Analysis
-
max time kernel
300s -
max time network
272s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
20-11-2023 18:48
Static task
static1
Behavioral task
behavioral1
Sample
inkscape-1.3.1_2023-11-16_91b66b0783-x64_yOr62Fw.msi
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
inkscape-1.3.1_2023-11-16_91b66b0783-x64_yOr62Fw.msi
Resource
win10v2004-20231023-en
General
-
Target
inkscape-1.3.1_2023-11-16_91b66b0783-x64_yOr62Fw.msi
-
Size
138.3MB
-
MD5
8063827e946f0877100eb79ec6a6988c
-
SHA1
289dbc9936649878c87c459f0271dc9de1c09875
-
SHA256
90f8f632c57fe6ab5b050ba1ed8dc08ae79d88bb9c48ee6de3e8d17db5673f58
-
SHA512
332a1748e4d207ea2bf33abe197a0e486f722b2d2ad35d80380327cdf478f340b6b45588e96d93a6d79d2a9d19b822d373b1e128a2089112ab6e1fb9846456ed
-
SSDEEP
3145728:xIulCxvIXQ/tveMi9CW1P2A0QEHXq4MA2PRH:xIzvIXQVv2hgAVE64m
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-984744499-3605095035-265325720-1000\Control Panel\International\Geo\Nation inkscape.exe Key value queried \REGISTRY\USER\S-1-5-21-984744499-3605095035-265325720-1000\Control Panel\International\Geo\Nation gdbus.exe -
Executes dropped EXE 2 IoCs
pid Process 3324 inkscape.exe 1984 gdbus.exe -
Loads dropped DLL 64 IoCs
pid Process 3324 inkscape.exe 3324 inkscape.exe 3324 inkscape.exe 3324 inkscape.exe 3324 inkscape.exe 3324 inkscape.exe 3324 inkscape.exe 3324 inkscape.exe 3324 inkscape.exe 3324 inkscape.exe 3324 inkscape.exe 3324 inkscape.exe 3324 inkscape.exe 3324 inkscape.exe 3324 inkscape.exe 3324 inkscape.exe 3324 inkscape.exe 3324 inkscape.exe 3324 inkscape.exe 3324 inkscape.exe 3324 inkscape.exe 3324 inkscape.exe 3324 inkscape.exe 3324 inkscape.exe 3324 inkscape.exe 3324 inkscape.exe 3324 inkscape.exe 3324 inkscape.exe 3324 inkscape.exe 3324 inkscape.exe 3324 inkscape.exe 3324 inkscape.exe 3324 inkscape.exe 3324 inkscape.exe 3324 inkscape.exe 3324 inkscape.exe 3324 inkscape.exe 3324 inkscape.exe 3324 inkscape.exe 3324 inkscape.exe 3324 inkscape.exe 3324 inkscape.exe 3324 inkscape.exe 3324 inkscape.exe 3324 inkscape.exe 3324 inkscape.exe 3324 inkscape.exe 3324 inkscape.exe 3324 inkscape.exe 3324 inkscape.exe 3324 inkscape.exe 3324 inkscape.exe 3324 inkscape.exe 3324 inkscape.exe 3324 inkscape.exe 3324 inkscape.exe 3324 inkscape.exe 3324 inkscape.exe 3324 inkscape.exe 3324 inkscape.exe 3324 inkscape.exe 3324 inkscape.exe 3324 inkscape.exe 3324 inkscape.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: msiexec.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Inkscape\Run Inkscape with GTK Inspector.bat msiexec.exe File created C:\Program Files\Inkscape\share\poppler\cMap\Adobe-GB1\UniGB-UTF8-V msiexec.exe File created C:\Program Files\Inkscape\share\icons\Adwaita\scalable\devices\ebook-reader.svg msiexec.exe File created C:\Program Files\Inkscape\share\inkscape\themes\Minwaita-Inkscape\gtk-3.0\assets\[email protected] msiexec.exe File created C:\Program Files\Inkscape\share\inkscape\icons\hicolor\scalable\actions\display-enhance-stroke-alt.svg msiexec.exe File created C:\Program Files\Inkscape\share\icons\Adwaita\symbolic\mimetypes\x-office-address-book-symbolic.svg msiexec.exe File created C:\Program Files\Inkscape\share\icons\Adwaita\symbolic\status\network-cellular-signal-ok-symbolic-rtl.svg msiexec.exe File created C:\Program Files\Inkscape\lib\python3.11\site-packages\numpy\typing\tests\data\reveal\constants.pyi msiexec.exe File created C:\Program Files\Inkscape\lib\tcl8.6\tzdata\SystemV\AST4 msiexec.exe File created C:\Program Files\Inkscape\share\inkscape\palettes\Tango-Palette.gpl msiexec.exe File created C:\Program Files\Inkscape\lib\python3.11\distutils\command\__init__.py msiexec.exe File created C:\Program Files\Inkscape\lib\python3.11\site-packages\numpy\linalg\__init__.pyi msiexec.exe File created C:\Program Files\Inkscape\lib\python3.11\site-packages\PIL\__pycache__\ImageQt.cpython-311.pyc msiexec.exe File created C:\Program Files\Inkscape\share\inkscape\themes\Minwaita-Inkscape\gtk-3.0\assets\[email protected] msiexec.exe File created C:\Program Files\Inkscape\share\icons\Adwaita\cursors\v_double_arrow.cur msiexec.exe File created C:\Program Files\Inkscape\lib\python3.11\idlelib\idle_test\test_calltip_w.py msiexec.exe File created C:\Program Files\Inkscape\lib\python3.11\site-packages\numpy\core\__pycache__\cversions.cpython-311.pyc msiexec.exe File created C:\Program Files\Inkscape\share\poppler\cMap\Adobe-CNS1\HKm314-B5-V msiexec.exe File created C:\Program Files\Inkscape\lib\python3.11\__pycache__\bz2.cpython-311.pyc msiexec.exe File created C:\Program Files\Inkscape\share\icons\Adwaita\32x32\devices\network-wired-symbolic.symbolic.png msiexec.exe File created C:\Program Files\Inkscape\share\locale\fr\LC_MESSAGES\inkscape.mo msiexec.exe File created C:\Program Files\Inkscape\lib\python3.11\site-packages\numpy\core\_multiarray_umath.cp311-mingw_x86_64_ucrt.pyd msiexec.exe File created C:\Program Files\Inkscape\share\icons\Adwaita\symbolic\actions\mail-send-receive-symbolic.svg msiexec.exe File created C:\Program Files\Inkscape\share\inkscape\tutorials\tutorial-advanced.zh_TW.svg msiexec.exe File created C:\Program Files\Inkscape\share\icons\Adwaita\symbolic\status\network-cellular-disabled-rtl-symbolic.svg msiexec.exe File created C:\Program Files\Inkscape\share\inkscape\themes\Minwaita-Inkscape\gtk-3.0\assets\slider-vert-scale-has-marks-above-hover-dark.png msiexec.exe File created C:\Program Files\Inkscape\lib\python3.11\site-packages\lxml\includes\__init__.py msiexec.exe File created C:\Program Files\Inkscape\share\inkscape\extensions\other\clipart\licenses\mit.svg msiexec.exe File created C:\Program Files\Inkscape\share\inkscape\icons\multicolor\symbolic\actions\boundingbox_right-symbolic.svg msiexec.exe File created C:\Program Files\Inkscape\share\inkscape\icons\Tango\scalable\actions\distribute-remove-overlaps.svg msiexec.exe File created C:\Program Files\Inkscape\lib\python3.11\Tools\scripts\__pycache__\analyze_dxp.cpython-311.pyc msiexec.exe File created C:\Program Files\Inkscape\lib\tcl8.6\tzdata\America\Argentina\San_Juan msiexec.exe File created C:\Program Files\Inkscape\share\icons\Adwaita\32x32\status\network-transmit-receive-symbolic.symbolic.png msiexec.exe File created C:\Program Files\Inkscape\lib\python3.11\site-packages\serial\tools\__pycache__\list_ports.cpython-311.pyc msiexec.exe File created C:\Program Files\Inkscape\share\icons\Adwaita\16x16\actions\view-more-symbolic.symbolic.png msiexec.exe File created C:\Program Files\Inkscape\lib\python3.11\site-packages\PIL\BmpImagePlugin.py msiexec.exe File created C:\Program Files\Inkscape\share\inkscape\icons\multicolor\symbolic\actions\path-combine-symbolic.svg msiexec.exe File created C:\Program Files\Inkscape\share\inkscape\keys\xara.xml msiexec.exe File created C:\Program Files\Inkscape\lib\python3.11\site-packages\numpy\distutils\tests\__pycache__\test_log.cpython-311.pyc msiexec.exe File created C:\Program Files\Inkscape\lib\python3.11\idlelib\__pycache__\stackviewer.cpython-311.pyc msiexec.exe File created C:\Program Files\Inkscape\lib\python3.11\site-packages\numpy\distutils\tests\test_exec_command.py msiexec.exe File created C:\Program Files\Inkscape\lib\python3.11\site-packages\numpy\distutils\mingw\gfortran_vs2003_hack.c msiexec.exe File created C:\Program Files\Inkscape\lib\python3.11\site-packages\numpy\ma\tests\__pycache__\test_old_ma.cpython-311.pyc msiexec.exe File created C:\Program Files\Inkscape\share\icons\Adwaita\symbolic\actions\view-more-symbolic.svg msiexec.exe File created C:\Program Files\Inkscape\lib\tcl8.6\tzdata\Etc\GMT-1 msiexec.exe File created C:\Program Files\Inkscape\include\2geom-1.3.0\2geom\rect.h msiexec.exe File created C:\Program Files\Inkscape\lib\python3.11\config-3.11\makesetup msiexec.exe File created C:\Program Files\Inkscape\lib\python3.11\idlelib\idle_test\test_config.py msiexec.exe File created C:\Program Files\Inkscape\share\inkscape\icons\multicolor\symbolic\actions\display-no-filter-symbolic.svg msiexec.exe File created C:\Program Files\Inkscape\lib\tcl8.6\tzdata\Pacific\Niue msiexec.exe File created C:\Program Files\Inkscape\lib\python3.11\encodings\gb2312.py msiexec.exe File created C:\Program Files\Inkscape\lib\python3.11\site-packages\numpy\polynomial\__pycache__\chebyshev.cpython-311.pyc msiexec.exe File created C:\Program Files\Inkscape\share\icons\Adwaita\symbolic\status\microphone-sensitivity-low-symbolic.svg msiexec.exe File created C:\Program Files\Inkscape\share\icons\Adwaita\symbolic\devices\camera-web-symbolic.svg msiexec.exe File created C:\Program Files\Inkscape\lib\python3.11\site-packages\numpy\lib\_version.py msiexec.exe File created C:\Program Files\Inkscape\lib\python3.11\__pycache__\_aix_support.cpython-311.pyc msiexec.exe File created C:\Program Files\Inkscape\share\inkscape\icons\multicolor\symbolic\actions\mesh-gradient-symbolic.svg msiexec.exe File created C:\Program Files\Inkscape\lib\python3.11\idlelib\idle_test\__pycache__\test_mainmenu.cpython-311.pyc msiexec.exe File created C:\Program Files\Inkscape\lib\python3.11\site-packages\numpy\typing\tests\data\pass\random.py msiexec.exe File created C:\Program Files\Inkscape\lib\tcl8.6\tzdata\America\Campo_Grande msiexec.exe File created C:\Program Files\Inkscape\lib\python3.11\asyncio\constants.py msiexec.exe File created C:\Program Files\Inkscape\share\inkscape\icons\hicolor\scalable\actions\draw-ellipse.svg msiexec.exe File created C:\Program Files\Inkscape\share\icons\Adwaita\32x32\status\power-profile-balanced-symbolic.symbolic.png msiexec.exe File created C:\Program Files\Inkscape\share\inkscape\extensions\docs\authors\inx-widgets.rst msiexec.exe -
Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSI6DE8.tmp msiexec.exe File created C:\Windows\Installer\e584eb9.msi msiexec.exe File created C:\Windows\Installer\e584eb7.msi msiexec.exe File opened for modification C:\Windows\Installer\e584eb7.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{454A87BE-0589-4AD2-8FA3-E6D1825D97DE} msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000326c22034809cb6a0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000326c22030000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900326c2203000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d326c2203000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000326c220300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe -
Modifies registry class 20 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-984744499-3605095035-265325720-1000_Classes\Inkscape.SVG\shell\open\command\ = "\"C:\\Program Files\\Inkscape\\bin\\inkscape.exe\" \"%1\"" msiexec.exe Key created \REGISTRY\USER\S-1-5-21-984744499-3605095035-265325720-1000_Classes\Inkscape.SVGZ\shell msiexec.exe Key created \REGISTRY\USER\S-1-5-21-984744499-3605095035-265325720-1000_Classes\Inkscape.SVG msiexec.exe Key created \REGISTRY\USER\S-1-5-21-984744499-3605095035-265325720-1000_Classes\Inkscape.SVG\shell\open msiexec.exe Key created \REGISTRY\USER\S-1-5-21-984744499-3605095035-265325720-1000_Classes\.svg msiexec.exe Key created \REGISTRY\USER\S-1-5-21-984744499-3605095035-265325720-1000_Classes\Inkscape.SVGZ\shell\open\command msiexec.exe Key created \REGISTRY\USER\S-1-5-21-984744499-3605095035-265325720-1000_Classes\Inkscape.SVGZ\shell\open msiexec.exe Key created \REGISTRY\USER\S-1-5-21-984744499-3605095035-265325720-1000_Classes\Inkscape.SVG\shell msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-984744499-3605095035-265325720-1000_Classes\Inkscape.SVG\DefaultIcon\ = "\"C:\\Program Files\\Inkscape\\bin\\inkscape.exe\"" msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-984744499-3605095035-265325720-1000_Classes\Inkscape.SVGZ\shell\open\command\ = "\"C:\\Program Files\\Inkscape\\bin\\inkscape.exe\" \"%1\"" msiexec.exe Key created \REGISTRY\USER\S-1-5-21-984744499-3605095035-265325720-1000_Classes\.svgz msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-984744499-3605095035-265325720-1000_Classes\.svgz\ = "Inkscape.SVGZ" msiexec.exe Key created \REGISTRY\USER\S-1-5-21-984744499-3605095035-265325720-1000_Classes\Inkscape.SVGZ\DefaultIcon msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-984744499-3605095035-265325720-1000_Classes\Inkscape.SVGZ\DefaultIcon\ = "\"C:\\Program Files\\Inkscape\\bin\\inkscape.exe\"" msiexec.exe Key created \REGISTRY\USER\S-1-5-21-984744499-3605095035-265325720-1000_Classes\Inkscape.SVG\shell\open\command msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-984744499-3605095035-265325720-1000_Classes\.svg\ = "Inkscape.SVG" msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-984744499-3605095035-265325720-1000_Classes\Inkscape.SVG\ = "Scalable Vector Graphics" msiexec.exe Key created \REGISTRY\USER\S-1-5-21-984744499-3605095035-265325720-1000_Classes\Inkscape.SVG\DefaultIcon msiexec.exe Key created \REGISTRY\USER\S-1-5-21-984744499-3605095035-265325720-1000_Classes\Inkscape.SVGZ msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-984744499-3605095035-265325720-1000_Classes\Inkscape.SVGZ\ = "Compressed Scalable Vector Graphics" msiexec.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 3324 inkscape.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3592 msiexec.exe 3592 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4372 msiexec.exe Token: SeIncreaseQuotaPrivilege 4372 msiexec.exe Token: SeSecurityPrivilege 3592 msiexec.exe Token: SeCreateTokenPrivilege 4372 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4372 msiexec.exe Token: SeLockMemoryPrivilege 4372 msiexec.exe Token: SeIncreaseQuotaPrivilege 4372 msiexec.exe Token: SeMachineAccountPrivilege 4372 msiexec.exe Token: SeTcbPrivilege 4372 msiexec.exe Token: SeSecurityPrivilege 4372 msiexec.exe Token: SeTakeOwnershipPrivilege 4372 msiexec.exe Token: SeLoadDriverPrivilege 4372 msiexec.exe Token: SeSystemProfilePrivilege 4372 msiexec.exe Token: SeSystemtimePrivilege 4372 msiexec.exe Token: SeProfSingleProcessPrivilege 4372 msiexec.exe Token: SeIncBasePriorityPrivilege 4372 msiexec.exe Token: SeCreatePagefilePrivilege 4372 msiexec.exe Token: SeCreatePermanentPrivilege 4372 msiexec.exe Token: SeBackupPrivilege 4372 msiexec.exe Token: SeRestorePrivilege 4372 msiexec.exe Token: SeShutdownPrivilege 4372 msiexec.exe Token: SeDebugPrivilege 4372 msiexec.exe Token: SeAuditPrivilege 4372 msiexec.exe Token: SeSystemEnvironmentPrivilege 4372 msiexec.exe Token: SeChangeNotifyPrivilege 4372 msiexec.exe Token: SeRemoteShutdownPrivilege 4372 msiexec.exe Token: SeUndockPrivilege 4372 msiexec.exe Token: SeSyncAgentPrivilege 4372 msiexec.exe Token: SeEnableDelegationPrivilege 4372 msiexec.exe Token: SeManageVolumePrivilege 4372 msiexec.exe Token: SeImpersonatePrivilege 4372 msiexec.exe Token: SeCreateGlobalPrivilege 4372 msiexec.exe Token: SeBackupPrivilege 2880 vssvc.exe Token: SeRestorePrivilege 2880 vssvc.exe Token: SeAuditPrivilege 2880 vssvc.exe Token: SeBackupPrivilege 3592 msiexec.exe Token: SeRestorePrivilege 3592 msiexec.exe Token: SeRestorePrivilege 3592 msiexec.exe Token: SeTakeOwnershipPrivilege 3592 msiexec.exe Token: SeBackupPrivilege 4252 srtasks.exe Token: SeRestorePrivilege 4252 srtasks.exe Token: SeSecurityPrivilege 4252 srtasks.exe Token: SeTakeOwnershipPrivilege 4252 srtasks.exe Token: SeBackupPrivilege 4252 srtasks.exe Token: SeRestorePrivilege 4252 srtasks.exe Token: SeSecurityPrivilege 4252 srtasks.exe Token: SeTakeOwnershipPrivilege 4252 srtasks.exe Token: SeRestorePrivilege 3592 msiexec.exe Token: SeTakeOwnershipPrivilege 3592 msiexec.exe Token: SeRestorePrivilege 3592 msiexec.exe Token: SeTakeOwnershipPrivilege 3592 msiexec.exe Token: SeRestorePrivilege 3592 msiexec.exe Token: SeTakeOwnershipPrivilege 3592 msiexec.exe Token: SeRestorePrivilege 3592 msiexec.exe Token: SeTakeOwnershipPrivilege 3592 msiexec.exe Token: SeRestorePrivilege 3592 msiexec.exe Token: SeTakeOwnershipPrivilege 3592 msiexec.exe Token: SeRestorePrivilege 3592 msiexec.exe Token: SeTakeOwnershipPrivilege 3592 msiexec.exe Token: SeRestorePrivilege 3592 msiexec.exe Token: SeTakeOwnershipPrivilege 3592 msiexec.exe Token: SeRestorePrivilege 3592 msiexec.exe Token: SeTakeOwnershipPrivilege 3592 msiexec.exe Token: SeRestorePrivilege 3592 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4372 msiexec.exe 4372 msiexec.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3592 wrote to memory of 4252 3592 msiexec.exe 107 PID 3592 wrote to memory of 4252 3592 msiexec.exe 107 PID 3324 wrote to memory of 1984 3324 inkscape.exe 118 PID 3324 wrote to memory of 1984 3324 inkscape.exe 118 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\inkscape-1.3.1_2023-11-16_91b66b0783-x64_yOr62Fw.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4372
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3592 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:4252
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:2880
-
C:\Program Files\Inkscape\bin\inkscape.exe"C:\Program Files\Inkscape\bin\inkscape.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of WriteProcessMemory
PID:3324 -
C:\Program Files\Inkscape\bin\gdbus.exe"C:\Program Files\Inkscape\bin\gdbus.exe" _win32_run_session_bus2⤵
- Checks computer location settings
- Executes dropped EXE
PID:1984
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.0MB
MD568793cd4b97265732f030646686ae578
SHA14925c87b314f45a662e7b31a68aa7e7c2f1ac64d
SHA256a8672444270d201951fb9c9e4e82062cc37556c227b0cd510e7726a9f46d62fe
SHA512b287df4d8715f3ea7c14a9afd96ed57826c58f54192bd321b578544220cabb986397beef47d8cd0cc22ee2872245f00d3a4cbc15ac11450f6e92707944c535a1
-
Filesize
453KB
MD5531d384409fdb3f611ce926e5072754b
SHA1df897cd1584a7e7da861913af7a8df9dc218359e
SHA2563063166a7983b35a8547f968745184c2c337de94e5d3745882c548b3c3f7a0e7
SHA512c8ee8ef13604d75ce88994fee5601e32e98c32c39077707272b2979d1cac8a9a82e1b954642564a2d802e94bf875054d427dc466f968f4ada524b91cf65470dc
-
Filesize
453KB
MD5531d384409fdb3f611ce926e5072754b
SHA1df897cd1584a7e7da861913af7a8df9dc218359e
SHA2563063166a7983b35a8547f968745184c2c337de94e5d3745882c548b3c3f7a0e7
SHA512c8ee8ef13604d75ce88994fee5601e32e98c32c39077707272b2979d1cac8a9a82e1b954642564a2d802e94bf875054d427dc466f968f4ada524b91cf65470dc
-
Filesize
453KB
MD5531d384409fdb3f611ce926e5072754b
SHA1df897cd1584a7e7da861913af7a8df9dc218359e
SHA2563063166a7983b35a8547f968745184c2c337de94e5d3745882c548b3c3f7a0e7
SHA512c8ee8ef13604d75ce88994fee5601e32e98c32c39077707272b2979d1cac8a9a82e1b954642564a2d802e94bf875054d427dc466f968f4ada524b91cf65470dc
-
Filesize
349KB
MD505218ccaa420a95fb06e43befdc91f92
SHA15d5955290f72ce8503657e20dc845b20b63dc124
SHA256db064a08b85a6c59b6d9b988c5578a08267fe6ece60aec54d208ebc5dddee339
SHA512da5b56338d29ea2aecd7db933bc74f205c23278afee2bc9b09c070e8361c8c03950d101f947bcafd220b83dbe66c1df759652bccc141bc98c49d6ee9a5fadaa2
-
Filesize
252KB
MD5a51f4b52670f33f7929669e24865d461
SHA10b503ac55a888d8832e71e9031ae726b9f01c42d
SHA256eda342100538a1970ca148eb294d1677911754cf1ff7ffe9e3910bb5bf2ca73d
SHA512ce87dbbd4cbd2d09e009279ddc69bc81bfb5e068b1d48a4269b818d4a7adb9d28fcd42e11b454b3982fe54a1247f84de231288b591378f9d1785300b5572568d
-
Filesize
252KB
MD5a51f4b52670f33f7929669e24865d461
SHA10b503ac55a888d8832e71e9031ae726b9f01c42d
SHA256eda342100538a1970ca148eb294d1677911754cf1ff7ffe9e3910bb5bf2ca73d
SHA512ce87dbbd4cbd2d09e009279ddc69bc81bfb5e068b1d48a4269b818d4a7adb9d28fcd42e11b454b3982fe54a1247f84de231288b591378f9d1785300b5572568d
-
Filesize
184KB
MD539eea47e70ee9c69ed9ad2b2ea23a037
SHA1015894310a18822764e98d73b51bb2bdaae2cff1
SHA2564c8077ee313adb925ba2a75c4ba14bfcf8ffbc1c380265958dc2d557c00974b8
SHA5128a4de9e52f9958b13f7b43ff10d23ade7dd9986f053b5bc03f06fba7dfdebf717e3d34b5f23a5e32e8dbf5b445b1adc50d9590ff11b1e4eae9d3b8401e05a985
-
Filesize
184KB
MD539eea47e70ee9c69ed9ad2b2ea23a037
SHA1015894310a18822764e98d73b51bb2bdaae2cff1
SHA2564c8077ee313adb925ba2a75c4ba14bfcf8ffbc1c380265958dc2d557c00974b8
SHA5128a4de9e52f9958b13f7b43ff10d23ade7dd9986f053b5bc03f06fba7dfdebf717e3d34b5f23a5e32e8dbf5b445b1adc50d9590ff11b1e4eae9d3b8401e05a985
-
Filesize
7.4MB
MD58aca2beb32616a3bf907062acfabee84
SHA1d861bb5474b9e536f2bc708f8eeb720b886a84fb
SHA256596c26e957ec6410ad2c0c8826976516926084da6faec6240c0145da9d90f1c3
SHA512d1e51236469a04d43b99f08c4bc4203e5662845a04e8252e1be841c03f4004cae6d3aff066bc345ce7ebf8a7e1c625a56ac4bc8a4d57f3620d9b7be5042dd135
-
Filesize
7.4MB
MD58aca2beb32616a3bf907062acfabee84
SHA1d861bb5474b9e536f2bc708f8eeb720b886a84fb
SHA256596c26e957ec6410ad2c0c8826976516926084da6faec6240c0145da9d90f1c3
SHA512d1e51236469a04d43b99f08c4bc4203e5662845a04e8252e1be841c03f4004cae6d3aff066bc345ce7ebf8a7e1c625a56ac4bc8a4d57f3620d9b7be5042dd135
-
Filesize
161KB
MD59ec6f3131c3e98e210145063bf0d3905
SHA151c5b07bcc5e01ba01a87a63250a1c892b1e7d7e
SHA256192bd7773176a5cf734be0ce380e7ee6941ae452504ff53e43488bab994b9730
SHA512ad5556ae07ece9765d301c70c5c593b91e0c396f40dd22637f41f697f302df6e9889804f96dd337d3f36d46ab58a37f3d912d8cd4b94a755d53dc2965b62a3f1
-
Filesize
161KB
MD59ec6f3131c3e98e210145063bf0d3905
SHA151c5b07bcc5e01ba01a87a63250a1c892b1e7d7e
SHA256192bd7773176a5cf734be0ce380e7ee6941ae452504ff53e43488bab994b9730
SHA512ad5556ae07ece9765d301c70c5c593b91e0c396f40dd22637f41f697f302df6e9889804f96dd337d3f36d46ab58a37f3d912d8cd4b94a755d53dc2965b62a3f1
-
Filesize
143KB
MD5c90c52977442c9a5029a682d5bda6ad8
SHA16b197f19098155485334d942621c62b3875cd1f8
SHA256a143678aa07f22c405e339b83aaff2f5488e8461ecdfea2ced1b3e4584fb722b
SHA5129484fbaa52a973f8be8c62d25bddd9c24edc6d680e1bc9fd309c207e3dd29dfd87ddc6188e199d919945267fc3ffaca7aa315dbc9ae24e61626c990cf94721fd
-
Filesize
143KB
MD5c90c52977442c9a5029a682d5bda6ad8
SHA16b197f19098155485334d942621c62b3875cd1f8
SHA256a143678aa07f22c405e339b83aaff2f5488e8461ecdfea2ced1b3e4584fb722b
SHA5129484fbaa52a973f8be8c62d25bddd9c24edc6d680e1bc9fd309c207e3dd29dfd87ddc6188e199d919945267fc3ffaca7aa315dbc9ae24e61626c990cf94721fd
-
Filesize
611KB
MD56143bd87e6062c87ed2e7127aca95885
SHA14450a5dce9216e8f9c6e9bc0cbb98ea35c4864c5
SHA256960271c0e5fdc630f81c74efd6266c64299700a71bfa450b2ae900615d846c92
SHA512c74f594e5c1d3d6d6f307d1b701823e773f8c72aa477274b95508c14cee6ea94f384fc69fe688ba6944e72eed33874560b9e9dfdb7d04d20a23148a9a592de12
-
Filesize
611KB
MD56143bd87e6062c87ed2e7127aca95885
SHA14450a5dce9216e8f9c6e9bc0cbb98ea35c4864c5
SHA256960271c0e5fdc630f81c74efd6266c64299700a71bfa450b2ae900615d846c92
SHA512c74f594e5c1d3d6d6f307d1b701823e773f8c72aa477274b95508c14cee6ea94f384fc69fe688ba6944e72eed33874560b9e9dfdb7d04d20a23148a9a592de12
-
Filesize
1.7MB
MD51a1307082ec7232e8dde2440332b194d
SHA1881d6934bbd9fd32e98c22cd1026bb2e6b27049e
SHA2569f591140b368c20cdb6f21241d5b455309246213fe55ea09af7244c34ac7a450
SHA51290051e1c02077febb9ab52590ce139b7187cc7cc06d753c8ed490609b2dcf4a740b684617ae5309d2e24d6e1a836d3ce558b6ec95cdbabad30bcbaa67cd28ee3
-
Filesize
1.7MB
MD51a1307082ec7232e8dde2440332b194d
SHA1881d6934bbd9fd32e98c22cd1026bb2e6b27049e
SHA2569f591140b368c20cdb6f21241d5b455309246213fe55ea09af7244c34ac7a450
SHA51290051e1c02077febb9ab52590ce139b7187cc7cc06d753c8ed490609b2dcf4a740b684617ae5309d2e24d6e1a836d3ce558b6ec95cdbabad30bcbaa67cd28ee3
-
Filesize
35KB
MD5c0d05e4e99ccb5c0b7f0554640b84e61
SHA15b3dcd648a8cdbafec06565e7620b5fabc6ed03f
SHA256d7ec6d5922d80dacd8c19b9714dc9266c046e27bb3c99651fc20116b8beb4972
SHA51226205f0d8562d81201a12f4ff5b56d20a831eef06074dff1b908d097fe98ae77a5b40edeeb382cfa9f192e3534822874593a4a16e877bc2fb28a7dc13e7afa96
-
Filesize
35KB
MD5c0d05e4e99ccb5c0b7f0554640b84e61
SHA15b3dcd648a8cdbafec06565e7620b5fabc6ed03f
SHA256d7ec6d5922d80dacd8c19b9714dc9266c046e27bb3c99651fc20116b8beb4972
SHA51226205f0d8562d81201a12f4ff5b56d20a831eef06074dff1b908d097fe98ae77a5b40edeeb382cfa9f192e3534822874593a4a16e877bc2fb28a7dc13e7afa96
-
Filesize
318KB
MD514b9f0694ff2ae44a22c049988464275
SHA1ee161354847a4461098e0e21de4282e4d111d8cf
SHA2567c8c88cd1e02f7e348c56f6ce1b209c576597a4ed5da0d2c04ed338700905d9b
SHA512b53a9515608e3d25218c9cebecd32230c12f72ea8da8475bb1715feca3b218bd9510d84ea31f5afacb334a494d33e8a8fdc6cd95451ed805a80b5c26c0064c50
-
Filesize
318KB
MD514b9f0694ff2ae44a22c049988464275
SHA1ee161354847a4461098e0e21de4282e4d111d8cf
SHA2567c8c88cd1e02f7e348c56f6ce1b209c576597a4ed5da0d2c04ed338700905d9b
SHA512b53a9515608e3d25218c9cebecd32230c12f72ea8da8475bb1715feca3b218bd9510d84ea31f5afacb334a494d33e8a8fdc6cd95451ed805a80b5c26c0064c50
-
Filesize
760KB
MD57ccd3e142098ca16c4831da55770f14e
SHA10a52be3dd9e3c9ec849a6480c61621eebcc05f28
SHA25627e2122ec950dc59caad5de0edddbfed32ccf7633331b62af51ebcef82de415c
SHA5121af09cfafc7906290ec542c06d5b592ddcaaded3e73d260bb91ff24d9ab7e601cfab480ebd19768ed6db769cb3108b41a5f1680e122d0ce37ea1b9de35806513
-
Filesize
760KB
MD57ccd3e142098ca16c4831da55770f14e
SHA10a52be3dd9e3c9ec849a6480c61621eebcc05f28
SHA25627e2122ec950dc59caad5de0edddbfed32ccf7633331b62af51ebcef82de415c
SHA5121af09cfafc7906290ec542c06d5b592ddcaaded3e73d260bb91ff24d9ab7e601cfab480ebd19768ed6db769cb3108b41a5f1680e122d0ce37ea1b9de35806513
-
Filesize
171KB
MD57f797f90ccc81063d7cf455ccaf65dcf
SHA10a56d8605ed2a9b7bd0d73d769eec33bad75b0d2
SHA2563952b36150e72e71f548b79ef74be20f07969554d238908441ec88f7c87b009a
SHA51216feff604baa91eb231045569eb55b6bf0dd73d0106c83c6ffe2aa08f93ad11b4d467e5109e2552406be98a02c7de115ae024d063a0d28a63199825141c02dcb
-
Filesize
171KB
MD57f797f90ccc81063d7cf455ccaf65dcf
SHA10a56d8605ed2a9b7bd0d73d769eec33bad75b0d2
SHA2563952b36150e72e71f548b79ef74be20f07969554d238908441ec88f7c87b009a
SHA51216feff604baa91eb231045569eb55b6bf0dd73d0106c83c6ffe2aa08f93ad11b4d467e5109e2552406be98a02c7de115ae024d063a0d28a63199825141c02dcb
-
Filesize
118KB
MD51a4eeaed23da850d2afd6e6fb8c60215
SHA191e9b261ba86ae5b5515a6447909e1e04caa5648
SHA256a2a5f1dd4013d3e0fee520763ce9c1836756164cb692013566db2475cebde4d1
SHA512aff844257c6c50e6bfe70fce2861743c7ad0bf5f1433e91170849697510d035fa6b167e3981a75cf7a51bc325e144e1f45d4c3838df95d4bf403aeab186e3870
-
Filesize
118KB
MD51a4eeaed23da850d2afd6e6fb8c60215
SHA191e9b261ba86ae5b5515a6447909e1e04caa5648
SHA256a2a5f1dd4013d3e0fee520763ce9c1836756164cb692013566db2475cebde4d1
SHA512aff844257c6c50e6bfe70fce2861743c7ad0bf5f1433e91170849697510d035fa6b167e3981a75cf7a51bc325e144e1f45d4c3838df95d4bf403aeab186e3870
-
Filesize
1.3MB
MD5539951c26343a11b2b36b41e5f632592
SHA1823a75727f74ff9e00d9a229cbad03839a3754f2
SHA2566e98551e876aa82673289ec791566d70f887386d5d240c45afbc89bb7340089b
SHA51217bece844e38983801d90d9f0402e30f59d982949b4c04cfd0b381b6b7745ec03191a74de38d021ebda05960a925f6737b0b6473a0568f8f73262891dfe96ecb
-
Filesize
1.3MB
MD5539951c26343a11b2b36b41e5f632592
SHA1823a75727f74ff9e00d9a229cbad03839a3754f2
SHA2566e98551e876aa82673289ec791566d70f887386d5d240c45afbc89bb7340089b
SHA51217bece844e38983801d90d9f0402e30f59d982949b4c04cfd0b381b6b7745ec03191a74de38d021ebda05960a925f6737b0b6473a0568f8f73262891dfe96ecb
-
Filesize
171KB
MD55213fc7c41781c3a47e04dbc52e0ac7e
SHA1d9d1e461deb4de8b720042e9b238e01b29db6c01
SHA25639f569c9af724cd5d228091ca22c636eab5052df0637fdf1f1f16242089e1c2b
SHA512539b899e260e6ad7e7b71d31c6b0eed8af559633a7ca55af201aa871a00fbb5f6d04c6bace2eecc7c403c23a1e90e102edd6f8fff65624ba1e8c41c46ac2d03b
-
Filesize
171KB
MD55213fc7c41781c3a47e04dbc52e0ac7e
SHA1d9d1e461deb4de8b720042e9b238e01b29db6c01
SHA25639f569c9af724cd5d228091ca22c636eab5052df0637fdf1f1f16242089e1c2b
SHA512539b899e260e6ad7e7b71d31c6b0eed8af559633a7ca55af201aa871a00fbb5f6d04c6bace2eecc7c403c23a1e90e102edd6f8fff65624ba1e8c41c46ac2d03b
-
Filesize
284KB
MD5c3b2fd7bbb48a19509540e1833025afb
SHA12edef98515cdeef1216fbd52678cffababbf9186
SHA25676e41d17982d841cf76988a041c03b253d633673f92e6b92f7ad40a89885586c
SHA512452e044685031ce0690af75306b4ea19c429a8fbc514937a507e463527a4e4a2a8568e0ccefcfcb04f9d8e835982030a8309f6dc5086896323aa6766a367ccc1
-
Filesize
284KB
MD5c3b2fd7bbb48a19509540e1833025afb
SHA12edef98515cdeef1216fbd52678cffababbf9186
SHA25676e41d17982d841cf76988a041c03b253d633673f92e6b92f7ad40a89885586c
SHA512452e044685031ce0690af75306b4ea19c429a8fbc514937a507e463527a4e4a2a8568e0ccefcfcb04f9d8e835982030a8309f6dc5086896323aa6766a367ccc1
-
Filesize
1.7MB
MD5015a26509c63ce5193ee20c194654272
SHA1bf1d1e8b7ecd70953830803ab4630ac32067fdee
SHA256fcdeb4c876967e4e7e7534e9f5030d3db31421eac5f84f7784f265d5088428f4
SHA512e939b4da9bac2d0c2da3dfb865a6275cb07b5573d1f27489869688d9477b9ee4815fdb9d4eb4940e3bd60e5199662a2309682ba69852c0ac8a89375e110116a0
-
Filesize
1.7MB
MD5015a26509c63ce5193ee20c194654272
SHA1bf1d1e8b7ecd70953830803ab4630ac32067fdee
SHA256fcdeb4c876967e4e7e7534e9f5030d3db31421eac5f84f7784f265d5088428f4
SHA512e939b4da9bac2d0c2da3dfb865a6275cb07b5573d1f27489869688d9477b9ee4815fdb9d4eb4940e3bd60e5199662a2309682ba69852c0ac8a89375e110116a0
-
Filesize
1.4MB
MD5f18d0950455699e4e02c9547234d41d9
SHA1fb83e2d1676742448c30f3e29426f805be4cf281
SHA25639f93d4a5fb002a590be6e1889a26bc8c8531cfe51f66950f8286e7a5cda30dc
SHA512dac717c687d62ee63c03081b5b9fe751c7a5229c8f0fc4b371d7a0239771654f9fae3d7a0b2679eec5b791ca256e41e52fc1218d50cad285ddfc115328cec605
-
Filesize
1.4MB
MD5f18d0950455699e4e02c9547234d41d9
SHA1fb83e2d1676742448c30f3e29426f805be4cf281
SHA25639f93d4a5fb002a590be6e1889a26bc8c8531cfe51f66950f8286e7a5cda30dc
SHA512dac717c687d62ee63c03081b5b9fe751c7a5229c8f0fc4b371d7a0239771654f9fae3d7a0b2679eec5b791ca256e41e52fc1218d50cad285ddfc115328cec605
-
Filesize
1.4MB
MD539a02b060ed747bf80329677e2dcc8bc
SHA1378d702df1e4350b47dc7968b71c3a6bec9ef049
SHA256fae9a83603b2ee704bb03d757313dcbabfe17501680290780489b2537256a641
SHA512794045957b597c4acc75cd8b4a1c95ea70e4123d914cc314032c7dd637bf41584edbddc176f159287d442308fbe7f926ef00ecc3161b2d4e46261fb481363e53
-
Filesize
1.4MB
MD539a02b060ed747bf80329677e2dcc8bc
SHA1378d702df1e4350b47dc7968b71c3a6bec9ef049
SHA256fae9a83603b2ee704bb03d757313dcbabfe17501680290780489b2537256a641
SHA512794045957b597c4acc75cd8b4a1c95ea70e4123d914cc314032c7dd637bf41584edbddc176f159287d442308fbe7f926ef00ecc3161b2d4e46261fb481363e53
-
Filesize
444KB
MD57a6a1111cab1abff222bc8adddd83b40
SHA13cf98bf58989c482cedb481715d56b2ef5b2dc6f
SHA256a6f7c447c14da03442e6db94d61a27a78f213dd44e9ff7be1288ade3635bf927
SHA51276e1c2f317d1129554d1eaa0729c460470ca1028905a319cfb6cc4d03ddfe1c575875d15476a77cd88ba99fde9cbd72a699546e7bf525650c24fb98206730178
-
Filesize
444KB
MD57a6a1111cab1abff222bc8adddd83b40
SHA13cf98bf58989c482cedb481715d56b2ef5b2dc6f
SHA256a6f7c447c14da03442e6db94d61a27a78f213dd44e9ff7be1288ade3635bf927
SHA51276e1c2f317d1129554d1eaa0729c460470ca1028905a319cfb6cc4d03ddfe1c575875d15476a77cd88ba99fde9cbd72a699546e7bf525650c24fb98206730178
-
Filesize
30KB
MD545521d781910b36f11ec498e30299233
SHA14c72b0162ec56482ddd9a552cae39fbba27720f3
SHA2561f43c39842cc4143dd352e1c3c9d4e306e62428392f6ed70730a0444cf9496f4
SHA5121ae12f4f015f0c49468cbe8536a313942633e0e4cce654283835f1c2bf3da59126f675f8034144217bad36f888e76051fcc19d3568b0f4fc149b72d22ec654f1
-
Filesize
30KB
MD545521d781910b36f11ec498e30299233
SHA14c72b0162ec56482ddd9a552cae39fbba27720f3
SHA2561f43c39842cc4143dd352e1c3c9d4e306e62428392f6ed70730a0444cf9496f4
SHA5121ae12f4f015f0c49468cbe8536a313942633e0e4cce654283835f1c2bf3da59126f675f8034144217bad36f888e76051fcc19d3568b0f4fc149b72d22ec654f1
-
Filesize
345KB
MD59c91fd30601316d7a69e633c6bbd872a
SHA15c2934bd3be80bfd8da8bac21840045e454b7fea
SHA256412526527d7f8b876aea0b468d9e0852f23b14c57545dbc863a04b25c222a9ac
SHA5123875a8eb2dbe89edf4c0b16432d354c3d16e78320a9937139d42705e3ffb08afb0c558ad88f999ffbc7dead4c87f47232373af1478da1cf50f375660ea88b320
-
Filesize
345KB
MD59c91fd30601316d7a69e633c6bbd872a
SHA15c2934bd3be80bfd8da8bac21840045e454b7fea
SHA256412526527d7f8b876aea0b468d9e0852f23b14c57545dbc863a04b25c222a9ac
SHA5123875a8eb2dbe89edf4c0b16432d354c3d16e78320a9937139d42705e3ffb08afb0c558ad88f999ffbc7dead4c87f47232373af1478da1cf50f375660ea88b320
-
Filesize
288KB
MD5a988affb22969e08c768cdcb3b008425
SHA1343cf7459d9a83ebbd4d6aca0d7987647a760448
SHA2563a8304168c6a33e6c7a70d5bc36c490f62170dc32447b9cf192dadbd801e8652
SHA512cababb578f37016ed790572f55694ca8fafb0edcda487b2eefe235a0df677ba1f0e44e987d64cebacc793b805d39fbd7076c378fd4997f8c1bd367c865debc71
-
Filesize
1.1MB
MD58600c2cd46fa3f8573d4abdb85cb85c4
SHA115ec72b1d3e58064f279ac911e7089509012978b
SHA256d8a6d7adf1b29dda4563c3442175ae1cc61b55729e2f83a8e88d8801cc7aa8cf
SHA5127ead1cdd87839a7e3e9ca4e63857a5dd2f7af35b22438b3098df29eed35f689a167d2414401201d9c3c881ae71682f19710ccc347a96f518bc25cff3fc37cdff
-
Filesize
1.1MB
MD58600c2cd46fa3f8573d4abdb85cb85c4
SHA115ec72b1d3e58064f279ac911e7089509012978b
SHA256d8a6d7adf1b29dda4563c3442175ae1cc61b55729e2f83a8e88d8801cc7aa8cf
SHA5127ead1cdd87839a7e3e9ca4e63857a5dd2f7af35b22438b3098df29eed35f689a167d2414401201d9c3c881ae71682f19710ccc347a96f518bc25cff3fc37cdff
-
Filesize
34.2MB
MD574cbc226579df4e7b19dcdb6418a2d37
SHA103e975c550b16d9b7b5f3933b5ddd966e68426a0
SHA25628ec1a43bed2618fb97c093d922e3f8f6e9aa2d38898da2974d66a839f6ef751
SHA512e3e7954b770fd7bcb8574fd531bd0c2a177cdd6062ba7fe5b08896cfce8fe77bad6031d6adbfacd64189a486258ad085db4a21c24e733e0c037b0f59b1c29ec2
-
Filesize
34.2MB
MD574cbc226579df4e7b19dcdb6418a2d37
SHA103e975c550b16d9b7b5f3933b5ddd966e68426a0
SHA25628ec1a43bed2618fb97c093d922e3f8f6e9aa2d38898da2974d66a839f6ef751
SHA512e3e7954b770fd7bcb8574fd531bd0c2a177cdd6062ba7fe5b08896cfce8fe77bad6031d6adbfacd64189a486258ad085db4a21c24e733e0c037b0f59b1c29ec2
-
Filesize
185KB
MD5b4b714c1e58bdebf7dc8bff1740c370d
SHA1ca15629c0f6751dfc7ea43a73d85058bd78ab4d7
SHA256182a71f71a65ea10bc69e6d4fa5fa80cf4ee792384a0be5ffdf9905ff48673c2
SHA512fb2cb77ebce1f9ff9191c4f27a0ccb93ea1f65bccf62f192336bb5e246131aa9bf039549832cbe0c5cfc9088cb03f1d9a2d9d9d09d0f82567aba87b9ea7328eb
-
Filesize
185KB
MD5b4b714c1e58bdebf7dc8bff1740c370d
SHA1ca15629c0f6751dfc7ea43a73d85058bd78ab4d7
SHA256182a71f71a65ea10bc69e6d4fa5fa80cf4ee792384a0be5ffdf9905ff48673c2
SHA512fb2cb77ebce1f9ff9191c4f27a0ccb93ea1f65bccf62f192336bb5e246131aa9bf039549832cbe0c5cfc9088cb03f1d9a2d9d9d09d0f82567aba87b9ea7328eb
-
Filesize
387KB
MD591378361c635405554771f188cd20b85
SHA123a24fae74ece4abc62014d8a57c4e2399e87176
SHA2569fa5b8ab23eadd7fbd7f38149b5619c37c0ae1cdc4c0229d032a2c8da6e4880e
SHA512ecd4bec3e87af8822768417aec7857b3e3254f999cb380f247c5055aec013d36702fdf43b8c6cf02cedcf8fa768a2839e246712ea59de5ffed460197f2b89299
-
Filesize
387KB
MD591378361c635405554771f188cd20b85
SHA123a24fae74ece4abc62014d8a57c4e2399e87176
SHA2569fa5b8ab23eadd7fbd7f38149b5619c37c0ae1cdc4c0229d032a2c8da6e4880e
SHA512ecd4bec3e87af8822768417aec7857b3e3254f999cb380f247c5055aec013d36702fdf43b8c6cf02cedcf8fa768a2839e246712ea59de5ffed460197f2b89299
-
Filesize
30KB
MD5ca9efe922272553c874d7e935fe687d6
SHA1f89ab5337c28a689036b0158475d9834dde94292
SHA2561b70ca6cb6cedf6fdceaad18ce40e2963b2bea3e1a72a2b5575f10ab7cea62cf
SHA51255eed0afa88f242bbbcd3f4e625ca034ed54c328140c360b01d0b09f420d3b1c602c7ae447126a4aad0e310b9e5b7b2aa1c532612d777f56a40506e8d5124204
-
Filesize
30KB
MD5ca9efe922272553c874d7e935fe687d6
SHA1f89ab5337c28a689036b0158475d9834dde94292
SHA2561b70ca6cb6cedf6fdceaad18ce40e2963b2bea3e1a72a2b5575f10ab7cea62cf
SHA51255eed0afa88f242bbbcd3f4e625ca034ed54c328140c360b01d0b09f420d3b1c602c7ae447126a4aad0e310b9e5b7b2aa1c532612d777f56a40506e8d5124204
-
Filesize
2.2MB
MD54c10da5a59daee95a9733017749aaef1
SHA15554176d11e6157439ee3459605769ddefd8ca24
SHA256316c5adec127510a59f540b4f19b69fe0fa8eaf1025e186ec57d924ea74ed4bd
SHA51237b78477d5d286cd897d8174c2dadd69d6d0d6131817cb427c9693b0f1f866afdeeab8face8cbce7181d91eda17599f45ea6f8c5ffa2ee6102b59b0dede9c4d5
-
Filesize
2.2MB
MD54c10da5a59daee95a9733017749aaef1
SHA15554176d11e6157439ee3459605769ddefd8ca24
SHA256316c5adec127510a59f540b4f19b69fe0fa8eaf1025e186ec57d924ea74ed4bd
SHA51237b78477d5d286cd897d8174c2dadd69d6d0d6131817cb427c9693b0f1f866afdeeab8face8cbce7181d91eda17599f45ea6f8c5ffa2ee6102b59b0dede9c4d5
-
Filesize
62KB
MD5987a3df68eef44006e61de92cae10b2a
SHA1729042de3e19aa1d7fc6ef7a63e7df0cee4640f8
SHA256cc00155bd3c575e2cd7993dd35de89147e83125a905d219c9823ba44ecb236a3
SHA5121f4658544c00974bec622cb82167e38854b8ee3bec266faac0c6439d1e281fe5283503d296781969a5069e69d856d1b8518e6a70df0cc0ac4ea93bfeb0df3f3e
-
Filesize
62KB
MD5987a3df68eef44006e61de92cae10b2a
SHA1729042de3e19aa1d7fc6ef7a63e7df0cee4640f8
SHA256cc00155bd3c575e2cd7993dd35de89147e83125a905d219c9823ba44ecb236a3
SHA5121f4658544c00974bec622cb82167e38854b8ee3bec266faac0c6439d1e281fe5283503d296781969a5069e69d856d1b8518e6a70df0cc0ac4ea93bfeb0df3f3e
-
Filesize
97KB
MD50f15b2f49b733e89ee9e20fc71cab507
SHA1ad9b23bb3253d096684a3e927728db7fda892245
SHA256555bb5fcfcad5fe46c227d3a76964ac9a791d45d00ca277949f8c7774c940ba6
SHA51251644a4879b3e53c3af27f1f91a3551f2907ddccf54381d15cadbacd25d350dc4fb70d68b7a8124020a9131d6435ca008d9674696633c883d82d26254715ed1e
-
Filesize
97KB
MD50f15b2f49b733e89ee9e20fc71cab507
SHA1ad9b23bb3253d096684a3e927728db7fda892245
SHA256555bb5fcfcad5fe46c227d3a76964ac9a791d45d00ca277949f8c7774c940ba6
SHA51251644a4879b3e53c3af27f1f91a3551f2907ddccf54381d15cadbacd25d350dc4fb70d68b7a8124020a9131d6435ca008d9674696633c883d82d26254715ed1e
-
C:\Program Files\Inkscape\lib\python3.11\site-packages\lxml-4.9.3-py3.11.egg-info\dependency_links.txt
Filesize1B
MD568b329da9893e34099c7d8ad5cb9c940
SHA1adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
SHA25601ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
SHA512be688838ca8686e5c90689bf2ab585cef1137c999b48c70b92f67a5c34dc15697b5d11c982ed6d71be1e1e7f7b4e0733884aa97c3f7a339a8ed03577cf74be09
-
Filesize
343B
MD598690d2999811100face91d0f295e94e
SHA17d37ce214084f7ebbf830c0009012e28bbd167ba
SHA256a0723f4ad61ee0bbe1449a622f5c4bb2404fa32027b1b415605a329071999732
SHA512c97008361c3fd38bab61fc998b2cd062fdcb65982739653f223e70bef9825712b96b8ffbd43b2ac4dff52683fe8f782a096048be4f3ace16603ce37e85210043
-
C:\Program Files\Inkscape\share\icons\Adwaita\32x32\devices\media-optical-cd-audio-symbolic.symbolic.png
Filesize748B
MD5cc85a90666de9d03213a0ac932780855
SHA13a3ee1fa70fdc227c3514fe06f140cd27b0bfd31
SHA25600dfddc3ce57b1e251c077724e15590e3ae37b65b180848635298fb285a7431e
SHA51265bb17aa9649774ccbcc55921538225b2dd4f2ae54a72edfb5b30935821d8a048f57cbdc47b2a0aaecc7a68bd6aff7798e1a4466d77f9605ae85b5f8a7b41f50
-
Filesize
133KB
MD5744a2340f10ee9eb09a7d18f2f391e95
SHA1483aef639daffaf87e7e53dd0a2b913e8262eefa
SHA256d3cde91f91cd8bfe6495f9f790e5f5a47ce019e4e6c1260e3f07ba14f593c958
SHA5125aed2786d3dca1083a643627352326a7560edaaef1ed1a65e80d48572f39c18b3ad21a963678a5c83aa252512796f5fcef8f3342e9a0e26a021bd421f93f86f8
-
Filesize
133KB
MD549cf85c6a06da1472a5158128461c71f
SHA140377f16ede9932e2322296816de628ed5c083aa
SHA2560dbcbcc6716a192706171126e10796788ce7beac0da16a1e2358e717e7c54a76
SHA5125162e812c4760efc6b653d1e592ab3f77c12e56c1ac50463df2bd1fefd962540633bdf2b8196fde31d26e48ec476ba9360836dbe97c9dcb5eec029290d023833
-
Filesize
133KB
MD5de8ef6323f19afb27ca0187d682b4560
SHA1a7e130786e922c7da2393317bbc88b60b1ffe182
SHA25645c224e24b945e1f1a9079933d6130bc2ab4951f5b55e14612dcbf466eb1bed5
SHA5125deff4619e2cbb82b2cd10afdc4e2c36c1828897017c46db07f7931ac8414b7bae69ba8fb95da8dc35cdd112ca53374218091c1581db3c4ff97542dae4ceb9e6
-
Filesize
133KB
MD5f336af8e3a3e1e3f24bca91a77c720a4
SHA1913104d1797ea0f9a00578c2cf9192c93d7d4b76
SHA2561230dbb931506e3281884eb9ea1a54bff353ce5ba9f2059952c2a739bc298365
SHA512de6ed801cda9f091b468b3690dc1d700145f5192d4ae2cfd176d6b9fd4a6b3f17a3e43f0857b1ee420aae747cf7da48c0512e69f91e55a170cf78644a81f3a3a
-
Filesize
133KB
MD5d7f806705a8eee1594a21274a8cf16b9
SHA1a846a6672ef2a93f58a6bd1dc3cbe0451eb108a0
SHA2562ad29bcfe57726c8ba3b343204f6797cc26c08e49737305b7a90d70878ce8ad6
SHA512525203ed181e1ee160c634a08d79a1e58dccffd6948a48f26975176796f43e80b12cd62854fc05ca6a123e18164389acb6601ea60b6e34abbb071d851c1d1be3
-
Filesize
133KB
MD550e4a5de56b93d9642961ee2a942e7e0
SHA1a7a7c00ff2942219bcdfe9e306ad689f61a65046
SHA256e38de2a5bd1af406d4a289a12c4417b23ed8ceabb2c1b559d7e4fb6ee93665ba
SHA51220f15c022a9cb4b6cdde5fa851897349a490f27d66b6de7369682e3edddbf5ce962251cbaa7337a3c4c3329267eaad59ec7534290e7aae0224daf0e2f9536153
-
Filesize
133KB
MD5ca670dccf38eefed5ca5a9b9bf1cbfef
SHA1056df31790245ab97dd60ea87755199cec687d40
SHA25691acc2268854381bf5e4d6b75120ff6c85322a6b9ed1d7ba0c95b993de95d4af
SHA5128331ce5e26dfd9dc62832987dfbf604c11fe7187703e217cd6475d60ca01411d8b5d356dec3eaefb2f096a13348b91a605ffcfd331a3e699db45381ffd87d7cb
-
Filesize
133KB
MD50055764fbefedbbe359ebc14d0529572
SHA18481c73641c7f440aa0c3a0da4d3c358dbefd2f5
SHA256935532cf4a55ac166c4479a1e0932fb7d08b4f842005539344726bcbe8074cf3
SHA512c659c8ddaad968ffcce9beea6d1ccb8f755c496eb3b606e41874a6c69b0662e8cde21107041dfcdce4569f93d6ef0496040a5d448dc13007331d80c0e312ab3e
-
Filesize
629B
MD548281857472b1a6c0917cecbee2b39b8
SHA10e45fb15f77bc37909e56fee9d807d5f96f60f53
SHA256400909b4e6008b6a90e83e5bac3338ca96b068a6e765b548ce8af87e090054b1
SHA51239cc48c2ec5af9bb7d51c02f3cfffdd1ca3a31c698ffc91c96ce86fad241f7aa0a5b3ccb9a205d7639fe5307dedcf9ea0d3518baebb17b5399ae93517a88ccfd
-
Filesize
635B
MD5ded322e67a1d0b057c698848c5d94d92
SHA178305f24e12f47b83bc2eec705e9e107c1412a7f
SHA256df531115311558c4625cf58866c516cd2ab37921137f4a77896b8acfd5490476
SHA51246c7d31e481a04832235438faa84fdf4d2b1ab5b08d77352c574802d8457e0f05a88dbcd55a1c58af7894030760be9d57fed9661a8018c46f8dc683860a12f98
-
Filesize
301KB
MD5e0bd82118084ed492ca54c5b7bff53b6
SHA1165ba76b74cc6f5a40cc31efe81a890b25e5e28d
SHA256c725b2e2cdc94d5bcf8f74891732aa88382f32f589294a7d2e3a622ae5462762
SHA51241f59a44fa680203b7d4de7945fccf517274df31b268f36f08a74444b3e46f87b0e3674ce54fa3a0f450cea02eb1c9da027af1f6bb553cfa8904b35f41150c67
-
Filesize
102KB
MD57d57cc365547a0db3f72f645ac38427d
SHA17d9d7394bfd7199a1caa3ec15dc39426c923d378
SHA2569419ebd70da19866d41b8abe701826aa2b427d9dd7352e29be14707416f20b34
SHA5122b27b2145317482f40369186b38d05ed095e763e426152a411e9a4a48441b3695779c7124d6b644999d294d9c1782d92d8a65258af24f802684d3aab276ee0df
-
Filesize
136KB
MD595ed46ad8cdc6a6827cc98c1b2666e89
SHA16a53245c924335391dc00494f7b4ad060de5723a
SHA2560e50ea0fcd28411ae98423ade3833016d0abd1d034c8c5c4ff27c7ce08f0ad2a
SHA51207020c3680ab4734bf3ea856e1bdcfb0a46b40ea656f0937a6339c1837dcb1e046bbbdb0ae3916e38f31ae957b59cbf5c1208498e0d3ce05b73a4c0e0731f0d0
-
Filesize
108KB
MD5ab8aac75a5caf9d142d1c98ae36fd6ff
SHA108b12e1aea6b0cff364158dfecba5bcfd8d11f45
SHA256642a9674b03ab630c2c4347b4826dd82a39c7710b15406ffb23b779e05aba2b1
SHA51222d542d0fc94977acc953f00573a8a86da885749d342b94cb8abbb4e907360a93885190f3395159288e7d2d614b5a0d03d75b9a298318ee81f5a3902e0acf232
-
Filesize
157KB
MD586311f8d96bf2deda787c0f251ff3d95
SHA12054c4c00156c48341694b6152e5f14f5a8e0d9f
SHA25638ebf11f4fe243895659488eaccc1e6bd7f95dc5d58bcefb6f353a1aa442168c
SHA512935d00c611231df81e7d90cbba71070dbaec9c1e54424fd6fb6089835f1619fcc537ab4d216e86042ccfe7d151775f18ae03e5d131b67e8a19a60ed89c4f00ce
-
Filesize
585KB
MD5f1d77dfcb4f468a11ae82dc67aa73e8d
SHA1d33c5c4149115c4e41cafaa7e781e1530be67342
SHA256c8ff92927df362cd849ba5ee20d01076d53237b17c61c9b211b5752d1ec7e110
SHA5128ed82f08f9b75fc4b1a234dc0d7c051744282685443f273b3017625196b66ca556ae5a23744c653cb482e53dc392fdba6fb10d7286ef07304f86cd7aa1096949
-
Filesize
138.3MB
MD58063827e946f0877100eb79ec6a6988c
SHA1289dbc9936649878c87c459f0271dc9de1c09875
SHA25690f8f632c57fe6ab5b050ba1ed8dc08ae79d88bb9c48ee6de3e8d17db5673f58
SHA512332a1748e4d207ea2bf33abe197a0e486f722b2d2ad35d80380327cdf478f340b6b45588e96d93a6d79d2a9d19b822d373b1e128a2089112ab6e1fb9846456ed
-
Filesize
23.0MB
MD567fca04b573a4eb0de58db896b8579f9
SHA11c0f920ca8457086b3050a5ce1a45680d273bae6
SHA256fe82133d98f390ca97c578f34a0d5948c470a43507c18b8692135794b4739689
SHA5121283dbaa03a52f3ca98b268ba7ff745186bef391bd8c49723b526649a4b11df0586196affeb75a9d21eb5fc1785c75e680e2084ce9c71eef8eb6cb5c302f31b0
-
\??\Volume{03226c32-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{0eedefeb-8cac-477a-91eb-b69cf1867e44}_OnDiskSnapshotProp
Filesize5KB
MD5f1b7c54b01c3ed62a36deb7719c3f916
SHA17c9ac2930c5dc8f599ca19637c98dda2d18ca8a7
SHA256aa0e7cae35b94a7955807b0eb5b0fdaf33958630eb43e286f8a287d01e8b453c
SHA512df6736c1b7e3c9410ab4dfe87a0e5a825f4a6ddb01a5a515e56f630635065d1495a82e81711161706e13e9805d3d9f3d0bbf246e48090d481944879972a668a2