Overview

overview

10

Static

static

1

Adobe.Afte...78.rar

windows7-x64

3

Adobe.Afte...78.rar

windows10-2004-x64

10

Analysis

  • max time kernel
    368s
  • max time network
    384s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-es
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-eslocale:es-esos:windows10-2004-x64systemwindows
  • submitted
    31/03/2024, 16:11

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Adobe.After.Effects.2024.v24.1.0.78.rar
  • Size 169.9MB
  • Sample240331-tmym7afb56
  • SHA256 c16fa42dd6874f4af0b195a46d93191cb22a4d4ab078aa91b6e4e1d6e7c86858
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
vidarstealer

Malware Config

Extracted

Family

  • vidar

C2

  • https://steamcommunity.com/profiles/76561199658817715

  • https://t.me/sa9ok

Attributes
  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36

Signatures

  • Detect Vidar Stealer 22 IoCs
    stealer
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 10 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 8 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 38 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of FindShellTrayWindow 53 IoCs
  • Suspicious use of SendNotifyMessage 50 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\Adobe.After.Effects.2024.v24.1.0.78.rar
    1⤵
    • Checks computer location settings
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2352
    • C:\Program Files\7-Zip\7zFM.exe
      "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Adobe.After.Effects.2024.v24.1.0.78.rar"
      2⤵
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      PID:3484
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:3884
    • C:\Users\Admin\Desktop\xd\Setup.exe
      "C:\Users\Admin\Desktop\xd\Setup.exe"
      1⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2028
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2028 -s 2172
        2⤵
        • Program crash
        PID:4680
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2028 -s 2172
        2⤵
        • Program crash
        PID:752
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2028 -ip 2028
      1⤵
        PID:4444
      • C:\Users\Admin\Desktop\xd\Setup.exe
        "C:\Users\Admin\Desktop\xd\Setup.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        PID:1288
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1288 -s 2144
          2⤵
          • Program crash
          PID:5072
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1288 -ip 1288
        1⤵
          PID:4836
        • C:\Users\Admin\Desktop\xd\Setup.exe
          "C:\Users\Admin\Desktop\xd\Setup.exe"
          1⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          PID:2480
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2480 -s 2148
            2⤵
            • Program crash
            PID:4756
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 2480 -ip 2480
          1⤵
            PID:4892
          • C:\Users\Admin\Desktop\xd\Setup.exe
            "C:\Users\Admin\Desktop\xd\Setup.exe"
            1⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            PID:4800
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 4800 -s 2132
              2⤵
              • Program crash
              PID:5060
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4800 -ip 4800
            1⤵
              PID:2428
            • C:\Windows\system32\taskmgr.exe
              "C:\Windows\system32\taskmgr.exe" /4
              1⤵
              • Checks SCSI registry key(s)
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              PID:4148
            • C:\Users\Admin\Desktop\xd\audit\updater.exe
              "C:\Users\Admin\Desktop\xd\audit\updater.exe"
              1⤵
              • Executes dropped EXE
              PID:3256
            • C:\Users\Admin\Desktop\xd\audit\updater.exe
              "C:\Users\Admin\Desktop\xd\audit\updater.exe"
              1⤵
              • Executes dropped EXE
              PID:4392
            • C:\Users\Admin\Desktop\xd\audit\updater.exe
              "C:\Users\Admin\Desktop\xd\audit\updater.exe"
              1⤵
              • Executes dropped EXE
              PID:4508
            • C:\Users\Admin\Desktop\xd\Setup.exe
              "C:\Users\Admin\Desktop\xd\Setup.exe"
              1⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              PID:5044
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 5044 -s 2160
                2⤵
                • Program crash
                PID:3372
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 5044 -ip 5044
              1⤵
                PID:5076
              • C:\Windows\System32\cmd.exe
                "C:\Windows\System32\cmd.exe"
                1⤵
                • Suspicious use of WriteProcessMemory
                PID:1668
                • C:\Users\Admin\Desktop\xd\Setup.exe
                  Setup.exe
                  2⤵
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  PID:568
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 568 -s 2168
                    3⤵
                    • Program crash
                    PID:3400
                • C:\Users\Admin\Desktop\xd\Setup.exe
                  Setup.exe
                  2⤵
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  PID:3080
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 3080 -s 2160
                    3⤵
                    • Program crash
                    PID:3816
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 568 -ip 568
                1⤵
                  PID:3136
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3080 -ip 3080
                  1⤵
                    PID:4912

                  Network

                        MITRE ATT&CK Enterprise v15

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        76561199658817715[1].htm
                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\N1D00922\76561199658817715[1].htm
                        • Size 33KB
                        • SHA256 632afc2865dd354079b32527b34b6fa6469793794b927305b9119219cdd7f28c
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        76561199658817715[1].htm
                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\N1D00922\76561199658817715[1].htm
                        • Size 33KB
                        • SHA256 f2e81a65ad308cbb966a0c6338b8b162d37f34f5f47c3d7e74d2f64bae5bb732
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        76561199658817715[1].htm
                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\PICZ11Q6\76561199658817715[1].htm
                        • Size 33KB
                        • SHA256 5c4eade481f3856218897ad9895c58aac4bd8bc45b9b74c6f414c552dfdeee7d
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        76561199658817715[1].htm
                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\PICZ11Q6\76561199658817715[1].htm
                        • Size 33KB
                        • SHA256 db3a99de6bcdc35d436dacfdb95165803675f2188f44fad17ac375fabab3b9a2
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        76561199658817715[1].htm
                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RLMZURDM\76561199658817715[1].htm
                        • Size 33KB
                        • SHA256 9f43edd41a939fd0c7807825e95426d2e6c35dd1644228b39e9367682e6daf34
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        76561199658817715[1].htm
                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RLMZURDM\76561199658817715[1].htm
                        • Size 33KB
                        • SHA256 ad9aae16f21279bcca41a212601c044ce73f978fe00552343d748479460dceae
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        JSByteCodeCache_64
                        • Path C:\Users\Admin\AppData\Local\Temp\7zEC9DA7A68\SystemApps\Microsoft.AsyncTextService_8wekyb3d8bbwe\microsoft.system.package.metadata\Autogen\JSByteCodeCache_64
                        • Size 4B
                        • SHA256 fb5e512425fc9449316ec95969ebe71e2d576dbab833d61e2a5b9330fd70ee02
                        • MD5 SHA1 SHA512
                        Submit Download

                        StoreLogo.png
                        • Path C:\Users\Admin\AppData\Local\Temp\7zEC9DA7A68\SystemApps\Microsoft.ECApp_8wekyb3d8bbwe\Assets\StoreLogo.png
                        • Size 477B
                        • SHA256 3914354dc54e28a203de2fe4cc2303bbbc9dd527e5a44f08f87e6d00870c35e6
                        • MD5 SHA1 SHA512
                        Submit Download

                        wide310x150logo.scale-400.png
                        • Path C:\Users\Admin\AppData\Local\Temp\7zEC9DA7A68\SystemApps\Microsoft.Windows.CallingShellApp_cw5n1h2txyewy\Assets\wide310x150logo.scale-400.png
                        • Size 3KB
                        • SHA256 c9a4d0ff9bbe1c4920884938fd42e4e7c91abdd252d1612039176d72b749051a
                        • MD5 SHA1 SHA512
                        Submit Download

                        SplashScreen.scale-100.png
                        • Path C:\Users\Admin\AppData\Local\Temp\7zEC9DA7A68\SystemApps\Microsoft.Windows.FilePicker_cw5n1h2txyewy\Assets\SplashScreen.scale-100.png
                        • Size 1KB
                        • SHA256 2b69bef2df257330218577149c26cb56e019c4e822d795050574a83dc8a2352d
                        • MD5 SHA1 SHA512
                        Submit Download

                        AppListIcon.targetsize-16.png
                        • Path C:\Users\Admin\AppData\Local\Temp\7zEC9DA7A68\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\Assets\Icons\contrast-black\AppListIcon.targetsize-16.png
                        • Size 220B
                        • SHA256 32fd2ec7da4a6e6801ed1dce868c87ea67c933e315c59318c5ffb141cf44a30c
                        • MD5 SHA1 SHA512
                        Submit Download

                        AppListIcon.targetsize-20.png
                        • Path C:\Users\Admin\AppData\Local\Temp\7zEC9DA7A68\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\Assets\Icons\contrast-black\AppListIcon.targetsize-20.png
                        • Size 245B
                        • SHA256 f9035baa2ae8dc8358713121a462b278eeef0c61e9dc7be660acceb128fc6d48
                        • MD5 SHA1 SHA512
                        Submit Download

                        AppListIcon.targetsize-24.png
                        • Path C:\Users\Admin\AppData\Local\Temp\7zEC9DA7A68\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\Assets\Icons\contrast-black\AppListIcon.targetsize-24.png
                        • Size 298B
                        • SHA256 d0a4889a7cc6ef64e6ccf0ec304a76b130bdd215d039173fbe54bf4a7bef0323
                        • MD5 SHA1 SHA512
                        Submit Download

                        AppListIcon.targetsize-256.png
                        • Path C:\Users\Admin\AppData\Local\Temp\7zEC9DA7A68\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\Assets\Icons\contrast-black\AppListIcon.targetsize-256.png
                        • Size 4KB
                        • SHA256 22a13e34e1ea4555e15638b7339df270163bc7491c663cd2acbdc97b19323cd5
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        AppListIcon.targetsize-32.png
                        • Path C:\Users\Admin\AppData\Local\Temp\7zEC9DA7A68\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\Assets\Icons\contrast-black\AppListIcon.targetsize-32.png
                        • Size 407B
                        • SHA256 7367f367fe8549780fa3d56efdc02b3cb1e0aea08e078eb8bb6e116d099bfcf3
                        • MD5 SHA1 SHA512
                        Submit Download

                        AppListIcon.targetsize-40.png
                        • Path C:\Users\Admin\AppData\Local\Temp\7zEC9DA7A68\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\Assets\Icons\contrast-black\AppListIcon.targetsize-40.png
                        • Size 453B
                        • SHA256 19b4a87af0ae9360539b35c6da1fd4b49ef9d4e4d6032867105b6588562489c1
                        • MD5 SHA1 SHA512
                        Submit Download

                        AppListIcon.targetsize-48.png
                        • Path C:\Users\Admin\AppData\Local\Temp\7zEC9DA7A68\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\Assets\Icons\contrast-black\AppListIcon.targetsize-48.png
                        • Size 535B
                        • SHA256 ceba3b12583bacc9b681628551d3b735d8c7d2d864eb0417682edb0968119770
                        • MD5 SHA1 SHA512
                        Submit Download

                        AppListIcon.targetsize-64.png
                        • Path C:\Users\Admin\AppData\Local\Temp\7zEC9DA7A68\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\Assets\Icons\contrast-black\AppListIcon.targetsize-64.png
                        • Size 765B
                        • SHA256 a7f6fc82ee192056128cac0a0fea8acce5b5d690026b4f5414c35b44b0049a4b
                        • MD5 SHA1 SHA512
                        Submit Download

                        AppListIcon.targetsize-80.png
                        • Path C:\Users\Admin\AppData\Local\Temp\7zEC9DA7A68\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\Assets\Icons\contrast-black\AppListIcon.targetsize-80.png
                        • Size 891B
                        • SHA256 8e59ac99f7e38adbdd74b52b08cdba4ada0681fcf421b600f3976bf59ffd3442
                        • MD5 SHA1 SHA512
                        Submit Download

                        AppListIcon.targetsize-96.png
                        • Path C:\Users\Admin\AppData\Local\Temp\7zEC9DA7A68\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\Assets\Icons\contrast-black\AppListIcon.targetsize-96.png
                        • Size 1KB
                        • SHA256 a8edf77f7373240de7bd7fd7a2ffb67283750b3ca874f505b9951ad247938146
                        • MD5 SHA1 SHA512
                        Submit Download

                        SplashScreen.png
                        • Path C:\Users\Admin\AppData\Local\Temp\7zEC9DA7A68\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\Assets\SplashScreen.png
                        • Size 2KB
                        • SHA256 565185b96355ba74a80b502380f126f230f9d9cb89c193b57858cfb784b903f3
                        • MD5 SHA1 SHA512
                        Submit Download

                        SplashScreen.scale-100.png
                        • Path C:\Users\Admin\AppData\Local\Temp\7zEC9DA7A68\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\Assets\SplashScreen.scale-100.png
                        • Size 3KB
                        • SHA256 509523c5085ccd8b2967df9d90d04804defec4b78a98dbb0ba605e49e902ca63
                        • MD5 SHA1 SHA512
                        Submit Download

                        WideLogo310x150.scale-400.png
                        • Path C:\Users\Admin\AppData\Local\Temp\7zEC9DA7A68\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\Assets\WideLogo310x150.scale-400.png
                        • Size 7KB
                        • SHA256 6481e4f9518e3f75db13e70e4acaf9d6b65a67fc369afe2010c32bd2ea599237
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        StoreLogo.scale-100.png
                        • Path C:\Users\Admin\AppData\Local\Temp\7zEC9DA7A68\SystemApps\ShellExperienceHost_cw5n1h2txyewy\Assets\StoreLogo.scale-100.png
                        • Size 392B
                        • SHA256 625bc5c02ab457c466698097381fc329dcb5e6bf77eee2ea4f3ca9a4d50e1488
                        • MD5 SHA1 SHA512
                        Submit Download

                        NarratorUWPSquare44x44Logo.targetsize-16_altform-unplated_contrast-black.png
                        • Path C:\Users\Admin\AppData\Local\Temp\7zEC9DA7A68\SystemApps\microsoft.windows.narratorquickstart_8wekyb3d8bbwe\assets\NarratorUWPSquare44x44Logo.targetsize-16_altform-unplated_contrast-black.png
                        • Size 175B
                        • SHA256 8401a4227912332f5a9de2a23d6bf285a31e76dc950986145acdef2d81f58eaf
                        • MD5 SHA1 SHA512
                        Submit Download

                        NarratorUWPSquare44x44Logo.targetsize-20_altform-unplated_contrast-black.png
                        • Path C:\Users\Admin\AppData\Local\Temp\7zEC9DA7A68\SystemApps\microsoft.windows.narratorquickstart_8wekyb3d8bbwe\assets\NarratorUWPSquare44x44Logo.targetsize-20_altform-unplated_contrast-black.png
                        • Size 185B
                        • SHA256 6fd64e00fc312456c8280cfeddcf28d6a5d549a9069cb0f43637e3d0432593aa
                        • MD5 SHA1 SHA512
                        Submit Download

                        NarratorUWPSquare44x44Logo.targetsize-24_altform-unplated_contrast-black.png
                        • Path C:\Users\Admin\AppData\Local\Temp\7zEC9DA7A68\SystemApps\microsoft.windows.narratorquickstart_8wekyb3d8bbwe\assets\NarratorUWPSquare44x44Logo.targetsize-24_altform-unplated_contrast-black.png
                        • Size 198B
                        • SHA256 b8d3cc240d561506c2420a2318c053ee7bf4ad79c019157f1a516d90d487e8a0
                        • MD5 SHA1 SHA512
                        Submit Download

                        NarratorUWPSquare44x44Logo.targetsize-256_altform-unplated_contrast-black.png
                        • Path C:\Users\Admin\AppData\Local\Temp\7zEC9DA7A68\SystemApps\microsoft.windows.narratorquickstart_8wekyb3d8bbwe\assets\NarratorUWPSquare44x44Logo.targetsize-256_altform-unplated_contrast-black.png
                        • Size 1KB
                        • SHA256 770b6e60db416280a1d9ee44a6a00d605b98ad561c004f1183af25eac5150d2d
                        • MD5 SHA1 SHA512
                        Submit Download

                        NarratorUWPSquare44x44Logo.targetsize-30_altform-unplated_contrast-black.png
                        • Path C:\Users\Admin\AppData\Local\Temp\7zEC9DA7A68\SystemApps\microsoft.windows.narratorquickstart_8wekyb3d8bbwe\assets\NarratorUWPSquare44x44Logo.targetsize-30_altform-unplated_contrast-black.png
                        • Size 260B
                        • SHA256 096097873179de3599f80d893577c54052db0b334887afe3597ded8d0b5f41db
                        • MD5 SHA1 SHA512
                        Submit Download

                        NarratorUWPSquare44x44Logo.targetsize-32_altform-unplated_contrast-black.png
                        • Path C:\Users\Admin\AppData\Local\Temp\7zEC9DA7A68\SystemApps\microsoft.windows.narratorquickstart_8wekyb3d8bbwe\assets\NarratorUWPSquare44x44Logo.targetsize-32_altform-unplated_contrast-black.png
                        • Size 273B
                        • SHA256 db6f10c47ac0178f7a44ccf51ba830689c382ea9b526d0d2e81e7d4f8ed35702
                        • MD5 SHA1 SHA512
                        Submit Download

                        NarratorUWPSquare44x44Logo.targetsize-36_altform-unplated_contrast-black.png
                        • Path C:\Users\Admin\AppData\Local\Temp\7zEC9DA7A68\SystemApps\microsoft.windows.narratorquickstart_8wekyb3d8bbwe\assets\NarratorUWPSquare44x44Logo.targetsize-36_altform-unplated_contrast-black.png
                        • Size 286B
                        • SHA256 7fc9b5cd37ac8ca9a704bfee6c3db4b7b264972d485196673de139249f34bd75
                        • MD5 SHA1 SHA512
                        Submit Download

                        NarratorUWPSquare44x44Logo.targetsize-40_altform-unplated_contrast-black.png
                        • Path C:\Users\Admin\AppData\Local\Temp\7zEC9DA7A68\SystemApps\microsoft.windows.narratorquickstart_8wekyb3d8bbwe\assets\NarratorUWPSquare44x44Logo.targetsize-40_altform-unplated_contrast-black.png
                        • Size 302B
                        • SHA256 3ae26832f900c61d436bdce015957814a9a1d8d30fa73a5193d156097b4e3e9c
                        • MD5 SHA1 SHA512
                        Submit Download

                        NarratorUWPSquare44x44Logo.targetsize-48_altform-unplated_contrast-black.png
                        • Path C:\Users\Admin\AppData\Local\Temp\7zEC9DA7A68\SystemApps\microsoft.windows.narratorquickstart_8wekyb3d8bbwe\assets\NarratorUWPSquare44x44Logo.targetsize-48_altform-unplated_contrast-black.png
                        • Size 359B
                        • SHA256 5fb7775a8be470d36220ef9fc83af1ebd3d35da7ee02fadc49697b5416d158dd
                        • MD5 SHA1 SHA512
                        Submit Download

                        NarratorUWPSquare44x44Logo.targetsize-60_altform-unplated_contrast-black.png
                        • Path C:\Users\Admin\AppData\Local\Temp\7zEC9DA7A68\SystemApps\microsoft.windows.narratorquickstart_8wekyb3d8bbwe\assets\NarratorUWPSquare44x44Logo.targetsize-60_altform-unplated_contrast-black.png
                        • Size 424B
                        • SHA256 5e1adaeb4910ec309faa51718294957aca66a3d5ac75e8cd44cb222b77408ee6
                        • MD5 SHA1 SHA512
                        Submit Download

                        NarratorUWPSquare44x44Logo.targetsize-64_altform-unplated_contrast-black.png
                        • Path C:\Users\Admin\AppData\Local\Temp\7zEC9DA7A68\SystemApps\microsoft.windows.narratorquickstart_8wekyb3d8bbwe\assets\NarratorUWPSquare44x44Logo.targetsize-64_altform-unplated_contrast-black.png
                        • Size 443B
                        • SHA256 edf9f4c4b8592e131ddf55ba5162c484fde8bb216f48c729d6bd0d14717696a2
                        • MD5 SHA1 SHA512
                        Submit Download

                        NarratorUWPSquare44x44Logo.targetsize-72_altform-unplated_contrast-black.png
                        • Path C:\Users\Admin\AppData\Local\Temp\7zEC9DA7A68\SystemApps\microsoft.windows.narratorquickstart_8wekyb3d8bbwe\assets\NarratorUWPSquare44x44Logo.targetsize-72_altform-unplated_contrast-black.png
                        • Size 509B
                        • SHA256 6b08464202fa80ae5a6311c15c7a77d148bd170c7458c940e4b1797d0b127309
                        • MD5 SHA1 SHA512
                        Submit Download

                        NarratorUWPSquare44x44Logo.targetsize-80_altform-unplated_contrast-black.png
                        • Path C:\Users\Admin\AppData\Local\Temp\7zEC9DA7A68\SystemApps\microsoft.windows.narratorquickstart_8wekyb3d8bbwe\assets\NarratorUWPSquare44x44Logo.targetsize-80_altform-unplated_contrast-black.png
                        • Size 528B
                        • SHA256 72199eb6e4c1a6af4ea0eb90c7f153a3713aa721501048cfc7b2d78effbdb1b2
                        • MD5 SHA1 SHA512
                        Submit Download

                        NarratorUWPSquare44x44Logo.targetsize-96_altform-unplated_contrast-black.png
                        • Path C:\Users\Admin\AppData\Local\Temp\7zEC9DA7A68\SystemApps\microsoft.windows.narratorquickstart_8wekyb3d8bbwe\assets\NarratorUWPSquare44x44Logo.targetsize-96_altform-unplated_contrast-black.png
                        • Size 643B
                        • SHA256 72babcee3ff2c243b756251d984ccb0e200fa594f71f13737d336e97c893a4bc
                        • MD5 SHA1 SHA512
                        Submit Download

                        Setup.exe
                        • Path C:\Users\Admin\Desktop\xd\Setup.exe
                        • Size 782.1MB
                        • SHA256 a3248573f3ba96adb079f6382e43b2520cb8ddcb9f847f9c11c0384b96723812
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        Setup.exe
                        • Path C:\Users\Admin\Desktop\xd\Setup.exe
                        • Size 634.9MB
                        • SHA256 aa84fb1561a6c771e32da4b182f869a291d779c10618ebe2d09901178ebdc016
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        Setup.exe
                        • Path C:\Users\Admin\Desktop\xd\Setup.exe
                        • Size 491.3MB
                        • SHA256 2b2806f2c0d401981913606cd65cd69b5b6464af67662efaeb0ccfc72227bb33
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        updater.exe
                        • Path C:\Users\Admin\Desktop\xd\audit\updater.exe
                        • Size 97.2MB
                        • SHA256 ddb47ac9f17f6ef351f59cd2c8ef54ccf240f918681034b1a9d6fa358780dc07
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        memory/568-2459-0x0000000000D50000-0x0000000001A4C000-memory.dmp
                        Download

                        memory/568-2474-0x0000000000D50000-0x0000000001A4C000-memory.dmp
                        Download

                        memory/1288-2377-0x0000000000D50000-0x0000000001A4C000-memory.dmp
                        Download

                        memory/1288-2368-0x00000000009D0000-0x00000000009D1000-memory.dmp
                        Download

                        memory/1288-2369-0x00000000009E0000-0x00000000009E1000-memory.dmp
                        Download

                        memory/1288-2370-0x00000000009F0000-0x00000000009F1000-memory.dmp
                        Download

                        memory/1288-2371-0x0000000000A00000-0x0000000000A01000-memory.dmp
                        Download

                        memory/1288-2367-0x0000000000D50000-0x0000000001A4C000-memory.dmp
                        Download

                        memory/1288-2366-0x00000000009A0000-0x00000000009A1000-memory.dmp
                        Download

                        memory/1288-2382-0x0000000000D50000-0x0000000001A4C000-memory.dmp
                        Download

                        memory/1288-2365-0x0000000000890000-0x0000000000891000-memory.dmp
                        Download

                        memory/2028-2354-0x0000000000D30000-0x0000000000D31000-memory.dmp
                        Download

                        memory/2028-2364-0x0000000000D50000-0x0000000001A4C000-memory.dmp
                        Download

                        memory/2028-2352-0x0000000000D10000-0x0000000000D11000-memory.dmp
                        Download

                        memory/2028-2353-0x0000000000D20000-0x0000000000D21000-memory.dmp
                        Download

                        memory/2028-2350-0x0000000000D00000-0x0000000000D01000-memory.dmp
                        Download

                        memory/2028-2351-0x0000000000D50000-0x0000000001A4C000-memory.dmp
                        Download

                        memory/2028-2348-0x0000000000A10000-0x0000000000A11000-memory.dmp
                        Download

                        memory/2028-2349-0x0000000000CC0000-0x0000000000CC1000-memory.dmp
                        Download

                        memory/2028-2360-0x0000000000D50000-0x0000000001A4C000-memory.dmp
                        Download

                        memory/2480-2385-0x0000000004370000-0x0000000004371000-memory.dmp
                        Download

                        memory/2480-2400-0x0000000000D50000-0x0000000001A4C000-memory.dmp
                        Download

                        memory/2480-2396-0x0000000000D50000-0x0000000001A4C000-memory.dmp
                        Download

                        memory/2480-2390-0x00000000043E0000-0x00000000043E1000-memory.dmp
                        Download

                        memory/2480-2389-0x00000000043C0000-0x00000000043C1000-memory.dmp
                        Download

                        memory/2480-2388-0x00000000043B0000-0x00000000043B1000-memory.dmp
                        Download

                        memory/2480-2386-0x0000000000D50000-0x0000000001A4C000-memory.dmp
                        Download

                        memory/2480-2383-0x0000000004360000-0x0000000004361000-memory.dmp
                        Download

                        memory/2480-2384-0x0000000000D50000-0x0000000001A4C000-memory.dmp
                        Download

                        memory/2480-2387-0x00000000043A0000-0x00000000043A1000-memory.dmp
                        Download

                        memory/3080-2492-0x0000000000D50000-0x0000000001A4C000-memory.dmp
                        Download

                        memory/3080-2480-0x0000000000D50000-0x0000000001A4C000-memory.dmp
                        Download

                        memory/3080-2477-0x0000000000D50000-0x0000000001A4C000-memory.dmp
                        Download

                        memory/4148-2432-0x000001ECB56D0000-0x000001ECB56D1000-memory.dmp
                        Download

                        memory/4148-2422-0x000001ECB56D0000-0x000001ECB56D1000-memory.dmp
                        Download

                        memory/4148-2426-0x000001ECB56D0000-0x000001ECB56D1000-memory.dmp
                        Download

                        memory/4148-2429-0x000001ECB56D0000-0x000001ECB56D1000-memory.dmp
                        Download

                        memory/4148-2430-0x000001ECB56D0000-0x000001ECB56D1000-memory.dmp
                        Download

                        memory/4148-2431-0x000001ECB56D0000-0x000001ECB56D1000-memory.dmp
                        Download

                        memory/4148-2428-0x000001ECB56D0000-0x000001ECB56D1000-memory.dmp
                        Download

                        memory/4148-2427-0x000001ECB56D0000-0x000001ECB56D1000-memory.dmp
                        Download

                        memory/4148-2421-0x000001ECB56D0000-0x000001ECB56D1000-memory.dmp
                        Download

                        memory/4148-2420-0x000001ECB56D0000-0x000001ECB56D1000-memory.dmp
                        Download

                        memory/4800-2408-0x0000000000D40000-0x0000000000D41000-memory.dmp
                        Download

                        memory/4800-2406-0x0000000000D30000-0x0000000000D31000-memory.dmp
                        Download

                        memory/4800-2402-0x0000000000AE0000-0x0000000000AE1000-memory.dmp
                        Download

                        memory/4800-2403-0x0000000000BD0000-0x0000000000BD1000-memory.dmp
                        Download

                        memory/4800-2419-0x0000000000D50000-0x0000000001A4C000-memory.dmp
                        Download

                        memory/4800-2415-0x0000000000D50000-0x0000000001A4C000-memory.dmp
                        Download

                        memory/4800-2405-0x0000000000D50000-0x0000000001A4C000-memory.dmp
                        Download

                        memory/4800-2404-0x0000000000CF0000-0x0000000000CF1000-memory.dmp
                        Download

                        memory/4800-2409-0x0000000003F90000-0x0000000003F91000-memory.dmp
                        Download

                        memory/4800-2407-0x0000000000D50000-0x0000000001A4C000-memory.dmp
                        Download

                        memory/5044-2440-0x0000000000D50000-0x0000000001A4C000-memory.dmp
                        Download

                        memory/5044-2439-0x00000000009D0000-0x00000000009D1000-memory.dmp
                        Download

                        memory/5044-2455-0x0000000000D50000-0x0000000001A4C000-memory.dmp
                        Download

                        memory/5044-2443-0x0000000000D50000-0x0000000001A4C000-memory.dmp
                        Download

                        memory/5044-2438-0x00000000009C0000-0x00000000009C1000-memory.dmp
                        Download