hxxps://caritasmadrededios[.]org/

Analysis

max time kernel
471s
max time network
445s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
18-07-2023 00:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://caritasmadrededios.org/

Score

8^/10

spyware

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 1 IoCs

pid	Process
3200	Setup_App.exe

Loads dropped DLL 2 IoCs

pid	Process
2376	AppLaunch.exe
2376	AppLaunch.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\taskschd.msc	mmc.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3200 set thread context of 2376	3200	Setup_App.exe	149

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1776	3200	WerFault.exe	147

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AppLaunch.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	AppLaunch.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133341125524384321"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\Local Settings	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3060	chrome.exe
3060	chrome.exe
880	msedge.exe
880	msedge.exe
2008	msedge.exe
2008	msedge.exe
3760	identity_helper.exe
3760	identity_helper.exe
2376	AppLaunch.exe
2376	AppLaunch.exe
2376	AppLaunch.exe
2376	AppLaunch.exe
2376	AppLaunch.exe
2376	AppLaunch.exe
2376	AppLaunch.exe
2376	AppLaunch.exe
2376	AppLaunch.exe
2376	AppLaunch.exe
2376	AppLaunch.exe
2376	AppLaunch.exe
2376	AppLaunch.exe
2376	AppLaunch.exe
2376	AppLaunch.exe
2376	AppLaunch.exe
2376	AppLaunch.exe
2376	AppLaunch.exe
2376	AppLaunch.exe
2376	AppLaunch.exe
2376	AppLaunch.exe
2376	AppLaunch.exe
4476	taskmgr.exe
4476	taskmgr.exe
4476	taskmgr.exe
4476	taskmgr.exe
4476	taskmgr.exe
4476	taskmgr.exe
4476	taskmgr.exe
4476	taskmgr.exe
4476	taskmgr.exe
4476	taskmgr.exe
4476	taskmgr.exe
4476	taskmgr.exe
4476	taskmgr.exe
4476	taskmgr.exe
4476	taskmgr.exe
4476	taskmgr.exe
4476	taskmgr.exe
4476	taskmgr.exe
4476	taskmgr.exe
4476	taskmgr.exe
4476	taskmgr.exe
4476	taskmgr.exe
4476	taskmgr.exe
4476	taskmgr.exe
4476	taskmgr.exe
4476	taskmgr.exe
4476	taskmgr.exe
4476	taskmgr.exe
4476	taskmgr.exe
4476	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
692	mmc.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3892	chrome.exe
Token: SeCreatePagefilePrivilege	3892	chrome.exe
Token: SeShutdownPrivilege	3892	chrome.exe
Token: SeCreatePagefilePrivilege	3892	chrome.exe
Token: SeShutdownPrivilege	3892	chrome.exe
Token: SeCreatePagefilePrivilege	3892	chrome.exe
Token: SeShutdownPrivilege	3892	chrome.exe
Token: SeCreatePagefilePrivilege	3892	chrome.exe
Token: SeShutdownPrivilege	3892	chrome.exe
Token: SeCreatePagefilePrivilege	3892	chrome.exe
Token: SeShutdownPrivilege	3892	chrome.exe
Token: SeCreatePagefilePrivilege	3892	chrome.exe
Token: SeShutdownPrivilege	3892	chrome.exe
Token: SeCreatePagefilePrivilege	3892	chrome.exe
Token: SeShutdownPrivilege	3892	chrome.exe
Token: SeCreatePagefilePrivilege	3892	chrome.exe
Token: SeShutdownPrivilege	3892	chrome.exe
Token: SeCreatePagefilePrivilege	3892	chrome.exe
Token: SeShutdownPrivilege	3892	chrome.exe
Token: SeCreatePagefilePrivilege	3892	chrome.exe
Token: SeShutdownPrivilege	3892	chrome.exe
Token: SeCreatePagefilePrivilege	3892	chrome.exe
Token: SeShutdownPrivilege	3892	chrome.exe
Token: SeCreatePagefilePrivilege	3892	chrome.exe
Token: SeShutdownPrivilege	3892	chrome.exe
Token: SeCreatePagefilePrivilege	3892	chrome.exe
Token: SeShutdownPrivilege	3892	chrome.exe
Token: SeCreatePagefilePrivilege	3892	chrome.exe
Token: SeShutdownPrivilege	3892	chrome.exe
Token: SeCreatePagefilePrivilege	3892	chrome.exe
Token: SeShutdownPrivilege	3892	chrome.exe
Token: SeCreatePagefilePrivilege	3892	chrome.exe
Token: SeShutdownPrivilege	3892	chrome.exe
Token: SeCreatePagefilePrivilege	3892	chrome.exe
Token: SeShutdownPrivilege	3892	chrome.exe
Token: SeCreatePagefilePrivilege	3892	chrome.exe
Token: SeShutdownPrivilege	3892	chrome.exe
Token: SeCreatePagefilePrivilege	3892	chrome.exe
Token: SeShutdownPrivilege	3892	chrome.exe
Token: SeCreatePagefilePrivilege	3892	chrome.exe
Token: SeShutdownPrivilege	3892	chrome.exe
Token: SeCreatePagefilePrivilege	3892	chrome.exe
Token: SeShutdownPrivilege	3892	chrome.exe
Token: SeCreatePagefilePrivilege	3892	chrome.exe
Token: SeShutdownPrivilege	3892	chrome.exe
Token: SeCreatePagefilePrivilege	3892	chrome.exe
Token: SeShutdownPrivilege	3892	chrome.exe
Token: SeCreatePagefilePrivilege	3892	chrome.exe
Token: SeShutdownPrivilege	3892	chrome.exe
Token: SeCreatePagefilePrivilege	3892	chrome.exe
Token: SeShutdownPrivilege	3892	chrome.exe
Token: SeCreatePagefilePrivilege	3892	chrome.exe
Token: SeShutdownPrivilege	3892	chrome.exe
Token: SeCreatePagefilePrivilege	3892	chrome.exe
Token: SeShutdownPrivilege	3892	chrome.exe
Token: SeCreatePagefilePrivilege	3892	chrome.exe
Token: SeShutdownPrivilege	3892	chrome.exe
Token: SeCreatePagefilePrivilege	3892	chrome.exe
Token: SeShutdownPrivilege	3892	chrome.exe
Token: SeCreatePagefilePrivilege	3892	chrome.exe
Token: SeShutdownPrivilege	3892	chrome.exe
Token: SeCreatePagefilePrivilege	3892	chrome.exe
Token: SeShutdownPrivilege	3892	chrome.exe
Token: SeCreatePagefilePrivilege	3892	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
3892	chrome.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
2008	msedge.exe
4476	taskmgr.exe
4476	taskmgr.exe
4476	taskmgr.exe
4476	taskmgr.exe
4476	taskmgr.exe
4476	taskmgr.exe
4476	taskmgr.exe
4476	taskmgr.exe
4476	taskmgr.exe
4476	taskmgr.exe
4476	taskmgr.exe
4476	taskmgr.exe
4476	taskmgr.exe
4476	taskmgr.exe
4476	taskmgr.exe
4476	taskmgr.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
692	mmc.exe
692	mmc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3892 wrote to memory of 332	3892	chrome.exe	59
PID 3892 wrote to memory of 332	3892	chrome.exe	59
PID 3892 wrote to memory of 460	3892	chrome.exe	87
PID 3892 wrote to memory of 460	3892	chrome.exe	87
PID 3892 wrote to memory of 460	3892	chrome.exe	87
PID 3892 wrote to memory of 460	3892	chrome.exe	87
PID 3892 wrote to memory of 460	3892	chrome.exe	87
PID 3892 wrote to memory of 460	3892	chrome.exe	87
PID 3892 wrote to memory of 460	3892	chrome.exe	87
PID 3892 wrote to memory of 460	3892	chrome.exe	87
PID 3892 wrote to memory of 460	3892	chrome.exe	87
PID 3892 wrote to memory of 460	3892	chrome.exe	87
PID 3892 wrote to memory of 460	3892	chrome.exe	87
PID 3892 wrote to memory of 460	3892	chrome.exe	87
PID 3892 wrote to memory of 460	3892	chrome.exe	87
PID 3892 wrote to memory of 460	3892	chrome.exe	87
PID 3892 wrote to memory of 460	3892	chrome.exe	87
PID 3892 wrote to memory of 460	3892	chrome.exe	87
PID 3892 wrote to memory of 460	3892	chrome.exe	87
PID 3892 wrote to memory of 460	3892	chrome.exe	87
PID 3892 wrote to memory of 460	3892	chrome.exe	87
PID 3892 wrote to memory of 460	3892	chrome.exe	87
PID 3892 wrote to memory of 460	3892	chrome.exe	87
PID 3892 wrote to memory of 460	3892	chrome.exe	87
PID 3892 wrote to memory of 460	3892	chrome.exe	87
PID 3892 wrote to memory of 460	3892	chrome.exe	87
PID 3892 wrote to memory of 460	3892	chrome.exe	87
PID 3892 wrote to memory of 460	3892	chrome.exe	87
PID 3892 wrote to memory of 460	3892	chrome.exe	87
PID 3892 wrote to memory of 460	3892	chrome.exe	87
PID 3892 wrote to memory of 460	3892	chrome.exe	87
PID 3892 wrote to memory of 460	3892	chrome.exe	87
PID 3892 wrote to memory of 460	3892	chrome.exe	87
PID 3892 wrote to memory of 460	3892	chrome.exe	87
PID 3892 wrote to memory of 460	3892	chrome.exe	87
PID 3892 wrote to memory of 460	3892	chrome.exe	87
PID 3892 wrote to memory of 460	3892	chrome.exe	87
PID 3892 wrote to memory of 460	3892	chrome.exe	87
PID 3892 wrote to memory of 460	3892	chrome.exe	87
PID 3892 wrote to memory of 460	3892	chrome.exe	87
PID 3892 wrote to memory of 4500	3892	chrome.exe	89
PID 3892 wrote to memory of 4500	3892	chrome.exe	89
PID 3892 wrote to memory of 4780	3892	chrome.exe	90
PID 3892 wrote to memory of 4780	3892	chrome.exe	90
PID 3892 wrote to memory of 4780	3892	chrome.exe	90
PID 3892 wrote to memory of 4780	3892	chrome.exe	90
PID 3892 wrote to memory of 4780	3892	chrome.exe	90
PID 3892 wrote to memory of 4780	3892	chrome.exe	90
PID 3892 wrote to memory of 4780	3892	chrome.exe	90
PID 3892 wrote to memory of 4780	3892	chrome.exe	90
PID 3892 wrote to memory of 4780	3892	chrome.exe	90
PID 3892 wrote to memory of 4780	3892	chrome.exe	90
PID 3892 wrote to memory of 4780	3892	chrome.exe	90
PID 3892 wrote to memory of 4780	3892	chrome.exe	90
PID 3892 wrote to memory of 4780	3892	chrome.exe	90
PID 3892 wrote to memory of 4780	3892	chrome.exe	90
PID 3892 wrote to memory of 4780	3892	chrome.exe	90
PID 3892 wrote to memory of 4780	3892	chrome.exe	90
PID 3892 wrote to memory of 4780	3892	chrome.exe	90
PID 3892 wrote to memory of 4780	3892	chrome.exe	90
PID 3892 wrote to memory of 4780	3892	chrome.exe	90
PID 3892 wrote to memory of 4780	3892	chrome.exe	90
PID 3892 wrote to memory of 4780	3892	chrome.exe	90
PID 3892 wrote to memory of 4780	3892	chrome.exe	90

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://caritasmadrededios.org/
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8ef689758,0x7ff8ef689768,0x7ff8ef689778
  2⤵
  PID:332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1632 --field-trial-handle=1816,i,16556611677976099138,14806346342564920281,131072 /prefetch:2
  2⤵
  PID:460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=1816,i,16556611677976099138,14806346342564920281,131072 /prefetch:8
  2⤵
  PID:4500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2236 --field-trial-handle=1816,i,16556611677976099138,14806346342564920281,131072 /prefetch:8
  2⤵
  PID:4780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3012 --field-trial-handle=1816,i,16556611677976099138,14806346342564920281,131072 /prefetch:1
  2⤵
  PID:2968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2992 --field-trial-handle=1816,i,16556611677976099138,14806346342564920281,131072 /prefetch:1
  2⤵
  PID:3436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5308 --field-trial-handle=1816,i,16556611677976099138,14806346342564920281,131072 /prefetch:8
  2⤵
  PID:1616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5304 --field-trial-handle=1816,i,16556611677976099138,14806346342564920281,131072 /prefetch:8
  2⤵
  PID:2720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5308 --field-trial-handle=1816,i,16556611677976099138,14806346342564920281,131072 /prefetch:8
  2⤵
  PID:972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4928 --field-trial-handle=1816,i,16556611677976099138,14806346342564920281,131072 /prefetch:8
  2⤵
  PID:2572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5196 --field-trial-handle=1816,i,16556611677976099138,14806346342564920281,131072 /prefetch:8
  2⤵
  PID:4304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=1776 --field-trial-handle=1816,i,16556611677976099138,14806346342564920281,131072 /prefetch:1
  2⤵
  PID:432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3096 --field-trial-handle=1816,i,16556611677976099138,14806346342564920281,131072 /prefetch:8
  2⤵
  PID:4108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5468 --field-trial-handle=1816,i,16556611677976099138,14806346342564920281,131072 /prefetch:8
  2⤵
  PID:3296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=212 --field-trial-handle=1816,i,16556611677976099138,14806346342564920281,131072 /prefetch:1
  2⤵
  PID:4704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4632 --field-trial-handle=1816,i,16556611677976099138,14806346342564920281,131072 /prefetch:8
  2⤵
  PID:2564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4892 --field-trial-handle=1816,i,16556611677976099138,14806346342564920281,131072 /prefetch:8
  2⤵
  PID:4196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4632 --field-trial-handle=1816,i,16556611677976099138,14806346342564920281,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3060

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:5008

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4892

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Unlimited_Version\" -spe -an -ai#7zMap25788:96:7zEvent31521
1⤵
PID:3092

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Downloads\Unlimited_Version\LICENSE.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of SendNotifyMessage
PID:2008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff8e0e946f8,0x7ff8e0e94708,0x7ff8e0e94718
  2⤵
  PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,12117525851669859332,10254145314856554820,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
  2⤵
  PID:1244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,12117525851669859332,10254145314856554820,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,12117525851669859332,10254145314856554820,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2932 /prefetch:8
  2⤵
  PID:2796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12117525851669859332,10254145314856554820,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12117525851669859332,10254145314856554820,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,12117525851669859332,10254145314856554820,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5388 /prefetch:8
  2⤵
  PID:2204
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,12117525851669859332,10254145314856554820,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5388 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12117525851669859332,10254145314856554820,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:1
  2⤵
  PID:1844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12117525851669859332,10254145314856554820,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:1
  2⤵
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12117525851669859332,10254145314856554820,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3592 /prefetch:1
  2⤵
  PID:4112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12117525851669859332,10254145314856554820,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:1
  2⤵
  PID:4200

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1768

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4764

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SDRSVC
1⤵
PID:2412

C:\Users\Admin\Downloads\Unlimited_Version\Setup_App.exe
"C:\Users\Admin\Downloads\Unlimited_Version\Setup_App.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3200
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Loads dropped DLL
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:2376
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3200 -s 268
  2⤵
  - Program crash
  PID:1776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3200 -ip 3200
1⤵
PID:2112

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SendNotifyMessage
PID:4476

C:\Windows\system32\mmc.exe
"C:\Windows\system32\mmc.exe" "C:\Windows\system32\taskschd.msc" /s
1⤵
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:692

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\CENTEURO.TXT

Filesize
12KB

MD5
3ea4a9a2765040c721374ccbb8e7bd59

SHA1
bae4c79a9e9c27cbb7308bb364f69566387cce45

SHA256
ae8fdf0311fe249ee1a3e08fe36c394ca2da791c622b665ddebcb623ac248903

SHA512
1a86665a081c73d170ac6ba9a3abfbedecd71557b274d99e254a446e852e6c62cc0bf383eeafbfc1722f63af65b4e4bc73f9e0ebc6fd790317b08ffd488be289

Download Submit
C:\ProgramData\CORPCHAR.TXT

Filesize
18KB

MD5
0fbad8e1c335ac42617936aa6f89ec89

SHA1
02ba453abfbe24b25c35a2d75c6134714b3d7d43

SHA256
83246b8c942cbacf1031445a99e62acbb4733ef4167bebfba2bd852869824eab

SHA512
ab9e0bb4cae4c72cbccf7d061f1f181dc86277e8e59424802422c6641bec864d3e87b2261d56cb7991e3f60c5c6f56a814073f7d180745b8499c05c39f93842a

Download Submit
C:\ProgramData\CP1250.TXT

Filesize
9KB

MD5
3c9476725fbfeeffb9f549d995ee2815

SHA1
8e2502eb4fc5137ae6e776d1f1804a3afb6eae31

SHA256
cf79ba755416ae5628a9dd1f870306b5a45fd6b256efed0c2ac1cc2ccb3307f0

SHA512
ff35c0a6a878c303567d957c0e465cd9bcd0678c1be3953b3438c686b4f739fb6f47a465465119b474d468d46b19397955e688fc2b92f71abbec276be072f5c8

Download Submit
C:\ProgramData\CP1251.TXT

Filesize
9KB

MD5
2926366654dbc6711ee71ba2589161c3

SHA1
455e6e5e78d03349454cb1c6b0175e9bf2b943ce

SHA256
f87ed4480cfddb8f5f6226292338ca407ccc7b1a543f3832f1d20aff6cb72a58

SHA512
a9a69e32a16ecf7de291e4fa00c6cb349048ceb2f4070406c16b050439a4c2420a7da0f1fc9a0b76e21439b8deabcdd2085c3c14411a6032226c74274dd1e49b

Download Submit
C:\ProgramData\CP1252.TXT

Filesize
9KB

MD5
93fb108016f8a1e87e4129b21fe9984b

SHA1
f6d6b1cac29fdffe774e5175cb60970ba373a656

SHA256
fca3ab5882f0a562794f05d7f15a39157c59d7c07fcbac79ab7cf3d12c979541

SHA512
e0679ddb288423557170c09bf6848d6d8d74f9e70bd751131db7bd248446606db856a86af7ac8e3500b2950261de199a5ede444d8bf451ee1ccc6cc854151342

Download Submit
C:\ProgramData\CP1253.TXT

Filesize
8KB

MD5
6b77baac03038b028948d2a667efdaa1

SHA1
6afbc63ab3a2b0bf10cbe802f7633da3e3198417

SHA256
2d36bec3e1ecbf2b6de8a37c98717ae21ca8c5bc0b487556996b3fff2b6f6fd9

SHA512
d7541266b100ac879be8139108344121b10390350b93d26c6f5c5279c18503d7b6829332281a892369de4d578090987d1310201262c181addbc3b9d9495bd209

Download Submit
C:\ProgramData\CP1254.TXT

Filesize
9KB

MD5
65d7c9205e1a1393b8530670add4e596

SHA1
535cada91e5fba038e0fd9f2214f91a83c3be45d

SHA256
32fa83c6f8ad346e66e544640942906e0a91cc0d2075324b7f244695de5740a5

SHA512
95798f9e068a82380bdbdf649a2dd2f7cc72206444de0a7b9ab2de2cbd9938dc0856f2a0faeb29bcc965900448dfb0e7dddef0cc8e1c5711896f1b82d40a3ca1

Download Submit
C:\ProgramData\CP1257.TXT

Filesize
9KB

MD5
002134c7ea7f619246bbf445caad9f08

SHA1
def97351b77ebf6210b6bfb69b8bc3a4f9a64c36

SHA256
7cb16a0b949f8573b06f22f091c44a1ea251cc9904591fceb2743475302c4640

SHA512
95e4620258b0189b993bb56f2219f73d84145bd8e5b45f9ad70899d8da0e742bb3ead8697e5335e4de895bed925f6212d96f813b0ce9383ae42a967cca2730ca

Download Submit
C:\ProgramData\CP1258.TXT

Filesize
9KB

MD5
88e9b5216b90d0332bd2cd4fcee88a22

SHA1
748ec8b8b4427f3b48b23b3b224c1cffea2dd169

SHA256
f53d0ffb7f3c8182794331cfdd2fbcf77ff6dbdb05b415c98cc8d6fc49dce2fb

SHA512
9d5d6e0cf41e9054d3c9253cec0a482dd97e412794523e352c06d39666931b1d8291fef1c5bbef629eb7c1bb53d866fe2eb925cb314026bf027eaabb1208f0bb

Download Submit
C:\ProgramData\CROATIAN.TXT

Filesize
13KB

MD5
5c36e2cba7fdd612c575d50974ef708a

SHA1
b7a92b10de26a0e23434152694302e4867b011dc

SHA256
f353d83def5c9632ffd1925a0f1480e3dc0e00c096aff5680e448cbfd97fad05

SHA512
9a2a71bf2de141f7e0a295ad40824e63b7b18f1d530d90b5edeec78dd23eaab733d40f95ec320ee2c7686a113bee58fb92d48875d347c669c4c82f9ac27af76e

Download Submit
C:\ProgramData\CYRILLIC.TXT

Filesize
13KB

MD5
db4ed5c205fddd693dc9ce69cccad036

SHA1
ffae0be88d51d71fb1e496156564e55f874efad9

SHA256
10738cd5bba3b23c02d3655bf2afdf72daeaaef778cda562c6d10ae8d25ca591

SHA512
0402d575c17d03e7af8bf44f36ead7d4ccd283375b65d94597ed927a3975d5427483c681a2c604b6f61d796e9c92868620594b7661de6321920c23a6ba281c96

Download Submit
C:\ProgramData\GREEK.TXT

Filesize
13KB

MD5
962d73ae58ea74dfa492bda68064f130

SHA1
b3ecd08894988a66c190ab75b88c3cc752aba34f

SHA256
1ce082e86367551b2a21465d1b1c2edc103242f7d565411dcea0762e3dd63aa1

SHA512
5c3c8ee79c6714097b58276905f2532b1d8be07fbe8db129624f130bd6622bba604393673d2932a08df79eea83caeaf2ce157893ede76bef6fc1027573ea8592

Download Submit
C:\ProgramData\ICELAND.TXT

Filesize
13KB

MD5
48f0f1332aca28076f1d479d8a1c0447

SHA1
e19b21754d221f5fa53aecfb01b2578d9974f35d

SHA256
e04b3c96f65a27030b5e4b071d8e61b8ede1d94cf7bf7845262b29be2b7656ac

SHA512
7360aab0683f102420e850e5b0ca7e366f605aec7a3be4305dc0fb27270209a006dc5ae1a28f68a7c4241bd1a674a215ce9c197e25aa3e18744691c1b987abe6

Download Submit
C:\ProgramData\ROMAN.TXT

Filesize
14KB

MD5
94a43862cb0159469484841d8370e552

SHA1
45afc896bb3ef65a7c77550244a52e7212de89ad

SHA256
a58f56f7cf7767658cff9fdfd1ba182cc74a513b3a2b6f34e44625ff811f53dd

SHA512
eb6454659fd8cb0a631875e27bba01023eb3c75740379c2deb514bc08577221a7914f2717f141134aebc596cb4b34a523548a50f3448abede2b87b4ccfcb93d5

Download Submit
C:\ProgramData\ROMANIAN.TXT

Filesize
14KB

MD5
d39f6c0a8cfe6f118ffd105cf44dea90

SHA1
6c0ae83fd83e5b1af2d288b149e0f7907dd378cc

SHA256
ff13110e8b448b033f464184a1a07b4cd32f0f0fea203a4401c284073fffad66

SHA512
75a42575a542e95a9736deac09fe5480a52d514d9b09c2542a9bf7af1de104a3f83b29bf0c317b4d593d572bc1548728f2fb68115ab1506c5784528ae33710ed

Download Submit
C:\ProgramData\SYMBOL.TXT

Filesize
15KB

MD5
46485e1a024abc31e8b9d2b4ca9a3b39

SHA1
57f5f3109969a8dd8e71e1e925dee37f2b61c016

SHA256
c57c451d4a524159bf143573cd0568869c8eed814a999bff7f3e560dabd39f1d

SHA512
fbaff075b556b461ba6dd731ec52dfe9d3a2be202995e8da1d4794aedb812652a198ffcdaa0052c95fa57f94edb5d51342b1a38e10f62a7ca506c41b759195e3

Download Submit
C:\ProgramData\TURKISH.TXT

Filesize
12KB

MD5
6bfac3d4ab3ac941a0b2a29a56de6f64

SHA1
cdc38c3e0de96c3f2b50448cf3dcf42d52e7e243

SHA256
9ecde6f591caed9c2ce4438884da5f22e35fbdbb97e8d80b43129b23a6791891

SHA512
1e2645df84c5392b09e85dac63970ba49dec9dee63c06548f7717fbfca2643646c1668202217ec836a663c4938fa45774d3c7a9a7254b926d75b0a32c90fd3ee

Download Submit
C:\ProgramData\UKRAINE.TXT

Filesize
4KB

MD5
96431211151b2e58c23262cce683e033

SHA1
ff90820ba88a249c4f8bb605d6f9d6cfcb896257

SHA256
98dd24a56e7d0e2bd2fc6a8bf429aa7bd3820b0d2d90456b972914639d2278ed

SHA512
28dcd7c9e41cd378f88a14dafa5ae4cec291206feea3bae7a26c6f5681059ccbbf54a59c075a19f752e48658204c388b4495b707e7249f3622e827c24c83630b

Download Submit
C:\ProgramData\mozglue.dll

Filesize
593KB

MD5
c8fd9be83bc728cc04beffafc2907fe9

SHA1
95ab9f701e0024cedfbd312bcfe4e726744c4f2e

SHA256
ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

SHA512
fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

Download Submit
C:\ProgramData\mozglue.dll

Filesize
593KB

MD5
c8fd9be83bc728cc04beffafc2907fe9

SHA1
95ab9f701e0024cedfbd312bcfe4e726744c4f2e

SHA256
ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

SHA512
fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

Download Submit
C:\ProgramData\nss3.dll

Filesize
2.0MB

MD5
1cc453cdf74f31e4d913ff9c10acdde2

SHA1
6e85eae544d6e965f15fa5c39700fa7202f3aafe

SHA256
ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

SHA512
dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

Download Submit
C:\ProgramData\symbol.txt

Filesize
10KB

MD5
31d752fa13b4d1fc7b7b4747a3f6d3f9

SHA1
eaafd280b2ea187f078674b9a1d5a8206ccf4a13

SHA256
52dbabcdebe38f3e19e9071d6796fe49f1463f03d2d82064aab4a10bfbd4dddf

SHA512
ed402d201b19c9edeeefa17d2f82a480b8d16ce3235668a91bdd0e6f3b59cbb55bc7119a272c34d1c4e88999b6fe08697d65d65e7b4de44c197e57f2ff44f079

Download Submit
C:\ProgramData\zdingbat.txt

Filesize
12KB

MD5
691886379048a5f9065ee903757af29b

SHA1
9f6453e6f027e771602ad98c5379eaa2b2469463

SHA256
e7651bcf12532af30c79c499e7a280ccbcd7f208436999a21b1500b07149bc95

SHA512
e2934bd4f36cc21e1d71c4fcfc3c31d091a54f04762b0cf7b20fd6bf70ce30fd209a406020c82c565005bc0677471eb524b5a537059e29e4231955fc9307216c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
d16af43270706a94836175f39ce7f09d

SHA1
8b9d17ee564b2fa47f923f3fee55df9efd215211

SHA256
c4996f9fa7e889eba3a3e1928a4ce36598f13d90afbe1dca9311f4350e69792e

SHA512
a5ebbd9adbc7f3f8dfac9bca1c941249cc870c7924cf81191978b9ef10cf123ed66d98c2d00ded25665c483e2e01753ce6c78c37eeb6b501979249e8b6ba3d4f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\History

Filesize
148KB

MD5
f2ad0c1c3570ad82853ec28c6f81dc82

SHA1
6c3f770a2a8a2432084f2ed54dc1f89335a43b06

SHA256
e33e3d5a78b8bf91cd4cf2794336f0ae2bb83cb005270e9b7a91b69ea3517c95

SHA512
853b90bbac9dab0e87440ae2af5b259680da9e9ecaed71a5a546abbab84105dfa18ad5b44593b5ab6f8d1fbf3c6267783b6c7a44f99d59260bfcb07d46d2b23f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies

Filesize
20KB

MD5
190d9eeca44ef21271830a635e6b005c

SHA1
de0cfc9da92419771e0802503c97ef738cdca9d3

SHA256
ada59df3073b7045cbf46854425da251397c8fc1b7a0d072466bf94d087b723e

SHA512
c9da67ef0444b541b21b793991535fc58479338316d77c8b9e83ba2d4c1d9590a34344711c6c6c5edd86e896746da6e738847642417069037c91bea6ddf27287

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
9c9644d2f54fbae108d885a7064da27d

SHA1
4c6d5e41c556bf09b357faf9faa3ad5aff236fd4

SHA256
b93db596f1943545366a19b104af5b7e90e218df65b7bd43bb95d49c50a8ae01

SHA512
a3d7d54b72b36256751034f1e9b9be4377ac0b0ba6968c12653d21322b874a89325e98dbd37845637ed837213a31f997aa8db90379a029bf9db19e03db698059

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
fab1bdfe925d4032ad2ee790d7638cb9

SHA1
9a8f307200be6f6489939bb4de34b2476c8364b3

SHA256
76ae13042a22a8ccc51b425281f45a7bce46a16426cb3306943a756ff4a951ce

SHA512
82582bfdd64da747437a890f5ba30b3c067aa5877e8375ca1bff302c4cf2c5de7cd880bd186f833fed5761604ba362f3d5bacdee215b7709c2e9a02c14901e07

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
d41902fb680d9203e75671de498e0253

SHA1
69811ae464a114357d9cc1099a26656c87443968

SHA256
062c935edbd2d0bb60363d1936ac68a74bf60e2b5da9ad682de37248eb408eb4

SHA512
004292ecf0a68b4f60baf37cfb55993fadf40e6216fe1e5dc0f8e677b073802136e86115849b618b7fdf29af96157f4e3b4867ff98dccb14335fa63c2517c609

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
91254015c9b0ea0a6ebfdb6d33bc8229

SHA1
e4bd9a152a30be5db4ff4d16e725e2c5ee282fa3

SHA256
ca3aa9710f942d74ab851019645d3316b37c0c893b911143fb0ba02403351667

SHA512
11ab5c07ff23db24552792baa23f8e0c621ca3cfb0659725c4b9b84ab5d8748b13d4c1e274b3264cad47994e8fcfa8cc5ec54c073c8ce59726d862b47af3d1f0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
707B

MD5
7a68d748c4db2d500c253d0b790a3c93

SHA1
430c37bb29b7984608f10eeec8752588fe59b090

SHA256
65d83fa4da44dbbbab8249032402178bcff47eb531b89120bd59e02c14d81085

SHA512
03fc5a0a7e66ea9c3cc3211ac3d18ddc33db55569ff531e74a25a1811e5f5a7d0c4aa9b87b9e27ea1ae424cf274ce30c2421d1926aa25284c9daf218d8fc66a5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
e49ba3521d198c39433dde0e11ab6ded

SHA1
34ed64ed16542d5c2276c4a98c5222226e75a467

SHA256
c13082970ac92421a699db850876b5f19b2d1f5c0a562066cd22c9c57efdb074

SHA512
029337681734a581e3be21344d2f8c084b059bf2f51a30242aa8e58f009394ba9cf3fc141bbdc2234313b5707bc0449a39d0813ac0213c138322438c3f88d470

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
549870854dbfed0070b7f64c178be581

SHA1
6d1dae07c5b02859f30eaaee6edc2198eb277c49

SHA256
179fcce67a798ad9d21529302a91e47f8829beb9dfcc0a8573e884f2a60a0200

SHA512
585091b6be50ab980f97977a66608eacd9d12b9aaa9558a3bd036d2da16d4c74593ad5c81b3dc6aacf6d6a499d3ece8cb72ec1add53cce607c6c881a26332747

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
421909e8e227cfbba8041cf5e00d2ca8

SHA1
a8aaf2953abb2d6b81767f0386b1ff0d088f8d33

SHA256
d2a60c19f2b41320d4dc347c93a31a4ba6d7a0c2711729668fd34c3cc7655392

SHA512
b892e25df426e534cfda61579b228786e45fbdbadb2c662349f594ccd4cf08cc2034108baf9da454e69760066f295f6e224c2ec67f189adcc4d830177f797642

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
c6676b36d9edd131d23f3c28e4d77aa1

SHA1
6364230ac8f72bd4fc9a7260070fe6045e59a2fc

SHA256
724cee161a7aee72599334c96f3cdab664f96f41fbe339eda0a5d1b8542d05f5

SHA512
c1d98a029acc1706573796e8a6d48518859121bc3b648bacbe6674fcb9812cc2b896c45aaf1f99f546bdd7f61135c852d95aa75bf754111038bb7d781cdd610a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
aab280651ecca39830016f7d4f4ec3a4

SHA1
ccfd4da27f2cb6fd66c51cd2504a2836597d287e

SHA256
d7a08da6e169b249fe1db0f9e37db46d9695281524f82cec6ad5c1c743881393

SHA512
ab5c2bdbc93321e4d2a26984917664d3e8c9ff35f13788e733ee17fdf4794695092e0089f28fb864431691c5034e07cea1bc356736eae8ea090e53b7c4f6e0e0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
a5140f71bf82877032a257d1b29526cb

SHA1
23f2aa8b3162968a67916d6cc1a74aba2006933c

SHA256
b5104bef0233b9cead63d2c0360abe788c2e3dba0aa0d29ca182e2c11db8e0e0

SHA512
63ae8d3b97bc1a2aa7e68dc3d7810c65db13d2ea45199220a0aa75e358cdc7fd7352daa778003f303bb92b6310fb42767ee95b4e9697066301f61441e88ae8aa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
89KB

MD5
b56fcade4c42e633775af63ed36f3409

SHA1
e6d8ab4ef68d364e2ef81bfa037accf8b29c115d

SHA256
b44eda72ef1448ee0a4ba774670146602d4731dcd119a6a8c4c612750614be27

SHA512
5052784e9fb3d613770b2d66f81bb5019fe61bb214eb22b95e170161f49ec44bc38b18bdfc3e57b4d60019dbe836499e8058571d6864c684474653f7d9478e48

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
89KB

MD5
7b250ea53acf2b7abb5221708d3eefb1

SHA1
eff2f100624949fd9e54d3d2705ec41aa245b080

SHA256
8267f65d0fe3f28567fefdd9605ea20cc34ead84ddfe1bdb415bc99287c75c37

SHA512
b1f7270a7aed8c5ca76175702100f8caef85cc33f1ab1c2951ac1e5a8b3cbd73ff1db12c58a3acba708572f342ea4ed44e7fb385a5820c914a422997ade8cb78

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
89KB

MD5
15957bdd3ae584a0c90342f2f3d92505

SHA1
ee909dc68450e392c32514066d4b0ad22b6e8eca

SHA256
dcc46412237bc23b267314de7e9ff9356b8908d8cd7b1ebb6fb527b499b82525

SHA512
4e49e77ae504fce8e41942205c2f111538d413ddbf013ed60561c8a23834fe98f5885e7a05f0508e183357d787861b35c29eb8798a33ecbefa3d3342dd2a9d6e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
89KB

MD5
15957bdd3ae584a0c90342f2f3d92505

SHA1
ee909dc68450e392c32514066d4b0ad22b6e8eca

SHA256
dcc46412237bc23b267314de7e9ff9356b8908d8cd7b1ebb6fb527b499b82525

SHA512
4e49e77ae504fce8e41942205c2f111538d413ddbf013ed60561c8a23834fe98f5885e7a05f0508e183357d787861b35c29eb8798a33ecbefa3d3342dd2a9d6e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
108KB

MD5
cbe6865b5e6cb4434abdcb13a40c56c5

SHA1
9214e28bbd1134c91e07e35d28394982855af4ef

SHA256
5f17c2e9a9cfb6fb93611b24424a3380976f7812cb6858fc611d565661a7fa53

SHA512
53d06001bceda828a4c656c4074b6d92797020385b28b9f3374ade2c6c898185e17f2dd953cc160211f9fbe7f26ddb8157e5b0485581fb0af26c35d49502bb5c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
108KB

MD5
20e47c78416abfb69b9c28906f069f88

SHA1
493c9ca7e0d13db4c7a5ae5b0ddeac1767b5fb88

SHA256
ef67e2ad868d3cd45759b834039d495647063e3a9fdb9ccc459a63e3dfd56422

SHA512
16c1ab1c1488d740b14dec9e49178bb6d50cae5d71474b40b4b684e54b62607ee9383deb777bee8c84382db0c7bebeff16b9f7865a90727b434bac88a7919ae2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
103KB

MD5
336b54a23d593cca0d0a49ac58f2c093

SHA1
181021e42b18b4a1de7707a3a48cdfa183155c4d

SHA256
0bfe1801932d88fb28fee0126b0d7fc1b9339ee89042996e447c968e2edcffa1

SHA512
1c07181443552423da935cd1b8471d6c7a35189d5a32798a5127591858d3a22be2079050b1b905ba9dfc2a9bbd6b97f6e294747a822666626d6b2eb38f0b2b47

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
112KB

MD5
b2be3fc69a762ba4a12c001668acf4e1

SHA1
9b872c86e43a40b4fb33336a1b74ed67bc5c1415

SHA256
d1a88d08eb0997a185b5531990569c6cce26939515ef8105abbb32a729ca6cdc

SHA512
2b1cf3ad525a5a846371cd0c5e431ae1c859e54677c08048bb207880646a5bad996831c3c8be21c0fbe791506de17bc7e7d041e78986726de7e2856447094132

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe581be0.TMP

Filesize
101KB

MD5
d0186501a4fd4179119a45253c2c9c84

SHA1
d35aae2de3241841ec8f97c19ca45a2d71a1f2cf

SHA256
527d6302010094b81b0b6f5d47fc1929ffe3d323e0069f9b087bbacdbc4f874d

SHA512
e454818574575bde77ca5f65318db3d14d447e160f47e4302252fe05d173604accbeabaecad1f7ef20143d6fae864013f10213829b7b6dc65be10e39beba8e77

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fc99b0086d7714fd471ed4acc862ccc0

SHA1
39a3c43c97f778d67413a023d66e8e930d0e2314

SHA256
45ef01f81605bfd96126d5520c5aa0304c7fa7d5fdb3e4d5b2dd2bf84e2afd96

SHA512
c308fa3eda9235d67a506a5f058fefb9a769ec01d7b0d4f5a2397892cc4f8155301c55c1fac23bebacdd087ab3f47f1eacc9ff88eff4115a7d67aa7b1d6581a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

Filesize
124KB

MD5
ebfd752e302a1eb0ba92bad3f3225264

SHA1
0f40640c58d31be63e2bffeeddf3d95394189135

SHA256
803b7b20b8413a73f9483c72404fe25aee30cda0b9c19b510540d2b779601924

SHA512
4ed873c3c9ef40860a8fb2af3c56c6d1b5853c98f23ce022cea0728f9ef1c81ebdad234a3e3e5560a35def0bcb50dbf054919f529c95b6c1266a40c6c3273eda

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
67dae14bac59d1b1be3cb9a9a6e097c3

SHA1
f7ef832ab325ed7dee984d4ee2f8bb2c9094fa30

SHA256
a9bb6f9d2bf2a1d91ea2fae65907fda889f07c1c64e8cfad14fb1a0e02bd02c7

SHA512
e3547e15859de967b7027421a243e403f7d22ef90e6f4da723f6f43b1dc7a667388f8586c1f6bc7e9443726f79861cc40d406e9b8bc221b742d43a254cd53968

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ffe806f6b512c13dae3850b3e343c8c9

SHA1
1ded448403588ae5f92222e1c28c8679e95cf89f

SHA256
6cf046d73cffcaf71a42115367ebafb73223817379f8a204692d9dcdda0efcad

SHA512
fd344dc6d8bf55b7960370b17ee32d09e5196589106bb3577dd46f7200391481b3bd27e4bcaaeb15d9a5e717f59b9012dac84521977203b8717e544acb6d0b4d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
96f00bbd6a174879c58220f95f0115f5

SHA1
d3d7f82b0bf27daf1b3903bfe050c2d05422050f

SHA256
644442e740a8c0bb20f712f6f84f5bf4a81bb29d4e9446b2832ca65618961107

SHA512
e7c5e90eb85aee7b81b9c163f618ad3789a48b256040f6f00eee7fce52c60e1ff491bf0538b9c846fb115b73163710e46a45ce056e3b41ca59d88c421502ccea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
e2cc9499439d68b57f8befb306913d6d

SHA1
86a24bc3a54b892fec2153bc532843c3cac1b394

SHA256
44fc17f453c0575e557ce86355bc935a1cc98d84ab9636a60bcf638c7eadc7e5

SHA512
8482c55d286328024a869dbcdfc5acdf0203b7c05ce3cb252ab6f694a7056590b159d6eb0c2749f7e57bbe814bcbf635ebed0eb32ea199e52a15f76bcd741d35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
df753e485435a5f07d17d4af482ac512

SHA1
1a2072c1f52564e187d8cfc1af142d19eda3f351

SHA256
954efc2a3104056b628ebf51a0c987c8e978b1bb5061305f8de8d0ee15e29e38

SHA512
cf6ab7292b31df15ee7908566d7aa9098b5d15514d817866fcdd352c71356cea52b7dd82f57b98a3c76b09467c08f2f16eedd112a8432bba84f0df3dba9c0c16

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\Downloads\Unlimited_Version (1).zip.crdownload

Filesize
67.0MB

MD5
1a523fc6a50393452dd4cd496272042b

SHA1
b3dfca2e2db12cb732aefa8bd803cbbc3d6158d6

SHA256
3521104e2f4ee64bb24fea5cd327925d8f79620824739968acb0d23400527934

SHA512
4f4db2896e548c6ef52732f2078f29f24c2ddafa8b630ea040ca3b62c36bc729e72803f62470b7f617b8f1524c3b29e887bd25b36f4d9e75f7c4a84bc4abe5cf

Download Submit
C:\Users\Admin\Downloads\Unlimited_Version.zip

Filesize
67.0MB

MD5
1a523fc6a50393452dd4cd496272042b

SHA1
b3dfca2e2db12cb732aefa8bd803cbbc3d6158d6

SHA256
3521104e2f4ee64bb24fea5cd327925d8f79620824739968acb0d23400527934

SHA512
4f4db2896e548c6ef52732f2078f29f24c2ddafa8b630ea040ca3b62c36bc729e72803f62470b7f617b8f1524c3b29e887bd25b36f4d9e75f7c4a84bc4abe5cf

Download Submit
C:\Users\Admin\Downloads\Unlimited_Version\LICENSE.html

Filesize
6.3MB

MD5
6e638956244aaded2c92b77f9d421a81

SHA1
f5269556b6fe04cfca5a1da21af718641708a666

SHA256
652457f1b5ec60a81c8aff095366bcc068402c21eb380ba8286366bc4e9a029e

SHA512
f0e173761a6acd13b6c1b5eb896c361487a770a54f1842ffaa80c8ff780b37a1e801169786776c4afa7d9c75cd968dbaddabff082de55cf75cc4f9d871d08bc1

Download Submit
C:\Users\Admin\Downloads\Unlimited_Version\Setup_App.exe

Filesize
689.6MB

MD5
e48280bcf9e39027758e93407a34da6a

SHA1
018f922611abc5139f3d2b3d41de5d1cb81d9289

SHA256
1fd3d755ab1e2de241ec74a5bea8b3af4868b822200172c7083d1a3aa33c6de1

SHA512
d04dba83140b1939493231f59bf10d5ef0954d2361bdfbfc7d24891f6699566df62647077bd63584f402c6dce510f3682971daef6bbfad2568827523fd48fe42

Download Submit
C:\Users\Admin\Downloads\Unlimited_Version\Setup_App.exe

Filesize
689.6MB

MD5
e48280bcf9e39027758e93407a34da6a

SHA1
018f922611abc5139f3d2b3d41de5d1cb81d9289

SHA256
1fd3d755ab1e2de241ec74a5bea8b3af4868b822200172c7083d1a3aa33c6de1

SHA512
d04dba83140b1939493231f59bf10d5ef0954d2361bdfbfc7d24891f6699566df62647077bd63584f402c6dce510f3682971daef6bbfad2568827523fd48fe42

Download Submit
C:\Users\Admin\Downloads\Unlimited_Version\locales\Resource\TypeSupport\Unicode\Mappings\Adobe\symbol.txt

Filesize
10KB

MD5
31d752fa13b4d1fc7b7b4747a3f6d3f9

SHA1
eaafd280b2ea187f078674b9a1d5a8206ccf4a13

SHA256
52dbabcdebe38f3e19e9071d6796fe49f1463f03d2d82064aab4a10bfbd4dddf

SHA512
ed402d201b19c9edeeefa17d2f82a480b8d16ce3235668a91bdd0e6f3b59cbb55bc7119a272c34d1c4e88999b6fe08697d65d65e7b4de44c197e57f2ff44f079

Download Submit
C:\Users\Admin\Downloads\Unlimited_Version\locales\Resource\TypeSupport\Unicode\Mappings\Adobe\zdingbat.txt

Filesize
12KB

MD5
691886379048a5f9065ee903757af29b

SHA1
9f6453e6f027e771602ad98c5379eaa2b2469463

SHA256
e7651bcf12532af30c79c499e7a280ccbcd7f208436999a21b1500b07149bc95

SHA512
e2934bd4f36cc21e1d71c4fcfc3c31d091a54f04762b0cf7b20fd6bf70ce30fd209a406020c82c565005bc0677471eb524b5a537059e29e4231955fc9307216c

Download Submit
C:\Users\Admin\Downloads\Unlimited_Version\locales\Resource\TypeSupport\Unicode\Mappings\Mac\CENTEURO.TXT

Filesize
12KB

MD5
3ea4a9a2765040c721374ccbb8e7bd59

SHA1
bae4c79a9e9c27cbb7308bb364f69566387cce45

SHA256
ae8fdf0311fe249ee1a3e08fe36c394ca2da791c622b665ddebcb623ac248903

SHA512
1a86665a081c73d170ac6ba9a3abfbedecd71557b274d99e254a446e852e6c62cc0bf383eeafbfc1722f63af65b4e4bc73f9e0ebc6fd790317b08ffd488be289

Download Submit
C:\Users\Admin\Downloads\Unlimited_Version\locales\Resource\TypeSupport\Unicode\Mappings\Mac\CORPCHAR.TXT

Filesize
18KB

MD5
0fbad8e1c335ac42617936aa6f89ec89

SHA1
02ba453abfbe24b25c35a2d75c6134714b3d7d43

SHA256
83246b8c942cbacf1031445a99e62acbb4733ef4167bebfba2bd852869824eab

SHA512
ab9e0bb4cae4c72cbccf7d061f1f181dc86277e8e59424802422c6641bec864d3e87b2261d56cb7991e3f60c5c6f56a814073f7d180745b8499c05c39f93842a

Download Submit
C:\Users\Admin\Downloads\Unlimited_Version\locales\Resource\TypeSupport\Unicode\Mappings\Mac\CROATIAN.TXT

Filesize
13KB

MD5
5c36e2cba7fdd612c575d50974ef708a

SHA1
b7a92b10de26a0e23434152694302e4867b011dc

SHA256
f353d83def5c9632ffd1925a0f1480e3dc0e00c096aff5680e448cbfd97fad05

SHA512
9a2a71bf2de141f7e0a295ad40824e63b7b18f1d530d90b5edeec78dd23eaab733d40f95ec320ee2c7686a113bee58fb92d48875d347c669c4c82f9ac27af76e

Download Submit
C:\Users\Admin\Downloads\Unlimited_Version\locales\Resource\TypeSupport\Unicode\Mappings\Mac\CYRILLIC.TXT

Filesize
13KB

MD5
db4ed5c205fddd693dc9ce69cccad036

SHA1
ffae0be88d51d71fb1e496156564e55f874efad9

SHA256
10738cd5bba3b23c02d3655bf2afdf72daeaaef778cda562c6d10ae8d25ca591

SHA512
0402d575c17d03e7af8bf44f36ead7d4ccd283375b65d94597ed927a3975d5427483c681a2c604b6f61d796e9c92868620594b7661de6321920c23a6ba281c96

Download Submit
C:\Users\Admin\Downloads\Unlimited_Version\locales\Resource\TypeSupport\Unicode\Mappings\Mac\GREEK.TXT

Filesize
13KB

MD5
962d73ae58ea74dfa492bda68064f130

SHA1
b3ecd08894988a66c190ab75b88c3cc752aba34f

SHA256
1ce082e86367551b2a21465d1b1c2edc103242f7d565411dcea0762e3dd63aa1

SHA512
5c3c8ee79c6714097b58276905f2532b1d8be07fbe8db129624f130bd6622bba604393673d2932a08df79eea83caeaf2ce157893ede76bef6fc1027573ea8592

Download Submit
C:\Users\Admin\Downloads\Unlimited_Version\locales\Resource\TypeSupport\Unicode\Mappings\Mac\ICELAND.TXT

Filesize
13KB

MD5
48f0f1332aca28076f1d479d8a1c0447

SHA1
e19b21754d221f5fa53aecfb01b2578d9974f35d

SHA256
e04b3c96f65a27030b5e4b071d8e61b8ede1d94cf7bf7845262b29be2b7656ac

SHA512
7360aab0683f102420e850e5b0ca7e366f605aec7a3be4305dc0fb27270209a006dc5ae1a28f68a7c4241bd1a674a215ce9c197e25aa3e18744691c1b987abe6

Download Submit
C:\Users\Admin\Downloads\Unlimited_Version\locales\Resource\TypeSupport\Unicode\Mappings\Mac\ROMAN.TXT

Filesize
14KB

MD5
94a43862cb0159469484841d8370e552

SHA1
45afc896bb3ef65a7c77550244a52e7212de89ad

SHA256
a58f56f7cf7767658cff9fdfd1ba182cc74a513b3a2b6f34e44625ff811f53dd

SHA512
eb6454659fd8cb0a631875e27bba01023eb3c75740379c2deb514bc08577221a7914f2717f141134aebc596cb4b34a523548a50f3448abede2b87b4ccfcb93d5

Download Submit
C:\Users\Admin\Downloads\Unlimited_Version\locales\Resource\TypeSupport\Unicode\Mappings\Mac\ROMANIAN.TXT

Filesize
14KB

MD5
d39f6c0a8cfe6f118ffd105cf44dea90

SHA1
6c0ae83fd83e5b1af2d288b149e0f7907dd378cc

SHA256
ff13110e8b448b033f464184a1a07b4cd32f0f0fea203a4401c284073fffad66

SHA512
75a42575a542e95a9736deac09fe5480a52d514d9b09c2542a9bf7af1de104a3f83b29bf0c317b4d593d572bc1548728f2fb68115ab1506c5784528ae33710ed

Download Submit
C:\Users\Admin\Downloads\Unlimited_Version\locales\Resource\TypeSupport\Unicode\Mappings\Mac\SYMBOL.TXT

Filesize
15KB

MD5
46485e1a024abc31e8b9d2b4ca9a3b39

SHA1
57f5f3109969a8dd8e71e1e925dee37f2b61c016

SHA256
c57c451d4a524159bf143573cd0568869c8eed814a999bff7f3e560dabd39f1d

SHA512
fbaff075b556b461ba6dd731ec52dfe9d3a2be202995e8da1d4794aedb812652a198ffcdaa0052c95fa57f94edb5d51342b1a38e10f62a7ca506c41b759195e3

Download Submit
C:\Users\Admin\Downloads\Unlimited_Version\locales\Resource\TypeSupport\Unicode\Mappings\Mac\TURKISH.TXT

Filesize
12KB

MD5
6bfac3d4ab3ac941a0b2a29a56de6f64

SHA1
cdc38c3e0de96c3f2b50448cf3dcf42d52e7e243

SHA256
9ecde6f591caed9c2ce4438884da5f22e35fbdbb97e8d80b43129b23a6791891

SHA512
1e2645df84c5392b09e85dac63970ba49dec9dee63c06548f7717fbfca2643646c1668202217ec836a663c4938fa45774d3c7a9a7254b926d75b0a32c90fd3ee

Download Submit
C:\Users\Admin\Downloads\Unlimited_Version\locales\Resource\TypeSupport\Unicode\Mappings\Mac\UKRAINE.TXT

Filesize
4KB

MD5
96431211151b2e58c23262cce683e033

SHA1
ff90820ba88a249c4f8bb605d6f9d6cfcb896257

SHA256
98dd24a56e7d0e2bd2fc6a8bf429aa7bd3820b0d2d90456b972914639d2278ed

SHA512
28dcd7c9e41cd378f88a14dafa5ae4cec291206feea3bae7a26c6f5681059ccbbf54a59c075a19f752e48658204c388b4495b707e7249f3622e827c24c83630b

Download Submit
C:\Users\Admin\Downloads\Unlimited_Version\locales\Resource\TypeSupport\Unicode\Mappings\win\CP1250.TXT

Filesize
9KB

MD5
3c9476725fbfeeffb9f549d995ee2815

SHA1
8e2502eb4fc5137ae6e776d1f1804a3afb6eae31

SHA256
cf79ba755416ae5628a9dd1f870306b5a45fd6b256efed0c2ac1cc2ccb3307f0

SHA512
ff35c0a6a878c303567d957c0e465cd9bcd0678c1be3953b3438c686b4f739fb6f47a465465119b474d468d46b19397955e688fc2b92f71abbec276be072f5c8

Download Submit
C:\Users\Admin\Downloads\Unlimited_Version\locales\Resource\TypeSupport\Unicode\Mappings\win\CP1251.TXT

Filesize
9KB

MD5
2926366654dbc6711ee71ba2589161c3

SHA1
455e6e5e78d03349454cb1c6b0175e9bf2b943ce

SHA256
f87ed4480cfddb8f5f6226292338ca407ccc7b1a543f3832f1d20aff6cb72a58

SHA512
a9a69e32a16ecf7de291e4fa00c6cb349048ceb2f4070406c16b050439a4c2420a7da0f1fc9a0b76e21439b8deabcdd2085c3c14411a6032226c74274dd1e49b

Download Submit
C:\Users\Admin\Downloads\Unlimited_Version\locales\Resource\TypeSupport\Unicode\Mappings\win\CP1252.TXT

Filesize
9KB

MD5
93fb108016f8a1e87e4129b21fe9984b

SHA1
f6d6b1cac29fdffe774e5175cb60970ba373a656

SHA256
fca3ab5882f0a562794f05d7f15a39157c59d7c07fcbac79ab7cf3d12c979541

SHA512
e0679ddb288423557170c09bf6848d6d8d74f9e70bd751131db7bd248446606db856a86af7ac8e3500b2950261de199a5ede444d8bf451ee1ccc6cc854151342

Download Submit
C:\Users\Admin\Downloads\Unlimited_Version\locales\Resource\TypeSupport\Unicode\Mappings\win\CP1253.TXT

Filesize
8KB

MD5
6b77baac03038b028948d2a667efdaa1

SHA1
6afbc63ab3a2b0bf10cbe802f7633da3e3198417

SHA256
2d36bec3e1ecbf2b6de8a37c98717ae21ca8c5bc0b487556996b3fff2b6f6fd9

SHA512
d7541266b100ac879be8139108344121b10390350b93d26c6f5c5279c18503d7b6829332281a892369de4d578090987d1310201262c181addbc3b9d9495bd209

Download Submit
C:\Users\Admin\Downloads\Unlimited_Version\locales\Resource\TypeSupport\Unicode\Mappings\win\CP1254.TXT

Filesize
9KB

MD5
65d7c9205e1a1393b8530670add4e596

SHA1
535cada91e5fba038e0fd9f2214f91a83c3be45d

SHA256
32fa83c6f8ad346e66e544640942906e0a91cc0d2075324b7f244695de5740a5

SHA512
95798f9e068a82380bdbdf649a2dd2f7cc72206444de0a7b9ab2de2cbd9938dc0856f2a0faeb29bcc965900448dfb0e7dddef0cc8e1c5711896f1b82d40a3ca1

Download Submit
C:\Users\Admin\Downloads\Unlimited_Version\locales\Resource\TypeSupport\Unicode\Mappings\win\CP1257.TXT

Filesize
9KB

MD5
002134c7ea7f619246bbf445caad9f08

SHA1
def97351b77ebf6210b6bfb69b8bc3a4f9a64c36

SHA256
7cb16a0b949f8573b06f22f091c44a1ea251cc9904591fceb2743475302c4640

SHA512
95e4620258b0189b993bb56f2219f73d84145bd8e5b45f9ad70899d8da0e742bb3ead8697e5335e4de895bed925f6212d96f813b0ce9383ae42a967cca2730ca

Download Submit
C:\Users\Admin\Downloads\Unlimited_Version\locales\Resource\TypeSupport\Unicode\Mappings\win\CP1258.TXT

Filesize
9KB

MD5
88e9b5216b90d0332bd2cd4fcee88a22

SHA1
748ec8b8b4427f3b48b23b3b224c1cffea2dd169

SHA256
f53d0ffb7f3c8182794331cfdd2fbcf77ff6dbdb05b415c98cc8d6fc49dce2fb

SHA512
9d5d6e0cf41e9054d3c9253cec0a482dd97e412794523e352c06d39666931b1d8291fef1c5bbef629eb7c1bb53d866fe2eb925cb314026bf027eaabb1208f0bb

Download Submit
C:\Users\Admin\Downloads\Unlimited_Version\locales\resources\Data\level4.resS

Filesize
128KB

MD5
64d183ad524dfcd10a7c816fbca3333d

SHA1
5a180d5c1f42a0deaf475b7390755b3c0ecc951c

SHA256
5a666340f42f0f985772024d90a83d15c9a241a68d58205cd4afbb1a31f1621a

SHA512
3cab59dff09981f49d1070fba06a781439bb1ea2dae0cfcb937d9875bbe9e866be2c951cfc6a3ca4a92aea79dd3e9c4792a765f5a06f230a57dabcab2f0b3c1e

Download Submit
memory/692-1577-0x0000000005040000-0x0000000005050000-memory.dmp

Filesize
64KB

Download
memory/692-1575-0x000000001F280000-0x000000001F380000-memory.dmp

Filesize
1024KB

Download
memory/692-1582-0x00007FF420E40000-0x00007FF420E50000-memory.dmp

Filesize
64KB

Download
memory/692-1578-0x0000000005040000-0x0000000005050000-memory.dmp

Filesize
64KB

Download
memory/692-1580-0x0000000005040000-0x0000000005050000-memory.dmp

Filesize
64KB

Download
memory/692-1579-0x0000000005040000-0x0000000005050000-memory.dmp

Filesize
64KB

Download
memory/692-1581-0x0000000005040000-0x0000000005050000-memory.dmp

Filesize
64KB

Download
memory/692-1570-0x0000000005040000-0x0000000005050000-memory.dmp

Filesize
64KB

Download
memory/692-1576-0x0000000005040000-0x0000000005050000-memory.dmp

Filesize
64KB

Download
memory/692-1585-0x00007FF8DBB50000-0x00007FF8DC611000-memory.dmp

Filesize
10.8MB

Download
memory/692-1574-0x0000000005040000-0x0000000005050000-memory.dmp

Filesize
64KB

Download
memory/692-1573-0x00007FF8DBB50000-0x00007FF8DC611000-memory.dmp

Filesize
10.8MB

Download
memory/692-1572-0x00007FF420E40000-0x00007FF420E50000-memory.dmp

Filesize
64KB

Download
memory/692-1571-0x0000000005040000-0x0000000005050000-memory.dmp

Filesize
64KB

Download
memory/692-1567-0x00007FF8DBB50000-0x00007FF8DC611000-memory.dmp

Filesize
10.8MB

Download
memory/692-1568-0x0000000005040000-0x0000000005050000-memory.dmp

Filesize
64KB

Download
memory/692-1569-0x0000000005040000-0x0000000005050000-memory.dmp

Filesize
64KB

Download
memory/2376-1343-0x0000000000400000-0x000000000062D000-memory.dmp

Filesize
2.2MB

Download
memory/2376-1350-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Filesize
972KB

Download
memory/2376-1349-0x0000000000400000-0x000000000062D000-memory.dmp

Filesize
2.2MB

Download
memory/3200-1342-0x0000000000B80000-0x0000000000E7A000-memory.dmp

Filesize
3.0MB

Download
memory/4476-1561-0x00000224D0030000-0x00000224D0031000-memory.dmp

Filesize
4KB

Download
memory/4476-1563-0x00000224D0030000-0x00000224D0031000-memory.dmp

Filesize
4KB

Download
memory/4476-1560-0x00000224D0030000-0x00000224D0031000-memory.dmp

Filesize
4KB

Download
memory/4476-1566-0x00000224D0030000-0x00000224D0031000-memory.dmp

Filesize
4KB

Download
memory/4476-1556-0x00000224D0030000-0x00000224D0031000-memory.dmp

Filesize
4KB

Download
memory/4476-1555-0x00000224D0030000-0x00000224D0031000-memory.dmp

Filesize
4KB

Download
memory/4476-1554-0x00000224D0030000-0x00000224D0031000-memory.dmp

Filesize
4KB

Download
memory/4476-1562-0x00000224D0030000-0x00000224D0031000-memory.dmp

Filesize
4KB

Download
memory/4476-1564-0x00000224D0030000-0x00000224D0031000-memory.dmp

Filesize
4KB

Download
memory/4476-1565-0x00000224D0030000-0x00000224D0031000-memory.dmp

Filesize
4KB

Download