vidar | 08d20e9870aa598bfb01836af105778d40c41da7a421046b28b474bfa720dc2f

Resubmissions

10-02-2024 08:04

240210-jyhq1ahe5w 10

08-02-2024 12:04

240208-n8ngfsee49 10

08-02-2024 11:55

240208-n3qpmaee28 10

Analysis

max time kernel
582s
max time network
588s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
10-02-2024 08:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

W.exe
Size

15.4MB
MD5

10a8d72bff104e8c01501c8efecc615b
SHA1

36a8ec8597731f51d3a51fc50c123fc84e9af979
SHA256

08d20e9870aa598bfb01836af105778d40c41da7a421046b28b474bfa720dc2f
SHA512

01361f9e85378281b3637218104d222cf672fb91a6a52ed5e9d2b44148cf9e2cab000f45670a59b8acb5ab55e3ad707a116f64652f20b7b35fb34594a6c49a70
SSDEEP

393216:4u7L/sQxSdQuslQq99oWOv+9rztzMK9x:4CL0QQdQuSDorvSr5zV7

Score

10^/10

vidar 22f834b36c39209a5fa9900aee4897e0 spyware stealer

Malware Config

Extracted

Family

vidar

Version

7.7

Botnet

22f834b36c39209a5fa9900aee4897e0

https://t.me/newagev

https://steamcommunity.com/profiles/76561199631487327

Attributes

profile_id_v2
22f834b36c39209a5fa9900aee4897e0

Signatures

Detect Vidar Stealer 3 IoCs

stealer

resource	yara_rule
behavioral1/memory/4800-1454-0x0000000000400000-0x0000000000644000-memory.dmp	family_vidar_v7
behavioral1/memory/4800-1457-0x0000000000400000-0x0000000000644000-memory.dmp	family_vidar_v7
behavioral1/memory/4800-1462-0x0000000000400000-0x0000000000644000-memory.dmp	family_vidar_v7

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\W.exe	W.exe

Executes dropped EXE 3 IoCs

pid	Process
1696	Setup_x64.exe
2304	Setup_x64.exe
4368	Setup_x64.exe

Loads dropped DLL 47 IoCs

pid	Process
2536	W.exe
2536	W.exe
2536	W.exe
2536	W.exe
2536	W.exe
2536	W.exe
2536	W.exe
2536	W.exe
2536	W.exe
2536	W.exe
2536	W.exe
2536	W.exe
2536	W.exe
2536	W.exe
2536	W.exe
2536	W.exe
2536	W.exe
2536	W.exe
2536	W.exe
2536	W.exe
2536	W.exe
2536	W.exe
2536	W.exe
2536	W.exe
2536	W.exe
2536	W.exe
2536	W.exe
2536	W.exe
2536	W.exe
2536	W.exe
2536	W.exe
2536	W.exe
2536	W.exe
2536	W.exe
2536	W.exe
2536	W.exe
2536	W.exe
2536	W.exe
2536	W.exe
2536	W.exe
2536	W.exe
2536	W.exe
2536	W.exe
2536	W.exe
2536	W.exe
2536	W.exe
2536	W.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs

Web Service

T1102

flow	ioc
26	discord.com
34	discord.com
41	discord.com
45	discord.com
218	raw.githubusercontent.com
25	discord.com

Looks up external IP address via web service 5 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
43	api.ipify.org
18	api.ipify.org
20	api.ipify.org
32	api.ipify.org
38	api.ipify.org

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1696 set thread context of 4800	1696	Setup_x64.exe	133
PID 2304 set thread context of 4300	2304	Setup_x64.exe	140

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3128	4800	WerFault.exe	133
2736	4300	WerFault.exe	140

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
2032	tasklist.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133520259209276831"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000_Classes\Local Settings	chrome.exe

Opens file in notepad (likely ransom note) 2 IoCs

ransomware

pid	Process
2636	NOTEPAD.EXE
4792	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3084	taskmgr.exe
3084	taskmgr.exe
3084	taskmgr.exe
3084	taskmgr.exe
3084	taskmgr.exe
3084	taskmgr.exe
3084	taskmgr.exe
3084	taskmgr.exe
3084	taskmgr.exe
3084	taskmgr.exe
3084	taskmgr.exe
3084	taskmgr.exe
3084	taskmgr.exe
3084	taskmgr.exe
3084	taskmgr.exe
3084	taskmgr.exe
1396	chrome.exe
1396	chrome.exe
4672	chrome.exe
4672	chrome.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe
3840	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
3472	7zFM.exe
3840	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2032	tasklist.exe
Token: SeDebugPrivilege	3084	taskmgr.exe
Token: SeSystemProfilePrivilege	3084	taskmgr.exe
Token: SeCreateGlobalPrivilege	3084	taskmgr.exe
Token: 33	3084	taskmgr.exe
Token: SeIncBasePriorityPrivilege	3084	taskmgr.exe
Token: SeShutdownPrivilege	1396	chrome.exe
Token: SeCreatePagefilePrivilege	1396	chrome.exe
Token: SeShutdownPrivilege	1396	chrome.exe
Token: SeCreatePagefilePrivilege	1396	chrome.exe
Token: SeShutdownPrivilege	1396	chrome.exe
Token: SeCreatePagefilePrivilege	1396	chrome.exe
Token: SeShutdownPrivilege	1396	chrome.exe
Token: SeCreatePagefilePrivilege	1396	chrome.exe
Token: SeShutdownPrivilege	1396	chrome.exe
Token: SeCreatePagefilePrivilege	1396	chrome.exe
Token: SeShutdownPrivilege	1396	chrome.exe
Token: SeCreatePagefilePrivilege	1396	chrome.exe
Token: SeShutdownPrivilege	1396	chrome.exe
Token: SeCreatePagefilePrivilege	1396	chrome.exe
Token: SeShutdownPrivilege	1396	chrome.exe
Token: SeCreatePagefilePrivilege	1396	chrome.exe
Token: SeShutdownPrivilege	1396	chrome.exe
Token: SeCreatePagefilePrivilege	1396	chrome.exe
Token: SeShutdownPrivilege	1396	chrome.exe
Token: SeCreatePagefilePrivilege	1396	chrome.exe
Token: SeShutdownPrivilege	1396	chrome.exe
Token: SeCreatePagefilePrivilege	1396	chrome.exe
Token: SeShutdownPrivilege	1396	chrome.exe
Token: SeCreatePagefilePrivilege	1396	chrome.exe
Token: SeShutdownPrivilege	1396	chrome.exe
Token: SeCreatePagefilePrivilege	1396	chrome.exe
Token: SeShutdownPrivilege	1396	chrome.exe
Token: SeCreatePagefilePrivilege	1396	chrome.exe
Token: SeShutdownPrivilege	1396	chrome.exe
Token: SeCreatePagefilePrivilege	1396	chrome.exe
Token: SeShutdownPrivilege	1396	chrome.exe
Token: SeCreatePagefilePrivilege	1396	chrome.exe
Token: SeShutdownPrivilege	1396	chrome.exe
Token: SeCreatePagefilePrivilege	1396	chrome.exe
Token: SeShutdownPrivilege	1396	chrome.exe
Token: SeCreatePagefilePrivilege	1396	chrome.exe
Token: SeShutdownPrivilege	1396	chrome.exe
Token: SeCreatePagefilePrivilege	1396	chrome.exe
Token: SeShutdownPrivilege	1396	chrome.exe
Token: SeCreatePagefilePrivilege	1396	chrome.exe
Token: SeShutdownPrivilege	1396	chrome.exe
Token: SeCreatePagefilePrivilege	1396	chrome.exe
Token: SeShutdownPrivilege	1396	chrome.exe
Token: SeCreatePagefilePrivilege	1396	chrome.exe
Token: SeShutdownPrivilege	1396	chrome.exe
Token: SeCreatePagefilePrivilege	1396	chrome.exe
Token: SeShutdownPrivilege	1396	chrome.exe
Token: SeCreatePagefilePrivilege	1396	chrome.exe
Token: SeShutdownPrivilege	1396	chrome.exe
Token: SeCreatePagefilePrivilege	1396	chrome.exe
Token: SeShutdownPrivilege	1396	chrome.exe
Token: SeCreatePagefilePrivilege	1396	chrome.exe
Token: SeShutdownPrivilege	1396	chrome.exe
Token: SeCreatePagefilePrivilege	1396	chrome.exe
Token: SeShutdownPrivilege	1396	chrome.exe
Token: SeCreatePagefilePrivilege	1396	chrome.exe
Token: SeShutdownPrivilege	1396	chrome.exe
Token: SeCreatePagefilePrivilege	1396	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3084	taskmgr.exe
3084	taskmgr.exe
3084	taskmgr.exe
3084	taskmgr.exe
3084	taskmgr.exe
3084	taskmgr.exe
3084	taskmgr.exe
3084	taskmgr.exe
3084	taskmgr.exe
3084	taskmgr.exe
3084	taskmgr.exe
3084	taskmgr.exe
3084	taskmgr.exe
3084	taskmgr.exe
3084	taskmgr.exe
3084	taskmgr.exe
3084	taskmgr.exe
3084	taskmgr.exe
3084	taskmgr.exe
3084	taskmgr.exe
3084	taskmgr.exe
3084	taskmgr.exe
3084	taskmgr.exe
3084	taskmgr.exe
3084	taskmgr.exe
3084	taskmgr.exe
3084	taskmgr.exe
3084	taskmgr.exe
3084	taskmgr.exe
3084	taskmgr.exe
3084	taskmgr.exe
3084	taskmgr.exe
3084	taskmgr.exe
3084	taskmgr.exe
3084	taskmgr.exe
3084	taskmgr.exe
3084	taskmgr.exe
3084	taskmgr.exe
3084	taskmgr.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3084	taskmgr.exe
3084	taskmgr.exe
3084	taskmgr.exe
3084	taskmgr.exe
3084	taskmgr.exe
3084	taskmgr.exe
3084	taskmgr.exe
3084	taskmgr.exe
3084	taskmgr.exe
3084	taskmgr.exe
3084	taskmgr.exe
3084	taskmgr.exe
3084	taskmgr.exe
3084	taskmgr.exe
3084	taskmgr.exe
3084	taskmgr.exe
3084	taskmgr.exe
3084	taskmgr.exe
3084	taskmgr.exe
3084	taskmgr.exe
3084	taskmgr.exe
3084	taskmgr.exe
3084	taskmgr.exe
3084	taskmgr.exe
3084	taskmgr.exe
3084	taskmgr.exe
3084	taskmgr.exe
3084	taskmgr.exe
3084	taskmgr.exe
3084	taskmgr.exe
3084	taskmgr.exe
3084	taskmgr.exe
3084	taskmgr.exe
3084	taskmgr.exe
3084	taskmgr.exe
3084	taskmgr.exe
3084	taskmgr.exe
3084	taskmgr.exe
3084	taskmgr.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
1396	chrome.exe
3840	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1148 wrote to memory of 2536	1148	W.exe	83
PID 1148 wrote to memory of 2536	1148	W.exe	83
PID 2536 wrote to memory of 1984	2536	W.exe	84
PID 2536 wrote to memory of 1984	2536	W.exe	84
PID 2536 wrote to memory of 2212	2536	W.exe	87
PID 2536 wrote to memory of 2212	2536	W.exe	87
PID 2212 wrote to memory of 2032	2212	cmd.exe	89
PID 2212 wrote to memory of 2032	2212	cmd.exe	89
PID 1396 wrote to memory of 2820	1396	chrome.exe	100
PID 1396 wrote to memory of 2820	1396	chrome.exe	100
PID 1396 wrote to memory of 4028	1396	chrome.exe	103
PID 1396 wrote to memory of 4028	1396	chrome.exe	103
PID 1396 wrote to memory of 4028	1396	chrome.exe	103
PID 1396 wrote to memory of 4028	1396	chrome.exe	103
PID 1396 wrote to memory of 4028	1396	chrome.exe	103
PID 1396 wrote to memory of 4028	1396	chrome.exe	103
PID 1396 wrote to memory of 4028	1396	chrome.exe	103
PID 1396 wrote to memory of 4028	1396	chrome.exe	103
PID 1396 wrote to memory of 4028	1396	chrome.exe	103
PID 1396 wrote to memory of 4028	1396	chrome.exe	103
PID 1396 wrote to memory of 4028	1396	chrome.exe	103
PID 1396 wrote to memory of 4028	1396	chrome.exe	103
PID 1396 wrote to memory of 4028	1396	chrome.exe	103
PID 1396 wrote to memory of 4028	1396	chrome.exe	103
PID 1396 wrote to memory of 4028	1396	chrome.exe	103
PID 1396 wrote to memory of 4028	1396	chrome.exe	103
PID 1396 wrote to memory of 4028	1396	chrome.exe	103
PID 1396 wrote to memory of 4028	1396	chrome.exe	103
PID 1396 wrote to memory of 4028	1396	chrome.exe	103
PID 1396 wrote to memory of 4028	1396	chrome.exe	103
PID 1396 wrote to memory of 4028	1396	chrome.exe	103
PID 1396 wrote to memory of 4028	1396	chrome.exe	103
PID 1396 wrote to memory of 4028	1396	chrome.exe	103
PID 1396 wrote to memory of 4028	1396	chrome.exe	103
PID 1396 wrote to memory of 4028	1396	chrome.exe	103
PID 1396 wrote to memory of 4028	1396	chrome.exe	103
PID 1396 wrote to memory of 4028	1396	chrome.exe	103
PID 1396 wrote to memory of 4028	1396	chrome.exe	103
PID 1396 wrote to memory of 4028	1396	chrome.exe	103
PID 1396 wrote to memory of 4028	1396	chrome.exe	103
PID 1396 wrote to memory of 4028	1396	chrome.exe	103
PID 1396 wrote to memory of 4028	1396	chrome.exe	103
PID 1396 wrote to memory of 4028	1396	chrome.exe	103
PID 1396 wrote to memory of 4028	1396	chrome.exe	103
PID 1396 wrote to memory of 4028	1396	chrome.exe	103
PID 1396 wrote to memory of 4028	1396	chrome.exe	103
PID 1396 wrote to memory of 4028	1396	chrome.exe	103
PID 1396 wrote to memory of 4028	1396	chrome.exe	103
PID 1396 wrote to memory of 5068	1396	chrome.exe	102
PID 1396 wrote to memory of 5068	1396	chrome.exe	102
PID 1396 wrote to memory of 4360	1396	chrome.exe	104
PID 1396 wrote to memory of 4360	1396	chrome.exe	104
PID 1396 wrote to memory of 4360	1396	chrome.exe	104
PID 1396 wrote to memory of 4360	1396	chrome.exe	104
PID 1396 wrote to memory of 4360	1396	chrome.exe	104
PID 1396 wrote to memory of 4360	1396	chrome.exe	104
PID 1396 wrote to memory of 4360	1396	chrome.exe	104
PID 1396 wrote to memory of 4360	1396	chrome.exe	104
PID 1396 wrote to memory of 4360	1396	chrome.exe	104
PID 1396 wrote to memory of 4360	1396	chrome.exe	104
PID 1396 wrote to memory of 4360	1396	chrome.exe	104
PID 1396 wrote to memory of 4360	1396	chrome.exe	104
PID 1396 wrote to memory of 4360	1396	chrome.exe	104
PID 1396 wrote to memory of 4360	1396	chrome.exe	104

C:\Users\Admin\AppData\Local\Temp\W.exe
"C:\Users\Admin\AppData\Local\Temp\W.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1148
- C:\Users\Admin\AppData\Local\Temp\W.exe
  "C:\Users\Admin\AppData\Local\Temp\W.exe"
  2⤵
  - Drops startup file
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2536
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:1984
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2212
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2032

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3084

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffe56dd9758,0x7ffe56dd9768,0x7ffe56dd9778
  2⤵
  PID:2820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1948 --field-trial-handle=2252,i,10670618350334796948,16290728094567500570,131072 /prefetch:8
  2⤵
  PID:5068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1640 --field-trial-handle=2252,i,10670618350334796948,16290728094567500570,131072 /prefetch:2
  2⤵
  PID:4028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2032 --field-trial-handle=2252,i,10670618350334796948,16290728094567500570,131072 /prefetch:8
  2⤵
  PID:4360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3104 --field-trial-handle=2252,i,10670618350334796948,16290728094567500570,131072 /prefetch:1
  2⤵
  PID:2636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3272 --field-trial-handle=2252,i,10670618350334796948,16290728094567500570,131072 /prefetch:1
  2⤵
  PID:4436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4724 --field-trial-handle=2252,i,10670618350334796948,16290728094567500570,131072 /prefetch:1
  2⤵
  PID:3620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5156 --field-trial-handle=2252,i,10670618350334796948,16290728094567500570,131072 /prefetch:8
  2⤵
  PID:784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5296 --field-trial-handle=2252,i,10670618350334796948,16290728094567500570,131072 /prefetch:8
  2⤵
  PID:4528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5388 --field-trial-handle=2252,i,10670618350334796948,16290728094567500570,131072 /prefetch:8
  2⤵
  PID:3664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=1992 --field-trial-handle=2252,i,10670618350334796948,16290728094567500570,131072 /prefetch:1
  2⤵
  PID:3368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5216 --field-trial-handle=2252,i,10670618350334796948,16290728094567500570,131072 /prefetch:8
  2⤵
  PID:4520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5372 --field-trial-handle=2252,i,10670618350334796948,16290728094567500570,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=3432 --field-trial-handle=2252,i,10670618350334796948,16290728094567500570,131072 /prefetch:1
  2⤵
  PID:4692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=5556 --field-trial-handle=2252,i,10670618350334796948,16290728094567500570,131072 /prefetch:1
  2⤵
  PID:2480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=5696 --field-trial-handle=2252,i,10670618350334796948,16290728094567500570,131072 /prefetch:1
  2⤵
  PID:1440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=5728 --field-trial-handle=2252,i,10670618350334796948,16290728094567500570,131072 /prefetch:1
  2⤵
  PID:4796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5916 --field-trial-handle=2252,i,10670618350334796948,16290728094567500570,131072 /prefetch:8
  2⤵
  PID:1460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5136 --field-trial-handle=2252,i,10670618350334796948,16290728094567500570,131072 /prefetch:8
  2⤵
  PID:2832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=3960 --field-trial-handle=2252,i,10670618350334796948,16290728094567500570,131072 /prefetch:1
  2⤵
  PID:4224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=2252,i,10670618350334796948,16290728094567500570,131072 /prefetch:8
  2⤵
  PID:4428
- C:\Program Files\7-Zip\7zFM.exe
  "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\Setup.rar"
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:3472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --mojo-platform-channel-handle=972 --field-trial-handle=2252,i,10670618350334796948,16290728094567500570,131072 /prefetch:1
  2⤵
  PID:1636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=3252 --field-trial-handle=2252,i,10670618350334796948,16290728094567500570,131072 /prefetch:1
  2⤵
  PID:3172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --mojo-platform-channel-handle=5464 --field-trial-handle=2252,i,10670618350334796948,16290728094567500570,131072 /prefetch:1
  2⤵
  PID:1148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --mojo-platform-channel-handle=4564 --field-trial-handle=2252,i,10670618350334796948,16290728094567500570,131072 /prefetch:1
  2⤵
  PID:3076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5720 --field-trial-handle=2252,i,10670618350334796948,16290728094567500570,131072 /prefetch:8
  2⤵
  PID:5100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5228 --field-trial-handle=2252,i,10670618350334796948,16290728094567500570,131072 /prefetch:8
  2⤵
  PID:3132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --mojo-platform-channel-handle=5192 --field-trial-handle=2252,i,10670618350334796948,16290728094567500570,131072 /prefetch:1
  2⤵
  PID:3204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5456 --field-trial-handle=2252,i,10670618350334796948,16290728094567500570,131072 /prefetch:8
  2⤵
  PID:1448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --mojo-platform-channel-handle=5328 --field-trial-handle=2252,i,10670618350334796948,16290728094567500570,131072 /prefetch:1
  2⤵
  PID:2920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6496 --field-trial-handle=2252,i,10670618350334796948,16290728094567500570,131072 /prefetch:8
  2⤵
  PID:4276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2716 --field-trial-handle=2252,i,10670618350334796948,16290728094567500570,131072 /prefetch:8
  2⤵
  PID:460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2644 --field-trial-handle=2252,i,10670618350334796948,16290728094567500570,131072 /prefetch:8
  2⤵
  PID:4368

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:3528

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Readme.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:4792

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Readme.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:2636

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SDRSVC
1⤵
PID:1852

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\" -an -ai#7zMap24819:70:7zEvent29878
1⤵
PID:4968

C:\Users\Admin\Desktop\Setup_x64.exe
"C:\Users\Admin\Desktop\Setup_x64.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1696
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:4800
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4800 -s 2136
    3⤵
    - Program crash
    PID:3128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4800 -ip 4800
1⤵
PID:2032

C:\Users\Admin\Desktop\Setup_x64.exe
"C:\Users\Admin\Desktop\Setup_x64.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2304
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:4300
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4300 -s 2300
    3⤵
    - Program crash
    PID:2736

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SendNotifyMessage
PID:3840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4300 -ip 4300
1⤵
PID:1032

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4652

C:\Users\Admin\Desktop\dnSpy.exe
"C:\Users\Admin\Desktop\dnSpy.exe"
1⤵
PID:1072

C:\Users\Admin\Desktop\Setup_x64.exe
"C:\Users\Admin\Desktop\Setup_x64.exe"
1⤵
- Executes dropped EXE
PID:4368
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:3500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007

Filesize
24KB

MD5
657ed1b9ac0c74717ea560e6c23eae3e

SHA1
6d20c145f3aff13693c61aaac2efbc93066476ef

SHA256
ff95275ab9f5eadda334244325d601245c05592144758c1015d67554af125570

SHA512
60b6682071ade61ae76eed2fe8fa702963c04261bd179c29eed391184d40dc376136d3346b3809b05c44fb59f31b0e9ab95f1e6b19e735234d1f0613720e532f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000008

Filesize
43KB

MD5
8a3cfdb39284f26c5f0ee80a7d5cf713

SHA1
9140f39332a8760ad6f48331d6909d479bb48258

SHA256
f3e29e5d5f77d11693a83c8b82bb05249169720508f8a0e04c66493ed86fb1d3

SHA512
021c181962013f8dd5ea8c938a485a1906304bfddcb7706c005ec8827f9735130ad0102f63888edcc5054b99413c8c2905f6ae5781f51447540fb778f4c047ce

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000009

Filesize
49KB

MD5
4b4947c20d0989be322a003596b94bdc

SHA1
f24db7a83eb52ecbd99c35c2af513e85a5a06dda

SHA256
96f697d16fbe496e4575cd5f655c0edb07b3f737c2f03de8c9dda54e635b3180

SHA512
2a3443e18051b7c830517143482bf6bffd54725935e37ee58d6464fac52d3ce29c6a85fc842b306feaa49e424ba6086942fc3f0fea8bb28e7495070a38ce2e59

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000b

Filesize
15KB

MD5
be8d876a55e539842fc4cf14638d8203

SHA1
02bd347f7ba0a86dbc19d69d072483d1f6c35540

SHA256
9126ae831f3857dea10d75e7d38dfb84e91922714ac40ec437936cf2f2eed621

SHA512
6ceacbe87c3b2e3cbe57c8f6c73bf9defce4abdda46685ee68b14655b2fa6f41d6be0af27dc916b36621bca5ce9707b8609d1e40faab3bf2e447cb26bc604638

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000d

Filesize
25KB

MD5
5c848f21375fca8bdd155347516b2d79

SHA1
f7cbbcbfe3deb43160b60a6a381724d1ad3cce00

SHA256
02f4d8333d1f16ef029c4aa3de40e24972100cfdab823db61a2439378da4804d

SHA512
4c6e175c5a24c12a15337bcb702db15a87aac19f2d3f2cc96be855a756c00b904651ad1472aabf6c669f56c6afa8dada3762febe2c82baaf46782e62b0f042a0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000f

Filesize
65KB

MD5
f5aaaa87cb41b13ccec4d92184bfa559

SHA1
cb32e987ff90712069a093f82b7de5e869f32351

SHA256
864a9d1cae4670d18aba82e93eff0fb8637f7108d7bd15e61a87eadd9b107b4a

SHA512
905ffb3b0817aa8b44a0011e594292a72cf8e1684a4c67364783c3a3e575161c58996e75039ee7f1947a70573b88d7d37933f204f839188e7f09434dabf5786e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000010

Filesize
59KB

MD5
063fe934b18300c766e7279114db4b67

SHA1
d7e71855cf6e8d1e7fbaa763223857f50cd1d4bd

SHA256
8745914e0214bcd9d2e6a841f0679a81084ef3fc3d99125876bee26653f4253e

SHA512
9d0dfc21306b3a56c2ecdf1265392271969e3765e161e117c8765125b34793e24458217cf6514b364f351f47e65baaaf5856be0d13406a789f844d6ba8c7075f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000012

Filesize
153KB

MD5
2f3c7b5f9221520efbdb40dc21658819

SHA1
df12f010d51fe1214d9aca86b0b95fa5832af5fd

SHA256
3ba36c441b5843537507d844eca311044121e3bb7a5a60492a71828c183b9e99

SHA512
d9ed3dccd44e05a7fde2b48c8428057345022a3bcea32b5bdd42b1595e7d6d55f2018a2d444e82380b887726377ab68fa119027c24ac1dadc50d7918cc123d7b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000015

Filesize
18KB

MD5
5d04a5aed02ac5a2f8a4269a6c2570b5

SHA1
727f0be60a1bd0abfe72a018e5741204006d5f03

SHA256
7d8edeba0329989214034e43d9b5c089bb187c2082dd29a811cc766ad998c258

SHA512
88bcd58efd108cacc3818994606e9fd58f0fdf59e4a0beec4be6081f49d0c236c08168ae9a8b975e7a8955068d4fa2765d68506e5a042bf2a962393aedcf1961

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000020

Filesize
194KB

MD5
36104d04a9994182ba78be74c7ac3b0e

SHA1
0c049d44cd22468abb1d0711ec844e68297a7b3d

SHA256
ccde155056cdce86d7e51dfd4e8fb603e8d816224b1257adfcf9503139dd28f1

SHA512
8c115e3e5925fb01efd8dda889f4d5e890f6daaf40b10d5b8e3d9b19e15dadcb9dcf344f40c43f59a1f5428b3ee49e24e492cf0cb6826add1c03d21efdec52ba

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
4d05e23cd519ba9110002e79f1cad99b

SHA1
87158d9e185804e983f66b2d329aab01e1692d09

SHA256
e4261b9a8b212ba7784182612318d6a354cae52d78e4b29aa616b1101fb4c610

SHA512
873f4844802bf986802fda3567c21adcfa105a5e0b7c5912760e309058df37fb15d4133727786f6ee31116ced7364d438a472264d53bba72adcc00c630bcc17a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
6e07caff868783b831e64127365ac1e6

SHA1
abcd0bf7a1bc18a7b680de6f613086d4241aed63

SHA256
047fd8ba6dac15cbf542ee004c30d392f2a9344177b5d83ace168ac565c1c536

SHA512
ada525dfc00840c45d96ef969b452efd711a4986ceb6c01c64640d107cbe7c6cd5b2452b5c77ae936ec413d2dfd56814365b106ec7e7f422dbfc85ae57eb9ee4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
bf34d2a4b154c4c451d7d6cf57f2ad4b

SHA1
42685772e13f239e1e132f0aa0ba84a3ef194bd7

SHA256
b2f89614d5e7b97cc431bd635b4298dee50154ee28d14ec7307e385bd0b9c792

SHA512
b3c87184b184bf46090c2e2bb633d43145b90f6dc5090739b92171ed7484f02fc1ee8a4c9e0bcc8602dbd95053e5a926c85ca00b6834f098e9b24f7c7cb7fae4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
5921eb6d5f1156dbc1748e91bf1eca4a

SHA1
e6f5868ae4503e66703c1fc47bd96ce958d0b07e

SHA256
68f86e206e6cdcb5e40dc7a724f1c7c0f707440e1d6ecaa1f3a8f732d58a5a69

SHA512
8b6207b934dcdd7813dabd6158f7f2029dc342f2bdf0543acfaaf3eef9985c45cdce58de0f63f0b1c3813cbe38b0ae70bf2a5b9dd2d1ecd692687c452aa63eb6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
5KB

MD5
55da90942f232f37ad844957d896b787

SHA1
f4a484b7a7d64f1adfed21b5c80a1ec2cc826a8d

SHA256
17d4b270b02b75125c445b4bf3f95f51a8c5457e11d1e390cef69e3ab67b77c9

SHA512
0bcfe11fe061e5fc1ea4ace2f899edbee2eb1e2967c1c6d44acf062c727ad414437a1c47247032c04c62d732f65fd83989036c318161ed3c270809ba74a5e04e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
5KB

MD5
3a611866b500046696c9a24cfae86609

SHA1
3d49242d7047ca559695870cbe6e58b5ed667ed8

SHA256
a586c8bb14e65601fca70cd9cc4110377c7fb5c81d6e0707fb52993e0fdf3f15

SHA512
e3b7a7db664f3076aa1cf166681be9998abb0d6cf1783fbbbe71740b93b68a9e38bbb40ac5ead09435bf8b24c0243f05cd284bbda76f8d03b7d0dd1a13d215bc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
3a3a8b0f66c959e7dc82d6e959310849

SHA1
18f9b361a17040c957f2c4fd91cde3296e82cefe

SHA256
34fc01a393677d51f79cb1bb890ad35ab72bce1304baf99c46b243c2a1dd6927

SHA512
b2542ae1a2b26a8780e83b6d4b27b47345434549ecdbed901a8c6859b42c238c40c50b969548826ba11feee5b78b60ab1ed7886062620c886ddc2e9d301ff356

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
371B

MD5
18ab33dd46a1fecca90fca2497ce95d0

SHA1
05212064386c16972ffe5a86cce52478708a7de8

SHA256
72e1c356ea506642ec02d374668bf748d5af8edbe6debc1704375997ad293586

SHA512
96fc788eb68b6cc4a2172e536224398b1f2c02381238819c0fe65462c41b71b7fe0d6260782b1cba6409110641e00150f9e7e45616c3efebc9959112cf0a6ee5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
e4f7822755052c4a05ac19ca91f3653d

SHA1
0556d9ffe0d4ed002141addb8b66f8ad2c85d8fc

SHA256
a8cdd919fed8b7c39f2c5b176f71e8d2c81fc5a025e64582e7e780712d02be42

SHA512
43e26194231947236258764f3756d60b99d52069549683c899c30133badb7f851fd13596bba9ae9e7c674f4fbf96cb1331d973426213e7efccd795317a8845f6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
4e3a9f2ad8a3cddf6d9312c6e8aea74c

SHA1
ab9f453598684d412c7c4cba234e2dd370036b55

SHA256
a560e4837affcbcedc788a7f4369b48e14602d1ed4170bc56fbb5d8dc7d904b4

SHA512
9532b52fa8606227f7a09aeaad8d5580861b980716f0d40996d086d5b113f42e924e496e88aa6e6cc193f02ba1bf10c7efc4fe6b40c1ce60d99c0d70cb52668e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
3KB

MD5
7dcaacb68a6df940106358938045c6ea

SHA1
62a9d8cf225926796c262a59d168ca3641691984

SHA256
d90d0a270fc8d6cf74bf80303a6996a7e7a4532d3f795243cd97ade77ed98704

SHA512
586518e4a47b23820d5b11547100bbcc56242cc693a25ff0dc4e0d438d969be18a1f92ec0bf2a244e5484a7faa1bc59a6713c9f609e529ede6850fd4b680fc0e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
4c48338f17e7fd230e06d4f631846e0e

SHA1
59664e60923c6c7a469d8aa1f9865456d2240050

SHA256
b7c03b73cf5edf8dace3cfc34a1dc0d1c6382d7c22eec96d3a8a4732cc92694b

SHA512
7f8d90c4593b865ec65816e3c4e916745fe618b132f53d913be8a8fd3da371cfcc2f5b5f20676adaddd190d3802e605eeeb8d8392c8c62429c98fde7a3d33390

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
adcc9473a409905f9aa1c8a0c2195163

SHA1
4c8dac21c7328baa3073ea1c6d62421b759b9a38

SHA256
8e25e5f01fc645505f961f30a9c1ff065a4ded6aaa7656edec9d14369ddbef21

SHA512
1b41885c49f51a73da67709608906fff665957db9e367ce7f211498061f073e8fe173b5686575caaa080524dbb2893e38e31903c54f4b863c0c8d6b0980524d8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
d2da6479e92d469d6ebf4f086248d64d

SHA1
ff04fd4153be46ac93c416e17aaccdd470c05fdc

SHA256
451a6a5c2a48209255fdb5803fb97385246d72afb1388b9c9761cc96e725f160

SHA512
8ba6e9c9e43fa043544b67c32065269b06a4fcd8d4b084ede3f01a9ba8e9305471159bead11dc3e539823bfd9049833922a9cb068fc22975abbd69e713c1865e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
3KB

MD5
42534577ef0f5bee319be19955634355

SHA1
0979cc7647053c8a0540042b326291138d6f29fa

SHA256
550c94783b03358c363eeca14d18d03314fd187b869a271a709dd214b96a2966

SHA512
fd0a5a83560fd7bc3f98dc071862bdd9956bd78f9912a719d003071150c4a86c5b7308494e45579fc95c39de385474b1402fbdc21da2a6469ee7362d5e76e967

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
7723f895521f9573a9c71ecc09a22df9

SHA1
3f35b4f3e83a11a1a35185454809650a09f66828

SHA256
bc152480bf8f5e66cd02b4f7dd280ea9b3e8e7e0b500a2831f55655642f58fd2

SHA512
281f9d572cfe19476183af8b38412dd911c784a5c12a95d55c3ab698269c77767090685066b93c2f75afba6c9fe894ee0ce7d72147046a7166e17752a6044d6c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
0555197a8de5432cafae48acc9af1502

SHA1
6b015678fa968d64a524f70d469282020e638372

SHA256
348282efed959edb3346aa5d4b6c0d8d904857084482ec4bfc5654448a9a44d0

SHA512
c9522bacc173873c5496f6266b856ee05a23b1efc387eb56df8df076819b3d7214ee81bf66a6b137051b857afe9b0a576f11a1d4eda54ccbccfd78a40ff447b4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
59643244d8fd7fe82277b41a262bd756

SHA1
dce4109edf0d538538700d038d9c31422cac57ea

SHA256
efa4bf7c963dbcc0656c54f0e9a63959750b452da3551151f731e3b382ef709f

SHA512
47b67bff4af461b16fa1a0f844cefd4e0683d0d19f05980d7317b5812c674401513b69fdc4a78a4cf35f369af78deb2e7e59d8e88ea5df81bb5df1e79986852d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
45ca9b859b1b3f26391e962782a32585

SHA1
b4158109c304d49cc510e2c5d929570fb1402717

SHA256
de1969e5d7c4ed0a4af7c5680445b323b61a9908361c27d54aa3318f8b973d39

SHA512
1effec68b581dfe35c9e4f44df8a91f760f497605ae86b6e11dcb29213865ac77b7a098f530fb4967a8f18035faf84d2d0597b11cce6fdab377d2d08e9913664

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
76e1d91814280453731c155c10c9cbbb

SHA1
1f6f864a91023a3422f78c505b59a61e62ce2d10

SHA256
70313a53a64673a68f37cb888022a1a6e6b46475eb511c7c369862dab3831729

SHA512
1321370ce534aebb62f04a5bdf4bc8e08d7c7ee753738edffa8027f3b2b719b42d6daec2945741491975e2a3f21ddc785c73503b62731218748657db77ce1636

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
c9eebfe0a8c4b1a2dd760b8e05a7893e

SHA1
f1dea9e81a61f5942af9e1aa998bd0a065d1ac77

SHA256
9c1a0d419093586a357529002e9e948ff6ce53ba43387bb2d736c5c895e89655

SHA512
9c32d0d7345e219a2ee9cc5a7785d7ddaa1346fc61c2e44a96f7ab813873bbdc4c80505c33a45c5dde7eef1a30b44a248b4d616f3148ebe17bc40aad6bc4aa33

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
149f299daed903270d2dfb8cae609aa9

SHA1
6b1c81dc3481119f431b3c1c62584b84ce5e4938

SHA256
48a2ee27bb166d1edbe2f94f3eb67c4c0ec36a8767a3c59dcfa9d0eebc51098b

SHA512
dc3d9450a6062d94f6c3d8f97a77fec4f3a3bc1ac4e2a07f1099c74cec81b2d704067585615b35ad9f4864581b8eea72cf15bba4d707842ff811078cebfa131b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
38f367ac1fc6600907b4790fc63ef5cb

SHA1
94fbe9054feb1a827f49d3888774f9ee5c698963

SHA256
97036c2e20cac98ec2fafce3d60eedffd8ee0fa29a477d2c6bc8df139bc5f5e3

SHA512
e85cf858d4f139cb6c33e8a2ff87a8b430d7d4dfa6eda6716405d3c93d569e5283a06fb3a698f2b212c88a76900f4b072b288aa9be68e0c58f6b3e3997420634

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
1ac41ea8e73279193239728af9651bfc

SHA1
850e5eb6d6dfc9e44c243566c4e005474091be80

SHA256
3981e237f18b02f9ca1a66e4428e5a3f21290758cfee3d14c30af5986393d0af

SHA512
223d323b9166d7cadf7dc74c090672c2872dcb1a8e7167b8d623eda243863e56510144bc9cabe5be8b9eced4bd67ecf6eba608a5f8782e1be4888776418a827d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
d0db01ac874191036988348a566a28da

SHA1
0c27902893f6bca2799450af85b06dd9486b2077

SHA256
d2623d81744ca6444c7413fba94a1fb06a82906c66c2b0f1c5786b8f0b8b0cb1

SHA512
8fdef55e6b116d08deefefa4250e6828c40ea9a7ea43d9fbd02545683d57dbbebd9d688eb7a71b5cd57f4c0e78542b428576496dcdcb5fa98f401e923d43f0a7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
8c169ab12cbf405c2a6d9aedc2297914

SHA1
025ac0568fb78fc83054d6fdad8adcbb096a5257

SHA256
bef0239457e0af34a2130ba788cff2321d5c4a5d8d6ec6b2586b739fa75dc321

SHA512
2d957c53d6480def35b18be5338e5f91dec7bb2843f9b829e7eb946b9598740468562675de691a6a887cb67911c286dd0677e40db5752683b8165d8b9e23e3ac

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
239KB

MD5
6cd7a4181b4733ddc8ce951243b7cccd

SHA1
40e69a9474af495cb76b8ebf024b6e299a5dfcc2

SHA256
479291365339b00ffce5211e73a69b48a454952cd38ae8b0e0f30cab0d841920

SHA512
5be617f292357a34de58a67ae1eb96e3a44401393a03755f0b1c1d91fe8e4fcc8104da791abb4e58b9fb56579b0bc44b39d1200410a11222771bd926490997f2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
239KB

MD5
c700345ee26af09009e4587a886a016c

SHA1
476bb45b96e07ed4dc053894bbf7814a01c44e92

SHA256
2de241d91b94f175eae04a7f162ba409371d3c473c585ef0660b8659492ea7d7

SHA512
e8ca88694bea7bce5abfad1f3fc962a2b8bb74032a60e2471608a5c710e5cbb114f7f0aff50acebf85be195da015e4fc4662b76d9951857838f2b30b7e3171c9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
239KB

MD5
f393a84e14b118368d372938894c4954

SHA1
2aca07e01a4717d950ad58eab1f1bb3a7dfabb05

SHA256
7122fb403d722f2353c4384fd349490e70ee99f2272ebfe65f5b82f322fa3bc8

SHA512
5a4c370b4ae2b7112f665a25a8e407988b73c75407d7b499e5f0a0fccd56f2b8485ce60cc5b26f77c47e6c5d8b5cfcb4075704d9facce2b69c2451dae39d9632

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
239KB

MD5
c64513dc627ab3e4d5a21d97844f151a

SHA1
c058fe4d2018ce86ffef1246c8926cf29c0b96cd

SHA256
f95f717892db581d3ad6f89692d4831978d2909804a4e5e69123f705aa63b17e

SHA512
38411c04c6f42c937237043007bdfca5b96a0fa505d85c3cdfa8a78dfa68022cc4c4ff169c76eace715b1032f30eb963adc0218f3bf2067c36b61e042c3e4946

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
110KB

MD5
ff39b70e29adcfe747d21c77ce278fa2

SHA1
4339093c06e638c90bca9b121ddb86dc03aefa55

SHA256
1240bb43e6efe4b2d00bcec4dca05767930e7f8d6eee40f68847758041e53793

SHA512
3c7b863d54d03dace7f6c44313f37e24aaac6f9aeba12ac51bb05cc94c308d1736063eed003040f7cd9aa4d67330a93e81a4fcafc2e3f34cf355031f90f28e2e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
103KB

MD5
6439fe59b026400a1cf4cc5330444236

SHA1
438d57b00b6ce8d72e5adcaeb08033fd4eee1426

SHA256
a86e2e51827c999a917a9c0b0c145100ef2072087c1f8e00f1d4cafe2b0d4b1e

SHA512
e6ed6f2f8180173b7d8432a7c65193a07f56fca20660b13639ebb1ab4a12682823a9d6d38f6375712fa79e8b7ce5e72610ff8123775c0a654f1ad57125826f65

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
117KB

MD5
82591acec135f3d71bc9e97b9f181086

SHA1
ab63ec3ebe10509acf49880dda486d36ea4effe8

SHA256
ffc1a5e3ba3a864c2084fc01e6c17afcc5770eee3d3a0f08b6958f45fc33a6f2

SHA512
c917ecfa445b9387c1c2b01e3fdbdc08a8c094e0970181a5560efc91513e2edba6d29d1e9c94890d3b5581277d06c8f513017af6c7d193a29b24744ef3fa105c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
110KB

MD5
273c4c2f10707c608279ccd8246089ec

SHA1
67cd61e6f6f793141643a85db8b206f49f5f8ccd

SHA256
dc4d3872bc4d6fed60fa1b41ea816a42d53ac62a09f215288dbc4f691981fcb6

SHA512
ae50f2381e131e780531f92386c18eb29807b6de170012605bd5243c517a8b0e617750cba837c2b11df8ed85a7497e71549fc8056f935232da7771a07b016786

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
116KB

MD5
0046fba068eddb800ac02c916912f984

SHA1
eaffe87640077cd41b1015225a372b2f1adeae5c

SHA256
60a99d8a9ed66c50bd7de2c44621efeca9eae9cac7442b7320ed7f97a42fcc95

SHA512
aeea645ab18627e4e8b0f45cac61095d47090479d5e4a7edb4c305e9939a9923702028026ee213e7246d044db2278cf749ea41d26ef38fcabcdaf8aba319e80d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe5a2b76.TMP

Filesize
97KB

MD5
55b19e973f8370888267736a1a21b13d

SHA1
9963455b8bb57ee9a774b1d5123bf4f7c728b4ae

SHA256
4dd17bfe61186799295b655d754ac591a21481e3ef8263239fd14c83ff70ddb4

SHA512
83134cfe958f2811e0b780f5ace78b2e9fcecaf16f28a6edf42ea5b46eab8947823333208d3f79d4fceb1fe3371afe08e02f10fe476d8c16abae5a9277b598d7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11482\VCRUNTIME140.dll

Filesize
106KB

MD5
870fea4e961e2fbd00110d3783e529be

SHA1
a948e65c6f73d7da4ffde4e8533c098a00cc7311

SHA256
76fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644

SHA512
0b636a3cdefa343eb4cb228b391bb657b5b4c20df62889cd1be44c7bee94ffad6ec82dc4db79949edef576bff57867e0d084e0a597bf7bf5c8e4ed1268477e88

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11482\VCRUNTIME140_1.dll

Filesize
48KB

MD5
bba9680bc310d8d25e97b12463196c92

SHA1
9a480c0cf9d377a4caedd4ea60e90fa79001f03a

SHA256
e0b66601cc28ecb171c3d4b7ac690c667f47da6b6183bff80604c84c00d265ab

SHA512
1575c786ac3324b17057255488da5f0bc13ad943ac9383656baf98db64d4ec6e453230de4cd26b535ce7e8b7d41a9f2d3f569a0eff5a84aeb1c2f9d6e3429739

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11482\_asyncio.pyd

Filesize
62KB

MD5
4543813a21958d0764975032b09ded7b

SHA1
c571dea89ab89b6aab6da9b88afe78ace90dd882

SHA256
45c229c3988f30580c79b38fc0c19c81e6f7d5778e64cef6ce04dd188a9ccab5

SHA512
3b007ab252cccda210b473ca6e2d4b7fe92c211fb81ade41a5a69c67adde703a9b0bc97990f31dcbe049794c62ba2b70dadf699e83764893a979e95fd6e89d8f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11482\_bz2.pyd

Filesize
81KB

MD5
bbe89cf70b64f38c67b7bf23c0ea8a48

SHA1
44577016e9c7b463a79b966b67c3ecc868957470

SHA256
775fbc6e9a4c7e9710205157350f3d6141b5a9e8f44cb07b3eac38f2789c8723

SHA512
3ee72ba60541116bbca1a62db64074276d40ad8ed7d0ca199a9c51d65c3f0762a8ef6d0e1e9ebf04bf4efe1347f120e4bc3d502dd288339b4df646a59aad0ec1

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11482\_cffi_backend.cp310-win_amd64.pyd

Filesize
177KB

MD5
ebb660902937073ec9695ce08900b13d

SHA1
881537acead160e63fe6ba8f2316a2fbbb5cb311

SHA256
52e5a0c3ca9b0d4fc67243bd8492f5c305ff1653e8d956a2a3d9d36af0a3e4fd

SHA512
19d5000ef6e473d2f533603afe8d50891f81422c59ae03bead580412ec756723dc3379310e20cd0c39e9683ce7c5204791012e1b6b73996ea5cb59e8d371de24

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11482\_ctypes.pyd

Filesize
119KB

MD5
ca4cef051737b0e4e56b7d597238df94

SHA1
583df3f7ecade0252fdff608eb969439956f5c4a

SHA256
e60a2b100c4fa50b0b144cf825fe3cde21a8b7b60b92bfc326cb39573ce96b2b

SHA512
17103d6b5fa84156055e60f9e5756ffc31584cdb6274c686a136291c58ba0be00238d501f8acc1f1ca7e1a1fadcb0c7fefddcb98cedb9dd04325314f7e905df3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11482\_decimal.pyd

Filesize
242KB

MD5
6339fa92584252c3b24e4cce9d73ef50

SHA1
dccda9b641125b16e56c5b1530f3d04e302325cd

SHA256
4ae6f6fb3992bb878416211221b3d62515e994d78f72eab51e0126ca26d0ee96

SHA512
428b62591d4eba3a4e12f7088c990c48e30b6423019bebf8ede3636f6708e1f4151f46d442516d2f96453694ebeef78618c0c8a72e234f679c6e4d52bebc1b84

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11482\_lzma.pyd

Filesize
153KB

MD5
0a94c9f3d7728cf96326db3ab3646d40

SHA1
8081df1dca4a8520604e134672c4be79eb202d14

SHA256
0a70e8546fa6038029f2a3764e721ceebea415818e5f0df6b90d6a40788c3b31

SHA512
6f047f3bdaead121018623f52a35f7e8b38c58d3a9cb672e8056a5274d02395188975de08cabae948e2cc2c1ca01c74ca7bc1b82e2c23d652e952f3745491087

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11482\api-ms-win-core-console-l1-1-0.dll

Filesize
21KB

MD5
40ba4a99bf4911a3bca41f5e3412291f

SHA1
c9a0e81eb698a419169d462bcd04d96eaa21d278

SHA256
af0e561bb3b2a13aa5ca9dfc9bc53c852bad85075261af6ef6825e19e71483a6

SHA512
f11b98ff588c2e8a88fdd61d267aa46dc5240d8e6e2bfeea174231eda3affc90b991ff9aae80f7cea412afc54092de5857159569496d47026f8833757c455c23

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11482\api-ms-win-core-datetime-l1-1-0.dll

Filesize
21KB

MD5
c5e3e5df803c9a6d906f3859355298e1

SHA1
0ecd85619ee5ce0a47ff840652a7c7ef33e73cf4

SHA256
956773a969a6213f4685c21702b9ed5bd984e063cf8188acbb6d55b1d6ccbd4e

SHA512
deedef8eaac9089f0004b6814862371b276fbcc8df45ba7f87324b2354710050d22382c601ef8b4e2c5a26c8318203e589aa4caf05eb2e80e9e8c87fd863dfc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11482\api-ms-win-core-debug-l1-1-0.dll

Filesize
21KB

MD5
71f1d24c7659171eafef4774e5623113

SHA1
8712556b19ed9f80b9d4b6687decfeb671ad3bfe

SHA256
c45034620a5bb4a16e7dd0aff235cc695a5516a4194f4fec608b89eabd63eeef

SHA512
0a14c03365adb96a0ad539f8e8d8333c042668046cea63c0d11c75be0a228646ea5b3fbd6719c29580b8baaeb7a28dc027af3de10082c07e089cdda43d5c467a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11482\api-ms-win-core-errorhandling-l1-1-0.dll

Filesize
21KB

MD5
f1534c43c775d2cceb86f03df4a5657d

SHA1
9ed81e2ad243965e1090523b0c915e1d1d34b9e1

SHA256
6e6bfdc656f0cf22fabba1a25a42b46120b1833d846f2008952fe39fe4e57ab2

SHA512
62919d33c7225b7b7f97faf4a59791f417037704eb970cb1cb8c50610e6b2e86052480cdba771e4fad9d06454c955f83ddb4aea2a057725385460617b48f86a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11482\api-ms-win-core-file-l1-1-0.dll

Filesize
25KB

MD5
ea00855213f278d9804105e5045e2882

SHA1
07c6141e993b21c4aa27a6c2048ba0cff4a75793

SHA256
f2f74a801f05ab014d514f0f1d0b3da50396e6506196d8beccc484cd969621a6

SHA512
b23b78b7bd4138bb213b9a33120854249308bb2cf0d136676174c3d61852a0ac362271a24955939f04813cc228cd75b3e62210382a33444165c6e20b5e0a7f24

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11482\api-ms-win-core-file-l1-2-0.dll

Filesize
21KB

MD5
bcb8b9f6606d4094270b6d9b2ed92139

SHA1
bd55e985db649eadcb444857beed397362a2ba7b

SHA256
fa18d63a117153e2ace5400ed89b0806e96f0627d9db935906be9294a3038118

SHA512
869b2b38fd528b033b3ec17a4144d818e42242b83d7be48e2e6da6992111758b302f48f52e0dd76becb526a90a2b040ce143c6d4f0e009a513017f06b9a8f2b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11482\api-ms-win-core-file-l2-1-0.dll

Filesize
18KB

MD5
bfffa7117fd9b1622c66d949bac3f1d7

SHA1
402b7b8f8dcfd321b1d12fc85a1ee5137a5569b2

SHA256
1ea267a2e6284f17dd548c6f2285e19f7edb15d6e737a55391140ce5cb95225e

SHA512
b319cc7b436b1be165cdf6ffcab8a87fe29de78f7e0b14c8f562be160481fb5483289bd5956fdc1d8660da7a3f86d8eede35c6cc2b7c3d4c852decf4b2dcdb7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11482\api-ms-win-core-handle-l1-1-0.dll

Filesize
21KB

MD5
d584c1e0f0a0b568fce0efd728255515

SHA1
2e5ce6d4655c391f2b2f24fc207fdf0e6cd0cc2a

SHA256
3de40a35254e3e0e0c6db162155d5e79768a6664b33466bf603516f3743efb18

SHA512
c7d1489bf81e552c022493bb5a3cd95ccc81dbedaaa8fdc0048cacbd087913f90b366eeb4bf72bf4a56923541d978b80d7691d96dbbc845625f102c271072c42

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11482\api-ms-win-core-heap-l1-1-0.dll

Filesize
21KB

MD5
6168023bdb7a9ddc69042beecadbe811

SHA1
54ee35abae5173f7dc6dafc143ae329e79ec4b70

SHA256
4ea8399debe9d3ae00559d82bc99e4e26f310934d3fd1d1f61177342cf526062

SHA512
f1016797f42403bb204d4b15d75d25091c5a0ab8389061420e1e126d2214190a08f02e2862a2ae564770397e677b5bcdd2779ab948e6a3e639aa77b94d0b3f6c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11482\api-ms-win-core-interlocked-l1-1-0.dll

Filesize
21KB

MD5
4f631924e3f102301dac36b514be7666

SHA1
b3740a0acdaf3fba60505a135b903e88acb48279

SHA256
e2406077621dce39984da779f4d436c534a31c5e863db1f65de5939d962157af

SHA512
56f9fb629675525cbe84a29d44105b9587a9359663085b62f3fbe3eea66451da829b1b6f888606bc79754b6b814ca4a1b215f04f301efe4db0d969187d6f76f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11482\api-ms-win-core-libraryloader-l1-1-0.dll

Filesize
21KB

MD5
8dfc224c610dd47c6ec95e80068b40c5

SHA1
178356b790759dc9908835e567edfb67420fbaac

SHA256
7b8c7e09030df8cdc899b9162452105f8baeb03ca847e552a57f7c81197762f2

SHA512
fe5be81bfce4a0442dd1901721f36b1e2efcdcee1fdd31d7612ad5676e6c5ae5e23e9a96b2789cb42b7b26e813347f0c02614937c561016f1563f0887e69bbee

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11482\api-ms-win-core-localization-l1-2-0.dll

Filesize
21KB

MD5
20ddf543a1abe7aee845de1ec1d3aa8e

SHA1
0eaf5de57369e1db7f275a2fffd2d2c9e5af65bf

SHA256
d045a72c3e4d21165e9372f76b44ff116446c1e0c221d9cea3ab0a1134a310e8

SHA512
96dd48df315a7eea280ca3da0965a937a649ee77a82a1049e3d09b234439f7d927d7fb749073d7af1b23dadb643978b70dcdadc6c503fe850b512b0c9c1c78dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11482\api-ms-win-core-memory-l1-1-0.dll

Filesize
21KB

MD5
c4098d0e952519161f4fd4846ec2b7fc

SHA1
8138ca7eb3015fc617620f05530e4d939cafbd77

SHA256
51b2103e0576b790d5f5fdacb42af5dac357f1fd37afbaaf4c462241c90694b4

SHA512
95aa4c7071bc3e3fa4db80742f587a0b80a452415c816003e894d2582832cf6eac645a26408145245d4deabe71f00eccf6adb38867206bedd5aa0a6413d241f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11482\api-ms-win-core-namedpipe-l1-1-0.dll

Filesize
21KB

MD5
eaf36a1ead954de087c5aa7ac4b4adad

SHA1
9dd6bc47e60ef90794a57c3a84967b3062f73c3c

SHA256
cdba9dc9af63ebd38301a2e7e52391343efeb54349fc2d9b4ee7b6bf4f9cf6eb

SHA512
1af9e60bf5c186ced5877a7fa690d9690b854faa7e6b87b0365521eafb7497fb7370ac023db344a6a92db2544b5bdc6e2744c03b10c286ebbf4f57c6ca3722cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11482\api-ms-win-core-processenvironment-l1-1-0.dll

Filesize
21KB

MD5
8711e4075fa47880a2cb2bb3013b801a

SHA1
b7ceec13e3d943f26def4c8a93935315c8bb1ac3

SHA256
5bcc3a2d7d651bb1ecc41aa8cd171b5f2b634745e58a8503b702e43aee7cd8c6

SHA512
7370e4acb298b2e690ccd234bd6c95e81a5b870ae225bc0ad8fa80f4473a85e44acc6159502085fe664075afa940cff3de8363304b66a193ac970ced1ba60aae

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11482\api-ms-win-core-processthreads-l1-1-0.dll

Filesize
21KB

MD5
8e6eb11588fa9625b68960a46a9b1391

SHA1
ff81f0b3562e846194d330fadf2ab12872be8245

SHA256
ae56e19da96204e7a9cdc0000f96a7ef15086a9fe1f686687cb2d6fbcb037cd6

SHA512
fdb97d1367852403245fc82cb1467942105e4d9db0de7cf13a73658905139bb9ae961044beb0a0870429a1e26fe00fc922fbd823bd43f30f825863cad2c22cea

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11482\api-ms-win-core-processthreads-l1-1-1.dll

Filesize
21KB

MD5
4380d56a3b83ca19ea269747c9b8302b

SHA1
0c4427f6f0f367d180d37fc10ecbe6534ef6469c

SHA256
a79c7f86462d8ab8a7b73a3f9e469514f57f9fe456326be3727352b092b6b14a

SHA512
1c29c335c55f5f896526c8ee0f7160211fd457c1f1b98915bcc141112f8a730e1a92391ab96688cbb7287e81e6814cc86e3b057e0a6129cbb02892108bfafaf4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11482\api-ms-win-core-profile-l1-1-0.dll

Filesize
21KB

MD5
9082d23943b0aa48d6af804a2f3609a2

SHA1
c11b4e12b743e260e8b3c22c9face83653d02efe

SHA256
7ecc2e3fe61f9166ff53c28d7cb172a243d94c148d3ef13545bc077748f39267

SHA512
88434a2b996ed156d5effbb7960b10401831e9b2c9421a0029d2d8fa651b9411f973e988565221894633e9ffcd6512f687afbb302efe2273d4d1282335ee361d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11482\api-ms-win-core-rtlsupport-l1-1-0.dll

Filesize
21KB

MD5
772f1b596a7338f8ea9ddff9aba9447d

SHA1
cda9f4b9808e9cef2aeac2ac6e7cdf0e8687c4c5

SHA256
cc1bfce8fe6f9973cca15d7dfcf339918538c629e6524f10f1931ae8e1cd63b4

SHA512
8c94890c8f0e0a8e716c777431022c2f77b69ebfaa495d541e2d3312ae1da307361d172efce94590963d17fe3fcac8599dcabe32ab56e01b4d9cf9b4f0478277

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11482\api-ms-win-core-string-l1-1-0.dll

Filesize
21KB

MD5
84b1347e681e7c8883c3dc0069d6d6fa

SHA1
9e62148a2368724ca68dfa5d146a7b95c710c2f2

SHA256
1cb48031891b967e2f93fdd416b0324d481abde3838198e76bc2d0ca99c4fd09

SHA512
093097a49080aec187500e2a9e9c8ccd01f134a3d8dc8ab982e9981b9de400dae657222c20fb250368ecddc73b764b2f4453ab84756b908fcb16df690d3f4479

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11482\api-ms-win-core-synch-l1-1-0.dll

Filesize
21KB

MD5
6ea31229d13a2a4b723d446f4242425b

SHA1
036e888b35281e73b89da1b0807ea8e89b139791

SHA256
8eccaba9321df69182ee3fdb8fc7d0e7615ae9ad3b8ca53806ed47f4867395ae

SHA512
fa834e0e54f65d9a42ad1f4fb1086d26edfa182c069b81cff514feb13cfcb7cb5876508f1289efbc2d413b1047d20bab93ced3e5830bf4a6bb85468decd87cb6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11482\api-ms-win-core-synch-l1-2-0.dll

Filesize
21KB

MD5
dd6f223b4f9b84c6e9b2a7cf49b84fc7

SHA1
2ee75d635d21d628e8083346246709a71b085710

SHA256
8356f71c5526808af2896b2d296ce14e812e4585f4d0c50d7648bc851b598bef

SHA512
9c12912daea5549a3477baa2cd05180702cf24dd185be9f1fca636db6fbd25950c8c2b83f18d093845d9283c982c0255d6402e3cdea0907590838e0acb8cc8c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11482\api-ms-win-core-sysinfo-l1-1-0.dll

Filesize
21KB

MD5
9ca65d4fe9b76374b08c4a0a12db8d2f

SHA1
a8550d6d04da33baa7d88af0b4472ba28e14e0af

SHA256
8a1e56bd740806777bc467579bdc070bcb4d1798df6a2460b9fe36f1592189b8

SHA512
19e0d2065f1ca0142b26b1f5efdd55f874f7dde7b5712dd9dfd4988a24e2fcd20d4934bdda1c2d04b95e253aa1bee7f1e7809672d7825cd741d0f6480787f3b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11482\api-ms-win-core-timezone-l1-1-0.dll

Filesize
21KB

MD5
2554060f26e548a089cab427990aacdf

SHA1
8cc7a44a16d6b0a6b7ed444e68990ff296d712fe

SHA256
5ab003e899270b04abc7f67be953eaccf980d5bbe80904c47f9aaf5d401bb044

SHA512
fd4d5a7fe4da77b0222b040dc38e53f48f7a3379f69e2199639b9f330b2e55939d89ce8361d2135182b607ad75e58ee8e34b90225143927b15dcc116b994c506

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11482\api-ms-win-core-util-l1-1-0.dll

Filesize
21KB

MD5
427f0e19148d98012968564e4b7e622a

SHA1
488873eb98133e20acd106b39f99e3ebdfaca386

SHA256
0cbacaccedaf9b6921e6c1346de4c0b80b4607dacb0f7e306a94c2f15fa6d63d

SHA512
03fa49bdadb65b65efed5c58107912e8d1fccfa13e9adc9df4441e482d4b0edd6fa1bd8c8739ce09654b9d6a176e749a400418f01d83e7ae50fa6114d6aead2b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11482\api-ms-win-crt-conio-l1-1-0.dll

Filesize
21KB

MD5
42ee890e5e916935a0d3b7cdee7147e0

SHA1
d354db0aac3a997b107ec151437ef17589d20ca5

SHA256
91d7a4c39baac78c595fc6cf9fd971aa0a780c297da9a8b20b37b0693bdcd42c

SHA512
4fae6d90d762ed77615d0f87833152d16b2c122964754b486ea90963930e90e83f3467253b7ed90d291a52637374952570bd9036c6b8c9eaebe8b05663ebb08e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11482\api-ms-win-crt-convert-l1-1-0.dll

Filesize
25KB

MD5
33b85a64c4af3a65c4b72c0826668500

SHA1
315ddb7a49283efe7fcae1b51ebd6db77267d8df

SHA256
8b24823407924688ecafc771edd9c58c6dbcc7de252e7ebd20751a5b9dd7abef

SHA512
b3a62cb67c7fe44ca57ac16505a9e9c3712c470130df315b591a9d39b81934209c8b48b66e1e18da4a5323785120af2d9e236f39c9b98448f88adab097bc6651

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11482\api-ms-win-crt-environment-l1-1-0.dll

Filesize
21KB

MD5
f983f25bf0ad58bcfa9f1e8fd8f94fcb

SHA1
27ede57c1a59b64db8b8c3c1b7f758deb07942e8

SHA256
a5c8c787c59d0700b5605925c8c255e5ef7902716c675ec40960640b15ff5aca

SHA512
ac797ff4f49be77803a3fe5097c006bb4806a3f69e234bf8d1440543f945360b19694c8ecf132ccfbd17b788afce816e5866154c357c27dfeb0e97c0a594c166

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11482\api-ms-win-crt-filesystem-l1-1-0.dll

Filesize
21KB

MD5
931246f429565170bb80a1144b42a8c4

SHA1
e544fad20174cf794b51d1194fd780808f105d38

SHA256
a3ba0ee6a4abc082b730c00484d4462d16bc13ee970ee3eee96c34fc9b6ef8ed

SHA512
4d1d811a1e61a8f1798a617200f0a5ffbde9939a0c57b6b3901be9ca8445b2e50fc736f1dce410210965116249d77801940ef65d9440700a6489e1b9a8dc0a39

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11482\api-ms-win-crt-heap-l1-1-0.dll

Filesize
21KB

MD5
546da2b69f039da9da801eb7455f7ab7

SHA1
b8ff34c21862ee79d94841c40538a90953a7413b

SHA256
a93c8af790c37a9b6bac54003040c283bef560266aeec3d2de624730a161c7dc

SHA512
4a3c8055ab832eb84dd2d435f49b5b748b075bbb484248188787009012ee29dc4e04d8fd70110e546ce08d0c4457e96f4368802caee5405cff7746569039a555

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11482\api-ms-win-crt-locale-l1-1-0.dll

Filesize
21KB

MD5
d8302fc8fac16f2afebf571a5ae08a71

SHA1
0c1aee698e2b282c4d19011454da90bb5ab86252

SHA256
b9ae70e8f74615ea2dc6fc74ec8371616e57c8eff8555547e7167bb2db3424f2

SHA512
cd2f4d502cd37152c4b864347fb34bc77509cc9e0e7fe0e0a77624d78cda21f244af683ea8b47453aa0fa6ead2a0b2af4816040d8ea7cdad505f470113322009

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11482\api-ms-win-crt-math-l1-1-0.dll

Filesize
29KB

MD5
e9036fd8b4d476807a22cb2eb4485b8a

SHA1
0e49d745643f6b0a7d15ea12b6a1fe053c829b30

SHA256
bfc8ad242bf673bf9024b5bbe4158ca6a4b7bdb45760ae9d56b52965440501bd

SHA512
f1af074cce2a9c3a92e3a211223e05596506e7874ede5a06c8c580e002439d102397f2446ce12cc69c38d5143091443833820b902bb07d990654ce9d14e0a7f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11482\api-ms-win-crt-multibyte-l1-1-0.dll

Filesize
29KB

MD5
3bbb672a2bf43fc51bedc039f7af0236

SHA1
39ae160a5e668fd08ed52dbebdec2de1de02c48f

SHA256
e5d3f2f18a33d6c296e64bec7161e961f10d2043bbbdc821610429c5684f34c6

SHA512
7c201c547e04c04fe43169fcb075e2e69ef526fb2ee54d08db237309859bbb0f6017b2deaa1ea002df4d78300c1267366987a31f1f6f61b9c7a8ef638d31f8ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11482\api-ms-win-crt-process-l1-1-0.dll

Filesize
21KB

MD5
ad586ea6ac80ac6309421deeea701d2f

SHA1
bc2419dff19a9ab3c555bc00832c7074ec2d9186

SHA256
39e363c47d4d45beda156cb363c5241083b38c395e4be237f3cfeda55176453c

SHA512
15c17cba6e73e2e2adb0e85af8ed3c0b71d37d4613d561ce0e818bdb2ca16862253b3cb291e0cf2475cedcb7ce9f7b4d66752817f61cf11c512869ef8dabc92a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11482\api-ms-win-crt-runtime-l1-1-0.dll

Filesize
25KB

MD5
3ae4741db3ddbcb205c6acbbae234036

SHA1
5026c734dcee219f73d291732722691a02c414f2

SHA256
c26540e3099fa91356ee69f5058cf7b8aee63e23d6b58385476d1883e99033c3

SHA512
9dd5e12265da0f40e3c1432fb25fd19be594684283e961a2eaffd87048d4f892d075dcd049ab08aeee582542e795a0d124b490d321d7beb7963fd778ef209929

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11482\api-ms-win-crt-stdio-l1-1-0.dll

Filesize
25KB

MD5
9a7e2a550c64dabff61dad8d1574c79a

SHA1
8908de9d45f76764140687389bfaed7711855a2d

SHA256
db059947ace80d2c801f684a38d90fd0292bdaa1c124cd76467da7c4329a8a32

SHA512
70a6eb10a3c3bad45ba99803117e589bda741ecbb8bbdd2420a5ae981003aebe21e28cb437c177a3b23f057f299f85af7577fec9693d59a1359e5ffc1e8eaabd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11482\api-ms-win-crt-string-l1-1-0.dll

Filesize
25KB

MD5
cf115db7dcf92a69cb4fd6e2ae42fed5

SHA1
b39aa5eca6be3f90b71dc37a5ecf286e3ddca09a

SHA256
eb8fe2778c54213aa2cc14ab8cec89ebd062e18b3e24968aca57e1f344588e74

SHA512
8abd2754171c90bbd37ca8dfc3db6edaf57ccdd9bc4ce82aef702a5ce8bc9e36b593dc863d9a2abd3b713a2f0693b04e52867b51cd578977a4a9fde175dba97a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11482\api-ms-win-crt-time-l1-1-0.dll

Filesize
21KB

MD5
82e6d4ff7887b58206199e6e4be0feaf

SHA1
943e42c95562682c99a7ed3058ea734e118b0c44

SHA256
fb425bf6d7eb8202acd10f3fbd5d878ab045502b6c928ebf39e691e2b1961454

SHA512
ff774295c68bfa6b3c00a1e05251396406dee1927c16d4e99f4514c15ae674fd7ac5cadfe9bfffef764209c94048b107e70ac7614f6a8db453a9ce03a3db12e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11482\api-ms-win-crt-utility-l1-1-0.dll

Filesize
21KB

MD5
9a3b4e5b18a946d6954f61673576fa11

SHA1
74206258cfd864f08e26ea3081d66297221b1d52

SHA256
ce74a264803d3e5761ed2c364e2196ac1b391cb24029af24aee8ef537ec68738

SHA512
da21178f2e7f4b15c28ae7cb0cc5891eaa3bdd0192042965861c729839983c7dcba9cfb96930b52dbe8a592b4713aa40762e54d846b8135456a09ae5bacbb727

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11482\base_library.zip

Filesize
859KB

MD5
f5b15ac0a24a122d69c41843da5d463b

SHA1
e25772476631d5b6dd278cb646b93abd282c34ed

SHA256
ec3b8c865c6e3c5e35449b32dcb397da665d6a10fbee61284489a6c420c72a3b

SHA512
1704611166d63962e14deb6d519c2a7af4f05bca308c1949652fddf89bc526c594ede43a34b9306e5979998576f448951d08ad9e25b6d749d5d46b7d18d133b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11482\libcrypto-1_1.dll

Filesize
3.3MB

MD5
6f4b8eb45a965372156086201207c81f

SHA1
8278f9539463f0a45009287f0516098cb7a15406

SHA256
976ce72efd0a8aeeb6e21ad441aa9138434314ea07f777432205947cdb149541

SHA512
2c5c54842aba9c82fb9e7594ae9e264ac3cbdc2cc1cd22263e9d77479b93636799d0f28235ac79937070e40b04a097c3ea3b7e0cd4376a95ed8ca90245b7891f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11482\libffi-7.dll

Filesize
32KB

MD5
eef7981412be8ea459064d3090f4b3aa

SHA1
c60da4830ce27afc234b3c3014c583f7f0a5a925

SHA256
f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081

SHA512
dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11482\libssl-1_1.dll

Filesize
686KB

MD5
8769adafca3a6fc6ef26f01fd31afa84

SHA1
38baef74bdd2e941ccd321f91bfd49dacc6a3cb6

SHA256
2aebb73530d21a2273692a5a3d57235b770daf1c35f60c74e01754a5dac05071

SHA512
fac22f1a2ffbfb4789bdeed476c8daf42547d40efe3e11b41fadbc4445bb7ca77675a31b5337df55fdeb4d2739e0fb2cbcac2feabfd4cd48201f8ae50a9bd90b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11482\pyexpat.pyd

Filesize
193KB

MD5
43e5a1470c298ba773ac9fcf5d99e8f9

SHA1
06db03daf3194c9e492b2f406b38ed33a8c87ab3

SHA256
56984d43be27422d31d8ece87d0abda2c0662ea2ff22af755e49e3462a5f8b65

SHA512
a5a1ebb34091ea17c8f0e7748004558d13807fdc16529bc6f8f6c6a3a586ee997bf72333590dc451d78d9812ef8adfa7deabab6c614fce537f56fa38ce669cfc

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11482\python310.dll

Filesize
487KB

MD5
a3e58476f333451eff394c7041d8643c

SHA1
4316cf6f84adac2d39b1c547c5ade46362d73b4c

SHA256
81ef96d286bd482f6e5c654af1fadaaa4e4390f11daecfeb5c91aff6b562f788

SHA512
6d81ea675c7f51d8ea72a445a1cf86c69b1cd62faa988ea12554376369f468b390c05543bf9aa6b383cd5b43c24b0706278fb37a9f0e5d25375fedf9c5f596e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11482\python310.dll

Filesize
4.3MB

MD5
deaf0c0cc3369363b800d2e8e756a402

SHA1
3085778735dd8badad4e39df688139f4eed5f954

SHA256
156cf2b64dd0f4d9bdb346b654a11300d6e9e15a65ef69089923dafc1c71e33d

SHA512
5cac1d92af7ee18425b5ee8e7cd4e941a9ddffb4bc1c12bb8aeabeed09acec1ff0309abc41a2e0c8db101fee40724f8bfb27a78898128f8746c8fe01c1631989

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11482\select.pyd

Filesize
28KB

MD5
c119811a40667dca93dfe6faa418f47a

SHA1
113e792b7dcec4366fc273e80b1fc404c309074c

SHA256
8f27cd8c5071cb740a2191b3c599e99595b121f461988166f07d9f841e7116b7

SHA512
107257dbd8cf2607e4a1c7bef928a6f61ebdfc21be1c4bdc3a649567e067e9bb7ea40c0ac8844d2cedd08682447b963148b52f85adb1837f243df57af94c04b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11482\sqlite3.dll

Filesize
1.4MB

MD5
aaf9fd98bc2161ad7dff996450173a3b

SHA1
ab634c09b60aa18ea165084a042d917b65d1fe85

SHA256
f1e8b6c4d61ac6a320fa2566da9391fbfd65a5ac34ac2e2013bc37c8b7b41592

SHA512
597ffe3c2f0966ab94fbb7ecac27160c691f4a07332311f6a9baf8dec8b16fb16ec64df734c3bdbabf2c0328699e234d14f1b8bd5ac951782d35ea0c78899e5f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11482\ucrtbase.dll

Filesize
992KB

MD5
0e0bac3d1dcc1833eae4e3e4cf83c4ef

SHA1
4189f4459c54e69c6d3155a82524bda7549a75a6

SHA256
8a91052ef261b5fbf3223ae9ce789af73dfe1e9b0ba5bdbc4d564870a24f2bae

SHA512
a45946e3971816f66dd7ea3788aacc384a9e95011500b458212dc104741315b85659e0d56a41570731d338bdf182141c093d3ced222c007038583ceb808e26fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11482\ucrtbase.dll

Filesize
896KB

MD5
cbf1ffcbc3b4f9187c3b4f527c892144

SHA1
85a9c4d2575de1bb9cf334d3365c9d29c8f7a0d8

SHA256
d688a288392305ccf0d6ed2004ce0f82d398cd2c45186abb4976c120391fe56d

SHA512
2c8554f5404876d539303683fc479f74be67779641fd5554ce5144e7958b79e888eaa1e6781c3f9968c4807b8d0231c36732adad3e273c29e299426067297453

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11482\unicodedata.pyd

Filesize
1.1MB

MD5
4c8af8a30813e9380f5f54309325d6b8

SHA1
169a80d8923fb28f89bc26ebf89ffe37f8545c88

SHA256
4b6e3ba734c15ec789b5d7469a5097bd082bdfd8e55e636ded0d097cf6511e05

SHA512
ea127779901b10953a2bf9233e20a4fab2fba6f97d7baf40c1b314b7cd03549e0f4d2fb9bad0fbc23736e21eb391a418d79a51d64402245c1cd8899e4d765c5a

Download Submit
C:\Users\Admin\AppData\Local\Temp\crcook.txt

Filesize
29B

MD5
155ea3c94a04ceab8bd7480f9205257d

SHA1
b46bbbb64b3df5322dd81613e7fa14426816b1c1

SHA256
445e2bcecaa0d8d427b87e17e7e53581d172af1b9674cf1a33dbe1014732108b

SHA512
3d47449da7c91fe279217a946d2f86e5d95d396f53b55607ec8aca7e9aa545cfaf9cb97914b643a5d8a91944570f9237e18eecec0f1526735be6ceee45ecba05

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\Desktop\locales\resources\Data\level4.resS

Filesize
128KB

MD5
64d183ad524dfcd10a7c816fbca3333d

SHA1
5a180d5c1f42a0deaf475b7390755b3c0ecc951c

SHA256
5a666340f42f0f985772024d90a83d15c9a241a68d58205cd4afbb1a31f1621a

SHA512
3cab59dff09981f49d1070fba06a781439bb1ea2dae0cfcb937d9875bbe9e866be2c951cfc6a3ca4a92aea79dd3e9c4792a765f5a06f230a57dabcab2f0b3c1e

Download Submit
memory/1072-2115-0x00007FFE52F50000-0x00007FFE53454000-memory.dmp

Filesize
5.0MB

Download
memory/1072-2112-0x00000239F39E0000-0x00000239F39F0000-memory.dmp

Filesize
64KB

Download
memory/1072-2111-0x00000239F39E0000-0x00000239F39F0000-memory.dmp

Filesize
64KB

Download
memory/1072-2092-0x00007FFE52F50000-0x00007FFE53454000-memory.dmp

Filesize
5.0MB

Download
memory/1072-2109-0x00000239F39E0000-0x00000239F39F0000-memory.dmp

Filesize
64KB

Download
memory/1072-2099-0x00000239F39E0000-0x00000239F39F0000-memory.dmp

Filesize
64KB

Download
memory/1072-2098-0x00007FFE52F50000-0x00007FFE53454000-memory.dmp

Filesize
5.0MB

Download
memory/1696-1449-0x00000000049E0000-0x0000000004F84000-memory.dmp

Filesize
5.6MB

Download
memory/1696-1460-0x00000000024B0000-0x00000000044B0000-memory.dmp

Filesize
32.0MB

Download
memory/1696-1461-0x0000000074F00000-0x00000000756B0000-memory.dmp

Filesize
7.7MB

Download
memory/1696-1451-0x0000000004990000-0x00000000049A0000-memory.dmp

Filesize
64KB

Download
memory/1696-1450-0x0000000004FD0000-0x000000000500C000-memory.dmp

Filesize
240KB

Download
memory/1696-1448-0x0000000004990000-0x00000000049A0000-memory.dmp

Filesize
64KB

Download
memory/1696-1447-0x0000000004990000-0x00000000049A0000-memory.dmp

Filesize
64KB

Download
memory/1696-1446-0x0000000074F00000-0x00000000756B0000-memory.dmp

Filesize
7.7MB

Download
memory/1696-1445-0x0000000004930000-0x000000000496C000-memory.dmp

Filesize
240KB

Download
memory/2304-1463-0x0000000074FA0000-0x0000000075750000-memory.dmp

Filesize
7.7MB

Download
memory/2304-1464-0x0000000002460000-0x0000000002470000-memory.dmp

Filesize
64KB

Download
memory/2304-1465-0x0000000002460000-0x0000000002470000-memory.dmp

Filesize
64KB

Download
memory/2304-1466-0x0000000002460000-0x0000000002470000-memory.dmp

Filesize
64KB

Download
memory/2304-1475-0x0000000002560000-0x0000000004560000-memory.dmp

Filesize
32.0MB

Download
memory/2304-1476-0x0000000074FA0000-0x0000000075750000-memory.dmp

Filesize
7.7MB

Download
memory/2304-1841-0x0000000002560000-0x0000000004560000-memory.dmp

Filesize
32.0MB

Download
memory/3084-284-0x000001B024B70000-0x000001B024B71000-memory.dmp

Filesize
4KB

Download
memory/3084-281-0x000001B024B70000-0x000001B024B71000-memory.dmp

Filesize
4KB

Download
memory/3084-279-0x000001B024B70000-0x000001B024B71000-memory.dmp

Filesize
4KB

Download
memory/3084-282-0x000001B024B70000-0x000001B024B71000-memory.dmp

Filesize
4KB

Download
memory/3084-283-0x000001B024B70000-0x000001B024B71000-memory.dmp

Filesize
4KB

Download
memory/3084-272-0x000001B024B70000-0x000001B024B71000-memory.dmp

Filesize
4KB

Download
memory/3084-280-0x000001B024B70000-0x000001B024B71000-memory.dmp

Filesize
4KB

Download
memory/3084-273-0x000001B024B70000-0x000001B024B71000-memory.dmp

Filesize
4KB

Download
memory/3084-274-0x000001B024B70000-0x000001B024B71000-memory.dmp

Filesize
4KB

Download
memory/3084-278-0x000001B024B70000-0x000001B024B71000-memory.dmp

Filesize
4KB

Download
memory/3840-1484-0x000001B6AF9D0000-0x000001B6AF9D1000-memory.dmp

Filesize
4KB

Download
memory/3840-1478-0x000001B6AF9D0000-0x000001B6AF9D1000-memory.dmp

Filesize
4KB

Download
memory/3840-1479-0x000001B6AF9D0000-0x000001B6AF9D1000-memory.dmp

Filesize
4KB

Download
memory/3840-1477-0x000001B6AF9D0000-0x000001B6AF9D1000-memory.dmp

Filesize
4KB

Download
memory/3840-1481-0x000001B6AF9D0000-0x000001B6AF9D1000-memory.dmp

Filesize
4KB

Download
memory/3840-1486-0x000001B6AF9D0000-0x000001B6AF9D1000-memory.dmp

Filesize
4KB

Download
memory/3840-1482-0x000001B6AF9D0000-0x000001B6AF9D1000-memory.dmp

Filesize
4KB

Download
memory/3840-1483-0x000001B6AF9D0000-0x000001B6AF9D1000-memory.dmp

Filesize
4KB

Download
memory/3840-1485-0x000001B6AF9D0000-0x000001B6AF9D1000-memory.dmp

Filesize
4KB

Download
memory/4368-2117-0x0000000004B50000-0x0000000004B60000-memory.dmp

Filesize
64KB

Download
memory/4368-2116-0x0000000074FA0000-0x0000000075750000-memory.dmp

Filesize
7.7MB

Download
memory/4368-2118-0x0000000004B50000-0x0000000004B60000-memory.dmp

Filesize
64KB

Download
memory/4368-2126-0x00000000024D0000-0x00000000044D0000-memory.dmp

Filesize
32.0MB

Download
memory/4368-2128-0x0000000074FA0000-0x0000000075750000-memory.dmp

Filesize
7.7MB

Download
memory/4800-1457-0x0000000000400000-0x0000000000644000-memory.dmp

Filesize
2.3MB

Download
memory/4800-1454-0x0000000000400000-0x0000000000644000-memory.dmp

Filesize
2.3MB

Download
memory/4800-1462-0x0000000000400000-0x0000000000644000-memory.dmp

Filesize
2.3MB

Download