Behavioral Report

Analysis

max time kernel
446s
max time network
432s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
12-03-2023 02:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

paint.net.5.0.2.install.anycpu.web.exe
Size

1MB
MD5

6a5e8c6eec9ab6ed7088bc35739e52d5
SHA1

be77e05970628d62c65b0bd609ef7ab5bb705c8f
SHA256

9d3edf7ade8ce94aaa6038e894562229e002a86840835e573caf1116e7b928a5
SHA512

e56e5356bee8d6d942f1bee7acd0a31fa03f51a7614df6f7bcdec89ec26cc3e7ea686892325938e7156f23c78814e0a9f04eeff255853939b157004ed6c12ed0
SSDEEP

24576:7rYYYYkWYCzwLhA29pQCo7jIC0BuDgwf0z:7rYYYYkvLhA29piUDjwe

Score

9^/10

coreentity discovery evasion persistence trojan

Malware Config

Signatures

CoreEntity .NET Packer 1 IoCs
A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.
coreentity

Processes:

resource yara_rule

behavioral2/files/0x00060000000233b2-1750.dat coreentity

resource	yara_rule
behavioral2/files/0x00060000000233b2-1750.dat	coreentity

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

paint.net.5.0.2.install.anycpu.web.exepaint.net.5.0.2.install.x64.exeSetupFrontEnd.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	paint.net.5.0.2.install.anycpu.web.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	paint.net.5.0.2.install.x64.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	SetupFrontEnd.exe

Executes dropped EXE 7 IoCs

Processes:

SetupShim.exeSetupDownloader.exepaint.net.5.0.2.install.x64.exeSetupShim.exeSetupFrontEnd.exepaintdotnet.exePaintDotNet.exe

pid	process
4840	SetupShim.exe
464	SetupDownloader.exe
3448	paint.net.5.0.2.install.x64.exe
2840	SetupShim.exe
4860	SetupFrontEnd.exe
2860	paintdotnet.exe
468	PaintDotNet.exe

Loads dropped DLL 64 IoCs

Processes:

SetupFrontEnd.exepaintdotnet.exe

pid	process
4860	SetupFrontEnd.exe
4860	SetupFrontEnd.exe
4860	SetupFrontEnd.exe
4860	SetupFrontEnd.exe
4860	SetupFrontEnd.exe
4860	SetupFrontEnd.exe
4860	SetupFrontEnd.exe
4860	SetupFrontEnd.exe
4860	SetupFrontEnd.exe
4860	SetupFrontEnd.exe
4860	SetupFrontEnd.exe
4860	SetupFrontEnd.exe
4860	SetupFrontEnd.exe
4860	SetupFrontEnd.exe
4860	SetupFrontEnd.exe
4860	SetupFrontEnd.exe
4860	SetupFrontEnd.exe
4860	SetupFrontEnd.exe
4860	SetupFrontEnd.exe
4860	SetupFrontEnd.exe
4860	SetupFrontEnd.exe
4860	SetupFrontEnd.exe
4860	SetupFrontEnd.exe
4860	SetupFrontEnd.exe
4860	SetupFrontEnd.exe
4860	SetupFrontEnd.exe
4860	SetupFrontEnd.exe
4860	SetupFrontEnd.exe
4860	SetupFrontEnd.exe
4860	SetupFrontEnd.exe
4860	SetupFrontEnd.exe
4860	SetupFrontEnd.exe
4860	SetupFrontEnd.exe
4860	SetupFrontEnd.exe
4860	SetupFrontEnd.exe
4860	SetupFrontEnd.exe
4860	SetupFrontEnd.exe
4860	SetupFrontEnd.exe
4860	SetupFrontEnd.exe
4860	SetupFrontEnd.exe
4860	SetupFrontEnd.exe
4860	SetupFrontEnd.exe
4860	SetupFrontEnd.exe
4860	SetupFrontEnd.exe
4860	SetupFrontEnd.exe
4860	SetupFrontEnd.exe
4860	SetupFrontEnd.exe
4860	SetupFrontEnd.exe
4860	SetupFrontEnd.exe
4860	SetupFrontEnd.exe
4860	SetupFrontEnd.exe
4860	SetupFrontEnd.exe
4860	SetupFrontEnd.exe
4860	SetupFrontEnd.exe
4860	SetupFrontEnd.exe
4860	SetupFrontEnd.exe
4860	SetupFrontEnd.exe
4860	SetupFrontEnd.exe
4860	SetupFrontEnd.exe
4860	SetupFrontEnd.exe
4860	SetupFrontEnd.exe
4860	SetupFrontEnd.exe
2860	paintdotnet.exe
2860	paintdotnet.exe

Registers COM server for autorun 1 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Processes:

paintdotnet.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FBF113F1-D7C8-477C-A23A-E600E7937E11}\InprocServer32	paintdotnet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FBF113F1-D7C8-477C-A23A-E600E7937E11}\InprocServer32\ = "C:\\Program Files\\paint.net\\PaintDotNet.ShellExtension.x64.dll"	paintdotnet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FBF113F1-D7C8-477C-A23A-E600E7937E11}\InprocServer32\ThreadingModel = "Apartment"	paintdotnet.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

SetupFrontEnd.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA SetupFrontEnd.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	SetupFrontEnd.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exe

description	ioc	process
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe

Drops file in Program Files directory 64 IoCs

Processes:

msiexec.exeSetupFrontEnd.exe

description	ioc	process
File created	C:\Program Files\paint.net\PresentationFramework-SystemData.dll	msiexec.exe
File created	C:\Program Files\paint.net\System.Reflection.Extensions.dll	msiexec.exe
File created	C:\Program Files\paint.net\ilasm.exe	msiexec.exe
File created	C:\Program Files\paint.net\K4os.Compression.LZ4.dll	msiexec.exe
File created	C:\Program Files\paint.net\PaintDotNet.Effects.Gpu.dll	msiexec.exe
File created	C:\Program Files\paint.net\System.Runtime.InteropServices.JavaScript.dll	msiexec.exe
File created	C:\Program Files\paint.net\System.Xml.XDocument.dll	msiexec.exe
File opened for modification	C:\Program Files\paint.net\Staging	SetupFrontEnd.exe
File created	C:\Program Files\paint.net\PaintDotNet.Core.xml	msiexec.exe
File created	C:\Program Files\paint.net\PresentationFramework.Luna.dll	msiexec.exe
File created	C:\Program Files\paint.net\System.Diagnostics.Tracing.dll	msiexec.exe
File created	C:\Program Files\paint.net\System.Threading.Tasks.Parallel.dll	msiexec.exe
File created	C:\Program Files\paint.net\System.Xml.XmlSerializer.dll	msiexec.exe
File created	C:\Program Files\paint.net\mscordaccore.dll	msiexec.exe
File created	C:\Program Files\paint.net\PaintDotNet.Strings.3.da.resources	msiexec.exe
File created	C:\Program Files\paint.net\PointerToolkit.TerraFX.Interop.Windows.dll	msiexec.exe
File created	C:\Program Files\paint.net\PaintDotNet.Strings.3.tr.resources	msiexec.exe
File created	C:\Program Files\paint.net\System.Runtime.CompilerServices.Unsafe.dll	msiexec.exe
File created	C:\Program Files\paint.net\vcruntime140_cor3.dll	msiexec.exe
File created	C:\Program Files\paint.net\System.Web.HttpUtility.dll	msiexec.exe
File created	C:\Program Files\paint.net\ildasm.exe	msiexec.exe
File created	C:\Program Files\paint.net\PaintDotNet.Core.dll	msiexec.exe
File created	C:\Program Files\paint.net\System.dll	msiexec.exe
File created	C:\Program Files\paint.net\System.IO.FileSystem.Primitives.dll	msiexec.exe
File created	C:\Program Files\paint.net\System.Reflection.Emit.ILGeneration.dll	msiexec.exe
File created	C:\Program Files\paint.net\System.Security.Cryptography.ProtectedData.dll	msiexec.exe
File created	C:\Program Files\paint.net\System.Text.Encoding.dll	msiexec.exe
File created	C:\Program Files\paint.net\mscordbi.dll	msiexec.exe
File created	C:\Program Files\paint.net\PaintDotNet.UI.xml	msiexec.exe
File created	C:\Program Files\paint.net\paintdotnet.deps.json	msiexec.exe
File created	C:\Program Files\paint.net\PaintDotNet.Strings.3.sl.resources	msiexec.exe
File created	C:\Program Files\paint.net\System.Diagnostics.DiagnosticSource.dll	msiexec.exe
File created	C:\Program Files\paint.net\System.Resources.Extensions.dll	msiexec.exe
File created	C:\Program Files\paint.net\System.Diagnostics.FileVersionInfo.dll	msiexec.exe
File created	C:\Program Files\paint.net\Microsoft.VisualBasic.dll	msiexec.exe
File created	C:\Program Files\paint.net\Microsoft.Win32.Registry.dll	msiexec.exe
File created	C:\Program Files\paint.net\PaintDotNet.Base.dll	msiexec.exe
File created	C:\Program Files\paint.net\PaintDotNet.Runtime.pdb	msiexec.exe
File created	C:\Program Files\paint.net\PaintDotNet.Strings.3.hu.resources	msiexec.exe
File created	C:\Program Files\paint.net\PhotoSauce.MagicScaler.dll	msiexec.exe
File created	C:\Program Files\paint.net\System.Console.dll	msiexec.exe
File created	C:\Program Files\paint.net\System.Security.Permissions.dll	msiexec.exe
File created	C:\Program Files\paint.net\System.Threading.Tasks.Dataflow.dll	msiexec.exe
File created	C:\Program Files\paint.net\System.Web.dll	msiexec.exe
File created	C:\Program Files\paint.net\PaintDotNet.Strings.3.el.resources	msiexec.exe
File created	C:\Program Files\paint.net\PresentationFramework-SystemCore.dll	msiexec.exe
File created	C:\Program Files\paint.net\System.Runtime.Handles.dll	msiexec.exe
File created	C:\Program Files\paint.net\Bundled\DDSFileTypePlus\License.txt	msiexec.exe
File created	C:\Program Files\paint.net\msvcp140.dll	msiexec.exe
File created	C:\Program Files\paint.net\PaintDotNet.Effects.Legacy.dll	msiexec.exe
File created	C:\Program Files\paint.net\PaintDotNet.Strings.3.ca.resources	msiexec.exe
File created	C:\Program Files\paint.net\PaintDotNet.Windows.dll	msiexec.exe
File created	C:\Program Files\paint.net\System.Memory.dll	msiexec.exe
File created	C:\Program Files\paint.net\System.Net.NameResolution.dll	msiexec.exe
File created	C:\Program Files\paint.net\System.Security.AccessControl.dll	msiexec.exe
File created	C:\Program Files\paint.net\Bundled\WebPFileType\WebPFileType.pdb	msiexec.exe
File created	C:\Program Files\paint.net\PaintDotNet.Collections.dll	msiexec.exe
File created	C:\Program Files\paint.net\PaintDotNet.Strings.3.JA.resources	msiexec.exe
File created	C:\Program Files\paint.net\PaintDotNet.Strings.3.pt-PT.resources	msiexec.exe
File created	C:\Program Files\paint.net\PresentationUI.dll	msiexec.exe
File created	C:\Program Files\paint.net\System.IO.FileSystem.AccessControl.dll	msiexec.exe
File created	C:\Program Files\paint.net\PaintDotNet.Primitives.xml	msiexec.exe
File created	C:\Program Files\paint.net\PaintDotNet.Strings.3.FR.resources	msiexec.exe
File created	C:\Program Files\paint.net\System.IO.Compression.FileSystem.dll	msiexec.exe

Drops file in Windows directory 11 IoCs

Processes:

msiexec.exe

description	ioc	process
File opened for modification	C:\Windows\Installer\e57c6ca.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{DBC43589-CC32-4502-BBEC-5B931AF4BD2E}	msiexec.exe
File created	C:\Windows\Installer\e57c6ca.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE530.tmp	msiexec.exe
File created	C:\Windows\Installer\e57c6cd.msi	msiexec.exe
File created	C:\Windows\Installer\{DBC43589-CC32-4502-BBEC-5B931AF4BD2E}\app_icon.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\{DBC43589-CC32-4502-BBEC-5B931AF4BD2E}\app_icon.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1180.tmp	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

vssvc.exe

description	ioc	process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000027c70fafd0cbe6b20000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000027c70faf0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3f000000ffffffff00000000070001000068090027c70faf000000000000d0120000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000027c70faf00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000027c70faf00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe

Modifies data under HKEY_USERS 5 IoCs

Processes:

msiexec.exe

description	ioc	process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1E\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1F	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\20	msiexec.exe

Modifies registry class 64 IoCs

Processes:

paintdotnet.exemsiexec.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\paintdotnet.exe\SupportedTypes\.jpg	paintdotnet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.webp\OpenWithProgids\paint.net.1	paintdotnet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\98534CBD23CC2054BBCEB539A14FDBE2\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.jfif\OpenWithProgids\paint.net.1	paintdotnet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.jpe\OpenWithProgids\paint.net.1	paintdotnet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.jpg\OpenWithProgids\paint.net.1	paintdotnet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tga\OpenWithProgids	paintdotnet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.tga\OpenWithProgids\paint.net.1	paintdotnet.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\98534CBD23CC2054BBCEB539A14FDBE2\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\98534CBD23CC2054BBCEB539A14FDBE2\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\paintdotnet\shell\open\command\ = "\"C:\\Program Files\\paint.net\\paintdotnet.exe\" %1"	paintdotnet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\paintdotnet.exe\SupportedTypes\.heic	paintdotnet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\paintdotnet.exe\shell\edit\command\ = "\"C:\\Program Files\\paint.net\\paintdotnet.exe\" \"%1\""	paintdotnet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.pdn\PerceivedType = "image"	paintdotnet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FBF113F1-D7C8-477C-A23A-E600E7937E11}\InprocServer32	paintdotnet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\paint.net.1\shell\print	paintdotnet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\paint.net.1\shell\edit\command	paintdotnet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\paintdotnet.exe\shell\edit	paintdotnet.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\98534CBD23CC2054BBCEB539A14FDBE2\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\98534CBD23CC2054BBCEB539A14FDBE2\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\paintdotnet.exe\SupportedTypes\.tga	paintdotnet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\paintdotnet.exe\SupportedTypes\.tiff	paintdotnet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\98534CBD23CC2054BBCEB539A14FDBE2\DefaultFeature	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.pdn	paintdotnet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FBF113F1-D7C8-477C-A23A-E600E7937E11}	paintdotnet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\paint.net.1\ShellEx\{E357FCCD-A995-4576-B01F-234630154E96}	paintdotnet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\paint.net.ThumbnailProvider\CLSID\ = "{FBF113F1-D7C8-477C-A23A-E600E7937E11}"	paintdotnet.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\98534CBD23CC2054BBCEB539A14FDBE2\Version = "83886082"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\paintdotnet\URL Protocol	paintdotnet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FBF113F1-D7C8-477C-A23A-E600E7937E11}\InprocServer32\ThreadingModel = "Apartment"	paintdotnet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\paint.net.1\ShellEx\{E357FCCD-A995-4576-B01F-234630154E96}\ = "{FBF113F1-D7C8-477C-A23A-E600E7937E11}"	paintdotnet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\paint.net.ThumbnailProvider\CurVer\ = "paint.net.ThumbnailProvider.1"	paintdotnet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rle\OpenWithProgids	paintdotnet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\98534CBD23CC2054BBCEB539A14FDBE2	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\paint.net.1\shell\edit\command\ = "\"C:\\Program Files\\paint.net\\paintdotnet.exe\" \"%1\""	paintdotnet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\paint.net.1\DefaultIcon	paintdotnet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\paint.net.1\shell	paintdotnet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\paint.net.1\shell\print\command\ = "\"C:\\Program Files\\paint.net\\paintdotnet.exe\" \"print:%1\""	paintdotnet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\paint.net.1\ShellEx	paintdotnet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\paintdotnet.exe\shell\edit\command	paintdotnet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\paintdotnet.exe\SupportedTypes\.webp	paintdotnet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\98534CBD23CC2054BBCEB539A14FDBE2\ProductName = "paint.net"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\paint.net.1\ = "paint.net Image"	paintdotnet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\paintdotnet\DefaultIcon	paintdotnet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\paint.net.ThumbnailProvider.1\CLSID\ = "{FBF113F1-D7C8-477C-A23A-E600E7937E11}"	paintdotnet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\98534CBD23CC2054BBCEB539A14FDBE2\ProductIcon = "C:\\Windows\\Installer\\{DBC43589-CC32-4502-BBEC-5B931AF4BD2E}\\app_icon.ico"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\04F04A40702A84B4EA7DA65A234E2357\98534CBD23CC2054BBCEB539A14FDBE2	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.dds\OpenWithProgids\paint.net.1	paintdotnet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\paintdotnet.exe\SupportedTypes\.tif	paintdotnet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\paint.net.ThumbnailProvider\CLSID	paintdotnet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.pdn\OpenWithProgids	paintdotnet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.pdn\ShellEx\{E357FCCD-A995-4576-B01F-234630154E96}\ = "{FBF113F1-D7C8-477C-A23A-E600E7937E11}"	paintdotnet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.avif\OpenWithProgids\paint.net.1	paintdotnet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.tif\OpenWithProgids\paint.net.1	paintdotnet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\98534CBD23CC2054BBCEB539A14FDBE2\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\98534CBD23CC2054BBCEB539A14FDBE2\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\paintdotnet.exe\SupportedTypes\.gif	paintdotnet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.tiff\OpenWithProgids\paint.net.1	paintdotnet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.wdp\OpenWithProgids\paint.net.1	paintdotnet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.wmp\OpenWithProgids\paint.net.1	paintdotnet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\paintdotnet	paintdotnet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\paint.net.ThumbnailProvider.1	paintdotnet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\04F04A40702A84B4EA7DA65A234E2357	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.heic\OpenWithProgids	paintdotnet.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

SetupDownloader.exe

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa20f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	SetupDownloader.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	SetupDownloader.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	SetupDownloader.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

msiexec.exe

pid process

3936 msiexec.exe
3936 msiexec.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

SetupFrontEnd.exe

pid process

4860 SetupFrontEnd.exe

pid	process
3936	msiexec.exe
3936	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

SetupDownloader.exeSetupFrontEnd.exevssvc.exemsiexec.exesrtasks.exe

description	pid	process
Token: SeDebugPrivilege	464	SetupDownloader.exe
Token: SeDebugPrivilege	4860	SetupFrontEnd.exe
Token: SeBackupPrivilege	3816	vssvc.exe
Token: SeRestorePrivilege	3816	vssvc.exe
Token: SeAuditPrivilege	3816	vssvc.exe
Token: SeBackupPrivilege	4860	SetupFrontEnd.exe
Token: SeRestorePrivilege	4860	SetupFrontEnd.exe
Token: SeShutdownPrivilege	4860	SetupFrontEnd.exe
Token: SeIncreaseQuotaPrivilege	4860	SetupFrontEnd.exe
Token: SeSecurityPrivilege	3936	msiexec.exe
Token: SeCreateTokenPrivilege	4860	SetupFrontEnd.exe
Token: SeAssignPrimaryTokenPrivilege	4860	SetupFrontEnd.exe
Token: SeLockMemoryPrivilege	4860	SetupFrontEnd.exe
Token: SeIncreaseQuotaPrivilege	4860	SetupFrontEnd.exe
Token: SeMachineAccountPrivilege	4860	SetupFrontEnd.exe
Token: SeTcbPrivilege	4860	SetupFrontEnd.exe
Token: SeSecurityPrivilege	4860	SetupFrontEnd.exe
Token: SeTakeOwnershipPrivilege	4860	SetupFrontEnd.exe
Token: SeLoadDriverPrivilege	4860	SetupFrontEnd.exe
Token: SeSystemProfilePrivilege	4860	SetupFrontEnd.exe
Token: SeSystemtimePrivilege	4860	SetupFrontEnd.exe
Token: SeProfSingleProcessPrivilege	4860	SetupFrontEnd.exe
Token: SeIncBasePriorityPrivilege	4860	SetupFrontEnd.exe
Token: SeCreatePagefilePrivilege	4860	SetupFrontEnd.exe
Token: SeCreatePermanentPrivilege	4860	SetupFrontEnd.exe
Token: SeBackupPrivilege	4860	SetupFrontEnd.exe
Token: SeRestorePrivilege	4860	SetupFrontEnd.exe
Token: SeShutdownPrivilege	4860	SetupFrontEnd.exe
Token: SeDebugPrivilege	4860	SetupFrontEnd.exe
Token: SeAuditPrivilege	4860	SetupFrontEnd.exe
Token: SeSystemEnvironmentPrivilege	4860	SetupFrontEnd.exe
Token: SeChangeNotifyPrivilege	4860	SetupFrontEnd.exe
Token: SeRemoteShutdownPrivilege	4860	SetupFrontEnd.exe
Token: SeUndockPrivilege	4860	SetupFrontEnd.exe
Token: SeSyncAgentPrivilege	4860	SetupFrontEnd.exe
Token: SeEnableDelegationPrivilege	4860	SetupFrontEnd.exe
Token: SeManageVolumePrivilege	4860	SetupFrontEnd.exe
Token: SeImpersonatePrivilege	4860	SetupFrontEnd.exe
Token: SeCreateGlobalPrivilege	4860	SetupFrontEnd.exe
Token: SeRestorePrivilege	3936	msiexec.exe
Token: SeTakeOwnershipPrivilege	3936	msiexec.exe
Token: SeRestorePrivilege	3936	msiexec.exe
Token: SeTakeOwnershipPrivilege	3936	msiexec.exe
Token: SeBackupPrivilege	764	srtasks.exe
Token: SeRestorePrivilege	764	srtasks.exe
Token: SeSecurityPrivilege	764	srtasks.exe
Token: SeTakeOwnershipPrivilege	764	srtasks.exe
Token: SeBackupPrivilege	764	srtasks.exe
Token: SeRestorePrivilege	764	srtasks.exe
Token: SeSecurityPrivilege	764	srtasks.exe
Token: SeTakeOwnershipPrivilege	764	srtasks.exe
Token: SeRestorePrivilege	3936	msiexec.exe
Token: SeTakeOwnershipPrivilege	3936	msiexec.exe
Token: SeRestorePrivilege	3936	msiexec.exe
Token: SeTakeOwnershipPrivilege	3936	msiexec.exe
Token: SeRestorePrivilege	3936	msiexec.exe
Token: SeTakeOwnershipPrivilege	3936	msiexec.exe
Token: SeRestorePrivilege	3936	msiexec.exe
Token: SeTakeOwnershipPrivilege	3936	msiexec.exe
Token: SeRestorePrivilege	3936	msiexec.exe
Token: SeTakeOwnershipPrivilege	3936	msiexec.exe
Token: SeRestorePrivilege	3936	msiexec.exe
Token: SeTakeOwnershipPrivilege	3936	msiexec.exe
Token: SeRestorePrivilege	3936	msiexec.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

SetupFrontEnd.exe

pid process

4860 SetupFrontEnd.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

SetupShim.exepaint.net.5.0.2.install.x64.exeSetupShim.exeSetupFrontEnd.exe

pid process

4840 SetupShim.exe
3448 paint.net.5.0.2.install.x64.exe
2840 SetupShim.exe
4860 SetupFrontEnd.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

paint.net.5.0.2.install.anycpu.web.exeSetupShim.exeSetupDownloader.exepaint.net.5.0.2.install.x64.exeSetupShim.exemsiexec.exeSetupFrontEnd.exe

description	pid	process	target process
PID 2540 wrote to memory of 4840	2540	paint.net.5.0.2.install.anycpu.web.exe	SetupShim.exe
PID 2540 wrote to memory of 4840	2540	paint.net.5.0.2.install.anycpu.web.exe	SetupShim.exe
PID 2540 wrote to memory of 4840	2540	paint.net.5.0.2.install.anycpu.web.exe	SetupShim.exe
PID 4840 wrote to memory of 464	4840	SetupShim.exe	SetupDownloader.exe
PID 4840 wrote to memory of 464	4840	SetupShim.exe	SetupDownloader.exe
PID 464 wrote to memory of 3448	464	SetupDownloader.exe	paint.net.5.0.2.install.x64.exe
PID 464 wrote to memory of 3448	464	SetupDownloader.exe	paint.net.5.0.2.install.x64.exe
PID 464 wrote to memory of 3448	464	SetupDownloader.exe	paint.net.5.0.2.install.x64.exe
PID 3448 wrote to memory of 2840	3448	paint.net.5.0.2.install.x64.exe	SetupShim.exe
PID 3448 wrote to memory of 2840	3448	paint.net.5.0.2.install.x64.exe	SetupShim.exe
PID 3448 wrote to memory of 2840	3448	paint.net.5.0.2.install.x64.exe	SetupShim.exe
PID 2840 wrote to memory of 4860	2840	SetupShim.exe	SetupFrontEnd.exe
PID 2840 wrote to memory of 4860	2840	SetupShim.exe	SetupFrontEnd.exe
PID 3936 wrote to memory of 2860	3936	msiexec.exe	paintdotnet.exe
PID 3936 wrote to memory of 2860	3936	msiexec.exe	paintdotnet.exe
PID 4860 wrote to memory of 468	4860	SetupFrontEnd.exe	PaintDotNet.exe
PID 4860 wrote to memory of 468	4860	SetupFrontEnd.exe	PaintDotNet.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\paint.net.5.0.2.install.anycpu.web.exe
"C:\Users\Admin\AppData\Local\Temp\paint.net.5.0.2.install.anycpu.web.exe"
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2540

C:\Users\Admin\AppData\Local\Temp\7zSCE904476\SetupShim.exe
"C:\Users\Admin\AppData\Local\Temp\7zSCE904476\SetupShim.exe" /suppressReboot
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4840

C:\Users\Admin\AppData\Local\Temp\7zSCE904476\x64\SetupDownloader\SetupDownloader.exe
"x64\SetupDownloader\SetupDownloader.exe" /SkipSuccessPrompt "C:\Users\Admin\AppData\Local\Temp\7zSCE904476\SetupShim.exe" /suppressReboot
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:464

C:\Users\Admin\AppData\Local\Temp\PdnSetupDownloader\d5987737-89e3-4c3e-a673-298c362002e8\paint.net.5.0.2.install.x64.exe
"C:\Users\Admin\AppData\Local\Temp\PdnSetupDownloader\d5987737-89e3-4c3e-a673-298c362002e8\paint.net.5.0.2.install.x64.exe" C:\Users\Admin\AppData\Local\Temp\7zSCE904476\SetupShim.exe
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3448

C:\Users\Admin\AppData\Local\Temp\7zS87D6B686\SetupShim.exe
"C:\Users\Admin\AppData\Local\Temp\7zS87D6B686\SetupShim.exe" /suppressReboot C:\Users\Admin\AppData\Local\Temp\7zSCE904476\SetupShim.exe
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2840

C:\Users\Admin\AppData\Local\Temp\7zS87D6B686\x64\SetupFrontEnd.exe
"x64\SetupFrontEnd.exe" "C:\Users\Admin\AppData\Local\Temp\7zS87D6B686\SetupShim.exe" /suppressReboot C:\Users\Admin\AppData\Local\Temp\7zSCE904476\SetupShim.exe
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4860

C:\Program Files\paint.net\PaintDotNet.exe
"C:\Program Files\paint.net\PaintDotNet.exe"
- Executes dropped EXE
PID:468

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3816

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:3
- Suspicious use of AdjustPrivilegeToken
PID:764

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3936

C:\Program Files\paint.net\paintdotnet.exe
"C:\Program Files\paint.net\paintdotnet.exe" /setupActions /install DESKTOPSHORTCUT=1 PDNUPDATING=0 SKIPCLEANUP=0 "PROGRAMSGROUP=" /disablePGO /skipEstablishNVProfile /skipRepairAttempt
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
PID:2860

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

00:00 00:00

Downloads

C:\Config.Msi\e57c6cc.rbs
Filesize
79KB

MD5
b8fefa9e4cd1f1727e824354096cd178

SHA1
6d29e34d11470775b99b3e939902d2295d51bfa3

SHA256
3e2776911d7e4f3e5b1f00f4313441e0e5d0c7c60e6f75ba4ac6d0e15a307a8d

SHA512
df6c2f277b71ff054eb57e15971e92fdb730f87af57f243de76e504ce9c5d30a2c842fc02611f85ce01358d4bb07f995f0c19868cf636b660e91e0868cba521f

Download Submit
C:\Config.Msi\e57c6ce.rbs
Filesize
663B

MD5
c728174265a27bab41836a2f67267eb1

SHA1
664ee9889b57da2fc2e71dfce0868bc36e7fca18

SHA256
fb2936a47b42bb426b7c7fab437246e52db0bff9247e187b82ee9854ba1808e2

SHA512
d2dc197bf755666c351c229075460199c853b4597252f29058b23b74d709e3dc10af188590aacb91f3da48f22b2ceba5e79650e88f49abff42884b1df9f75883

Download Submit
C:\Program Files\paint.net\mscordaccore_amd64_amd64_7.0.323.6910.dll
Filesize
1MB

MD5
8753cfc25b8785a7204e522d99ad50f2

SHA1
fde44f698b477755aa49cf9717d07ab1fdceadd0

SHA256
b9e9aed9f540350284b5274fbb27be1eaae107a339b8e58c89216fb1adf38e05

SHA512
2757a03a268f66f3cd766edaadab0a4b6d2f9e6d4fddf3c30608a434e1806c34ad4691c690d9105b9298687114bc5f9b4fc0ea4acdb42254ea78db265f94f5c5

Download Submit
C:\Program Files\paint.net\paintdotnet.runtimeconfig.json
Filesize
449B

MD5
5653eeba8fa7fcba355024cf1cdc3030

SHA1
352596de8ee84a1d18d61c2eb74cad8fe3efe92b

SHA256
c3a49dd86d68b783c5bf42d9a03381b68f93e2f7014ec8d2a111078cbc20f03a

SHA512
2151d877d38f738091a41b02013c547906c0e4cbccd3d68f720d9a187de02fdf336df3c2c42af38c93835902cec7d601dc0e825145fe23c8a48a51c463035b0a

Download Submit
C:\Program Files\paint.net\vcruntime140_cor3.dll
Filesize
106KB

MD5
870fea4e961e2fbd00110d3783e529be

SHA1
a948e65c6f73d7da4ffde4e8533c098a00cc7311

SHA256
76fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644

SHA512
0b636a3cdefa343eb4cb228b391bb657b5b4c20df62889cd1be44c7bee94ffad6ec82dc4db79949edef576bff57867e0d084e0a597bf7bf5c8e4ed1268477e88

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS87D6B686\SetupShim.exe
Filesize
136KB

MD5
db51c903838632898319669eb2271114

SHA1
25fa7935e834e56f7757321da7f84aad8d587eee

SHA256
babcd035c2f920004fcc922aa23c4fc55949b335b5e920bcec215a51c1e036d4

SHA512
a42fd32040317d351f98bf53e0832e1c9dfd7e1b45c5aba44dfbc79f25f88cc19dcb762410840cfa5cd63e8531496dfe25d63937af8758d712d06102e626fdbb

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS87D6B686\SetupShim.exe
Filesize
136KB

MD5
db51c903838632898319669eb2271114

SHA1
25fa7935e834e56f7757321da7f84aad8d587eee

SHA256
babcd035c2f920004fcc922aa23c4fc55949b335b5e920bcec215a51c1e036d4

SHA512
a42fd32040317d351f98bf53e0832e1c9dfd7e1b45c5aba44dfbc79f25f88cc19dcb762410840cfa5cd63e8531496dfe25d63937af8758d712d06102e626fdbb

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS87D6B686\x64\PaintDotNet.Base.dll
Filesize
718KB

MD5
1cf53a29e427572615759900ca36c907

SHA1
0f023f73bed0833154de0282e3a5336879b9ef72

SHA256
23cd2f8a4bf0283833e772d583701b2b806273cd8ed2e8c2ac7fbeaf0ebcba2f

SHA512
fecd8e43b981bf0206a280eb3008f6156c7939b67d507bd892dc1cca63b4178db0490746da5386885256fc118a03875f0900f014741abfc99dd1958fed3c5fd8

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS87D6B686\x64\PaintDotNet.Base.dll
Filesize
718KB

MD5
1cf53a29e427572615759900ca36c907

SHA1
0f023f73bed0833154de0282e3a5336879b9ef72

SHA256
23cd2f8a4bf0283833e772d583701b2b806273cd8ed2e8c2ac7fbeaf0ebcba2f

SHA512
fecd8e43b981bf0206a280eb3008f6156c7939b67d507bd892dc1cca63b4178db0490746da5386885256fc118a03875f0900f014741abfc99dd1958fed3c5fd8

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS87D6B686\x64\PaintDotNet.ComponentModel.dll
Filesize
98KB

MD5
85a011052f83162b31d78e7c515a8d5e

SHA1
be7d91c62ccba4e971bfa0cf82f65d87706d6bc7

SHA256
92a847f24993b6d79a8f88f132dc7579b605de97adbb1824676ee41b0604a90f

SHA512
97e5369cd63d94fad2fe26dd7340230fb61e68e4884c47442716723233abf0f86f0a413b0ed30efba4c58617c5ddca6f379b581ca07984e948a2522aab60afe3

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS87D6B686\x64\PaintDotNet.ComponentModel.dll
Filesize
98KB

MD5
85a011052f83162b31d78e7c515a8d5e

SHA1
be7d91c62ccba4e971bfa0cf82f65d87706d6bc7

SHA256
92a847f24993b6d79a8f88f132dc7579b605de97adbb1824676ee41b0604a90f

SHA512
97e5369cd63d94fad2fe26dd7340230fb61e68e4884c47442716723233abf0f86f0a413b0ed30efba4c58617c5ddca6f379b581ca07984e948a2522aab60afe3

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS87D6B686\x64\PaintDotNet.Core.dll
Filesize
2MB

MD5
c8355d166cef6f93f2f47774a0776467

SHA1
3aad0094ba42ddad5b7f09a269666608ff61ea43

SHA256
5b525c55dab076d859b6e295d41f1d11ad72bdd8c4c9f0276d6367b905f0d016

SHA512
20697b959024ee159e5dbdc7e0b070294cd531d27ff7aa911b556c91f22f579bc7f57b412172a92c6593a8015370d4a91fdbc299ad4b0a00516cf743f88defc1

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS87D6B686\x64\PaintDotNet.Core.dll
Filesize
2MB

MD5
c8355d166cef6f93f2f47774a0776467

SHA1
3aad0094ba42ddad5b7f09a269666608ff61ea43

SHA256
5b525c55dab076d859b6e295d41f1d11ad72bdd8c4c9f0276d6367b905f0d016

SHA512
20697b959024ee159e5dbdc7e0b070294cd531d27ff7aa911b556c91f22f579bc7f57b412172a92c6593a8015370d4a91fdbc299ad4b0a00516cf743f88defc1

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS87D6B686\x64\PaintDotNet.Framework.dll
Filesize
1010KB

MD5
f577126db967a0eefbdb78ef4f90234c

SHA1
2913c381e2dc10f35f51fd001e05a5f6d776c43d

SHA256
52d9976c5dc0b39d41a2c8e981c348fd481db7c55c32ff894bfb4d0cc49639d6

SHA512
168a626a5e4bb0bf77a351c27a8f0d250948e3968570546fcb6f8bc657535da883ba4e6dbeb72d06c7326f2b40454f9c595d79ff5996ab64e8d5040fae774266

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS87D6B686\x64\PaintDotNet.Framework.dll
Filesize
1010KB

MD5
f577126db967a0eefbdb78ef4f90234c

SHA1
2913c381e2dc10f35f51fd001e05a5f6d776c43d

SHA256
52d9976c5dc0b39d41a2c8e981c348fd481db7c55c32ff894bfb4d0cc49639d6

SHA512
168a626a5e4bb0bf77a351c27a8f0d250948e3968570546fcb6f8bc657535da883ba4e6dbeb72d06c7326f2b40454f9c595d79ff5996ab64e8d5040fae774266

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS87D6B686\x64\PaintDotNet.Fundamentals.dll
Filesize
1MB

MD5
e9231a4e54b4480e76033c5957c482ba

SHA1
dd4a3aba9f7fe4e9430f427513780b9f02b5ad0d

SHA256
67c6eb3513e7125c5caca12733a90dd7dcb0586b2b3a7c6cf636a3268373f8b7

SHA512
cedffc352a59f8210743de0534f760842e7ea541702836725180ab4e3ecd1fb39f30ca4c204f6a897d21e0ef0b41713df7af12cce9f48627b85938cac348392d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS87D6B686\x64\PaintDotNet.Fundamentals.dll
Filesize
1MB

MD5
e9231a4e54b4480e76033c5957c482ba

SHA1
dd4a3aba9f7fe4e9430f427513780b9f02b5ad0d

SHA256
67c6eb3513e7125c5caca12733a90dd7dcb0586b2b3a7c6cf636a3268373f8b7

SHA512
cedffc352a59f8210743de0534f760842e7ea541702836725180ab4e3ecd1fb39f30ca4c204f6a897d21e0ef0b41713df7af12cce9f48627b85938cac348392d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS87D6B686\x64\PaintDotNet.ObjectModel.dll
Filesize
182KB

MD5
9ed7ba99bbc0d61dd08352a58055b175

SHA1
675a0adf156c2a88224483b8469c027e7554d71e

SHA256
4118f6e2dea0c8caf0e7b822c52a373af15d8bcdb8038ea8145ac0bd9b25c3c4

SHA512
4d498f2604f3ca43912705eb8a19f95a7e930e8babbd5ac0025a0175cd06b1e49d31d5e126100b9fe2fef89c9486ffad7b40695cbb0133c927a01cf2d81484d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS87D6B686\x64\PaintDotNet.ObjectModel.dll
Filesize
182KB

MD5
9ed7ba99bbc0d61dd08352a58055b175

SHA1
675a0adf156c2a88224483b8469c027e7554d71e

SHA256
4118f6e2dea0c8caf0e7b822c52a373af15d8bcdb8038ea8145ac0bd9b25c3c4

SHA512
4d498f2604f3ca43912705eb8a19f95a7e930e8babbd5ac0025a0175cd06b1e49d31d5e126100b9fe2fef89c9486ffad7b40695cbb0133c927a01cf2d81484d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS87D6B686\x64\PaintDotNet.Primitives.dll
Filesize
938KB

MD5
a14d449a03e33436f492eb89f1aee8c3

SHA1
74de3ebcd500dc15cee127e77eedda123e6f25f4

SHA256
00fdfea382eee9fdc3d54fbda6dade12313955aab4ed1109340a485c28154a44

SHA512
f650b355a573ea42f638ef82c7c0a452604759fa20beb9911fb45000202a06f922e231c012c3c28d2e4d4064de9dc0223852062de9be88ae3605a37994e7d768

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS87D6B686\x64\PaintDotNet.Primitives.dll
Filesize
938KB

MD5
a14d449a03e33436f492eb89f1aee8c3

SHA1
74de3ebcd500dc15cee127e77eedda123e6f25f4

SHA256
00fdfea382eee9fdc3d54fbda6dade12313955aab4ed1109340a485c28154a44

SHA512
f650b355a573ea42f638ef82c7c0a452604759fa20beb9911fb45000202a06f922e231c012c3c28d2e4d4064de9dc0223852062de9be88ae3605a37994e7d768

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS87D6B686\x64\PaintDotNet.Runtime.dll
Filesize
74KB

MD5
12cd1f43ab57b0b4f67393aefa684510

SHA1
54a6c06cbe86d131c7baa84a0e389e825d157339

SHA256
ebfe25806fc3357c209820fb8fdc17613140cdbb8f0dd8760b53fb7c09e5fda0

SHA512
c5f3fab93afe8cf7e7620ff7531b49b37b8518fc23081b3e2d97fd85cfa012da905a6fa9bccbb76690ab7ced661cb6d9529a51dd2967ad6b9b55653ce8f602c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS87D6B686\x64\PaintDotNet.Strings.3.co.resources
Filesize
176KB

MD5
d52f605089a5909444cd3d00121b9eca

SHA1
4585d03750c24cb46cd0d47b271019fdd8248163

SHA256
85f434ade1a64d4719fa1759446bc2451cac9c81ff063bf4c54eff684625d815

SHA512
37ced0bd1c88c67f2aa6efe7c76566a2f39f3fedae4da245752b844f0cebea0a3e4345e74987bb5102cc461b7b9d1e5a4dc6c1131c01bca485a7790159eb1e5a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS87D6B686\x64\PaintDotNet.Windows.dll
Filesize
3MB

MD5
9175025bcbca0f749d6500a842e9f048

SHA1
361941df6e4d3e9a4ec1b340a7a1e06c02e85c45

SHA256
616009e382db7b7d5f7cb9af73cc501f05a879bb9d67045d483fa69e6ac4a0e3

SHA512
4dc770f39cb3489c2c1c1078f35bf50b6e5eec83217863ea57a12d77db70a91d1fc9e5932ec0b32c6de8f54efc8eedcadc3ea18ae383bda95eb59c1c542d18da

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS87D6B686\x64\PaintDotNet.Windows.dll
Filesize
3MB

MD5
9175025bcbca0f749d6500a842e9f048

SHA1
361941df6e4d3e9a4ec1b340a7a1e06c02e85c45

SHA256
616009e382db7b7d5f7cb9af73cc501f05a879bb9d67045d483fa69e6ac4a0e3

SHA512
4dc770f39cb3489c2c1c1078f35bf50b6e5eec83217863ea57a12d77db70a91d1fc9e5932ec0b32c6de8f54efc8eedcadc3ea18ae383bda95eb59c1c542d18da

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS87D6B686\x64\SetupFrontEnd.deps.json
Filesize
59KB

MD5
28b6e9050c62d0117e97e70a5bac36f4

SHA1
0ba79797c1f1da83353b589a87724c75440df931

SHA256
1db2bb606660cf0de98c5260d44f29b17357466d216e90dc937c2e2bf0a1330f

SHA512
16166b440b1c81c8a1598da8c2fbeddfb9eb271f9467d2f567543f0a452a2d35fccc2ba231b8b0524de0aeecedc509882d5908b4b99c3b9c703849cf2e9e2450

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS87D6B686\x64\SetupFrontEnd.dll
Filesize
210KB

MD5
7661fbc617c62838da8d27fa8fe41e69

SHA1
173c1d28c5bec798dd1ba2a6e077809f6cda2abe

SHA256
9c06869c94371a1754f90fa0475f3987f1177dff0b5e3b88a555b3971ce78b81

SHA512
099165b23c85e0a70e7f337a822d23a9880c7c31f240f0f20bebf186359e17bfc1ccd40d7119f4c16502401e06e8e1a3b7ee5e8cbc4a47160c552a76798044ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS87D6B686\x64\SetupFrontEnd.dll
Filesize
210KB

MD5
7661fbc617c62838da8d27fa8fe41e69

SHA1
173c1d28c5bec798dd1ba2a6e077809f6cda2abe

SHA256
9c06869c94371a1754f90fa0475f3987f1177dff0b5e3b88a555b3971ce78b81

SHA512
099165b23c85e0a70e7f337a822d23a9880c7c31f240f0f20bebf186359e17bfc1ccd40d7119f4c16502401e06e8e1a3b7ee5e8cbc4a47160c552a76798044ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS87D6B686\x64\SetupFrontEnd.exe
Filesize
162KB

MD5
ecd1b6c532545defb118d10bb666575e

SHA1
3209041ed6b54c274b0a66e6121955b500fd42c5

SHA256
5610b309cc56efd174fdf45feec265b086ee9ff55efb0d3862fff81348e78fb0

SHA512
dd2522cac5ab3062492851e72892c99a0aa8e2c1d9e056c1fb18fdd882a433dd93a6b1e68f1c49f3de6f4e88f7a684f695a86f82bbd8f3c811ffe0a4b40ee152

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS87D6B686\x64\SetupFrontEnd.exe
Filesize
162KB

MD5
ecd1b6c532545defb118d10bb666575e

SHA1
3209041ed6b54c274b0a66e6121955b500fd42c5

SHA256
5610b309cc56efd174fdf45feec265b086ee9ff55efb0d3862fff81348e78fb0

SHA512
dd2522cac5ab3062492851e72892c99a0aa8e2c1d9e056c1fb18fdd882a433dd93a6b1e68f1c49f3de6f4e88f7a684f695a86f82bbd8f3c811ffe0a4b40ee152

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS87D6B686\x64\SetupFrontEnd.runtimeconfig.json
Filesize
449B

MD5
5653eeba8fa7fcba355024cf1cdc3030

SHA1
352596de8ee84a1d18d61c2eb74cad8fe3efe92b

SHA256
c3a49dd86d68b783c5bf42d9a03381b68f93e2f7014ec8d2a111078cbc20f03a

SHA512
2151d877d38f738091a41b02013c547906c0e4cbccd3d68f720d9a187de02fdf336df3c2c42af38c93835902cec7d601dc0e825145fe23c8a48a51c463035b0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS87D6B686\x64\System.Collections.Concurrent.dll
Filesize
258KB

MD5
f449d4c37f4d57f2040dad7f9f6473c3

SHA1
194166b4977895ae8e60b2b6379407487a323b98

SHA256
f53b877e777a137218174fdbe09324f2a41d9b13402c14e54ea913e7271c3fb5

SHA512
f88f143cca13210184d0f08c761607d79d416b8368de2aec104595a624ec44da7b77f9bb01974479491988e92907dadab61b854e9621a978f1f8c48d2b910453

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS87D6B686\x64\System.Collections.Concurrent.dll
Filesize
258KB

MD5
f449d4c37f4d57f2040dad7f9f6473c3

SHA1
194166b4977895ae8e60b2b6379407487a323b98

SHA256
f53b877e777a137218174fdbe09324f2a41d9b13402c14e54ea913e7271c3fb5

SHA512
f88f143cca13210184d0f08c761607d79d416b8368de2aec104595a624ec44da7b77f9bb01974479491988e92907dadab61b854e9621a978f1f8c48d2b910453

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS87D6B686\x64\System.Collections.Specialized.dll
Filesize
106KB

MD5
d266ccdac8a4beab6b1df38847c06ee3

SHA1
9ab6aefe5142becb42a24069b2c1df9148d1c9fd

SHA256
12737b63f59707891828a0c5fecd716e34aa35be795bb5b19547185104e22aa3

SHA512
d100df0e44e34d7b466976093a1fb8287203a29381a34a8f315c5931b4b9fc132024935d02534101570b34a40e80b3972d3061ace5be3b8428ea531d65ebe054

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS87D6B686\x64\System.Collections.Specialized.dll
Filesize
106KB

MD5
d266ccdac8a4beab6b1df38847c06ee3

SHA1
9ab6aefe5142becb42a24069b2c1df9148d1c9fd

SHA256
12737b63f59707891828a0c5fecd716e34aa35be795bb5b19547185104e22aa3

SHA512
d100df0e44e34d7b466976093a1fb8287203a29381a34a8f315c5931b4b9fc132024935d02534101570b34a40e80b3972d3061ace5be3b8428ea531d65ebe054

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS87D6B686\x64\System.ComponentModel.Primitives.dll
Filesize
82KB

MD5
facfdafa0ae200ca0633d319a17e0cd1

SHA1
534d0549fa4dd93da4edf6b09a0e4fe64488cfd6

SHA256
8b176b5697c67ffd3f5ad4ec60bf4efd2bd5d0ad902bb96f6b05ef48bea0124c

SHA512
d44cad0fab5d1e150ae806e2e81dbe68caf36d6e64907f43d861c5c7681f93313982a3aa1dd9bb36848d71ee60dfb10548b57f856bd317a9ce70198837fd8e26

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS87D6B686\x64\System.ComponentModel.Primitives.dll
Filesize
82KB

MD5
facfdafa0ae200ca0633d319a17e0cd1

SHA1
534d0549fa4dd93da4edf6b09a0e4fe64488cfd6

SHA256
8b176b5697c67ffd3f5ad4ec60bf4efd2bd5d0ad902bb96f6b05ef48bea0124c

SHA512
d44cad0fab5d1e150ae806e2e81dbe68caf36d6e64907f43d861c5c7681f93313982a3aa1dd9bb36848d71ee60dfb10548b57f856bd317a9ce70198837fd8e26

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS87D6B686\x64\System.ComponentModel.dll
Filesize
30KB

MD5
03529f44b676b450990e523c6c50208a

SHA1
4046f0095fa3a01ec771d749961e3aed356efaf8

SHA256
b69c45559d45e199152ed3b558ec9656fd52ecc05cd0456adccecc72e276ae9e

SHA512
ae0610381848bbd5993cb95b2f9c8ba18eace61b496883df7946f8c3509e03fdbd45558e74020045f98dbed95a257743f8a3f055e9b2e519e782b678119c23fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS87D6B686\x64\System.ComponentModel.dll
Filesize
30KB

MD5
03529f44b676b450990e523c6c50208a

SHA1
4046f0095fa3a01ec771d749961e3aed356efaf8

SHA256
b69c45559d45e199152ed3b558ec9656fd52ecc05cd0456adccecc72e276ae9e

SHA512
ae0610381848bbd5993cb95b2f9c8ba18eace61b496883df7946f8c3509e03fdbd45558e74020045f98dbed95a257743f8a3f055e9b2e519e782b678119c23fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS87D6B686\x64\System.Drawing.Primitives.dll
Filesize
134KB

MD5
98fdeb87ea5ea177d59f9696a8ad4037

SHA1
7c9e811e273c73e7f1966feade5185bacdab4bfb

SHA256
6f9f317c606db86f5e708a991c70641a3b7246a14b8f6b4a771b65111b409c91

SHA512
030b179196292a23d9c92c61c0661d00aa2321d91ef6c90e2ffd22d593ded19bce8c22203269e3b6608eb1fa55a1ae9f2102501935299261f30865d073101220

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS87D6B686\x64\System.Drawing.Primitives.dll
Filesize
134KB

MD5
98fdeb87ea5ea177d59f9696a8ad4037

SHA1
7c9e811e273c73e7f1966feade5185bacdab4bfb

SHA256
6f9f317c606db86f5e708a991c70641a3b7246a14b8f6b4a771b65111b409c91

SHA512
030b179196292a23d9c92c61c0661d00aa2321d91ef6c90e2ffd22d593ded19bce8c22203269e3b6608eb1fa55a1ae9f2102501935299261f30865d073101220

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS87D6B686\x64\System.Private.CoreLib.dll
Filesize
11MB

MD5
df68b7a4b26558b45a358e300bfd1fff

SHA1
97172af4477cacc71501e7ad8a7b1c23aa5292ee

SHA256
c3c1f001304c11fc0ec037a8aac9348c82aea824f3b50a308aebdf2c47f579b9

SHA512
e6d895cf2720a1bbb5138db2cad2aad2e4768ba1934406bb812fb2d5ccdbbb341dcf95ace2d7dd3d0209d5ee8aa143c31f195e7a43912c2a12eff1e411198125

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS87D6B686\x64\System.Private.CoreLib.dll
Filesize
11MB

MD5
df68b7a4b26558b45a358e300bfd1fff

SHA1
97172af4477cacc71501e7ad8a7b1c23aa5292ee

SHA256
c3c1f001304c11fc0ec037a8aac9348c82aea824f3b50a308aebdf2c47f579b9

SHA512
e6d895cf2720a1bbb5138db2cad2aad2e4768ba1934406bb812fb2d5ccdbbb341dcf95ace2d7dd3d0209d5ee8aa143c31f195e7a43912c2a12eff1e411198125

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS87D6B686\x64\System.Runtime.InteropServices.dll
Filesize
62KB

MD5
e31b6fb60d050aa48ff3ef07ee328774

SHA1
5a28a778566856b8a9a578ea7e72d32b9edf0c30

SHA256
f218bca40230158afd7d9c3e0c4e604e6c75d8cc089013c6b86b05670c5ead60

SHA512
b5841e4e9e4d26942a68b50d8a4298b636608525a83f2550c5693248ca79c9f221455c35714d958503766f1c571637283b43aac758e36b60873043a301417f5a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS87D6B686\x64\System.Runtime.InteropServices.dll
Filesize
62KB

MD5
e31b6fb60d050aa48ff3ef07ee328774

SHA1
5a28a778566856b8a9a578ea7e72d32b9edf0c30

SHA256
f218bca40230158afd7d9c3e0c4e604e6c75d8cc089013c6b86b05670c5ead60

SHA512
b5841e4e9e4d26942a68b50d8a4298b636608525a83f2550c5693248ca79c9f221455c35714d958503766f1c571637283b43aac758e36b60873043a301417f5a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS87D6B686\x64\System.Runtime.dll
Filesize
42KB

MD5
ed234e38f8a495d72bc9a09c994586bf

SHA1
f705cb25476684043e53e218cff38d25c2a39485

SHA256
3b3334e456862d406be6d07438c91fd74f5c1eb75d7f2a4a634b2e4c9d1d8da9

SHA512
a67ec1cba68870e16b151578c49fb05c0b35c763fa59cf8c791ce2793bea2af402d4e43f155c23ce3aeba1e1004fd5968ebf59ec273c61aea7b6a5a07ecbbf6b

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS87D6B686\x64\System.Windows.Forms.Primitives.dll
Filesize
938KB

MD5
2c4e345796dad80b1a759e870a8a3ad9

SHA1
f2070511c877aa75c33d81a9e389b0b304561b29

SHA256
7d8d937eb21dec9b14d7c9850ab4e4ed35371c81951064a52e5dd35d08f258b1

SHA512
b73ee44081a86897ea65301a44c1226e11118800ebe5b40dbe524ea6dab89590341768662395175d0faa85956cb80cdc9a9178d9d044ebd30fab08a56fbd37da

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS87D6B686\x64\System.Windows.Forms.Primitives.dll
Filesize
938KB

MD5
2c4e345796dad80b1a759e870a8a3ad9

SHA1
f2070511c877aa75c33d81a9e389b0b304561b29

SHA256
7d8d937eb21dec9b14d7c9850ab4e4ed35371c81951064a52e5dd35d08f258b1

SHA512
b73ee44081a86897ea65301a44c1226e11118800ebe5b40dbe524ea6dab89590341768662395175d0faa85956cb80cdc9a9178d9d044ebd30fab08a56fbd37da

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS87D6B686\x64\System.Windows.Forms.dll
Filesize
12MB

MD5
868c8f0294d962d59e42cd99f84df7db

SHA1
4000ed87508a8ae6c2f5734c88b36f63aad7cf7e

SHA256
0f011e8a2c0e8012460d2d3f8c4f8770479114a7a82190f2cee0d549d0464f3a

SHA512
72fb85ba781b5ccda918d1f3935df81ff03ce0db48652647db1242a5c0fccdbeb245489115bc245f0e1f1aad5f1245f4f96f8ed0ff692ff3838adaf4179cb7a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS87D6B686\x64\System.Windows.Forms.dll
Filesize
12MB

MD5
868c8f0294d962d59e42cd99f84df7db

SHA1
4000ed87508a8ae6c2f5734c88b36f63aad7cf7e

SHA256
0f011e8a2c0e8012460d2d3f8c4f8770479114a7a82190f2cee0d549d0464f3a

SHA512
72fb85ba781b5ccda918d1f3935df81ff03ce0db48652647db1242a5c0fccdbeb245489115bc245f0e1f1aad5f1245f4f96f8ed0ff692ff3838adaf4179cb7a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS87D6B686\x64\TerraFX.Interop.Windows.dll
Filesize
874KB

MD5
02e0e4acaf12073066b467486d0358af

SHA1
3e7f37711fc8e8219aa1f99cb6b6aa8a6d78e476

SHA256
8e8844e26f2f9b50b5b2d2990e56c5dbd2ee90f613977ed469b5c16db253d80d

SHA512
7ef5bf3ff33c89cd8d39c25d365db047bac628282f74ac6a6b4b54602faddb50aafcb638498147be13b78d2241194967ed4779e402e4c174e78060625cf32c46

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS87D6B686\x64\TerraFX.Interop.Windows.dll
Filesize
874KB

MD5
02e0e4acaf12073066b467486d0358af

SHA1
3e7f37711fc8e8219aa1f99cb6b6aa8a6d78e476

SHA256
8e8844e26f2f9b50b5b2d2990e56c5dbd2ee90f613977ed469b5c16db253d80d

SHA512
7ef5bf3ff33c89cd8d39c25d365db047bac628282f74ac6a6b4b54602faddb50aafcb638498147be13b78d2241194967ed4779e402e4c174e78060625cf32c46

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS87D6B686\x64\clrjit.dll
Filesize
1MB

MD5
ece00d3324e879add5c7928dbbb9338c

SHA1
68e9fe01016c6d0dce5d0e29111b49e60330867b

SHA256
6f86ee8b4b17306ab623a2f4310151fec97d98abd774316ce10d40cdb8507a2f

SHA512
50b2ef7df03c920b103bfb17363b27d46d953f99217790c9acaa12357940a97fc8b5872e6e1665b88303db6c2bb55ca4175fd3c78c942ad9dd7c72c3c9c66315

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS87D6B686\x64\clrjit.dll
Filesize
1MB

MD5
ece00d3324e879add5c7928dbbb9338c

SHA1
68e9fe01016c6d0dce5d0e29111b49e60330867b

SHA256
6f86ee8b4b17306ab623a2f4310151fec97d98abd774316ce10d40cdb8507a2f

SHA512
50b2ef7df03c920b103bfb17363b27d46d953f99217790c9acaa12357940a97fc8b5872e6e1665b88303db6c2bb55ca4175fd3c78c942ad9dd7c72c3c9c66315

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS87D6B686\x64\coreclr.dll
Filesize
4MB

MD5
d221f609769e83ea77fd159f3ae009cd

SHA1
a0117b8f30085ee22de5756eb758af8efbd64080

SHA256
8f12e8464a0e8009f60e6d30beef4ce2f03e6f890580c567174d48f199e2fe61

SHA512
d3624a1b404cfc07632abf69002c4f2131012925f9af5c1d45729b98ab532951dea3f336107746318c6f77f0165914f5acefcceeb60b6658414ab7b3beef8bcd

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS87D6B686\x64\coreclr.dll
Filesize
4MB

MD5
d221f609769e83ea77fd159f3ae009cd

SHA1
a0117b8f30085ee22de5756eb758af8efbd64080

SHA256
8f12e8464a0e8009f60e6d30beef4ce2f03e6f890580c567174d48f199e2fe61

SHA512
d3624a1b404cfc07632abf69002c4f2131012925f9af5c1d45729b98ab532951dea3f336107746318c6f77f0165914f5acefcceeb60b6658414ab7b3beef8bcd

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS87D6B686\x64\hostfxr.dll
Filesize
373KB

MD5
07292fe45226d0860160e191476bd1e7

SHA1
d347d1b1f9356fe2d59b1a7c1c32b6799c527b30

SHA256
0ee83d7180cc7a716f5d8089bf2bfbed6a3a88d92f2a5519e8ff507ed35b72de

SHA512
42c7366b09f87780c8e1153ad556d904d98abb3f6800319893f75d644b0fd350149df64591b72b3f3ebdc51effa7e6c2c15ad0885513e81bd7c6613423ebe3a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS87D6B686\x64\hostfxr.dll
Filesize
373KB

MD5
07292fe45226d0860160e191476bd1e7

SHA1
d347d1b1f9356fe2d59b1a7c1c32b6799c527b30

SHA256
0ee83d7180cc7a716f5d8089bf2bfbed6a3a88d92f2a5519e8ff507ed35b72de

SHA512
42c7366b09f87780c8e1153ad556d904d98abb3f6800319893f75d644b0fd350149df64591b72b3f3ebdc51effa7e6c2c15ad0885513e81bd7c6613423ebe3a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS87D6B686\x64\hostpolicy.dll
Filesize
382KB

MD5
7d7edb04eef25cc94ccde47f45169ec7

SHA1
e155a20bdf4de0487493d44ccd167e36cbfd4af6

SHA256
402a29f533cdb6f945fd52c03bafd0330e2a57613f2d6b42b45aa7d929196958

SHA512
e3cb1e3bbf31aa9d0ca87e05254b9fe6a9b3e201fe58bf23c9e5ce2a1b6f81fc93f9a51cb65f3ff7575bbfc9a73ef32ac8f9b7195bb2b87bf50e37f64f2f6afb

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS87D6B686\x64\hostpolicy.dll
Filesize
382KB

MD5
7d7edb04eef25cc94ccde47f45169ec7

SHA1
e155a20bdf4de0487493d44ccd167e36cbfd4af6

SHA256
402a29f533cdb6f945fd52c03bafd0330e2a57613f2d6b42b45aa7d929196958

SHA512
e3cb1e3bbf31aa9d0ca87e05254b9fe6a9b3e201fe58bf23c9e5ce2a1b6f81fc93f9a51cb65f3ff7575bbfc9a73ef32ac8f9b7195bb2b87bf50e37f64f2f6afb

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSCE904476\SetupShim.exe
Filesize
136KB

MD5
db51c903838632898319669eb2271114

SHA1
25fa7935e834e56f7757321da7f84aad8d587eee

SHA256
babcd035c2f920004fcc922aa23c4fc55949b335b5e920bcec215a51c1e036d4

SHA512
a42fd32040317d351f98bf53e0832e1c9dfd7e1b45c5aba44dfbc79f25f88cc19dcb762410840cfa5cd63e8531496dfe25d63937af8758d712d06102e626fdbb

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSCE904476\SetupShim.exe
Filesize
136KB

MD5
db51c903838632898319669eb2271114

SHA1
25fa7935e834e56f7757321da7f84aad8d587eee

SHA256
babcd035c2f920004fcc922aa23c4fc55949b335b5e920bcec215a51c1e036d4

SHA512
a42fd32040317d351f98bf53e0832e1c9dfd7e1b45c5aba44dfbc79f25f88cc19dcb762410840cfa5cd63e8531496dfe25d63937af8758d712d06102e626fdbb

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSCE904476\SetupShim.exe
Filesize
136KB

MD5
db51c903838632898319669eb2271114

SHA1
25fa7935e834e56f7757321da7f84aad8d587eee

SHA256
babcd035c2f920004fcc922aa23c4fc55949b335b5e920bcec215a51c1e036d4

SHA512
a42fd32040317d351f98bf53e0832e1c9dfd7e1b45c5aba44dfbc79f25f88cc19dcb762410840cfa5cd63e8531496dfe25d63937af8758d712d06102e626fdbb

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSCE904476\x64\SetupDownloader\Newtonsoft.Json.dll
Filesize
695KB

MD5
715a1fbee4665e99e859eda667fe8034

SHA1
e13c6e4210043c4976dcdc447ea2b32854f70cc6

SHA256
c5c83bbc1741be6ff4c490c0aee34c162945423ec577c646538b2d21ce13199e

SHA512
bf9744ccb20f8205b2de39dbe79d34497b4d5c19b353d0f95e87ea7ef7fa1784aea87e10efcef11e4c90451eaa47a379204eb0533aa3018e378dd3511ce0e8ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSCE904476\x64\SetupDownloader\SetupDownloader.Configuration.json
Filesize
135B

MD5
8ca6779446e31e219589a08769448da2

SHA1
efc2d9e4b0f99daf0333406610d8031a5a8aed2f

SHA256
2b23a17e993b7837a89365cdd328541f58ddfd4ab2b45285058284eee5733613

SHA512
a6a863880835dcca879534ec8a353e2d7fef9c4410edfe41b59bac561492cc6084330c7aad1d2e8a9590b2a3d7551a0b8b6d45ced4d235f01b596d69b593bbf4

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSCE904476\x64\SetupDownloader\SetupDownloader.exe
Filesize
263KB

MD5
bf4f4864bcecd94eefa400a6ae55edbf

SHA1
eb106dbbe2c4d659cdd225229f9b82001152295a

SHA256
fb50d98597661e5f8386f0ea44f036031547f4e1c806d8aa38717337ed4fea95

SHA512
9bc97bbabb8023adb2544f59107a2e56346f787ed4f8ef042210601ad92cba54898d2e099946f87e11d5e72f0f1d637df11f7c028ff4e5ccaab7d265b307fb2b

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSCE904476\x64\SetupDownloader\SetupDownloader.exe
Filesize
263KB

MD5
bf4f4864bcecd94eefa400a6ae55edbf

SHA1
eb106dbbe2c4d659cdd225229f9b82001152295a

SHA256
fb50d98597661e5f8386f0ea44f036031547f4e1c806d8aa38717337ed4fea95

SHA512
9bc97bbabb8023adb2544f59107a2e56346f787ed4f8ef042210601ad92cba54898d2e099946f87e11d5e72f0f1d637df11f7c028ff4e5ccaab7d265b307fb2b

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSCE904476\x64\SetupDownloader\SetupDownloader.exe
Filesize
263KB

MD5
bf4f4864bcecd94eefa400a6ae55edbf

SHA1
eb106dbbe2c4d659cdd225229f9b82001152295a

SHA256
fb50d98597661e5f8386f0ea44f036031547f4e1c806d8aa38717337ed4fea95

SHA512
9bc97bbabb8023adb2544f59107a2e56346f787ed4f8ef042210601ad92cba54898d2e099946f87e11d5e72f0f1d637df11f7c028ff4e5ccaab7d265b307fb2b

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSCE904476\x64\SetupDownloader\SetupDownloader.exe.config
Filesize
218B

MD5
8f692dcbf1e68398b5dac3eba59872b0

SHA1
18011f5291790b0f49561385731ec5c6ad855415

SHA256
8c422938a58df86d88f29c61ff27006f0b3c9bb4742b11486bc5a01a6344129b

SHA512
e4bab07f4b9a9f725865e0e9f11fa31a4a1841399044f5976818782739b13d6c2012edf98199c5823ee9ecb3da40e7f3e2f88ab1394547801afa8b5b9dad9e79

Download Submit
C:\Users\Admin\AppData\Local\Temp\PdnSetupDownloader\d5987737-89e3-4c3e-a673-298c362002e8\paint.net.5.0.2.install.x64.exe
Filesize
61MB

MD5
ea9d42d85a902d06cac5a296ad274489

SHA1
169daa55bbe24114a3bf73553041fed22119a8f6

SHA256
3a93fa5e111285d1704884a325680ced7730d679949d9269794100a931dfee7c

SHA512
2d887582f0f407259c24545b0777a744258dae855594f46e0414dd2c23041be2b45ad04d477a6c2e84342c35f5df33b1efc744c620e275a8fea571defd0de9a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\PdnSetupDownloader\d5987737-89e3-4c3e-a673-298c362002e8\paint.net.5.0.2.install.x64.exe
Filesize
61MB

MD5
ea9d42d85a902d06cac5a296ad274489

SHA1
169daa55bbe24114a3bf73553041fed22119a8f6

SHA256
3a93fa5e111285d1704884a325680ced7730d679949d9269794100a931dfee7c

SHA512
2d887582f0f407259c24545b0777a744258dae855594f46e0414dd2c23041be2b45ad04d477a6c2e84342c35f5df33b1efc744c620e275a8fea571defd0de9a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\pdnSetupShim.log
Filesize
135B

MD5
3ad7703ad48a6890a72d20e52a0db836

SHA1
eb5a8ae0a6b5adc4775ee57ac8bf51c0e92a7111

SHA256
85817d2e0652c58e2ee265fa3a7ba24e55365df0975721e6f43a0beb5d97006d

SHA512
c910ef4da3862b488a1a4678e26c3f35f514d8ee02584cef4089a0104c91651fbe73c351b76a7c767d8c34620165ead97139389dfc8044493f641c0c21355aa5

Download Submit
C:\Users\Admin\AppData\Local\Temp\pdnSetupShim.log
Filesize
932B

MD5
9ef4240654cd9871e73e85bb4864f4bf

SHA1
cdeb85b443c2327bd4530a05857bfa5027060e74

SHA256
d52fb3f4bff28d9d614ba8635f5885d5f2bbcdd210a4faa84f1200d985096abb

SHA512
d5bdb15ec7d140dd7e0e64260305fff4f5c1a697ef45ebf804ebb6ff458ca4631e2b87d126aec9a48032680555f36476a365ad4da4366c758cf5b29fe3855b15

Download Submit
C:\Users\Admin\AppData\Local\Temp\pdnSetupShim.log
Filesize
775B

MD5
6845c9e906ca8966d40aa7d82904be74

SHA1
67c828ad847538f1bcc8450ebf4726551e392ac3

SHA256
99707cae9459007144fa7b03ec4b70c0e971dc83e51c3094629fd8d6a92c715b

SHA512
9886d4367d7bbc06d9533a0c6b4ba68b3744c45a53a892a10f83bccf8718c1b539a6629783bde508c570a314a2f72c1759c610b27d33100eebe6f4b53107233b

Download Submit
C:\Windows\Installer\e57c6ca.msi
Filesize
204MB

MD5
de6a045f5ef68a96f1fb0549ec958be9

SHA1
d50e72ee01dabf72691895efd5722f448dd28bde

SHA256
14fb04493868d2cc676fac34c249691e82fe828b444e98f8cb223cc76d793487

SHA512
712f0146a1de0e291f15637dc099c4bf277d96becdec070dc69796398c8961287e88b43fc95caea4bab71563d3e5a11efb2507c68cbd7d8e0275a77ceb2b1055

Download Submit
C:\Windows\Installer\{DBC43589-CC32-4502-BBEC-5B931AF4BD2E}\app_icon.ico
Filesize
75KB

MD5
d47d5e7a8a90d00db1644a40555d14c2

SHA1
652eae27caf68d1903616910f46bcca27f6623b0

SHA256
9c6063ea5b8a118f1aeab0c201f5bc7fa5d630dcfd80d0c8bf3efe67bfde6953

SHA512
ecf923b823e246416ad4f010647a14c764325ff83752d542313ccd74143f800c1d37f14952e02ed78813f0417c94a0e5eccb02daecabf242444cd5d6a635ec8a

Download Submit
memory/464-183-0x000001F752190000-0x000001F7521D6000-memory.dmp

Filesize
280KB

Download
memory/464-185-0x000001F76D820000-0x000001F76D8D2000-memory.dmp

Filesize
712KB

Download
memory/464-187-0x000001F752580000-0x000001F7525A2000-memory.dmp

Filesize
136KB

Download
memory/464-188-0x000001F76DA20000-0x000001F76DA30000-memory.dmp

Filesize
64KB

Download
memory/464-190-0x000001F76DA20000-0x000001F76DA30000-memory.dmp

Filesize
64KB

Download
memory/464-191-0x000001F76DA20000-0x000001F76DA30000-memory.dmp

Filesize
64KB

Download
memory/464-193-0x000001F753F80000-0x000001F753F92000-memory.dmp

Filesize
72KB

Download
memory/464-189-0x000001F76DA20000-0x000001F76DA30000-memory.dmp

Filesize
64KB

Download