Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
298s -
max time network
287s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
10/04/2024, 03:19
Static task
static1
Behavioral task
behavioral1
Sample
REAPER_KeyGen.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral2
Sample
$TEMP/BASSMOD.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
$TEMP/R2RRPRKG.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral4
Sample
$TEMP/keygen.exe
Resource
win10v2004-20240226-en
General
-
Target
REAPER_KeyGen.exe
-
Size
688KB
-
MD5
fd5a3b2e2933ea1151d71f9cefc9fbcf
-
SHA1
8c7596bc39e7945ac58396102386f77db6dda4be
-
SHA256
2a22be4c7e3a17d6a408b0c0547cc181e148ab20c2e3f048791b421280686544
-
SHA512
3299c6534b2a09158c3decdec536e4296c2a2a31f32edfb5da1de413036a0f9475549ad14a7b891c0e413839f1dbaf03e1bb75b576e545e6a4138650b3533a30
-
SSDEEP
12288:sc9t2SllULgBqjW0PPdH5DVIXKGE6/gBQpoZmp2FTV0RY5wmm64a:scLyLBW0VHpag2KZmp2F2Rd64a
Malware Config
Signatures
-
Downloads MZ/PE file
-
Executes dropped EXE 5 IoCs
pid Process 3444 keygen.exe 6096 reaper714_x64-install.exe 5368 reaper714_x64-install.exe 5716 reaper714_x64-install.exe 2904 reaper.exe -
Identifies Wine through registry keys 2 TTPs 2 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\MACHINE\Software\Wine reaper.exe Key opened \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Software\Wine reaper.exe -
Loads dropped DLL 64 IoCs
pid Process 3444 keygen.exe 3444 keygen.exe 3444 keygen.exe 6096 reaper714_x64-install.exe 6096 reaper714_x64-install.exe 6096 reaper714_x64-install.exe 6096 reaper714_x64-install.exe 6096 reaper714_x64-install.exe 5368 reaper714_x64-install.exe 5716 reaper714_x64-install.exe 5368 reaper714_x64-install.exe 5368 reaper714_x64-install.exe 5368 reaper714_x64-install.exe 5368 reaper714_x64-install.exe 2904 reaper.exe 2904 reaper.exe 2904 reaper.exe 2904 reaper.exe 2904 reaper.exe 2904 reaper.exe 2904 reaper.exe 2904 reaper.exe 2904 reaper.exe 2904 reaper.exe 2904 reaper.exe 2904 reaper.exe 2904 reaper.exe 2904 reaper.exe 2904 reaper.exe 2904 reaper.exe 2904 reaper.exe 2904 reaper.exe 2904 reaper.exe 2904 reaper.exe 2904 reaper.exe 2904 reaper.exe 2904 reaper.exe 2904 reaper.exe 2904 reaper.exe 2904 reaper.exe 2904 reaper.exe 2904 reaper.exe 2904 reaper.exe 2904 reaper.exe 2904 reaper.exe 2904 reaper.exe 2904 reaper.exe 2904 reaper.exe 2904 reaper.exe 2904 reaper.exe 2904 reaper.exe 2904 reaper.exe 2904 reaper.exe 2904 reaper.exe 2904 reaper.exe 2904 reaper.exe 2904 reaper.exe 2904 reaper.exe 2904 reaper.exe 2904 reaper.exe 2904 reaper.exe 2904 reaper.exe 2904 reaper.exe 2904 reaper.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
NSIS installer 2 IoCs
resource yara_rule behavioral1/files/0x000c00000002323e-203.dat nsis_installer_1 behavioral1/files/0x000c00000002323e-203.dat nsis_installer_2 -
Checks processor information in registry 2 TTPs 10 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor reaper.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor reaper.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe -
Modifies registry class 60 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 keygen.exe Set value (int) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1" keygen.exe Set value (int) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4" keygen.exe Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags keygen.exe Set value (int) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4" keygen.exe Set value (int) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1" keygen.exe Set value (int) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16" keygen.exe Set value (data) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 keygen.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ keygen.exe Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg keygen.exe Set value (int) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0" keygen.exe Set value (int) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" keygen.exe Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ reaper714_x64-install.exe Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 keygen.exe Set value (data) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0000000001000000ffffffff keygen.exe Set value (data) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 keygen.exe Set value (data) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 keygen.exe Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2 keygen.exe Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8 keygen.exe Set value (int) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" keygen.exe Set value (data) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 keygen.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ reaper714_x64-install.exe Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\Shell keygen.exe Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg keygen.exe Set value (int) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" keygen.exe Set value (int) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1" keygen.exe Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings keygen.exe Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 keygen.exe Set value (data) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000 keygen.exe Set value (data) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff keygen.exe Set value (str) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents" keygen.exe Set value (data) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202020202 keygen.exe Set value (data) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202020202 keygen.exe Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 keygen.exe Set value (data) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff keygen.exe Set value (int) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1" keygen.exe Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell keygen.exe Set value (int) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0" keygen.exe Set value (data) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff keygen.exe Set value (int) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257" keygen.exe Set value (int) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1" keygen.exe Set value (int) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257" keygen.exe Set value (int) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16" keygen.exe Set value (str) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" keygen.exe Set value (data) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2 = 3a002e803accbfb42cdb4c42b0297fe99a87c641260001002600efbe11000000230bd29ecc68da01e2fcada1cc68da01cffd34a3cc68da0114000000 keygen.exe Set value (data) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 020000000000000001000000ffffffff keygen.exe Set value (data) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\MRUListEx = ffffffff keygen.exe Set value (str) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" keygen.exe Set value (data) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff keygen.exe Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ keygen.exe Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656} keygen.exe Set value (int) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\NodeSlot = "8" keygen.exe Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} keygen.exe Set value (int) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1" keygen.exe Set value (data) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 keygen.exe Set value (data) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff keygen.exe Set value (str) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\Shell\SniffedFolderType = "Generic" keygen.exe Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell keygen.exe Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU keygen.exe Set value (data) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots keygen.exe -
NTFS ADS 1 IoCs
description ioc Process File created C:\Users\Admin\Downloads\reaper714_x64-install.exe:Zone.Identifier firefox.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3444 keygen.exe 3444 keygen.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: 33 2776 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 2776 AUDIODG.EXE Token: SeDebugPrivilege 4796 firefox.exe Token: SeDebugPrivilege 4796 firefox.exe Token: SeDebugPrivilege 5716 reaper714_x64-install.exe Token: SeDebugPrivilege 4796 firefox.exe Token: SeDebugPrivilege 4796 firefox.exe Token: SeDebugPrivilege 4796 firefox.exe -
Suspicious use of FindShellTrayWindow 5 IoCs
pid Process 4796 firefox.exe 4796 firefox.exe 4796 firefox.exe 4796 firefox.exe 3444 keygen.exe -
Suspicious use of SendNotifyMessage 3 IoCs
pid Process 4796 firefox.exe 4796 firefox.exe 4796 firefox.exe -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 3444 keygen.exe 4796 firefox.exe 4796 firefox.exe 4796 firefox.exe 4796 firefox.exe 5368 reaper714_x64-install.exe 4796 firefox.exe 4796 firefox.exe 4796 firefox.exe 3444 keygen.exe 3444 keygen.exe 2904 reaper.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4128 wrote to memory of 3444 4128 REAPER_KeyGen.exe 86 PID 4128 wrote to memory of 3444 4128 REAPER_KeyGen.exe 86 PID 4128 wrote to memory of 3444 4128 REAPER_KeyGen.exe 86 PID 1140 wrote to memory of 4796 1140 firefox.exe 101 PID 1140 wrote to memory of 4796 1140 firefox.exe 101 PID 1140 wrote to memory of 4796 1140 firefox.exe 101 PID 1140 wrote to memory of 4796 1140 firefox.exe 101 PID 1140 wrote to memory of 4796 1140 firefox.exe 101 PID 1140 wrote to memory of 4796 1140 firefox.exe 101 PID 1140 wrote to memory of 4796 1140 firefox.exe 101 PID 1140 wrote to memory of 4796 1140 firefox.exe 101 PID 1140 wrote to memory of 4796 1140 firefox.exe 101 PID 1140 wrote to memory of 4796 1140 firefox.exe 101 PID 1140 wrote to memory of 4796 1140 firefox.exe 101 PID 4796 wrote to memory of 1464 4796 firefox.exe 102 PID 4796 wrote to memory of 1464 4796 firefox.exe 102 PID 4796 wrote to memory of 2352 4796 firefox.exe 103 PID 4796 wrote to memory of 2352 4796 firefox.exe 103 PID 4796 wrote to memory of 2352 4796 firefox.exe 103 PID 4796 wrote to memory of 2352 4796 firefox.exe 103 PID 4796 wrote to memory of 2352 4796 firefox.exe 103 PID 4796 wrote to memory of 2352 4796 firefox.exe 103 PID 4796 wrote to memory of 2352 4796 firefox.exe 103 PID 4796 wrote to memory of 2352 4796 firefox.exe 103 PID 4796 wrote to memory of 2352 4796 firefox.exe 103 PID 4796 wrote to memory of 2352 4796 firefox.exe 103 PID 4796 wrote to memory of 2352 4796 firefox.exe 103 PID 4796 wrote to memory of 2352 4796 firefox.exe 103 PID 4796 wrote to memory of 2352 4796 firefox.exe 103 PID 4796 wrote to memory of 2352 4796 firefox.exe 103 PID 4796 wrote to memory of 2352 4796 firefox.exe 103 PID 4796 wrote to memory of 2352 4796 firefox.exe 103 PID 4796 wrote to memory of 2352 4796 firefox.exe 103 PID 4796 wrote to memory of 2352 4796 firefox.exe 103 PID 4796 wrote to memory of 2352 4796 firefox.exe 103 PID 4796 wrote to memory of 2352 4796 firefox.exe 103 PID 4796 wrote to memory of 2352 4796 firefox.exe 103 PID 4796 wrote to memory of 2352 4796 firefox.exe 103 PID 4796 wrote to memory of 2352 4796 firefox.exe 103 PID 4796 wrote to memory of 2352 4796 firefox.exe 103 PID 4796 wrote to memory of 2352 4796 firefox.exe 103 PID 4796 wrote to memory of 2352 4796 firefox.exe 103 PID 4796 wrote to memory of 2352 4796 firefox.exe 103 PID 4796 wrote to memory of 2352 4796 firefox.exe 103 PID 4796 wrote to memory of 2352 4796 firefox.exe 103 PID 4796 wrote to memory of 2352 4796 firefox.exe 103 PID 4796 wrote to memory of 2352 4796 firefox.exe 103 PID 4796 wrote to memory of 2352 4796 firefox.exe 103 PID 4796 wrote to memory of 2352 4796 firefox.exe 103 PID 4796 wrote to memory of 2352 4796 firefox.exe 103 PID 4796 wrote to memory of 2352 4796 firefox.exe 103 PID 4796 wrote to memory of 2352 4796 firefox.exe 103 PID 4796 wrote to memory of 2352 4796 firefox.exe 103 PID 4796 wrote to memory of 2352 4796 firefox.exe 103 PID 4796 wrote to memory of 2352 4796 firefox.exe 103 PID 4796 wrote to memory of 2352 4796 firefox.exe 103 PID 4796 wrote to memory of 2352 4796 firefox.exe 103 PID 4796 wrote to memory of 2352 4796 firefox.exe 103 PID 4796 wrote to memory of 2352 4796 firefox.exe 103 PID 4796 wrote to memory of 2352 4796 firefox.exe 103 PID 4796 wrote to memory of 2352 4796 firefox.exe 103 PID 4796 wrote to memory of 2352 4796 firefox.exe 103 PID 4796 wrote to memory of 2352 4796 firefox.exe 103 PID 4796 wrote to memory of 2352 4796 firefox.exe 103 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\REAPER_KeyGen.exe"C:\Users\Admin\AppData\Local\Temp\REAPER_KeyGen.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\Users\Admin\AppData\Local\Temp\keygen.exeC:\Users\Admin\AppData\Local\Temp\keygen.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3444
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x398 0x4cc1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2776
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1140 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Checks processor information in registry
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4796.0.914852525\1238101974" -parentBuildID 20221007134813 -prefsHandle 1868 -prefMapHandle 1860 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0f1e778d-33f9-4000-b234-9096345e0dbd} 4796 "\\.\pipe\gecko-crash-server-pipe.4796" 1948 1b22baf2b58 gpu3⤵PID:1464
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4796.1.219373035\485829558" -parentBuildID 20221007134813 -prefsHandle 2340 -prefMapHandle 2336 -prefsLen 20785 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9c2df98b-c79b-4d64-b547-2343c92ceaa9} 4796 "\\.\pipe\gecko-crash-server-pipe.4796" 2348 1b21f270d58 socket3⤵
- Checks processor information in registry
PID:2352
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4796.2.1730659343\1388542688" -childID 1 -isForBrowser -prefsHandle 3096 -prefMapHandle 2956 -prefsLen 20888 -prefMapSize 233444 -jsInitHandle 1424 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {601b1882-68c1-4895-9738-d6580a512abc} 4796 "\\.\pipe\gecko-crash-server-pipe.4796" 3136 1b22fba1158 tab3⤵PID:812
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4796.3.43698571\416466470" -childID 2 -isForBrowser -prefsHandle 3564 -prefMapHandle 3560 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1424 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fc74f750-5e83-47df-b347-a60bd1481d21} 4796 "\\.\pipe\gecko-crash-server-pipe.4796" 3424 1b21f267e58 tab3⤵PID:1848
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4796.4.1098293788\2138944435" -childID 3 -isForBrowser -prefsHandle 4296 -prefMapHandle 4292 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1424 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {821c36e1-664d-44de-9c8f-97ad34d17607} 4796 "\\.\pipe\gecko-crash-server-pipe.4796" 4348 1b2316cb658 tab3⤵PID:1140
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4796.5.1045285557\1501398535" -childID 4 -isForBrowser -prefsHandle 5188 -prefMapHandle 5192 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1424 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6e5f0d82-48eb-4b2d-b9ef-7c9daf95af2e} 4796 "\\.\pipe\gecko-crash-server-pipe.4796" 5168 1b22e869158 tab3⤵PID:3552
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4796.6.181684426\1071007611" -childID 5 -isForBrowser -prefsHandle 5200 -prefMapHandle 5184 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1424 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {825577fa-328a-4069-94df-e2fa03ff36e7} 4796 "\\.\pipe\gecko-crash-server-pipe.4796" 5212 1b231e1fe58 tab3⤵PID:412
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4796.7.426925726\1041231808" -childID 6 -isForBrowser -prefsHandle 5336 -prefMapHandle 5212 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1424 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cd9bfae6-08ad-48f9-af80-17ea69592f65} 4796 "\\.\pipe\gecko-crash-server-pipe.4796" 5324 1b232007258 tab3⤵PID:1948
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4796.8.1008581011\1198816815" -childID 7 -isForBrowser -prefsHandle 5888 -prefMapHandle 5884 -prefsLen 26285 -prefMapSize 233444 -jsInitHandle 1424 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f6da5d4a-d4e5-443e-b2d4-f7a9f5153751} 4796 "\\.\pipe\gecko-crash-server-pipe.4796" 5872 1b231e05e58 tab3⤵PID:5644
-
-
C:\Users\Admin\Downloads\reaper714_x64-install.exe"C:\Users\Admin\Downloads\reaper714_x64-install.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:6096 -
C:\Users\Admin\Downloads\reaper714_x64-install.exe"C:\Users\Admin\Downloads\reaper714_x64-install.exe" /SKIP2 /ADMIN /D=C:\Program Files\REAPER (x64)4⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5368 -
C:\Users\Admin\Downloads\reaper714_x64-install.exeC:\Users\Admin\Downloads\reaper714_x64-install.exe /UAC:3023E /NCRC /SKIP2 /ADMIN /D=C:\Program Files\REAPER (x64)5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:5716
-
-
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:5956
-
C:\Users\Admin\Documents\reaper.exe"C:\Users\Admin\Documents\reaper.exe"1⤵
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
PID:2904
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
33KB
MD5e4ec57e8508c5c4040383ebe6d367928
SHA1b22bcce36d9fdeae8ab7a7ecc0b01c8176648d06
SHA2568ad9e47693e292f381da42ddc13724a3063040e51c26f4ca8e1f8e2f1ddd547f
SHA51277d5cf66caf06e192e668fae2b2594e60a498e8e0ccef5b09b9710721a4cdb0c852d00c446fd32c5b5c85e739de2e73cb1f1f6044879fe7d237341bbb6f27822
-
Filesize
232KB
MD542bd86289f5d56522d73f5b1d14a2300
SHA1ec577994687bdac4fb5cd237f89583ea87fac5a8
SHA256f4004b3d39093bd1ea159c285b12c3a94ed110d48f29d4548f4fcb891e6c6530
SHA512686f9a8538b7603a43bd6266817f4c4d94b8186b5a9ac057bd100691add36253751a5d2455527353d61c3512cdb8658dec01cf490ba05fe36522674653077f57
-
Filesize
31KB
MD5d7bf06611a3eb46e6caa92fa6e5f2103
SHA108adad693cc7455cfbbba9a77790a97fe493d5a5
SHA256c6d3769490a754c5d878e1dc5fc059ce04570c595b573f254c0903db11decdee
SHA512d915419126d4375c0711d2ca73e2220285558183ef5e4b30768df17c82d4303b754c725a815a003bb6bb3093f9a3ddc1ceccc37236f993e0bd88ca1935b623d4
-
Filesize
477KB
MD57867ffa49a15b1c1c98fa28f6f4915d5
SHA1841ab6d9e30f89022129243cf7c15b7ce02b55c3
SHA25611f7d1889f87bcdb136e2ffcd4d4dc6daddfaeee4c2d418585e11aeabf45afa3
SHA512a705ef34997ed5a083e0c1436a707da0eeb00ee74da928f397cbd6fe5ef4c17e11f461092ac8cd395752b8a51bbb1d94537d1933c2316eacd1f5a06bba3d2712
-
Filesize
10KB
MD556a321bd011112ec5d8a32b2f6fd3231
SHA1df20e3a35a1636de64df5290ae5e4e7572447f78
SHA256bb6df93369b498eaa638b0bcdc4bb89f45e9b02ca12d28bcedf4629ea7f5e0f1
SHA5125354890cbc53ce51081a78c64ba9c4c8c4dc9e01141798c1e916e19c5776dac7c82989fad0f08c73e81aaba332dad81205f90d0663119af45550b97b338b9cc3
-
Filesize
14KB
MD54814167aa1c7ec892e84907094646faa
SHA1a57a5ecbdfa9a8777a3c587f1acb02b783afc5ee
SHA25632dd7269abf5a0e5db888e307d9df313e87cef4f1b597965a9d8e00934658822
SHA512fb1f35e393997ecd2301f371892b59574ee6b666095c3a435336160481f6ef7ed5635c90ce5d2cf88e5ef4a5affb46cb841b7d17e7981bd6e998531193f5d067
-
Filesize
24KB
MD5c9397d267d0d10169c4535f6d5e06a6c
SHA12fc5d2e909d56042d32b3fe0a5ae39fc58d110ef
SHA25625e5a428e663c6b6c352e7eb313d9fd265e944e0f8f88c7406c3fc15d1ad82b6
SHA512143943d8e02392ef41c2c43641db9d1737a108defb9cd62a3ed3dce800ccbc8f5997f1d0ea4846ae675e3f2b0efbbd9cebd5c5c0022822d10a89a356983440e6
-
Filesize
10KB
MD5d60dc7dea1b8337f0c8e8d72a6079c42
SHA1c21309b8b8af256e4b656b082c359d7578a7d640
SHA256884c9413e776feedc2fe25d2bb6e6b1913690233e73089de2312d939b09fae62
SHA5122560aa4ac39eb18e20fbea313e041f645d31ac631b79ba8314db72ccb3cba159af5295c46b883bbbf3090c1df42ab7e5a4b5b07e7a941fb629d3bc975aa0bcac
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qapp529h.default-release\datareporting\glean\db\data.safe.bin
Filesize9KB
MD5ba4a174c173ab380eb6752355a5ee56d
SHA124b63669610841d82211845491bf413a3fc9c592
SHA2560ef5abf96c6393c1dea3faebabdc79dc2b1dfde87c82cc2b24bf954566d417a6
SHA512c34f41c1be664741f9cfd14c3fe0c56d109c962536de9f35eafd9949858c88b7a676fbb1e2761512569973f29dfad5276367a3f0c7be98ad75d4381c951b0f0d
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qapp529h.default-release\datareporting\glean\pending_pings\c147a63f-f659-48a9-b838-8d34394adc7d
Filesize734B
MD539fef7abb0ec42bde1b392c398bd6cc3
SHA10ce89e8c7bb7e12f9389763376e96abe41c0760c
SHA2569af4a8b38b6691129cedcfcfa20ad82ebf4206b9c74f2fa4cbca58c6fc1c3e48
SHA5126f1c57628e8257e4b1f4afa8a29037cec7cb17c8a9a41c82f9d021a927b1bfd68691763a57130b636c75bf5715efa151eee0fd86790acb922ccd83c9d8e7cc59
-
Filesize
6KB
MD5e96b972400ec95d0dadb8cb8436a8d42
SHA1ccf055b4e9834909b57ef2bf777b67c58fe9a57d
SHA2569bb96154ff4782fb885203a6ca5d18db62d8d14f8453f30093b58ca881a4405d
SHA51205d47fc8ec69e12550c5e47db6feaadd9343da1de1e5df0e8f952401114501af9ce0adeb70c16727f34b54460335269bba011042eb6c1c1cd20a7d9ba998072d
-
Filesize
6KB
MD514753512c59adbae91d9bd4cead8be5e
SHA15719cd85e456f7112048e57af4c2f0582232aa19
SHA256b44e361a9c41d25bf439099c79ea11ef0b31780419e97da8d5787f8b41782a53
SHA51273438316ff927d5ab300fad2c0ff4f5bfbe031bf97768f899dd1098ce7e19dfbb1116964b6a71cf8e499c3e1100ae57a89dbc795c951040cfdefea564f945e27
-
Filesize
6KB
MD59b2a327b0c1650aecffa03772d38cef9
SHA1e758f244ce20d921158f4ca914c65cac45f5c4a0
SHA256c7525ebb3734ddadfa984b60dc1dd53154584c0aa0521410a98026dead3fee69
SHA512c5ee1343ebc2b91d15e0367131b4f2643dbc55851b8a5eb0071fd64ff00fc755703505aa808d195f431814264471046701a6e0a4c13896e4a7713b9a65ce0af0
-
Filesize
6KB
MD570fe86bc58e0e72a21ad9f2ec0917a45
SHA1a3fbeed6762aac775a1d525446c46abce2fcbcca
SHA256a79893302e1b429b420f394b5ec5959bc0c63a211a1a70c3749da73c55f69d35
SHA5122ba4995bdafc8187426daccf30e50a5def1d6d42bd695979eebbab7fe0a67a2f93752bd0d36c81fd921ba71065385b8c93115ea045b43016a70f64f06e6ef8ea
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qapp529h.default-release\sessionstore-backups\recovery.jsonlz4
Filesize5KB
MD53f2d29388f303748e5883449111480e2
SHA1db8da6391c8d144ea1a3d532a0e9a6c6475c28d1
SHA256e3df9b32bc7864a49ac8e31d2af2d0b7ba479106c27de993b1ffe5c25d76314b
SHA512c56c4960ebb75d72a7633f44e3df66da7d8c5f7ce36baff047b20f97eaec879a2ffb1390b3d156e33541b6e08ab139cd52586d6b11cc227a05713a63527d8b3d
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qapp529h.default-release\sessionstore-backups\recovery.jsonlz4
Filesize5KB
MD5abc58a3f5fc96fc6c9db74b7feb5bf2b
SHA1a225d84f3e42b693e1dc3c1aa27265c855a772be
SHA2561a7d51ba9449e4bf7dce7bc4f8d6afea6222950a0160f73eaa439b2b4c8be542
SHA512a6744a8d0a59267dcd98163a22ebf59a0aa5ab8fcb259d9be9e2e21bbcbcb97feddfb5f9efe0830b3e49569a3b1218c06355f10f4e8c57a8a72f502503c831fe
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qapp529h.default-release\sessionstore-backups\recovery.jsonlz4
Filesize5KB
MD592c9d94ba3126627c5e10a69c79844aa
SHA1e8c51bb4131fe4beba8a213dc295cd8fe92bc374
SHA256434788fac80ac1111c5118687b9985e34238b0a414d985809f0f17c8adee62ac
SHA51238db3d2bc3bafeff1e0862e370a8731cc33549b5f8b452773d326cfccd7fb443789e3481037de33a76c61c9f06d0f96ce782cd6a042cd6cf745bc27c57f6a708
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qapp529h.default-release\sessionstore-backups\recovery.jsonlz4
Filesize5KB
MD524238a116e21bd930888cced7f2fc137
SHA1267ad4e3660475bf599a4e7b5c5b150706fc3247
SHA25685fb8c3c911c3e5fefe1caa5c37247e160468300b85ed666df52efd93dbcf4da
SHA5121558cb9afbee3c3e3d9c095e3a71fa265c7ccbed88a3e5275435db4a38a643451ffe952286a15b9953dcb95aea9f54dadda0aa2193a42beb8bb46d7625dbd66f
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qapp529h.default-release\sessionstore.jsonlz4
Filesize5KB
MD5bc65af43359766dd5742895bd5bc39c0
SHA1dcf857badb5960208d3f1d324f8db49aa3beb977
SHA256d458ce9c33aa8836f9f47e2a173f2b1ba94b5012d8b523b7f1cf12c5a87b9253
SHA512e27aec92775f9d61dd85d07cb030807d08663727a37282c56868633c1daba256ad5c532fa0782a59878a26f79342f7b0b081ec6e7ffee71450fdb27774b81b2a
-
Filesize
21.2MB
MD50e62ac9aef83e216197dc5e0985322c8
SHA1fbb7afc8497e944b4bb36d3eb5f09bef4ddb4ca3
SHA256d2bcd3a68ad3b50da10667823c2109749394725876a224881f3b6f9e37fe065c
SHA512e24940851467f833695ab698e596a9e54a8d16e42a06012da82eaa5e5b9a384d657fd15d23860fc965e3bb8f465f29d356a64fb79113962232b0e126bdf6eefb
-
Filesize
23KB
MD5468abb28636485af7bbff18fde3b21fa
SHA1f596b1e46a5acc1c0640d9a2cfc559caf2925a38
SHA25656cb9e0a78670b0081ace9a35d18c81b64d1feee12a067d9bde975f6c8457ca2
SHA512a200f2aee1b47f2f232bcac09990b397820e72ace10c6eb571e094533bc33642fe7de5dd8d7740245dd4b3205003102a609a0c77bd1fb98f256ab1836f2ab1fb
-
Filesize
23KB
MD523c319a29bb452fd5c6cfcb3b5f2c101
SHA15f47bcc38fe59c88d4c16a3339767495a407e4c8
SHA2560919bcc1f20063d0a9781a1d6a7dca2cd14b0ddeba5316478043c38942b404f9
SHA51273d86260f15a3db55f9297541f2527f4c3ea05ebf310d9225f805e184c095c28787b275441eeb5bfff67048de29a7b91108f265387d081b7c6988f07ab7c813e
-
Filesize
23KB
MD5ad406ecef8afdd03af46267ffe7c466e
SHA1a8459398eafe41325b38c03521d9f6f0f394fb06
SHA2561a4a708eb9d2f77b3b10d01248ce2f4cbbd0b7092c2a4d2f5ace360bb19519aa
SHA512906a6e8c81203ca4994ce2f66e565c1d80a1e30a62a380d8ad9bc8076e45f15b43d9ae2c67922b88f46c8f809447d1385589c9977c7d8ecb974b60d8cc5726c2
-
Filesize
23KB
MD5d2789c9b6dd96f4e6e7a6d8402727029
SHA1ad96e565aa5038904d2b3c37d3426113ea8cd4ed
SHA256dbf46c6c988400a1f25e4a575c07047c33773e97796e3cff714b5754298e260e
SHA51215408e5359089e7bb6b803238afaa6588c50e1b5b02529dafe926bb7ff44a08d2b76d3349f935d197d1a80f12c208a28a22ccea02c0519d3f5f269210e531426
-
Filesize
42KB
MD50524f3b0cacb1c64570c5c45ed3ee93a
SHA14bf968900d2ff328f7869fc96552823a5f918fcc
SHA2568f2e23d5c864f5887778267c217c02b3dd6eddc0d6f97e09393cbb5486cf0d72
SHA5122272863ea890f43010af84db8df2172c0ca1438951f3543b856313e757e9cf02644c484963f2178b837903c4360e0bb8846e813df038b42d7daf24eca2e9bc01
-
Filesize
16KB
MD5bd8ba042fe7e03622c11dc9b3ff8218d
SHA11f12594db2bd76219c3e1cdce6aaa771516ed199
SHA2566f6368a80ae186918208234298296e4551cc2a7d0468930c49ea3a45c19a9449
SHA51224bd3fb737acab5e8becc2f95af83dbea0163da702a2d10b343236f4679a4bc4c4ea55d1c3512faf77b128e3091e8d99f963a9192f29d4c97581c73ce29a44fb
-
Filesize
418KB
MD512cc432e707dbb3846c79c85bf616719
SHA166c2cd0d827b6d6149b842d3ed64e6b83d985993
SHA25659a10f8f4e068c2368c5803fb8070eb3b1408106ebdc18b4110ed38761c26438
SHA51221f53487c9b408a1195cd801b29aae1197d01218fc5bb5ccb73a6b120faa23c5fe63e528bc674dd6f770667f41109214bd923d5962a9287fbd1fda18e9a9431b
-
Filesize
333KB
MD5a9fdb78898b9667c6d935d739e9414b4
SHA1808ba063359d2ca7830929f03cd66dfa510f91ac
SHA256af4dbcf1c75453046335235a1ac3eb7c12bb988daf18d674f24adf1ec61b1266
SHA5127e1d4f9f5199f3aa0bd2b6bd31c2d3a52e201d0edfc742e4dd7ca7963b30d19e64cdfdf3dc069608f99fac895905acd306603c31f8ae90a4a453d90e1d0e0370
-
Filesize
375KB
MD57fb00dcbf1c05679cc2684149067fcd1
SHA11851a086c9718efa24dd7127f7429eea68efae3e
SHA256062bb15aa0e775591b19a02b7e34cf4c4cb89a122c68839ae9aa9bb63dcd25fd
SHA512dc308219fa2c7c3a49e20bf5acd803d5dfec57cd731ba646f1336bd7121d917c920d98472bf800e752145b256e18aefcad846e49044379c64dab4bc3ce9e3766
-
Filesize
292KB
MD501117c13ff17b8e32ab5ccff45e280c7
SHA1158415bf8e1e38f045fa4476bc069f5da638571d
SHA2569bba281e150abab2b48bf906d352a58b53ff7436846790f011ece15932e97790
SHA51252779977bc9f3f92de83ae9e6095050a7cf1010e0deb13c96b67c03b4e06fe7f6ec889614dd3ee43f9854df06e9ca47e918ba5cc9fce370af8399df7e8a1244c
-
Filesize
476KB
MD5571bb5752e8759d4622a5f0064dc232e
SHA16adf108e20336cc4d80fa39d4a487c039380fab7
SHA256c5b593691b4b5fa688cc97bb6a2451647a0c9a346666e87eedd8e1b4f981d127
SHA5125c98c488fcad296bb77a687334108570991d0286c2f05a0da054709b27b8eaae6fc4a7c38711bfe410aab8c6f7a20f05d57cb1258e640cd1091619bded16f619
-
Filesize
388KB
MD5d0b0533b6c5673e4e6da48061e43fc62
SHA1d4325ca3ce71f7de74021f0125490ec0bad82e9f
SHA2565beb5d78c2e5284d7a9114f9ad3621d549e6883cb956713178df796e7d570144
SHA512013e84aa1081ae65eb92154b4fa1475d5e6ba70b869a8a413d3e221eb31479c30352b69ce5c90af03985507fcc2e8d6c7e271963742ff00bdd3843151cc7eb71
-
Filesize
291KB
MD59265622011ac1650263a5f1b90e2a1bd
SHA1d8cc6be9e164eadb241204efe37fa213492fdf08
SHA25695c1425db70c11560eebaf26a5bc8146ff9dff0370ead4fa4ab9e15e9cb6b2d4
SHA512fe9d14c290953e0c3dfca1e03f017dccf40b97590da0983c4d77f17eb57972ea1c05e8634022ca352f1e9068c167901ed02d0dcd0f69972c8027595192c4cfc7
-
Filesize
289KB
MD58ed4d73bc91946e7cd4449fa96d50704
SHA183605c8d0271ed38b9046c38b12c4bf26751e57a
SHA25685eacc60f8bb0a4d3b06dae2547ef33b3a00c1d27284eeaf4c09565704642f64
SHA512af0068164d59790d6498558e8ca9a5630f25cdf32f013ab374e3f4c203030f19f22f57bbf55d73fc20af526255ecd058e70f8e192cc6e75f4a5669d0bbce6fbb
-
Filesize
368KB
MD587e7c91b2a5a04f66890ac6c4f968372
SHA132b1ad52ac043a0b66f4d6ab0ebdd0f52478130c
SHA256cbdc46f3005cda4d44a8e9115ac78efc9075084337389bece5aa448c3bbcb2ed
SHA51274769f8f8e6df4255a2e46381ea1a4a8702564061b173c44bd393ac1d251c5d8e5454de5fb2b9c7c7a2e42db5fc04ec2f3946fd86395cfda607b8cf234ec171c
-
Filesize
571KB
MD5fa4f0a30d77f0b3fefb2cbc1146c7b9f
SHA183b9ff522ece3d948ef934ba0a027fdd7b4c709b
SHA256a2997a23341cf23008972c4eff3b6f09b8e9e3250c4720fc75c0e9ae922866a7
SHA512a524441b953af16ed05617f898777de6b90be68e4afbf97fa118239cddff78c1f462bf02c8db346e57e1cf4f40683f499a36c8eda15529927e279f9a8f1479bc
-
Filesize
888KB
MD58a97f72006cfa350e01aaac3b593ae4b
SHA102a77355dce753a8766bab37656cfaf536ffd485
SHA2567f84c9d16ea406b940392180d0e6f7426f3461a71029bb82ea6719aeee613670
SHA5121a63145bf15e34b6ac3e6c892280b2fd459736d4923f88ae7c0b2b74ef1502f7468010ea8d782e0e271d45aca38224a82b7aa92eca4568853cd6d3dde751696f
-
Filesize
23B
MD5534ed690a365f671259a9ce7d2a8a910
SHA114ebb3a3b065f4c7f574726480e036e0c2f8beb1
SHA25674fa69e7b0329ae4af0f9893df5388030208a8c360073608641fbcd8bd4de28a
SHA512e5273745086967ce23d94b8ccbdf96703c3abce11a83b2674db52d11607c49bb91637911d71fc74ab60409dcb4d131271c54a266f2aeb96f7ec0fbaf4b409be7
-
Filesize
3KB
MD583a4486739b224487c2bc2f37fa9d87e
SHA1afeb9c4992c2dfae3095e831704d04e3f66304dc
SHA256fb28e25e507880d596ae8d4b210c6df6719283e610c24bf27d7b09ca7a12d469
SHA51289fad9a63cb475ab647838a97464e1cd42904d0cc22fd62404a8a5fabbef6b9f16a7919445f55d120a2ba4e2456472cb43e1e624cb849d315af9bc6a69a54ab3
-
C:\Users\Admin\Documents\Scripts\Cockos\Default_6.0_theme_adjuster_images\[email protected]
Filesize65KB
MD5a55fdeed83f64e4b3a4af73b52d2f3d6
SHA1ea3be498a1a87616f7b0e4dfefa6fe45706970e9
SHA25691a64bc8730949624af0b6916d380c4a3be0901ad6dbe10797cb9bd16516541a
SHA512f1f036a4ed1b6aff65e7182d3c341a7f6e2af038094399cbc27a43949920866cdb24180a8a61728f93353f0983c37bad2881ee52dc0b6c73691927f3345e5c67
-
C:\Users\Admin\Documents\Scripts\Cockos\Default_6.0_theme_adjuster_images\[email protected]
Filesize95KB
MD51dea3c1552cfa296632626316f81cfe1
SHA1451bc22d77c120f98a15bb1b7f0c979c6f661a36
SHA2568ec8a207170d8b57697bc718e96df66ba570d5d105c1e74c0dae4aa8a991a9a6
SHA5126f1c3dc429c914d85c06b903f2987c9d685947a8da58e0e2310e448b792ac591bf9728b425ef30f3b02a13eb38b013f2fe645a08dd7a556b03073e8ac7f1d1b4
-
C:\Users\Admin\Documents\Scripts\Cockos\Default_6.0_theme_adjuster_images\[email protected]
Filesize42KB
MD5b41d9eab199b13e33786992d256fc5cf
SHA1865770a7f2ea23e2d413afb478e56bdc8397af4f
SHA2569e895169189004dd4bc522fc06e0520c3be84e2d83fcee07be3820e81f9596be
SHA51216363d5a4b13ee8c1a6d06ca3564aab057156a3771b062fce558bfb6d670b885a8a7d41c737d8035f54319ba27b50b2b4d6f0aa59f882caad54d0a5a2d3e08fb
-
Filesize
363B
MD59b6d64d89698e3aebcc40d4982363106
SHA1a588e87a75cf97b92716d65fcbbf1e183c999402
SHA256196b80306189c333c27fcc90762087fcf7ce737cd86c3789e399cb4de73c042b
SHA5129ec7c51874b98e7663b9d87718889f0e7cedbed7eb5ee9139a9a2c699cce53d20f3ab623d3fe3bc52b7ea08df5eedbe928ad3e6432dc2cae4332d1d72d7a6b71
-
Filesize
544B
MD5baccefe3cffebe31c6955eb57141a9fc
SHA198f9127c8ffc09630a95749f46ae57abbfa4e871
SHA256486c6d9144d2f9ac2bc5948a24b89394d28fc826cc63f9d2406926723f162249
SHA512df34152715a92a38528d59e5df532771811b299590afbd52e972232af38d526c9d26a1f8a7ad073981965e328f1fad499a870bbb7dcf2b04cecf016de452cd0e
-
Filesize
15.9MB
MD51ebb849057c0e6100fec0f5c1ffc5f17
SHA1812f8b26c8099cbabde2a6b2b2ff8dd1d9b07bd5
SHA256b6f70d9380b38aa165be2f911dfbe89f2d27ce29bca5c18fcc2cb55071921344
SHA5123b79d5d689a31e06db168f417116043a95e08a64a3c01c734ab93355dc8a12af8c9fb8ee7995da7723e8b610e2422285c85f5b0c17387c4f7659079dc8d98c45
-
Filesize
15.9MB
MD525b2180bbeb7f27eed4a896befd66371
SHA19f07b841d5ecc48b87e4d9319de5b061858d42fb
SHA256f63716b5eb38cccc145aa6143fdfca8b58adcb788446d0db41fc7444584be26b
SHA51247ede6bb038a0e9481bd9d54afb099e171c0a0a1d717a99ace5c82f180c340327a9b605be567ca4499741f699734cb0aba682c42ca663cc5d0b7dca3276d2677
-
Filesize
46B
MD574492e56819b821fc830b3958d007b6d
SHA1f7cc111c29e6edec590767eca84a536ab71c3f6b
SHA2563eb8b23a45983f6919d91bd57c5529f0f607a6d9866aeb98dec44a1236118f90
SHA5120fea0c4f031bb517a67f895e9c90640f0d7cc648af7c522838994b6b3a86f49f871668f7fef2afa8cd45a9a39a0d9d6db2f3eb9ba7852e79b499fee1d6aff896
-
Filesize
60B
MD5a262f20bb21b1ce112d7d0addcbafe9f
SHA18afc49f216d648830537908bb965de9fc34809d9
SHA25633c2a5733c8e212a4db488df4286d8c81f903847876f3784e5c6040ce0f4028f
SHA51265c688b6848334dd9a9ee082102bd60d62cd5ae6b9019f2529f5cdbc4b973d5bab6827ebde99ed6e23bb31772caff3a4ad7e0349eeb0db153b5b1e88de2bccc7
-
Filesize
14.9MB
MD52d00754f44c07a3241059e43be8dc6c6
SHA18419d033f6d5d483a7fafe1df69c029856c3c920
SHA2562a29407a012be17087edc4de06d1c4ae96f72ae52097aaa98bc2707d7d7624c7
SHA5121a8efcc2c357fc6b32ac03af7ac0dbb5e34b79e799f9b7f11ff89bdf1ffa2e763bb4a636740cc2426e592a50ea102d9ae33aefd7ca32d1945107722a7a0eb5af