Analysis
-
max time kernel
143s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
21-04-2023 15:37
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://github.com/paintdotnet/release/releases/download/v5.0.3/paint.net.5.0.3.install.anycpu.web.zip
Resource
win10v2004-20230220-en
General
-
Target
https://github.com/paintdotnet/release/releases/download/v5.0.3/paint.net.5.0.3.install.anycpu.web.zip
Malware Config
Signatures
-
CoreEntity .NET Packer 1 IoCs
A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.
Processes:
resource yara_rule C:\Windows\Installer\e581ba1.msi coreentity -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
paint.net.5.0.3.install.x64.exeSetupFrontEnd.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation paint.net.5.0.3.install.x64.exe Key value queried \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation SetupFrontEnd.exe -
Executes dropped EXE 7 IoCs
Processes:
SetupShim.exeSetupDownloader.exepaint.net.5.0.3.install.x64.exeSetupShim.exeSetupFrontEnd.exepaintdotnet.exePaintDotNet.exepid process 3912 SetupShim.exe 4088 SetupDownloader.exe 3656 paint.net.5.0.3.install.x64.exe 4172 SetupShim.exe 1320 SetupFrontEnd.exe 4020 paintdotnet.exe 1384 PaintDotNet.exe -
Loads dropped DLL 64 IoCs
Processes:
SetupFrontEnd.exepaintdotnet.exepid process 1320 SetupFrontEnd.exe 1320 SetupFrontEnd.exe 1320 SetupFrontEnd.exe 1320 SetupFrontEnd.exe 1320 SetupFrontEnd.exe 1320 SetupFrontEnd.exe 1320 SetupFrontEnd.exe 1320 SetupFrontEnd.exe 1320 SetupFrontEnd.exe 1320 SetupFrontEnd.exe 1320 SetupFrontEnd.exe 1320 SetupFrontEnd.exe 1320 SetupFrontEnd.exe 1320 SetupFrontEnd.exe 1320 SetupFrontEnd.exe 1320 SetupFrontEnd.exe 1320 SetupFrontEnd.exe 1320 SetupFrontEnd.exe 1320 SetupFrontEnd.exe 1320 SetupFrontEnd.exe 1320 SetupFrontEnd.exe 1320 SetupFrontEnd.exe 1320 SetupFrontEnd.exe 1320 SetupFrontEnd.exe 1320 SetupFrontEnd.exe 1320 SetupFrontEnd.exe 1320 SetupFrontEnd.exe 1320 SetupFrontEnd.exe 1320 SetupFrontEnd.exe 1320 SetupFrontEnd.exe 1320 SetupFrontEnd.exe 1320 SetupFrontEnd.exe 1320 SetupFrontEnd.exe 1320 SetupFrontEnd.exe 1320 SetupFrontEnd.exe 1320 SetupFrontEnd.exe 1320 SetupFrontEnd.exe 1320 SetupFrontEnd.exe 1320 SetupFrontEnd.exe 1320 SetupFrontEnd.exe 1320 SetupFrontEnd.exe 1320 SetupFrontEnd.exe 1320 SetupFrontEnd.exe 1320 SetupFrontEnd.exe 1320 SetupFrontEnd.exe 1320 SetupFrontEnd.exe 1320 SetupFrontEnd.exe 1320 SetupFrontEnd.exe 1320 SetupFrontEnd.exe 1320 SetupFrontEnd.exe 1320 SetupFrontEnd.exe 1320 SetupFrontEnd.exe 1320 SetupFrontEnd.exe 1320 SetupFrontEnd.exe 1320 SetupFrontEnd.exe 1320 SetupFrontEnd.exe 1320 SetupFrontEnd.exe 1320 SetupFrontEnd.exe 1320 SetupFrontEnd.exe 1320 SetupFrontEnd.exe 1320 SetupFrontEnd.exe 1320 SetupFrontEnd.exe 4020 paintdotnet.exe 4020 paintdotnet.exe -
Registers COM server for autorun 1 TTPs 3 IoCs
Processes:
paintdotnet.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FBF113F1-D7C8-477C-A23A-E600E7937E11}\InprocServer32 paintdotnet.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FBF113F1-D7C8-477C-A23A-E600E7937E11}\InprocServer32\ = "C:\\Program Files\\paint.net\\PaintDotNet.ShellExtension.x64.dll" paintdotnet.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FBF113F1-D7C8-477C-A23A-E600E7937E11}\InprocServer32\ThreadingModel = "Apartment" paintdotnet.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
SetupFrontEnd.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA SetupFrontEnd.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
msiexec.exedescription ioc process File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Z: msiexec.exe -
Drops file in Program Files directory 64 IoCs
Processes:
msiexec.exedescription ioc process File created C:\Program Files\paint.net\PaintDotNet.Strings.3.he.resources msiexec.exe File created C:\Program Files\paint.net\PaintDotNet.Strings.3.sv.resources msiexec.exe File created C:\Program Files\paint.net\PaintDotNet.Strings.3.ZH-CN.resources msiexec.exe File created C:\Program Files\paint.net\PaintDotNet.SystemLayer.dll msiexec.exe File created C:\Program Files\paint.net\System.Reflection.TypeExtensions.dll msiexec.exe File created C:\Program Files\paint.net\System.Runtime.InteropServices.JavaScript.dll msiexec.exe File created C:\Program Files\paint.net\D3DCompiler_47_cor3.dll msiexec.exe File created C:\Program Files\paint.net\PaintDotNet.Primitives.xml msiexec.exe File created C:\Program Files\paint.net\System.Runtime.Serialization.dll msiexec.exe File created C:\Program Files\paint.net\System.Security.Cryptography.Csp.dll msiexec.exe File created C:\Program Files\paint.net\mscordbi.dll msiexec.exe File created C:\Program Files\paint.net\System.Diagnostics.Debug.dll msiexec.exe File created C:\Program Files\paint.net\System.IO.Pipes.AccessControl.dll msiexec.exe File created C:\Program Files\paint.net\System.Net.ServicePoint.dll msiexec.exe File created C:\Program Files\paint.net\System.Private.Xml.Linq.dll msiexec.exe File created C:\Program Files\paint.net\System.Reflection.DispatchProxy.dll msiexec.exe File created C:\Program Files\paint.net\clrjit.dll msiexec.exe File created C:\Program Files\paint.net\ilasm.exe msiexec.exe File created C:\Program Files\paint.net\PaintDotNet.Strings.3.ca.resources msiexec.exe File created C:\Program Files\paint.net\System.Collections.Immutable.dll msiexec.exe File created C:\Program Files\paint.net\System.ComponentModel.EventBasedAsync.dll msiexec.exe File created C:\Program Files\paint.net\System.Net.NetworkInformation.dll msiexec.exe File created C:\Program Files\paint.net\System.Threading.Tasks.dll msiexec.exe File created C:\Program Files\paint.net\createdump.exe msiexec.exe File created C:\Program Files\paint.net\PaintDotNet.Data.dll msiexec.exe File created C:\Program Files\paint.net\PaintDotNet.Effects.dll msiexec.exe File created C:\Program Files\paint.net\PaintDotNet.Strings.3.sl.resources msiexec.exe File created C:\Program Files\paint.net\System.Resources.ResourceManager.dll msiexec.exe File created C:\Program Files\paint.net\Mono.Cecil.Rocks.dll msiexec.exe File created C:\Program Files\paint.net\PaintDotNet.Data.xml msiexec.exe File created C:\Program Files\paint.net\PaintDotNet.PropertySystem.dll msiexec.exe File created C:\Program Files\paint.net\System.Text.Encoding.Extensions.dll msiexec.exe File created C:\Program Files\paint.net\System.Web.HttpUtility.dll msiexec.exe File created C:\Program Files\paint.net\UIAutomationTypes.dll msiexec.exe File created C:\Program Files\paint.net\Microsoft.VisualBasic.dll msiexec.exe File created C:\Program Files\paint.net\Microsoft.Win32.Registry.dll msiexec.exe File created C:\Program Files\paint.net\PaintDotNet.Framework.xml msiexec.exe File created C:\Program Files\paint.net\PaintDotNet.Windows.Core.xml msiexec.exe File created C:\Program Files\paint.net\System.Data.DataSetExtensions.dll msiexec.exe File created C:\Program Files\paint.net\System.Net.HttpListener.dll msiexec.exe File created C:\Program Files\paint.net\Bundled\WebPFileType\License.txt msiexec.exe File created C:\Program Files\paint.net\Newtonsoft.Json.dll msiexec.exe File created C:\Program Files\paint.net\paintdotnet.deps.json msiexec.exe File created C:\Program Files\paint.net\PaintDotNet.UI.pdb msiexec.exe File created C:\Program Files\paint.net\PresentationFramework.Luna.dll msiexec.exe File created C:\Program Files\paint.net\System.Collections.Concurrent.dll msiexec.exe File created C:\Program Files\paint.net\System.Diagnostics.PerformanceCounter.dll msiexec.exe File created C:\Program Files\paint.net\System.Diagnostics.StackTrace.dll msiexec.exe File created C:\Program Files\paint.net\System.Reflection.Extensions.dll msiexec.exe File created C:\Program Files\paint.net\PaintDotNet.Strings.3.nl.resources msiexec.exe File created C:\Program Files\paint.net\PaintDotNet.Strings.3.PT-BR.resources msiexec.exe File created C:\Program Files\paint.net\System.Windows.Input.Manipulations.dll msiexec.exe File created C:\Program Files\paint.net\System.Security.Cryptography.Algorithms.dll msiexec.exe File created C:\Program Files\paint.net\System.Security.Principal.Windows.dll msiexec.exe File created C:\Program Files\paint.net\System.Threading.Tasks.Parallel.dll msiexec.exe File created C:\Program Files\paint.net\System.IO.FileSystem.AccessControl.dll msiexec.exe File created C:\Program Files\paint.net\System.Threading.AccessControl.dll msiexec.exe File created C:\Program Files\paint.net\paintdotnet.exe msiexec.exe File created C:\Program Files\paint.net\PaintDotNet.UI.dll msiexec.exe File created C:\Program Files\paint.net\PaintDotNet.Windows.Framework.dll msiexec.exe File created C:\Program Files\paint.net\System.IO.MemoryMappedFiles.dll msiexec.exe File created C:\Program Files\paint.net\Bundled\WebPFileType\WebPFileType.pdb msiexec.exe File created C:\Program Files\paint.net\msvcp140_1.dll msiexec.exe File created C:\Program Files\paint.net\PaintDotNet.Core.dll msiexec.exe -
Drops file in Windows directory 11 IoCs
Processes:
msiexec.exedescription ioc process File opened for modification C:\Windows\Installer\e581ba1.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI3D52.tmp msiexec.exe File created C:\Windows\Installer\e581ba4.msi msiexec.exe File created C:\Windows\Installer\{67D72105-13E9-4EB7-8059-28DFC3A2DCA1}\app_icon.ico msiexec.exe File created C:\Windows\Installer\e581ba1.msi msiexec.exe File created C:\Windows\Installer\SourceHash{67D72105-13E9-4EB7-8059-28DFC3A2DCA1} msiexec.exe File opened for modification C:\Windows\Installer\{67D72105-13E9-4EB7-8059-28DFC3A2DCA1}\app_icon.ico msiexec.exe File opened for modification C:\Windows\Installer\MSI68B9.tmp msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
vssvc.exedescription ioc process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000009865abc95f2d4b980000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800009865abc90000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3f000000ffffffff0000000007000100006809009865abc9000000000000d0120000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000009865abc900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000009865abc900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe -
Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs
Processes:
iexplore.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\PhishingFilter iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = d42e80ebae45d901 iexplore.exe -
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "234205463" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\RepId iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\RepId\PublicId = "{B2F6DE5A-6AA0-4776-B9AE-B93D4EC9406C}" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31028344" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "234205463" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31028344" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{38CB037C-E06B-11ED-9EF6-DE61172DF127} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "388863640" iexplore.exe -
Modifies data under HKEY_USERS 5 IoCs
Processes:
msiexec.exedescription ioc process Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1F msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\20 msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1E\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f msiexec.exe -
Modifies registry class 64 IoCs
Processes:
paintdotnet.exemsiexec.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\paintdotnet\shell paintdotnet.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\paintdotnet.exe\shell\edit\command\ = "\"C:\\Program Files\\paint.net\\paintdotnet.exe\" \"%1\"" paintdotnet.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\50127D769E317BE4089582FD3C2ACD1A\InstanceType = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.pdn\OpenWithProgids paintdotnet.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bmp\OpenWithProgids\paint.net.1 paintdotnet.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.dds\OpenWithProgids\paint.net.1 paintdotnet.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\paintdotnet.exe\SupportedTypes\.jpe paintdotnet.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.tif\OpenWithProgids\paint.net.1 paintdotnet.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\50127D769E317BE4089582FD3C2ACD1A\Assignment = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\50127D769E317BE4089582FD3C2ACD1A\SourceList\Net\1 = "C:\\Program Files\\paint.net\\Staging\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\paintdotnet\shell\open\command paintdotnet.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\paintdotnet.exe\FriendlyAppName = "paint.net" paintdotnet.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.pdn\PerceivedType = "image" paintdotnet.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\paintdotnet.exe\SupportedTypes\.avif paintdotnet.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\50127D769E317BE4089582FD3C2ACD1A\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\paintdotnet\DefaultIcon\ = "C:\\Program Files\\paint.net\\paintdotnet.exe,0" paintdotnet.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\50127D769E317BE4089582FD3C2ACD1A msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\50127D769E317BE4089582FD3C2ACD1A\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\paintdotnet.exe\SupportedTypes\.wdp paintdotnet.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\paintdotnet\shell\open paintdotnet.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FBF113F1-D7C8-477C-A23A-E600E7937E11}\InprocServer32\ = "C:\\Program Files\\paint.net\\PaintDotNet.ShellExtension.x64.dll" paintdotnet.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.heic\OpenWithProgids\paint.net.1 paintdotnet.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\50127D769E317BE4089582FD3C2ACD1A\Version = "83886083" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\paint.net.1\CurVer\ = "paint.net.1" paintdotnet.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\paintdotnet\DefaultIcon paintdotnet.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\paint.net.1\ShellEx\{E357FCCD-A995-4576-B01F-234630154E96} paintdotnet.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wmp\OpenWithProgids paintdotnet.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.pdn\ShellEx\{E357FCCD-A995-4576-B01F-234630154E96}\ = "{FBF113F1-D7C8-477C-A23A-E600E7937E11}" paintdotnet.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\paintdotnet.exe\shell paintdotnet.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.heic\OpenWithProgids paintdotnet.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.jpg\OpenWithProgids\paint.net.1 paintdotnet.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\paintdotnet.exe\shell\edit paintdotnet.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\paintdotnet.exe\SupportedTypes\.bmp paintdotnet.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.rle\OpenWithProgids\paint.net.1 paintdotnet.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\50127D769E317BE4089582FD3C2ACD1A\SourceList\Net msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\paint.net.ThumbnailProvider\CurVer paintdotnet.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\paintdotnet.exe\shell\edit\command paintdotnet.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.jfif\OpenWithProgids\paint.net.1 paintdotnet.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.tga\OpenWithProgids\paint.net.1 paintdotnet.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\paintdotnet.exe\SupportedTypes\.webp paintdotnet.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\paint.net.1\ShellEx paintdotnet.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.pdn paintdotnet.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Applications paintdotnet.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\paintdotnet.exe\SupportedTypes\.jxr paintdotnet.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\paintdotnet.exe\SupportedTypes\.tga paintdotnet.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\50127D769E317BE4089582FD3C2ACD1A\PackageCode = "E6C4A3919FD404F45A92D4D8D93DA042" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.jpe\OpenWithProgids\paint.net.1 paintdotnet.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.jpeg\OpenWithProgids\paint.net.1 paintdotnet.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.avif\OpenWithProgids\paint.net.1 paintdotnet.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\paint.net.1\shell\edit\command paintdotnet.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\paint.net.1\ShellEx\{E357FCCD-A995-4576-B01F-234630154E96}\ = "{FBF113F1-D7C8-477C-A23A-E600E7937E11}" paintdotnet.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\paintdotnet.exe\SupportedTypes\.tif paintdotnet.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wdp\OpenWithProgids\paint.net.1 paintdotnet.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\paintdotnet.exe\SupportedTypes paintdotnet.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\paintdotnet.exe\SupportedTypes\.wmp paintdotnet.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\paint.net.ThumbnailProvider\CLSID paintdotnet.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.pdn\OpenWithProgids\paint.net.1 paintdotnet.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\paintdotnet.exe\SupportedTypes\.gif paintdotnet.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\paintdotnet.exe\SupportedTypes\.rle paintdotnet.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.webp\OpenWithProgids\paint.net.1 paintdotnet.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\paint.net.1\CurVer paintdotnet.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\paint.net.1\shell\open\command paintdotnet.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FBF113F1-D7C8-477C-A23A-E600E7937E11}\InprocServer32\ThreadingModel = "Apartment" paintdotnet.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\50127D769E317BE4089582FD3C2ACD1A\ProductIcon = "C:\\Windows\\Installer\\{67D72105-13E9-4EB7-8059-28DFC3A2DCA1}\\app_icon.ico" msiexec.exe -
Processes:
SetupDownloader.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 SetupDownloader.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e SetupDownloader.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa20f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e SetupDownloader.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
msiexec.exepid process 2224 msiexec.exe 2224 msiexec.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
Processes:
SetupFrontEnd.exePaintDotNet.exepid process 1320 SetupFrontEnd.exe 1384 PaintDotNet.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
SetupDownloader.exeSetupFrontEnd.exevssvc.exemsiexec.exesrtasks.exedescription pid process Token: SeDebugPrivilege 4088 SetupDownloader.exe Token: SeDebugPrivilege 1320 SetupFrontEnd.exe Token: SeBackupPrivilege 1624 vssvc.exe Token: SeRestorePrivilege 1624 vssvc.exe Token: SeAuditPrivilege 1624 vssvc.exe Token: SeBackupPrivilege 1320 SetupFrontEnd.exe Token: SeRestorePrivilege 1320 SetupFrontEnd.exe Token: SeShutdownPrivilege 1320 SetupFrontEnd.exe Token: SeIncreaseQuotaPrivilege 1320 SetupFrontEnd.exe Token: SeSecurityPrivilege 2224 msiexec.exe Token: SeCreateTokenPrivilege 1320 SetupFrontEnd.exe Token: SeAssignPrimaryTokenPrivilege 1320 SetupFrontEnd.exe Token: SeLockMemoryPrivilege 1320 SetupFrontEnd.exe Token: SeIncreaseQuotaPrivilege 1320 SetupFrontEnd.exe Token: SeMachineAccountPrivilege 1320 SetupFrontEnd.exe Token: SeTcbPrivilege 1320 SetupFrontEnd.exe Token: SeSecurityPrivilege 1320 SetupFrontEnd.exe Token: SeTakeOwnershipPrivilege 1320 SetupFrontEnd.exe Token: SeLoadDriverPrivilege 1320 SetupFrontEnd.exe Token: SeSystemProfilePrivilege 1320 SetupFrontEnd.exe Token: SeSystemtimePrivilege 1320 SetupFrontEnd.exe Token: SeProfSingleProcessPrivilege 1320 SetupFrontEnd.exe Token: SeIncBasePriorityPrivilege 1320 SetupFrontEnd.exe Token: SeCreatePagefilePrivilege 1320 SetupFrontEnd.exe Token: SeCreatePermanentPrivilege 1320 SetupFrontEnd.exe Token: SeBackupPrivilege 1320 SetupFrontEnd.exe Token: SeRestorePrivilege 1320 SetupFrontEnd.exe Token: SeShutdownPrivilege 1320 SetupFrontEnd.exe Token: SeDebugPrivilege 1320 SetupFrontEnd.exe Token: SeAuditPrivilege 1320 SetupFrontEnd.exe Token: SeSystemEnvironmentPrivilege 1320 SetupFrontEnd.exe Token: SeChangeNotifyPrivilege 1320 SetupFrontEnd.exe Token: SeRemoteShutdownPrivilege 1320 SetupFrontEnd.exe Token: SeUndockPrivilege 1320 SetupFrontEnd.exe Token: SeSyncAgentPrivilege 1320 SetupFrontEnd.exe Token: SeEnableDelegationPrivilege 1320 SetupFrontEnd.exe Token: SeManageVolumePrivilege 1320 SetupFrontEnd.exe Token: SeImpersonatePrivilege 1320 SetupFrontEnd.exe Token: SeCreateGlobalPrivilege 1320 SetupFrontEnd.exe Token: SeRestorePrivilege 2224 msiexec.exe Token: SeTakeOwnershipPrivilege 2224 msiexec.exe Token: SeRestorePrivilege 2224 msiexec.exe Token: SeTakeOwnershipPrivilege 2224 msiexec.exe Token: SeBackupPrivilege 5040 srtasks.exe Token: SeRestorePrivilege 5040 srtasks.exe Token: SeSecurityPrivilege 5040 srtasks.exe Token: SeTakeOwnershipPrivilege 5040 srtasks.exe Token: SeBackupPrivilege 5040 srtasks.exe Token: SeRestorePrivilege 5040 srtasks.exe Token: SeSecurityPrivilege 5040 srtasks.exe Token: SeTakeOwnershipPrivilege 5040 srtasks.exe Token: SeRestorePrivilege 2224 msiexec.exe Token: SeTakeOwnershipPrivilege 2224 msiexec.exe Token: SeRestorePrivilege 2224 msiexec.exe Token: SeTakeOwnershipPrivilege 2224 msiexec.exe Token: SeRestorePrivilege 2224 msiexec.exe Token: SeTakeOwnershipPrivilege 2224 msiexec.exe Token: SeRestorePrivilege 2224 msiexec.exe Token: SeTakeOwnershipPrivilege 2224 msiexec.exe Token: SeRestorePrivilege 2224 msiexec.exe Token: SeTakeOwnershipPrivilege 2224 msiexec.exe Token: SeRestorePrivilege 2224 msiexec.exe Token: SeTakeOwnershipPrivilege 2224 msiexec.exe Token: SeRestorePrivilege 2224 msiexec.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
iexplore.exeSetupFrontEnd.exePaintDotNet.exepid process 4988 iexplore.exe 4988 iexplore.exe 1320 SetupFrontEnd.exe 1384 PaintDotNet.exe -
Suspicious use of SetWindowsHookEx 14 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpaint.net.5.0.3.install.anycpu.web.exeSetupShim.exepaint.net.5.0.3.install.x64.exeSetupShim.exeSetupFrontEnd.exePaintDotNet.exepid process 4988 iexplore.exe 4988 iexplore.exe 1984 IEXPLORE.EXE 1984 IEXPLORE.EXE 3980 paint.net.5.0.3.install.anycpu.web.exe 3912 SetupShim.exe 3656 paint.net.5.0.3.install.x64.exe 4172 SetupShim.exe 1320 SetupFrontEnd.exe 1384 PaintDotNet.exe 1384 PaintDotNet.exe 1384 PaintDotNet.exe 1384 PaintDotNet.exe 1384 PaintDotNet.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
iexplore.exepaint.net.5.0.3.install.anycpu.web.exeSetupShim.exeSetupDownloader.exepaint.net.5.0.3.install.x64.exeSetupShim.exemsiexec.exeSetupFrontEnd.exedescription pid process target process PID 4988 wrote to memory of 1984 4988 iexplore.exe IEXPLORE.EXE PID 4988 wrote to memory of 1984 4988 iexplore.exe IEXPLORE.EXE PID 4988 wrote to memory of 1984 4988 iexplore.exe IEXPLORE.EXE PID 3980 wrote to memory of 3912 3980 paint.net.5.0.3.install.anycpu.web.exe SetupShim.exe PID 3980 wrote to memory of 3912 3980 paint.net.5.0.3.install.anycpu.web.exe SetupShim.exe PID 3980 wrote to memory of 3912 3980 paint.net.5.0.3.install.anycpu.web.exe SetupShim.exe PID 3912 wrote to memory of 4088 3912 SetupShim.exe SetupDownloader.exe PID 3912 wrote to memory of 4088 3912 SetupShim.exe SetupDownloader.exe PID 4088 wrote to memory of 3656 4088 SetupDownloader.exe paint.net.5.0.3.install.x64.exe PID 4088 wrote to memory of 3656 4088 SetupDownloader.exe paint.net.5.0.3.install.x64.exe PID 4088 wrote to memory of 3656 4088 SetupDownloader.exe paint.net.5.0.3.install.x64.exe PID 3656 wrote to memory of 4172 3656 paint.net.5.0.3.install.x64.exe SetupShim.exe PID 3656 wrote to memory of 4172 3656 paint.net.5.0.3.install.x64.exe SetupShim.exe PID 3656 wrote to memory of 4172 3656 paint.net.5.0.3.install.x64.exe SetupShim.exe PID 4172 wrote to memory of 1320 4172 SetupShim.exe SetupFrontEnd.exe PID 4172 wrote to memory of 1320 4172 SetupShim.exe SetupFrontEnd.exe PID 2224 wrote to memory of 4020 2224 msiexec.exe paintdotnet.exe PID 2224 wrote to memory of 4020 2224 msiexec.exe paintdotnet.exe PID 1320 wrote to memory of 1384 1320 SetupFrontEnd.exe PaintDotNet.exe PID 1320 wrote to memory of 1384 1320 SetupFrontEnd.exe PaintDotNet.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://github.com/paintdotnet/release/releases/download/v5.0.3/paint.net.5.0.3.install.anycpu.web.zip1⤵
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4988 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\AppData\Local\Temp\Temp1_paint.net.5.0.3.install.anycpu.web.zip\paint.net.5.0.3.install.anycpu.web.exe"C:\Users\Admin\AppData\Local\Temp\Temp1_paint.net.5.0.3.install.anycpu.web.zip\paint.net.5.0.3.install.anycpu.web.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSC8F3A6F6\SetupShim.exe"C:\Users\Admin\AppData\Local\Temp\7zSC8F3A6F6\SetupShim.exe" /suppressReboot2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSC8F3A6F6\x64\SetupDownloader\SetupDownloader.exe"x64\SetupDownloader\SetupDownloader.exe" /SkipSuccessPrompt "C:\Users\Admin\AppData\Local\Temp\7zSC8F3A6F6\SetupShim.exe" /suppressReboot3⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PdnSetupDownloader\012fe196-9800-4d04-a949-7cb74b92e52d\paint.net.5.0.3.install.x64.exe"C:\Users\Admin\AppData\Local\Temp\PdnSetupDownloader\012fe196-9800-4d04-a949-7cb74b92e52d\paint.net.5.0.3.install.x64.exe" C:\Users\Admin\AppData\Local\Temp\7zSC8F3A6F6\SetupShim.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS84EBD077\SetupShim.exe"C:\Users\Admin\AppData\Local\Temp\7zS84EBD077\SetupShim.exe" /suppressReboot C:\Users\Admin\AppData\Local\Temp\7zSC8F3A6F6\SetupShim.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS84EBD077\x64\SetupFrontEnd.exe"x64\SetupFrontEnd.exe" "C:\Users\Admin\AppData\Local\Temp\7zS84EBD077\SetupShim.exe" /suppressReboot C:\Users\Admin\AppData\Local\Temp\7zSC8F3A6F6\SetupShim.exe6⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\paint.net\PaintDotNet.exe"C:\Program Files\paint.net\PaintDotNet.exe"7⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:31⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\paint.net\paintdotnet.exe"C:\Program Files\paint.net\paintdotnet.exe" /setupActions /install DESKTOPSHORTCUT=1 PDNUPDATING=0 SKIPCLEANUP=0 "PROGRAMSGROUP=" /disablePGO /skipEstablishNVProfile /skipRepairAttempt2⤵
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Config.Msi\e581ba3.rbsFilesize
79KB
MD54f2ef1db2b4353129c98d360253ba110
SHA1e98c17dc938fc08cafc06168b5fc78c6574847ac
SHA25649f7290cd7c4d5b41be4ebf3a5f792adc0ff5d23ff083eaa9d39e28c65d00efd
SHA512d43c9faae98d094100ad5a55c1c91b44e5142b56344f9c35858b44596be493e670d63b82633b340d694c72e76d6eb3c8c4749a0151cbc9cf2e1a3d036482efba
-
C:\Config.Msi\e581ba5.rbsFilesize
663B
MD5ae1b6563b8f27d6ac44c0700feb911fd
SHA1fdd9ff6f863332ed14ef48eb8bfd3ba0c2dd7f28
SHA256788ea0efb44d1e917e2e76c6c17b5df3d98a849eb46621e61b4e20283ddbad9a
SHA512e4d35b8e5137783cd643fb0261bb0137fda2b0c18e9663c01c673340dcf6081d738f6b176995be3c46aa7d1131245599bef1d826ac255ce11fdffb30c6f92711
-
C:\Program Files\paint.net\mscordaccore_amd64_amd64_7.0.423.11508.dllFilesize
1.3MB
MD5a54257d04b9910dc618d1f7833a298f1
SHA1bab917f9811f502d4928c0f0068d08c42827c6c9
SHA256180b92fe910242114cdd5d605ea7254faedefd412b7b7100485b5dec3b7ad2cc
SHA51223c4a9a0f84a0089ed43d02be855a0209f10a5bd5238c7a0a115c26e488ec0af1662429c32a4cc1b500d3c93f357e5d321dd435cc0bfd66bc52f81a34fe4627c
-
C:\Program Files\paint.net\paintdotnet.runtimeconfig.jsonFilesize
449B
MD5855798731cf9f727530fdf409006fc1b
SHA13433add3eb478374dd58d6b3147b34758487dee8
SHA256a835bc55d5d331510c679221eb7de631db51edf41fe57022d499893bafe782d6
SHA512f7749bbdead985f2d0556a6aa77583b39c563878fd5d6844dd31eb9c026b082d2deba7d3b84a3598b7745ca2a911d41e4672febc993e20f6d21421e4d7490fa1
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\UUIKWEAJ\paint.net.5.0.3.install.anycpu.web.zip.tz1snfd.partialFilesize
734KB
MD5834cbfa14264790676c0c33cf6d4bab0
SHA1d91938fbd9c80be3328e6de4592587386de7a64d
SHA2569100841237455418412447da8ddaa2bbb810577de6bb18179f2384cccd6ff614
SHA51280bf90560ff8cff9119372f9261de35fc780a735603ebb3722f332afd53342fb0058bff759334eeed76eb1054392e3e171f6aee4487345c54278859020d9f384
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\WPCK8CWE\paint.net.5.0.3.install.anycpu.web[1].zipFilesize
734KB
MD5834cbfa14264790676c0c33cf6d4bab0
SHA1d91938fbd9c80be3328e6de4592587386de7a64d
SHA2569100841237455418412447da8ddaa2bbb810577de6bb18179f2384cccd6ff614
SHA51280bf90560ff8cff9119372f9261de35fc780a735603ebb3722f332afd53342fb0058bff759334eeed76eb1054392e3e171f6aee4487345c54278859020d9f384
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\WPCK8CWE\suggestions[1].en-USFilesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
C:\Users\Admin\AppData\Local\Temp\7zS84EBD077\SetupShim.exeFilesize
136KB
MD5e2b8f4221931e23f65dcdb2fd051be8d
SHA176db9efa379bef5c65c8f2e1733bc6575747502a
SHA256621499bdf212eb1aaf80b3d2c7befffcaa5fb2804b301d14690a236667a7908a
SHA512700ef42e2199d6dad3a48ec8c562b43cc7210ed52e65bc2cc77b3f2905173be081f19a622efaab579fc098c165c0b3c5f3644cf98f81629a2f0d4a722014b5b2
-
C:\Users\Admin\AppData\Local\Temp\7zS84EBD077\SetupShim.exeFilesize
136KB
MD5e2b8f4221931e23f65dcdb2fd051be8d
SHA176db9efa379bef5c65c8f2e1733bc6575747502a
SHA256621499bdf212eb1aaf80b3d2c7befffcaa5fb2804b301d14690a236667a7908a
SHA512700ef42e2199d6dad3a48ec8c562b43cc7210ed52e65bc2cc77b3f2905173be081f19a622efaab579fc098c165c0b3c5f3644cf98f81629a2f0d4a722014b5b2
-
C:\Users\Admin\AppData\Local\Temp\7zS84EBD077\x64\PaintDotNet.Base.dllFilesize
718KB
MD52db7bf99c25c83a1297d2ac5da875331
SHA1088df6faa8f3e86a07ccc4a7604b6c51c1d3d371
SHA2560aab4adbcce2569aca4ce59997cba61d548b284c9734b5905f6c3a9f6e91b723
SHA5125b2e95aa8a54ec25410042395b276d8b29d4dc4cdd1bd0a5d65bab0758c2bd1830a11609d317c9537a45d7516cf0d3ff613f7940d419ec5c26cb35cce05d9017
-
C:\Users\Admin\AppData\Local\Temp\7zS84EBD077\x64\PaintDotNet.Base.dllFilesize
718KB
MD52db7bf99c25c83a1297d2ac5da875331
SHA1088df6faa8f3e86a07ccc4a7604b6c51c1d3d371
SHA2560aab4adbcce2569aca4ce59997cba61d548b284c9734b5905f6c3a9f6e91b723
SHA5125b2e95aa8a54ec25410042395b276d8b29d4dc4cdd1bd0a5d65bab0758c2bd1830a11609d317c9537a45d7516cf0d3ff613f7940d419ec5c26cb35cce05d9017
-
C:\Users\Admin\AppData\Local\Temp\7zS84EBD077\x64\PaintDotNet.ComponentModel.dllFilesize
98KB
MD5c3f0602203022db89e1c8ff982aca603
SHA1491db9889dd1b59b21ef234a56fa2fb637c286ab
SHA25642503924190bf885450b376d4685e112aaa78e3a1e219703f210fb43f846fddd
SHA512083b72c2a46de419eab12f97ddbb3acaff15736471e2eb2efc49b478459e7eb14242b2de5bd3df59f0be006f163457313b7e9aa338124c636273bdbe4682bd95
-
C:\Users\Admin\AppData\Local\Temp\7zS84EBD077\x64\PaintDotNet.ComponentModel.dllFilesize
98KB
MD5c3f0602203022db89e1c8ff982aca603
SHA1491db9889dd1b59b21ef234a56fa2fb637c286ab
SHA25642503924190bf885450b376d4685e112aaa78e3a1e219703f210fb43f846fddd
SHA512083b72c2a46de419eab12f97ddbb3acaff15736471e2eb2efc49b478459e7eb14242b2de5bd3df59f0be006f163457313b7e9aa338124c636273bdbe4682bd95
-
C:\Users\Admin\AppData\Local\Temp\7zS84EBD077\x64\PaintDotNet.Core.dllFilesize
2.2MB
MD5862838027c0430730e79a9d84748feec
SHA19b0b0d47ad95f590cf8c79c6991f9629bff21a37
SHA256344703b2bb0ddfb8bd1a0b892b0534a78d83fc49a90b8a1593f0123cdbc2bbd5
SHA512e0fa882f14720ddc1a4ea7fa7958f331bbf167678edef0f3adefe0e6193ed64ddad6eb4ac55aa63e2a17fe8394829e8344f1d3470062cfe16f45e71825432b42
-
C:\Users\Admin\AppData\Local\Temp\7zS84EBD077\x64\PaintDotNet.Core.dllFilesize
2.2MB
MD5862838027c0430730e79a9d84748feec
SHA19b0b0d47ad95f590cf8c79c6991f9629bff21a37
SHA256344703b2bb0ddfb8bd1a0b892b0534a78d83fc49a90b8a1593f0123cdbc2bbd5
SHA512e0fa882f14720ddc1a4ea7fa7958f331bbf167678edef0f3adefe0e6193ed64ddad6eb4ac55aa63e2a17fe8394829e8344f1d3470062cfe16f45e71825432b42
-
C:\Users\Admin\AppData\Local\Temp\7zS84EBD077\x64\PaintDotNet.Framework.dllFilesize
1.0MB
MD54dd915dce3ba0d65dba6ae12138815c1
SHA1394615daef73866c3d51cd4909ea54fa67dff37b
SHA256216b4701cee99e18f3cd6889eaca0ff21d6f0daf952ef0399b456986adfeddbe
SHA512550d468f1c56ae96eab08a8c8f593a3d0ba0e7d94b096864df366c7ff44810c66555936d1f4f1ac1236716c9947e7bd98e732aef4302dee012a549111d6eb864
-
C:\Users\Admin\AppData\Local\Temp\7zS84EBD077\x64\PaintDotNet.Framework.dllFilesize
1.0MB
MD54dd915dce3ba0d65dba6ae12138815c1
SHA1394615daef73866c3d51cd4909ea54fa67dff37b
SHA256216b4701cee99e18f3cd6889eaca0ff21d6f0daf952ef0399b456986adfeddbe
SHA512550d468f1c56ae96eab08a8c8f593a3d0ba0e7d94b096864df366c7ff44810c66555936d1f4f1ac1236716c9947e7bd98e732aef4302dee012a549111d6eb864
-
C:\Users\Admin\AppData\Local\Temp\7zS84EBD077\x64\PaintDotNet.Fundamentals.dllFilesize
1.3MB
MD5a90bfac16d161027972fcb4d96632e01
SHA14a6121d6b0c2c1e0d629c511758e8ec59970d272
SHA2566c5cca663c1cff15a4ff7f466638a1e94eef34b0358ad78c4038debe4f4dd568
SHA5120a50bf93e7bebcd60273e1136e1fef7c36a5656c414842fae8a9db63188bed7bf4f4d20edbd12250e59f8afb914a7b41592dd7a113bf43759615221fad10041a
-
C:\Users\Admin\AppData\Local\Temp\7zS84EBD077\x64\PaintDotNet.Fundamentals.dllFilesize
1.3MB
MD5a90bfac16d161027972fcb4d96632e01
SHA14a6121d6b0c2c1e0d629c511758e8ec59970d272
SHA2566c5cca663c1cff15a4ff7f466638a1e94eef34b0358ad78c4038debe4f4dd568
SHA5120a50bf93e7bebcd60273e1136e1fef7c36a5656c414842fae8a9db63188bed7bf4f4d20edbd12250e59f8afb914a7b41592dd7a113bf43759615221fad10041a
-
C:\Users\Admin\AppData\Local\Temp\7zS84EBD077\x64\PaintDotNet.ObjectModel.dllFilesize
182KB
MD5fb75ef98bca52b2500b7f02b34732814
SHA167e20fb5d32cb197e3a7d72857f218dbb6c0ca1f
SHA25646fcbd795100a148c14dcf5a9f64f5d4cbdecefe080541cf1c40f34ee592d6d9
SHA5129e6b38aaa60e90165a5af5d74f17bc7317a6e0f9207a1db0a17a6231584372343c26f99e00a7c7cdcfa8d331d58722889735386c0de6485177d90ef2bfb9edf6
-
C:\Users\Admin\AppData\Local\Temp\7zS84EBD077\x64\PaintDotNet.ObjectModel.dllFilesize
182KB
MD5fb75ef98bca52b2500b7f02b34732814
SHA167e20fb5d32cb197e3a7d72857f218dbb6c0ca1f
SHA25646fcbd795100a148c14dcf5a9f64f5d4cbdecefe080541cf1c40f34ee592d6d9
SHA5129e6b38aaa60e90165a5af5d74f17bc7317a6e0f9207a1db0a17a6231584372343c26f99e00a7c7cdcfa8d331d58722889735386c0de6485177d90ef2bfb9edf6
-
C:\Users\Admin\AppData\Local\Temp\7zS84EBD077\x64\PaintDotNet.Primitives.dllFilesize
934KB
MD571266031fba2a9ed024fbe83d5169ab2
SHA1f081273799c5e56eb2973d2f21c8857307996dfb
SHA2568a6165cbd053dda6e069ada7eee5328633bf0b9a92050a91902b56d723768b01
SHA512c35ead84db6cb5369fbb3b3b1f127beeb66f5b71e43be93f332e5be3c7ac69b4ef3c13cb53489db73f8228fb7951ad016cedbd867fefd20a678d0c6efc2b9423
-
C:\Users\Admin\AppData\Local\Temp\7zS84EBD077\x64\PaintDotNet.Primitives.dllFilesize
934KB
MD571266031fba2a9ed024fbe83d5169ab2
SHA1f081273799c5e56eb2973d2f21c8857307996dfb
SHA2568a6165cbd053dda6e069ada7eee5328633bf0b9a92050a91902b56d723768b01
SHA512c35ead84db6cb5369fbb3b3b1f127beeb66f5b71e43be93f332e5be3c7ac69b4ef3c13cb53489db73f8228fb7951ad016cedbd867fefd20a678d0c6efc2b9423
-
C:\Users\Admin\AppData\Local\Temp\7zS84EBD077\x64\PaintDotNet.Strings.3.co.resourcesFilesize
176KB
MD5c0dec6327462f7728ae5dfdbf47edc80
SHA1d8bddc3e01cd2e06d29099c96bad2e18e0b798aa
SHA256700f2eb136f01f4f5059e4e76a21263e642528734aba9cc2f257642893adce0c
SHA512c9582e4647c7c004f08b027cd8b68769856e05ccd9d5e886512921b219317e6ee0a477ca4aaa42ca6d08277920ce528cdcaeef95b8e4c0d89bd50e9e2693d28a
-
C:\Users\Admin\AppData\Local\Temp\7zS84EBD077\x64\PaintDotNet.Windows.dllFilesize
3.6MB
MD5de72d4bfe376a4993d82a40bb077f7c9
SHA16a893e3b66c33b63097d9b3c1637c27d0b594e91
SHA2563041d4185c0fa4d3589e5f3a987702c319a47a345b9ee80662796018297fc641
SHA512d8fa2c0f521f6722a97d2f1f50d1a57e53a2305def38d03cf4376f9e54580951bf2a5b47744baba3449ef21335bca120f3356eea169fcf437de900c57f642bbf
-
C:\Users\Admin\AppData\Local\Temp\7zS84EBD077\x64\PaintDotNet.Windows.dllFilesize
3.6MB
MD5de72d4bfe376a4993d82a40bb077f7c9
SHA16a893e3b66c33b63097d9b3c1637c27d0b594e91
SHA2563041d4185c0fa4d3589e5f3a987702c319a47a345b9ee80662796018297fc641
SHA512d8fa2c0f521f6722a97d2f1f50d1a57e53a2305def38d03cf4376f9e54580951bf2a5b47744baba3449ef21335bca120f3356eea169fcf437de900c57f642bbf
-
C:\Users\Admin\AppData\Local\Temp\7zS84EBD077\x64\SetupFrontEnd.deps.jsonFilesize
60KB
MD575bb5ed174e86611f66d39b720c48a1e
SHA1ef75601cf845237a634e4f716a2b22b69d3392ad
SHA2561b596086933e124a090bf0875fe5b9d1c632d6e6108e84caf34f5c497b8bf5ff
SHA5123a6a17d8e708c752f813916583c326384c87bd9252006a24913998d828753ddf586ff3c6a7b764328b432be76fcbdab802192257e4fb888415701f3ba35acef4
-
C:\Users\Admin\AppData\Local\Temp\7zS84EBD077\x64\SetupFrontEnd.dllFilesize
210KB
MD582d84b7b86059ba373bd470369a47e48
SHA1b7252d76866b665b0a20fd66e884d15f8573aece
SHA25651d17e65b4fbdcc144f2056cf903813057c91e7b7841d239eb8676e1ed6e6471
SHA512fee38581c9bdb10ff2221e8fa2840c5e06c8ac91450f9250c7ebbb3e95b1c4bfc9f1b77785372519ab5be0f7471a41801082951ce81eb4c6c8575b49852a12ca
-
C:\Users\Admin\AppData\Local\Temp\7zS84EBD077\x64\SetupFrontEnd.dllFilesize
210KB
MD582d84b7b86059ba373bd470369a47e48
SHA1b7252d76866b665b0a20fd66e884d15f8573aece
SHA25651d17e65b4fbdcc144f2056cf903813057c91e7b7841d239eb8676e1ed6e6471
SHA512fee38581c9bdb10ff2221e8fa2840c5e06c8ac91450f9250c7ebbb3e95b1c4bfc9f1b77785372519ab5be0f7471a41801082951ce81eb4c6c8575b49852a12ca
-
C:\Users\Admin\AppData\Local\Temp\7zS84EBD077\x64\SetupFrontEnd.exeFilesize
162KB
MD537acf526b16c96bf8fd1cdf3510fc596
SHA11a1e39d6cebb09d4c7dbc8fa376c53ba91c4b71e
SHA256e2c9b45c50a7d4e671c9a483f87babd13421ed9a2c986cc915e4209a6162929c
SHA512998341de0dfbf02712b48f01eff7f0de31eb319c779a8011772204eda513b635e6bb5fc3e247056244974356fbcb00ebfcfd4f4cd2af60af3a2e81b2ebe80172
-
C:\Users\Admin\AppData\Local\Temp\7zS84EBD077\x64\SetupFrontEnd.exeFilesize
162KB
MD537acf526b16c96bf8fd1cdf3510fc596
SHA11a1e39d6cebb09d4c7dbc8fa376c53ba91c4b71e
SHA256e2c9b45c50a7d4e671c9a483f87babd13421ed9a2c986cc915e4209a6162929c
SHA512998341de0dfbf02712b48f01eff7f0de31eb319c779a8011772204eda513b635e6bb5fc3e247056244974356fbcb00ebfcfd4f4cd2af60af3a2e81b2ebe80172
-
C:\Users\Admin\AppData\Local\Temp\7zS84EBD077\x64\SetupFrontEnd.runtimeconfig.jsonFilesize
449B
MD5855798731cf9f727530fdf409006fc1b
SHA13433add3eb478374dd58d6b3147b34758487dee8
SHA256a835bc55d5d331510c679221eb7de631db51edf41fe57022d499893bafe782d6
SHA512f7749bbdead985f2d0556a6aa77583b39c563878fd5d6844dd31eb9c026b082d2deba7d3b84a3598b7745ca2a911d41e4672febc993e20f6d21421e4d7490fa1
-
C:\Users\Admin\AppData\Local\Temp\7zS84EBD077\x64\System.Collections.Concurrent.dllFilesize
258KB
MD5a3213606edbfe542e4a4c80360eae446
SHA11c9928c54987788f8ab4fe53705eb7a8d1481ad1
SHA256689b62857903e110fba88b8c977ee5ca7b943f632a84a9fb9c5f64977873c350
SHA512f5de4f21b70212a45d958add4a9a4b236a3eb35e071e748851f753b7d040349ccfa0f08ed9600bdeb2efa2fddb78e1a45cdc544a09bc48af449d8c683a449c85
-
C:\Users\Admin\AppData\Local\Temp\7zS84EBD077\x64\System.Collections.Concurrent.dllFilesize
258KB
MD5a3213606edbfe542e4a4c80360eae446
SHA11c9928c54987788f8ab4fe53705eb7a8d1481ad1
SHA256689b62857903e110fba88b8c977ee5ca7b943f632a84a9fb9c5f64977873c350
SHA512f5de4f21b70212a45d958add4a9a4b236a3eb35e071e748851f753b7d040349ccfa0f08ed9600bdeb2efa2fddb78e1a45cdc544a09bc48af449d8c683a449c85
-
C:\Users\Admin\AppData\Local\Temp\7zS84EBD077\x64\System.Collections.Specialized.dllFilesize
106KB
MD5859ade54c2a26e9f73b28f01984255d1
SHA122eb5f78c298b656dd6eab105f0e39b1442a23ef
SHA2567943c8c3c0f759108e1dd8b1ea69502e8261d9e3e275051b75cce82242bae0e7
SHA512aa72d67309e4c3d5f3ee0800dc9d1246d88ff081ff6cf519ee9c9009ddf10dfe98997389f012797b99302db2c04657a4e351bdbed11b49d14136245292ceb9fa
-
C:\Users\Admin\AppData\Local\Temp\7zS84EBD077\x64\System.Collections.Specialized.dllFilesize
106KB
MD5859ade54c2a26e9f73b28f01984255d1
SHA122eb5f78c298b656dd6eab105f0e39b1442a23ef
SHA2567943c8c3c0f759108e1dd8b1ea69502e8261d9e3e275051b75cce82242bae0e7
SHA512aa72d67309e4c3d5f3ee0800dc9d1246d88ff081ff6cf519ee9c9009ddf10dfe98997389f012797b99302db2c04657a4e351bdbed11b49d14136245292ceb9fa
-
C:\Users\Admin\AppData\Local\Temp\7zS84EBD077\x64\System.ComponentModel.Primitives.dllFilesize
82KB
MD5b5c9e2bb66a63a06a2ad90924fe354ed
SHA1883cf2f249e9dad2a3558d6263e7f17056e46321
SHA256263a81ee06efb6107ef92225d824321d2b62a6f9141efaa44ba95f23a5c39a12
SHA5129fd0bc6e81fd1a78ea7d0da4f03b71ce04889b6412e5bba57fda513e15b982a1c85b3e913fbcabf356a3d7b809ef470224f77e6cd75db018e2449239f1b046d1
-
C:\Users\Admin\AppData\Local\Temp\7zS84EBD077\x64\System.ComponentModel.Primitives.dllFilesize
82KB
MD5b5c9e2bb66a63a06a2ad90924fe354ed
SHA1883cf2f249e9dad2a3558d6263e7f17056e46321
SHA256263a81ee06efb6107ef92225d824321d2b62a6f9141efaa44ba95f23a5c39a12
SHA5129fd0bc6e81fd1a78ea7d0da4f03b71ce04889b6412e5bba57fda513e15b982a1c85b3e913fbcabf356a3d7b809ef470224f77e6cd75db018e2449239f1b046d1
-
C:\Users\Admin\AppData\Local\Temp\7zS84EBD077\x64\System.ComponentModel.dllFilesize
30KB
MD5ab8ec6d232fe963d1c7d9690c8d2b8a6
SHA16453f555c5f017f647d90a6a78a8183ca104af1a
SHA256ab374776cf9e2c92dfc687fb7612bb7d8558679cb01802ef6d58f2aa51cb65ad
SHA512a0981f0b00a6c74679c40f0e96dc4c432fcfc727a448ee3eda52e8855003161a8af95a8537fef76809c29a3b8daaf74e00dab713a963a151b81412a5804c85c6
-
C:\Users\Admin\AppData\Local\Temp\7zS84EBD077\x64\System.ComponentModel.dllFilesize
30KB
MD5ab8ec6d232fe963d1c7d9690c8d2b8a6
SHA16453f555c5f017f647d90a6a78a8183ca104af1a
SHA256ab374776cf9e2c92dfc687fb7612bb7d8558679cb01802ef6d58f2aa51cb65ad
SHA512a0981f0b00a6c74679c40f0e96dc4c432fcfc727a448ee3eda52e8855003161a8af95a8537fef76809c29a3b8daaf74e00dab713a963a151b81412a5804c85c6
-
C:\Users\Admin\AppData\Local\Temp\7zS84EBD077\x64\System.Drawing.Primitives.dllFilesize
134KB
MD55b45dc4fe64241dc8bc912367f40f5f7
SHA132be46d76e5513be1aec0880e13a76473898d9f0
SHA2560059d93762d28faa920ffb4b82900dc9d7ab8fd5ac9416abad45876070f07c49
SHA5129698e362e1c01bfa63fc7dcaa4a412862712b044b1bebe289c670eb625ee3c9ab384a7f1482d656bb2e220be7625dd4164e40c857465d381330f8e561ad17340
-
C:\Users\Admin\AppData\Local\Temp\7zS84EBD077\x64\System.Drawing.Primitives.dllFilesize
134KB
MD55b45dc4fe64241dc8bc912367f40f5f7
SHA132be46d76e5513be1aec0880e13a76473898d9f0
SHA2560059d93762d28faa920ffb4b82900dc9d7ab8fd5ac9416abad45876070f07c49
SHA5129698e362e1c01bfa63fc7dcaa4a412862712b044b1bebe289c670eb625ee3c9ab384a7f1482d656bb2e220be7625dd4164e40c857465d381330f8e561ad17340
-
C:\Users\Admin\AppData\Local\Temp\7zS84EBD077\x64\System.Private.CoreLib.dllFilesize
11.1MB
MD54f4b9d74c1a9a3f20a036458a20aa901
SHA1030569f9ee43f8b09f663f2c635b332dcc833d81
SHA256207152788866278b2826e467bc2468c73422aa72482b2730c355cd2414010cb5
SHA512afa4161ffe497879e5c1a4c0ed5b976e778dd356fd3acc391354f23238b64c48c55742a9fd39485e7e4f7014019e1f2ce436109c5a5dcac8828845976dcc5498
-
C:\Users\Admin\AppData\Local\Temp\7zS84EBD077\x64\System.Private.CoreLib.dllFilesize
11.1MB
MD54f4b9d74c1a9a3f20a036458a20aa901
SHA1030569f9ee43f8b09f663f2c635b332dcc833d81
SHA256207152788866278b2826e467bc2468c73422aa72482b2730c355cd2414010cb5
SHA512afa4161ffe497879e5c1a4c0ed5b976e778dd356fd3acc391354f23238b64c48c55742a9fd39485e7e4f7014019e1f2ce436109c5a5dcac8828845976dcc5498
-
C:\Users\Admin\AppData\Local\Temp\7zS84EBD077\x64\System.Runtime.InteropServices.dllFilesize
62KB
MD598d1838ded9e7a035c00eceecc51210e
SHA17925cc1fbc286e38d74a6cd64eb666a74af4f747
SHA256eb3bec2ca3af9f8cb905a47059f948b67dcb6d96b85764a1ef1534a5a9a1394b
SHA512f1ec1790f41a9813a5d2aa02d1001604f895262eb00dc65ed8a7f6a08ebd49eb1843bebc24018e0b1b530181db618bea9257e0ecfcb40475b484c974a2ef16ff
-
C:\Users\Admin\AppData\Local\Temp\7zS84EBD077\x64\System.Runtime.InteropServices.dllFilesize
62KB
MD598d1838ded9e7a035c00eceecc51210e
SHA17925cc1fbc286e38d74a6cd64eb666a74af4f747
SHA256eb3bec2ca3af9f8cb905a47059f948b67dcb6d96b85764a1ef1534a5a9a1394b
SHA512f1ec1790f41a9813a5d2aa02d1001604f895262eb00dc65ed8a7f6a08ebd49eb1843bebc24018e0b1b530181db618bea9257e0ecfcb40475b484c974a2ef16ff
-
C:\Users\Admin\AppData\Local\Temp\7zS84EBD077\x64\System.Runtime.dllFilesize
42KB
MD51a84053ebe07166c871edd7c7c181a83
SHA1c379c00bea94663aa1ba0a4eb6e456ca2847d31e
SHA2566948236074aa133f57fa7c9bc2557bafbec1b05834bbc2bab707c41b2ab7a4a9
SHA512b639b60437cf75c903e531cc3c95613ff2e27a1428e822a1a26a2057343568b8a6a11a2741786a254833fa7c9491aedeaaed3acdf061331b81e4071ad9cf6ca6
-
C:\Users\Admin\AppData\Local\Temp\7zS84EBD077\x64\System.Windows.Forms.Primitives.dllFilesize
938KB
MD5240854502cd2fd551a5c2540a02c5a3f
SHA1562a9f3337b2e2ebfc1098064272ea0c9ffb9448
SHA25604e658695c092a03691cda46859667b613c71b60d6d8d4835b712c70d4ceef42
SHA512f142d0284694999f365f4001ca57f9710c158ea02edb86179c912388f8ed0efd4e1417c0528f77db7d8cb65d5a54a590c2803c4607ae019abd20041cdd84c891
-
C:\Users\Admin\AppData\Local\Temp\7zS84EBD077\x64\System.Windows.Forms.Primitives.dllFilesize
938KB
MD5240854502cd2fd551a5c2540a02c5a3f
SHA1562a9f3337b2e2ebfc1098064272ea0c9ffb9448
SHA25604e658695c092a03691cda46859667b613c71b60d6d8d4835b712c70d4ceef42
SHA512f142d0284694999f365f4001ca57f9710c158ea02edb86179c912388f8ed0efd4e1417c0528f77db7d8cb65d5a54a590c2803c4607ae019abd20041cdd84c891
-
C:\Users\Admin\AppData\Local\Temp\7zS84EBD077\x64\System.Windows.Forms.dllFilesize
12.7MB
MD52e7272756190f51683c6c171068b3b28
SHA1963e3f9f416f1ef44881873a006e57066948a823
SHA2562b49d2d1c5a93a99b6c1c8545b559177aa215de363d67eb5243d69282a6b6969
SHA512500953146f107c9df2399a7727907059c2c0970316daf1f648f28f683cb07198c96ee0d1b9ba5381ea74e37d7183878533a484fa72b4fa4f92094c3c9ce1ddb7
-
C:\Users\Admin\AppData\Local\Temp\7zS84EBD077\x64\System.Windows.Forms.dllFilesize
12.7MB
MD52e7272756190f51683c6c171068b3b28
SHA1963e3f9f416f1ef44881873a006e57066948a823
SHA2562b49d2d1c5a93a99b6c1c8545b559177aa215de363d67eb5243d69282a6b6969
SHA512500953146f107c9df2399a7727907059c2c0970316daf1f648f28f683cb07198c96ee0d1b9ba5381ea74e37d7183878533a484fa72b4fa4f92094c3c9ce1ddb7
-
C:\Users\Admin\AppData\Local\Temp\7zS84EBD077\x64\TerraFX.Interop.Windows.dllFilesize
966KB
MD5b5d02ceacecfa4350292991f3d3bd72f
SHA144ad5b10395a0269e6b9e685c27ce44bf5fc41f5
SHA256d86006ce0ca86dcd3990c9e06e77c60fd95bbfd2aef98d51ffa3ac4d6c3e64b7
SHA51240b87995c3438edb78066f6fd820761bb553e2d1abb8671d205b8112b239a59c1b69724816634fc0c4d670d1c50dfda1f11be676d54f90aa22ebf5d08216f595
-
C:\Users\Admin\AppData\Local\Temp\7zS84EBD077\x64\TerraFX.Interop.Windows.dllFilesize
966KB
MD5b5d02ceacecfa4350292991f3d3bd72f
SHA144ad5b10395a0269e6b9e685c27ce44bf5fc41f5
SHA256d86006ce0ca86dcd3990c9e06e77c60fd95bbfd2aef98d51ffa3ac4d6c3e64b7
SHA51240b87995c3438edb78066f6fd820761bb553e2d1abb8671d205b8112b239a59c1b69724816634fc0c4d670d1c50dfda1f11be676d54f90aa22ebf5d08216f595
-
C:\Users\Admin\AppData\Local\Temp\7zS84EBD077\x64\clrjit.dllFilesize
1.5MB
MD5214103ec27a3334f1a54572e06edd7f0
SHA12331ad94c2014ee301130d58841fbbfa56bd9571
SHA25698e88c84b1e9f40fd9a53779b4b2bc720282f546ff6eb875ca2bdcde3caa819a
SHA51281155dda5d36b54c91f99fd08ed86c71cb98faddf0a98fa14264448327b88318bbb4fa9ab53f6f94eedc4fd71a3eaa169d1bda437c74ef7f3979e1f335ae7813
-
C:\Users\Admin\AppData\Local\Temp\7zS84EBD077\x64\clrjit.dllFilesize
1.5MB
MD5214103ec27a3334f1a54572e06edd7f0
SHA12331ad94c2014ee301130d58841fbbfa56bd9571
SHA25698e88c84b1e9f40fd9a53779b4b2bc720282f546ff6eb875ca2bdcde3caa819a
SHA51281155dda5d36b54c91f99fd08ed86c71cb98faddf0a98fa14264448327b88318bbb4fa9ab53f6f94eedc4fd71a3eaa169d1bda437c74ef7f3979e1f335ae7813
-
C:\Users\Admin\AppData\Local\Temp\7zS84EBD077\x64\coreclr.dllFilesize
4.9MB
MD5af772e60472ea250d3352cf128952555
SHA1e0ccf9ae5fc81d5efa5e3cce4f5815d04fb90629
SHA256eb730b08abc2fbcca0fa5d80fa0ca9400608db09165108c7b31eb55f36540173
SHA5128d67c3f831b5078e315c93c0fa2b5d3db476f405efc42221217216806774bf676e283858b28e495b91559f395673a446693a79d104b6e095ba3f982010d89911
-
C:\Users\Admin\AppData\Local\Temp\7zS84EBD077\x64\coreclr.dllFilesize
4.9MB
MD5af772e60472ea250d3352cf128952555
SHA1e0ccf9ae5fc81d5efa5e3cce4f5815d04fb90629
SHA256eb730b08abc2fbcca0fa5d80fa0ca9400608db09165108c7b31eb55f36540173
SHA5128d67c3f831b5078e315c93c0fa2b5d3db476f405efc42221217216806774bf676e283858b28e495b91559f395673a446693a79d104b6e095ba3f982010d89911
-
C:\Users\Admin\AppData\Local\Temp\7zS84EBD077\x64\hostfxr.dllFilesize
373KB
MD5272bee5405e37cb80ac1be7594014561
SHA1b1ec2f31cf43b2f94ccb791bd2dec73634469cd3
SHA256ef79f293eee7ac8a4d448e31e2f2b6d2627e436889f7a6561296d97eef70cde2
SHA5126aca18c89be621dec402e1534ad41e26d9c77d4b0c3f66919dec977681b5ef9afaf0f19f1ab4fb19f295bf294deb5f7b1e51921e6a67b680217615038791dbac
-
C:\Users\Admin\AppData\Local\Temp\7zS84EBD077\x64\hostfxr.dllFilesize
373KB
MD5272bee5405e37cb80ac1be7594014561
SHA1b1ec2f31cf43b2f94ccb791bd2dec73634469cd3
SHA256ef79f293eee7ac8a4d448e31e2f2b6d2627e436889f7a6561296d97eef70cde2
SHA5126aca18c89be621dec402e1534ad41e26d9c77d4b0c3f66919dec977681b5ef9afaf0f19f1ab4fb19f295bf294deb5f7b1e51921e6a67b680217615038791dbac
-
C:\Users\Admin\AppData\Local\Temp\7zS84EBD077\x64\hostpolicy.dllFilesize
383KB
MD536cc628074a9288e94a9964a27d17a59
SHA106222857ba30e2aa026894dfafd6ea2876705a9d
SHA25605ed73a9eae0ba8465d6a2fe9239a403939d565bbbd51ff44bc0489f3d3a7b53
SHA512c95ae58b2de59692c83797c48d52830be0fbfdd0f3a5fff557a5ba82c63704ef3dec6e5a2315b68e665d41e58845932047fe6380125496040a424601b9c06825
-
C:\Users\Admin\AppData\Local\Temp\7zS84EBD077\x64\hostpolicy.dllFilesize
383KB
MD536cc628074a9288e94a9964a27d17a59
SHA106222857ba30e2aa026894dfafd6ea2876705a9d
SHA25605ed73a9eae0ba8465d6a2fe9239a403939d565bbbd51ff44bc0489f3d3a7b53
SHA512c95ae58b2de59692c83797c48d52830be0fbfdd0f3a5fff557a5ba82c63704ef3dec6e5a2315b68e665d41e58845932047fe6380125496040a424601b9c06825
-
C:\Users\Admin\AppData\Local\Temp\7zSC8F3A6F6\SetupShim.exeFilesize
136KB
MD5e2b8f4221931e23f65dcdb2fd051be8d
SHA176db9efa379bef5c65c8f2e1733bc6575747502a
SHA256621499bdf212eb1aaf80b3d2c7befffcaa5fb2804b301d14690a236667a7908a
SHA512700ef42e2199d6dad3a48ec8c562b43cc7210ed52e65bc2cc77b3f2905173be081f19a622efaab579fc098c165c0b3c5f3644cf98f81629a2f0d4a722014b5b2
-
C:\Users\Admin\AppData\Local\Temp\7zSC8F3A6F6\SetupShim.exeFilesize
136KB
MD5e2b8f4221931e23f65dcdb2fd051be8d
SHA176db9efa379bef5c65c8f2e1733bc6575747502a
SHA256621499bdf212eb1aaf80b3d2c7befffcaa5fb2804b301d14690a236667a7908a
SHA512700ef42e2199d6dad3a48ec8c562b43cc7210ed52e65bc2cc77b3f2905173be081f19a622efaab579fc098c165c0b3c5f3644cf98f81629a2f0d4a722014b5b2
-
C:\Users\Admin\AppData\Local\Temp\7zSC8F3A6F6\SetupShim.exeFilesize
136KB
MD5e2b8f4221931e23f65dcdb2fd051be8d
SHA176db9efa379bef5c65c8f2e1733bc6575747502a
SHA256621499bdf212eb1aaf80b3d2c7befffcaa5fb2804b301d14690a236667a7908a
SHA512700ef42e2199d6dad3a48ec8c562b43cc7210ed52e65bc2cc77b3f2905173be081f19a622efaab579fc098c165c0b3c5f3644cf98f81629a2f0d4a722014b5b2
-
C:\Users\Admin\AppData\Local\Temp\7zSC8F3A6F6\x64\SetupDownloader\Newtonsoft.Json.dllFilesize
695KB
MD5715a1fbee4665e99e859eda667fe8034
SHA1e13c6e4210043c4976dcdc447ea2b32854f70cc6
SHA256c5c83bbc1741be6ff4c490c0aee34c162945423ec577c646538b2d21ce13199e
SHA512bf9744ccb20f8205b2de39dbe79d34497b4d5c19b353d0f95e87ea7ef7fa1784aea87e10efcef11e4c90451eaa47a379204eb0533aa3018e378dd3511ce0e8ad
-
C:\Users\Admin\AppData\Local\Temp\7zSC8F3A6F6\x64\SetupDownloader\SetupDownloader.Configuration.jsonFilesize
135B
MD58ca6779446e31e219589a08769448da2
SHA1efc2d9e4b0f99daf0333406610d8031a5a8aed2f
SHA2562b23a17e993b7837a89365cdd328541f58ddfd4ab2b45285058284eee5733613
SHA512a6a863880835dcca879534ec8a353e2d7fef9c4410edfe41b59bac561492cc6084330c7aad1d2e8a9590b2a3d7551a0b8b6d45ced4d235f01b596d69b593bbf4
-
C:\Users\Admin\AppData\Local\Temp\7zSC8F3A6F6\x64\SetupDownloader\SetupDownloader.exeFilesize
263KB
MD54ec105376265ad264f8ae81f7910697d
SHA12bfd7aec6b525421b1d8959bae23ba79edef27c1
SHA25625b826f01283de2346ed61f81581fdb7fe34415a5cd97cda708136701796a87f
SHA5128a5d95c2ddf4eb90bca6d44308f2c2534aeecf99dc5428886318eb49aec505942082cf17c2d1ef4cf580e50966349d9f77a83b63e0567812e347137023b6d66c
-
C:\Users\Admin\AppData\Local\Temp\7zSC8F3A6F6\x64\SetupDownloader\SetupDownloader.exeFilesize
263KB
MD54ec105376265ad264f8ae81f7910697d
SHA12bfd7aec6b525421b1d8959bae23ba79edef27c1
SHA25625b826f01283de2346ed61f81581fdb7fe34415a5cd97cda708136701796a87f
SHA5128a5d95c2ddf4eb90bca6d44308f2c2534aeecf99dc5428886318eb49aec505942082cf17c2d1ef4cf580e50966349d9f77a83b63e0567812e347137023b6d66c
-
C:\Users\Admin\AppData\Local\Temp\7zSC8F3A6F6\x64\SetupDownloader\SetupDownloader.exeFilesize
263KB
MD54ec105376265ad264f8ae81f7910697d
SHA12bfd7aec6b525421b1d8959bae23ba79edef27c1
SHA25625b826f01283de2346ed61f81581fdb7fe34415a5cd97cda708136701796a87f
SHA5128a5d95c2ddf4eb90bca6d44308f2c2534aeecf99dc5428886318eb49aec505942082cf17c2d1ef4cf580e50966349d9f77a83b63e0567812e347137023b6d66c
-
C:\Users\Admin\AppData\Local\Temp\7zSC8F3A6F6\x64\SetupDownloader\SetupDownloader.exe.configFilesize
218B
MD58f692dcbf1e68398b5dac3eba59872b0
SHA118011f5291790b0f49561385731ec5c6ad855415
SHA2568c422938a58df86d88f29c61ff27006f0b3c9bb4742b11486bc5a01a6344129b
SHA512e4bab07f4b9a9f725865e0e9f11fa31a4a1841399044f5976818782739b13d6c2012edf98199c5823ee9ecb3da40e7f3e2f88ab1394547801afa8b5b9dad9e79
-
C:\Users\Admin\AppData\Local\Temp\PdnSetupDownloader\012fe196-9800-4d04-a949-7cb74b92e52d\paint.net.5.0.3.install.x64.exeFilesize
62.1MB
MD520846a76b4cf1326fb68c41c5f62b701
SHA18c166732fe568e165dc5d56aea1bf0d4648b3a0a
SHA256fa166f62134343ccfdf29c3b64a98bcb7c564e100a86e28c8f79826833a6a675
SHA512d08ef470ff376936f3931ecf1b6d4fba65bfcd2fc2b70d2489f680126504a232220cdad4c5063bc89dcc47e92254effb4d32ca013cfa31dcf4608e40619df4b6
-
C:\Users\Admin\AppData\Local\Temp\PdnSetupDownloader\012fe196-9800-4d04-a949-7cb74b92e52d\paint.net.5.0.3.install.x64.exeFilesize
62.1MB
MD520846a76b4cf1326fb68c41c5f62b701
SHA18c166732fe568e165dc5d56aea1bf0d4648b3a0a
SHA256fa166f62134343ccfdf29c3b64a98bcb7c564e100a86e28c8f79826833a6a675
SHA512d08ef470ff376936f3931ecf1b6d4fba65bfcd2fc2b70d2489f680126504a232220cdad4c5063bc89dcc47e92254effb4d32ca013cfa31dcf4608e40619df4b6
-
C:\Users\Admin\AppData\Local\Temp\pdnSetupShim.logFilesize
135B
MD554c7b251567af4c3193c030b5483ac11
SHA165c6e335f7bb7ea9adc27fb86deb252e7636cd70
SHA2565a7843a9202313e0755939e04781d9fe0669588920ced6bd39ed75f5062842cb
SHA5125dda411a643868aa49988f29b71633147271b8c100314d59b3897df1d6569418347abe191bbbf058fafa4d3ce59ed788bbcf9ae58939da5bf10b042d1f4130fd
-
C:\Users\Admin\AppData\Local\Temp\pdnSetupShim.logFilesize
932B
MD5653726d7356fcc9a835375ca6706273c
SHA1ddf29a5ec5b555afab2d2f90a23e5a675135be43
SHA256fcc87382cf40350c018fc8182138313902aa45298ef32c7560736d500ef28a1f
SHA512a1b8d85be9bc69e3e0aab1f19fcc58cd487bca43b81ebb7ef4cb2f41fff94a6e61ada324372ac440b26157b3945c7b90e8b34c6f5e2b51c1cd90bdcbf44fdbe8
-
C:\Users\Admin\AppData\Local\Temp\pdnSetupShim.logFilesize
775B
MD5e3c61d8438ceda68467e76278c056129
SHA1921eefd8c3019de3e35a8b91c99d9d3ec7b30422
SHA2569008ef9fe19269147d76de191529145750677ee1c1479f1714862911a50f80da
SHA51268972a7b070897bd8ff592de4819c01c9e8095eb953809d7f8fd6c134020727ad94f6b662fd33e0752ecba70385268094d95f47ab6163036796937866242eeff
-
C:\Windows\Installer\e581ba1.msiFilesize
205.9MB
MD5e0c1955661b236343201895f752924dc
SHA148cf9f1459703250a3f1a1b70280fd7c59fc458f
SHA256e136fefcc96e247242dd50f193c0f213d9bb477c9be87ff2e6908dc60242c31b
SHA51235b1b649cd315973b853acaac547bf547a15a9603a96e05aef39914d0d85fd66aec26254a984fd17ad42f5d94b7376b49a071784071dafdebf040d3a61843f97
-
C:\Windows\Installer\{67D72105-13E9-4EB7-8059-28DFC3A2DCA1}\app_icon.icoFilesize
75KB
MD5d47d5e7a8a90d00db1644a40555d14c2
SHA1652eae27caf68d1903616910f46bcca27f6623b0
SHA2569c6063ea5b8a118f1aeab0c201f5bc7fa5d630dcfd80d0c8bf3efe67bfde6953
SHA512ecf923b823e246416ad4f010647a14c764325ff83752d542313ccd74143f800c1d37f14952e02ed78813f0417c94a0e5eccb02daecabf242444cd5d6a635ec8a
-
memory/1384-2259-0x000002FC125A0000-0x000002FC125A4000-memory.dmpFilesize
16KB
-
memory/1384-2258-0x000002FC12130000-0x000002FC12140000-memory.dmpFilesize
64KB
-
memory/4088-207-0x0000029837340000-0x0000029837350000-memory.dmpFilesize
64KB
-
memory/4088-220-0x000002981B940000-0x000002981B952000-memory.dmpFilesize
72KB
-
memory/4088-218-0x0000029837340000-0x0000029837350000-memory.dmpFilesize
64KB
-
memory/4088-217-0x0000029837340000-0x0000029837350000-memory.dmpFilesize
64KB
-
memory/4088-209-0x0000029837340000-0x0000029837350000-memory.dmpFilesize
64KB
-
memory/4088-208-0x0000029837340000-0x0000029837350000-memory.dmpFilesize
64KB
-
memory/4088-201-0x000002981B430000-0x000002981B476000-memory.dmpFilesize
280KB
-
memory/4088-206-0x0000029837340000-0x0000029837350000-memory.dmpFilesize
64KB
-
memory/4088-205-0x000002981B7F0000-0x000002981B812000-memory.dmpFilesize
136KB
-
memory/4088-203-0x000002981D230000-0x000002981D2E2000-memory.dmpFilesize
712KB