2a22be4c7e3a17d6a408b0c0547cc181e148ab20c2e3f048791b421280686544

Analysis

max time kernel
298s
max time network
287s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/04/2024, 03:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

REAPER_KeyGen.exe
Size

688KB
MD5

fd5a3b2e2933ea1151d71f9cefc9fbcf
SHA1

8c7596bc39e7945ac58396102386f77db6dda4be
SHA256

2a22be4c7e3a17d6a408b0c0547cc181e148ab20c2e3f048791b421280686544
SHA512

3299c6534b2a09158c3decdec536e4296c2a2a31f32edfb5da1de413036a0f9475549ad14a7b891c0e413839f1dbaf03e1bb75b576e545e6a4138650b3533a30
SSDEEP

12288:sc9t2SllULgBqjW0PPdH5DVIXKGE6/gBQpoZmp2FTV0RY5wmm64a:scLyLBW0VHpag2KZmp2F2Rd64a

Score

8^/10

evasion

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 5 IoCs

pid	Process
3444	keygen.exe
6096	reaper714_x64-install.exe
5368	reaper714_x64-install.exe
5716	reaper714_x64-install.exe
2904	reaper.exe

Identifies Wine through registry keys 2 TTPs 2 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Software\Wine	reaper.exe
Key opened	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Software\Wine	reaper.exe

Loads dropped DLL 64 IoCs

pid	Process
3444	keygen.exe
3444	keygen.exe
3444	keygen.exe
6096	reaper714_x64-install.exe
6096	reaper714_x64-install.exe
6096	reaper714_x64-install.exe
6096	reaper714_x64-install.exe
6096	reaper714_x64-install.exe
5368	reaper714_x64-install.exe
5716	reaper714_x64-install.exe
5368	reaper714_x64-install.exe
5368	reaper714_x64-install.exe
5368	reaper714_x64-install.exe
5368	reaper714_x64-install.exe
2904	reaper.exe
2904	reaper.exe
2904	reaper.exe
2904	reaper.exe
2904	reaper.exe
2904	reaper.exe
2904	reaper.exe
2904	reaper.exe
2904	reaper.exe
2904	reaper.exe
2904	reaper.exe
2904	reaper.exe
2904	reaper.exe
2904	reaper.exe
2904	reaper.exe
2904	reaper.exe
2904	reaper.exe
2904	reaper.exe
2904	reaper.exe
2904	reaper.exe
2904	reaper.exe
2904	reaper.exe
2904	reaper.exe
2904	reaper.exe
2904	reaper.exe
2904	reaper.exe
2904	reaper.exe
2904	reaper.exe
2904	reaper.exe
2904	reaper.exe
2904	reaper.exe
2904	reaper.exe
2904	reaper.exe
2904	reaper.exe
2904	reaper.exe
2904	reaper.exe
2904	reaper.exe
2904	reaper.exe
2904	reaper.exe
2904	reaper.exe
2904	reaper.exe
2904	reaper.exe
2904	reaper.exe
2904	reaper.exe
2904	reaper.exe
2904	reaper.exe
2904	reaper.exe
2904	reaper.exe
2904	reaper.exe
2904	reaper.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral1/files/0x000c00000002323e-203.dat	nsis_installer_1
behavioral1/files/0x000c00000002323e-203.dat	nsis_installer_2

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor	reaper.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	reaper.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 60 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	keygen.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	keygen.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	keygen.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	keygen.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	keygen.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	keygen.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	keygen.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	keygen.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	keygen.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	keygen.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	keygen.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	keygen.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	reaper714_x64-install.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	keygen.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0000000001000000ffffffff	keygen.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	keygen.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	keygen.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2	keygen.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8	keygen.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	keygen.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	keygen.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	reaper714_x64-install.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\Shell	keygen.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg	keygen.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	keygen.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	keygen.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings	keygen.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	keygen.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000	keygen.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	keygen.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	keygen.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202020202	keygen.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202020202	keygen.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	keygen.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	keygen.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	keygen.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	keygen.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	keygen.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff	keygen.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	keygen.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	keygen.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	keygen.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	keygen.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	keygen.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2 = 3a002e803accbfb42cdb4c42b0297fe99a87c641260001002600efbe11000000230bd29ecc68da01e2fcada1cc68da01cffd34a3cc68da0114000000	keygen.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 020000000000000001000000ffffffff	keygen.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\MRUListEx = ffffffff	keygen.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	keygen.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	keygen.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	keygen.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	keygen.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\NodeSlot = "8"	keygen.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	keygen.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	keygen.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	keygen.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	keygen.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\Shell\SniffedFolderType = "Generic"	keygen.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	keygen.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	keygen.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	keygen.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\reaper714_x64-install.exe:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3444	keygen.exe
3444	keygen.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: 33	2776	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2776	AUDIODG.EXE
Token: SeDebugPrivilege	4796	firefox.exe
Token: SeDebugPrivilege	4796	firefox.exe
Token: SeDebugPrivilege	5716	reaper714_x64-install.exe
Token: SeDebugPrivilege	4796	firefox.exe
Token: SeDebugPrivilege	4796	firefox.exe
Token: SeDebugPrivilege	4796	firefox.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
4796	firefox.exe
4796	firefox.exe
4796	firefox.exe
4796	firefox.exe
3444	keygen.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
4796	firefox.exe
4796	firefox.exe
4796	firefox.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
3444	keygen.exe
4796	firefox.exe
4796	firefox.exe
4796	firefox.exe
4796	firefox.exe
5368	reaper714_x64-install.exe
4796	firefox.exe
4796	firefox.exe
4796	firefox.exe
3444	keygen.exe
3444	keygen.exe
2904	reaper.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4128 wrote to memory of 3444	4128	REAPER_KeyGen.exe	86
PID 4128 wrote to memory of 3444	4128	REAPER_KeyGen.exe	86
PID 4128 wrote to memory of 3444	4128	REAPER_KeyGen.exe	86
PID 1140 wrote to memory of 4796	1140	firefox.exe	101
PID 1140 wrote to memory of 4796	1140	firefox.exe	101
PID 1140 wrote to memory of 4796	1140	firefox.exe	101
PID 1140 wrote to memory of 4796	1140	firefox.exe	101
PID 1140 wrote to memory of 4796	1140	firefox.exe	101
PID 1140 wrote to memory of 4796	1140	firefox.exe	101
PID 1140 wrote to memory of 4796	1140	firefox.exe	101
PID 1140 wrote to memory of 4796	1140	firefox.exe	101
PID 1140 wrote to memory of 4796	1140	firefox.exe	101
PID 1140 wrote to memory of 4796	1140	firefox.exe	101
PID 1140 wrote to memory of 4796	1140	firefox.exe	101
PID 4796 wrote to memory of 1464	4796	firefox.exe	102
PID 4796 wrote to memory of 1464	4796	firefox.exe	102
PID 4796 wrote to memory of 2352	4796	firefox.exe	103
PID 4796 wrote to memory of 2352	4796	firefox.exe	103
PID 4796 wrote to memory of 2352	4796	firefox.exe	103
PID 4796 wrote to memory of 2352	4796	firefox.exe	103
PID 4796 wrote to memory of 2352	4796	firefox.exe	103
PID 4796 wrote to memory of 2352	4796	firefox.exe	103
PID 4796 wrote to memory of 2352	4796	firefox.exe	103
PID 4796 wrote to memory of 2352	4796	firefox.exe	103
PID 4796 wrote to memory of 2352	4796	firefox.exe	103
PID 4796 wrote to memory of 2352	4796	firefox.exe	103
PID 4796 wrote to memory of 2352	4796	firefox.exe	103
PID 4796 wrote to memory of 2352	4796	firefox.exe	103
PID 4796 wrote to memory of 2352	4796	firefox.exe	103
PID 4796 wrote to memory of 2352	4796	firefox.exe	103
PID 4796 wrote to memory of 2352	4796	firefox.exe	103
PID 4796 wrote to memory of 2352	4796	firefox.exe	103
PID 4796 wrote to memory of 2352	4796	firefox.exe	103
PID 4796 wrote to memory of 2352	4796	firefox.exe	103
PID 4796 wrote to memory of 2352	4796	firefox.exe	103
PID 4796 wrote to memory of 2352	4796	firefox.exe	103
PID 4796 wrote to memory of 2352	4796	firefox.exe	103
PID 4796 wrote to memory of 2352	4796	firefox.exe	103
PID 4796 wrote to memory of 2352	4796	firefox.exe	103
PID 4796 wrote to memory of 2352	4796	firefox.exe	103
PID 4796 wrote to memory of 2352	4796	firefox.exe	103
PID 4796 wrote to memory of 2352	4796	firefox.exe	103
PID 4796 wrote to memory of 2352	4796	firefox.exe	103
PID 4796 wrote to memory of 2352	4796	firefox.exe	103
PID 4796 wrote to memory of 2352	4796	firefox.exe	103
PID 4796 wrote to memory of 2352	4796	firefox.exe	103
PID 4796 wrote to memory of 2352	4796	firefox.exe	103
PID 4796 wrote to memory of 2352	4796	firefox.exe	103
PID 4796 wrote to memory of 2352	4796	firefox.exe	103
PID 4796 wrote to memory of 2352	4796	firefox.exe	103
PID 4796 wrote to memory of 2352	4796	firefox.exe	103
PID 4796 wrote to memory of 2352	4796	firefox.exe	103
PID 4796 wrote to memory of 2352	4796	firefox.exe	103
PID 4796 wrote to memory of 2352	4796	firefox.exe	103
PID 4796 wrote to memory of 2352	4796	firefox.exe	103
PID 4796 wrote to memory of 2352	4796	firefox.exe	103
PID 4796 wrote to memory of 2352	4796	firefox.exe	103
PID 4796 wrote to memory of 2352	4796	firefox.exe	103
PID 4796 wrote to memory of 2352	4796	firefox.exe	103
PID 4796 wrote to memory of 2352	4796	firefox.exe	103
PID 4796 wrote to memory of 2352	4796	firefox.exe	103
PID 4796 wrote to memory of 2352	4796	firefox.exe	103
PID 4796 wrote to memory of 2352	4796	firefox.exe	103
PID 4796 wrote to memory of 2352	4796	firefox.exe	103

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\REAPER_KeyGen.exe
"C:\Users\Admin\AppData\Local\Temp\REAPER_KeyGen.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4128
- C:\Users\Admin\AppData\Local\Temp\keygen.exe
  C:\Users\Admin\AppData\Local\Temp\keygen.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:3444

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x398 0x4cc
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2776

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1140
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4796
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4796.0.914852525\1238101974" -parentBuildID 20221007134813 -prefsHandle 1868 -prefMapHandle 1860 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0f1e778d-33f9-4000-b234-9096345e0dbd} 4796 "\\.\pipe\gecko-crash-server-pipe.4796" 1948 1b22baf2b58 gpu
    3⤵
    PID:1464
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4796.1.219373035\485829558" -parentBuildID 20221007134813 -prefsHandle 2340 -prefMapHandle 2336 -prefsLen 20785 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9c2df98b-c79b-4d64-b547-2343c92ceaa9} 4796 "\\.\pipe\gecko-crash-server-pipe.4796" 2348 1b21f270d58 socket
    3⤵
    - Checks processor information in registry
    PID:2352
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4796.2.1730659343\1388542688" -childID 1 -isForBrowser -prefsHandle 3096 -prefMapHandle 2956 -prefsLen 20888 -prefMapSize 233444 -jsInitHandle 1424 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {601b1882-68c1-4895-9738-d6580a512abc} 4796 "\\.\pipe\gecko-crash-server-pipe.4796" 3136 1b22fba1158 tab
    3⤵
    PID:812
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4796.3.43698571\416466470" -childID 2 -isForBrowser -prefsHandle 3564 -prefMapHandle 3560 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1424 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fc74f750-5e83-47df-b347-a60bd1481d21} 4796 "\\.\pipe\gecko-crash-server-pipe.4796" 3424 1b21f267e58 tab
    3⤵
    PID:1848
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4796.4.1098293788\2138944435" -childID 3 -isForBrowser -prefsHandle 4296 -prefMapHandle 4292 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1424 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {821c36e1-664d-44de-9c8f-97ad34d17607} 4796 "\\.\pipe\gecko-crash-server-pipe.4796" 4348 1b2316cb658 tab
    3⤵
    PID:1140
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4796.5.1045285557\1501398535" -childID 4 -isForBrowser -prefsHandle 5188 -prefMapHandle 5192 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1424 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6e5f0d82-48eb-4b2d-b9ef-7c9daf95af2e} 4796 "\\.\pipe\gecko-crash-server-pipe.4796" 5168 1b22e869158 tab
    3⤵
    PID:3552
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4796.6.181684426\1071007611" -childID 5 -isForBrowser -prefsHandle 5200 -prefMapHandle 5184 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1424 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {825577fa-328a-4069-94df-e2fa03ff36e7} 4796 "\\.\pipe\gecko-crash-server-pipe.4796" 5212 1b231e1fe58 tab
    3⤵
    PID:412
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4796.7.426925726\1041231808" -childID 6 -isForBrowser -prefsHandle 5336 -prefMapHandle 5212 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1424 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cd9bfae6-08ad-48f9-af80-17ea69592f65} 4796 "\\.\pipe\gecko-crash-server-pipe.4796" 5324 1b232007258 tab
    3⤵
    PID:1948
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4796.8.1008581011\1198816815" -childID 7 -isForBrowser -prefsHandle 5888 -prefMapHandle 5884 -prefsLen 26285 -prefMapSize 233444 -jsInitHandle 1424 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f6da5d4a-d4e5-443e-b2d4-f7a9f5153751} 4796 "\\.\pipe\gecko-crash-server-pipe.4796" 5872 1b231e05e58 tab
    3⤵
    PID:5644
- - C:\Users\Admin\Downloads\reaper714_x64-install.exe
    "C:\Users\Admin\Downloads\reaper714_x64-install.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:6096
  - - C:\Users\Admin\Downloads\reaper714_x64-install.exe
      "C:\Users\Admin\Downloads\reaper714_x64-install.exe" /SKIP2 /ADMIN /D=C:\Program Files\REAPER (x64)
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Modifies registry class
      Suspicious use of SetWindowsHookEx
      PID:5368
    - - C:\Users\Admin\Downloads\reaper714_x64-install.exe
        
        C:\Users\Admin\Downloads\reaper714_x64-install.exe /UAC:3023E /NCRC /SKIP2 /ADMIN /D=C:\Program Files\REAPER (x64)
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:5716

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5956

C:\Users\Admin\Documents\reaper.exe
"C:\Users\Admin\Documents\reaper.exe"
1⤵
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
PID:2904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\BASSMOD.DLL

Filesize
33KB

MD5
e4ec57e8508c5c4040383ebe6d367928

SHA1
b22bcce36d9fdeae8ab7a7ecc0b01c8176648d06

SHA256
8ad9e47693e292f381da42ddc13724a3063040e51c26f4ca8e1f8e2f1ddd547f

SHA512
77d5cf66caf06e192e668fae2b2594e60a498e8e0ccef5b09b9710721a4cdb0c852d00c446fd32c5b5c85e739de2e73cb1f1f6044879fe7d237341bbb6f27822

Download Submit
C:\Users\Admin\AppData\Local\Temp\R2RRPRKG.dll

Filesize
232KB

MD5
42bd86289f5d56522d73f5b1d14a2300

SHA1
ec577994687bdac4fb5cd237f89583ea87fac5a8

SHA256
f4004b3d39093bd1ea159c285b12c3a94ed110d48f29d4548f4fcb891e6c6530

SHA512
686f9a8538b7603a43bd6266817f4c4d94b8186b5a9ac057bd100691add36253751a5d2455527353d61c3512cdb8658dec01cf490ba05fe36522674653077f57

Download Submit
C:\Users\Admin\AppData\Local\Temp\bgm.xm

Filesize
31KB

MD5
d7bf06611a3eb46e6caa92fa6e5f2103

SHA1
08adad693cc7455cfbbba9a77790a97fe493d5a5

SHA256
c6d3769490a754c5d878e1dc5fc059ce04570c595b573f254c0903db11decdee

SHA512
d915419126d4375c0711d2ca73e2220285558183ef5e4b30768df17c82d4303b754c725a815a003bb6bb3093f9a3ddc1ceccc37236f993e0bd88ca1935b623d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\keygen.exe

Filesize
477KB

MD5
7867ffa49a15b1c1c98fa28f6f4915d5

SHA1
841ab6d9e30f89022129243cf7c15b7ce02b55c3

SHA256
11f7d1889f87bcdb136e2ffcd4d4dc6daddfaeee4c2d418585e11aeabf45afa3

SHA512
a705ef34997ed5a083e0c1436a707da0eeb00ee74da928f397cbd6fe5ef4c17e11f461092ac8cd395752b8a51bbb1d94537d1933c2316eacd1f5a06bba3d2712

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi26DE.tmp\System.dll

Filesize
10KB

MD5
56a321bd011112ec5d8a32b2f6fd3231

SHA1
df20e3a35a1636de64df5290ae5e4e7572447f78

SHA256
bb6df93369b498eaa638b0bcdc4bb89f45e9b02ca12d28bcedf4629ea7f5e0f1

SHA512
5354890cbc53ce51081a78c64ba9c4c8c4dc9e01141798c1e916e19c5776dac7c82989fad0f08c73e81aaba332dad81205f90d0663119af45550b97b338b9cc3

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi26DE.tmp\UAC.dll

Filesize
14KB

MD5
4814167aa1c7ec892e84907094646faa

SHA1
a57a5ecbdfa9a8777a3c587f1acb02b783afc5ee

SHA256
32dd7269abf5a0e5db888e307d9df313e87cef4f1b597965a9d8e00934658822

SHA512
fb1f35e393997ecd2301f371892b59574ee6b666095c3a435336160481f6ef7ed5635c90ce5d2cf88e5ef4a5affb46cb841b7d17e7981bd6e998531193f5d067

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi26DE.tmp\portable.dll

Filesize
24KB

MD5
c9397d267d0d10169c4535f6d5e06a6c

SHA1
2fc5d2e909d56042d32b3fe0a5ae39fc58d110ef

SHA256
25e5a428e663c6b6c352e7eb313d9fd265e944e0f8f88c7406c3fc15d1ad82b6

SHA512
143943d8e02392ef41c2c43641db9d1737a108defb9cd62a3ed3dce800ccbc8f5997f1d0ea4846ae675e3f2b0efbbd9cebd5c5c0022822d10a89a356983440e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\rea82C9.tmp

Filesize
10KB

MD5
d60dc7dea1b8337f0c8e8d72a6079c42

SHA1
c21309b8b8af256e4b656b082c359d7578a7d640

SHA256
884c9413e776feedc2fe25d2bb6e6b1913690233e73089de2312d939b09fae62

SHA512
2560aa4ac39eb18e20fbea313e041f645d31ac631b79ba8314db72ccb3cba159af5295c46b883bbbf3090c1df42ab7e5a4b5b07e7a941fb629d3bc975aa0bcac

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qapp529h.default-release\datareporting\glean\db\data.safe.bin

Filesize
9KB

MD5
ba4a174c173ab380eb6752355a5ee56d

SHA1
24b63669610841d82211845491bf413a3fc9c592

SHA256
0ef5abf96c6393c1dea3faebabdc79dc2b1dfde87c82cc2b24bf954566d417a6

SHA512
c34f41c1be664741f9cfd14c3fe0c56d109c962536de9f35eafd9949858c88b7a676fbb1e2761512569973f29dfad5276367a3f0c7be98ad75d4381c951b0f0d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qapp529h.default-release\datareporting\glean\pending_pings\c147a63f-f659-48a9-b838-8d34394adc7d

Filesize
734B

MD5
39fef7abb0ec42bde1b392c398bd6cc3

SHA1
0ce89e8c7bb7e12f9389763376e96abe41c0760c

SHA256
9af4a8b38b6691129cedcfcfa20ad82ebf4206b9c74f2fa4cbca58c6fc1c3e48

SHA512
6f1c57628e8257e4b1f4afa8a29037cec7cb17c8a9a41c82f9d021a927b1bfd68691763a57130b636c75bf5715efa151eee0fd86790acb922ccd83c9d8e7cc59

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qapp529h.default-release\prefs-1.js

Filesize
6KB

MD5
e96b972400ec95d0dadb8cb8436a8d42

SHA1
ccf055b4e9834909b57ef2bf777b67c58fe9a57d

SHA256
9bb96154ff4782fb885203a6ca5d18db62d8d14f8453f30093b58ca881a4405d

SHA512
05d47fc8ec69e12550c5e47db6feaadd9343da1de1e5df0e8f952401114501af9ce0adeb70c16727f34b54460335269bba011042eb6c1c1cd20a7d9ba998072d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qapp529h.default-release\prefs-1.js

Filesize
6KB

MD5
14753512c59adbae91d9bd4cead8be5e

SHA1
5719cd85e456f7112048e57af4c2f0582232aa19

SHA256
b44e361a9c41d25bf439099c79ea11ef0b31780419e97da8d5787f8b41782a53

SHA512
73438316ff927d5ab300fad2c0ff4f5bfbe031bf97768f899dd1098ce7e19dfbb1116964b6a71cf8e499c3e1100ae57a89dbc795c951040cfdefea564f945e27

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qapp529h.default-release\prefs-1.js

Filesize
6KB

MD5
9b2a327b0c1650aecffa03772d38cef9

SHA1
e758f244ce20d921158f4ca914c65cac45f5c4a0

SHA256
c7525ebb3734ddadfa984b60dc1dd53154584c0aa0521410a98026dead3fee69

SHA512
c5ee1343ebc2b91d15e0367131b4f2643dbc55851b8a5eb0071fd64ff00fc755703505aa808d195f431814264471046701a6e0a4c13896e4a7713b9a65ce0af0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qapp529h.default-release\prefs.js

Filesize
6KB

MD5
70fe86bc58e0e72a21ad9f2ec0917a45

SHA1
a3fbeed6762aac775a1d525446c46abce2fcbcca

SHA256
a79893302e1b429b420f394b5ec5959bc0c63a211a1a70c3749da73c55f69d35

SHA512
2ba4995bdafc8187426daccf30e50a5def1d6d42bd695979eebbab7fe0a67a2f93752bd0d36c81fd921ba71065385b8c93115ea045b43016a70f64f06e6ef8ea

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qapp529h.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
5KB

MD5
3f2d29388f303748e5883449111480e2

SHA1
db8da6391c8d144ea1a3d532a0e9a6c6475c28d1

SHA256
e3df9b32bc7864a49ac8e31d2af2d0b7ba479106c27de993b1ffe5c25d76314b

SHA512
c56c4960ebb75d72a7633f44e3df66da7d8c5f7ce36baff047b20f97eaec879a2ffb1390b3d156e33541b6e08ab139cd52586d6b11cc227a05713a63527d8b3d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qapp529h.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
5KB

MD5
abc58a3f5fc96fc6c9db74b7feb5bf2b

SHA1
a225d84f3e42b693e1dc3c1aa27265c855a772be

SHA256
1a7d51ba9449e4bf7dce7bc4f8d6afea6222950a0160f73eaa439b2b4c8be542

SHA512
a6744a8d0a59267dcd98163a22ebf59a0aa5ab8fcb259d9be9e2e21bbcbcb97feddfb5f9efe0830b3e49569a3b1218c06355f10f4e8c57a8a72f502503c831fe

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qapp529h.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
5KB

MD5
92c9d94ba3126627c5e10a69c79844aa

SHA1
e8c51bb4131fe4beba8a213dc295cd8fe92bc374

SHA256
434788fac80ac1111c5118687b9985e34238b0a414d985809f0f17c8adee62ac

SHA512
38db3d2bc3bafeff1e0862e370a8731cc33549b5f8b452773d326cfccd7fb443789e3481037de33a76c61c9f06d0f96ce782cd6a042cd6cf745bc27c57f6a708

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qapp529h.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
5KB

MD5
24238a116e21bd930888cced7f2fc137

SHA1
267ad4e3660475bf599a4e7b5c5b150706fc3247

SHA256
85fb8c3c911c3e5fefe1caa5c37247e160468300b85ed666df52efd93dbcf4da

SHA512
1558cb9afbee3c3e3d9c095e3a71fa265c7ccbed88a3e5275435db4a38a643451ffe952286a15b9953dcb95aea9f54dadda0aa2193a42beb8bb46d7625dbd66f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qapp529h.default-release\sessionstore.jsonlz4

Filesize
5KB

MD5
bc65af43359766dd5742895bd5bc39c0

SHA1
dcf857badb5960208d3f1d324f8db49aa3beb977

SHA256
d458ce9c33aa8836f9f47e2a173f2b1ba94b5012d8b523b7f1cf12c5a87b9253

SHA512
e27aec92775f9d61dd85d07cb030807d08663727a37282c56868633c1daba256ad5c532fa0782a59878a26f79342f7b0b081ec6e7ffee71450fdb27774b81b2a

Download Submit
C:\Users\Admin\Documents\ColorThemes\Default_7.0.ReaperThemeZip

Filesize
21.2MB

MD5
0e62ac9aef83e216197dc5e0985322c8

SHA1
fbb7afc8497e944b4bb36d3eb5f09bef4ddb4ca3

SHA256
d2bcd3a68ad3b50da10667823c2109749394725876a224881f3b6f9e37fe065c

SHA512
e24940851467f833695ab698e596a9e54a8d16e42a06012da82eaa5e5b9a384d657fd15d23860fc965e3bb8f465f29d356a64fb79113962232b0e126bdf6eefb

Download Submit
C:\Users\Admin\Documents\Data\toolbar_icons\150\toolbar_color_note_pitch.png

Filesize
23KB

MD5
468abb28636485af7bbff18fde3b21fa

SHA1
f596b1e46a5acc1c0640d9a2cfc559caf2925a38

SHA256
56cb9e0a78670b0081ace9a35d18c81b64d1feee12a067d9bde975f6c8457ca2

SHA512
a200f2aee1b47f2f232bcac09990b397820e72ace10c6eb571e094533bc33642fe7de5dd8d7740245dd4b3205003102a609a0c77bd1fb98f256ab1836f2ab1fb

Download Submit
C:\Users\Admin\Documents\Data\toolbar_icons\150\toolbar_color_take_lane.png

Filesize
23KB

MD5
23c319a29bb452fd5c6cfcb3b5f2c101

SHA1
5f47bcc38fe59c88d4c16a3339767495a407e4c8

SHA256
0919bcc1f20063d0a9781a1d6a7dca2cd14b0ddeba5316478043c38942b404f9

SHA512
73d86260f15a3db55f9297541f2527f4c3ea05ebf310d9225f805e184c095c28787b275441eeb5bfff67048de29a7b91108f265387d081b7c6988f07ab7c813e

Download Submit
C:\Users\Admin\Documents\Data\toolbar_icons\150\toolbar_time_selection_item_delete_remove.png

Filesize
23KB

MD5
ad406ecef8afdd03af46267ffe7c466e

SHA1
a8459398eafe41325b38c03521d9f6f0f394fb06

SHA256
1a4a708eb9d2f77b3b10d01248ce2f4cbbd0b7092c2a4d2f5ace360bb19519aa

SHA512
906a6e8c81203ca4994ce2f66e565c1d80a1e30a62a380d8ad9bc8076e45f15b43d9ae2c67922b88f46c8f809447d1385589c9977c7d8ecb974b60d8cc5726c2

Download Submit
C:\Users\Admin\Documents\Data\toolbar_icons\150\toolbar_window_tab_mixer_mcp.png

Filesize
23KB

MD5
d2789c9b6dd96f4e6e7a6d8402727029

SHA1
ad96e565aa5038904d2b3c37d3426113ea8cd4ed

SHA256
dbf46c6c988400a1f25e4a575c07047c33773e97796e3cff714b5754298e260e

SHA512
15408e5359089e7bb6b803238afaa6588c50e1b5b02529dafe926bb7ff44a08d2b76d3349f935d197d1a80f12c208a28a22ccea02c0519d3f5f269210e531426

Download Submit
C:\Users\Admin\Documents\Data\toolbar_icons\200\toolbar_audio_waveform_disk_load.png

Filesize
42KB

MD5
0524f3b0cacb1c64570c5c45ed3ee93a

SHA1
4bf968900d2ff328f7869fc96552823a5f918fcc

SHA256
8f2e23d5c864f5887778267c217c02b3dd6eddc0d6f97e09393cbb5486cf0d72

SHA512
2272863ea890f43010af84db8df2172c0ca1438951f3543b856313e757e9cf02644c484963f2178b837903c4360e0bb8846e813df038b42d7daf24eca2e9bc01

Download Submit
C:\Users\Admin\Documents\Data\track_icons\room_large.png

Filesize
16KB

MD5
bd8ba042fe7e03622c11dc9b3ff8218d

SHA1
1f12594db2bd76219c3e1cdce6aaa771516ed199

SHA256
6f6368a80ae186918208234298296e4551cc2a7d0468930c49ea3a45c19a9449

SHA512
24bd3fb737acab5e8becc2f95af83dbea0163da702a2d10b343236f4679a4bc4c4ea55d1c3512faf77b128e3091e8d99f963a9192f29d4c97581c73ce29a44fb

Download Submit
C:\Users\Admin\Documents\Plugins\FX\reacast.dll

Filesize
418KB

MD5
12cc432e707dbb3846c79c85bf616719

SHA1
66c2cd0d827b6d6149b842d3ed64e6b83d985993

SHA256
59a10f8f4e068c2368c5803fb8070eb3b1408106ebdc18b4110ed38761c26438

SHA512
21f53487c9b408a1195cd801b29aae1197d01218fc5bb5ccb73a6b120faa23c5fe63e528bc674dd6f770667f41109214bd923d5962a9287fbd1fda18e9a9431b

Download Submit
C:\Users\Admin\Documents\Plugins\FX\reacomp.dll

Filesize
333KB

MD5
a9fdb78898b9667c6d935d739e9414b4

SHA1
808ba063359d2ca7830929f03cd66dfa510f91ac

SHA256
af4dbcf1c75453046335235a1ac3eb7c12bb988daf18d674f24adf1ec61b1266

SHA512
7e1d4f9f5199f3aa0bd2b6bd31c2d3a52e201d0edfc742e4dd7ca7963b30d19e64cdfdf3dc069608f99fac895905acd306603c31f8ae90a4a453d90e1d0e0370

Download Submit
C:\Users\Admin\Documents\Plugins\FX\reacontrolmidi.dll

Filesize
375KB

MD5
7fb00dcbf1c05679cc2684149067fcd1

SHA1
1851a086c9718efa24dd7127f7429eea68efae3e

SHA256
062bb15aa0e775591b19a02b7e34cf4c4cb89a122c68839ae9aa9bb63dcd25fd

SHA512
dc308219fa2c7c3a49e20bf5acd803d5dfec57cd731ba646f1336bd7121d917c920d98472bf800e752145b256e18aefcad846e49044379c64dab4bc3ce9e3766

Download Submit
C:\Users\Admin\Documents\Plugins\FX\readelay.dll

Filesize
292KB

MD5
01117c13ff17b8e32ab5ccff45e280c7

SHA1
158415bf8e1e38f045fa4476bc069f5da638571d

SHA256
9bba281e150abab2b48bf906d352a58b53ff7436846790f011ece15932e97790

SHA512
52779977bc9f3f92de83ae9e6095050a7cf1010e0deb13c96b67c03b4e06fe7f6ec889614dd3ee43f9854df06e9ca47e918ba5cc9fce370af8399df7e8a1244c

Download Submit
C:\Users\Admin\Documents\Plugins\FX\reaeq.dll

Filesize
476KB

MD5
571bb5752e8759d4622a5f0064dc232e

SHA1
6adf108e20336cc4d80fa39d4a487c039380fab7

SHA256
c5b593691b4b5fa688cc97bb6a2451647a0c9a346666e87eedd8e1b4f981d127

SHA512
5c98c488fcad296bb77a687334108570991d0286c2f05a0da054709b27b8eaae6fc4a7c38711bfe410aab8c6f7a20f05d57cb1258e640cd1091619bded16f619

Download Submit
C:\Users\Admin\Documents\Plugins\FX\reafir.dll

Filesize
388KB

MD5
d0b0533b6c5673e4e6da48061e43fc62

SHA1
d4325ca3ce71f7de74021f0125490ec0bad82e9f

SHA256
5beb5d78c2e5284d7a9114f9ad3621d549e6883cb956713178df796e7d570144

SHA512
013e84aa1081ae65eb92154b4fa1475d5e6ba70b869a8a413d3e221eb31479c30352b69ce5c90af03985507fcc2e8d6c7e271963742ff00bdd3843151cc7eb71

Download Submit
C:\Users\Admin\Documents\Plugins\FX\reagate.dll

Filesize
291KB

MD5
9265622011ac1650263a5f1b90e2a1bd

SHA1
d8cc6be9e164eadb241204efe37fa213492fdf08

SHA256
95c1425db70c11560eebaf26a5bc8146ff9dff0370ead4fa4ab9e15e9cb6b2d4

SHA512
fe9d14c290953e0c3dfca1e03f017dccf40b97590da0983c4d77f17eb57972ea1c05e8634022ca352f1e9068c167901ed02d0dcd0f69972c8027595192c4cfc7

Download Submit
C:\Users\Admin\Documents\Plugins\FX\reainsert.dll

Filesize
289KB

MD5
8ed4d73bc91946e7cd4449fa96d50704

SHA1
83605c8d0271ed38b9046c38b12c4bf26751e57a

SHA256
85eacc60f8bb0a4d3b06dae2547ef33b3a00c1d27284eeaf4c09565704642f64

SHA512
af0068164d59790d6498558e8ca9a5630f25cdf32f013ab374e3f4c203030f19f22f57bbf55d73fc20af526255ecd058e70f8e192cc6e75f4a5669d0bbce6fbb

Download Submit
C:\Users\Admin\Documents\Plugins\FX\realimit.dll

Filesize
368KB

MD5
87e7c91b2a5a04f66890ac6c4f968372

SHA1
32b1ad52ac043a0b66f4d6ab0ebdd0f52478130c

SHA256
cbdc46f3005cda4d44a8e9115ac78efc9075084337389bece5aa448c3bbcb2ed

SHA512
74769f8f8e6df4255a2e46381ea1a4a8702564061b173c44bd393ac1d251c5d8e5454de5fb2b9c7c7a2e42db5fc04ec2f3946fd86395cfda607b8cf234ec171c

Download Submit
C:\Users\Admin\Documents\Plugins\FX\reaninjam.dll

Filesize
571KB

MD5
fa4f0a30d77f0b3fefb2cbc1146c7b9f

SHA1
83b9ff522ece3d948ef934ba0a027fdd7b4c709b

SHA256
a2997a23341cf23008972c4eff3b6f09b8e9e3250c4720fc75c0e9ae922866a7

SHA512
a524441b953af16ed05617f898777de6b90be68e4afbf97fa118239cddff78c1f462bf02c8db346e57e1cf4f40683f499a36c8eda15529927e279f9a8f1479bc

Download Submit
C:\Users\Admin\Documents\Plugins\libmp3lame.dll

Filesize
888KB

MD5
8a97f72006cfa350e01aaac3b593ae4b

SHA1
02a77355dce753a8766bab37656cfaf536ffd485

SHA256
7f84c9d16ea406b940392180d0e6f7426f3461a71029bb82ea6719aeee613670

SHA512
1a63145bf15e34b6ac3e6c892280b2fd459736d4923f88ae7c0b2b74ef1502f7468010ea8d782e0e271d45aca38224a82b7aa92eca4568853cd6d3dde751696f

Download Submit
C:\Users\Admin\Documents\REAPER.ini

Filesize
23B

MD5
534ed690a365f671259a9ce7d2a8a910

SHA1
14ebb3a3b065f4c7f574726480e036e0c2f8beb1

SHA256
74fa69e7b0329ae4af0f9893df5388030208a8c360073608641fbcd8bd4de28a

SHA512
e5273745086967ce23d94b8ccbdf96703c3abce11a83b2674db52d11607c49bb91637911d71fc74ab60409dcb4d131271c54a266f2aeb96f7ec0fbaf4b409be7

Download Submit
C:\Users\Admin\Documents\REAPER5.dll

Filesize
3KB

MD5
83a4486739b224487c2bc2f37fa9d87e

SHA1
afeb9c4992c2dfae3095e831704d04e3f66304dc

SHA256
fb28e25e507880d596ae8d4b210c6df6719283e610c24bf27d7b09ca7a12d469

SHA512
89fad9a63cb475ab647838a97464e1cd42904d0cc22fd62404a8a5fabbef6b9f16a7919445f55d120a2ba4e2456472cb43e1e624cb849d315af9bc6a69a54ab3

Download Submit
C:\Users\Admin\Documents\Scripts\Cockos\Default_6.0_theme_adjuster_images\[email protected]

Filesize
65KB

MD5
a55fdeed83f64e4b3a4af73b52d2f3d6

SHA1
ea3be498a1a87616f7b0e4dfefa6fe45706970e9

SHA256
91a64bc8730949624af0b6916d380c4a3be0901ad6dbe10797cb9bd16516541a

SHA512
f1f036a4ed1b6aff65e7182d3c341a7f6e2af038094399cbc27a43949920866cdb24180a8a61728f93353f0983c37bad2881ee52dc0b6c73691927f3345e5c67

Download Submit
C:\Users\Admin\Documents\Scripts\Cockos\Default_6.0_theme_adjuster_images\[email protected]

Filesize
95KB

MD5
1dea3c1552cfa296632626316f81cfe1

SHA1
451bc22d77c120f98a15bb1b7f0c979c6f661a36

SHA256
8ec8a207170d8b57697bc718e96df66ba570d5d105c1e74c0dae4aa8a991a9a6

SHA512
6f1c3dc429c914d85c06b903f2987c9d685947a8da58e0e2310e448b792ac591bf9728b425ef30f3b02a13eb38b013f2fe645a08dd7a556b03073e8ac7f1d1b4

Download Submit
C:\Users\Admin\Documents\Scripts\Cockos\Default_6.0_theme_adjuster_images\[email protected]

Filesize
42KB

MD5
b41d9eab199b13e33786992d256fc5cf

SHA1
865770a7f2ea23e2d413afb478e56bdc8397af4f

SHA256
9e895169189004dd4bc522fc06e0520c3be84e2d83fcee07be3820e81f9596be

SHA512
16363d5a4b13ee8c1a6d06ca3564aab057156a3771b062fce558bfb6d670b885a8a7d41c737d8035f54319ba27b50b2b4d6f0aa59f882caad54d0a5a2d3e08fb

Download Submit
C:\Users\Admin\Documents\reaper-license.rk

Filesize
363B

MD5
9b6d64d89698e3aebcc40d4982363106

SHA1
a588e87a75cf97b92716d65fcbbf1e183c999402

SHA256
196b80306189c333c27fcc90762087fcf7ce737cd86c3789e399cb4de73c042b

SHA512
9ec7c51874b98e7663b9d87718889f0e7cedbed7eb5ee9139a9a2c699cce53d20f3ab623d3fe3bc52b7ea08df5eedbe928ad3e6432dc2cae4332d1d72d7a6b71

Download Submit
C:\Users\Admin\Documents\reaper-mouse.ini

Filesize
544B

MD5
baccefe3cffebe31c6955eb57141a9fc

SHA1
98f9127c8ffc09630a95749f46ae57abbfa4e871

SHA256
486c6d9144d2f9ac2bc5948a24b89394d28fc826cc63f9d2406926723f162249

SHA512
df34152715a92a38528d59e5df532771811b299590afbd52e972232af38d526c9d26a1f8a7ad073981965e328f1fad499a870bbb7dcf2b04cecf016de452cd0e

Download Submit
C:\Users\Admin\Documents\reaper.exe

Filesize
15.9MB

MD5
1ebb849057c0e6100fec0f5c1ffc5f17

SHA1
812f8b26c8099cbabde2a6b2b2ff8dd1d9b07bd5

SHA256
b6f70d9380b38aa165be2f911dfbe89f2d27ce29bca5c18fcc2cb55071921344

SHA512
3b79d5d689a31e06db168f417116043a95e08a64a3c01c734ab93355dc8a12af8c9fb8ee7995da7723e8b610e2422285c85f5b0c17387c4f7659079dc8d98c45

Download Submit
C:\Users\Admin\Documents\reaper.exe

Filesize
15.9MB

MD5
25b2180bbeb7f27eed4a896befd66371

SHA1
9f07b841d5ecc48b87e4d9319de5b061858d42fb

SHA256
f63716b5eb38cccc145aa6143fdfca8b58adcb788446d0db41fc7444584be26b

SHA512
47ede6bb038a0e9481bd9d54afb099e171c0a0a1d717a99ace5c82f180c340327a9b605be567ca4499741f699734cb0aba682c42ca663cc5d0b7dca3276d2677

Download Submit
C:\Users\Admin\Documents\reaper.ini

Filesize
46B

MD5
74492e56819b821fc830b3958d007b6d

SHA1
f7cc111c29e6edec590767eca84a536ab71c3f6b

SHA256
3eb8b23a45983f6919d91bd57c5529f0f607a6d9866aeb98dec44a1236118f90

SHA512
0fea0c4f031bb517a67f895e9c90640f0d7cc648af7c522838994b6b3a86f49f871668f7fef2afa8cd45a9a39a0d9d6db2f3eb9ba7852e79b499fee1d6aff896

Download Submit
C:\Users\Admin\Documents\reaper.ini

Filesize
60B

MD5
a262f20bb21b1ce112d7d0addcbafe9f

SHA1
8afc49f216d648830537908bb965de9fc34809d9

SHA256
33c2a5733c8e212a4db488df4286d8c81f903847876f3784e5c6040ce0f4028f

SHA512
65c688b6848334dd9a9ee082102bd60d62cd5ae6b9019f2529f5cdbc4b973d5bab6827ebde99ed6e23bb31772caff3a4ad7e0349eeb0db153b5b1e88de2bccc7

Download Submit
C:\Users\Admin\Downloads\reaper714_x64-install.exe

Filesize
14.9MB

MD5
2d00754f44c07a3241059e43be8dc6c6

SHA1
8419d033f6d5d483a7fafe1df69c029856c3c920

SHA256
2a29407a012be17087edc4de06d1c4ae96f72ae52097aaa98bc2707d7d7624c7

SHA512
1a8efcc2c357fc6b32ac03af7ac0dbb5e34b79e799f9b7f11ff89bdf1ffa2e763bb4a636740cc2426e592a50ea102d9ae33aefd7ca32d1945107722a7a0eb5af

Download Submit
memory/2904-3095-0x00000000085A0000-0x0000000008610000-memory.dmp

Filesize
448KB

Download
memory/2904-3163-0x00000000085A0000-0x00000000085F0000-memory.dmp

Filesize
320KB

Download
memory/2904-3126-0x00000000085A0000-0x00000000085F1000-memory.dmp

Filesize
324KB

Download
memory/2904-3135-0x00000000085A0000-0x000000000861F000-memory.dmp

Filesize
508KB

Download
memory/2904-3154-0x00000000085A0000-0x00000000085F1000-memory.dmp

Filesize
324KB

Download
memory/2904-3193-0x00000000085A0000-0x0000000008611000-memory.dmp

Filesize
452KB

Download
memory/2904-3205-0x00000000085A0000-0x0000000008609000-memory.dmp

Filesize
420KB

Download
memory/2904-3227-0x00000000085A0000-0x00000000085FB000-memory.dmp

Filesize
364KB

Download
memory/2904-3239-0x00000000085A0000-0x00000000085FE000-memory.dmp

Filesize
376KB

Download
memory/2904-3251-0x00000000085A0000-0x00000000085EA000-memory.dmp

Filesize
296KB

Download
memory/2904-3263-0x00000000085A0000-0x00000000085EA000-memory.dmp

Filesize
296KB

Download
memory/2904-3276-0x0000000008690000-0x00000000087DE000-memory.dmp

Filesize
1.3MB

Download
memory/2904-3269-0x00000000085A0000-0x000000000861B000-memory.dmp

Filesize
492KB

Download
memory/2904-3257-0x00000000085A0000-0x00000000085E5000-memory.dmp

Filesize
276KB

Download
memory/2904-2607-0x0000000140000000-0x00000001410C7000-memory.dmp

Filesize
16.8MB

Download
memory/2904-2608-0x0000000180000000-0x0000000180007000-memory.dmp

Filesize
28KB

Download
memory/2904-3245-0x00000000085A0000-0x0000000008632000-memory.dmp

Filesize
584KB

Download
memory/2904-3233-0x00000000085A0000-0x00000000085E8000-memory.dmp

Filesize
288KB

Download
memory/2904-3211-0x00000000085A0000-0x000000000864B000-memory.dmp

Filesize
684KB

Download
memory/2904-3199-0x00000000085A0000-0x0000000008622000-memory.dmp

Filesize
520KB

Download
memory/2904-3187-0x00000000085A0000-0x00000000085F0000-memory.dmp

Filesize
320KB

Download
memory/2904-3181-0x00000000085A0000-0x0000000008637000-memory.dmp

Filesize
604KB

Download
memory/2904-3106-0x00000000085A0000-0x00000000085FA000-memory.dmp

Filesize
360KB

Download
memory/2904-3172-0x00000000085A0000-0x0000000008603000-memory.dmp

Filesize
396KB

Download
memory/2904-3145-0x00000000085A0000-0x0000000008627000-memory.dmp

Filesize
540KB

Download
memory/2904-3115-0x00000000085A0000-0x0000000008605000-memory.dmp

Filesize
404KB

Download
memory/3444-229-0x0000000002210000-0x00000000022AB000-memory.dmp

Filesize
620KB

Download
memory/3444-2597-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/3444-14-0x0000000002210000-0x00000000022AB000-memory.dmp

Filesize
620KB

Download
memory/3444-339-0x0000000002210000-0x00000000022AB000-memory.dmp

Filesize
620KB

Download
memory/3444-120-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/3444-17-0x0000000002210000-0x00000000022AB000-memory.dmp

Filesize
620KB

Download
memory/3444-338-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/3444-18-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/3444-299-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/3444-347-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/3444-20-0x0000000002210000-0x00000000022AB000-memory.dmp

Filesize
620KB

Download
memory/3444-19-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/3444-349-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/3444-271-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/3444-16-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/3444-336-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/3444-228-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/3444-2598-0x0000000002210000-0x00000000022AB000-memory.dmp

Filesize
620KB

Download
memory/3444-2599-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/3444-2591-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/3444-21-0x0000000002210000-0x00000000022AB000-memory.dmp

Filesize
620KB

Download
memory/3444-334-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/3444-332-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/3444-283-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/3444-94-0x0000000002210000-0x00000000022AB000-memory.dmp

Filesize
620KB

Download
memory/3444-308-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/3444-2497-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/3444-174-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/3444-12-0x0000000002210000-0x00000000022AB000-memory.dmp

Filesize
620KB

Download
memory/3444-10-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/3444-306-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download