Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/02/2024, 08:46

General

  • Target

    https://pathofcraft.net/

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 64 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 54 IoCs
  • Suspicious use of SendNotifyMessage 30 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pathofcraft.net/
    1⤵
    • Enumerates system info in registry
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3576
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xe0,0x108,0x7ffbd92146f8,0x7ffbd9214708,0x7ffbd9214718
      2⤵
        PID:1180
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2192,11516287948252906313,17153451534821715062,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2316 /prefetch:3
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:3600
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2192,11516287948252906313,17153451534821715062,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:8
        2⤵
          PID:2392
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2192,11516287948252906313,17153451534821715062,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2272 /prefetch:2
          2⤵
            PID:2976
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,11516287948252906313,17153451534821715062,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
            2⤵
              PID:3392
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,11516287948252906313,17153451534821715062,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
              2⤵
                PID:1320
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,11516287948252906313,17153451534821715062,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5016 /prefetch:1
                2⤵
                  PID:4332
                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2192,11516287948252906313,17153451534821715062,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5984 /prefetch:8
                  2⤵
                    PID:3292
                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2192,11516287948252906313,17153451534821715062,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5984 /prefetch:8
                    2⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:8
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,11516287948252906313,17153451534821715062,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:1
                    2⤵
                      PID:5064
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,11516287948252906313,17153451534821715062,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2912 /prefetch:1
                      2⤵
                        PID:1940
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,11516287948252906313,17153451534821715062,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1
                        2⤵
                          PID:3332
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,11516287948252906313,17153451534821715062,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:1
                          2⤵
                            PID:1196
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,11516287948252906313,17153451534821715062,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 /prefetch:1
                            2⤵
                              PID:3092
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,11516287948252906313,17153451534821715062,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6088 /prefetch:1
                              2⤵
                                PID:3840
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2192,11516287948252906313,17153451534821715062,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=1828 /prefetch:8
                                2⤵
                                  PID:3624
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,11516287948252906313,17153451534821715062,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6532 /prefetch:1
                                  2⤵
                                    PID:4092
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2192,11516287948252906313,17153451534821715062,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6468 /prefetch:8
                                    2⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:3080
                                • C:\Windows\System32\CompPkgSrv.exe
                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                  1⤵
                                    PID:1712
                                  • C:\Windows\System32\CompPkgSrv.exe
                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                    1⤵
                                      PID:3652
                                    • C:\Windows\System32\CompPkgSrv.exe
                                      C:\Windows\System32\CompPkgSrv.exe -Embedding
                                      1⤵
                                        PID:5044
                                      • C:\Windows\System32\rundll32.exe
                                        C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                        1⤵
                                          PID:3536
                                        • C:\Users\Admin\Downloads\2.6\2.6\Crafter.exe
                                          "C:\Users\Admin\Downloads\2.6\2.6\Crafter.exe"
                                          1⤵
                                            PID:1976
                                            • C:\Users\Admin\Downloads\2.6\2.6\Crafter.exe
                                              "C:\Users\Admin\Downloads\2.6\2.6\Crafter.exe"
                                              2⤵
                                              • Loads dropped DLL
                                              • Suspicious behavior: AddClipboardFormatListener
                                              • Suspicious behavior: GetForegroundWindowSpam
                                              • Suspicious use of FindShellTrayWindow
                                              • Suspicious use of SendNotifyMessage
                                              • Suspicious use of SetWindowsHookEx
                                              PID:2008
                                              • C:\Windows\system32\cmd.exe
                                                C:\Windows\system32\cmd.exe /c "ver"
                                                3⤵
                                                  PID:4596
                                            • C:\Windows\system32\AUDIODG.EXE
                                              C:\Windows\system32\AUDIODG.EXE 0x3fc 0x310
                                              1⤵
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:3840

                                            Network

                                            MITRE ATT&CK Enterprise v15

                                            Replay Monitor

                                            Loading Replay Monitor...

                                            Downloads

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                              Filesize

                                              152B

                                              MD5

                                              58670ac03d80eb4bd1cec7ac5672d2e8

                                              SHA1

                                              276295d2f9e58fb0b8ef03bd9567227fb94e03f7

                                              SHA256

                                              76e1645d9c4f363b34e554822cfe0d53ff1fce5e994acdf1edeff13ae8df30f8

                                              SHA512

                                              99fe23263de36ec0c8b6b3b0205df264250392cc9c0dd8fa28cf954ff39f9541f722f96a84fbc0b4e42cfd042f064525a6be4b220c0180109f8b1d51bbdef8ff

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                              Filesize

                                              152B

                                              MD5

                                              3782686f747f4a85739b170a3898b645

                                              SHA1

                                              81ae1c4fd3d1fddb50b3773e66439367788c219c

                                              SHA256

                                              67ee813be3c6598a8ea02cd5bb5453fc0aa114606e3fc7ad216f205fe46dfc13

                                              SHA512

                                              54eb860107637a611150ff18ac57856257bf650f70dce822de234aee644423080b570632208d38e45e2f0d2bf60ca2684d3c3480f9637ea4ad81f2bcfb9f24d5

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002e

                                              Filesize

                                              35KB

                                              MD5

                                              2fd093ba1ab6fcafe1263c686eb129f9

                                              SHA1

                                              7563a8b8c9893d8c55831dedd07f7327a94f3d8e

                                              SHA256

                                              74767429c47b573025cded7b094046c1a9eb158ac529a128e6578392f1016d09

                                              SHA512

                                              9c84430718600bffeafc1f817ea32921fe255f2064c363b2ee62df54c36bc93b3ca056e865b899f72a693e710654f42d6d9efac1bc4c15a52b06a35423ca24bf

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                              Filesize

                                              1KB

                                              MD5

                                              b09d92ec648ca37486cfc00793df2310

                                              SHA1

                                              13da8d8f0245bfc785eb99dc3ccfc406b4cc53e4

                                              SHA256

                                              c58b4a2e06d57e51100e1bc3b0f339f419b3b2e5aa5ca2aba5f5c47c2925623b

                                              SHA512

                                              8eab61462134e1600c03c4849acebf2ee11c76d172bae7a2788d986d559cd58e4b7bb1a2dda7a2775f05c2d8f9a95b8d2a2bbc4244051ba43e9e5145cf75ec42

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                              Filesize

                                              1KB

                                              MD5

                                              79814ea69da814f384a7dddbab29ce8f

                                              SHA1

                                              b6a18f1cd2462fe86c2194bf6f4bf5280580d9be

                                              SHA256

                                              ac1d6b087255a99e8cfbc49bf194fffc91c85af8a482ea8991f3e4865947ff7c

                                              SHA512

                                              6a0c9faec38769e8c31cb95bf21fed74e3c3ceb0de72d1e3cc2639f3832d18075c7b1d475fa1b1feb367d1c13c6146f7a53037707ade7c60c843ee112d257579

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                              Filesize

                                              1KB

                                              MD5

                                              cd9381956aecaffff613eefc5a2e516b

                                              SHA1

                                              eeac59c10b13e4b11319877a7712f4d4ede6f88d

                                              SHA256

                                              3e31e697d59633fe4208c99537391b05cef68a19bf2cea364c5b734015c35a15

                                              SHA512

                                              547836b05010f29d8739fb9721e49df16199d50deb5dca473447433b1d26cb101576066808809b1e6b869d64a2d7fd6d62b81260feef4fcca0d172163619a754

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                              Filesize

                                              111B

                                              MD5

                                              285252a2f6327d41eab203dc2f402c67

                                              SHA1

                                              acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

                                              SHA256

                                              5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

                                              SHA512

                                              11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                              Filesize

                                              6KB

                                              MD5

                                              85460237e7be10dd4405e7e41df488d6

                                              SHA1

                                              2294f41bf365e26c64442a4bde148dfb3af5a90f

                                              SHA256

                                              3c19d16deabd5f4096882bafe23519b32335614f95b3152a4f008e8cf3774033

                                              SHA512

                                              2bb71118f077ba80eb12157449740f0d8bc3394c131a6eda3dad14df886ce8175ba2baab4e79a3ea4dfe08291000f23869ec7d3cf321f6baed07641fe22a68b6

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                              Filesize

                                              111B

                                              MD5

                                              807419ca9a4734feaf8d8563a003b048

                                              SHA1

                                              a723c7d60a65886ffa068711f1e900ccc85922a6

                                              SHA256

                                              aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

                                              SHA512

                                              f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                              Filesize

                                              6KB

                                              MD5

                                              086ba933f6d2f1bf4051f1f89aa26cb0

                                              SHA1

                                              890c8251f7f76abb5b1e4359ffce52b6c18b3274

                                              SHA256

                                              2a381c8ead677562f3825ab64027fab64f47c551b929201d1768296f64ca2174

                                              SHA512

                                              07d6f41ec5298bab647b4925a023994523c86acdafab6d83941a6e46665ec9d4c3bab288eb7b60b0089a9bf0536ce19307f478488bc2d2a874106c150d38342b

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                              Filesize

                                              6KB

                                              MD5

                                              c1571cfdb4bc6e39a21a44cce549acf2

                                              SHA1

                                              a7c5b4bf222a4ee946cf1ee6782e11f13fe0a6cf

                                              SHA256

                                              9803e32da15e258f7d8f24a6dcc6ab02569fbcd4d0b5ef96c7612ced2fa4fbf0

                                              SHA512

                                              f305402feb8db37e59a1d42d30e083b35923c2dbef1c7bfffc877355191d06f305e7b3aedde2987aa5f55220cff70991687e080e14fba7202ed2d2adb8e86c5e

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                              Filesize

                                              8KB

                                              MD5

                                              b111b70101f002fc7da0a43f5a609514

                                              SHA1

                                              ef5633e7e0e642255f0e108da12224a732cb88dc

                                              SHA256

                                              1a29ef580ee325708125fb6793789110a5f227d662b282e39d8f67a0bb66792d

                                              SHA512

                                              8886b5e143822917a78d9b606eb2bdbe45dc3c4bd1c0001a23b01c0b6ea30eebce827594ac90bb059b63f62b7e30b9754df4a5f1942d60213fcfe585b7d59b0d

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                              Filesize

                                              8KB

                                              MD5

                                              676fc9aa39aa7e4c9f8f3c6a99e598f7

                                              SHA1

                                              97455350f0cbbdf85501574c1a230ff45f9d5c5f

                                              SHA256

                                              a39ad80eff92c4a28606c30c62aa8ffcb9ec4f25e9cbf064bc20c5221529d46c

                                              SHA512

                                              5b9221bfe8faa7709964b2031d69f4e067066eb993e0a60f551e7e1b1e828844ecb44066fb72df9950c9bf3489084141fc16599cafea45d64ea54e78d86deda2

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                              Filesize

                                              7KB

                                              MD5

                                              7bd648af0f19877adfde26b5a8b7c81d

                                              SHA1

                                              a418f3fc75c8ac2ed5dcf45b93a964e637e1bd66

                                              SHA256

                                              e51a3d9bed56e95feeb5b3a89a0aab2ea4e5aac500d9304b907855c4d4dd7f56

                                              SHA512

                                              448fcbcc15460fa7d21f7bda00d20cc1b10c03ce29be0f51508b4ad9ce676b5df513cf04bb0ab7f9116f630b2c80247f3566746dd336201e0ab183b7126c5184

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                              Filesize

                                              7KB

                                              MD5

                                              b145dd1a1b942cdb1d3e2a1326fdafd3

                                              SHA1

                                              f5331d60d3709c2728d9dc9333219094e54c9d63

                                              SHA256

                                              7d5618d44bb7df853340d94ba098ae4075c13cb88a0dafe5fd8a177f0ef9c21b

                                              SHA512

                                              33a6a41e427ea14abba0f6ed0e6b7f5b7d7f283bd22abf81ccb0c53fff05996e5cb7d96309957d9c3e91736bbebde74c3ccb18c5bbda3f29082d1f1044bff5b5

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                              Filesize

                                              8KB

                                              MD5

                                              382ef6a4825d3976720807b49a5323b9

                                              SHA1

                                              337507b0831ae777ea6e025a59aa345a1d9802e3

                                              SHA256

                                              b5ea5891280608e9bf985b2f20af1a17fc04e68f1030b75351c1d847daa6c6be

                                              SHA512

                                              edc2c37b0ca41a577bb2c21b843cccea763dccb570d776ec082c87f7f3a7978e8aa36c18d90b5656777a11e3c2f634d4f508621bbd1d6e9f1a5177eeff6305e9

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                              Filesize

                                              1KB

                                              MD5

                                              9fec3c4af00706f788efa511ae9fe87c

                                              SHA1

                                              2bb150d7de34027e32dc49f81bbd56a62681bf04

                                              SHA256

                                              29c1b7cb1fa8116a27f8ef756895b3ca5dbe14e48f608f558eea743ddfe232d2

                                              SHA512

                                              8527672638662bccaf62771ed82d42a1f7f0205cf3dcdad4a6392087a09f0bdcb3961bfac30fcb574d56ef964f96f5c9fe4afe61c21e693457f3f6ac2505bdf7

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                              Filesize

                                              1KB

                                              MD5

                                              7a769d895799d63191444f5bae25fd87

                                              SHA1

                                              f44f099bf5b160b1db8e84d20be56a1189e05ed0

                                              SHA256

                                              625aa0af8c5b98a3f8ce59b9642e5d2cbe6e2a2a34e12194edd2934831d0f7ab

                                              SHA512

                                              95846880fc866be7b36fbe5944125839a1d668ebf77eb8b97df963522c4acf709333af926ccf7fa486db1fc321baca80c0737aa75e7504d2e7bc4e1da3669da8

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                              Filesize

                                              1KB

                                              MD5

                                              0554a0c7779b7bcd5214e9f8caebb9ef

                                              SHA1

                                              2b872c6e8b612de96b32d774d10781319b3897e1

                                              SHA256

                                              8759134ae4bdcd1ab253c5a56805c0ecbcea28c635063d6274e58bea99d2884a

                                              SHA512

                                              9cfcd24f4369f18dd259e0b3bd14dc9dd49177fc3fc14772d8558e8f15f6e915887ad7b12753fea4766eb0e0001fa40767ee61374ff7c0a59a1b894340c96813

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57bc7a.TMP

                                              Filesize

                                              372B

                                              MD5

                                              4b5c823a1531da6dead584ace5c9ac92

                                              SHA1

                                              4616102726ef6fbd6dd4ae2faf07744223f962a0

                                              SHA256

                                              334a575e11f57dfc9336f9496c1be88b50be29456fc68f5d8cb520d4935fbd54

                                              SHA512

                                              4c3b0c72e031e729998c9107f4ef73096a4ee6ea112ab30a7b2e266f8d190248ff7f15140659e98c466535363822b9dc4aff68ab6e52e8d09174440f1a57f820

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                              Filesize

                                              16B

                                              MD5

                                              6752a1d65b201c13b62ea44016eb221f

                                              SHA1

                                              58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                              SHA256

                                              0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                              SHA512

                                              9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                              Filesize

                                              12KB

                                              MD5

                                              f10f173f38f2dda5ebe3d6b2e4e4e456

                                              SHA1

                                              df418043ed79aefae3e18633054144191d3c9185

                                              SHA256

                                              fdaf833b387749cf577df8c6359eca4580d8d604bf280aca0096b33e42ace374

                                              SHA512

                                              ed7b7032c7536a152c9e300b130b0d24a479cca716c22efc3ab2d15ffa44d4f27a8594d222f813849afa3ae46158fe005364dd08f089aeeb10d596d5680efc35

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                              Filesize

                                              12KB

                                              MD5

                                              3943d518f9bdcdbd6fdd4c12e4a5976c

                                              SHA1

                                              975c601f706c4d0ca74dc95319ddab86f12e0096

                                              SHA256

                                              236b74c591a47cf1ffa6e0dde9f1e9be23353d89a98c0a7bc208f4f4f373407f

                                              SHA512

                                              3d4e126bc333f40d4cffeb9a2bef7b297034262fd376538bced3288b6dea3ee773f91fcc1c30aaacdb266a6f3bb2bd62e8143fa2882e36734579dd9786206247

                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                              Filesize

                                              11KB

                                              MD5

                                              ab15cda085c2eb081181144cc66b19d1

                                              SHA1

                                              d75aaa6229ccb7c2fd46dc342dbb9ee3a8be0bf3

                                              SHA256

                                              c901ed104f76ac1b02922f2d9208209bfa316242d6d4a48484b814fc11991f60

                                              SHA512

                                              722e6749b84276125264065a971c59abf4d9a9272da5c5d8a80a1fa5cb5857cee0b72205b1e951a91990dabc11a976fc7f3b2be0ac6ccf7aa43396e7162f5e8d

                                            • C:\Users\Admin\AppData\Local\Temp\_MEI19762\VCRUNTIME140.dll

                                              Filesize

                                              99KB

                                              MD5

                                              8697c106593e93c11adc34faa483c4a0

                                              SHA1

                                              cd080c51a97aa288ce6394d6c029c06ccb783790

                                              SHA256

                                              ff43e813785ee948a937b642b03050bb4b1c6a5e23049646b891a66f65d4c833

                                              SHA512

                                              724bbed7ce6f7506e5d0b43399fb3861dda6457a2ad2fafe734f8921c9a4393b480cdd8a435dbdbd188b90236cb98583d5d005e24fa80b5a0622a6322e6f3987

                                            • C:\Users\Admin\AppData\Local\Temp\_MEI19762\_bz2.pyd

                                              Filesize

                                              74KB

                                              MD5

                                              177308f1e8a2f500c4948a2bcd299785

                                              SHA1

                                              ef3a3c0d030a6c55acb8c06c0c7ed878231e1a2f

                                              SHA256

                                              54ad29a941793dbdcf7a41310437fc5a4591cd66005e30206ff4c07376ddafb9

                                              SHA512

                                              bd00bb1dfd22dfa3960db08955623ca16ce76fbaebfd2781eb4f5e2d877f7eddbb9daad48ae5f7abf2a05642f42136a743b6d7b32b9de94bb1d34f9cfa1d1700

                                            • C:\Users\Admin\AppData\Local\Temp\_MEI19762\_ctypes.pyd

                                              Filesize

                                              114KB

                                              MD5

                                              c3480ffe322762b2b5436f5e3814379b

                                              SHA1

                                              1d610d93cf736cc63667e776b1e479f672d9e9d5

                                              SHA256

                                              adf692c4dea2d5f429215d89427b6059499ffeba40fe4ba1595eff7e6b3d713c

                                              SHA512

                                              67a92b4e87e59b9736b5c8882a765ece05536882cba97a754b7ef5951303d23626be0ec199ae49bb32c589ecbd4e68a8d48fc58cbd2edd6d0cc27aadfbe4b804

                                            • C:\Users\Admin\AppData\Local\Temp\_MEI19762\_lzma.pyd

                                              Filesize

                                              152KB

                                              MD5

                                              7b45f888febd15893430275070405e65

                                              SHA1

                                              5a19373059e0f8e7ad4ebeb6745758d14324984a

                                              SHA256

                                              f8486617d631fd02e02a021b0f4871551788a037bd8f67939a4c0d00a36218e4

                                              SHA512

                                              6aba44c014c03e470cb4cfd83fb92c068826f87ab02e269686fbfb1bb651486b9337e60cad47e5573b70df84d841fe3b259370289900598b6aa250478b9b066b

                                            • C:\Users\Admin\AppData\Local\Temp\_MEI19762\api-ms-win-core-console-l1-1-0.dll

                                              Filesize

                                              18KB

                                              MD5

                                              e5912b05988259dad0d6d04c8a17d19b

                                              SHA1

                                              724f4f91041ad595e365b724a0348c83acf12bbb

                                              SHA256

                                              9f3608c15c5de2f577a2220ce124b530825717d778f1e3941e536a3ab691f733

                                              SHA512

                                              c270a622d7887f4c97232ea898f5380459c565817f0d201cdb081ee82e3002b6e6248753a68da896d3b1327f93e8e8cb0ca0dcaeef324f610e0a1c7b542c6492

                                            • C:\Users\Admin\AppData\Local\Temp\_MEI19762\api-ms-win-core-datetime-l1-1-0.dll

                                              Filesize

                                              18KB

                                              MD5

                                              16789cc09a417d7deb590fffe4ed02dc

                                              SHA1

                                              4940d5b92b6b80a40371f8df073bf3eb406f5658

                                              SHA256

                                              3b68d7ab0641de6b3e81d209b7c0d3896e4ffa76617bbadd01eb54036cdd1b07

                                              SHA512

                                              19e4f086cc2137ee60316b0736b3c6b3780578896df9a826edfe004bb74bee8e051c511a84d8a7ea278a5f47c82b9c955394f629ab0bb0740ecb51293d9be7b7

                                            • C:\Users\Admin\AppData\Local\Temp\_MEI19762\api-ms-win-core-debug-l1-1-0.dll

                                              Filesize

                                              18KB

                                              MD5

                                              9476affaac53e6e34405c4001f141805

                                              SHA1

                                              e7c8a6c29c3158f8b332eea5c33c3b1e044b5f73

                                              SHA256

                                              55574f9e80d313048c245acefd21801d0d6c908a8a5049b4c46253efaf420f89

                                              SHA512

                                              f8e3476a09d888caebd50da0ea2debc4006004e72af677919413655ab4595622cac524f1bc6c13406ee341ae0052a19ed83826ad530f652e73b2c65d4fa65680

                                            • C:\Users\Admin\AppData\Local\Temp\_MEI19762\api-ms-win-core-errorhandling-l1-1-0.dll

                                              Filesize

                                              18KB

                                              MD5

                                              a5883c68d432f593812ab3b755b808db

                                              SHA1

                                              51cbb7ba47802dc630c2507750432c55f5979c27

                                              SHA256

                                              b3715112a7ca4c6cc0efee044bd82444d3267a379e33a3ec118d87e75604204d

                                              SHA512

                                              27153e29e99a905fa4c8b3ede078644a3a3f29fdf7b98e387e39c5c60444e326c92afd74da8fee225f7ddf39724a0daef68ba238f3cc64fb7860172b8f29d79a

                                            • C:\Users\Admin\AppData\Local\Temp\_MEI19762\api-ms-win-core-file-l1-1-0.dll

                                              Filesize

                                              21KB

                                              MD5

                                              241338aef5e2c18c80fb1db07aa8bcdf

                                              SHA1

                                              9acbeef0ac510c179b319ca69cd5378d0e70504d

                                              SHA256

                                              56de091efe467fe23cc989c1ee21f3249a1bdb2178b51511e3bd514df12c5ccb

                                              SHA512

                                              b9fd37f01a58594e48fa566c41827b2b9499605d9e55c2178e83ee41c8c5f50a4df2c85efea94ca586ea0ea4a6d984ebb7ca2193e9306fcb853b147b2c76bc2d

                                            • C:\Users\Admin\AppData\Local\Temp\_MEI19762\api-ms-win-core-file-l1-2-0.dll

                                              Filesize

                                              18KB

                                              MD5

                                              49c3ffd47257dbcb67a6be9ee112ba7f

                                              SHA1

                                              04669214375b25e2dc8a3635484e6eeb206bc4eb

                                              SHA256

                                              322d963d2a2aefd784e99697c59d494853d69bed8efd4b445f59292930a6b165

                                              SHA512

                                              bda5e6c669b04aaed89538a982ef430cef389237c6c1d670819a22b2a20bf3c22aef5cb4e73ef7837cbbd89d870693899f97cb538122059c885f4b19b7860a98

                                            • C:\Users\Admin\AppData\Local\Temp\_MEI19762\api-ms-win-core-file-l2-1-0.dll

                                              Filesize

                                              18KB

                                              MD5

                                              bfffa7117fd9b1622c66d949bac3f1d7

                                              SHA1

                                              402b7b8f8dcfd321b1d12fc85a1ee5137a5569b2

                                              SHA256

                                              1ea267a2e6284f17dd548c6f2285e19f7edb15d6e737a55391140ce5cb95225e

                                              SHA512

                                              b319cc7b436b1be165cdf6ffcab8a87fe29de78f7e0b14c8f562be160481fb5483289bd5956fdc1d8660da7a3f86d8eede35c6cc2b7c3d4c852decf4b2dcdb7f

                                            • C:\Users\Admin\AppData\Local\Temp\_MEI19762\api-ms-win-core-handle-l1-1-0.dll

                                              Filesize

                                              18KB

                                              MD5

                                              cce27ff9b1e78b61955682788452f785

                                              SHA1

                                              a2e2a40cea25ea4fd64b8deaf4fbe4a2db94107a

                                              SHA256

                                              8ee2de377a045c52bbb05087ae3c2f95576edfb0c2767f40b13454f2d9f779de

                                              SHA512

                                              1fcec1cd70426e3895c48598dfc359839d2b3f2b1e3e94314872a866540353460ec932bf3841e5afe89aa4d6c6fac768e21ae368d68c2bb15f65960f6f5d7d5b

                                            • C:\Users\Admin\AppData\Local\Temp\_MEI19762\api-ms-win-core-heap-l1-1-0.dll

                                              Filesize

                                              18KB

                                              MD5

                                              cdc266896e0dbe6c73542f6dec19de23

                                              SHA1

                                              b4310929ccb82dd3c3a779cab68f1f9f368076f2

                                              SHA256

                                              87a5c5475e9c26fabfead6802dac8a62e2807e50e0d18c4bfadcb15ebf5bcbc0

                                              SHA512

                                              79a29041699f41938174a6ec9797faf8d6bf7764657d801cb3af15c225f8eab0135d59cfa627bd02dd7459f7b857d62299e4d082586ce690627ebdf1267ebb21

                                            • C:\Users\Admin\AppData\Local\Temp\_MEI19762\api-ms-win-core-interlocked-l1-1-0.dll

                                              Filesize

                                              18KB

                                              MD5

                                              39809cc5dabf769da8871a91a8ed9e69

                                              SHA1

                                              f779cdef9ded19402aa72958085213d6671ca572

                                              SHA256

                                              5cd00ff4731691f81ff528c4b5a2e408548107efc22cc6576048b0fdce3dfbc9

                                              SHA512

                                              83a8246839d28378c6f6951d7593dc98b6caa6dbca5fbd023b00b3b1a9eba0597943838c508493533c2de276c4d2f9107d890e1c9a493ee834351cff5dfd2cab

                                            • C:\Users\Admin\AppData\Local\Temp\_MEI19762\api-ms-win-core-libraryloader-l1-1-0.dll

                                              Filesize

                                              19KB

                                              MD5

                                              5d5fae1a17961d6ee37637f04fe99b8a

                                              SHA1

                                              47143a66b4a2e2ba019bf1fd07bcca9cfb8bb117

                                              SHA256

                                              8e01eb923fc453f927a7eca1c8aa5643e43b360c76b648088f51b31488970aa0

                                              SHA512

                                              9db32ec8416320dcb28f874b4679d2d47a5ae56317fdc9d2d65ebb553f1d6345c3dd0024294a671a694337683dd4e77254595a9cdbfe115c80d0ef53516d46aa

                                            • C:\Users\Admin\AppData\Local\Temp\_MEI19762\api-ms-win-core-localization-l1-2-0.dll

                                              Filesize

                                              20KB

                                              MD5

                                              588bd2a8e0152e0918742c1a69038f1d

                                              SHA1

                                              9874398548891f6a08fc06437996f84eb7495783

                                              SHA256

                                              a07cc878ab5595aacd4ab229a6794513f897bd7ad14bcec353793379146b2094

                                              SHA512

                                              32ffe64c697f94c4db641ab3e20b0f522cf3eba9863164f1f6271d2f32529250292a16be95f32d852480bd1b59b8b0554c1e7fd7c7a336f56c048f4f56e4d62f

                                            • C:\Users\Admin\AppData\Local\Temp\_MEI19762\api-ms-win-core-memory-l1-1-0.dll

                                              Filesize

                                              18KB

                                              MD5

                                              6def20ed13972f3c3f08dba8ecf3d6cc

                                              SHA1

                                              9c03356cf48112563bb845479f40bf27b293e95e

                                              SHA256

                                              c2e887a17875d39099d662a42f58c120b9cc8a799afd87a9e49adf3faddd2b68

                                              SHA512

                                              5b4d2b1152bed14108dc58d358b1082e27defd1001d36cd72ec6f030a34d6caf9b01c3c1dd8a9ac66d1937fcf86a6fe3469ac93b1e76d933a8f4b51c1f782f65

                                            • C:\Users\Admin\AppData\Local\Temp\_MEI19762\api-ms-win-core-namedpipe-l1-1-0.dll

                                              Filesize

                                              18KB

                                              MD5

                                              a056d4eeaae37deab8333dcc4c910a93

                                              SHA1

                                              cb59f1fe73c17446eb196fc0dd7d944a0cd9d81f

                                              SHA256

                                              593fa2aa2474508ad942bbaa0fdc9a1badd81c85b0dff1c43b90a47c23ad5fb7

                                              SHA512

                                              c2f811994182ef51d0c011c19336179da69357e5f284f787bcdb54f90c32768a959232a477534f7e62cd3d71a048a13e91b20042e2fe6ab108d606c7c8df9255

                                            • C:\Users\Admin\AppData\Local\Temp\_MEI19762\api-ms-win-core-processenvironment-l1-1-0.dll

                                              Filesize

                                              19KB

                                              MD5

                                              f3b4ab35a65a8d938c6b60ad59ba6e7f

                                              SHA1

                                              2745259f4dbbefbf6b570ee36d224abdb18719bc

                                              SHA256

                                              ea2972fec12305825162ae3e1ae2b6c140e840be0e7ebb51a7a77b7feeda133a

                                              SHA512

                                              a88afb66311494d6c15613c94555ba436cd2f75e11a49a448c9c6776dfba24cda25a44792a1e8b3e680c1ad3ad0574b43ac2328c6e41ff0832139c94b066dbf5

                                            • C:\Users\Admin\AppData\Local\Temp\_MEI19762\api-ms-win-core-processthreads-l1-1-0.dll

                                              Filesize

                                              20KB

                                              MD5

                                              5faf9a33bab1d39dd9f820d34339b3d4

                                              SHA1

                                              50699041060d14576ed7bacbd44be9af80eb902a

                                              SHA256

                                              a1221836731c7e52c42d5809cc02b17c5ec964601631ec15a84201f423da4ac4

                                              SHA512

                                              73c25d1338df9aee5211fbb0e1b14e6bd853e31746c63bc46f44810622b09d52ee39b8e8a57c655da63d3d3d4025c2cba4d8673893d022417a2032ba3d935061

                                            • C:\Users\Admin\AppData\Local\Temp\_MEI19762\api-ms-win-core-processthreads-l1-1-1.dll

                                              Filesize

                                              18KB

                                              MD5

                                              d699333637db92d319661286df7cc39e

                                              SHA1

                                              0bffb9ed366853e7019452644d26e8e8f236241b

                                              SHA256

                                              fe760614903e6d46a1be508dccb65cf6929d792a1db2c365fc937f2a8a240504

                                              SHA512

                                              6fa9ff0e45f803faf3eb9908e810a492f6f971cb96d58c06f408980ab40cba138b52d853aa0e3c68474053690dfafa1817f4b4c8fb728d613696b6c516fa0f51

                                            • C:\Users\Admin\AppData\Local\Temp\_MEI19762\api-ms-win-core-profile-l1-1-0.dll

                                              Filesize

                                              17KB

                                              MD5

                                              7028cf6b6b609cb0e31abd1f618e42d0

                                              SHA1

                                              e7e0b18a40a35bd8b0766ac72253de827432e148

                                              SHA256

                                              9e98b03a3ca1ebabdceb7ed9c0ceb4912bb68eb68f3e0df17f39c7a55fada31d

                                              SHA512

                                              d035ccfd0de316e64187c18e6e5b36e14f615f872c08740ec22ef2c12d592e37d78ab154202926a56ab01d669eb5870dff651280a882d6bf2a700c43dcd25ac2

                                            • C:\Users\Admin\AppData\Local\Temp\_MEI19762\api-ms-win-core-rtlsupport-l1-1-0.dll

                                              Filesize

                                              18KB

                                              MD5

                                              2166fb99debbb1b0649c4685cf630a4a

                                              SHA1

                                              24f37d46dfc0ef303ef04abf9956241af55d25c9

                                              SHA256

                                              cdc4cfebf9cba85b0d3979befdb258c1f2cfcb79edd00da2dfbf389d080e4379

                                              SHA512

                                              de27d06b1f306110b42d0ed2642a555862d0ade7e56e5f2908e399f140aa5f43904e08d690bcb0d2f4d11d799ec18fa682db048da57d99cd99891e45add86371

                                            • C:\Users\Admin\AppData\Local\Temp\_MEI19762\api-ms-win-core-string-l1-1-0.dll

                                              Filesize

                                              18KB

                                              MD5

                                              b7cbc8d977a00a2574e110b01124ed40

                                              SHA1

                                              637e4a9946691f76e6deb69bdc21c210921d6f07

                                              SHA256

                                              854db7d2085caacf83d6616761d8bdcbacb54a06c9a9b171b1c1a15e7dc10908

                                              SHA512

                                              b415ef4092fa62d39941bf529a2032bc8b591c54ed2050ea4730f198899f147539b2c0e97f3c4f14848c71066924c1848ae5f07779a1a47ab4c5e46f02be7258

                                            • C:\Users\Admin\AppData\Local\Temp\_MEI19762\api-ms-win-core-synch-l1-1-0.dll

                                              Filesize

                                              20KB

                                              MD5

                                              6961bf5622ffcd14c16fbfc1296950a4

                                              SHA1

                                              5584c189216a17228cca6cd07037aaa9a8603241

                                              SHA256

                                              50a1542d16b42ecb3edc1edd0881744171ea52f7155e5269ad39234f0ea691de

                                              SHA512

                                              a4d0c15acbff4e9140ae4264fa24bd4c65fb2d1052a0b37bf281498f3b641fef563c18115511829a23340c9440f547028d36015ba38cbd51ad0744d44d5ccd87

                                            • C:\Users\Admin\AppData\Local\Temp\_MEI19762\api-ms-win-core-synch-l1-2-0.dll

                                              Filesize

                                              18KB

                                              MD5

                                              47388f3966e732706054fe3d530ed0dc

                                              SHA1

                                              a9aebbbb73b7b846b051325d7572f2398f5986ee

                                              SHA256

                                              59c14541107f5f2b94bbf8686efee862d20114bcc9828d279de7bf664d721132

                                              SHA512

                                              cce1fc5bcf0951b6a76d456249997b427735e874b650e5b50b3d278621bf99e39c4fc7fee081330f20762f797be1b1c048cb057967ec7699c9546657b3e248ee

                                            • C:\Users\Admin\AppData\Local\Temp\_MEI19762\api-ms-win-core-sysinfo-l1-1-0.dll

                                              Filesize

                                              19KB

                                              MD5

                                              df50047bbd2cf3a4b0cf0567514b464c

                                              SHA1

                                              f20ae25484a1c1b43748a1f0c422f48f092ad2c1

                                              SHA256

                                              8310d855398f83cb5b9ca3adeb358da1354557aec5c82c8ef91a29f79a47f620

                                              SHA512

                                              5c3bfc2ccb2ee864b99f6709677474327e85889f4c962ea0a1ef9e1e876dc88b1d8e8e0f6c1422f634ff1c84a861c34e52ee07dac7fdde505b508bea80562b9f

                                            • C:\Users\Admin\AppData\Local\Temp\_MEI19762\api-ms-win-core-timezone-l1-1-0.dll

                                              Filesize

                                              18KB

                                              MD5

                                              f62b66f451f2daa8410ad62d453fa0a2

                                              SHA1

                                              4bf13db65943e708690d6256d7ddd421cc1cc72b

                                              SHA256

                                              48eb5b52227b6fb5be70cb34009c8da68356b62f3e707db56af957338ba82720

                                              SHA512

                                              d64c2a72adf40bd451341552e7e6958779de3054b0cf676b876c3ba7b86147aecba051ac08adc0c3bfb2779109f87dca706c43de3ce36e05af0ddee02bbbf419

                                            • C:\Users\Admin\AppData\Local\Temp\_MEI19762\api-ms-win-core-util-l1-1-0.dll

                                              Filesize

                                              18KB

                                              MD5

                                              a1952875628359a0632be61ba4727684

                                              SHA1

                                              1e1a5ab47e4c2b3c32c81690b94954b7612bb493

                                              SHA256

                                              a41bede183fa1c70318332d6bc54ef13817aeee6d52b3ab408f95fa532b809f1

                                              SHA512

                                              3f86180cc085dc8c9f6d3c72f5ccc0f5a0c9048343edaf62239eb4b038799845388898408ed7e8eac5d015a9bc42ff428f74585f64f5d3467dddb1303baf4f03

                                            • C:\Users\Admin\AppData\Local\Temp\_MEI19762\api-ms-win-crt-conio-l1-1-0.dll

                                              Filesize

                                              19KB

                                              MD5

                                              6c88d0006cf852f2d8462dfa4e9ca8d1

                                              SHA1

                                              49002b58cb0df2ee8d868dec335133cf225657df

                                              SHA256

                                              d5960c7356e8ab97d0ad77738e18c80433da277671a6e89a943c7f7257ff3663

                                              SHA512

                                              d081843374a43d2e9b33904d4334d49383df04ee7143a8b49600841ece844eff4e8e36b4b5966737ac931ed0350f202270e043f7003bf2748c5418d5e21c2a27

                                            • C:\Users\Admin\AppData\Local\Temp\_MEI19762\api-ms-win-crt-convert-l1-1-0.dll

                                              Filesize

                                              22KB

                                              MD5

                                              d53637eab49fe1fe1bd45d12f8e69c1f

                                              SHA1

                                              c84e41fdcc4ca89a76ae683cb390a9b86500d3ca

                                              SHA256

                                              83678f181f46fe77f8afe08bfc48aebb0b4154ad45b2efe9bfadc907313f6087

                                              SHA512

                                              94d43da0e2035220e38e4022c429a9c049d6a355a9cb4695ad4e0e01d6583530917f3b785ea6cd2592fdd7b280b9df95946243e395a60dc58ec0c94627832aeb

                                            • C:\Users\Admin\AppData\Local\Temp\_MEI19762\api-ms-win-crt-environment-l1-1-0.dll

                                              Filesize

                                              18KB

                                              MD5

                                              c712515d052a385991d30b9c6afc767f

                                              SHA1

                                              9a4818897251cacb7fe1c6fe1be3e854985186ad

                                              SHA256

                                              f7c6c7ea22edd2f8bd07aa5b33cbce862ef1dcdc2226eb130e0018e02ff91dc1

                                              SHA512

                                              b7d1e22a169c3869aa7c7c749925a031e8bdd94c2531c6ffe9dae3b3cd9a2ee1409ca26824c4e720be859de3d4b2af637dd60308c023b4774d47afe13284dcd2

                                            • C:\Users\Admin\AppData\Local\Temp\_MEI19762\api-ms-win-crt-filesystem-l1-1-0.dll

                                              Filesize

                                              20KB

                                              MD5

                                              f0d507de92851a8c0404ac78c383c5cd

                                              SHA1

                                              78fa03c89ea12ff93fa499c38673039cc2d55d40

                                              SHA256

                                              610332203d29ab218359e291401bf091bb1db1a6d7ed98ab9a7a9942384b8e27

                                              SHA512

                                              a65c9129ee07864f568c651800f6366bca5313ba400814792b5cc9aa769c057f357b5055988c414e88a6cd87186b6746724a43848f96a389a13e347ef5064551

                                            • C:\Users\Admin\AppData\Local\Temp\_MEI19762\api-ms-win-crt-heap-l1-1-0.dll

                                              Filesize

                                              19KB

                                              MD5

                                              f9e20dd3b07766307fccf463ab26e3ca

                                              SHA1

                                              60b4cf246c5f414fc1cd12f506c41a1043d473ee

                                              SHA256

                                              af47aebe065af2f045a19f20ec7e54a6e73c0c3e9a5108a63095a7232b75381a

                                              SHA512

                                              13c43eee9c93c9f252087cb397ff2d6b087b1dc92a47ba5493297f080e91b7c39ee5665d6bdc1a80e7320e2b085541fc798a3469b1f249b05dee26bbbb6ab706

                                            • C:\Users\Admin\AppData\Local\Temp\_MEI19762\api-ms-win-crt-locale-l1-1-0.dll

                                              Filesize

                                              18KB

                                              MD5

                                              ab206f2943977256ca3a59e5961e3a4f

                                              SHA1

                                              9c1df49a8dbdc8496ac6057f886f5c17b2c39e3e

                                              SHA256

                                              b3b6ee98aca14cf5bc9f3bc7897bc23934bf85fc4bc25b7506fe4cd9a767047a

                                              SHA512

                                              baccc304b091a087b2300c10f6d18be414abb4c1575274c327104aabb5fdf975ba26a86e423fda6befb5d7564effac0c138eb1bad2d2e226131e4963c7aac5bd

                                            • C:\Users\Admin\AppData\Local\Temp\_MEI19762\base_library.zip

                                              Filesize

                                              352KB

                                              MD5

                                              0a2ee3722e8ba7fb1272838eb1d47696

                                              SHA1

                                              df760ded1dde50c76f8d15dac614ab0b1c3696e5

                                              SHA256

                                              6df51d1f06264c0b7c931dccd830209add2ea765cb797faf206375a968f2933e

                                              SHA512

                                              5eacdfdd5ab87142b01c23146a613c94ace3948615bb033fbb761e398e38b22427819b0ac90f2f696cd3ad3bf2bf5ac471d116458d2c3bf93d3d7bad1ee80e7b

                                            • C:\Users\Admin\AppData\Local\Temp\_MEI19762\libffi-7.dll

                                              Filesize

                                              32KB

                                              MD5

                                              eef7981412be8ea459064d3090f4b3aa

                                              SHA1

                                              c60da4830ce27afc234b3c3014c583f7f0a5a925

                                              SHA256

                                              f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081

                                              SHA512

                                              dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016

                                            • C:\Users\Admin\AppData\Local\Temp\_MEI19762\python3.DLL

                                              Filesize

                                              51KB

                                              MD5

                                              1337b40b72bbdd59c9160706bd0cf2f1

                                              SHA1

                                              e15c4774a335f2371197c073479246a6d792412e

                                              SHA256

                                              ae88285d10fed8c43e457f20c5ea704b1fd1b44e97e691c463ff9eb62b0c653c

                                              SHA512

                                              b653cc32d8d17690cb6cd115595c45d29b9a68da6a2845c31e9dfc9f23800b0d6b56c001a97ba33c98f2889ac74a444d7818275b51ea079ec6c76a22e93397b5

                                            • C:\Users\Admin\AppData\Local\Temp\_MEI19762\python39.dll

                                              Filesize

                                              4.3MB

                                              MD5

                                              33f1c14cc443c6bfddfa2d86a2d4e490

                                              SHA1

                                              6d7aa11003fb9b40760d47e5e1121f4731319f1a

                                              SHA256

                                              5dd0b205b16545218552676c3dd602a0cf01fb4ee8c656df988e3e308083f67a

                                              SHA512

                                              1cbe8d87ae5037f14b80ddbede0e984803529a9ddd17d68608c751283a92e9c9d788e2f255298006cca8afb5015024a6551603ccc3bace4ec8a86e076a8e068d

                                            • C:\Users\Admin\AppData\Local\Temp\_MEI19762\pytz\zoneinfo\Africa\Conakry

                                              Filesize

                                              148B

                                              MD5

                                              09a9397080948b96d97819d636775e33

                                              SHA1

                                              5cc9b028b5bd2222200e20091a18868ea62c4f18

                                              SHA256

                                              d2efac4e5f23d88c95d72c1db42807170f52f43dd98a205af5a92a91b9f2d997

                                              SHA512

                                              2eccf2515599ed261e96da3fbcfbab0b6a2dfc86a1d87e3814091709f0bfe2f600c3044c8555ed027978a8ae9045666ee639a8c249f48d665d8e5c60f0597799

                                            • C:\Users\Admin\AppData\Local\Temp\_MEI19762\pytz\zoneinfo\Africa\Djibouti

                                              Filesize

                                              265B

                                              MD5

                                              86dcc322e421bc8bdd14925e9d61cd6c

                                              SHA1

                                              289d1fb5a419107bc1d23a84a9e06ad3f9ee8403

                                              SHA256

                                              c89b2e253a8926a6cecf7eff34e4bfcdb7fe24daff22d84718c30deec0ea4968

                                              SHA512

                                              d32771be8629fb3186723c8971f06c3803d31389438b29bf6baa958b3f9db9a38971019583ba272c7a8f5eb4a633dfc467bfcb6f76faa8e290bad4fd7366bb2b

                                            • C:\Users\Admin\AppData\Local\Temp\_MEI19762\pytz\zoneinfo\Africa\Gaborone

                                              Filesize

                                              149B

                                              MD5

                                              b77fb20b4917d76b65c3450a7117023c

                                              SHA1

                                              b99f3115100292d9884a22ed9aef9a9c43b31ccd

                                              SHA256

                                              93f19e9551d58868ae5820752d2c93a486124c364463dc9c9489d0458f8bc682

                                              SHA512

                                              a088c2a4c7d72717257c3125c7c2aca28463d68306ea452afaad75b8a0f9e5730a8d9c430d14668809717a672dc63c4816762acb046b339da662da421a6d65df

                                            • C:\Users\Admin\AppData\Local\Temp\_MEI19762\pytz\zoneinfo\Africa\Lagos

                                              Filesize

                                              235B

                                              MD5

                                              8244c4cc8508425b6612fa24df71e603

                                              SHA1

                                              30ba925b4670235915dddfa1dd824dd9d7295eac

                                              SHA256

                                              cffeb0282ccbd7fba0e493ff8677a1e5a6dd5197885042e437f95a773f844846

                                              SHA512

                                              560c7581dcb2c800eae779005e41406beaf15d24efc763304e3111b9bb6074fe0ba59c48b5a2c5511245551b94418bbc35934d9bd46313fcc6e383323056668c

                                            • C:\Users\Admin\AppData\Local\Temp\_MEI19762\pytz\zoneinfo\America\Curacao

                                              Filesize

                                              246B

                                              MD5

                                              adf95d436701b9774205f9315ec6e4a4

                                              SHA1

                                              fcf8be5296496a5dd3a7a97ed331b0bb5c861450

                                              SHA256

                                              8491e557ff801a8306516b8ca5946ff5f2e6821af31477eb47d7d191cc5a6497

                                              SHA512

                                              f8fceff3c346224d693315af1ab12433eb046415200abaa6cdd65fd0ad40673fdddf67b83563d351e4aa520565881a4226fb37d578d3ba88a135e596ebb9b348

                                            • C:\Users\Admin\AppData\Local\Temp\_MEI19762\pytz\zoneinfo\America\Toronto

                                              Filesize

                                              3KB

                                              MD5

                                              44a2dd3cb61b90aa4201c38e571a15ba

                                              SHA1

                                              73f6ad91b2c748957bdaec149db3b1b6b0d8ac86

                                              SHA256

                                              820392cdb1e499f82ef704d0ccfd0c50ab2b28c6e0bdeb80793861d5e165d5ad

                                              SHA512

                                              11ddb971c65c2f4ecc690ef685163f2972c089660f4778997964d89113a403030927edbb2ed397b81cf61bde9276add6a43ee8ee92dfa69a6d102b035fe9f01d

                                            • C:\Users\Admin\AppData\Local\Temp\_MEI19762\pytz\zoneinfo\Etc\Greenwich

                                              Filesize

                                              114B

                                              MD5

                                              9cd2aef183c064f630dfcf6018551374

                                              SHA1

                                              2a8483df5c2809f1dfe0c595102c474874338379

                                              SHA256

                                              6d9f378883c079f86c0387a5547a92c449869d806e07de10084ab04f0249018d

                                              SHA512

                                              dafa0cb9d0a8e0ff75a19be499751ad85372aafa856ff06dd68ecf2b1c5578bb98a040becaecf0aed2c3e4ff7372ff200fe7614334756d19fe79dd61c01d4e92

                                            • C:\Users\Admin\AppData\Local\Temp\_MEI19762\pytz\zoneinfo\Europe\London

                                              Filesize

                                              3KB

                                              MD5

                                              a40006ee580ef0a4b6a7b925fee2e11f

                                              SHA1

                                              1beba7108ea93c7111dabc9d7f4e4bfdea383992

                                              SHA256

                                              c85495070dca42687df6a1c3ee780a27cbcb82f1844750ea6f642833a44d29b4

                                              SHA512

                                              316ecacc34136294ce11dcb6d0f292570ad0515f799fd59fbff5e7121799860b1347d802b6439a291f029573a3715e043009e2c1d5275f38957be9e04f92e62e

                                            • C:\Users\Admin\AppData\Local\Temp\_MEI19762\pytz\zoneinfo\Europe\Oslo

                                              Filesize

                                              2KB

                                              MD5

                                              7db6c3e5031eaf69e6d1e5583ab2e870

                                              SHA1

                                              918341ad71f9d3acd28997326e42d5b00fba41e0

                                              SHA256

                                              5ee475f71a0fc1a32faeb849f8c39c6e7aa66d6d41ec742b97b3a7436b3b0701

                                              SHA512

                                              688eaa6d3001192addaa49d4e15f57aa59f3dd9dc511c063aa2687f36ffd28ffef01d937547926be6477bba8352a8006e8295ee77690be935f76d977c3ea12fe

                                            • C:\Users\Admin\AppData\Local\Temp\_MEI19762\pytz\zoneinfo\Europe\Skopje

                                              Filesize

                                              1KB

                                              MD5

                                              6213fc0a706f93af6ff6a831fecbc095

                                              SHA1

                                              961a2223fd1573ab344930109fbd905336175c5f

                                              SHA256

                                              3a95adb06156044fd2fa662841c0268c2b5af47c1b19000d9d299563d387093a

                                              SHA512

                                              8149de3fd09f8e0f5a388f546ffe8823bdcda662d3e285b5cebc92738f0c6548ccb6ed2a5d086fd738cb3edc8e9e1f81c5e2e48edb0571e7ea7f131675b99327

                                            • C:\Users\Admin\AppData\Local\Temp\_MEI19762\pytz\zoneinfo\PRC

                                              Filesize

                                              561B

                                              MD5

                                              09dd479d2f22832ce98c27c4db7ab97c

                                              SHA1

                                              79360e38e040eaa15b6e880296c1d1531f537b6f

                                              SHA256

                                              64ffc2e43a94435a043c040d1d3af7e92d031adc78e7737af1861baa4eeef3e6

                                              SHA512

                                              f88ae25f3f04c7d5d5f98aafecc03cc7e4e56f1cd4c8deba6afd043f0fb7fe67b4d50e4df5493e77c6b34ba183e019442e736a13f784ba8c2847c06fd74ff200

                                            • C:\Users\Admin\AppData\Local\Temp\_MEI19762\pytz\zoneinfo\Pacific\Wallis

                                              Filesize

                                              152B

                                              MD5

                                              5bdd7374e21e3df324a5b3d178179715

                                              SHA1

                                              244ed7d52bc39d915e1f860727ecfe3f4b1ae121

                                              SHA256

                                              53268a8a6b11f0b8e02fc67683ae48d074efaf7b4c66e036c1478107afd9a7d7

                                              SHA512

                                              9c76f39e8795c50e6c5b384a7ff1f308a1c5173f42f810759b36cdeae7d33d1dac4934efeed580c59d988c152e2d7f8d9b8eb2073ab1fc15e4b9c10900c7b383

                                            • C:\Users\Admin\AppData\Local\Temp\_MEI19762\pytz\zoneinfo\Pacific\Yap

                                              Filesize

                                              172B

                                              MD5

                                              ec972f59902432836f93737f75c5116f

                                              SHA1

                                              331542d6faf6ab15ffd364d57fbaa62629b52b94

                                              SHA256

                                              9c1dfa1c15994dd8774e53f40cb14dcf529143468721f1dba7b2c2e14ae9f5f0

                                              SHA512

                                              e8e8c8f6d096c352d1244280254e4c6ecf93f7c2ff69ecc6fa4363a6be8a2daf6cfcd7f0d96bc2669268ced5565532fa06be348a139b0742ccccb83953c6324d

                                            • C:\Users\Admin\AppData\Local\Temp\_MEI19762\pytz\zoneinfo\UCT

                                              Filesize

                                              114B

                                              MD5

                                              38bb24ba4d742dd6f50c1cba29cd966a

                                              SHA1

                                              d0b8991654116e9395714102c41d858c1454b3bd

                                              SHA256

                                              8b85846791ab2c8a5463c83a5be3c043e2570d7448434d41398969ed47e3e6f2

                                              SHA512

                                              194867d0cf66c2de4969dbfeb58c775964ecb2132acdc1b000b5ef0998cefde4a2979ffc04ec8b7dcb430e43326a79d9cedb28ecea184345aa7d742eaf9234ac

                                            • C:\Users\Admin\AppData\Local\Temp\_MEI19762\ucrtbase.dll

                                              Filesize

                                              992KB

                                              MD5

                                              0e0bac3d1dcc1833eae4e3e4cf83c4ef

                                              SHA1

                                              4189f4459c54e69c6d3155a82524bda7549a75a6

                                              SHA256

                                              8a91052ef261b5fbf3223ae9ce789af73dfe1e9b0ba5bdbc4d564870a24f2bae

                                              SHA512

                                              a45946e3971816f66dd7ea3788aacc384a9e95011500b458212dc104741315b85659e0d56a41570731d338bdf182141c093d3ced222c007038583ceb808e26fd

                                            • memory/2008-1566-0x00007FFBC95D0000-0x00007FFBC9AB0000-memory.dmp

                                              Filesize

                                              4.9MB

                                            • memory/2008-1567-0x00007FFBC9080000-0x00007FFBC95C1000-memory.dmp

                                              Filesize

                                              5.3MB

                                            • memory/2008-1568-0x00007FFBD8820000-0x00007FFBD8A80000-memory.dmp

                                              Filesize

                                              2.4MB

                                            • memory/2008-1569-0x00007FFBC8750000-0x00007FFBC89B4000-memory.dmp

                                              Filesize

                                              2.4MB

                                            • memory/2008-1570-0x0000021CC3720000-0x0000021CC3730000-memory.dmp

                                              Filesize

                                              64KB

                                            • memory/2008-1571-0x0000021CB25A0000-0x0000021CB4656000-memory.dmp

                                              Filesize

                                              32.7MB

                                            • memory/2008-1574-0x0000021CB1A40000-0x0000021CB1A41000-memory.dmp

                                              Filesize

                                              4KB

                                            • memory/2008-1580-0x0000021CB1A40000-0x0000021CB1A41000-memory.dmp

                                              Filesize

                                              4KB