0ffb06b7e5f65c17f974e200c9acf13e2acc3bb2c2f5dc9b17f14018cf0f47c7

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-en-20211208
submitted
20-12-2021 04:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6851ee86ef723624b9d8bb881188b745.exe
Size

5.4MB
MD5

6851ee86ef723624b9d8bb881188b745
SHA1

bd1354f4b1679b4b5aa79bb3af38d3e041ebd24c
SHA256

0ffb06b7e5f65c17f974e200c9acf13e2acc3bb2c2f5dc9b17f14018cf0f47c7
SHA512

24ca73eb150904362a14577bbbd88f585412f1b1e660631ae7614d80d0dbea58d877548d8f816e56d76933bdc8af734051183624e728b2653a59713f7e75c7fa

Score

9^/10

evasion themida trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497
Blocklisted process makes network request 4 IoCs

Processes:

WScript.exe

flow pid process

13 1180 WScript.exe
14 1180 WScript.exe
15 1180 WScript.exe
16 1180 WScript.exe
Executes dropped EXE 3 IoCs

Processes:

edenic.exegodwitvp.exeDpEditor.exe

pid process

952 edenic.exe
1076 godwitvp.exe
1496 DpEditor.exe

flow	pid	process
13	1180	WScript.exe
14	1180	WScript.exe
15	1180	WScript.exe
16	1180	WScript.exe

pid	process
952	edenic.exe
1076	godwitvp.exe
1496	DpEditor.exe

Checks BIOS information in registry 2 TTPs 6 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

edenic.exeDpEditor.exegodwitvp.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	edenic.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	DpEditor.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	DpEditor.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	godwitvp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	godwitvp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	edenic.exe

Loads dropped DLL 10 IoCs

Processes:

6851ee86ef723624b9d8bb881188b745.exeedenic.exegodwitvp.exeDpEditor.exe

pid	process
1676	6851ee86ef723624b9d8bb881188b745.exe
1676	6851ee86ef723624b9d8bb881188b745.exe
952	edenic.exe
952	edenic.exe
1676	6851ee86ef723624b9d8bb881188b745.exe
1076	godwitvp.exe
1076	godwitvp.exe
952	edenic.exe
1496	DpEditor.exe
1496	DpEditor.exe

Themida packer 27 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\gustus\edenic.exe	themida
C:\Users\Admin\AppData\Local\Temp\gustus\edenic.exe	themida
C:\Users\Admin\AppData\Local\Temp\gustus\edenic.exe	themida
\Users\Admin\AppData\Local\Temp\gustus\edenic.exe	themida
\Users\Admin\AppData\Local\Temp\gustus\edenic.exe	themida
C:\Users\Admin\AppData\Local\Temp\gustus\godwitvp.exe	themida
\Users\Admin\AppData\Local\Temp\gustus\godwitvp.exe	themida
\Users\Admin\AppData\Local\Temp\gustus\godwitvp.exe	themida
\Users\Admin\AppData\Local\Temp\gustus\godwitvp.exe	themida
C:\Users\Admin\AppData\Local\Temp\gustus\godwitvp.exe	themida
behavioral1/memory/952-72-0x00000000002E0000-0x00000000009CB000-memory.dmp	themida
behavioral1/memory/1076-71-0x0000000001310000-0x00000000019DD000-memory.dmp	themida
behavioral1/memory/1076-73-0x0000000001310000-0x00000000019DD000-memory.dmp	themida
behavioral1/memory/952-74-0x00000000002E0000-0x00000000009CB000-memory.dmp	themida
behavioral1/memory/1076-75-0x0000000001310000-0x00000000019DD000-memory.dmp	themida
behavioral1/memory/952-76-0x00000000002E0000-0x00000000009CB000-memory.dmp	themida
behavioral1/memory/1076-77-0x0000000001310000-0x00000000019DD000-memory.dmp	themida
behavioral1/memory/952-78-0x00000000002E0000-0x00000000009CB000-memory.dmp	themida
\Users\Admin\AppData\Roaming\NCH Software\DrawPad\DpEditor.exe	themida
\Users\Admin\AppData\Roaming\NCH Software\DrawPad\DpEditor.exe	themida
\Users\Admin\AppData\Roaming\NCH Software\DrawPad\DpEditor.exe	themida
C:\Users\Admin\AppData\Roaming\NCH Software\DrawPad\DpEditor.exe	themida
C:\Users\Admin\AppData\Roaming\NCH Software\DrawPad\DpEditor.exe	themida
behavioral1/memory/1496-89-0x00000000002F0000-0x00000000009DB000-memory.dmp	themida
behavioral1/memory/1496-90-0x00000000002F0000-0x00000000009DB000-memory.dmp	themida
behavioral1/memory/1496-92-0x00000000002F0000-0x00000000009DB000-memory.dmp	themida
behavioral1/memory/1496-91-0x00000000002F0000-0x00000000009DB000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 3 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

godwitvp.exeDpEditor.exeedenic.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	godwitvp.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	DpEditor.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	edenic.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 ip-api.com
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

Processes:

godwitvp.exeedenic.exeDpEditor.exe

pid process

1076 godwitvp.exe
952 edenic.exe
1496 DpEditor.exe

flow	ioc
4	ip-api.com

pid	process
1076	godwitvp.exe
952	edenic.exe
1496	DpEditor.exe

Drops file in Program Files directory 3 IoCs

Processes:

6851ee86ef723624b9d8bb881188b745.exe

description	ioc	process
File created	C:\Program Files (x86)\foler\olader\acledit.dll	6851ee86ef723624b9d8bb881188b745.exe
File created	C:\Program Files (x86)\foler\olader\acppage.dll	6851ee86ef723624b9d8bb881188b745.exe
File created	C:\Program Files (x86)\foler\olader\adprovider.dll	6851ee86ef723624b9d8bb881188b745.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

godwitvp.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	godwitvp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	godwitvp.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

DpEditor.exe

pid process

1496 DpEditor.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

edenic.exegodwitvp.exeDpEditor.exe

pid process

952 edenic.exe
1076 godwitvp.exe
1496 DpEditor.exe

pid	process
1496	DpEditor.exe

pid	process
952	edenic.exe
1076	godwitvp.exe
1496	DpEditor.exe

Suspicious use of WriteProcessMemory 35 IoCs

Processes:

6851ee86ef723624b9d8bb881188b745.exegodwitvp.exeedenic.exe

description	pid	process	target process
PID 1676 wrote to memory of 952	1676	6851ee86ef723624b9d8bb881188b745.exe	edenic.exe
PID 1676 wrote to memory of 952	1676	6851ee86ef723624b9d8bb881188b745.exe	edenic.exe
PID 1676 wrote to memory of 952	1676	6851ee86ef723624b9d8bb881188b745.exe	edenic.exe
PID 1676 wrote to memory of 952	1676	6851ee86ef723624b9d8bb881188b745.exe	edenic.exe
PID 1676 wrote to memory of 952	1676	6851ee86ef723624b9d8bb881188b745.exe	edenic.exe
PID 1676 wrote to memory of 952	1676	6851ee86ef723624b9d8bb881188b745.exe	edenic.exe
PID 1676 wrote to memory of 952	1676	6851ee86ef723624b9d8bb881188b745.exe	edenic.exe
PID 1676 wrote to memory of 1076	1676	6851ee86ef723624b9d8bb881188b745.exe	godwitvp.exe
PID 1676 wrote to memory of 1076	1676	6851ee86ef723624b9d8bb881188b745.exe	godwitvp.exe
PID 1676 wrote to memory of 1076	1676	6851ee86ef723624b9d8bb881188b745.exe	godwitvp.exe
PID 1676 wrote to memory of 1076	1676	6851ee86ef723624b9d8bb881188b745.exe	godwitvp.exe
PID 1676 wrote to memory of 1076	1676	6851ee86ef723624b9d8bb881188b745.exe	godwitvp.exe
PID 1676 wrote to memory of 1076	1676	6851ee86ef723624b9d8bb881188b745.exe	godwitvp.exe
PID 1676 wrote to memory of 1076	1676	6851ee86ef723624b9d8bb881188b745.exe	godwitvp.exe
PID 1076 wrote to memory of 1124	1076	godwitvp.exe	WScript.exe
PID 1076 wrote to memory of 1124	1076	godwitvp.exe	WScript.exe
PID 1076 wrote to memory of 1124	1076	godwitvp.exe	WScript.exe
PID 1076 wrote to memory of 1124	1076	godwitvp.exe	WScript.exe
PID 1076 wrote to memory of 1124	1076	godwitvp.exe	WScript.exe
PID 1076 wrote to memory of 1124	1076	godwitvp.exe	WScript.exe
PID 1076 wrote to memory of 1124	1076	godwitvp.exe	WScript.exe
PID 952 wrote to memory of 1496	952	edenic.exe	DpEditor.exe
PID 952 wrote to memory of 1496	952	edenic.exe	DpEditor.exe
PID 952 wrote to memory of 1496	952	edenic.exe	DpEditor.exe
PID 952 wrote to memory of 1496	952	edenic.exe	DpEditor.exe
PID 952 wrote to memory of 1496	952	edenic.exe	DpEditor.exe
PID 952 wrote to memory of 1496	952	edenic.exe	DpEditor.exe
PID 952 wrote to memory of 1496	952	edenic.exe	DpEditor.exe
PID 1076 wrote to memory of 1180	1076	godwitvp.exe	WScript.exe
PID 1076 wrote to memory of 1180	1076	godwitvp.exe	WScript.exe
PID 1076 wrote to memory of 1180	1076	godwitvp.exe	WScript.exe
PID 1076 wrote to memory of 1180	1076	godwitvp.exe	WScript.exe
PID 1076 wrote to memory of 1180	1076	godwitvp.exe	WScript.exe
PID 1076 wrote to memory of 1180	1076	godwitvp.exe	WScript.exe
PID 1076 wrote to memory of 1180	1076	godwitvp.exe	WScript.exe

C:\Users\Admin\AppData\Local\Temp\6851ee86ef723624b9d8bb881188b745.exe
"C:\Users\Admin\AppData\Local\Temp\6851ee86ef723624b9d8bb881188b745.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1676

C:\Users\Admin\AppData\Local\Temp\gustus\edenic.exe
"C:\Users\Admin\AppData\Local\Temp\gustus\edenic.exe"
2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:952

C:\Users\Admin\AppData\Roaming\NCH Software\DrawPad\DpEditor.exe
"C:\Users\Admin\AppData\Roaming\NCH Software\DrawPad\DpEditor.exe"
3⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
PID:1496

C:\Users\Admin\AppData\Local\Temp\gustus\godwitvp.exe
"C:\Users\Admin\AppData\Local\Temp\gustus\godwitvp.exe"
2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1076

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\chdloox.vbs"
3⤵
PID:1124

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\qhkoxidb.vbs"
3⤵
- Blocklisted process makes network request
PID:1180

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Web Service

T1102

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\chdloox.vbs
MD5
c485c68ea850a4bc1ef5eb2af8b6173b

SHA1
b71bac0cde6b707db0af1bce551f92bd33dc95d4

SHA256
0488f4bd11929a890f5a9806219641f64980edd323c297385de8326b069d8c9c

SHA512
ed59d12d0f7fc9e9bc26f99de33fca3315f743c17bd753397300750197a6e5c9b673582881d54cbedf5afac6e449bc0dbe6efc39036f556e198f79145799ba1a

Download Submit
C:\Users\Admin\AppData\Local\Temp\gustus\edenic.exe
MD5
c9bdb6ed5eb6da1c74b956937bbd31b4

SHA1
a9c6389196fa0c28b91b1802758981feee113031

SHA256
31eb4eec08c93c2770affd600e010182855e63322fba278afede89816faff6aa

SHA512
496657b02941e8548c397f9b59eeaa2671fa7921ac052d1b336147b881975bc47861da7a6c16c3a53e759704300cd66ce31ae1a3b286875bf5e563aa9a697295

Download Submit
C:\Users\Admin\AppData\Local\Temp\gustus\edenic.exe
MD5
c9bdb6ed5eb6da1c74b956937bbd31b4

SHA1
a9c6389196fa0c28b91b1802758981feee113031

SHA256
31eb4eec08c93c2770affd600e010182855e63322fba278afede89816faff6aa

SHA512
496657b02941e8548c397f9b59eeaa2671fa7921ac052d1b336147b881975bc47861da7a6c16c3a53e759704300cd66ce31ae1a3b286875bf5e563aa9a697295

Download Submit
C:\Users\Admin\AppData\Local\Temp\gustus\godwitvp.exe
MD5
adca6cddf728ac19287c8da0690ce78e

SHA1
3bc43b39ac78d1edebf83ae6a95108b95acdb439

SHA256
7aaf99f9ad42337851b40596faf2241ae2957048c2862aad402320312536c6d7

SHA512
81dcd61505a0ced122e7b0ca12dd3520a475025643c8ca109edfd13fd017740c7ad32f854c87ea87c3eabadc780c3c4b041b247888aa7f22ffd5714be4051140

Download Submit
C:\Users\Admin\AppData\Local\Temp\gustus\godwitvp.exe
MD5
adca6cddf728ac19287c8da0690ce78e

SHA1
3bc43b39ac78d1edebf83ae6a95108b95acdb439

SHA256
7aaf99f9ad42337851b40596faf2241ae2957048c2862aad402320312536c6d7

SHA512
81dcd61505a0ced122e7b0ca12dd3520a475025643c8ca109edfd13fd017740c7ad32f854c87ea87c3eabadc780c3c4b041b247888aa7f22ffd5714be4051140

Download Submit
C:\Users\Admin\AppData\Local\Temp\qhkoxidb.vbs
MD5
450b8ac6c7c2bb63af2e0db72dab7f9a

SHA1
399a2ae7b2cb70adfe27d0261e30313c560372e7

SHA256
9382a914059057dee0ce2092cef0098379ea59faf8b03737045ec0819e1be0df

SHA512
ed6813037fda0b6ee28c01e715c1e1ed0a5bde0fe2e82b72ba9a789283a63ccf85f2c4188fd24a364f0043ec514c94530154d8f3697dac4eb0582cd416a28b2f

Download Submit
C:\Users\Admin\AppData\Roaming\NCH Software\DrawPad\DpEditor.exe
MD5
c9bdb6ed5eb6da1c74b956937bbd31b4

SHA1
a9c6389196fa0c28b91b1802758981feee113031

SHA256
31eb4eec08c93c2770affd600e010182855e63322fba278afede89816faff6aa

SHA512
496657b02941e8548c397f9b59eeaa2671fa7921ac052d1b336147b881975bc47861da7a6c16c3a53e759704300cd66ce31ae1a3b286875bf5e563aa9a697295

Download Submit
C:\Users\Admin\AppData\Roaming\NCH Software\DrawPad\DpEditor.exe
MD5
c9bdb6ed5eb6da1c74b956937bbd31b4

SHA1
a9c6389196fa0c28b91b1802758981feee113031

SHA256
31eb4eec08c93c2770affd600e010182855e63322fba278afede89816faff6aa

SHA512
496657b02941e8548c397f9b59eeaa2671fa7921ac052d1b336147b881975bc47861da7a6c16c3a53e759704300cd66ce31ae1a3b286875bf5e563aa9a697295

Download Submit
\Users\Admin\AppData\Local\Temp\gustus\edenic.exe
MD5
c9bdb6ed5eb6da1c74b956937bbd31b4

SHA1
a9c6389196fa0c28b91b1802758981feee113031

SHA256
31eb4eec08c93c2770affd600e010182855e63322fba278afede89816faff6aa

SHA512
496657b02941e8548c397f9b59eeaa2671fa7921ac052d1b336147b881975bc47861da7a6c16c3a53e759704300cd66ce31ae1a3b286875bf5e563aa9a697295

Download Submit
\Users\Admin\AppData\Local\Temp\gustus\edenic.exe
MD5
c9bdb6ed5eb6da1c74b956937bbd31b4

SHA1
a9c6389196fa0c28b91b1802758981feee113031

SHA256
31eb4eec08c93c2770affd600e010182855e63322fba278afede89816faff6aa

SHA512
496657b02941e8548c397f9b59eeaa2671fa7921ac052d1b336147b881975bc47861da7a6c16c3a53e759704300cd66ce31ae1a3b286875bf5e563aa9a697295

Download Submit
\Users\Admin\AppData\Local\Temp\gustus\edenic.exe
MD5
c9bdb6ed5eb6da1c74b956937bbd31b4

SHA1
a9c6389196fa0c28b91b1802758981feee113031

SHA256
31eb4eec08c93c2770affd600e010182855e63322fba278afede89816faff6aa

SHA512
496657b02941e8548c397f9b59eeaa2671fa7921ac052d1b336147b881975bc47861da7a6c16c3a53e759704300cd66ce31ae1a3b286875bf5e563aa9a697295

Download Submit
\Users\Admin\AppData\Local\Temp\gustus\godwitvp.exe
MD5
adca6cddf728ac19287c8da0690ce78e

SHA1
3bc43b39ac78d1edebf83ae6a95108b95acdb439

SHA256
7aaf99f9ad42337851b40596faf2241ae2957048c2862aad402320312536c6d7

SHA512
81dcd61505a0ced122e7b0ca12dd3520a475025643c8ca109edfd13fd017740c7ad32f854c87ea87c3eabadc780c3c4b041b247888aa7f22ffd5714be4051140

Download Submit
\Users\Admin\AppData\Local\Temp\gustus\godwitvp.exe
MD5
adca6cddf728ac19287c8da0690ce78e

SHA1
3bc43b39ac78d1edebf83ae6a95108b95acdb439

SHA256
7aaf99f9ad42337851b40596faf2241ae2957048c2862aad402320312536c6d7

SHA512
81dcd61505a0ced122e7b0ca12dd3520a475025643c8ca109edfd13fd017740c7ad32f854c87ea87c3eabadc780c3c4b041b247888aa7f22ffd5714be4051140

Download Submit
\Users\Admin\AppData\Local\Temp\gustus\godwitvp.exe
MD5
adca6cddf728ac19287c8da0690ce78e

SHA1
3bc43b39ac78d1edebf83ae6a95108b95acdb439

SHA256
7aaf99f9ad42337851b40596faf2241ae2957048c2862aad402320312536c6d7

SHA512
81dcd61505a0ced122e7b0ca12dd3520a475025643c8ca109edfd13fd017740c7ad32f854c87ea87c3eabadc780c3c4b041b247888aa7f22ffd5714be4051140

Download Submit
\Users\Admin\AppData\Local\Temp\nsyF43F.tmp\UAC.dll
MD5
adb29e6b186daa765dc750128649b63d

SHA1
160cbdc4cb0ac2c142d361df138c537aa7e708c9

SHA256
2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08

SHA512
b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada

Download Submit
\Users\Admin\AppData\Roaming\NCH Software\DrawPad\DpEditor.exe
MD5
c9bdb6ed5eb6da1c74b956937bbd31b4

SHA1
a9c6389196fa0c28b91b1802758981feee113031

SHA256
31eb4eec08c93c2770affd600e010182855e63322fba278afede89816faff6aa

SHA512
496657b02941e8548c397f9b59eeaa2671fa7921ac052d1b336147b881975bc47861da7a6c16c3a53e759704300cd66ce31ae1a3b286875bf5e563aa9a697295

Download Submit
\Users\Admin\AppData\Roaming\NCH Software\DrawPad\DpEditor.exe
MD5
c9bdb6ed5eb6da1c74b956937bbd31b4

SHA1
a9c6389196fa0c28b91b1802758981feee113031

SHA256
31eb4eec08c93c2770affd600e010182855e63322fba278afede89816faff6aa

SHA512
496657b02941e8548c397f9b59eeaa2671fa7921ac052d1b336147b881975bc47861da7a6c16c3a53e759704300cd66ce31ae1a3b286875bf5e563aa9a697295

Download Submit
\Users\Admin\AppData\Roaming\NCH Software\DrawPad\DpEditor.exe
MD5
c9bdb6ed5eb6da1c74b956937bbd31b4

SHA1
a9c6389196fa0c28b91b1802758981feee113031

SHA256
31eb4eec08c93c2770affd600e010182855e63322fba278afede89816faff6aa

SHA512
496657b02941e8548c397f9b59eeaa2671fa7921ac052d1b336147b881975bc47861da7a6c16c3a53e759704300cd66ce31ae1a3b286875bf5e563aa9a697295

Download Submit
memory/952-72-0x00000000002E0000-0x00000000009CB000-memory.dmp

Filesize
6.9MB

Download
memory/952-58-0x0000000000000000-mapping.dmp

Download
memory/952-74-0x00000000002E0000-0x00000000009CB000-memory.dmp

Filesize
6.9MB

Download
memory/952-76-0x00000000002E0000-0x00000000009CB000-memory.dmp

Filesize
6.9MB

Download
memory/952-78-0x00000000002E0000-0x00000000009CB000-memory.dmp

Filesize
6.9MB

Download
memory/1076-65-0x0000000000000000-mapping.dmp

Download
memory/1076-77-0x0000000001310000-0x00000000019DD000-memory.dmp

Filesize
6.8MB

Download
memory/1076-75-0x0000000001310000-0x00000000019DD000-memory.dmp

Filesize
6.8MB

Download
memory/1076-73-0x0000000001310000-0x00000000019DD000-memory.dmp

Filesize
6.8MB

Download
memory/1076-71-0x0000000001310000-0x00000000019DD000-memory.dmp

Filesize
6.8MB

Download
memory/1124-79-0x0000000000000000-mapping.dmp

Download
memory/1180-93-0x0000000000000000-mapping.dmp

Download
memory/1496-83-0x0000000000000000-mapping.dmp

Download
memory/1496-89-0x00000000002F0000-0x00000000009DB000-memory.dmp

Filesize
6.9MB

Download
memory/1496-90-0x00000000002F0000-0x00000000009DB000-memory.dmp

Filesize
6.9MB

Download
memory/1496-92-0x00000000002F0000-0x00000000009DB000-memory.dmp

Filesize
6.9MB

Download
memory/1496-91-0x00000000002F0000-0x00000000009DB000-memory.dmp

Filesize
6.9MB

Download
memory/1676-55-0x0000000075021000-0x0000000075023000-memory.dmp

Filesize
8KB

Download