52c01c7aeee30b32a84169a67aaf209252acd27d115cbc69330f5097da3778fc

Analysis

max time kernel
117s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
27-12-2024 18:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

reakcja.exe
Size

39.9MB
MD5

be5a895b5dba9fff017cccd58c09f664
SHA1

d607399d5214be29a0c1219fa38c3465bd763ef7
SHA256

52c01c7aeee30b32a84169a67aaf209252acd27d115cbc69330f5097da3778fc
SHA512

ba3813c62a6699e71a3f78a546c23297aff39590ea7881f297cd065dd6a671f294ac4ddce46e548b25226a18443742f4ec357f7db616058964794617f4bf364d
SSDEEP

786432:SddQtsRPJBqdUUTLJHddQiLP2j6+s7LWB75zupiPJVEEe3MGYdycP1iXDlUC:kdQt6P/RUTdHdpP2qHWB75ioPkE8MGAE

Score

10^/10

Malware Config

Signatures

Suspicious use of NtCreateProcessExOtherParentProcess 4 IoCs

description	pid	Process	procid_target
PID 3396 created 860	3396	taskmgr.exe	84
PID 3396 created 860	3396	taskmgr.exe	84
PID 3396 created 3268	3396	taskmgr.exe	122
PID 3396 created 3268	3396	taskmgr.exe	122

Loads dropped DLL 64 IoCs

pid	Process
860	reakcja.exe
860	reakcja.exe
860	reakcja.exe
860	reakcja.exe
860	reakcja.exe
860	reakcja.exe
860	reakcja.exe
860	reakcja.exe
860	reakcja.exe
860	reakcja.exe
860	reakcja.exe
860	reakcja.exe
860	reakcja.exe
860	reakcja.exe
860	reakcja.exe
860	reakcja.exe
860	reakcja.exe
860	reakcja.exe
860	reakcja.exe
860	reakcja.exe
860	reakcja.exe
860	reakcja.exe
860	reakcja.exe
860	reakcja.exe
860	reakcja.exe
860	reakcja.exe
860	reakcja.exe
860	reakcja.exe
860	reakcja.exe
860	reakcja.exe
860	reakcja.exe
860	reakcja.exe
860	reakcja.exe
860	reakcja.exe
860	reakcja.exe
860	reakcja.exe
860	reakcja.exe
860	reakcja.exe
860	reakcja.exe
860	reakcja.exe
860	reakcja.exe
860	reakcja.exe
860	reakcja.exe
860	reakcja.exe
860	reakcja.exe
860	reakcja.exe
860	reakcja.exe
860	reakcja.exe
860	reakcja.exe
860	reakcja.exe
860	reakcja.exe
860	reakcja.exe
860	reakcja.exe
860	reakcja.exe
860	reakcja.exe
860	reakcja.exe
860	reakcja.exe
860	reakcja.exe
860	reakcja.exe
860	reakcja.exe
860	reakcja.exe
860	reakcja.exe
860	reakcja.exe
860	reakcja.exe

Drops file in System32 directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jcp	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jtx	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00001.jrs	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00002.jrs	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.log	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSStmp.log	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.jfm	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat	svchost.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe

Checks SCSI registry key(s) 3 TTPs 47 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	reakcja.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	reakcja.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	PaintStudio.View.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	PaintStudio.View.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	reakcja.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	reakcja.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	PaintStudio.View.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	PaintStudio.View.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	reakcja.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	reakcja.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	PaintStudio.View.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	reakcja.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	reakcja.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	PaintStudio.View.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe

Modifies registry class 17 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CacheVersion = "1"	PaintStudio.View.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:"	PaintStudio.View.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings	PaintStudio.View.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Extensible Cache	PaintStudio.View.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Content\CachePrefix	PaintStudio.View.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	mspaint.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\History\CacheLimit = "1"	PaintStudio.View.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Cookies	PaintStudio.View.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	PaintStudio.View.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache	PaintStudio.View.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Content	PaintStudio.View.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Content\CacheVersion = "1"	PaintStudio.View.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\History	PaintStudio.View.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\History\CacheVersion = "1"	PaintStudio.View.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\MuiCache	PaintStudio.View.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Content\CacheLimit = "51200"	PaintStudio.View.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CacheLimit = "1"	PaintStudio.View.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
2208	vlc.exe
2372	PaintStudio.View.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
4280	mspaint.exe
4280	mspaint.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
2208	vlc.exe
4256	OpenWith.exe
3396	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: 33	2784	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2784	AUDIODG.EXE
Token: SeDebugPrivilege	3396	taskmgr.exe
Token: SeSystemProfilePrivilege	3396	taskmgr.exe
Token: SeCreateGlobalPrivilege	3396	taskmgr.exe
Token: 33	2208	vlc.exe
Token: SeIncBasePriorityPrivilege	2208	vlc.exe
Token: SeDebugPrivilege	2372	PaintStudio.View.exe
Token: SeDebugPrivilege	2372	PaintStudio.View.exe
Token: SeDebugPrivilege	2372	PaintStudio.View.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
2208	vlc.exe
2208	vlc.exe
2208	vlc.exe
2208	vlc.exe
2208	vlc.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
2208	vlc.exe
2208	vlc.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
2208	vlc.exe
2208	vlc.exe
2208	vlc.exe
2208	vlc.exe
3396	taskmgr.exe
3396	taskmgr.exe
3396	taskmgr.exe
2208	vlc.exe
2208	vlc.exe
2208	vlc.exe
2208	vlc.exe

Suspicious use of SetWindowsHookEx 11 IoCs

pid	Process
860	reakcja.exe
2208	vlc.exe
3268	reakcja.exe
4280	mspaint.exe
4256	OpenWith.exe
2816	mspaint.exe
2816	mspaint.exe
2816	mspaint.exe
2816	mspaint.exe
2860	mspaint.exe
2372	PaintStudio.View.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4280 wrote to memory of 860	4280	reakcja.exe	84
PID 4280 wrote to memory of 860	4280	reakcja.exe	84
PID 860 wrote to memory of 2152	860	reakcja.exe	85
PID 860 wrote to memory of 2152	860	reakcja.exe	85
PID 5024 wrote to memory of 3268	5024	reakcja.exe	122
PID 5024 wrote to memory of 3268	5024	reakcja.exe	122
PID 3268 wrote to memory of 1016	3268	reakcja.exe	123
PID 3268 wrote to memory of 1016	3268	reakcja.exe	123

C:\Users\Admin\AppData\Local\Temp\reakcja.exe
"C:\Users\Admin\AppData\Local\Temp\reakcja.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4280
- C:\Users\Admin\AppData\Local\Temp\reakcja.exe
  "C:\Users\Admin\AppData\Local\Temp\reakcja.exe"
  2⤵
  - Loads dropped DLL
  - Checks SCSI registry key(s)
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:860
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:2152

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x464 0x500
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2784

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3396

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\acceea3cd8f04f44bab4fa9fccf3a77d /t 864 /p 860
1⤵
PID:3976

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4552

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\ciemno.mp3"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2208

C:\Users\Admin\AppData\Local\Temp\reakcja.exe
"C:\Users\Admin\AppData\Local\Temp\reakcja.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5024
- C:\Users\Admin\AppData\Local\Temp\reakcja.exe
  "C:\Users\Admin\AppData\Local\Temp\reakcja.exe"
  2⤵
  - Checks SCSI registry key(s)
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3268
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:1016

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\reaction.png" /ForceBootstrapPaint3D
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4280

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s DsSvc
1⤵
- Drops file in System32 directory
PID:1780

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4256

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\reaction.png"
1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:2816

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:2304

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\reaction_prepped.png" /ForceBootstrapPaint3D
1⤵
- Suspicious use of SetWindowsHookEx
PID:2860

C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe
"C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe"
1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2372

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\a504693be06040f98935c2e611bed259 /t 4536 /p 3268
1⤵
PID:4880

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Packages\Microsoft.MSPaint_8wekyb3d8bbwe\LocalState\Projects\Projects.json

Filesize
250B

MD5
346bd55eba37966f44ec34e18a04eaba

SHA1
b6c1c2b88db3efccac88b1143dee8760edee26fe

SHA256
36c555d8ad482bdbc15aaaefaa511e46b2b8acbf5077bc14876f480da53d796a

SHA512
0ed80567bda5a0ee13045dac532c6f9f58b72cd3dde62efd46e2d372e11c95797f0b41554f3f391a208e20c203e75d8016a0f8407f1a53ff20559cde0f7f6653

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MSPaint_8wekyb3d8bbwe\LocalState\cloudCommunitySettings.json

Filesize
2KB

MD5
f4e4a03ebd0ab3a953c56a300d61d223

SHA1
97a9acf22c3bdd6989d7c120c21077c4d5a9a80e

SHA256
52bfb22aa2d7b0ce083d312fb8fa8dcda3063207186f99fc259aebd9064cbedc

SHA512
12aa71eea45720a4d7d057da0b662635671e4cd165ad2e0d30a3d2a43950b47dd60c26c1bbbe049418f815850e571b8d93e4c8b8cbbd686abc3cf7926ba719c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI42802\VCRUNTIME140.dll

Filesize
96KB

MD5
f12681a472b9dd04a812e16096514974

SHA1
6fd102eb3e0b0e6eef08118d71f28702d1a9067c

SHA256
d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8

SHA512
7d3accbf84de73fb0c5c0de812a9ed600d39cd7ed0f99527ca86a57ce63f48765a370e913e3a46ffc2ccd48ee07d823dafdd157710eef9e7cc1eb7505dc323a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI42802\_bz2.pyd

Filesize
81KB

MD5
4101128e19134a4733028cfaafc2f3bb

SHA1
66c18b0406201c3cfbba6e239ab9ee3dbb3be07d

SHA256
5843872d5e2b08f138a71fe9ba94813afee59c8b48166d4a8eb0f606107a7e80

SHA512
4f2fc415026d7fd71c5018bc2ffdf37a5b835a417b9e5017261849e36d65375715bae148ce8f9649f9d807a63ac09d0fb270e4abae83dfa371d129953a5422ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI42802\_ctypes.pyd

Filesize
120KB

MD5
6a9ca97c039d9bbb7abf40b53c851198

SHA1
01bcbd134a76ccd4f3badb5f4056abedcff60734

SHA256
e662d2b35bb48c5f3432bde79c0d20313238af800968ba0faa6ea7e7e5ef4535

SHA512
dedf7f98afc0a94a248f12e4c4ca01b412da45b926da3f9c4cbc1d2cbb98c8899f43f5884b1bf1f0b941edaeef65612ea17438e67745962ff13761300910960d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI42802\_lzma.pyd

Filesize
154KB

MD5
337b0e65a856568778e25660f77bc80a

SHA1
4d9e921feaee5fa70181eba99054ffa7b6c9bb3f

SHA256
613de58e4a9a80eff8f8bc45c350a6eaebf89f85ffd2d7e3b0b266bf0888a60a

SHA512
19e6da02d9d25ccef06c843b9f429e6b598667270631febe99a0d12fc12d5da4fb242973a8351d3bf169f60d2e17fe821ad692038c793ce69dfb66a42211398e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI42802\api-ms-win-core-console-l1-1-0.dll

Filesize
20KB

MD5
39852d24acf76cf0b3a427f46663efdf

SHA1
92b9730c276c6f2a46e583fc815374c823e6098b

SHA256
191e08dea0ad5ac02e7e84669d9fffa5aa67dc696e36077c5fa20d81c80b6a56

SHA512
e6f0898871b769244818d93117fe3cb82cc8f12bb24d6b3406ffcaa2a26f0b5754246b5c739e9cbcf07cb94aabba2fd934e7054607b4086b2f4c5592607e8385

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI42802\api-ms-win-core-datetime-l1-1-0.dll

Filesize
20KB

MD5
b71c18f8966cead654800ff402c6520f

SHA1
a6f658ea85ad754cf571f7b67f3360d5417f94bd

SHA256
a94b80a5111aabefb1309609abdd300bb626d861cd8e0938b9735ab711a43c22

SHA512
17867aaa57542c1cd989ca3000f3d93bbb959eb5a69100c70c694bde10db8f8422d3e86e1a5fc0848677e4343c424013cdf496b8bb685f8875c3330271242369

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI42802\api-ms-win-core-debug-l1-1-0.dll

Filesize
20KB

MD5
a998282826d6091984d7d5f0bf476a31

SHA1
b958281ad7b861e0adcbeb0033932057082ae4fc

SHA256
263e038363527b7bed05110f37f7e5b95f82aab9c0280c9c522cf7bfce10fd7d

SHA512
ba46b6e7649cded62e9c097c29d42a8ea3da52109d285b8ed7aaea9a93c203efcfd856d25cee9bd825c0835b37a1d7a37a8ae55e0e10dc237f0da7013056cf5d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI42802\api-ms-win-core-errorhandling-l1-1-0.dll

Filesize
20KB

MD5
c148a26d3d9d39777dabe28dc08cee60

SHA1
4f7537ba8cee5ff774f8d7c3fe4174fc512b70d4

SHA256
085968d938ea924827c4740697713674850218a8fe91dd9982e93b0effacc820

SHA512
6689dfb19898f420632295fb9982668919011784278dc6840716c91ca8dcb434057096640a15fab7a93edf722530451da274d02bb344cd429388412ad11a79e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI42802\api-ms-win-core-fibers-l1-1-0.dll

Filesize
20KB

MD5
ee3f0d24e7e32e661ac407c60b84b7db

SHA1
09107fb9ace59a1ac3a8b8dbb4ff00b91182929b

SHA256
c86ebc9f48e2db659e80d9c7ad5f29e6b6c850eea58813c041baeff496ae4f18

SHA512
c3fbba7fad4fe03a3a763ad86681655f1bb04d6dd9f64c0083aaa0262ce18f82970365532337825d44ec92b3d79b3212817b25f188537a3771807ad17e7f8d05

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI42802\api-ms-win-core-file-l1-1-0.dll

Filesize
24KB

MD5
e933cdd91fd5725873f57532f262f815

SHA1
e48f6f301a03beb5e57a0727a09e7c28a68e19f3

SHA256
120c3afed9ce2a981c61208757fca0665f43926751ec8d0d13e10ef1096a0d48

SHA512
d1c598f964a98a30c6a4926f6b19f8213884224861c36aba839f5a91acefaa8c0e8b3d7cd555103885520432a343b489044e4ad3a1c33d77cf3fda4493eb48fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI42802\api-ms-win-core-file-l1-2-0.dll

Filesize
20KB

MD5
b59d773b0848785a76baba82d3f775fa

SHA1
1b8dcd7f0e2ab0ba9ba302aa4e9c4bfa8da74a82

SHA256
0dc1f695befddb8ee52a308801410f2f1d115fc70668131075c2dbcfa0b6f9a0

SHA512
cbd52ed8a7471187d74367aa03bf097d9eac3e0d6dc64baf835744a09da0b050537ea6092dcb8b1e0365427e7f27315be2145c6f853ef936755ad07ef17d4a26

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI42802\api-ms-win-core-file-l2-1-0.dll

Filesize
20KB

MD5
4c9bf992ae40c7460a029b1046a7fb5e

SHA1
79e13947af1d603c964cce3b225306cadff4058b

SHA256
18655793b4d489f769327e3c8710aced6b763c7873b6a8dc5ae6f28d228647f4

SHA512
c36d455ac79a73758f6090977c204764a88e929e8eaa7ce27a9c9920451c014e84ae98beb447e8345a8fa186b8c668b076c0ed27047a0e23ad2eeaf2cbc3a8d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI42802\api-ms-win-core-handle-l1-1-0.dll

Filesize
20KB

MD5
f90e3b45c7942e3e30ecf1505253b289

SHA1
83beec2358de70268bc2e26ed0a1290aaef93f94

SHA256
7e45a1b997331f4d038f847f205904d6ec703df7a8c5c660435697e318ced8fc

SHA512
676450eb70a5ceae1820a978412ef3df746f14790322122b2de3e18ef013802c27867ad315950fc9b711e66f36628b062e57a7ec44d1ddc06f443655383cdc14

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI42802\api-ms-win-core-heap-l1-1-0.dll

Filesize
20KB

MD5
f2c267153db0182cca23038fc1cbf16a

SHA1
10d701ab952cacbf802615b0b458bc4d1a629042

SHA256
dd1e8c77002685629c5cd569ee17f9aa2bcb2e59d41b76ae5bc751cae26d75bf

SHA512
84f3c587be5a91752eeffd4f8e5ded74877930515fd9f4d48021b0f22a32feb3a4ddb9a0f14748e817f8c648bd307942ec026fc67eea922247499b5f412b4914

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI42802\api-ms-win-core-interlocked-l1-1-0.dll

Filesize
20KB

MD5
5f2e21c4f0be6a9e15c8ddc2ecdd7089

SHA1
1282b65a9b7276679366fe88c55fab442c0cc3a1

SHA256
ea60d03a35ef2c50306dbbd1ad408c714b1548035c615359af5a7ce8c0bd14a8

SHA512
a32c5ed72d4bfda60b2259e5982e42a79040225a4877246f3a645e05bfb8be395555fa22b2f0ed884f5fd82a8021bba85637727544c9adbb3a8c97b80e7a30f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI42802\api-ms-win-core-libraryloader-l1-1-0.dll

Filesize
20KB

MD5
7b828554daa24f54275b81dfa54e0c62

SHA1
03fa109c21c0dc2e847117de133a68c6cd891555

SHA256
929298566ba01d1c3e64356a1f8370c1e97f0599f56f823c508cde9ae17f130b

SHA512
1f4f030d4a1cd3f98ba628dee873978b3797a4a7db66615fc484270a2b3fa68f231d9d12142840cfb52d7592c1ae7af6e35ae7a410878774a9fb199d7a647985

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI42802\api-ms-win-core-localization-l1-2-0.dll

Filesize
20KB

MD5
9d8e7a90dd0d54b7ccde435b977ee46d

SHA1
15cd12089c63f4147648856b16193cf014e6764f

SHA256
dc570708327c4c8419d4cced2a162d7ca112a168301134dd1fb5e2040eee45b6

SHA512
339fe195602355bce26a2526613a212271e7f8c7518d591b9e3c795c154d93b29b8c524b2c3678c799d0ea0101eabea918564e49def0b915af0619e975f1c34b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI42802\api-ms-win-core-memory-l1-1-0.dll

Filesize
20KB

MD5
e56f2d05d147add31d6f89bcd1f008ca

SHA1
dde258c7b42b17363bca53b5554a5e13ea056f80

SHA256
8a4b66cea7b474506fbdbe4c45e78923645f5f0a13f7f4e43449649f50ea38b8

SHA512
9fd1afd32fda24a92af4bb24661f7cf791cc6686b65f13dae97c56a1e83b25f0f2710c77167e6a9a491001877a0712c9a011833bb6026e08ae536744f0b40905

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI42802\api-ms-win-core-namedpipe-l1-1-0.dll

Filesize
20KB

MD5
f08cd348ac935ac60436ac4cb1836203

SHA1
fd0608e704677fd4733296c2577647057541f392

SHA256
e8382a73730c2f7f873b40e2fcc5e1cd4847e7cb42fef3c76bea183af5891d65

SHA512
595e08301a0cbfd4f943ea3555dbce27d37b16c340b6972b054097b889285bbf942cc0314797a714a2e393956075c5dd95a5d2c2d4bde143b5f5387793e7a8de

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI42802\api-ms-win-core-processenvironment-l1-1-0.dll

Filesize
20KB

MD5
88916eed5164cb8884ebba842cd540cc

SHA1
f15674fbfef5b09cc02c924336554c17b715db00

SHA256
9c1afc7cd0b0e0d136d09b65dd082ace136fc306f8f116f3d13956211ec146c8

SHA512
2929c3ab67b364a7caf6c8fe1a42309917a0620f36c5d7194ca8a41ab7703a564ded32a4f9291a4f8fdd7d3a35383715fd8bef10ff603554b95519d109469617

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI42802\api-ms-win-core-processthreads-l1-1-0.dll

Filesize
20KB

MD5
42e99c89e241f21bf2fb20f3ff477eba

SHA1
e3b0012cd6d74f0ac2bf0c34997a87333c895834

SHA256
6e5bd110a2f4dc345b68e9a8fb081783586c8c25f46027c58443ade2d3e1bf01

SHA512
8eed3b21695cccae0dbf2db844efa11ad4957cd7bcd6c8ab7cfd4f0653bbacfd6bedd82ac27c3995f6418ae38ed0b8d46afa0bdfc627c16619aab775c5f8da16

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI42802\api-ms-win-core-processthreads-l1-1-1.dll

Filesize
20KB

MD5
d399c926466f044f183faa723ba59120

SHA1
a9534b4910888d70eefba6fcc3376f2549cb4a05

SHA256
19b018be16afe143fb107ef1dd5b8e6c6cb45966806eb3d31ec09ff0dc2b70d1

SHA512
fc55f4cfe7c6c63e0720971d920c5c6ead4db74a671f7bb8dc830aa87cb54459a62e974456875bdfda449d82a0acb368e3b6c2cc20c32b1b407e8de7cc532057

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI42802\api-ms-win-core-profile-l1-1-0.dll

Filesize
20KB

MD5
7b746cda44a5773455c455690ba26a4f

SHA1
d6ff8a5ac6c71e0b037236fad32f9bbecfc68aec

SHA256
cc3c609193f2e99f80a6a21064d10c5c591101e386338879326775ccdd77dcb6

SHA512
25fd04facb3ddabbcb0265cd7a306d6c159ac6419a3e2ff4de7bb9fe41eb9a1e3afecea6558771b9e4b3f912227dda65021822fbe1ab52d7dcf6cd115bea84f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI42802\api-ms-win-core-rtlsupport-l1-1-0.dll

Filesize
20KB

MD5
d6fc6c9da69334221c5438f5c7444336

SHA1
ac385fee49c6a4f7ff918fa93ef3324e71943505

SHA256
bcb9a6dd2cc0caaa700d95fa3af5163a8246388c2efefbbc4cf6e1fe2687c72e

SHA512
646d23590974acf8ea523018b97d994df4d760500c5bbddc9d6bcbb5c0fc5665b82b40b49b7636050b83269aea4fa802b3be016a02403fe189cbe72fc1de0ed5

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI42802\api-ms-win-core-string-l1-1-0.dll

Filesize
20KB

MD5
82fa7c54d034123805b57c96a5bced7f

SHA1
bbc6ebffbf21996f187345b7e28b9dfeca31829e

SHA256
9b071b842445a5dd90148445af148d024674085927d079864f7893807fd1b305

SHA512
715b2e794b2c2af5cdec22653d569ed33cf91bc092fae49449111cf7450385d1e5a1c713feac231bcedfa12fab7af57005c53f7721330400aef7c17dabddafff

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI42802\api-ms-win-core-synch-l1-1-0.dll

Filesize
20KB

MD5
6dbc816b9aef0f91b57bfc9a3ab18972

SHA1
e88cb7a5955630d29d24d2f05f540403ed9498e3

SHA256
a981a24c9231e0230031bb1cba8f2509565ece1f53ebdb4d0a50efd722ab4330

SHA512
bfb4cfc89eb8b1409a826e59699f2c3f4af765f114281bb30026dad02d2353ca95ec3b544f522833e657be4cf69b1070dc9bd3767b7a6014c2cbacba38c023e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI42802\api-ms-win-core-synch-l1-2-0.dll

Filesize
20KB

MD5
da5d400ade0d2288b17dcc11ed339e25

SHA1
f4a340079477a2c91e091968fe2d252cb01eeae2

SHA256
69dd52caffe1ea6e0900fb9604a57a87618f8468dc68cbb2a9bcefd1265f3f49

SHA512
3bfa3b4f93a0a68e1c0ac17c74c91c0a01b779961af4811756223fd1f47a86ce1f3ebd7ee4190a2edb84a50b1b444318965cad3a74d1ed4acfa014d0f5bbe34a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI42802\api-ms-win-core-sysinfo-l1-1-0.dll

Filesize
20KB

MD5
6971c41c21eb35668520f0bb949b3742

SHA1
5de3a45c15afb7c2038dc7fc0d29275b7fb90a36

SHA256
3513cffa44c88ec13d6a8c9b63e5d505a131b46746d13ee654144f08a96f20c3

SHA512
dd9914f547d5c34efd0f2879ebffd2d3ec9daf7465dffb7644ae0f4bc05f9f75df8b49ca8d692a8de7a92854a1b44c81e6f1b15ee691bf1995a1da76d3c3b82a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI42802\api-ms-win-core-timezone-l1-1-0.dll

Filesize
20KB

MD5
ea5f768b9a1664884ae4ae62cec90678

SHA1
ae08e80431da7f4e8f1e5457c255cc360ef1cac0

SHA256
24f4530debf2161e0d0256f923b836aeccc3278a6ff2c9400e415600276b5a6d

SHA512
411db31e994ebbc69971972e45d6e51186d8f8790e8c67660b6a846e48a5a5c53a113916a5a15d14c33d8c88037d7f252135e699cb526c4bb3b5abd2e2dfee7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI42802\api-ms-win-core-util-l1-1-0.dll

Filesize
20KB

MD5
7fcf9a2588c1372d6104333a4cfc4603

SHA1
8c1ea131a30178c4f250d0cef254557fded0d132

SHA256
2e1cc12f93837a4e1fe95e0c640b147be29793705628f9c6cd91a0b5c0c50262

SHA512
2fb84dcedfeddbf41109dbadb59ede86ceeb168db08955dbf9395fab7a18941cc7313bcb47cb31cfd2978540e9beed346044e6c5b5defa61f59b9b78535e784b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI42802\api-ms-win-crt-conio-l1-1-0.dll

Filesize
20KB

MD5
a5daf7d2dd7d447196f5aa65c3b48755

SHA1
847c75d74be334298a8cdb414905cad66bbf0b49

SHA256
1368b9af85f186a2b35e2a744eb2103555234b32fdfbfdb94c0f5e525c588e46

SHA512
32b1463dee8cbc4ccb5296b22281e014f432887eec07773e41477ecebbd1fb85087ff6adc6b7ac68d5fee818f3289daceb2817881bdbe2838cc104d2166a9607

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI42802\api-ms-win-crt-convert-l1-1-0.dll

Filesize
24KB

MD5
cf95a8f66313283f046ba9e6e5cdbba4

SHA1
b25c686fcc6729a88a8776cdb75ff21cbceb1c5d

SHA256
2ccb01b62188ddc051a582c128bf880608111c602534e487ec09a7cf67c22d17

SHA512
59f5901e513aceeeb819c73c5b9fe2504e80af28df54db19775d7c0e0481f14c21ce38e6db207672cc10facfdd217638829af2d3f0f85a0a413d10e3a81dae9c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI42802\api-ms-win-crt-environment-l1-1-0.dll

Filesize
20KB

MD5
71407c52ff12b113cc0498fdd42db8dc

SHA1
f0c6a3c1308177b090b2a94fee90156e1df6bb9b

SHA256
5a2ae5b270c1eaf467878e7f5dbdc689b71914bdf30293d7d46c01d9dd11bdd4

SHA512
b9bb29d76a144c10b234835b6006637c84103abeb8f5db19991f3ab2baaabe3ea3fc1a87132263d097addd01afcad08e77c9834dccd4c6723b3ca204f50aac1e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI42802\api-ms-win-crt-filesystem-l1-1-0.dll

Filesize
20KB

MD5
bbbf361746440219a3f7933ced5234bb

SHA1
1e3ededaa28e41f51e903c2ca66e7bd048fbaee7

SHA256
42a99227775e85ca8c197811a86aad0e2af496bd21623e4c9a2dd747571c8990

SHA512
f6681875bc02903676cd3ea3303920202c563a1a6e82dd687ed9bd0fafe92c9abba4a6df3e9c93f2bb0da9dccf0abb4543b6a5e5f0c92fa06e809b30b84085aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI42802\api-ms-win-crt-heap-l1-1-0.dll

Filesize
20KB

MD5
bacc491eb1dee4786ade841e7b480cd8

SHA1
84cb8f770cdf873415403edf48e625514aecad02

SHA256
43c80120970be1efed3ea60bf7aa37b46fcce946b94fb11ca6e3ffff2f16bb29

SHA512
7832912f38cd6ba145af57548c2a1d4da3bed9392a0ab3a0faffe18fab40087e1d74676e2af004627a37f7e079b9146dccf7aaa04e360a88443196fede4ccadc

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI42802\api-ms-win-crt-locale-l1-1-0.dll

Filesize
20KB

MD5
fb992bbb73e0127c70d075f81e52aaf9

SHA1
e9d326d436e2e55c521261ad9a5b73d2e998f644

SHA256
6011ece89f4833dcb4cefb02ea366b828725205eae6f25ab704b76fd9e5d86eb

SHA512
f568898a660c3850998b71a854fb5b8ffee59f02ebe7bc8c12ad9bc68f5472a0c812cf0a8ebc096fcc462e941a86a2a46619d4f03030e7ab69a0e4a9e7b1e0b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI42802\api-ms-win-crt-math-l1-1-0.dll

Filesize
28KB

MD5
0936c89e36a8bac313de187e50c61078

SHA1
7f0e64a66301e1926fa9acdc36ad728958ce6d78

SHA256
5ba8f9c2842990ccdb447fc6d22023103b03f5387f341d3375809f060b5bb4ef

SHA512
a72fcadc55d12c97770f1222bb3b605b7d58157f6f55814d900fe0f1b5ff8075f84914c7ac66d4b0e59ef41c01504a35c391bfb182e2e9019d152037ef4ec20f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI42802\api-ms-win-crt-multibyte-l1-1-0.dll

Filesize
28KB

MD5
2e75ba5bc87963d4244ae9bac3457466

SHA1
a624f1eb6ae3b7ee01fee889e65e0d7a4253ffa8

SHA256
77328a716589be3c3bcf1f3d3134b4ad050380f504dbc1a3fa076380d77ed0f8

SHA512
c3ab9bd515a52aa19767f0cbe5efdc4a8d145bda959ae13eb3e587c1c20d05c9b3563dc2665699b597d34da0593f8a324d197c1407abaad8118d0d599f5279fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI42802\api-ms-win-crt-private-l1-1-0.dll

Filesize
72KB

MD5
1514e6309fc716b9d9447ecde164931a

SHA1
fe05f8158feeb241a5541a627f54d74868b167f4

SHA256
0e2751637bbeb7ccc2556194fa774ea4bcb937ea803fc955c7f10be0bf38cc77

SHA512
09e3047b56c43413593d2ec4ee30e273d63ec25f049b3c345371262268b5b05ab3c62eb3ce52a37bdd6c6ae86a0a8538f23d9e6498f7fea669b17164f8b54272

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI42802\api-ms-win-crt-process-l1-1-0.dll

Filesize
20KB

MD5
437e85738168dd8a2894005b01451001

SHA1
49b20fdc8e6287e684af3877352408bfea71a624

SHA256
cfc12dd7c1deabf35c8e0fbe01248171c49555fe2d1bed72c5fdba2102090870

SHA512
025148a7278c06e20d00fb0287d0168d4c367bef21ea8334f746b094250e488711cdb5780f8e08ebf501784b151c4bbe8caca925f7b7268f3324dfd9f49e5612

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI42802\api-ms-win-crt-runtime-l1-1-0.dll

Filesize
24KB

MD5
01380df01b9e61fc241f82f8fb984c2d

SHA1
18f92390b292af0db8aaa7c7e6f6aa24463f9b84

SHA256
698fa887c5b994375c9271222e21d0d4c74810e73d377ad898927549fb69dcb3

SHA512
743d45fae759d8ff3ef862ffa70584696824b86991f262ddc897f6f469fbb4264cf7da3fe001f33c6305523753d37a7a64874c5010cc7fe63252c53cd96b06f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI42802\api-ms-win-crt-stdio-l1-1-0.dll

Filesize
24KB

MD5
a3f3ffcde3dd59cc94fb7dba16715671

SHA1
bbf272dab014d4cde1a57831a2daf4fde03b4884

SHA256
c1541ed4dc6879a136bf532393f7cefd3c48ad371d2ed9965e7cbd44c87a1137

SHA512
0e323b44b4ed7959c5f6409e565707e6e402382c950d2a0fc18d18f56ab588a49a260c99ecbda1bdb3778be131fb71b1b1158d852981e2e86d0b989b05496e02

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI42802\api-ms-win-crt-string-l1-1-0.dll

Filesize
24KB

MD5
535d1195f493f7d92fe9007258494ebc

SHA1
1bf95ec546a6c1a8832d9002b7cd01265a1bbdad

SHA256
4429b8e6707645fb503ebc3bd50ce2a84f559b6a2ed778196835808bdfec2f48

SHA512
cd47f34032fc59a89dd286115db2cc2d1918f6ecc069fa37d2295126876fc5c931d6272892fb22db5eff1f810de818e64e6140617786a4d3fb153fd80c107468

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI42802\api-ms-win-crt-time-l1-1-0.dll

Filesize
20KB

MD5
ed44b4aac3c881a9bc524d15ae3f3944

SHA1
a87983d6c714aac9242bb60037864139863b1848

SHA256
f3e6f692cec86adb3985b929345c731469777aeaeb088e3ce070957df481f924

SHA512
25513c666f228365ce7e092782a92fb7eb144f6b3293f896b08317c36323006ba10f4133bbfdadd2576053c1d6ac0e28cc3ad5798b92eec34fc8fa36e8d83047

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI42802\api-ms-win-crt-utility-l1-1-0.dll

Filesize
20KB

MD5
e79464524fbc2c266da52d0a903d85d3

SHA1
6bad715617992277751a8ddfc180ba291ba75d59

SHA256
6c78d4aba91877c5bb33e545b6a69a818f377e07ff62e791b804fa5b4d2bcf02

SHA512
def71789e238ecd3b2d68dbd204acc62537ad39ce50a5bf09f320fc8cacc1b3f561822784d006ab2145eab5ab7be3f74c1c773fbe814efa040a1dbb3ffa6744e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI42802\base_library.zip

Filesize
1.4MB

MD5
16d6ef6a17d768b2f153e840a9c4ffdb

SHA1
96d1dd256d8b92a7115208777b696eb091f68024

SHA256
4eecbf4c87102b8a675b0fc486853588b97c079de3eec53cec85423cb319dca2

SHA512
a17676f3f1333dcfdbb68823765b5abca1d09bc7891805fdcc159e064d2d55bdab3c6a8fd23bd0619dc0ba8fa6ca186d1a1cc2594262b520dccb9038ce3dedca

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI42802\freetype.dll

Filesize
639KB

MD5
236f879a5dd26dc7c118d43396444b1c

SHA1
5ed3e4e084471cf8600fb5e8c54e11a254914278

SHA256
1c487392d6d06970ba3c7b52705881f1fb069f607243499276c2f0c033c7df6f

SHA512
cc9326bf1ae8bf574a4715158eba889d7f0d5e3818e6f57395740a4b593567204d6eef95b6e99d2717128c3bffa34a8031c213ff3f2a05741e1eaf3ca07f2254

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI42802\libcrypto-1_1.dll

Filesize
3.3MB

MD5
6f4b8eb45a965372156086201207c81f

SHA1
8278f9539463f0a45009287f0516098cb7a15406

SHA256
976ce72efd0a8aeeb6e21ad441aa9138434314ea07f777432205947cdb149541

SHA512
2c5c54842aba9c82fb9e7594ae9e264ac3cbdc2cc1cd22263e9d77479b93636799d0f28235ac79937070e40b04a097c3ea3b7e0cd4376a95ed8ca90245b7891f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI42802\libffi-8.dll

Filesize
34KB

MD5
32d36d2b0719db2b739af803c5e1c2f5

SHA1
023c4f1159a2a05420f68daf939b9ac2b04ab082

SHA256
128a583e821e52b595eb4b3dda17697d3ca456ee72945f7ecce48ededad0e93c

SHA512
a0a68cfc2f96cb1afd29db185c940e9838b6d097d2591b0a2e66830dd500e8b9538d170125a00ee8c22b8251181b73518b73de94beeedd421d3e888564a111c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI42802\libjpeg-9.dll

Filesize
238KB

MD5
c540308d4a8e6289c40753fdd3e1c960

SHA1
1b84170212ca51970f794c967465ca7e84000d0e

SHA256
3a224af540c96574800f5e9acf64b2cdfb9060e727919ec14fbd187a9b5bfe69

SHA512
1dadc6b92de9af998f83faf216d2ab6483b2dea7cdea3387ac846e924adbf624f36f8093daf5cee6010fea7f3556a5e2fcac494dbc87b5a55ce564c9cd76f92b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI42802\libmodplug-1.dll

Filesize
259KB

MD5
ead020db018b03e63a64ebff14c77909

SHA1
89bb59ae2b3b8ec56416440642076ae7b977080e

SHA256
0c1a9032812ec4c20003a997423e67b71ecb5e59d62cdc18a5bf591176a9010e

SHA512
c4742d657e5598c606ceff29c0abb19c588ba7976a7c4bff1df80a3109fe7df25e7d0dace962ec3962a94d2715a4848f2acc997a0552bf8d893ff6e7a78857e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI42802\libogg-0.dll

Filesize
25KB

MD5
307ef797fc1af567101afba8f6ce6a8c

SHA1
0023f520f874a0c3eb3dc1fe8df73e71bde5f228

SHA256
57abc4f6a9accdd08bf9a2b022a66640cc626a5bd4dac6c7c4f06a5df61ee1fe

SHA512
5b0b6049844c6fef0cd2b6b1267130bb6e4c17b26afc898cfc17499ef05e79096cd705007a74578f11a218786119be37289290c5c47541090d7b9dea2908688e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI42802\python3.dll

Filesize
64KB

MD5
34e49bb1dfddf6037f0001d9aefe7d61

SHA1
a25a39dca11cdc195c9ecd49e95657a3e4fe3215

SHA256
4055d1b9e553b78c244143ab6b48151604003b39a9bf54879dee9175455c1281

SHA512
edb715654baaf499cf788bcacd5657adcf9f20b37b02671abe71bda334629344415ed3a7e95cb51164e66a7aa3ed4bf84acb05649ccd55e3f64036f3178b7856

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI42802\python311.dll

Filesize
5.5MB

MD5
9a24c8c35e4ac4b1597124c1dcbebe0f

SHA1
f59782a4923a30118b97e01a7f8db69b92d8382a

SHA256
a0cf640e756875c25c12b4a38ba5f2772e8e512036e2ac59eb8567bf05ffbfb7

SHA512
9d9336bf1f0d3bc9ce4a636a5f4e52c5f9487f51f00614fc4a34854a315ce7ea8be328153812dbd67c45c75001818fa63317eba15a6c9a024fa9f2cab163165b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI42802\ucrtbase.dll

Filesize
1.1MB

MD5
b0397bb83c9d579224e464eebf40a090

SHA1
81efdfe57225dfe581aafb930347535f08f2f4ce

SHA256
d2ebd8719455ae4634d00fd0d0eb0c3ad75054fee4ff545346a1524e5d7e3a66

SHA512
e72a4378ed93cfb3da60d69af8103a0dcb9a69a86ee42f004db29771b00a606fbc9cbc37f3daa155d1d5fe85f82c87ca9898a39c7274462fcf5c4420f0581ab3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50242\cryptography-41.0.7.dist-info\INSTALLER

Filesize
4B

MD5
365c9bfeb7d89244f2ce01c1de44cb85

SHA1
d7a03141d5d6b1e88b6b59ef08b6681df212c599

SHA256
ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508

SHA512
d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\ciemno.mp3

Filesize
5.7MB

MD5
ee2001d790d9c8f44b083d9da969932b

SHA1
e8e1d553df261e9a63f876db800b23482fee0118

SHA256
80852d6197050cabd151b0ce16a1493a22157374871774dc48e5cc94fb4acd4d

SHA512
b5fb4a8d1be0f4ded602e2a4b3e2f650a56b50f2705723a3a43d3b7c8618ed574745a9da57e45ff036e795e873dad5228b580726dafb063b2d02991407f2c180

Download Submit
C:\Users\Admin\AppData\Local\Temp\reaction_prepped.png

Filesize
311KB

MD5
26f39ede01c2312720c913d96ddc8bf3

SHA1
50cfc5ba77e7cb6c5f4adc8f01a69409600efaba

SHA256
f325b9f55100ad4f49460ddb345b5e87bd7624fb6ecf8415d3a1000ccb3c4a2e

SHA512
eee130c53d8cbefdb15c9a2debb644b4ecc1cca1fcbf9678e6f2926589480132fd469eaf824017096b29b3d78b0ced3c50982706d2cf8a4a509ee246bb73c946

Download Submit
memory/860-663-0x00007FF8DB410000-0x00007FF8DB67C000-memory.dmp

Filesize
2.4MB

Download
memory/860-1100-0x00007FF8DB410000-0x00007FF8DB67C000-memory.dmp

Filesize
2.4MB

Download
memory/860-1581-0x00007FF8DB410000-0x00007FF8DB67C000-memory.dmp

Filesize
2.4MB

Download
memory/1780-1960-0x000001EF99710000-0x000001EF99711000-memory.dmp

Filesize
4KB

Download
memory/1780-1947-0x000001EF90B60000-0x000001EF90B70000-memory.dmp

Filesize
64KB

Download
memory/1780-1968-0x000001EF997B0000-0x000001EF997B1000-memory.dmp

Filesize
4KB

Download
memory/1780-1966-0x000001EF997B0000-0x000001EF997B1000-memory.dmp

Filesize
4KB

Download
memory/1780-1963-0x000001EF997A0000-0x000001EF997A1000-memory.dmp

Filesize
4KB

Download
memory/1780-1964-0x000001EF997A0000-0x000001EF997A1000-memory.dmp

Filesize
4KB

Download
memory/1780-1962-0x000001EF99710000-0x000001EF99711000-memory.dmp

Filesize
4KB

Download
memory/1780-1957-0x000001EF99690000-0x000001EF99691000-memory.dmp

Filesize
4KB

Download
memory/1780-1943-0x000001EF903A0000-0x000001EF903B0000-memory.dmp

Filesize
64KB

Download
memory/2208-1643-0x00007FF8DA880000-0x00007FF8DAB36000-memory.dmp

Filesize
2.7MB

Download
memory/2208-1644-0x00007FF8D95C0000-0x00007FF8DA670000-memory.dmp

Filesize
16.7MB

Download
memory/2208-1641-0x00007FF7F27A0000-0x00007FF7F2898000-memory.dmp

Filesize
992KB

Download
memory/2208-1642-0x00007FF8EA720000-0x00007FF8EA754000-memory.dmp

Filesize
208KB

Download
memory/3268-2288-0x00007FF8D9E50000-0x00007FF8DA0BC000-memory.dmp

Filesize
2.4MB

Download
memory/3268-4620-0x00007FF8D9E50000-0x00007FF8DA0BC000-memory.dmp

Filesize
2.4MB

Download
memory/3268-4604-0x00007FF8D9E50000-0x00007FF8DA0BC000-memory.dmp

Filesize
2.4MB

Download
memory/3268-3991-0x00007FF8D9E50000-0x00007FF8DA0BC000-memory.dmp

Filesize
2.4MB

Download
memory/3268-3399-0x00007FF8D9E50000-0x00007FF8DA0BC000-memory.dmp

Filesize
2.4MB

Download
memory/3268-2854-0x00007FF8D9E50000-0x00007FF8DA0BC000-memory.dmp

Filesize
2.4MB

Download
memory/3396-987-0x000001BDC1B50000-0x000001BDC1B51000-memory.dmp

Filesize
4KB

Download
memory/3396-988-0x000001BDC1B50000-0x000001BDC1B51000-memory.dmp

Filesize
4KB

Download
memory/3396-997-0x000001BDC1B50000-0x000001BDC1B51000-memory.dmp

Filesize
4KB

Download
memory/3396-999-0x000001BDC1B50000-0x000001BDC1B51000-memory.dmp

Filesize
4KB

Download
memory/3396-1000-0x000001BDC1B50000-0x000001BDC1B51000-memory.dmp

Filesize
4KB

Download
memory/3396-995-0x000001BDC1B50000-0x000001BDC1B51000-memory.dmp

Filesize
4KB

Download
memory/3396-996-0x000001BDC1B50000-0x000001BDC1B51000-memory.dmp

Filesize
4KB

Download
memory/3396-998-0x000001BDC1B50000-0x000001BDC1B51000-memory.dmp

Filesize
4KB

Download
memory/3396-989-0x000001BDC1B50000-0x000001BDC1B51000-memory.dmp

Filesize
4KB

Download
memory/3396-994-0x000001BDC1B50000-0x000001BDC1B51000-memory.dmp

Filesize
4KB

Download