379fd5ec4ea9f51ff22c2f99d680fae3066dbfc664f4acf6d47c5c501d192ebd

Analysis

max time kernel
13s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
16/04/2024, 15:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file01.vbs
Size

4KB
MD5

d94eb511487eb2dbb55788317bc294fb
SHA1

87b9ee01ea17bf6845f7f3130efba3600ed83222
SHA256

379fd5ec4ea9f51ff22c2f99d680fae3066dbfc664f4acf6d47c5c501d192ebd
SHA512

75ded8fca929dd35e1c64d4d327d6431fe3b36254fcb15fd6ee963529b1be582e0289083820e979e47c5e01c11688d30837234057576d165fdd47119fb0d17cb
SSDEEP

96:KYrtaAr0Vu6Eg9CBmoceWZHJMzY3p5Uoi:1rtaAwVQIymfnnMz+p50

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	WScript.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3564	mspaint.exe
3564	mspaint.exe
3972	mspaint.exe
3972	mspaint.exe
4804	mspaint.exe
4804	mspaint.exe
4796	mspaint.exe
4796	mspaint.exe

Suspicious use of SetWindowsHookEx 16 IoCs

pid	Process
3564	mspaint.exe
3972	mspaint.exe
4804	mspaint.exe
4804	mspaint.exe
3972	mspaint.exe
3564	mspaint.exe
3972	mspaint.exe
3972	mspaint.exe
4804	mspaint.exe
4804	mspaint.exe
3564	mspaint.exe
3564	mspaint.exe
4796	mspaint.exe
4796	mspaint.exe
4796	mspaint.exe
4796	mspaint.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 1012 wrote to memory of 3768	1012	WScript.exe	92
PID 1012 wrote to memory of 3768	1012	WScript.exe	92
PID 1012 wrote to memory of 3564	1012	WScript.exe	94
PID 1012 wrote to memory of 3564	1012	WScript.exe	94
PID 1012 wrote to memory of 3488	1012	WScript.exe	95
PID 1012 wrote to memory of 3488	1012	WScript.exe	95
PID 1012 wrote to memory of 3972	1012	WScript.exe	97
PID 1012 wrote to memory of 3972	1012	WScript.exe	97
PID 1012 wrote to memory of 3960	1012	WScript.exe	98
PID 1012 wrote to memory of 3960	1012	WScript.exe	98
PID 1012 wrote to memory of 4804	1012	WScript.exe	101
PID 1012 wrote to memory of 4804	1012	WScript.exe	101
PID 1012 wrote to memory of 2720	1012	WScript.exe	102
PID 1012 wrote to memory of 2720	1012	WScript.exe	102
PID 1012 wrote to memory of 4348	1012	WScript.exe	105
PID 1012 wrote to memory of 4348	1012	WScript.exe	105
PID 1012 wrote to memory of 3156	1012	WScript.exe	106
PID 1012 wrote to memory of 3156	1012	WScript.exe	106
PID 1012 wrote to memory of 436	1012	WScript.exe	108
PID 1012 wrote to memory of 436	1012	WScript.exe	108
PID 1012 wrote to memory of 3396	1012	WScript.exe	140
PID 1012 wrote to memory of 3396	1012	WScript.exe	140
PID 1012 wrote to memory of 4796	1012	WScript.exe	219
PID 1012 wrote to memory of 4796	1012	WScript.exe	219
PID 1012 wrote to memory of 3348	1012	WScript.exe	112
PID 1012 wrote to memory of 3348	1012	WScript.exe	112
PID 1012 wrote to memory of 3820	1012	WScript.exe	114
PID 1012 wrote to memory of 3820	1012	WScript.exe	114
PID 1012 wrote to memory of 3660	1012	WScript.exe	115
PID 1012 wrote to memory of 3660	1012	WScript.exe	115
PID 1012 wrote to memory of 1544	1012	WScript.exe	117
PID 1012 wrote to memory of 1544	1012	WScript.exe	117

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1012
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c gcc -o C:\Users\Admin\Desktop\monitorinvert1.exe C:\Users\Admin\Desktop\monitorinvert1.c && C:\Users\Admin\Desktop\monitorinvert1.exe
  2⤵
  PID:3768
- C:\Windows\System32\mspaint.exe
  "C:\Windows\System32\mspaint.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:3564
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c gcc -o C:\Users\Admin\Desktop\monitorinvert2.exe C:\Users\Admin\Desktop\monitorinvert2.c && C:\Users\Admin\Desktop\monitorinvert2.exe
  2⤵
  PID:3488
- C:\Windows\System32\mspaint.exe
  "C:\Windows\System32\mspaint.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:3972
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c gcc -o C:\Users\Admin\Desktop\monitorinvert3.exe C:\Users\Admin\Desktop\monitorinvert3.c && C:\Users\Admin\Desktop\monitorinvert3.exe
  2⤵
  PID:3960
- C:\Windows\System32\mspaint.exe
  "C:\Windows\System32\mspaint.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:4804
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c gcc -o C:\Users\Admin\Desktop\monitorinvert4.exe C:\Users\Admin\Desktop\monitorinvert4.c && C:\Users\Admin\Desktop\monitorinvert4.exe
  2⤵
  PID:2720
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:4348
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c gcc -o C:\Users\Admin\Desktop\monitorinvert5.exe C:\Users\Admin\Desktop\monitorinvert5.c && C:\Users\Admin\Desktop\monitorinvert5.exe
  2⤵
  PID:3156
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:436
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c gcc -o C:\Users\Admin\Desktop\monitorinvert6.exe C:\Users\Admin\Desktop\monitorinvert6.c && C:\Users\Admin\Desktop\monitorinvert6.exe
  2⤵
  PID:3396
- C:\Windows\System32\mspaint.exe
  "C:\Windows\System32\mspaint.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:4796
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c gcc -o C:\Users\Admin\Desktop\monitorinvert7.exe C:\Users\Admin\Desktop\monitorinvert7.c && C:\Users\Admin\Desktop\monitorinvert7.exe
  2⤵
  PID:3348
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:3820
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c gcc -o C:\Users\Admin\Desktop\monitorinvert8.exe C:\Users\Admin\Desktop\monitorinvert8.c && C:\Users\Admin\Desktop\monitorinvert8.exe
  2⤵
  PID:3660
- C:\Windows\System32\mspaint.exe
  "C:\Windows\System32\mspaint.exe"
  2⤵
  PID:1544
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c gcc -o C:\Users\Admin\Desktop\monitorinvert9.exe C:\Users\Admin\Desktop\monitorinvert9.c && C:\Users\Admin\Desktop\monitorinvert9.exe
  2⤵
  PID:4908
- C:\Windows\System32\mspaint.exe
  "C:\Windows\System32\mspaint.exe"
  2⤵
  PID:1304
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c gcc -o C:\Users\Admin\Desktop\monitorinvert10.exe C:\Users\Admin\Desktop\monitorinvert10.c && C:\Users\Admin\Desktop\monitorinvert10.exe
  2⤵
  PID:2580
- C:\Windows\System32\mspaint.exe
  "C:\Windows\System32\mspaint.exe"
  2⤵
  PID:2780
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c gcc -o C:\Users\Admin\Desktop\monitorinvert11.exe C:\Users\Admin\Desktop\monitorinvert11.c && C:\Users\Admin\Desktop\monitorinvert11.exe
  2⤵
  PID:1972
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:2816
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c gcc -o C:\Users\Admin\Desktop\monitorinvert12.exe C:\Users\Admin\Desktop\monitorinvert12.c && C:\Users\Admin\Desktop\monitorinvert12.exe
  2⤵
  PID:4664
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:3712
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c gcc -o C:\Users\Admin\Desktop\monitorinvert13.exe C:\Users\Admin\Desktop\monitorinvert13.c && C:\Users\Admin\Desktop\monitorinvert13.exe
  2⤵
  PID:3656
- C:\Windows\System32\mspaint.exe
  "C:\Windows\System32\mspaint.exe"
  2⤵
  PID:4248
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c gcc -o C:\Users\Admin\Desktop\monitorinvert14.exe C:\Users\Admin\Desktop\monitorinvert14.c && C:\Users\Admin\Desktop\monitorinvert14.exe
  2⤵
  PID:4084
- C:\Windows\System32\mspaint.exe
  "C:\Windows\System32\mspaint.exe"
  2⤵
  PID:1436
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c gcc -o C:\Users\Admin\Desktop\monitorinvert15.exe C:\Users\Admin\Desktop\monitorinvert15.c && C:\Users\Admin\Desktop\monitorinvert15.exe
  2⤵
  PID:2144
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:1844
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c gcc -o C:\Users\Admin\Desktop\monitorinvert16.exe C:\Users\Admin\Desktop\monitorinvert16.c && C:\Users\Admin\Desktop\monitorinvert16.exe
  2⤵
  PID:1036
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3396
- C:\Windows\System32\mspaint.exe
  "C:\Windows\System32\mspaint.exe"
  2⤵
  PID:4072
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c gcc -o C:\Users\Admin\Desktop\monitorinvert17.exe C:\Users\Admin\Desktop\monitorinvert17.c && C:\Users\Admin\Desktop\monitorinvert17.exe
  2⤵
  PID:4184
- C:\Windows\System32\mspaint.exe
  "C:\Windows\System32\mspaint.exe"
  2⤵
  PID:1132
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c gcc -o C:\Users\Admin\Desktop\monitorinvert18.exe C:\Users\Admin\Desktop\monitorinvert18.c && C:\Users\Admin\Desktop\monitorinvert18.exe
  2⤵
  PID:4908
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:3356
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c gcc -o C:\Users\Admin\Desktop\monitorinvert19.exe C:\Users\Admin\Desktop\monitorinvert19.c && C:\Users\Admin\Desktop\monitorinvert19.exe
  2⤵
  PID:4548
- C:\Windows\System32\mspaint.exe
  "C:\Windows\System32\mspaint.exe"
  2⤵
  PID:3588
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c gcc -o C:\Users\Admin\Desktop\monitorinvert20.exe C:\Users\Admin\Desktop\monitorinvert20.c && C:\Users\Admin\Desktop\monitorinvert20.exe
  2⤵
  PID:4400
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:3488
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c gcc -o C:\Users\Admin\Desktop\monitorinvert21.exe C:\Users\Admin\Desktop\monitorinvert21.c && C:\Users\Admin\Desktop\monitorinvert21.exe
  2⤵
  PID:2088
- C:\Windows\System32\mspaint.exe
  "C:\Windows\System32\mspaint.exe"
  2⤵
  PID:4748
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c gcc -o C:\Users\Admin\Desktop\monitorinvert22.exe C:\Users\Admin\Desktop\monitorinvert22.c && C:\Users\Admin\Desktop\monitorinvert22.exe
  2⤵
  PID:1260
- C:\Windows\System32\mspaint.exe
  "C:\Windows\System32\mspaint.exe"
  2⤵
  PID:3508
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c gcc -o C:\Users\Admin\Desktop\monitorinvert23.exe C:\Users\Admin\Desktop\monitorinvert23.c && C:\Users\Admin\Desktop\monitorinvert23.exe
  2⤵
  PID:3656
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:456
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c gcc -o C:\Users\Admin\Desktop\monitorinvert24.exe C:\Users\Admin\Desktop\monitorinvert24.c && C:\Users\Admin\Desktop\monitorinvert24.exe
  2⤵
  PID:4056
- C:\Windows\System32\mspaint.exe
  "C:\Windows\System32\mspaint.exe"
  2⤵
  PID:2980
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c gcc -o C:\Users\Admin\Desktop\monitorinvert25.exe C:\Users\Admin\Desktop\monitorinvert25.c && C:\Users\Admin\Desktop\monitorinvert25.exe
  2⤵
  PID:3852
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:212
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c gcc -o C:\Users\Admin\Desktop\monitorinvert26.exe C:\Users\Admin\Desktop\monitorinvert26.c && C:\Users\Admin\Desktop\monitorinvert26.exe
  2⤵
  PID:3904
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:3624
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c gcc -o C:\Users\Admin\Desktop\monitorinvert27.exe C:\Users\Admin\Desktop\monitorinvert27.c && C:\Users\Admin\Desktop\monitorinvert27.exe
  2⤵
  PID:4912
- C:\Windows\System32\mspaint.exe
  "C:\Windows\System32\mspaint.exe"
  2⤵
  PID:5028
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c gcc -o C:\Users\Admin\Desktop\monitorinvert28.exe C:\Users\Admin\Desktop\monitorinvert28.c && C:\Users\Admin\Desktop\monitorinvert28.exe
  2⤵
  PID:3224
- C:\Windows\System32\mspaint.exe
  "C:\Windows\System32\mspaint.exe"
  2⤵
  PID:4136
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c gcc -o C:\Users\Admin\Desktop\monitorinvert29.exe C:\Users\Admin\Desktop\monitorinvert29.c && C:\Users\Admin\Desktop\monitorinvert29.exe
  2⤵
  PID:3880
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:4776
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c gcc -o C:\Users\Admin\Desktop\monitorinvert30.exe C:\Users\Admin\Desktop\monitorinvert30.c && C:\Users\Admin\Desktop\monitorinvert30.exe
  2⤵
  PID:1844
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:964
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c gcc -o C:\Users\Admin\Desktop\monitorinvert31.exe C:\Users\Admin\Desktop\monitorinvert31.c && C:\Users\Admin\Desktop\monitorinvert31.exe
  2⤵
  PID:4900
- C:\Windows\System32\mspaint.exe
  "C:\Windows\System32\mspaint.exe"
  2⤵
  PID:3780
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c gcc -o C:\Users\Admin\Desktop\monitorinvert32.exe C:\Users\Admin\Desktop\monitorinvert32.c && C:\Users\Admin\Desktop\monitorinvert32.exe
  2⤵
  PID:2592
- C:\Windows\System32\mspaint.exe
  "C:\Windows\System32\mspaint.exe"
  2⤵
  PID:4400
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c gcc -o C:\Users\Admin\Desktop\monitorinvert33.exe C:\Users\Admin\Desktop\monitorinvert33.c && C:\Users\Admin\Desktop\monitorinvert33.exe
  2⤵
  PID:220
- C:\Windows\System32\mspaint.exe
  "C:\Windows\System32\mspaint.exe"
  2⤵
  PID:4500
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c gcc -o C:\Users\Admin\Desktop\monitorinvert34.exe C:\Users\Admin\Desktop\monitorinvert34.c && C:\Users\Admin\Desktop\monitorinvert34.exe
  2⤵
  PID:4056
- C:\Windows\System32\mspaint.exe
  "C:\Windows\System32\mspaint.exe"
  2⤵
  PID:3904
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c gcc -o C:\Users\Admin\Desktop\monitorinvert35.exe C:\Users\Admin\Desktop\monitorinvert35.c && C:\Users\Admin\Desktop\monitorinvert35.exe
  2⤵
  PID:2132
- C:\Windows\System32\mspaint.exe
  "C:\Windows\System32\mspaint.exe"
  2⤵
  PID:3472
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c gcc -o C:\Users\Admin\Desktop\monitorinvert36.exe C:\Users\Admin\Desktop\monitorinvert36.c && C:\Users\Admin\Desktop\monitorinvert36.exe
  2⤵
  PID:2484
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:5080
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c gcc -o C:\Users\Admin\Desktop\monitorinvert37.exe C:\Users\Admin\Desktop\monitorinvert37.c && C:\Users\Admin\Desktop\monitorinvert37.exe
  2⤵
  PID:4628
- C:\Windows\System32\mspaint.exe
  "C:\Windows\System32\mspaint.exe"
  2⤵
  PID:4592
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c gcc -o C:\Users\Admin\Desktop\monitorinvert38.exe C:\Users\Admin\Desktop\monitorinvert38.c && C:\Users\Admin\Desktop\monitorinvert38.exe
  2⤵
  PID:1844
- C:\Windows\System32\mspaint.exe
  "C:\Windows\System32\mspaint.exe"
  2⤵
  PID:4328
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c gcc -o C:\Users\Admin\Desktop\monitorinvert39.exe C:\Users\Admin\Desktop\monitorinvert39.c && C:\Users\Admin\Desktop\monitorinvert39.exe
  2⤵
  PID:4796
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:3684
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c gcc -o C:\Users\Admin\Desktop\monitorinvert40.exe C:\Users\Admin\Desktop\monitorinvert40.c && C:\Users\Admin\Desktop\monitorinvert40.exe
  2⤵
  PID:3944
- C:\Windows\System32\mspaint.exe
  "C:\Windows\System32\mspaint.exe"
  2⤵
  PID:4680
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c gcc -o C:\Users\Admin\Desktop\monitorinvert41.exe C:\Users\Admin\Desktop\monitorinvert41.c && C:\Users\Admin\Desktop\monitorinvert41.exe
  2⤵
  PID:4052
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:3152
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c gcc -o C:\Users\Admin\Desktop\monitorinvert42.exe C:\Users\Admin\Desktop\monitorinvert42.c && C:\Users\Admin\Desktop\monitorinvert42.exe
  2⤵
  PID:4052
- C:\Windows\System32\mspaint.exe
  "C:\Windows\System32\mspaint.exe"
  2⤵
  PID:5148
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c gcc -o C:\Users\Admin\Desktop\monitorinvert43.exe C:\Users\Admin\Desktop\monitorinvert43.c && C:\Users\Admin\Desktop\monitorinvert43.exe
  2⤵
  PID:5172
- C:\Windows\System32\mspaint.exe
  "C:\Windows\System32\mspaint.exe"
  2⤵
  PID:5256
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c gcc -o C:\Users\Admin\Desktop\monitorinvert44.exe C:\Users\Admin\Desktop\monitorinvert44.c && C:\Users\Admin\Desktop\monitorinvert44.exe
  2⤵
  PID:5292
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:5360
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c gcc -o C:\Users\Admin\Desktop\monitorinvert45.exe C:\Users\Admin\Desktop\monitorinvert45.c && C:\Users\Admin\Desktop\monitorinvert45.exe
  2⤵
  PID:5384
- C:\Windows\System32\mspaint.exe
  "C:\Windows\System32\mspaint.exe"
  2⤵
  PID:5444
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c gcc -o C:\Users\Admin\Desktop\monitorinvert46.exe C:\Users\Admin\Desktop\monitorinvert46.c && C:\Users\Admin\Desktop\monitorinvert46.exe
  2⤵
  PID:5480
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:5552
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c gcc -o C:\Users\Admin\Desktop\monitorinvert47.exe C:\Users\Admin\Desktop\monitorinvert47.c && C:\Users\Admin\Desktop\monitorinvert47.exe
  2⤵
  PID:5576
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:5636
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c gcc -o C:\Users\Admin\Desktop\monitorinvert48.exe C:\Users\Admin\Desktop\monitorinvert48.c && C:\Users\Admin\Desktop\monitorinvert48.exe
  2⤵
  PID:5660
- C:\Windows\System32\mspaint.exe
  "C:\Windows\System32\mspaint.exe"
  2⤵
  PID:5720
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c gcc -o C:\Users\Admin\Desktop\monitorinvert49.exe C:\Users\Admin\Desktop\monitorinvert49.c && C:\Users\Admin\Desktop\monitorinvert49.exe
  2⤵
  PID:5740
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:5816
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c gcc -o C:\Users\Admin\Desktop\monitorinvert50.exe C:\Users\Admin\Desktop\monitorinvert50.c && C:\Users\Admin\Desktop\monitorinvert50.exe
  2⤵
  PID:5840
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:5924
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c gcc -o C:\Users\Admin\Desktop\monitorinvert51.exe C:\Users\Admin\Desktop\monitorinvert51.c && C:\Users\Admin\Desktop\monitorinvert51.exe
  2⤵
  PID:5968
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:6016
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c gcc -o C:\Users\Admin\Desktop\monitorinvert52.exe C:\Users\Admin\Desktop\monitorinvert52.c && C:\Users\Admin\Desktop\monitorinvert52.exe
  2⤵
  PID:6040
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:6100
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c gcc -o C:\Users\Admin\Desktop\monitorinvert53.exe C:\Users\Admin\Desktop\monitorinvert53.c && C:\Users\Admin\Desktop\monitorinvert53.exe
  2⤵
  PID:6124
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:5156
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c gcc -o C:\Users\Admin\Desktop\monitorinvert54.exe C:\Users\Admin\Desktop\monitorinvert54.c && C:\Users\Admin\Desktop\monitorinvert54.exe
  2⤵
  PID:5212
- C:\Windows\System32\mspaint.exe
  "C:\Windows\System32\mspaint.exe"
  2⤵
  PID:5268
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c gcc -o C:\Users\Admin\Desktop\monitorinvert55.exe C:\Users\Admin\Desktop\monitorinvert55.c && C:\Users\Admin\Desktop\monitorinvert55.exe
  2⤵
  PID:5332
- C:\Windows\System32\mspaint.exe
  "C:\Windows\System32\mspaint.exe"
  2⤵
  PID:5388
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c gcc -o C:\Users\Admin\Desktop\monitorinvert56.exe C:\Users\Admin\Desktop\monitorinvert56.c && C:\Users\Admin\Desktop\monitorinvert56.exe
  2⤵
  PID:5424
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:5544
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c gcc -o C:\Users\Admin\Desktop\monitorinvert57.exe C:\Users\Admin\Desktop\monitorinvert57.c && C:\Users\Admin\Desktop\monitorinvert57.exe
  2⤵
  PID:4248
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:5580
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c gcc -o C:\Users\Admin\Desktop\monitorinvert58.exe C:\Users\Admin\Desktop\monitorinvert58.c && C:\Users\Admin\Desktop\monitorinvert58.exe
  2⤵
  PID:5612
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:5676
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c gcc -o C:\Users\Admin\Desktop\monitorinvert59.exe C:\Users\Admin\Desktop\monitorinvert59.c && C:\Users\Admin\Desktop\monitorinvert59.exe
  2⤵
  PID:5732
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:1096
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c gcc -o C:\Users\Admin\Desktop\monitorinvert60.exe C:\Users\Admin\Desktop\monitorinvert60.c && C:\Users\Admin\Desktop\monitorinvert60.exe
  2⤵
  PID:5844
- C:\Windows\System32\mspaint.exe
  "C:\Windows\System32\mspaint.exe"
  2⤵
  PID:5972
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c gcc -o C:\Users\Admin\Desktop\monitorinvert61.exe C:\Users\Admin\Desktop\monitorinvert61.c && C:\Users\Admin\Desktop\monitorinvert61.exe
  2⤵
  PID:6000
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:6108
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c gcc -o C:\Users\Admin\Desktop\monitorinvert62.exe C:\Users\Admin\Desktop\monitorinvert62.c && C:\Users\Admin\Desktop\monitorinvert62.exe
  2⤵
  PID:6128
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:5276
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c gcc -o C:\Users\Admin\Desktop\monitorinvert63.exe C:\Users\Admin\Desktop\monitorinvert63.c && C:\Users\Admin\Desktop\monitorinvert63.exe
  2⤵
  PID:5224
- C:\Windows\System32\mspaint.exe
  "C:\Windows\System32\mspaint.exe"
  2⤵
  PID:5368
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c gcc -o C:\Users\Admin\Desktop\monitorinvert64.exe C:\Users\Admin\Desktop\monitorinvert64.c && C:\Users\Admin\Desktop\monitorinvert64.exe
  2⤵
  PID:5404
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:5536
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c gcc -o C:\Users\Admin\Desktop\monitorinvert65.exe C:\Users\Admin\Desktop\monitorinvert65.c && C:\Users\Admin\Desktop\monitorinvert65.exe
  2⤵
  PID:5588
- C:\Windows\System32\mspaint.exe
  "C:\Windows\System32\mspaint.exe"
  2⤵
  PID:1232
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c gcc -o C:\Users\Admin\Desktop\monitorinvert66.exe C:\Users\Admin\Desktop\monitorinvert66.c && C:\Users\Admin\Desktop\monitorinvert66.exe
  2⤵
  PID:5612
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:5796
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c gcc -o C:\Users\Admin\Desktop\monitorinvert67.exe C:\Users\Admin\Desktop\monitorinvert67.c && C:\Users\Admin\Desktop\monitorinvert67.exe
  2⤵
  PID:5892

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:4452

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\89670b75e7104550b4bff18135fe5fc7 /t 3304 /p 3300
1⤵
PID:3980

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3692 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:8
1⤵
PID:5004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Desktop\monitorinvert5.c

Filesize
360B

MD5
35f471e11ba09bfc6a170e9a330deb02

SHA1
fbe4ed700d64c1ee4c9772c5b0a4b2eeeb50d142

SHA256
98fb0fd77d984fbac74c06dd264dd1a345185a85364358b0193198784db4368a

SHA512
6e6ff53d3611e58460a3c663e2bb37948eea10ba0ac44844d01658f5e934bb60fa6e4959e292a9986275473c02805e7d4821be8f57015bf8aea92dccc276c009

Download Submit
C:\Windows\Debug\WIA\wiatrace.log

Filesize
70KB

MD5
ccddb1fd547bf8824c48938f63cdf5fb

SHA1
9297e8fb95576c68a9bf56e5b8e2716c7a45807a

SHA256
844dd42e6d025be428227a9865488849114b90e6a03e1a3f9ac1c9fd94b7e648

SHA512
ca9af3ef9364f30bf54c0b406cb45dd592a05e31efc1ac141b934328c6994249d1d9a87b7b52508e6090b68a91830cc5bf3434cded53a8c000a6c18ebcf66cc5

Download Submit
C:\Windows\Debug\WIA\wiatrace.log

Filesize
6KB

MD5
0de9d15cc3a8c569909edc78a9ca8d7c

SHA1
9bcc0d59d98a9a50cc07b25c1f6740a1bb7a9100

SHA256
46a58dc726ff044e903209824bfa8896c60154118c69f1ec2bcff3a29e4c2a02

SHA512
f98f5a7741d8cef2d52b6c55627923d3f28897681fc9064d85327b8114041689f9949176ba627b131b06794cb6f688812fd978fa3fd0fb72132e38cd1455557a

Download Submit
C:\Windows\Debug\WIA\wiatrace.log

Filesize
73KB

MD5
8a93afeabdf8a04d7cb8e0001b437911

SHA1
b4c5dc528dd50c296e10f65fbb77d0428ec17b94

SHA256
77c770b9fa40a78a2c850795cdf5e9a32c56929dc614cf7832f5fd271fd05d33

SHA512
4cc6be1faa31c59553ce19b14172e7cac2fb1580c0eac4b4b1ca043c27d1eacacce8191a815255576b07f9039dce4420eff5b14e385ea1b62955b72426e057a5

Download Submit
C:\Windows\Debug\WIA\wiatrace.log

Filesize
7KB

MD5
0770466869fc275a30b136e0bdd1a850

SHA1
719d918163da60a83c32f67cc9e5d85dc6500368

SHA256
cdfbeaf3b7824f4e2144a717934f733fe2cc07f0b793000c1a1848fc0e337e66

SHA512
99018885c6381d8f094b0ee7440c9df701aa5eaf93b6cf467767682a587b9260b59bf022a92742f6316bf88e4c134360eb676854a85ceaac14eeea61543994a2

Download Submit
C:\Windows\Debug\WIA\wiatrace.log

Filesize
9KB

MD5
aff17056da23735c8e039f02f5aae65a

SHA1
95d4728b3cbcf3f9aa73255f45ad14b34a5b60bd

SHA256
73bdc87373fe12cea7e6d40c6de1436152c6c67dc5ad2b471947e762885778a1

SHA512
d54f6ecf2e2abcc8aa3037abf420dd8339545d89bbdcc234615d45b1842ed0aae7771c17967072eebd2061332f6b02ca4547e1f7fb9acca80d893b3f245d23df

Download Submit
C:\Windows\Debug\WIA\wiatrace.log

Filesize
10KB

MD5
f7831ad13bd2266e41561771d10d2373

SHA1
1467cfb8e55c6000070562e12348a5c532723bce

SHA256
458ea108b9614aace0e58673424085b7011619e1c51d858ae455ea0a68f366ae

SHA512
8acefab02c427943f3a14dd02c837a7ac105f62d65ea4e61904621e352abd97b74b2ead5c32c6bbfccd254da067fe639200d76a29358ed6031065ae24fb3ea21

Download Submit
C:\Windows\Debug\WIA\wiatrace.log

Filesize
12KB

MD5
fa495ebe5edee4975824802aaf86fbed

SHA1
0fbe0db873a9ef2c9722cbd6a5f31c9707e0eeec

SHA256
2dea9d6512eff9197125eecf8cd946ef5b14d37b399a9265dd72c1dce8a28445

SHA512
86f4d2e4dcb2876f5f03dbb9762e406de6869b888d4d7360dada08fcc960aae56745c81dfb1c98b4f1bd45094ec4d1c5c07c636026192f09a3e38c1309134d3c

Download Submit
C:\Windows\Debug\WIA\wiatrace.log

Filesize
13KB

MD5
6a166443f137c6b032795ea393a84f62

SHA1
71951e70a0bb9445447e89751f0539c3c2c0ba97

SHA256
2b5a2867d9c93dfe90a695922c076228f989593884c9174ee3ca4f7879902e98

SHA512
4854c7780c2f6c31b6abf12ed78d1e2725d9876922977fb6d53bc995b853040442b2d86c3162e191e7b659d422cbea6cbc25e8516387fa98961eae8f1a921d4c

Download Submit
C:\Windows\Debug\WIA\wiatrace.log

Filesize
15KB

MD5
96a82fafdc451443b7c8c582bcb03508

SHA1
55911d94d68244767e1a6ac158592fc28b3158e1

SHA256
24dbe54a4ac6663b73c2f0e816b50a5780ea348c096d8d77e947f0aa64f9913c

SHA512
00e30264fe173e59ba55b62d02af97c377688de8bee88782d7b18ca8c80e219a37ee3d96746c47bbb3fd6c215524c6860843434c35c6e6ed7f0873f893744b3d

Download Submit
C:\Windows\Debug\WIA\wiatrace.log

Filesize
16KB

MD5
b70f1e4309f014edd78582ba69ab7918

SHA1
914c6d21085ef6b0c792d10ce80475bb4c8374a3

SHA256
8713b085b2220ce502459ffc73ee2f92f8e7f6f18bf9b2b82156944479e43220

SHA512
857365ae840e423887abe4767c335f2eccd162cc30b0b7a69576a09120cc4ff1d2662e2f2fc8a9433bea00c7cd37e0b58900a827489a0b5ab0393f97d2b770ad

Download Submit
C:\Windows\Debug\WIA\wiatrace.log

Filesize
1KB

MD5
94ef6929dd7aeac24be6214c1f1035ae

SHA1
40c9b1fb09585b591a23553a0e03f5799ba945f3

SHA256
ffafc1ee98f480c3a379ecf423d16ff30f6d4f2fb7181e2070da368b4581c3d3

SHA512
73a9d458475fd1308eb6ce398518dad36a8ae9303be38257556e8f94f373c02be003300f2def4ea134eebf073bf56b006cb89bbcc445fa248d4cea87210b0c86

Download Submit
C:\Windows\Debug\WIA\wiatrace.log

Filesize
38KB

MD5
b22f876b9ba4e87df273113483787416

SHA1
6a7b7b7be74cdf6b13afb5c31f1546bc0e3e6b20

SHA256
ded1cf140a7eb09345da26a32a7240f531f0c8f694937d6572454ab794e48d23

SHA512
bc30f1f51c9ff2197d8f56a5a4b9bad474633b4822e65c3f7149ad71333a5b041a0fbed24bea3b63719ea370da40005dc1df8506c290a1af59029895f6871199

Download Submit
C:\Windows\Debug\WIA\wiatrace.log

Filesize
40KB

MD5
47d3e8e1fa94991d8606871952c2e31a

SHA1
a0db6f71a71b5304df27eeb60bcbbd0d42fc5d17

SHA256
3968ad4ac1fed72c0c0ee4298796d21ca7002e80da17064720354ae194b0c0b3

SHA512
88b6dfded96f19087d7505eae61b8c366e880909a388e22d70659aedc8a9b0f11e41cc187ed41d757a6ff61508cf1865ad4466276b2b94c86d7388c5cda2676a

Download Submit
C:\Windows\Debug\WIA\wiatrace.log

Filesize
41KB

MD5
0c6a3d0e5329ba23446305c8923f9723

SHA1
788c8d8f26d3ab138ae5f7af35fb3271a32eb2e2

SHA256
6143ab5501d518d87218e59f7fea00ae55601e8f82b71cd94938532c2c5f722e

SHA512
b200e62860af7ca674652c46e92b6b149db6d77cc6238e35f9a1b736fc37f68b2742acfd1c63169f1a0a23caf4501c25c176ceac67f9eb23b6956b1bfd77f8c7

Download Submit
C:\Windows\Debug\WIA\wiatrace.log

Filesize
43KB

MD5
9fa7d0ac9498143b3e4cbd78e01fa01d

SHA1
2fe184d0cf45903997670ced57ffb341d3734edb

SHA256
d8f57dd7b8912a2f82c4df7c7005d95391885833186e31095ac13a2b9a1d2d96

SHA512
6ebc3898a26712179b6b0e6fa78a3459ba51ac104e0ab5ba647e3c715eb91a97aac86d397b40fdff05067fbe5e024550e709a8550ca3bb0de0339596e371c957

Download Submit
C:\Windows\Debug\WIA\wiatrace.log

Filesize
44KB

MD5
55ffa13b4df9cd7c14ff529d6df788f1

SHA1
235b90f8907cc1a06f06a63c573b0e5989213cfb

SHA256
51d58e8170a4edc0b7accd6230238b44fdd5ad39a935684ddc81bab735351619

SHA512
e2aca87556463f644df0925cc9082ef184731d3b7986174fd584c78f3cf3c1da8d4dfe6c84bb7f7fd5e27af1cd922a44587935ad02e9867331018ef39b0f7b68

Download Submit
C:\Windows\Debug\WIA\wiatrace.log

Filesize
46KB

MD5
39a5435ecab809342bbebefeb8e3346c

SHA1
f408ad5831b685d98e0abfc3a3a710e8fe84eefe

SHA256
a82d052c4e3d13e5b9378529f6b158c43bfadda46d3836165f35f271eb4e8b1b

SHA512
62a0eba7f32a22d49e4bea6af66b8714a66e2e29dcbc963afa921078acb71a84f16b0ccefd71fe92dab748e1b969d106bdcfa4f81f52454fc82be2b34081e94c

Download Submit
C:\Windows\Debug\WIA\wiatrace.log

Filesize
47KB

MD5
687fb4f7b0c03de407cee8840ff4d1df

SHA1
2a997b9fa70fe17e91e63446544d2076933c369a

SHA256
4dddd8845972ddc071ac242cc57bc1f1763a9fb9981fda200dfe2c832513c983

SHA512
1fd9a0bd6d87d2e2ef5e809e4eeead35f35c0ca2d9e8cd6853c0f749a6b277a1b686427fbcde01d0f0ea6c37d8e88939fa9fc991f92a5c23cab935fdd15a258f

Download Submit
C:\Windows\Debug\WIA\wiatrace.log

Filesize
49KB

MD5
06650e6c3830169ad2f3b7d9cd8766cd

SHA1
c0845b95dbb05ebd2336547d43832e166303cbb1

SHA256
54ce752c2187b798f4422cf7d4c019f2e813792da677fae855a1fda3d5a2001d

SHA512
44a9480ab6923780840cd46ce69bf044f70a4b315e24935ae9c93add8923afcc658d031da3c91fc78fa6af81da07796339ee94adbc43d878ed428c21a3e9a98e

Download Submit
C:\Windows\Debug\WIA\wiatrace.log

Filesize
52KB

MD5
7d406950dd1c8f840c599898d14c6be5

SHA1
0f44982b4c698fbb9865e56f5835984ec3863089

SHA256
5ba55a7a5c345bb1c774165f25e7521e1dbadb7dad8ac552633c6d1bf2c62e9b

SHA512
5731e4539545d7907fdb69c845a084f19dbbb8f5bdf448e142b65b1712fb30e405908564368f6035e560fc4a51248086babad69a624ef8990354535d4aac89ec

Download Submit
C:\Windows\Debug\WIA\wiatrace.log

Filesize
55KB

MD5
7ce0350069b1aa1206cea8af7f77351d

SHA1
c1738575d32e610174582f4f5767ed56551499bc

SHA256
c3897c912b0b4e60a1f2fc7ba953824abb99d7796ffb2644d13ccaaf46071041

SHA512
91b351810c7b20b420a45f092f0f0f12580cb284f81fb32ed1d34332f5562b4c0d4c4fc4ef4d33e82fd85f77580bf2f7085137f17764010623076060080c7e74

Download Submit
C:\Windows\Debug\WIA\wiatrace.log

Filesize
57KB

MD5
960a1540dfa871d3704623c6091d144c

SHA1
ebb1e9c8622f807c9b65b36cd4de3d78405a83e7

SHA256
bf1e2a00ddf79aaefe84104a2b557462ea7f53de2c6195906ae9b57ad6204695

SHA512
b9036766833a51687275dc564e1759b5a92bf4616eeae8fa39d9dd2044d9fb7ba340f92fac1568dc2dd1349b7f3d3530d8c48ac3661aca3d16b6e7b49b46cd71

Download Submit
C:\Windows\Debug\WIA\wiatrace.log

Filesize
58KB

MD5
800e594e2e5bfdfa20741bae0fee387f

SHA1
e3e5d5779f79feb55eb0091dd83162e80c49fbd8

SHA256
c17d2676f325cf91677b0cf13101eed9c2249814b50cfe19eb723d96324ff5f0

SHA512
3ccc2bb3101675b9e8ab2653179b6291fa8331cd3140f6aa63f585b581c9c699ca68d479635eb40a0f7e4efbe24226416d18f0c54c1dc8f8dd142304dc382601

Download Submit
C:\Windows\Debug\WIA\wiatrace.log

Filesize
4KB

MD5
121bf66fd1a1439f240fc7154e835eb6

SHA1
3a9cca6fae0608a576037664d853d4f4100677e0

SHA256
5d3ab537ac2a8f3b71b8abf3ed403d11342467e1bb1704d96a9dd0e29175e3a2

SHA512
6051b352cf33072c9559c15f4c15d5fe931508c15b5f5a100c3671a98e2473219743d1793a8782ae4dc4e8208905e422a51166f7184acd27f7b71f6d1da94e5b

Download Submit
C:\Windows\Debug\WIA\wiatrace.log

Filesize
60KB

MD5
610ed94025b1a91f8c7679065c97ede6

SHA1
35276e20ac252a1b84dd5aa4857f0c6f8facc643

SHA256
38d27398082d0284822fbeb1a3eac369cb234ec30698a894d8e8e26761ee530a

SHA512
d79a19d5ebd004a47fcb9b9b46aaad650325e69cebaaf47e1bf12cc968b2155c80a82fd8d5a0109db410327842033af18fcfc7ba0e94972ae49f6ee319938de0

Download Submit
C:\Windows\Debug\WIA\wiatrace.log

Filesize
63KB

MD5
ccb667aa475c3673055b9f14355aa50b

SHA1
289dc8becb0376201dc93c271fff3c3509bd0b2f

SHA256
3a46927adfc2d399eb30f70a98410b8cdc0de5fe155587d879d7ef62bd5969fc

SHA512
7698267c7eb911035f6a7f0e67b0dc1e961b9acb9e43403b9a18d493da7ad652fdca0fc3936f146e14936fe08e027111d4d184691402758e412fe9563c4ca74f

Download Submit
C:\Windows\Debug\WIA\wiatrace.log

Filesize
63KB

MD5
6a444799732260d8dcdfb74e38e5d398

SHA1
221027ac8fee3cd96a40591624e58c510bab2e5c

SHA256
ccbf5cf5c2acc1caeaf7412506ec612c277c68313bd2ec248fa7982b74630cc2

SHA512
db7563aff67915e142e2d430b60bf725a510bad56dc35f73efc45e678c71ce4e8d1a951f460368d7488bced792371f8e7562fcc8f0991cb93748fcd0f8240036

Download Submit
C:\Windows\Debug\WIA\wiatrace.log

Filesize
64KB

MD5
ea4e365b593f74cdad686716448a4a0e

SHA1
679ca7901b32b822d5664b73f85dad48660f33dc

SHA256
d17e8bbb0c5fbe8cc2e3e2e209b2985322ff8259af81914bed00153a2bdf63a3

SHA512
c0d487af88877efd08485ade7f7bacec1ec8d499299d0906fcbf49a651e7dd4c99c6083e597203b41f1e1845b79b31167f632ed14d4893c8ebbd165f77725f78

Download Submit
C:\Windows\Debug\WIA\wiatrace.log

Filesize
66KB

MD5
df0a2c1dc85922ffc6234051422a1cb9

SHA1
41b3518f3c461232c95109f44b89eac56c10c562

SHA256
908e2f887494a1e01bbf618244fa8ea1d54b89935036da6bc056098b1b3fa9be

SHA512
7da451f0971815e0e9cb21d8dcf6d5e53d56256c772daae8346211fd4d4bead6b4e1c6a7a4cde66c471ddcdd9f858f3fa17d91a4acd5331f9e21ad762a05a096

Download Submit
C:\Windows\Debug\WIA\wiatrace.log

Filesize
67KB

MD5
8f9fedfc486756c34c74da50c67999be

SHA1
0f88efb0c96ec7b02fd917cbfee76b7b4436d996

SHA256
33207ada68c0ef31515c3538f456df75f8b040d3e22cd91bbb5aa6224f780786

SHA512
6fe60f13ee3b38a3273c6dcdaf9003a4d84569fbcb48b623923b8f8cd52f4582a8ca16dda6ff49ded89b943334de14cf7a38903c81a45963614a950d17908525

Download Submit
C:\Windows\debug\WIA\wiatrace.log

Filesize
36KB

MD5
64dddb058c7777c60b517b9b91100c41

SHA1
c1313ddcd1cb64821b72971a8c4d8c9a1ca83539

SHA256
231878e5b53740209638aa458652966f62da41a443456e8d998ac7f5bd75ffbb

SHA512
5fab50704b825d0f814ab9579a0e1d8872c033459daba661808b2347d38051a70eb04332530e7af209a9e61c59c6ced86fea0f3bfbded03d8675515949141c47

Download Submit