize

      1.2MB

    • memory/1972-388-0x00000000033F0000-0x0000000003530000-memory.dmp

      Filesize

      1.2MB

    • memory/1972-387-0x00000000033F0000-0x0000000003530000-memory.dmp

      Filesize

      1.2MB

    • memory/1972-383-0x0000000003570000-0x0000000003571000-memory.dmp

      Filesize

      4KB

    • memory/1972-386-0x0000000003580000-0x0000000003581000-memory.dmp

      Filesize

      4KB

    • memory/1972-385-0x00000000033F0000-0x0000000003530000-memory.dmp

      Filesize

      1.2MB

    • memory/1972-384-0x00000000033F0000-0x0000000003530000-memory.dmp

      Filesize

      1.2MB

    • memory/1972-380-0x0000000003560000-0x0000000003561000-memory.dmp

      Filesize

      4KB

    • memory/1972-382-0x00000000033F0000-0x0000000003530000-memory.dmp

      Filesize

      1.2MB

    • memory/1972-381-0x00000000033F0000-0x0000000003530000-memory.dmp

      Filesize

      1.2MB

    • memory/1972-379-0x00000000033F0000-0x0000000003530000-memory.dmp

      Filesize

      1.2MB

    • memory/1972-378-0x00000000033F0000-0x0000000003530000-memory.dmp

      Filesize

      1.2MB

    • memory/1972-376-0x00000000033F0000-0x0000000003530000-memory.dmp

      Filesize

      1.2MB

    • memory/1972-377-0x0000000003550000-0x0000000003551000-memory.dmp

      Filesize

      4KB

    • memory/1972-374-0x0000000003540000-0x0000000003541000-memory.dmp

      Filesize

      4KB

    • memory/1972-375-0x00000000033F0000-0x0000000003530000-memory.dmp

      Filesize

      1.2MB

    • memory/1972-373-0x00000000033F0000-0x0000000003530000-memory.dmp

      Filesize

      1.2MB

    • memory/1972-371-0x0000000003530000-0x0000000003531000-memory.dmp

      Filesize

      4KB

    • memory/1972-372-0x00000000033F0000-0x0000000003530000-memory.dmp

      Filesize

      1.2MB

    • memory/1972-434-0x0000000009B10000-0x0000000009B39000-memory.dmp

      Filesize

      164KB

    • memory/1972-369-0x00000000033F0000-0x0000000003530000-memory.dmp

      Filesize

      1.2MB

    • memory/1972-368-0x00000000025E0000-0x00000000025E1000-memory.dmp

      Filesize

      4KB

    • memory/1972-367-0x00000000033F0000-0x0000000003530000-memory.dmp

      Filesize

      1.2MB

    • memory/1972-365-0x00000000025D0000-0x00000000025D1000-memory.dmp

      Filesize

      4KB

    • memory/1972-366-0x00000000033F0000-0x0000000003530000-memory.dmp

      Filesize

      1.2MB

    • memory/1972-420-0x0000000009A90000-0x0000000009B06000-memory.dmp

      Filesize

      472KB

    • memory/1972-363-0x0000000000730000-0x0000000000731000-memory.dmp

      Filesize

      4KB

    • memory/1972-360-0x0000000009730000-0x0000000009955000-memory.dmp

      Filesize

      2.1MB

    • memory/1972-415-0x00000000033F0000-0x0000000003530000-memory.dmp

      Filesize

      1.2MB

    • memory/1972-414-0x00000000033F0000-0x0000000003530000-memory.dmp

      Filesize

      1.2MB

    • memory/1972-413-0x0000000009A80000-0x0000000009A81000-memory.dmp

      Filesize

      4KB

    • memory/1972-412-0x00000000033F0000-0x0000000003530000-memory.dmp

      Filesize

      1.2MB

    • memory/1972-411-0x00000000033F0000-0x0000000003530000-memory.dmp

      Filesize

      1.2MB

    • memory/1972-410-0x0000000009A70000-0x0000000009A71000-memory.dmp

      Filesize

      4KB

    • memory/1972-409-0x00000000033F0000-0x0000000003530000-memory.dmp

      Filesize

      1.2MB

    • memory/1972-408-0x00000000033F0000-0x0000000003530000-memory.dmp

      Filesize

      1.2MB

    • memory/1972-407-0x0000000009A60000-0x0000000009A61000-memory.dmp

      Filesize

      4KB

    • memory/1972-406-0x00000000033F0000-0x0000000003530000-memory.dmp

      Filesize

      1.2MB

    • memory/1972-397-0x00000000033F0000-0x0000000003530000-memory.dmp

      Filesize

      1.2MB

    • memory/1972-399-0x00000000033F0000-0x0000000003530000-memory.dmp

      Filesize

      1.2MB

    • memory/1972-398-0x00000000035C0000-0x00000000035C1000-memory.dmp

      Filesize

      4KB

    • memory/1972-400-0x00000000033F0000-0x0000000003530000-memory.dmp

      Filesize

      1.2MB

    • memory/1972-401-0x00000000035D0000-0x00000000035D1000-memory.dmp

      Filesize

      4KB

    • memory/1972-402-0x00000000033F0000-0x0000000003530000-memory.dmp

      Filesize

      1.2MB

    • memory/1972-403-0x00000000033F0000-0x0000000003530000-memory.dmp

      Filesize

      1.2MB

    • memory/1972-405-0x00000000033F0000-0x0000000003530000-memory.dmp

      Filesize

      1.2MB

    • memory/1972-404-0x00000000035E0000-0x00000000035E1000-memory.dmp

      Filesize

      4KB

    • memory/2332-338-0x0000000000340000-0x000000000038A000-memory.dmp

      Filesize

      296KB

    • memory/2332-339-0x0000000000CE0000-0x0000000000CF0000-memory.dmp

      Filesize

      64KB

    • memory/2332-340-0x000000001B9A0000-0x000000001BE6E000-memory.dmp

      Filesize

      4.8MB

    • memory/2332-341-0x000000001B2D0000-0x000000001B36C000-memory.dmp

      Filesize

      624KB

    • memory/2332-342-0x0000000000CD0000-0x0000000000CD8000-memory.dmp

      Filesize

      32KB

    • memory/2332-343-0x0000000000CE0000-0x0000000000CF0000-memory.dmp

      Filesize

      64KB

    • memory/2332-344-0x000000001F010000-0x000000001F05E000-memory.dmp

      Filesize

      312KB