Analysis

  • max time kernel
    143s
  • max time network
    160s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/11/2024, 05:03

General

  • Target

    Geometry Dash 2.11 Funcional/_CommonRedist/vcredist/2010/vcredist_x64.exe

  • Size

    9.8MB

  • MD5

    c9d9eebccef20d637f193490cec05e79

  • SHA1

    15d032d669078aa6f0f7fd1cbf4115a070bd034d

  • SHA256

    cc7ec044218c72a9a15fca2363baed8fc51095ee3b2a7593476771f9eba3d223

  • SHA512

    24b56b5d9b48d75baf53a98e007ace3e7d68fbd5fa55b75ae1a2c08dd466d20b13041f80e84fdb64b825f070843f9247daba681eff16baf99a4b14ea99f5cfd6

  • SSDEEP

    196608:n9A3D5MBD0vwqMKgL29M2JWMWiKV/nPlnqIaAAVINqsAsbPnpCxmz7dU8:23D5MBwZMd0b4oSQ7VSrAs1gEdU8

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 5 IoCs
  • Checks system information in the registry 2 TTPs 2 IoCs

    System information is often read in order to detect sandboxing environments.

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Geometry Dash 2.11 Funcional\_CommonRedist\vcredist\2010\vcredist_x64.exe
    "C:\Users\Admin\AppData\Local\Temp\Geometry Dash 2.11 Funcional\_CommonRedist\vcredist\2010\vcredist_x64.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1668
    • \??\c:\f1a80ecaa29c45fc8ce0\Setup.exe
      c:\f1a80ecaa29c45fc8ce0\Setup.exe
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks system information in the registry
      • System Location Discovery: System Language Discovery
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2516

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\HFIABC2.tmp.html

          Filesize

          16KB

          MD5

          928b890fbe154e9991185b2be97f3d14

          SHA1

          2aa26948f090131d1ff13c2b1c51f2f22f402f8b

          SHA256

          d5e9bace0272213d1f64295aed00ef3399faa7d11e7e10d4e15417a8e17af8c3

          SHA512

          ce4b966200ced44e3f2702b55936f10a6ffce1ef220d222f1b0ce917ea54f92a75169ad734913ef69a592b7617a4885943b23c54f6f18a45473805e8833112a8

        • C:\f1a80ecaa29c45fc8ce0\Setup.exe

          Filesize

          76KB

          MD5

          2af2c1a78542975b12282aca4300d515

          SHA1

          3216c853ed82e41dfbeb6ca48855fdcd41478507

          SHA256

          531eb45798728cb741043b28b8c1a4f75536dc75f92d100f55f9109d2d63f0d7

          SHA512

          4a70bd4b542f6001e46f827f341676c34af1ea216c50ad981dd04f547cd67f73aaa420fcbed379dc05dab199bf5ba00d899c49ff75da577613209f96226227eb

        • C:\f1a80ecaa29c45fc8ce0\sqmapi.dll

          Filesize

          141KB

          MD5

          3f0363b40376047eff6a9b97d633b750

          SHA1

          4eaf6650eca5ce931ee771181b04263c536a948b

          SHA256

          bd6395a58f55a8b1f4063e813ce7438f695b9b086bb965d8ac44e7a97d35a93c

          SHA512

          537be86e2f171e0b2b9f462ac7f62c4342beb5d00b68451228f28677d26a525014758672466ad15ed1fd073be38142dae478df67718908eae9e6266359e1f9e8

        • \??\c:\f1a80ecaa29c45fc8ce0\1028\LocalizedData.xml

          Filesize

          29KB

          MD5

          12df3535e4c4ef95a8cb03fd509b5874

          SHA1

          90b1f87ba02c1c89c159ebf0e1e700892b85dc39

          SHA256

          1c8132747dc33ccdb02345cbe706e65089a88fe32cf040684ca0d72bb9105119

          SHA512

          c6c8887e7023c4c1cbf849eebd17b6ad68fc14607d1c32c0d384f951e07bfaf6b61e0639f4e5978c9e3e1d52ef8a383b62622018a26fa4066eb620f584030808

        • \??\c:\f1a80ecaa29c45fc8ce0\1031\LocalizedData.xml

          Filesize

          40KB

          MD5

          b13ff959adc5c3e9c4ba4c4a76244464

          SHA1

          4df793626f41b92a5bc7c54757658ce30fdaeeb1

          SHA256

          44945bc0ba4be653d07f53e736557c51164224c8ec4e4672dfae1280260ba73b

          SHA512

          de78542d3bbc4c46871a8afb50fb408a59a76f6ed67e8be3cba8ba41724ea08df36400e233551b329277a7a0fe6168c5556abe9d9a735f41b29a941250bfc4d6

        • \??\c:\f1a80ecaa29c45fc8ce0\1033\LocalizedData.xml

          Filesize

          38KB

          MD5

          5486ff60b072102ee3231fd743b290a1

          SHA1

          d8d8a1d6bf6adf1095158b3c9b0a296a037632d0

          SHA256

          5ca3ecaa12ca56f955d403ca93c4cb36a7d3dcdea779fc9bdaa0cdd429dab706

          SHA512

          ae240eaac32edb18fd76982fc01e03bd9c8e40a9ec1b9c42d7ebd225570b7517949e045942dbb9e40e620aa9dcc9fbe0182c6cf207ac0a44d7358ad33ba81472

        • \??\c:\f1a80ecaa29c45fc8ce0\1033\SetupResources.dll

          Filesize

          16KB

          MD5

          0b4e76baf52d580f657f91972196cd91

          SHA1

          e6ac8f80ab8ade18ac7e834ac6d0536bb483988c

          SHA256

          74a7767d8893dcc1a745522d5a509561162f95bc9e8bcc3056f37a367dba64a4

          SHA512

          ed53292c549d09da9118e944a646aa5dc0a6231811eafcda4258c892b218bcf3e0363a2c974868d2d2722155983c5dc8e29bed36d58e566e1695e23ce07fea87

        • \??\c:\f1a80ecaa29c45fc8ce0\1036\LocalizedData.xml

          Filesize

          40KB

          MD5

          30dd04ce53b3f5d9363ade0359e3e0b2

          SHA1

          56bc3301013a2d0b08ecd38ff0a22b1040ef558e

          SHA256

          bf03073e0e939f3598aeb9aa19b655a24c4ad31f96065d6dc60f7c4df78653ba

          SHA512

          9cb1ff9ba0dc018f9e1bd301fbcb9e5c561f6a14c65290ebc0fe67cbdf59d1a09898a2f802c52339c10942c819ebb4bdd8b4c7f5f4f78af95f7c893641e41a34

        • \??\c:\f1a80ecaa29c45fc8ce0\1040\LocalizedData.xml

          Filesize

          39KB

          MD5

          fe6b23186c2d77f7612bf7b1018a9b2a

          SHA1

          1528ec7633e998f040d2d4c37ac8a7dc87f99817

          SHA256

          03bbe1a39c6716f07703d20ed7539d8bf13b87870c2c83ddda5445c82953a80a

          SHA512

          40c9c9f3607cab24655593fc4766829516de33f13060be09f5ee65578824ac600cc1c07fe71cdd48bff7f52b447ff37c0d161d755a69ac7db7df118da6db7649

        • \??\c:\f1a80ecaa29c45fc8ce0\1041\LocalizedData.xml

          Filesize

          33KB

          MD5

          6f86b79dbf15e810331df2ca77f1043a

          SHA1

          875ed8498c21f396cc96b638911c23858ece5b88

          SHA256

          f0f9dd1a9f164f4d2e73b4d23cc5742da2c39549b9c4db692283839c5313e04f

          SHA512

          ca233a6bf55e253ebf1e8180a326667438e1124f6559054b87021095ef16ffc6b0c87361e0922087be4ca9cabd10828be3b6cc12c4032cb7f2a317fdbd76f818

        • \??\c:\f1a80ecaa29c45fc8ce0\1042\LocalizedData.xml

          Filesize

          32KB

          MD5

          e87ad0b3bf73f3e76500f28e195f7dc0

          SHA1

          716b842f6fbf6c68dc9c4e599c8182bfbb1354dc

          SHA256

          43b351419b73ac266c4b056a9c3a92f6dfa654328163814d17833a837577c070

          SHA512

          d3ea8655d42a2b0938c2189ceeab25c29939c302c2e2205e05d6059afc2a9b2039b21c083a7c17da1ce5eebdc934ff327a452034e2e715e497bcd6239395774c

        • \??\c:\f1a80ecaa29c45fc8ce0\1049\LocalizedData.xml

          Filesize

          39KB

          MD5

          1290be72ed991a3a800a6b2a124073b2

          SHA1

          dac09f9f2ccb3b273893b653f822e3dfc556d498

          SHA256

          6ba9a2e4a6a58f5bb792947990e51babd9d5151a7057e1a051cb007fea2eb41c

          SHA512

          c0b8b4421fcb2aabe2c8c8773fd03842e3523bf2b75d6262fd8bd952adc12c06541bdae0219e89f9f9f8d79567a4fe4dff99529366c4a7c5bf66c218431f3217

        • \??\c:\f1a80ecaa29c45fc8ce0\2052\LocalizedData.xml

          Filesize

          30KB

          MD5

          150b5c3d1b452dccbe8f1313fda1b18c

          SHA1

          7128b6b9e84d69c415808f1d325dd969b17914cc

          SHA256

          6d4eb9dca1cbcd3c2b39a993133731750b9fdf5988411f4a6da143b9204c01f2

          SHA512

          a45a1f4f19a27558e08939c7f63894ff5754e6840db86b8c8c68d400a36fb23179caff164d8b839898321030469b56446b5a8efc5765096dee5e8a746351e949

        • \??\c:\f1a80ecaa29c45fc8ce0\3082\LocalizedData.xml

          Filesize

          39KB

          MD5

          05a95593c61c744759e52caf5e13502e

          SHA1

          0054833d8a7a395a832e4c188c4d012301dd4090

          SHA256

          1a3e5e49da88393a71ea00d73fee7570e40edb816b72622e39c7fcd09c95ead1

          SHA512

          00aee4c02f9d6374560f7d2b826503aab332e1c4bc3203f88fe82e905471ec43f92f4af4fc52e46f377e4d297c2be99daf94980df2ce7664c169552800264fd3

        • \??\c:\f1a80ecaa29c45fc8ce0\DHTMLHeader.html

          Filesize

          15KB

          MD5

          cd131d41791a543cc6f6ed1ea5bd257c

          SHA1

          f42a2708a0b42a13530d26515274d1fcdbfe8490

          SHA256

          e139af8858fe90127095ac1c4685bcd849437ef0df7c416033554703f5d864bb

          SHA512

          a6ee9af8f8c2c7acd58dd3c42b8d70c55202b382ffc5a93772af7bf7d7740c1162bb6d38a4307b1802294a18eb52032d410e128072af7d4f9d54f415be020c9a

        • \??\c:\f1a80ecaa29c45fc8ce0\ParameterInfo.xml

          Filesize

          21KB

          MD5

          5674d0bc3f4cdf572b9263332b2942c7

          SHA1

          495c5ba176fe6a6cbd4c0d9b85c2d886de1be968

          SHA256

          cbe5b9a27b1dde70a9040790eaff798e6534ff1ec2b4702cc4be7221d18d2182

          SHA512

          22d35950ee4291e42107a8b2d1fd1f305dcde9306480549b639f5c504247cfb73ba287f20e3e5232b3c35294176b0b3dbdc03c948561e90db0f22635efce7685

        • \??\c:\f1a80ecaa29c45fc8ce0\SetupEngine.dll

          Filesize

          789KB

          MD5

          63e7901d4fa7ac7766076720272060d0

          SHA1

          72dec0e4e12255d98ccd49937923c7b5590bbfac

          SHA256

          a5116ccb17b242713e5645c2374abf5827c0d2752b31553e3540c9123812e952

          SHA512

          de2e63bc090121484191cbf23194361d761b01c0fd332f35f0dfdfd0b11431b529e5c7f542031a0e7e26f31497d94b8baacfbf1c84c6493e66ac2ab76c11d0a0

        • \??\c:\f1a80ecaa29c45fc8ce0\SetupUi.dll

          Filesize

          288KB

          MD5

          0d214ced87bf0b55883359160a68dacb

          SHA1

          a60526505d56d447c6bbde03da980db67062c4c6

          SHA256

          29cf99d7e67b4c54bafd109577a385387a39301bcdec8ae4ba1a8a0044306713

          SHA512

          d9004ebd42d4aa7d13343b3746cf454ca1a5144f7b0f437f1a31639cc6bd90c5dd3385612df926bf53c3ef85cfe33756c067cb757fff257d674a10d638fc03c5

        • \??\c:\f1a80ecaa29c45fc8ce0\SetupUi.xsd

          Filesize

          29KB

          MD5

          2fadd9e618eff8175f2a6e8b95c0cacc

          SHA1

          9ab1710a217d15b192188b19467932d947b0a4f8

          SHA256

          222211e8f512edf97d78bc93e1f271c922d5e91fa899e092b4a096776a704093

          SHA512

          a3a934a8572ff9208d38cf381649bd83de227c44b735489fd2a9dc5a636ead9bb62459c9460ee53f61f0587a494877cd3a3c2611997be563f3137f8236ffc4ca

        • \??\c:\f1a80ecaa29c45fc8ce0\Strings.xml

          Filesize

          13KB

          MD5

          332adf643747297b9bfa9527eaefe084

          SHA1

          670f933d778eca39938a515a39106551185205e9

          SHA256

          e49545feeae22198728ad04236e31e02035af7cc4d68e10cbecffd08669cbeca

          SHA512

          bea95ce35c4c37b4b2e36cc1e81fc297cc4a8e17b93f10423a02b015ddb593064541b5eb7003560fbeee512ed52869a113a6fb439c1133af01f884a0db0344b0

        • \??\c:\f1a80ecaa29c45fc8ce0\UiInfo.xml

          Filesize

          35KB

          MD5

          4f90fcef3836f5fc49426ad9938a1c60

          SHA1

          89eba3b81982d5d5c457ffa7a7096284a10de64a

          SHA256

          66a0299ce7ee12dd9fc2cfead3c3211e59bfb54d6c0627d044d44cef6e70367b

          SHA512

          4ce2731c1d32d7ca3a4f644f4b3111f06223de96c1e241fcc86f5fe665f4db18c8a241dae4e8a7e278d6afbf91b235a2c3517a40d4d22d9866880e19a7221160

        • \??\c:\f1a80ecaa29c45fc8ce0\graphics\Rotate1.ico

          Filesize

          894B

          MD5

          26a00597735c5f504cf8b3e7e9a7a4c1

          SHA1

          d913cb26128d5ca1e1ac3dab782de363c9b89934

          SHA256

          37026c4ea2182d7908b3cf0cef8a6f72bddca5f1cfbc702f35b569ad689cf0af

          SHA512

          08cefc5a2b625f261668f70cc9e1536dc4878d332792c751884526e49e7fee1ecfa6fccfddf7be80910393421cc088c0fd0b0c27c7a7eff2ae03719e06022fdf

        • \??\c:\f1a80ecaa29c45fc8ce0\graphics\Rotate2.ico

          Filesize

          894B

          MD5

          8419caa81f2377e09b7f2f6218e505ae

          SHA1

          2cf5ad8c8da4f1a38aab433673f4dddc7ae380e9

          SHA256

          db89d8a45c369303c04988322b2774d2c7888da5250b4dab2846deef58a7de22

          SHA512

          74e504d2c3a8e82925110b7cfb45fde8a4e6df53a188e47cf22d664cbb805eba749d2db23456fc43a86e57c810bc3d9166e7c72468fbd736da6a776f8ca015d1

        • \??\c:\f1a80ecaa29c45fc8ce0\graphics\Rotate3.ico

          Filesize

          894B

          MD5

          924fd539523541d42dad43290e6c0db5

          SHA1

          19a161531a2c9dbc443b0f41b97cbde7375b8983

          SHA256

          02a7fe932029c6fa24d1c7cc06d08a27e84f43a0cbc47b7c43cac59424b3d1f6

          SHA512

          86a4c5d981370efa20183cc4a52c221467692e91539ac38c8def1cc200140f6f3d9412b6e62faf08ca6668df401d8b842c61b1f3c2a4c4570f3b2cec79c9ee8b

        • \??\c:\f1a80ecaa29c45fc8ce0\graphics\Rotate4.ico

          Filesize

          894B

          MD5

          bb55b5086a9da3097fb216c065d15709

          SHA1

          1206c708bd08231961f17da3d604a8956addccfe

          SHA256

          8d82ff7970c9a67da8134686560fe3a6c986a160ced9d1cc1392f2ba75c698ab

          SHA512

          de9226064680da6696976a4a320e08c41f73d127fbb81bf142048996df6206ddb1c2fe347c483cc8e0e50a00dab33db9261d03f1cd7ca757f5ca7bb84865fca9

        • \??\c:\f1a80ecaa29c45fc8ce0\graphics\Rotate5.ico

          Filesize

          894B

          MD5

          3b4861f93b465d724c60670b64fccfcf

          SHA1

          c672d63c62e00e24fbb40da96a0cc45b7c5ef7f0

          SHA256

          7237051d9af5db972a1fecf0b35cd8e9021471740782b0dbf60d3801dc9f5f75

          SHA512

          2e798b0c9e80f639571525f39c2f50838d5244eeda29b18a1fae6c15d939d5c8cd29f6785d234b54bda843a645d1a95c7339707991a81946b51f7e8d5ed40d2c

        • \??\c:\f1a80ecaa29c45fc8ce0\graphics\Rotate6.ico

          Filesize

          894B

          MD5

          70006bf18a39d258012875aefb92a3d1

          SHA1

          b47788f3f8c5c305982eb1d0e91c675ee02c7beb

          SHA256

          19abcedf93d790e19fb3379cb3b46371d3cbff48fe7e63f4fdcc2ac23a9943e4

          SHA512

          97fdbdd6efadbfb08161d8546299952470228a042bd2090cd49896bc31ccb7c73dab8f9de50cdaf6459f7f5c14206af7b90016deeb1220943d61c7324541fe2c

        • \??\c:\f1a80ecaa29c45fc8ce0\graphics\Rotate7.ico

          Filesize

          894B

          MD5

          fb4dfebe83f554faf1a5cec033a804d9

          SHA1

          6c9e509a5d1d1b8d495bbc8f57387e1e7e193333

          SHA256

          4f46a9896de23a92d2b5f963bcfb3237c3e85da05b8f7660641b3d1d5afaae6f

          SHA512

          3caeb21177685b9054b64dec997371c4193458ff8607bce67e4fbe72c4af0e6808d344dd0d59d3d0f5ce00e4c2b8a4ffca0f7d9352b0014b9259d76d7f03d404

        • \??\c:\f1a80ecaa29c45fc8ce0\graphics\Rotate8.ico

          Filesize

          894B

          MD5

          d1c53003264dce4effaf462c807e2d96

          SHA1

          92562ad5876a5d0cb35e2d6736b635cb5f5a91d9

          SHA256

          5fb03593071a99c7b3803fe8424520b8b548b031d02f2a86e8f5412ac519723c

          SHA512

          c34f8c05a50dc0de644d1f9d97696cdb0a1961c7c7e412eb3df2fd57bbd34199cf802962ca6a4b5445a317d9c7875e86e8e62f6c1df8cc3415afc0bd26e285bd

        • \??\c:\f1a80ecaa29c45fc8ce0\graphics\SysReqMet.ico

          Filesize

          1KB

          MD5

          661cbd315e9b23ba1ca19edab978f478

          SHA1

          605685c25d486c89f872296583e1dc2f20465a2b

          SHA256

          8bfc77c6d0f27f3d0625a884e0714698acc0094a92adcb6de46990735ae8f14d

          SHA512

          802cc019f07fd3b78fcefdc8404b3beb5d17bfc31bded90d42325a138762cc9f9ebfd1b170ec4bbcccf9b99773bd6c8916f2c799c54b22ff6d5edd9f388a67c6

        • \??\c:\f1a80ecaa29c45fc8ce0\graphics\SysReqNotMet.ico

          Filesize

          1KB

          MD5

          ee2c05cc9d14c29f586d40eb90c610a9

          SHA1

          e571d82e81bd61b8fe4c9ecd08869a07918ac00b

          SHA256

          3c9c71950857ddb82baab83ed70c496dee8f20f3bc3216583dc1ddda68aefc73

          SHA512

          0f38fe9c97f2518186d5147d2c4a786b352fceca234410a94cc9d120974fc4be873e39956e10374da6e8e546aea5689e7fa0beed025687547c430e6ceffabffb

        • \??\c:\f1a80ecaa29c45fc8ce0\graphics\print.ico

          Filesize

          1KB

          MD5

          7e55ddc6d611176e697d01c90a1212cf

          SHA1

          e2620da05b8e4e2360da579a7be32c1b225deb1b

          SHA256

          ff542e32330b123486797b410621e19eafb39df3997e14701afa4c22096520ed

          SHA512

          283d381aa396820b7e15768b20099d67688da1f6315ec9f7938c2fcc3167777502cded0d1beddf015a34cc4e5d045bcb665ffd28ba2fbb6faf50fdd38b31d16e

        • \??\c:\f1a80ecaa29c45fc8ce0\graphics\save.ico

          Filesize

          1KB

          MD5

          7d62e82d960a938c98da02b1d5201bd5

          SHA1

          194e96b0440bf8631887e5e9d3cc485f8e90fbf5

          SHA256

          ae041c8764f56fd89277b34982145d16fc59a4754d261c861b19371c3271c6e5

          SHA512

          ab06b2605f0c1f6b71ef69563c0c977d06c6ea84d58ef7f2baecba566d6037d1458c2b58e6bfd70ddef47dccbdea6d9c2f2e46dea67ea9e92457f754d7042f67

        • \??\c:\f1a80ecaa29c45fc8ce0\graphics\setup.ico

          Filesize

          35KB

          MD5

          3d25d679e0ff0b8c94273dcd8b07049d

          SHA1

          a517fc5e96bc68a02a44093673ee7e076ad57308

          SHA256

          288e9ad8f0201e45bc187839f15aca79d6b9f76a7d3c9274c80f5d4a4c219c0f

          SHA512

          3bde668004ca7e28390862d0ae9903c756c16255bdbb3f7e73a5b093ce6a57a3165d6797b0a643b254493149231aca7f7f03e0af15a0cbe28aff02f0071ec255

        • \??\c:\f1a80ecaa29c45fc8ce0\header.bmp

          Filesize

          7KB

          MD5

          3ad1a8c3b96993bcdf45244be2c00eef

          SHA1

          308f98e199f74a43d325115a8e7072d5f2c6202d

          SHA256

          133b86a4f1c67a159167489fdaeab765bfa1050c23a7ae6d5c517188fb45f94a

          SHA512

          133442c4a65269f817675adf01adcf622e509aa7ec7583bca8cd9a7eb6018d2aab56066054f75657038efb947cd3b3e5dc4fe7f0863c8b3b1770a8fa4fe2e658

        • \??\c:\f1a80ecaa29c45fc8ce0\msp_kb2565063.msp

          Filesize

          4.4MB

          MD5

          905fcc526204ddf1e6650212abc3d848

          SHA1

          aded77f45b75d796cc4795263c826c822df5f0d9

          SHA256

          4cd45cf57644d49b4c8f96e4a0efdc46a5ba196fa4f5a10190f790ccc74bb1bf

          SHA512

          9470fcd540ea542936120782aa31abecaf5d20cadd13ff82ad346f78f95020958937beb2bfcf5ea4de92c978338f5a324e334229c79f8166c66a1465e191ba47

        • \??\c:\f1a80ecaa29c45fc8ce0\vc_red.cab

          Filesize

          4.7MB

          MD5

          c2b6838431748d42e247c574a191b2c2

          SHA1

          f01c1a083c158d9470da3919b461938560e90874

          SHA256

          387e94a26165e4e5f035d89f9c6589a8a9d223978abbcc728b4c45c0115267a6

          SHA512

          5cf95c3cbe10a75360bc4d02840e196c919bcd2fd42ba86192d25d781d00e8019217a9c8829f51a2924d8c95bd48e06728a3530e3344000cac79c4b0e7faff91

        • \??\c:\f1a80ecaa29c45fc8ce0\vc_red.msi

          Filesize

          173KB

          MD5

          8f21bc0dc9e66f8e9d94197ae76698b3

          SHA1

          b48a08fde80f739657b819b94602f861f3ff57a4

          SHA256

          5763364634bdb2097b6df6cde79ac5cce6069acecf27254c589e3cabffe53c2b

          SHA512

          88fd8870bc0f5dbdd2cb4a6a97cf4b1ab81d7ff77c2b2a4d1f6b34a730d0347a5022ecc8ca5b2e7c5f7c2cbe0486d5046cfafcb8167e001e1ac5e1797d03278a

        • \??\c:\f1a80ecaa29c45fc8ce0\watermark.bmp

          Filesize

          301KB

          MD5

          1a5caafacfc8c7766e404d019249cf67

          SHA1

          35d4878db63059a0f25899f4be00b41f430389bf

          SHA256

          2e87d5742413254db10f7bd0762b6cdb98ff9c46ca9acddfd9b1c2e5418638f2

          SHA512

          202c13ded002d234117f08b18ca80d603246e6a166e18ba422e30d394ada7e47153dd3cce9728affe97128fdd797fe6302c74dc6882317e2ba254c8a6db80f46

        • memory/2516-107-0x0000000002E00000-0x0000000002E01000-memory.dmp

          Filesize

          4KB