Analysis
- user interaction
yes - max time kernel
899s - max time network
433s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
05/07/2026, 17:43
Behavioral task
behavioral1
Sample
gimp.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
gimp.exe
Resource
win11ltsc2024-20260629-en
General
- Target gimp.exe
- Size 179.4MB
- Sample260705-warefsev9z
- SHA256 52cfa91801256c8e92b9975d89fac105034de08101f1f48f9c3e526c1467e99b
- MD5 9d56acc4bb9ba650ef95b56ec550fe87
- SHA1 0ffa727e03d48fcf10832bca2efebdc2c0c1aacb
- SHA512 22cc20d76de6726c1a5f5fcfd5a6ddb2328dbf3ff1e8d9be04ce33cf8373b342f49cc690ec3c85806ea9edb1d02de583dc2bc83d3a045f0993d5ba834c90936d
- SSDEEP 3145728:cs7ESxbTx6uzEwAVfxQRPl9W6AC6SiQ4sISN/mZJZbgx6pCqo68PfMR:cs7EYT8joPlZAC6JQ4sdN/KLBc/68P
- TLSH T16B9833FF82AD552AE039C1F429BD8406173F5C50A4830D067AE0F8E9DB276B4395E67E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe - Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\E: explorer.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Executes dropped EXE 64 IoCs
pid Process 3248 gimp.tmp 3336 gimp-3.exe 4056 gdbus.exe 4168 wia.exe 6096 web-browser.exe 3620 wavelet-decompose.exe 4080 warp.exe 96 van-gogh-lic.exe 4540 unit-editor.exe 3164 tile-small.exe 5156 tile.exe 2568 gimp-script-fu-interpreter-3.0.exe 1932 pythonw.exe 1240 sphere-designer.exe 5180 sparkle.exe 828 smooth-palette.exe 2032 selection-to-path.exe 4044 script-fu-server.exe 3112 script-fu.exe 1256 screenshot.exe 4184 sample-colorize.exe 5896 qbist.exe 2396 pythonw.exe 4964 pythonw.exe 5980 procedure-browser.exe 4008 print.exe 1308 plugin-browser.exe 5952 pythonw.exe 2972 pythonw.exe 4552 pythonw.exe 3520 pythonw.exe 1368 pagecurl.exe 5360 nl-filter.exe 1280 metadata-viewer.exe 820 metadata-editor.exe 1640 map-object.exe 5480 lighting.exe 4708 jigsaw.exe 2416 imagemap.exe 4476 ifs-compose.exe 3308 hot.exe 3688 pythonw.exe 2840 help.exe 3064 guillotine.exe 5112 grid.exe 1492 pythonw.exe 5200 gradient-map.exe 3060 gradient-flare.exe 5284 gimpressionist.exe 5736 gfig.exe 1572 fractal-explorer.exe 2872 pythonw.exe 5068 flame.exe 3676 filter-browser.exe 5856 film.exe 5332 file-xwd.exe 2720 file-xpm.exe 2632 file-xbm.exe 3192 file-wmf.exe 928 file-webp.exe 4796 file-wbmp.exe 3680 file-tim.exe 2688 file-tiff.exe 2568 file-tga.exe - Loads dropped DLL 64 IoCs
pid Process 3336 gimp-3.exe 3336 gimp-3.exe 3336 gimp-3.exe 3336 gimp-3.exe 3336 gimp-3.exe 3336 gimp-3.exe 3336 gimp-3.exe 3336 gimp-3.exe 3336 gimp-3.exe 3336 gimp-3.exe 3336 gimp-3.exe 3336 gimp-3.exe 3336 gimp-3.exe 3336 gimp-3.exe 3336 gimp-3.exe 3336 gimp-3.exe 3336 gimp-3.exe 3336 gimp-3.exe 3336 gimp-3.exe 3336 gimp-3.exe 3336 gimp-3.exe 3336 gimp-3.exe 3336 gimp-3.exe 3336 gimp-3.exe 3336 gimp-3.exe 3336 gimp-3.exe 3336 gimp-3.exe 3336 gimp-3.exe 3336 gimp-3.exe 3336 gimp-3.exe 3336 gimp-3.exe 3336 gimp-3.exe 3336 gimp-3.exe 3336 gimp-3.exe 3336 gimp-3.exe 3336 gimp-3.exe 3336 gimp-3.exe 3336 gimp-3.exe 3336 gimp-3.exe 3336 gimp-3.exe 3336 gimp-3.exe 3336 gimp-3.exe 3336 gimp-3.exe 3336 gimp-3.exe 3336 gimp-3.exe 3336 gimp-3.exe 3336 gimp-3.exe 3336 gimp-3.exe 3336 gimp-3.exe 3336 gimp-3.exe 3336 gimp-3.exe 3336 gimp-3.exe 3336 gimp-3.exe 3336 gimp-3.exe 3336 gimp-3.exe 3336 gimp-3.exe 3336 gimp-3.exe 3336 gimp-3.exe 3336 gimp-3.exe 3336 gimp-3.exe 3336 gimp-3.exe 3336 gimp-3.exe 3336 gimp-3.exe 3336 gimp-3.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language gimp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language gimp.tmp - Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
resource yara_rule behavioral2/memory/2732-1-0x0000000000970000-0x0000000000A74000-memory.dmp innosetup behavioral2/memory/2732-19-0x0000000000970000-0x0000000000A74000-memory.dmp innosetup behavioral2/memory/2732-18025-0x0000000000970000-0x0000000000A74000-memory.dmp innosetup - Checks SCSI registry key(s) 3 TTPs 62 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities explorer.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000\Software\Microsoft\Internet Explorer\Main explorer.exe - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\GIMP3.acbm\shell\open\command gimp.tmp Set value (str) \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\GIMP3.avci\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\GIMP 3\\bin\\gimp-3.exe\" \"%1\"" gimp.tmp Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\GIMP3.ham\shell\open\command gimp.tmp Set value (str) \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Applications\gimp-3.exe\SupportedTypes\.ham6 gimp.tmp Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\GIMP3.hej2\shell gimp.tmp Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\GIMP3.j2c\shell\open\command gimp.tmp Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\GIMP3.otb\DefaultIcon gimp.tmp Set value (str) \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\.pfm\OpenWithProgids\GIMP3.pfm gimp.tmp Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\GIMP3.dicom\shell\open\command gimp.tmp Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\GIMP3.ilbm\shell\open gimp.tmp Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\GIMP3.pbm\shell gimp.tmp Set value (str) \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\GIMP3.pfm\ = "GIMP 3.2.4 PFM" gimp.tmp Set value (str) \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\GIMP3.sun\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\GIMP 3\\bin\\gimp-3.exe\" \"%1\"" gimp.tmp Set value (str) \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Applications\gimp-3.exe\SupportedTypes\.mask gimp.tmp Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\GIMP3.png\DefaultIcon gimp.tmp Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\.psd gimp.tmp Set value (int) \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23" SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\.ilbm\OpenWithProgids\GIMP3.ilbm gimp.tmp Set value (str) \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Applications\gimp-3.exe\SupportedTypes\.dicom gimp.tmp Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\GIMP3.ff\shell\open gimp.tmp Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\.psp gimp.tmp Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\GIMP3.svg\shell gimp.tmp Set value (str) \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\GIMP3.svg\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\GIMP 3\\bin\\gimp-3.exe\" \"%1\"" gimp.tmp Set value (str) \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Applications\gimp-3.exe\SupportedTypes\.tif gimp.tmp Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Applications\gimp-3.exe\SupportedTypes gimp.tmp Set value (str) \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\GIMP3.jpc\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\GIMP 3\\bin\\gimp-3.exe\" \"%1\"" gimp.tmp Set value (str) \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\GIMP3.mask\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Programs\\GIMP 3\\bin\\gimp-3.exe,2" gimp.tmp Set value (str) \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\GIMP3.pix\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Programs\\GIMP 3\\bin\\gimp-3.exe,2" gimp.tmp Set value (str) \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\GIMP3.rs\ = "GIMP 3.2.4 RS" gimp.tmp Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\GIMP3.fli\shell\open\command gimp.tmp Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\GIMP3.hej2\shell\open\command gimp.tmp Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\GIMP3.bitmap\shell\open gimp.tmp Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\GIMP3.dicom\DefaultIcon gimp.tmp Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\.hgt gimp.tmp Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\GIMP3.iff\shell gimp.tmp Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\.otb\OpenWithProgids gimp.tmp Set value (str) \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\GIMP3.apng\ = "GIMP 3.2.4 APNG" gimp.tmp Set value (str) \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Applications\gimp-3.exe\SupportedTypes\.dcm gimp.tmp Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\.jpe gimp.tmp Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\.sfw gimp.tmp Set value (str) \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Applications\gimp-3.exe\SupportedTypes\.sgi gimp.tmp Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\.wbmp\OpenWithProgids gimp.tmp Set value (str) \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\GIMP3.heif\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\GIMP 3\\bin\\gimp-3.exe\" \"%1\"" gimp.tmp Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\GIMP3.jpc\shell\open gimp.tmp Set value (str) \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\GIMP3.rs\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Programs\\GIMP 3\\bin\\gimp-3.exe,2" gimp.tmp Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\.paa gimp.tmp Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\.ham8\OpenWithProgids gimp.tmp Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\GIMP3.ham8 gimp.tmp Set value (str) \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Applications\gimp-3.exe\SupportedTypes\.jpe gimp.tmp Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\GIMP3.dcm\DefaultIcon gimp.tmp Set value (str) \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\GIMP3.otb\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\GIMP 3\\bin\\gimp-3.exe\" \"%1\"" gimp.tmp Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\GIMP3.qoi\shell gimp.tmp Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\GIMP3.tif\shell\open\command gimp.tmp Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\GIMP3.vst\shell\open gimp.tmp Set value (str) \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Applications\gimp-3.exe\SupportedTypes\.alpha gimp.tmp Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\.dcx gimp.tmp Set value (str) \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\GIMP3.gif\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\GIMP 3\\bin\\gimp-3.exe\" \"%1\"" gimp.tmp Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\.ilbm\OpenWithProgids gimp.tmp Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\GIMP3.jp2\DefaultIcon gimp.tmp Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\GIMP3.heic gimp.tmp Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\GIMP3.heif\DefaultIcon gimp.tmp Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\GIMP3.jpg gimp.tmp Key created \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\GIMP3.pfm\shell\open\command gimp.tmp Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1991999443-3181470666-3272020885-1000\{FAC32458-BE00-4965-A000-AAD405E4099E} explorer.exe - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 3336 gimp-3.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 5236 explorer.exe 5236 explorer.exe 3248 gimp.tmp 3248 gimp.tmp - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 5236 explorer.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 5236 explorer.exe Token: SeCreatePagefilePrivilege 5236 explorer.exe Token: SeShutdownPrivilege 5236 explorer.exe Token: SeCreatePagefilePrivilege 5236 explorer.exe Token: SeShutdownPrivilege 5236 explorer.exe Token: SeCreatePagefilePrivilege 5236 explorer.exe Token: SeShutdownPrivilege 5236 explorer.exe Token: SeCreatePagefilePrivilege 5236 explorer.exe Token: SeShutdownPrivilege 5236 explorer.exe Token: SeCreatePagefilePrivilege 5236 explorer.exe Token: SeShutdownPrivilege 5236 explorer.exe Token: SeCreatePagefilePrivilege 5236 explorer.exe Token: SeShutdownPrivilege 5236 explorer.exe Token: SeCreatePagefilePrivilege 5236 explorer.exe Token: SeShutdownPrivilege 5236 explorer.exe Token: SeCreatePagefilePrivilege 5236 explorer.exe Token: SeShutdownPrivilege 5236 explorer.exe Token: SeCreatePagefilePrivilege 5236 explorer.exe Token: SeShutdownPrivilege 5236 explorer.exe Token: SeCreatePagefilePrivilege 5236 explorer.exe Token: SeShutdownPrivilege 5236 explorer.exe Token: SeCreatePagefilePrivilege 5236 explorer.exe Token: SeShutdownPrivilege 5236 explorer.exe Token: SeCreatePagefilePrivilege 5236 explorer.exe Token: SeShutdownPrivilege 5236 explorer.exe Token: SeCreatePagefilePrivilege 5236 explorer.exe Token: SeShutdownPrivilege 5236 explorer.exe Token: SeCreatePagefilePrivilege 5236 explorer.exe Token: SeShutdownPrivilege 5236 explorer.exe Token: SeCreatePagefilePrivilege 5236 explorer.exe Token: SeShutdownPrivilege 5236 explorer.exe Token: SeCreatePagefilePrivilege 5236 explorer.exe Token: SeShutdownPrivilege 5236 explorer.exe Token: SeCreatePagefilePrivilege 5236 explorer.exe Token: SeShutdownPrivilege 5236 explorer.exe Token: SeCreatePagefilePrivilege 5236 explorer.exe Token: SeShutdownPrivilege 5236 explorer.exe Token: SeCreatePagefilePrivilege 5236 explorer.exe Token: SeShutdownPrivilege 5236 explorer.exe Token: SeCreatePagefilePrivilege 5236 explorer.exe Token: SeShutdownPrivilege 5236 explorer.exe Token: SeCreatePagefilePrivilege 5236 explorer.exe Token: SeShutdownPrivilege 5236 explorer.exe Token: SeCreatePagefilePrivilege 5236 explorer.exe Token: SeShutdownPrivilege 5236 explorer.exe Token: SeCreatePagefilePrivilege 5236 explorer.exe Token: SeShutdownPrivilege 5236 explorer.exe Token: SeCreatePagefilePrivilege 5236 explorer.exe Token: SeShutdownPrivilege 5236 explorer.exe Token: SeCreatePagefilePrivilege 5236 explorer.exe Token: SeShutdownPrivilege 5236 explorer.exe Token: SeCreatePagefilePrivilege 5236 explorer.exe Token: SeShutdownPrivilege 5236 explorer.exe Token: SeCreatePagefilePrivilege 5236 explorer.exe Token: SeShutdownPrivilege 5236 explorer.exe Token: SeCreatePagefilePrivilege 5236 explorer.exe Token: SeShutdownPrivilege 5236 explorer.exe Token: SeCreatePagefilePrivilege 5236 explorer.exe Token: SeShutdownPrivilege 5236 explorer.exe Token: SeCreatePagefilePrivilege 5236 explorer.exe Token: SeShutdownPrivilege 5236 explorer.exe Token: SeCreatePagefilePrivilege 5236 explorer.exe Token: SeShutdownPrivilege 5236 explorer.exe Token: SeCreatePagefilePrivilege 5236 explorer.exe - Suspicious use of FindShellTrayWindow 54 IoCs
pid Process 4916 sihost.exe 5236 explorer.exe 5236 explorer.exe 5236 explorer.exe 5236 explorer.exe 5236 explorer.exe 5236 explorer.exe 5236 explorer.exe 5236 explorer.exe 5236 explorer.exe 5236 explorer.exe 5236 explorer.exe 5236 explorer.exe 5236 explorer.exe 5236 explorer.exe 5236 explorer.exe 5236 explorer.exe 5236 explorer.exe 5236 explorer.exe 5236 explorer.exe 5236 explorer.exe 5236 explorer.exe 5236 explorer.exe 5236 explorer.exe 5236 explorer.exe 5236 explorer.exe 5236 explorer.exe 5236 explorer.exe 5236 explorer.exe 5236 explorer.exe 5236 explorer.exe 5236 explorer.exe 5236 explorer.exe 5236 explorer.exe 5236 explorer.exe 5236 explorer.exe 5236 explorer.exe 5236 explorer.exe 5236 explorer.exe 5236 explorer.exe 5236 explorer.exe 5236 explorer.exe 5236 explorer.exe 5236 explorer.exe 5236 explorer.exe 5236 explorer.exe 5236 explorer.exe 5236 explorer.exe 5236 explorer.exe 5236 explorer.exe 5236 explorer.exe 5236 explorer.exe 5236 explorer.exe 3248 gimp.tmp - Suspicious use of SendNotifyMessage 62 IoCs
pid Process 5236 explorer.exe 5236 explorer.exe 5236 explorer.exe 5236 explorer.exe 5236 explorer.exe 5236 explorer.exe 5236 explorer.exe 5236 explorer.exe 5236 explorer.exe 5236 explorer.exe 5236 explorer.exe 5236 explorer.exe 5236 explorer.exe 5236 explorer.exe 5236 explorer.exe 5236 explorer.exe 5236 explorer.exe 5236 explorer.exe 5236 explorer.exe 5236 explorer.exe 5236 explorer.exe 5236 explorer.exe 5236 explorer.exe 5236 explorer.exe 5236 explorer.exe 5236 explorer.exe 5236 explorer.exe 5236 explorer.exe 5236 explorer.exe 5236 explorer.exe 5236 explorer.exe 5236 explorer.exe 5236 explorer.exe 5236 explorer.exe 5236 explorer.exe 5236 explorer.exe 5236 explorer.exe 5236 explorer.exe 5236 explorer.exe 5236 explorer.exe 5236 explorer.exe 5236 explorer.exe 5236 explorer.exe 5236 explorer.exe 5236 explorer.exe 5236 explorer.exe 5236 explorer.exe 5236 explorer.exe 5236 explorer.exe 5236 explorer.exe 5236 explorer.exe 5236 explorer.exe 5236 explorer.exe 5236 explorer.exe 5236 explorer.exe 5236 explorer.exe 5236 explorer.exe 5236 explorer.exe 5236 explorer.exe 5236 explorer.exe 5236 explorer.exe 5236 explorer.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 3248 gimp.tmp 3840 StartMenuExperienceHost.exe 5116 SearchHost.exe 5236 explorer.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2732 wrote to memory of 3248 2732 gimp.exe 87 PID 4916 wrote to memory of 5236 4916 sihost.exe 92 PID 3248 wrote to memory of 3336 3248 gimp.tmp 102 PID 3336 wrote to memory of 4056 3336 gimp-3.exe 103 PID 3336 wrote to memory of 4168 3336 gimp-3.exe 104 PID 3336 wrote to memory of 6096 3336 gimp-3.exe 105 PID 3336 wrote to memory of 3620 3336 gimp-3.exe 106 PID 3336 wrote to memory of 4080 3336 gimp-3.exe 107 PID 3336 wrote to memory of 96 3336 gimp-3.exe 108 PID 3336 wrote to memory of 4540 3336 gimp-3.exe 223 PID 3336 wrote to memory of 3164 3336 gimp-3.exe 110 PID 3336 wrote to memory of 5156 3336 gimp-3.exe 111 PID 3336 wrote to memory of 2568 3336 gimp-3.exe 164 PID 3336 wrote to memory of 1932 3336 gimp-3.exe 113 PID 3336 wrote to memory of 1240 3336 gimp-3.exe 114 PID 3336 wrote to memory of 5180 3336 gimp-3.exe 115 PID 3336 wrote to memory of 828 3336 gimp-3.exe 116 PID 3336 wrote to memory of 2032 3336 gimp-3.exe 117 PID 3336 wrote to memory of 4044 3336 gimp-3.exe 118 PID 3336 wrote to memory of 3112 3336 gimp-3.exe 119 PID 3336 wrote to memory of 1256 3336 gimp-3.exe 120 PID 3336 wrote to memory of 4184 3336 gimp-3.exe 121 PID 3336 wrote to memory of 5896 3336 gimp-3.exe 122 PID 3336 wrote to memory of 2396 3336 gimp-3.exe 123 PID 3336 wrote to memory of 4964 3336 gimp-3.exe 124 PID 3336 wrote to memory of 5980 3336 gimp-3.exe 125 PID 3336 wrote to memory of 4008 3336 gimp-3.exe 126 PID 3336 wrote to memory of 1308 3336 gimp-3.exe 179 PID 3336 wrote to memory of 5952 3336 gimp-3.exe 128 PID 3336 wrote to memory of 2972 3336 gimp-3.exe 129 PID 3336 wrote to memory of 4552 3336 gimp-3.exe 130 PID 3336 wrote to memory of 3520 3336 gimp-3.exe 131 PID 3336 wrote to memory of 1368 3336 gimp-3.exe 185 PID 3336 wrote to memory of 5360 3336 gimp-3.exe 186 PID 3336 wrote to memory of 1280 3336 gimp-3.exe 187 PID 3336 wrote to memory of 820 3336 gimp-3.exe 188 PID 3336 wrote to memory of 1640 3336 gimp-3.exe 136 PID 3336 wrote to memory of 5480 3336 gimp-3.exe 137 PID 3336 wrote to memory of 4708 3336 gimp-3.exe 138 PID 3336 wrote to memory of 2416 3336 gimp-3.exe 139 PID 3336 wrote to memory of 4476 3336 gimp-3.exe 140 PID 3336 wrote to memory of 3308 3336 gimp-3.exe 141 PID 3336 wrote to memory of 3688 3336 gimp-3.exe 142 PID 3336 wrote to memory of 2840 3336 gimp-3.exe 143 PID 3336 wrote to memory of 3064 3336 gimp-3.exe 144 PID 3336 wrote to memory of 5112 3336 gimp-3.exe 145 PID 3336 wrote to memory of 1492 3336 gimp-3.exe 146 PID 3336 wrote to memory of 5200 3336 gimp-3.exe 147 PID 3336 wrote to memory of 3060 3336 gimp-3.exe 148 PID 3336 wrote to memory of 5284 3336 gimp-3.exe 149 PID 3336 wrote to memory of 5736 3336 gimp-3.exe 150 PID 3336 wrote to memory of 1572 3336 gimp-3.exe 151 PID 3336 wrote to memory of 2872 3336 gimp-3.exe 152 PID 3336 wrote to memory of 5068 3336 gimp-3.exe 153 PID 3336 wrote to memory of 3676 3336 gimp-3.exe 154 PID 3336 wrote to memory of 5856 3336 gimp-3.exe 218 PID 3336 wrote to memory of 5332 3336 gimp-3.exe 156 PID 3336 wrote to memory of 2720 3336 gimp-3.exe 157 PID 3336 wrote to memory of 2632 3336 gimp-3.exe 222 PID 3336 wrote to memory of 3192 3336 gimp-3.exe 159 PID 3336 wrote to memory of 928 3336 gimp-3.exe 160 PID 3336 wrote to memory of 4796 3336 gimp-3.exe 161 PID 3336 wrote to memory of 3680 3336 gimp-3.exe 162 PID 3336 wrote to memory of 2688 3336 gimp-3.exe 163 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\gimp.exe"C:\Users\Admin\AppData\Local\Temp\gimp.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\is-AGI4V8Y8PZ.tmp\gimp.tmp"C:\Users\Admin\AppData\Local\Temp\is-AGI4V8Y8PZ.tmp\gimp.tmp" /SL5="$40210,184011737,1004544,C:\Users\Admin\AppData\Local\Temp\gimp.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\Users\Admin\AppData\Local\Programs\GIMP 3\bin\gimp-3.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\bin\gimp-3.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of WriteProcessMemory
PID:3336 -
C:\Users\Admin\AppData\Local\Programs\GIMP 3\bin\gdbus.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\bin\gdbus.exe" _win32_run_session_bus4⤵
- Executes dropped EXE
PID:4056
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\wia\wia.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\wia\wia.exe" -gimp 279 6 5 -query 04⤵
- Executes dropped EXE
PID:4168
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\web-browser\web-browser.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\web-browser\web-browser.exe" -gimp 279 5 4 -query 04⤵
- Executes dropped EXE
PID:6096
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\wavelet-decompose\wavelet-decompose.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\wavelet-decompose\wavelet-decompose.exe" -gimp 279 5 4 -query 04⤵
- Executes dropped EXE
PID:3620
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\warp\warp.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\warp\warp.exe" -gimp 279 5 4 -query 04⤵
- Executes dropped EXE
PID:4080
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\van-gogh-lic\van-gogh-lic.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\van-gogh-lic\van-gogh-lic.exe" -gimp 279 6 5 -query 04⤵
- Executes dropped EXE
PID:96
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\unit-editor\unit-editor.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\unit-editor\unit-editor.exe" -gimp 279 6 5 -query 04⤵
- Executes dropped EXE
PID:4540
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\tile-small\tile-small.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\tile-small\tile-small.exe" -gimp 279 5 4 -query 04⤵
- Executes dropped EXE
PID:3164
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\tile\tile.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\tile\tile.exe" -gimp 279 5 4 -query 04⤵
- Executes dropped EXE
PID:5156
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\bin\gimp-script-fu-interpreter-3.0.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\bin\gimp-script-fu-interpreter-3.0.exe" "C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\test-sphere-v3\test-sphere-v3.scm" -gimp 279 5 4 -query 04⤵
- Executes dropped EXE
PID:2568
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\bin\pythonw.exepythonw.exe "C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\spyro-plus\spyro-plus.py" -gimp 279 5 4 -query 04⤵
- Executes dropped EXE
PID:1932
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\sphere-designer\sphere-designer.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\sphere-designer\sphere-designer.exe" -gimp 279 5 4 -query 04⤵
- Executes dropped EXE
PID:1240
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\sparkle\sparkle.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\sparkle\sparkle.exe" -gimp 279 5 4 -query 04⤵
- Executes dropped EXE
PID:5180
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\smooth-palette\smooth-palette.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\smooth-palette\smooth-palette.exe" -gimp 279 5 4 -query 04⤵
- Executes dropped EXE
PID:828
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\selection-to-path\selection-to-path.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\selection-to-path\selection-to-path.exe" -gimp 279 5 4 -query 04⤵
- Executes dropped EXE
PID:2032
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\script-fu-server\script-fu-server.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\script-fu-server\script-fu-server.exe" -gimp 279 5 4 -query 04⤵
- Executes dropped EXE
PID:4044
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\script-fu\script-fu.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\script-fu\script-fu.exe" -gimp 279 5 4 -query 04⤵
- Executes dropped EXE
PID:3112
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\screenshot\screenshot.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\screenshot\screenshot.exe" -gimp 279 5 4 -query 04⤵
- Executes dropped EXE
PID:1256
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\sample-colorize\sample-colorize.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\sample-colorize\sample-colorize.exe" -gimp 279 5 4 -query 04⤵
- Executes dropped EXE
PID:4184
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\qbist\qbist.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\qbist\qbist.exe" -gimp 279 5 4 -query 04⤵
- Executes dropped EXE
PID:5896
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\bin\pythonw.exepythonw.exe "C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\python-eval\python-eval.py" -gimp 279 5 4 -query 04⤵
- Executes dropped EXE
PID:2396
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\bin\pythonw.exepythonw.exe "C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\python-console\python-console.py" -gimp 279 5 4 -query 04⤵
- Executes dropped EXE
PID:4964
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\procedure-browser\procedure-browser.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\procedure-browser\procedure-browser.exe" -gimp 279 5 4 -query 04⤵
- Executes dropped EXE
PID:5980
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\print\print.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\print\print.exe" -gimp 279 5 4 -query 04⤵
- Executes dropped EXE
PID:4008
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\plugin-browser\plugin-browser.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\plugin-browser\plugin-browser.exe" -gimp 279 5 4 -query 04⤵
- Executes dropped EXE
PID:1308
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\bin\pythonw.exepythonw.exe "C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\palette-to-gradient\palette-to-gradient.py" -gimp 279 5 4 -query 04⤵
- Executes dropped EXE
PID:5952
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\bin\pythonw.exepythonw.exe "C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\palette-sort\palette-sort.py" -gimp 279 5 4 -query 04⤵
- Executes dropped EXE
PID:2972
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\bin\pythonw.exepythonw.exe "C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\palette-offset\palette-offset.py" -gimp 279 5 4 -query 04⤵
- Executes dropped EXE
PID:4552
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\bin\pythonw.exepythonw.exe "C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\palette-export-as-kpl\palette-export-as-kpl.py" -gimp 279 5 4 -query 04⤵
- Executes dropped EXE
PID:3520
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\pagecurl\pagecurl.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\pagecurl\pagecurl.exe" -gimp 279 5 4 -query 04⤵
- Executes dropped EXE
PID:1368
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\nl-filter\nl-filter.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\nl-filter\nl-filter.exe" -gimp 279 5 4 -query 04⤵
- Executes dropped EXE
PID:5360
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\metadata-viewer\metadata-viewer.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\metadata-viewer\metadata-viewer.exe" -gimp 279 5 4 -query 04⤵
- Executes dropped EXE
PID:1280
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\metadata-editor\metadata-editor.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\metadata-editor\metadata-editor.exe" -gimp 279 5 4 -query 04⤵
- Executes dropped EXE
PID:820
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\map-object\map-object.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\map-object\map-object.exe" -gimp 279 5 4 -query 04⤵
- Executes dropped EXE
PID:1640
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\lighting\lighting.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\lighting\lighting.exe" -gimp 279 5 4 -query 04⤵
- Executes dropped EXE
PID:5480
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\jigsaw\jigsaw.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\jigsaw\jigsaw.exe" -gimp 279 5 4 -query 04⤵
- Executes dropped EXE
PID:4708
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\imagemap\imagemap.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\imagemap\imagemap.exe" -gimp 279 5 4 -query 04⤵
- Executes dropped EXE
PID:2416
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\ifs-compose\ifs-compose.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\ifs-compose\ifs-compose.exe" -gimp 279 5 4 -query 04⤵
- Executes dropped EXE
PID:4476
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\hot\hot.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\hot\hot.exe" -gimp 279 5 4 -query 04⤵
- Executes dropped EXE
PID:3308
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\bin\pythonw.exepythonw.exe "C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\histogram-export\histogram-export.py" -gimp 279 5 4 -query 04⤵
- Executes dropped EXE
PID:3688
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\help\help.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\help\help.exe" -gimp 279 5 4 -query 04⤵
- Executes dropped EXE
PID:2840
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\guillotine\guillotine.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\guillotine\guillotine.exe" -gimp 279 5 4 -query 04⤵
- Executes dropped EXE
PID:3064
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\grid\grid.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\grid\grid.exe" -gimp 279 5 4 -query 04⤵
- Executes dropped EXE
PID:5112
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\bin\pythonw.exepythonw.exe "C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\gradients-save-as-css\gradients-save-as-css.py" -gimp 279 5 4 -query 04⤵
- Executes dropped EXE
PID:1492
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\gradient-map\gradient-map.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\gradient-map\gradient-map.exe" -gimp 279 5 4 -query 04⤵
- Executes dropped EXE
PID:5200
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\gradient-flare\gradient-flare.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\gradient-flare\gradient-flare.exe" -gimp 279 5 4 -query 04⤵
- Executes dropped EXE
PID:3060
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\gimpressionist\gimpressionist.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\gimpressionist\gimpressionist.exe" -gimp 279 5 4 -query 04⤵
- Executes dropped EXE
PID:5284
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\gfig\gfig.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\gfig\gfig.exe" -gimp 279 5 4 -query 04⤵
- Executes dropped EXE
PID:5736
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\fractal-explorer\fractal-explorer.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\fractal-explorer\fractal-explorer.exe" -gimp 279 5 4 -query 04⤵
- Executes dropped EXE
PID:1572
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\bin\pythonw.exepythonw.exe "C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\foggify\foggify.py" -gimp 279 5 4 -query 04⤵
- Executes dropped EXE
PID:2872
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\flame\flame.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\flame\flame.exe" -gimp 279 5 4 -query 04⤵
- Executes dropped EXE
PID:5068
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\filter-browser\filter-browser.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\filter-browser\filter-browser.exe" -gimp 279 5 4 -query 04⤵
- Executes dropped EXE
PID:3676
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\film\film.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\film\film.exe" -gimp 279 5 4 -query 04⤵
- Executes dropped EXE
PID:5856
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-xwd\file-xwd.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-xwd\file-xwd.exe" -gimp 279 5 4 -query 04⤵
- Executes dropped EXE
PID:5332
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-xpm\file-xpm.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-xpm\file-xpm.exe" -gimp 279 5 4 -query 04⤵
- Executes dropped EXE
PID:2720
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-xbm\file-xbm.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-xbm\file-xbm.exe" -gimp 279 5 4 -query 04⤵
- Executes dropped EXE
PID:2632
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-wmf\file-wmf.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-wmf\file-wmf.exe" -gimp 279 5 4 -query 04⤵
- Executes dropped EXE
PID:3192
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-webp\file-webp.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-webp\file-webp.exe" -gimp 279 5 4 -query 04⤵
- Executes dropped EXE
PID:928
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-wbmp\file-wbmp.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-wbmp\file-wbmp.exe" -gimp 279 5 4 -query 04⤵
- Executes dropped EXE
PID:4796
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-tim\file-tim.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-tim\file-tim.exe" -gimp 279 5 4 -query 04⤵
- Executes dropped EXE
PID:3680
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-tiff\file-tiff.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-tiff\file-tiff.exe" -gimp 279 5 4 -query 04⤵
- Executes dropped EXE
PID:2688
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-tga\file-tga.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-tga\file-tga.exe" -gimp 279 5 4 -query 04⤵
- Executes dropped EXE
PID:2568
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-svg\file-svg.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-svg\file-svg.exe" -gimp 279 5 4 -query 04⤵PID:4548
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-sunras\file-sunras.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-sunras\file-sunras.exe" -gimp 279 5 4 -query 04⤵PID:2196
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-sgi\file-sgi.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-sgi\file-sgi.exe" -gimp 279 5 4 -query 04⤵PID:3204
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-seattle-filmworks\file-seattle-filmworks.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-seattle-filmworks\file-seattle-filmworks.exe" -gimp 279 5 4 -query 04⤵PID:4860
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-rawtherapee\file-rawtherapee.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-rawtherapee\file-rawtherapee.exe" -gimp 279 5 4 -query 04⤵PID:1464
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-raw-placeholder\file-raw-placeholder.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-raw-placeholder\file-raw-placeholder.exe" -gimp 279 5 4 -query 04⤵PID:4376
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-raw-data\file-raw-data.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-raw-data\file-raw-data.exe" -gimp 279 5 4 -query 04⤵PID:4668
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-qoi\file-qoi.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-qoi\file-qoi.exe" -gimp 279 5 4 -query 04⤵PID:2580
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-pvr\file-pvr.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-pvr\file-pvr.exe" -gimp 279 5 4 -query 04⤵PID:4276
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-psp\file-psp.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-psp\file-psp.exe" -gimp 279 5 4 -query 04⤵PID:2100
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-psd\file-psd.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-psd\file-psd.exe" -gimp 279 5 4 -query 04⤵PID:5368
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-ps\file-ps.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-ps\file-ps.exe" -gimp 279 5 4 -query 04⤵PID:384
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-pnm\file-pnm.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-pnm\file-pnm.exe" -gimp 279 5 4 -query 04⤵PID:2812
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-png\file-png.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-png\file-png.exe" -gimp 279 5 4 -query 04⤵PID:5316
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-pix\file-pix.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-pix\file-pix.exe" -gimp 279 5 4 -query 04⤵PID:1308
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-pdf-load\file-pdf-load.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-pdf-load\file-pdf-load.exe" -gimp 279 5 4 -query 04⤵PID:5028
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-pdf-export\file-pdf-export.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-pdf-export\file-pdf-export.exe" -gimp 279 5 4 -query 04⤵PID:3420
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-pcx\file-pcx.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-pcx\file-pcx.exe" -gimp 279 5 4 -query 04⤵PID:4460
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-pat\file-pat.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-pat\file-pat.exe" -gimp 279 5 4 -query 04⤵PID:1644
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-paa\file-paa.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-paa\file-paa.exe" -gimp 279 5 4 -query 04⤵PID:6008
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\bin\pythonw.exepythonw.exe "C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-openraster\file-openraster.py" -gimp 279 5 4 -query 04⤵PID:1368
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-mng\file-mng.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-mng\file-mng.exe" -gimp 279 5 4 -query 04⤵PID:5360
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-lnk\file-lnk.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-lnk\file-lnk.exe" -gimp 279 5 4 -query 04⤵PID:1280
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-jpegxl\file-jpegxl.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-jpegxl\file-jpegxl.exe" -gimp 279 5 4 -query 04⤵PID:820
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-jpeg\file-jpeg.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-jpeg\file-jpeg.exe" -gimp 279 5 4 -query 04⤵PID:1736
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-jp2\file-jp2.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-jp2\file-jp2.exe" -gimp 279 5 4 -query 04⤵PID:3300
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-iff\file-iff.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-iff\file-iff.exe" -gimp 279 5 4 -query 04⤵PID:2924
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-ico\file-ico.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-ico\file-ico.exe" -gimp 279 5 4 -query 04⤵PID:4572
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-icns\file-icns.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-icns\file-icns.exe" -gimp 279 5 4 -query 04⤵PID:2420
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-html-table\file-html-table.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-html-table\file-html-table.exe" -gimp 279 5 4 -query 04⤵PID:4644
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-heif\file-heif.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-heif\file-heif.exe" -gimp 279 5 4 -query 04⤵PID:4116
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-header\file-header.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-header\file-header.exe" -gimp 279 5 4 -query 04⤵PID:3940
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-glob\file-glob.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-glob\file-glob.exe" -gimp 279 5 4 -query 04⤵PID:4604
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-gih\file-gih.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-gih\file-gih.exe" -gimp 279 5 4 -query 04⤵PID:3144
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-gif-load\file-gif-load.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-gif-load\file-gif-load.exe" -gimp 279 5 4 -query 04⤵PID:1440
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-gif-export\file-gif-export.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-gif-export\file-gif-export.exe" -gimp 279 5 4 -query 04⤵PID:3260
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-gegl\file-gegl.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-gegl\file-gegl.exe" -gimp 279 5 4 -query 04⤵PID:4416
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-gbr\file-gbr.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-gbr\file-gbr.exe" -gimp 279 5 4 -query 04⤵PID:1196
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-fli\file-fli.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-fli\file-fli.exe" -gimp 279 5 4 -query 04⤵PID:2428
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-fits\file-fits.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-fits\file-fits.exe" -gimp 279 5 4 -query 04⤵PID:976
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-faxg3\file-faxg3.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-faxg3\file-faxg3.exe" -gimp 279 5 4 -query 04⤵PID:3660
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-farbfeld\file-farbfeld.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-farbfeld\file-farbfeld.exe" -gimp 279 5 4 -query 04⤵PID:5616
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-exr\file-exr.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-exr\file-exr.exe" -gimp 279 5 4 -query 04⤵PID:4720
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-dicom\file-dicom.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-dicom\file-dicom.exe" -gimp 279 5 4 -query 04⤵PID:1468
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-dds\file-dds.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-dds\file-dds.exe" -gimp 279 5 4 -query 04⤵PID:3048
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-darktable\file-darktable.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-darktable\file-darktable.exe" -gimp 279 5 4 -query 04⤵PID:2724
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-csource\file-csource.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-csource\file-csource.exe" -gimp 279 5 4 -query 04⤵PID:1744
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-compressor\file-compressor.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-compressor\file-compressor.exe" -gimp 279 5 4 -query 04⤵PID:4712
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-cel\file-cel.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-cel\file-cel.exe" -gimp 279 5 4 -query 04⤵PID:2544
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-bmp\file-bmp.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-bmp\file-bmp.exe" -gimp 279 5 4 -query 04⤵PID:2500
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-another-rawtherapee\file-another-rawtherapee.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-another-rawtherapee\file-another-rawtherapee.exe" -gimp 279 5 4 -query 04⤵PID:1628
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-aa\file-aa.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-aa\file-aa.exe" -gimp 279 5 4 -query 04⤵PID:3872
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\destripe\destripe.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\destripe\destripe.exe" -gimp 279 5 4 -query 04⤵PID:936
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\despeckle\despeckle.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\despeckle\despeckle.exe" -gimp 279 5 4 -query 04⤵PID:5856
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\depth-merge\depth-merge.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\depth-merge\depth-merge.exe" -gimp 279 5 4 -query 04⤵PID:3772
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\decompose\decompose.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\decompose\decompose.exe" -gimp 279 5 4 -query 04⤵PID:2788
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\curve-bend\curve-bend.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\curve-bend\curve-bend.exe" -gimp 279 5 4 -query 04⤵PID:5676
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\crop-zealous\crop-zealous.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\crop-zealous\crop-zealous.exe" -gimp 279 5 4 -query 04⤵PID:2632
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\contrast-retinex\contrast-retinex.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\contrast-retinex\contrast-retinex.exe" -gimp 279 5 4 -query 04⤵PID:4540
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\compose\compose.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\compose\compose.exe" -gimp 279 5 4 -query 04⤵PID:3408
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\bin\pythonw.exepythonw.exe "C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\colorxhtml\colorxhtml.py" -gimp 279 5 4 -query 04⤵PID:3052
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\colormap-remap\colormap-remap.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\colormap-remap\colormap-remap.exe" -gimp 279 5 4 -query 04⤵PID:4744
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\cml-explorer\cml-explorer.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\cml-explorer\cml-explorer.exe" -gimp 279 5 4 -query 04⤵PID:612
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\checkerboard\checkerboard.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\checkerboard\checkerboard.exe" -gimp 279 5 4 -query 04⤵PID:5044
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\busy-dialog\busy-dialog.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\busy-dialog\busy-dialog.exe" -gimp 279 5 4 -query 04⤵PID:2512
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\border-average\border-average.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\border-average\border-average.exe" -gimp 279 5 4 -query 04⤵PID:6104
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\blinds\blinds.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\blinds\blinds.exe" -gimp 279 5 4 -query 04⤵PID:4860
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\animation-play\animation-play.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\animation-play\animation-play.exe" -gimp 279 5 4 -query 04⤵PID:4188
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\animation-optimize\animation-optimize.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\animation-optimize\animation-optimize.exe" -gimp 279 5 4 -query 04⤵PID:4216
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\align-layers\align-layers.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\align-layers\align-layers.exe" -gimp 279 5 4 -query 04⤵PID:3200
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\bin\pythonw.exepythonw.exe "C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\extensions\org.gimp.extension.goat-exercises\goat-exercise-py3.py" -gimp 279 5 4 -query 04⤵PID:6112
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\extensions\org.gimp.extension.goat-exercises\goat-exercise-vala.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\extensions\org.gimp.extension.goat-exercises\goat-exercise-vala.exe" -gimp 279 5 4 -query 04⤵PID:4276
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\extensions\org.gimp.extension.goat-exercises\goat-exercise-c.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\extensions\org.gimp.extension.goat-exercises\goat-exercise-c.exe" -gimp 279 5 4 -query 04⤵PID:2100
-
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-rawtherapee\file-rawtherapee.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-rawtherapee\file-rawtherapee.exe" -gimp 279 5 4 -init 04⤵PID:5368
-
C:\Users\Admin\AppData\Local\Programs\GIMP 3\bin\gspawn-win64-helper.exe"C:\Users\Admin\AppData\Local\Programs\GIMP 3\bin\gspawn-win64-helper.exe" 10 11 z 8 z - y y w - rawtherapee -v -w5⤵PID:3888
-
-
-
-
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5236
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5116
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
PID:3840
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:932
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:Global.RulesEngine.AppXgphnekvm0vv49drvfehh4b6kyf6ckafp.mca1⤵PID:3660
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵PID:1288
-
C:\Windows\system32\werfault.exewerfault.exe /h /shared Global\b573806cedab46f4b977466aa7714cd6 /t 3744 /p 33361⤵PID:3324
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
- Size 599B
- SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
- MD5 658ab8c32d4cc5deb36ac5f63da4658b
- SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
- SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
- TLSH T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Programs\GIMP 3\bin\exchndl.dll
- Size 719KB
- SHA256 a115ce2ecb77201bf77c57bf4a0817cf9b525c962d86119a7636509aced4aad2
- MD5 b29837e8ac7ff3f70f0428ddcf7422f9
- SHA1 d7430bbe83fffd73d220aee4cb30a562555b076b
- SHA512 96e58af22ea56202ce82e9802ecf80eba42889961f4e52226dcd387305d8a8d944bd99356a7f7bf921c5adfab1006d4bb94b25578299fec8a7a5f1e14798ac19
- SSDEEP 6144:+j3xaSX4HmBcf2fwv/OC0x8xwVkhrhyOwg4BZ2DdoOcvjLqaAwwuzZ+iFXVUoH9X:+jh1I2ov/50VkhCvXpZ+i55H9LXc3eb
- TLSH T1AAF43B07B3E99E6BCC26623899CB63096335FCA0079797DB571002616D57BE8CE3EB14
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\GIMP 3\bin\is-BU0BQTK7N9.tmp
- Size 6.9MB
- SHA256 b4ea813a747ee419657bc3e1289ebbe79f90a28bdf6fbbd445f7c5b3fbe41e99
- MD5 7970f01e2e3e39033172556319c8af51
- SHA1 19ff8475e3094fadaf4cb18eb9764d4777d62832
- SHA512 991fe887aa25dde9290c91d6f12ccecf6e53414d27f34e020e5189003b27791f7afb230b4ed8667c3a8e6a04b605d5235080dfb06c93ce2d242fff1b6e74b2ae
- SSDEEP 98304:CyzWuKq7Rn633wee0Ss3sV6hJoWmHe4jQjsVN8RR:vzjt7dee0Ss3sV6hJoWmHe4jNriR
- TLSH T18A764B079191209ED81AC1B5979A7231B8B8BC8597307CEF4961B3343FB4BF05A3ED99
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\GIMP 3\bin\is-ED0WLJTYVI.tmp
- Size 82KB
- SHA256 6242723eabddc8770e43116a3384ff7a076c935ae1f74c0d87bce8599e21c5f6
- MD5 c29266b4be37d66d81dcc8f9854849a7
- SHA1 50a37ffc962c29d55a272ccdd6fc0eacb7687f94
- SHA512 7443fee4446f237eefbe26881c973107b938ed2aa68aacdf4a0dacff6fa51b5402907fdebacf2b6069d12b1e390ae2523b95ca9d6ea847c92bbf99b6307869d8
- SSDEEP 1536:NgBsGo4sUj3iskhhJAjgPLEY59neKPIuNHC1qTRXDS8I6nw2MXDTW:CBniPIuLRFmbX
- TLSH T11E832A86D745BEEBDF135236DC6313182331E1221B858AEF1A1642752F93BE8CEB7245
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\GIMP 3\bin\is-MEYBT3SB7U.tmp
- Size 3.3MB
- SHA256 8dbb5502c69d63456ab53dc43b5c9baa8e435808a9fcad47d44c44a5e82fa3d4
- MD5 ddf6715b45a9d9f4209a5f049c9cad34
- SHA1 84729db6d2ee4c4efc50cfe45196a238d8e89ed4
- SHA512 0bf9fe222340fefe8ca7ff06d37dfd03437d63961950d5b94df0a534b02131168f912c4ade706ef367dee5c6c7973413e7ef6d6d54400aee7ddf16d4295d468f
- SSDEEP 49152:9rLpgJRkIFnH8AQAn90E4VoYDPgcykd4b0LLOaMv3HRs50VGfY2orK36/s6nCOm8:sbV38D9ykpAjIBywUD
- TLSH T1BFF55A03E18520AED845C2B5535A7231B9B8B885833079EF5A55E3343BB1FF04B7EE99
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\GIMP 3\bin\is-PRCBIH6UZD.tmp
- Size 94KB
- SHA256 71729e4885ed5ddb0aace2eac16147ee77cccd8124a53f2bf36fc14f8e2cc8df
- MD5 042bd503242c8e7ab6b904c585399fba
- SHA1 9e18b55f9f8253844eebabf3ee2ff6652daf5433
- SHA512 1c7d4265229e757ea10719a395f947d9e209f889a34af65adcc982c4570b3c2a95539714fb35a401222cd0044f42eac57f569101569ef7634c7b6533da69b65d
- SSDEEP 1536:U4DEDvemkPsUc4sUj3iskhhJAjgPLEY59seKuwjuHG1vxN4MHLI6nw2MXDTW:U4DEDvemkPsUfuwjjxrmbX
- TLSH T169935C878741AEEBEF12433B986313186331E5620B819ADF5B1741752F63FE48EB7285
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\GIMP 3\bin\is-U8KJTMVST9.tmp
- Size 89KB
- SHA256 6d67066068d2341aaf9c03aab9acde92644ee54b1339c50d0ac5e529f3a7b83d
- MD5 8962d6ef8323c80eed0df3b3c4205c17
- SHA1 3f48070718e8257b4f2bd97469c7bf370a0dab8b
- SHA512 75994768f63bcd834fa5e2a9a926500d21344b65775fde22e1d8d6b240e225859525f45e39438bcbdbdca44a034122cbf05199f016c57103d96d282b696175a2
- SSDEEP 1536:Z5O5UZiP0Yo4sUj3iskhhJAjgPLEY59eeKe1ewHOLjP3i5WYI6nw2MXDTW:3O5U8e1elkFmbX
- TLSH T1CD933B868740BEE7DF02023AD86303256731E5221B819BDF7B1E41752F53BD49EB768A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\GIMP 3\bin\libappstream-5.dll
- Size 677KB
- SHA256 5aefcc1f6c05673e2eeffbee2e7ed124bc005b7cee2eaa2dfb06430f077ba22a
- MD5 00580872ff0f43a180d4ceee01566b59
- SHA1 8d672111567fd15b0dd353d28cf546a39cc51917
- SHA512 64b60e5e0c447814185e0e07ed4292d092fc17da77e02800d003f5aa3aae078f8852da70922d086b6fdabea753a268d404737a359cc8f89489fcb2c5de6764c0
- SSDEEP 12288:Xo8NbHVekGWH5m+Lkul7yK1EZVR7vTpLJv1nFj3630YVg8hQT9kL8gWBvgNsIY:48NbVeVWH5m+Qul7R1EZVR7vTpLJv1nd
- TLSH T176E44B27A641586FCA9AA234AAA7732372B8F0501777F9DB455083753FA1BF4033AF44
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\GIMP 3\bin\libarchive-13.dll
- Size 863KB
- SHA256 2e26db38753de26cb4b12b96a38833319c2424235cb316f11015294acb7b1c71
- MD5 48d1e5903daa43a139873610ad38a623
- SHA1 6291f89d03d2e719ab53817e61349252dff81b06
- SHA512 c2ae72145d08e93fad70af44b7c93849fe2a3c8e6d5040ba5cd9ad25e624425b8cb4b4926d5d1c9cbed7a9e89c00f1ee4a2182d98a177baf144cfbf6afec7f8e
- SSDEEP 24576:4SFKU+RPMxaq+5uVk9kZSSQCXvCfY6su:ZF1+RUVkO7afYDu
- TLSH T135156A43F5D41AEDD42AC23492866733F675F0561F31A9EF526093303E69EE06B38B98
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\GIMP 3\bin\libbabl-0.1-0.dll
- Size 813KB
- SHA256 91016fb97c3868aaaa47ba091ea36a81a8bca77c1efc1a701d92680a330addbb
- MD5 9fa5954129f2f203755757c63c9c10f6
- SHA1 98392b416ddd961594ca03c9f835ec500b69015a
- SHA512 884f278faf25f167da0c25ea2acfe133159b40f7490b4a282b99a7b7d3113ba9f0a09551357d4ac44d653889b0c9626ae1b66e318417bf70d779a387e2c6ae9b
- SSDEEP 12288:rJY+VZCkx/n9LVqoB7SXJXiNZdUtvNBLB8nKVzXUAw:9Y+DCkx/nFcoB70if7KT
- TLSH T1BB057E087152E46FD53AC23A1E2BB553333164404B75EEA311425D2DADBEFC62FAB90E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\GIMP 3\bin\libcairo-2.dll
- Size 1.2MB
- SHA256 b00d4dd7cfe57d7c8b62fb05ae688c4dbaf7abb6a8e9bd67cce596d9d972da0d
- MD5 4754615d9eb89a7695d6166df7244cc5
- SHA1 ad5c64a7d3ea6383dd679d62f3bcafa2bf5c982a
- SHA512 c1f6742e3fa94c9e38c5fdf3e930114f21cb133fb3a021f0b366af7ae5cec738121e713ca58c450b246b48e790de7b998a597b3adf60e4b6a5deb7bb886947ca
- SSDEEP 24576:BTX6kVWS/Xl72iohhgiuhW7v7Gqk77EB324zEWcaVi5KB9:5X68Xl72i+hPtUAEdEl
- TLSH T1FE555A43E142D9EDC45AE274925B6733F536B4020739A8FF5790CB302E66BD0AA6BF05
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\GIMP 3\bin\libfontconfig-1.dll
- Size 348KB
- SHA256 3cb33273d221c0ca563d1e9dc6ccb9eecdffe0ee8367560c5cce78cc4f4d0887
- MD5 9ebc4259a45ee767dc8c33920823e994
- SHA1 5f04a306273e7749300d725c8fe78f7442e69394
- SHA512 c75e7a0e8c5fe96d509c1831c8416a5c2bb89677c77a5c614e221d7d4c84581404111bb1fd120d9a8299121f74b7de225b06d94577c1a8e15dcfb292daa2962f
- SSDEEP 6144:+qdnTek0+ucxgKEJtBcF0QgbzwFdq5ht7gpQiFm8s6LGv:+qdndpxgKEhcFLXb8gpQiFm8s6LGv
- TLSH T13D744C13F24258ADD446D1348697A736B57ABC214B32AEEB2360B7383D71BD05E3EB44
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\GIMP 3\bin\libfreetype-6.dll
- Size 824KB
- SHA256 fee9b0490e5217611436a4686fd75f341ce5e8c531cdf127fbdf3ecd9226f929
- MD5 c372d05b98bbe5f30b343db8570dcbe1
- SHA1 4597dc9f9ca0a898cf098ce1321ab0959e5015c5
- SHA512 c123e5f4896ef108005be8870ef956359f367381db0327ac3056713b26748451275706c888dfc78fb027941cef1d1577ad82a3be93581516f413589cc1665683
- SSDEEP 24576:eg4kmM4rdQ1A5oGHe8IezeeeeeeeeeeefeeeemeeeeeeeeeeeeeeeeeeeeeeeeeR:yrdQ1qpIezeeeeeeeeeeefeeeemeeeec
- TLSH T1FB058E43E68765EDC91BD33453576733FA35B4011226ADEB52A08B313E66FD06B2CB28
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\GIMP 3\bin\libgdk-3-0.dll
- Size 1.5MB
- SHA256 f8fe343413d7aac30f0fca8707abdefd8502de46090bd171052c58d5477e8bfa
- MD5 357c1c43f11dc32de242fad7f7f7045c
- SHA1 24e5f8bc0daefdef7ae56f9dadbeef3467d63de7
- SHA512 14202922822db5d61aac344eba35f2fb2dd20bf1b10cdcb1656868fd2eab33b78a0d904a1b2a81e553a485012cc3515370ef69ff4cd964b86e3c22f335f69566
- SSDEEP 24576:XX6ECIBCavdSdiK0FZdeZT+pl15/qxNCIhAp0AvwcWaz:n4IAaAa4T+pl15/e00Apbvwvk
- TLSH T16665B2256682DA5FC617C23555C2E23671386C01B733A5B70DC8BF6B3A727F3252A386
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\GIMP 3\bin\libgdk_pixbuf-2.0-0.dll
- Size 358KB
- SHA256 524eed6455ef5bba6ffb3056c71ecf9f34f677833c96bf0f8de2f87d1dae3d7b
- MD5 a6cc27bc341f1f9496c750ce0c45b55d
- SHA1 a066bb4e96fb912b2c4d9743aaaab38a5ecc02ad
- SHA512 295d31dab6e60e4d5d164ff5a5e57d255b95c6629d87b90ea6074c8b92676ad31f47ebff28972cb31a215ff6bd1a32e1d05e0268f4ced073e9212de88dd83ad5
- SSDEEP 6144:OH8kffVXj8eM/xzuuPxEGK5FVMvARoLRLOZ522vtHn+oOEbsb:OH8kfCl/xz3+GK5FVMvGoYPvH+oZM
- TLSH T175746B17F28119AED80BE37446C7A373B875B0524723A9FB565196307EB0FE0B17AB48
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\GIMP 3\bin\libgegl-0.4-0.dll
- Size 922KB
- SHA256 95b3be41918aa3c16552552f5764173b79131b690c54f832abcdfc3a7b6e32b3
- MD5 aa1347b01e1c523901cedad521185f78
- SHA1 92cebfa48078c22eded1c9ac58d0a7f1080dac01
- SHA512 9d9ece676bd5697f1f08a0efeca64fe2b1a6ad402a4c5fca58e2591085ecf9e505e700b6afcebe1cf0f26274e5f554485c036ef934b5f95a193cb75750306fa2
- SSDEEP 24576:USmLnrkAWYGQPSJv/QkWZqQe9JQdUCVZg2vgbPE/Zn:USmLnrkAWSLZqQe9JQdUCVamgbPE
- TLSH T16A159E16A58BE06DED6AD131A65736137170B08A07242DE7352C83343FB5EE12F3BE5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\GIMP 3\bin\libgexiv2-2.dll
- Size 262KB
- SHA256 9883c002c3b023a10e774a358c37cb3d7f3378eab7b3475eb56edaabb493f4e2
- MD5 6554cca6477af812687696a3bb3c673e
- SHA1 f39e89e39232a915ceb277a5eeffa9d7e39827e9
- SHA512 f38ea3fc0a61ae6a9e71e92b04f4a7956e4dae1c4d53c6be0b1c8c2706d1cca7b64db66ec59f7db086a86a8f14eb34ec75574087b4313aa0a8f9d75361f400ea
- SSDEEP 3072:FhYgZM+9oQK4QuHIycztQURc9XSdwxSncx38eEbm1RBPpVPjxtcI0EEUwTRv3u31:Fh1oKHkQURQid48U5RtcIvQRv3F
- TLSH T146443A17225A51EFD997F33940CFA212B8B2FC515F62E4E71A109A306EA07F77636B40
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\GIMP 3\bin\libgimpbase-3.0-0.dll
- Size 454KB
- SHA256 bb9f84957485ba2109aaac4a306761255df1917e7c1ab1bee3ebdbd52f373a0e
- MD5 307f6e71c8d144e4ebacb5880db116fd
- SHA1 2c64c2822e9c20d44fed075eb3583e9fe7977c9d
- SHA512 de1ad8a5d76e0a1544080af1e68b060e55a4d8e41b8dae1d82179035dc39a4d24fe3e00d670eb797b98f303d70ac9a76f0f60fedc8ad288e48f44d9f1b7b76a6
- SSDEEP 6144:iKf+InYHercPhUo5UtFngkqRBL/Uj/Cn8W:Z+z4UUtFn0RGTvW
- TLSH T139A428057241B867E92EC33F5D4BE5221370A44043A0EFAB56114E28EE6FFCA7D7E589
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\GIMP 3\bin\libgimpcolor-3.0-0.dll
- Size 121KB
- SHA256 ac34522a626a655cf0234e257a4e849cd1e617962dabd5e22d2d8514821c0dee
- MD5 f7c22d5a63ea65441ab9f3080e8e9be6
- SHA1 1b9544d183ad03875d6815de21c873a7eaa93dc6
- SHA512 16ed46e787192c5ba19ae1dbc9747853bc59d40ae7136370a54822eccbe5ced551c6d8ea7b1591d9cbe91e233920e4ebf2390cbf5205e3c172fe8bc88d281485
- SSDEEP 3072:1OtzoSM6cypprWvuqdV/DnxlpN3IN8xHpgmqbvBqoYWq:MwaZKJDnIl+
- TLSH T198C36C07E381AC9FDC02853A54736B256731F5021B906BEF5B52832C3E62FE45EB758A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\GIMP 3\bin\libgimpconfig-3.0-0.dll
- Size 141KB
- SHA256 354304998e6a12d5e78d7cea93a133a6fc3a4b58197f508aeebdb97ddaa5b5bb
- MD5 93271265465ec0f6188c24f310a552c6
- SHA1 787ccc85aa42653200a38b4fbd84b5a7ca327e33
- SHA512 cec129dfa61ad6219615d9fe731c45262d5f74736ac7c813af573b7b8bc3c92dbf69bf002f1db6d5c32cd7a83f5e4598b618ae3b906cc17aad25e5781af7a27e
- SSDEEP 1536:Ri6JHLzHszHs1fVyjG1o3G1FZ5sIoR8mFAj7gYhNpVrt2UykesJhjhsmFEUch/8u:vHLzHszHs1fVIG1Psbglhz5tm8+ww6q
- TLSH T154E36C0393846C4BDC06C539C122A7356B72F99227A17BEF0B6241747E56FE02E769CB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\GIMP 3\bin\libgimpmath-3.0-0.dll
- Size 73KB
- SHA256 2db9dd92f0cddb95b1da8094ceb5e24aad77a4e3a2b9827fed35b7c9c4a70cbc
- MD5 d1d5ccfc800a4152607a325fdeb87b2e
- SHA1 8667b4ca37adb3fc9ba993f64aed043a5eebf997
- SHA512 994c009041147a8e729f2ab7e4a1e574d971f971788447c937a59e662b1199b103da611b6fedcb369003b52772530fb9f80f025946b8f61393064686f5acf676
- SSDEEP 1536:hQT/YIl63BNwJhjhsmFEUcS68/RWG22yU18qI2wjhW/:hQpl63B78p1D4q
- TLSH T14F733B8AD742AE1BEE53013688672B383736D15217C44EEB5A23813C1F76BD49FB7642
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\GIMP 3\bin\libgimpmodule-3.0-0.dll
- Size 70KB
- SHA256 a0902c43bc89cadb72d0ef6838f040a2156bbd095ecbbca8e333ac16deb11c3b
- MD5 3b40f5741574d6714adf12a2db478794
- SHA1 79aac02dfc5fcba1991ad75a0d4daae29f859bbe
- SHA512 12a1ca1256f60c6c5500e321bb5da5b3ec07db7ee8bf90f03da3d71f849e12c175d1228c77dc0a4649ae424417b89655ad39b8a88d2a5b1339440d50c584ef85
- SSDEEP 1536:p3JXJhjhsmFEUccP8Q8x2pYnKgAiI2wjhW/:bz8pOYrgq
- TLSH T1DB636D8787D1AD5BEE064239C8231B287732F16117805BEF6A1A81BC1F52FE4DEB7185
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\GIMP 3\bin\libgimpthumb-3.0-0.dll
- Size 82KB
- SHA256 62b602bce36248ac2a69542f6be0c2d6534f89affd9ab82705e7b73441f88d28
- MD5 a31e625c0bbeca39a1d66c629fc6fe2f
- SHA1 df51ff3cab99873dee9baf5c8b5bb934217f5b57
- SHA512 b43e91fe35bb233af74bbc16becfe305ed1a7717f1fd282110032f1aa8c22ac09329471b30f295ccada9f84102231955e49e9b99c492787c75c0ae4388c07ba7
- SSDEEP 1536:HrX2Hi2eLz63z3Xw6JhjhsmFEUcHq86NpQ2ouBtYGI2wjhW/:aC6znx820un4q
- TLSH T138837D859381A99BEE024235C827172D3732F1111BC05BEF6616417C6FA2FF8AEB7985
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\GIMP 3\bin\libgimpwidgets-3.0-0.dll
- Size 2.5MB
- SHA256 bf9ff0126261b3c087c82fa234198ede6a139b92a2cdbebe15ad324eeb45bf27
- MD5 bd2a8bb3943536926056247fcc135197
- SHA1 6214119d096b606559c6b40092086cd35d64ddf2
- SHA512 6a308849761db24ec91f692400a2eea9cad8c04504bd0ecb7e430610e5cd1ebb3ae2fbd4976ba92c286dd5fc14fcff1b3af7cf63e3fab8ea93dafb6d07ed8e55
- SSDEEP 12288:bMwDyLNovFzkHShKki34oFi1GCV6aX04aDW/ozhblnJQNp:QwDqNovFk9N5aX04aDW/ozhblnS
- TLSH T17CC50902B141D89ED82AC2714E56E37934A17C849F6068EB76D1BF3F3671BF1097E84A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\GIMP 3\bin\libgio-2.0-0.dll
- Size 2.1MB
- SHA256 3d0e1ce2aef0d479b0cfe91a51e2a5f4f15a2705675cd49951ac4ac333024a8f
- MD5 64ca58acfcf2eabd54ec3edce0907ed4
- SHA1 d133043b1011fbfb2f1740116e826d1f99fa113d
- SHA512 fd6c9ecc329941dbcd8850db94178169464a2850aaa0ddbce0982d086b3f3e02c6a022ebaf0d65ea21fe0169e344be73ce73fc0af24c5ae75e7a93526adbeb6d
- SSDEEP 24576:RyaSzT5r19gJlZb96/hRp/lH9Gj/tpSN9bvIn1xDI08aWNd:Qaurng7Zb9EhRHH9GjVInvIXDI0dWf
- TLSH T16EA53A039281A15ED99BD33196C7772B74B4B4410B33B8EB1620D7747BB0BF6162EB89
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\GIMP 3\bin\libglib-2.0-0.dll
- Size 1.6MB
- SHA256 25815fe53925f4e01860bbd834a12f5aa13865382c4156570f64cf47c6fbfc47
- MD5 a5766c4c8692f2fe4abc5489651aa5a0
- SHA1 01631a90c5438b7a7e0c971f81692b06eae74cc1
- SHA512 ea11a07aaa5336cda46eabcdc67b4ae8e76d4c21a03d329ebd8266967b62d2e660948c7c71f6e06ce9bcfa21c77a785b0614c33d19446e346e8637ea87fdc927
- SSDEEP 24576:VqgNJoNYkNFHUYIv7jBBZDnGItxuuBNtv/kl6YJKlnpykjQ8rmOZy:V6YkwFBBZDGSuatvMinpC8rmOs
- TLSH T116852A03A14276ABE787DE3585E2A362F574B4500F3368AB2E5CC6342D7DBD3162AF05
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\GIMP 3\bin\libgobject-2.0-0.dll
- Size 359KB
- SHA256 81983e9e231c049faee9b2e3ecd4177f61511ec741c89b9fcbba8b5426171845
- MD5 4624a6a3481127be83766e4626886d09
- SHA1 9bcebab1f7cf8a208aa33981bf011e521b6331d6
- SHA512 03f154d2b86bdd03acdadc81ec887ebb01d628d171b0528c7e78425096ac873efabbbbd3ee0c51865bc88536c55376e55f82ba6fd751004280e5140e23c0cc20
- SSDEEP 6144:cPgvd4TSWr8lXkjs6UGpbxuZumVPNYHKpcAy3zzBSINKtlviEnYvfDIFFQj7mxt:IfTSWr8Jkjs6UGwDtKHK4q/imSfDIFFl
- TLSH T137746D176304287EED86D1388687B722B7B5B0541732ADEB5360C3306D76FE56A3AF09
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\GIMP 3\bin\libgtk-3-0.dll
- Size 7.2MB
- SHA256 7bff271c41930f0f6e64bd2467b8db481d37f2b2ab6acb1fee1f6ebc7df3472b
- MD5 b6f509b64e64a02768c413b300fceaf6
- SHA1 82e6ef1d96359207efa150d59f31a259d9e1b7a4
- SHA512 4d75875afb7c77c6f537c06608c7cf87a883fa1579640021940ffd0d8a515e14ba9850a09af8669023f245b5e5b75e89ea98e7d510437dfd421b737e2e575e8e
- SSDEEP 98304:GcOsNoA3PuY/d4Zmk8pQwYGAzyU52QUtBZ7qxLQZtfx0F07j:WsNoAmY/dewYAU52QUtBZ7RZtfe
- TLSH T1C7765C03E28129AED95BC23495977762F67170804732BDFF2BA0D3707BB4AF0456EA49
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\GIMP 3\bin\libharfbuzz-0.dll
- Size 1.5MB
- SHA256 fc0e0882c0e3ebbbc49307c2676ac4b2d029bbe771f4d4faf48210fffdf4b46c
- MD5 e74addbac9015ac5aa29546e19d3ec3e
- SHA1 ceccdc19cdded6ee3d09e3d38b3f511750acf501
- SHA512 94ba6e0e8b2e19d1f8662403dbfab8a4ed1d7c9a6bd6d66a51069fae7261879910dddd64e091580d770ef0fa6f6aacd6e7f9dfd7874f91c97a5ff9812068999b
- SSDEEP 24576:aRsVT22/OgD7DH4iODYKqzz9MkuDqGed:aRADgDYKqzzbUqG+
- TLSH T1D3659D43E146849DD01AE33481875723F5757802476998FFC7A08739AAD2EF06BBEF1A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\GIMP 3\bin\libintl-8.dll
- Size 295KB
- SHA256 b648dfd190711371bedd58f36cf7bf80cc60be0ff78e574e57f3bd81135eeff5
- MD5 cd1bf2243a2cf281d002cc5b5f50ddc9
- SHA1 20d6dece4b8f83faf40f75701ff087b146b51734
- SHA512 a2569078336f6940702617d09025c037163cb03b79da9510e613dcf11017992c103ad2ffc9ee7d185a2d4a4ecad8f04a93092b9a99ff420dbff2581361882fba
- SSDEEP 6144:TkVqo3htm6gxJRDWj01YKec/1IB75NfRPNkpDrFVKQKrOreokVq7Y:TkVqom6yZj1FJWB75NpFkbUQKCfkVq7Y
- TLSH T1F9545B0B7511459DE8A2C2B1C583E3B67A77BC310F1257E736B0B32C6E36AE11B26761
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\GIMP 3\bin\libjson-glib-1.0-0.dll
- Size 166KB
- SHA256 6712da62bcc66df11da870880b2f706433fb44e5dbb5bab45d7320232a2378dc
- MD5 d56747b5e383dfaf3d951a5628cbb864
- SHA1 d4969de73fd5382696e875b5086e3efe98fa66f7
- SHA512 3b2921fd364644ad916df8e825a10d291aade43e3d52e306b019da405f7c5fc43d0cfc2ab5ab03d0f5fb63b244bed0e565d795ba74f86e2ed64889fa0bc868d5
- SSDEEP 3072:7akBTvRJUoJ2KZvF78Di1uK+b5QfVSLLz9WUFa:7r38uF78Ym5QdSLLz9zF
- TLSH T14BF308276584687EDC0EC23987D66622B0FB78505323B5EF462193706F72FF4B936988
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\GIMP 3\bin\liblcms2-2.dll
- Size 464KB
- SHA256 fa745ce8b431a3d5f4f5922fb57a0b4d6b6ffbf1c660c60903a7855220b6f770
- MD5 05acf849fac0d63d0e821ed5944ca872
- SHA1 bb9bba966159f07775ea78c5cfe4b4ae70265b26
- SHA512 7b08bc57cc3a72f7a49f0d3c28b7d9fca4ec0c00ec8b8c1ac6ad649f0c7f0cc91aa5c2e78d3769ffead62e861eb3a488002421cbd490e66668afc692de42b1a0
- SSDEEP 6144:HhJt6ZWA33WzCa9iJCXYRnby5HG0Gj1rQJ7psavNz/cEQY+IFOwVgOA2jQiTg:HDt6vWma98zRnfkJ7ps+nVFh820iTg
- TLSH T177A45B46E14218FCC417E27592876623F97970254731EDEB1390CB386EA2BC0AB6FF59
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\GIMP 3\bin\libmypaint-0.dll
- Size 145KB
- SHA256 2bd0064d0fc68ef661b0f93f4aa7d7081d5ff43453988f68ddedfa9fd8042677
- MD5 6edf2a60aa192f0b7175363e8fa3c1c2
- SHA1 9c1d431710cac86ded959491b43408144555299e
- SHA512 8a9a232b0e220b05a2896e12fe0e6e6d464a683c5f861419351fea723593f5dc125e587a6561da484a68a316809885917a98f7eea82ea6604301321c685ebd5a
- SSDEEP 3072:BuimNNCAYMMO1j3pUm4p/bU1drMtcimD2D2+nFxYy:IimVB42c22D2OF6
- TLSH T1C3E35C03B1D656BEC902E2B49187772BF33AB45407328AE7035085385FA77D05EBBE66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\GIMP 3\bin\libpango-1.0-0.dll
- Size 427KB
- SHA256 d816394ed8ce376ec6c1952efc3f1c4e8620affaebf73cb594a82c9179d1288e
- MD5 afe001b52d1c1e1b32a3abc34d3d39aa
- SHA1 66d98e2cb7bedf31c4bbad347c70a5e44d24f617
- SHA512 73136d677c6a71e657724e60cb2a4ce3c9c35180405f7716f5a18d59216c6aa93dfb51fd651c7231cc3eaee3eb25446e9774126270c75539e5a3b0abc93177cb
- SSDEEP 6144:XMMsIV7SHXYqeL4vm82KOxjhGYGe1rRnFgdGXn27uUuvzj:XMTfoQm82R9hlZ1rRnFgdGXnvUuvzj
- TLSH T169945B17EA4048FDD847E13896A767237138B4BD4762A9F75750C6309EB0BE43A3BB18
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\GIMP 3\bin\libpangocairo-1.0-0.dll
- Size 75KB
- SHA256 d1a92a0642955c4bd2790a08f5fbb7f9953ce9e7e56c1a99c2db4229980c2c01
- MD5 6fbed71272ce9a8b59c91552ed8e2a2d
- SHA1 7b0ba779fc3e749dc7ebef5cfaeb8865eab68064
- SHA512 85af3bf4270d07eb4fc9e0308e544f6bed59330d12066663864cccee610141cf3894cb2fccff0a2302ec1c8e548fd0a5043698929d531353e9214b953b8d2ba5
- SSDEEP 1536:wjbEzFQ4HolU/n3MrjtAE5ZPKqntBOwDeVJ:9zFZolfjuE5ZT5DeVJ
- TLSH T1C873D7271900CD9EE4876B3DE5E26623713DF668432355EF8B5191389EA2BF0B077782
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\GIMP 3\bin\libpangoft2-1.0-0.dll
- Size 115KB
- SHA256 a2eee2fffc906e5c1160747688f5ac5d4ed2aa9f477750a17a394aad3718deb9
- MD5 b115d63a04309479960a9425bc0206e9
- SHA1 6999e520b29bae1f873f3c72b84378801f3b7a02
- SHA512 0a6a137f8348e1327b0a76ef074f02047cf0cac768a45c7925b7b7ae3189506262a08016e1b7d47004b44fce33c5b52a208fb21a8b81eb03cf1821432f0ca085
- SSDEEP 3072:VLDKO5pnwKdxlFV8CiMbDGirgOQzWowpzeD1:BtbbTiIVrgAze
- TLSH T1E6C3E9251D00549EE887963DA5D16622733CF6694327ABEB4B2093309FB27F43D7BB81
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\GIMP 3\bin\zlib1.dll
- Size 128KB
- SHA256 94dd0a72d4da79e25294a91d1edf902d76eade7512d9218609a5fe43e3a7397a
- MD5 b352ab8e1932f2b250c2eda58fa9b32c
- SHA1 bf4d5bde2bba4f701d5047dcf585f808d07bb316
- SHA512 26a0ad6cd540c2998a1086949e0f2b6e4233a02ce60d3e091694718c875676a5016f4ded7ea515f1cdc2060cf5f5fadf14a8e231c479a1498f6b85266793e7ce
- SSDEEP 3072:85zyIAhX+oELGfczoY4wAac2sp/1ubf19NVh2TBMj1Mztt+Kt:85zyIAhX+Pg/sTWBMxMztt+K
- TLSH T1FFD36C87B99152AEC562C371D2D35B22F579B8000B729EEB4354D7311F26BE05E38BE8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\babl-0.1\is-5SXQUL07CL.tmp
- Size 196KB
- SHA256 e0eb93a4c21368ac08363b79db77eca4d94a772052565deaa598b9b2f551306e
- MD5 82653a52878b38d37f5916cfcc99f4a6
- SHA1 fb5852434096fdd74d036f49fe9c6eb1655f2161
- SHA512 5e48504306422e952c496551b3604bbc76e8873b0115ede1ab50874b7151760a131adeb92346b433e80f61370422a673b6076ab6b28ebd5d23cf755698583a36
- SSDEEP 384:qZfm+10ZQjiZm6lmx6cspyTwJ1IINZHFyacI1za4orfiHQ8:Qe+6XHFyacYaTziHQ
- TLSH T13F142D52A714CAE7D52803F4689B43AC7336ED609B8302172F85F72E1DB2368DF67186
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\babl-0.1\is-9YCCI2WGQ2.tmp
- Size 208KB
- SHA256 8e647d4b9befce874019d4164d8bec9fa141646fd8747c1d6326698640dacb4f
- MD5 57f94b45fdde5a10b8f79c16d4d55a44
- SHA1 7804d84607d1e3dc2b7d6fd3f20cad83b4652b6a
- SHA512 41174e94d6d550c89a9377cbc380490f1cfacb38f4988d10c7062c51e76c68f3beac575cea438f03c86a843981815e8811d328ae9aaf48620c5f51b9a4b17bb8
- SSDEEP 384:qIsjsA0c5aazI0/y8IfodwVbg/qv0Pmz9fWJ1MV6EeQROHeuaihAkQ4/9a4orfvn:72LVWs/1EGHeuaihNQ4laTzv4Nt
- TLSH T152246152A724CAF7E52853B468CB436C7336EC629B8302172F98F71A0D72364DF665C9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\babl-0.1\is-9YQDL62OYN.tmp
- Size 212KB
- SHA256 b2c0e133c42744197672f0b81e1b5816c61c1868d42cbe22f3291108f2016cd6
- MD5 2edcf043978a43f84a0397b9ab0e075b
- SHA1 108e15d3590efa57e6cfd787b9f022fd92070cca
- SHA512 df47b9d7263253502c7af62d9e09ca24e58dc8f4eb87634cd2e184696595e3f8a73799f343b6d1a5b699f23104508aea6d364676a8a022d9c4d701889a998554
- SSDEEP 768:TeK1aozQrGRq0jGD1YHOLa18LkaTzRig:Td1aozT0YHOq8ISdi
- TLSH T1412495426B18C9E2CAA807B26CCB279C7336DED0CAD71A271E5CF71A8D71328DF55485
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\babl-0.1\is-CRJIFGKCM0.tmp
- Size 200KB
- SHA256 a15661827843d75e80d5d416765c69ce0fea56d63c8d2fba5b1b798920c7c160
- MD5 b106e1a51c8956db35a8d89945a13b5d
- SHA1 fa259101a097ccca626375c60b5d78a8cc308e33
- SHA512 5f908962b633603c96c9299a018a51e75aa3db8487eb4b19410ff2f098ed6efb0f636920b9b03e26cd5719307e87d09fd20dfbf2eaa4e2b57c5981468970d925
- SSDEEP 384:MJLbkJ130Fsc6n5Z7wnR1NgSpVrSG/x3QDMHn+aUWBga4orfLd7Jq:YId5B83XHn+aURaTzLdV
- TLSH T166147106A714CAE7D62807F068DB43AC7336EE609A8302272F99F71E1D72369DF57185
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\babl-0.1\is-D03EC3HRUX.tmp
- Size 208KB
- SHA256 a95e98a082cd2289f8bd37b334cbc54d25e787393a238c1cdaff3ae447bd4b71
- MD5 152eadb5db21364eb98dacbca23bb7d2
- SHA1 12c3972a2a77679462e11525a3c83318e5ee56ee
- SHA512 855501393fbee25fe4b9590a13908a5772e1a7a25177a70cdbab78904369e184345f9e43bbf49ef14aa59a16f8d8902735bd7d15f04a2231eeddb5155a1144b2
- SSDEEP 384:pOLH9AiPnJNYBjitBkCec4wllL0s91EKOjkh/NBZGvc/IvXkLNgez8W4Tbpmgwbf:KZnSWAWVYp+FZHg1aeNOUaTzU/k1
- TLSH T1D8249643671489F2CE2806B4A8DB43AC3336EE618BC716132E5CFB1A9D72365DF67149
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\babl-0.1\is-E75Z9ES56F.tmp
- Size 220KB
- SHA256 3a56e1c802c25b0665f51708be58a781555ee255877f21307655eeabc3a4582b
- MD5 383442830e8be417e90c3757acb20ec9
- SHA1 a27225e74e45cf56b3c4a13405edc1d3f5a81dcf
- SHA512 5dd2a4844bae1feaecc6a2a28a64818c0ae0831d0c452e17d59c025f8cf22489961db8cbf7c1a42c122bdcbff00bf393735930f4f3b8bbb59028d3b7f275a4c2
- SSDEEP 768:1i0RNU7nO0i9ZQs/cbHRBsrn0foy7HD/abTeaTzK1B:IocO0SAAy7HDYKS21
- TLSH T16724B352A7148EF3D63A42B468D7036C3336DDA0D6CB16935E8DF7495DB23A4DE13288
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\babl-0.1\is-FPWFL8SH8D.tmp
- Size 204KB
- SHA256 d63955c94474323c31379795e6d325a3e9749ce4f451113196d9eada87839f8d
- MD5 25d0200678b5112ffae483c971f445de
- SHA1 18be93e18e2d1855d70d233137dee9508fe93f79
- SHA512 1676e3025735538cced8d4ab341abd4a6baa126d230ea593e544340051eb32477c7aaf7e94c8552ad9e0b34b725bbe8508a856c78e5787c493e4c39a569dc0c1
- SSDEEP 384:aJLstib3PMwKBiLhtaMfC9sjgpKAEeNb33iW6KHw8adgye5a4orfNJM7R:q1hhx6Hw8adLuaTzNJ8
- TLSH T173148543A719CAF7DA2C16F068DB07AC3236DE608A8712532E58F71E1D71368DF5718A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\babl-0.1\is-IKIHPO62CM.tmp
- Size 224KB
- SHA256 819f22309543a28b85128471bb6290732c628bb97cb039920822caf9fad4e582
- MD5 f18b22b16f4a00f9b53598936dd039ec
- SHA1 67dd9d9cf91029787718c39f1cddc57ed009fd9b
- SHA512 de7dc6a419b9174fa20d986b4e67dd1d493d9c1f3cd38edad97bb3a077cb0b22bc99ba775c48a82d219039b990ae7cf15693242dadca62e29bb43b7d6a053558
- SSDEEP 1536:t4yO0wBqzwXgh0x+ckCuqthZDy7UQ06IZtzHHeTOSYq:aUzg9HHeSSYq
- TLSH T16D24B35277088EE2CB2946B4B8EB076C3235CEA09BDB06834F4CF7596DB13A4ED53645
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\babl-0.1\is-KVOV4DT37I.tmp
- Size 212KB
- SHA256 a89261141acd5cf0c4c13f538fccfcc105a1d0ef01b4b769e9d6877462443827
- MD5 e766ab2ea9a953aa6f8a102ad517ff87
- SHA1 9368a6803dd181901fb2b94a0f60cf6ea699a57d
- SHA512 a23508b99f464812b2af2b67098ac34e6f5f9231714949fb5967cbdef8c80dba7e5406293d136df20cac1b0839f4b7ffc8f6a39aa791059b7ac79303de8ac066
- SSDEEP 384:daMlgz7cofhVazvc1tQ3XKFqmjnKhPzu18abVJQfKNO/KOWAMujtMVmf5+RHL6Nt:mXWUzaKOWAVjelHLPafJKaTz0feYs
- TLSH T164247342A718CDF7E52816B0A8D7876C7336ED629BC302231F58F71A5D72364EE2A1C5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\babl-0.1\is-NLJSFWZQU4.tmp
- Size 216KB
- SHA256 fa66a0823052e1822c76a11932e1ba23dcbe2513f0adcb2eb55149842ff6572e
- MD5 7191c959f73c84a652ac3c3d8ee5429a
- SHA1 a341edf5e66fb28e7a51b73248fab1601a8f0eed
- SHA512 fe680e38b4a7dfb66ef1058e51fd2585bd465d1d0df7f8cb0748186c6819f855ab1e7216f7b348531c088da26271fe152f2588bbc38b9fd0ed7f65e6b773747d
- SSDEEP 384:16JLY75MjvLCvnith26pllRVFQlExGAdJy2E7LBFVMb6IUZv8c0KJnv7rMje1ssi:1KT2XCJold+D9ARtHXWahbJaTzv8d
- TLSH T15024B5426B18C9F3CA6906B0ACCB67AC7336DD6096CB03631E4CFB5A9D71324DE57246
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gegl-0.4\is-F8V4TCPSEW.tmp
- Size 236KB
- SHA256 6e4e5b05d40f626ff3515b1235a64ee6978ed8a594ab5cff82567417caa626d0
- MD5 9b74508f1dfaf97ec6c6ddb6ec715b9d
- SHA1 0047c9ed5e5ac8c57ddbf941564651da7b13527b
- SHA512 c9168418baec9aeea5715fcd0b6644aef891b4bcdcd6c55991bcbf650cac6677782c4f22bcd1746eff14e44d9e1081a72a903e1c1f7208a13b4ce3c139483977
- SSDEEP 1536:m060IHgg0Q+jGIFdAPG/ZZjnH1DfHSCNgWrP:mX0IHgjGWdAPG/zbH1DfSCNgWrP
- TLSH T1DC3493666719EEB3C4AD0BF468C7432CB235ED70DB9742126F88F31D4CB23619E52686
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gegl-0.4\is-V6347S8HR9.tmp
- Size 248KB
- SHA256 75723e82c615e284170992b19359e0505805500570f69e17aab72ec31a37820e
- MD5 c6758c675275a2eba664500059560da1
- SHA1 b904ed59d3079dc6eae3ab6cf8c144cf830f510e
- SHA512 ba182988a63c0aa82a383431534ad2e881594b83e71e3fad99a437c4306c6c313f93cc625128f49de3da47fa6078d0c7e6bf9375166668b670769fe3be435ddf
- SSDEEP 1536:9NahoE2igiy5Tnmxtz4TuVSwEN2mXHASU/DnSKIbIu:C5grqxtcTqSwENvHASULnSKMIu
- TLSH T13844C5662728DEF3C42D0B7468CB436E7379DD519BD74223AF44F3894CB23619E1268A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\extensions\org.gimp.extension.goat-exercises\locale\eu\LC_MESSAGES\org.gimp.extension.goat-exercises.mo
- Size 291KB
- SHA256 5b4dcf880ca4c7344ee507db131ae0cdd93d79605c6f40cdd74fd0262c59bc92
- MD5 3b948cf0ab8a790ab6c938e4606c88b5
- SHA1 e824325c0209f5159e2c24826c63bf163b4bed05
- SHA512 f92c9e86371da823ba76e12035b0e3f136a2436ec66729fe467fa1f7e1ec7a42354efdc4abde2d62858cd2e00d013bc15571cd03442e77e1c754667b0e05ac97
- SSDEEP 6144:x7QPnjPQITGalWlytshvfWOmKiEKNw8zqkZuJjvAYpxu:x7QbPCzfWOm33zqquJjvAYpxu
- TLSH T194544B1AAE400F7ADC2603BD235A4D95ABF9915E5706DF0AA12DD03C3D43E682D773E8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\extensions\org.gimp.extension.goat-exercises\locale\sr\LC_MESSAGES\is-VTOHXXZSMM.tmp
- Size 362KB
- SHA256 4e23db261597aaa1ed6eada9583b4829f15fa0c98b60eb92444892030c15dffe
- MD5 040ef473a31c03babff5677e6aaaa1e5
- SHA1 38d44861f4d2f28252b6a0ca83cf0391d5dc1eb1
- SHA512 a116e25e052a38efc41c97243b7bd8857cf0cc14cbcbe854486ed571890403e12a515896d58d84764f0ba55c8cd1ab37c2cc81c0453aee45c73bb3bfca05a148
- SSDEEP 6144:84J+5TwQjFDlTGalWlPtvWvfWHkY4BYMPKjf0qOeMGrDGGqHmeYpGRpJEkYASGI:8Z1FMafe4oOoGGqH/XRIkVSGI
- TLSH T11F7494629B9924EBC501E47BE819AE493FBE40FE3FA783161134187D39D30744AB935E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\extensions\org.gimp.extension.goat-exercises\locale\tr\LC_MESSAGES\is-DBKHIM7A4C.tmp
- Size 294KB
- SHA256 7ec67de14583695911c649ea6be116c8921cb577874043de41254bcac9147aa1
- MD5 6287bfd4c7e46e57d8283bd6c8d419af
- SHA1 0dfb6b3e9b5af844771201631b8ad018c02314ab
- SHA512 369cab18b0e5bd529c35f776ea7a325da9eb706a37fa2e0cbac1fc9bd80ecdf58be72cb27eba70b994177262ce3fc5082bf118dd28ff4e2fd19d3cd4f593b840
- SSDEEP 6144:1kBT3PGAOjFIlTGalWlPtshvf4SMkkuHDtKfP9QFL7x+uMMq3Jdy9j0:GT3OFbCf4zMp0
- TLSH T101546C07AC912D1AC26E03BFA2C68567D7FF956D6361EB46A52CC1343F83A561CE324C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\modules\is-3113ZVTTCU.tmp
- Size 232KB
- SHA256 3440fa43d52551350690e2226cf41377b74de7a3997928ff33b8ff9a682ab1c5
- MD5 b4f750ec0df1a4a7d2b7f9a22aebdf00
- SHA1 8165cf4fb37906706cb9383f2a9527dbe23f6535
- SHA512 091b6b5409429e1e54f3233e28cac68fa617e4fa73f1b73fd956275f8b7734e97e29738045eba8a4457de543c7ca724e0ed784befc1f51e0ae55ad075f4dbe7e
- SSDEEP 768:eDGnkZknxhTgq3f+3QG37j+lck8IU3EcN3LSIHSWahwaTzczwA:zkOnxhTgq3q3/+xxOZ3LSIHSLwSaw
- TLSH T14C347312AB24DFB3D069877494CB832D7739ED60DB9312139F58F70D9CB2364AE52286
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\depth-merge\is-IVY2Q5R84Y.tmp
- Size 340KB
- SHA256 d469ddfbe2f0e63d413a31734676af8b917b573bb0573241876fed1690772a11
- MD5 84606360696e1af88e6264f69306b3e8
- SHA1 0e6864248acc1efd84c86e0aeae506d28c3394c7
- SHA512 337e8611bc3ae21d1f079474131a3a33b250a9cfc6537d8e33d9c51f679d86b0acc91b58ec0d67a13af0fdd71b480e9e4a6e1602ec774402c625fb005ffce1bb
- SSDEEP 1536:KIP+49fp2b+MUH0NnYiIu8RQSCSeMSAHMsuZdM:t+mfHiIu8RIkPuZ6
- TLSH T17774A4519718EEF3D42807B469D7C36C7B3DDD289B9B422A9E44F21D0CB13619E3638A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\destripe\is-HCK82OSDPP.tmp
- Size 336KB
- SHA256 c78050b35b0d295ffa47faaffc90ead09f3f73296de154b58b6850efb457324c
- MD5 304962b95ec0918b154db023969ab480
- SHA1 b5761e82fba57ca81cec570f97e0bf5cfde38d01
- SHA512 4431ab1c53c63cb312f6e403da4bf357cfaec3b64e5747fcb7d47d1f983c5f479caa782391b8d17d0d956fbe12f9d51f58e604f73dd48f834231ace255a3c3de
- SSDEEP 1536:ly/NMu1+J4ggiZZND3UNbei+T906S6SbBeHM2r2:l0Nv8ji+T90zy5r
- TLSH T14A74A5529714EAF3D42807B8A9C7C33D7B3DDD689B8B021A5E44F61D4CB13619E3638A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-farbfeld\is-5LNUJG5VT9.tmp
- Size 328KB
- SHA256 7320782c42b361f0e1a427b6d8da9f15b103d186877c1a94b5e1457bdc623946
- MD5 ea62a074209ce97ddb68651506a85b93
- SHA1 41e11ff91cde40fdb07d8c25eb3dd440c57e26fa
- SHA512 19c4945776106547ecee40866475db77f6462e11d8d18bbb6186fa81b6e99056141ffb553ff1963480c8ea83cec2b4699aea9e1e08d593a6aeb912a7d2f36204
- SSDEEP 768:ykJJ0B6tnu9Ct7UXI8XoHPBEsFAeWmFIgfuioE+eSQKDaZQHMVVFdDf:MGnPUXzoH5SE2ioEdSQkaqHMHFdD
- TLSH T17D6482539718CAF3D03887B8A8D7837C3337DD60DB9B22125E54B61D1CB13619E66B8A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-iff\is-A24S6S3N8L.tmp
- Size 336KB
- SHA256 acfe778ffa198e22d7bf5b2dfade9f6f2b61781b7e8c80d60ae5ff0909e90049
- MD5 0ecec3b4320bfa33c931541a6dd51f71
- SHA1 8342be52f6d155c43c474ee50893dd239ed1e13b
- SHA512 4ef85179b0083f92a21958276909bfed6210f509701890b273ce2f8eeccaaf48fa4034945969688b4f07121a9bdcfc35a26866c13f732626ce514aac2587eb17
- SSDEEP 1536:tMnOu6Rzn8dlv7wMKis+BIuV1i+kf3sTSGHMfL:+nud8or+BPi+kf3ezqL
- TLSH T19C74B451A72ADAF3D42807B8A8D7433C7339DD619BDF43126F56B31D0CB13609E6628A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-paa\is-6DJVUOTF78.tmp
- Size 316KB
- SHA256 9b70f26587ac617c7875a46c532e84b68d54e16bdf46901a1ef0ce2b645bd2fb
- MD5 f061211385e351bc36bbb20676d1e6f2
- SHA1 3c069ab9de9e843ebd8c5e7df0c87ec35c70b2c7
- SHA512 7f6c209df3c8a8fece94b09cbe20c7b67e49ac136290258d57560abfaa179ea09b32e4fa02055f6e6218b714c1c4cfac0d89c66a591ff001c9b4014e04b62976
- SSDEEP 768:tWFIvtS2PK6y5UBs9ISoWZrH6gCa7gUsIxmi+pYpMjU7xswv8NTPUo:UCHK6kHrs1i+pQMjU7OwETP
- TLSH T117649351A734CAF3D42987F458D7836D3336EDA19BA702A26F44F31D0CB1361AF66289
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-pix\file-pix.pdb
- Size 332KB
- SHA256 8e7d377d40401aa78645a0757d36e291b5b7a8b0a94747c8584f02d6ed93a396
- MD5 96558094236ac3a2bd791930bf5f3943
- SHA1 945ba88bb04ab5dd915cf739f59dd7930331223c
- SHA512 10795a49e80aa598f355ee138dfa03fb2785bc3a6e209e3b8120fd78540caf93abaa4fc57a25b3ab85e777cd4cb3a82ba9465a2f59c81d24b89e506162d89689
- SSDEEP 1536:TOdq17OMl4Vb9JEwAweEUqRi+TIEW6wDP:TP1dWVb9PAoi+TIEGP
- TLSH T1ED7483539328CAF3D43887B8A4DB432D7337DD60DB9B22225E44F2194DB1361DE66B89
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-seattle-filmworks\is-QGEAB9CANQ.tmp
- Size 324KB
- SHA256 9dbb517da327f1ae317ffb82842944ea2c5d16040f8aac8dd141b70378cec427
- MD5 43df6f1eaaf07da459ef37a0f2d34535
- SHA1 df96ebece951e3b9bdeb5b117739607770aaa41c
- SHA512 7bde6f51ac31528336d592567d29d8220ef4c7f28a2f23e6f027e287f01bc71148ed0222bdc3478b4170a8bde799cf3035c83d298614f0c18a7b13e35cc8c90b
- SSDEEP 768:CoPAWQZFkIp/iYUqTwZVYOpz+wRm0qCDV1MORRiv7PJcve5kTLxlPwv8+k:6dkIpqWTC3gUiv7Bcve5kTLDPwP
- TLSH T1276493529334CAF3D42987F4A8D7436C7339EDA09BB702566E54B31E0CB1361DF5A28A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\file-sunras\is-USTI8OU366.tmp
- Size 364KB
- SHA256 a879dce76d9a97fe45c15f0bbb6bc3869b138b83659e7681a99dc27f1bc7caff
- MD5 18f26ce6f51306b9ae8868e60de31b54
- SHA1 7a590ce6680079d7f87a7ff7bb917acf48539c29
- SHA512 3957b7c8f56036b021ccce8d22ce5ccbaa3af2198d36f6407672d15a40c3f0a66cf2c9965f709603f31393d66908176ba52a59271bf5fd4f20913ce30de6cd83
- SSDEEP 1536:B+R9+PvYiRVER2+0eLvKnieWfIL8ZanZLamFmuH2liI2CE4kSrSbI/kHMihbA:B+R8vjRN64EiI2CE4+jXhb
- TLSH T17984A551E729CAE3D42887B8A4C743AD7339DE609BAB42129F54F30D4C71361DF6E286
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\help\is-8SJI20M33K.tmp
- Size 376KB
- SHA256 fd28458e81d22f38f6c5615f04c176e983b71939d319c216878ea1ea1c37a3fe
- MD5 92fd149e19fbccdd08444cf7fe755dc5
- SHA1 e81e137520c38ac6599a980978756bada3e97736
- SHA512 2a745fd7ddf34cb7c5941ece806f52dae883a6c5372ecc9c228884a43eef3c86826be17b65cd0addc74923d14d9e42b5509d63403a8c45d0c8e83e43b6803176
- SSDEEP 3072:iEbuoYNsYBPpOFCK+0t7R64C+p8K6SikKGG2uoVdaBX+B54:iEbtClS6nyBa
- TLSH T17D84C5639318C9A3C0289BB498D7533C733ADDB0DB9B22125E05F60D4E72765CE67B89
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\smooth-palette\is-9JVTKX4RSV.tmp
- Size 348KB
- SHA256 4554e3d02d8c7ed63ce4541bafeb85bda6883dbff377b49028f30ce6eaa94687
- MD5 b02cb71d2a40c003981e385d81863f04
- SHA1 34eb54ed26f86d07181f689baf6a55633dc1afb5
- SHA512 9f5e8601311b4bf155c8d17f4da0769c8e8a61baa50b580cfd5a67aecc29d88799ca914c1b2c0d66c502fcfb4249f30537b42e7dd349e3c1d35b48ec5be89221
- SSDEEP 1536:yd3VQX0sv3IEb6Z15ETzkC1FjENoNHif/xCqSeSlHcHMhF:C3CX0UsSTzBif/xChySF
- TLSH T1D074A451A718EAF3D52807B466D7C37C7B3DDD68879B421A5F58F2090CB1360AD3A38A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\gimp\3.0\plug-ins\van-gogh-lic\is-4QQX4AJ1XX.tmp
- Size 344KB
- SHA256 5c4ae07628774d3c3bbc8cf10543d4d1b2fd7a248afe73f9fca4defe7aea2571
- MD5 6e81852d3924bb37a7e7fbdb98e08544
- SHA1 4beec22906fd6526e30de92fa801428058783e0d
- SHA512 8bd1180d0a58b30a00050f3357baa474ae45e12ad5f167493dacf4b40fa7bc088a41f043c257302f8070c14e2fab21458ca24b2bf9e55377fa90776ef77e9927
- SSDEEP 1536:fWLA6Zc3anc6dugiIoNShAa8sMNxiobKxESLS13jkZyFHMor:IA6Z0Qu9BiobKxe1jr
- TLSH T10874A551A718EAF3D42807B466D7C37C7B3DDD648BDB422A5E54F2090CB13619E3A38A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\python3.14\site-packages\packaging-26.1.dist-info\licenses\is-H7VJDHHHXF.tmp
- Size 9KB
- SHA256 0d542e0c8804e39aa7f37eb00da5a762149dc682d7829451287e11b938e94594
- MD5 2ee41112a44fe7014dce33e26468ba93
- SHA1 598f87f072f66e2269dd6919292b2934dbb20492
- SHA512 27b8c0252eae50ca3ce02ab7c5670664c0c824e03eb3da1089f3f0a00d23e648a956bcb9f53645c6d79674a87c4cc86d1085dc335911be0210d691336b121857
- SSDEEP 192:nU6G5KXSD9VYUKhu1JVF9hFGvV/QiGkS594drFjuHYx5dvTrLhP:U9vlKM1zJlFvmNz5VrZ
- TLSH T18822512FBB48037B06C20162A79764CBF31E903F3B552568314CD1681F6B96593FB6AA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\python3.14\site-packages\pkg_resources\tests\data\my-test-package_unpacked-egg\my_test_package-1.0-py3.7.egg\EGG-INFO\is-Z1DTHWHAQS.tmp
- Size 1B
- SHA256 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
- MD5 68b329da9893e34099c7d8ad5cb9c940
- SHA1 adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
- SHA512 be688838ca8686e5c90689bf2ab585cef1137c999b48c70b92f67a5c34dc15697b5d11c982ed6d71be1e1e7f7b4e0733884aa97c3f7a339a8ed03577cf74be09
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\python3.14\site-packages\setuptools-81.0.0.dist-info\is-2GATZRLKOE.tmp
- Size 91B
- SHA256 60b2577585d0d8543452a9f627eea21080bede239ecbc947df10adbc52e477c4
- MD5 0dff239265d401b92fea51431058d68f
- SHA1 df7102c284710251786e54b8fc333431b9003518
- SHA512 0520a7383f1ba7ac0f100723f3915b75095097db1d51f3c62e02baf307c87e72c109495e5cab498e071ad35de841842c59fc86965af11c824fe002d33e2dc633
- TLSH T1A2B01215094014FC14A0FE134068A1601A6085455895607DB04A0344654AD4406CDC9E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\python3.14\site-packages\setuptools-81.0.0.dist-info\licenses\is-NZ5S7FG5P1.tmp
- Size 1023B
- SHA256 86da0f01aeae46348a3c3d465195dc1ceccde79f79e87769a64b8da04b2a4741
- MD5 141643e11c48898150daa83802dbc65f
- SHA1 0445ed0f69910eeaee036f09a39a13c6e1f37e12
- SHA512 ef62311602b466397baf0b23caca66114f8838f9e78e1b067787ceb709d09e0530e85a47bbcd4c5a0905b74fdb30df0cc640910c6cc2e67886e5b18794a3583f
- TLSH T12B11A82E735107721C5713B0557568D8B17B715F7B6B2784146EF240232A06CC1FBC40
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\python3.14\site-packages\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\is-GZU98XK128.tmp
- Size 2B
- SHA256 e6184ce10e266134fdcfa401e8f1a95005bcd4f18d16b62b757323e2833fe9a9
- MD5 45210da832f9626829457a65e9e7c4d0
- SHA1 ad5dd33dfa81a91517182f453879cc056a9f1230
- SHA512 00a0bdd98e82b3077db4b7cf7746140c204af743c208484934d7cb46b1c55bd31c8a29bd756d3c1eab8737df20f565c0b2a1c4e19b7c9a2785ca091696761cbc
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\python3.14\site-packages\setuptools\_vendor\jaraco_functools-4.4.0.dist-info\is-9QNERZ30UN.tmp
- Size 7B
- SHA256 d099cddcb7d71f82c845f5cbf9014e18227341664edc42f1e11d5dfe5a2ea103
- MD5 0ba8d736b7b4ab182687318b0497e61e
- SHA1 311ba5ffd098689179f299ef20768ee1a29f586d
- SHA512 7cccbb4afa2fade40d529482301beae152e0c71ee3cc41736eb19e35cfc5ee3b91ef958cf5ca6b7330333b8494feb6682fd833d5aa16bf4a8f1f721fd859832c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\python3.14\site-packages\setuptools\_vendor\jaraco_functools-4.4.0.dist-info\is-TQHWWFIUPG.tmp
- Size 91B
- SHA256 ff309ddcdd65ebd02bc724dbf2bcc4a0ff53a5b61792a44548d383e4ebb19d3b
- MD5 08dd01ac2afdbb287cc668d51c7056c8
- SHA1 e7224da97ededfb9d0239cf7cade76ebe3997743
- SHA512 917f7621e0d457d149964de3cddf50fe49be13388879f60ed818eaecdf5080864386c9cf2474dc2e514907935983d73dee1967b404f2941edced73856a1d6d1e
- TLSH T1B7B012150A4115F814A0EE134068A1201A70854799956079B14A03446549D1406CDC5E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\python3.14\site-packages\setuptools\_vendor\more_itertools-10.8.0.dist-info\is-BE3KJQBQMJ.tmp
- Size 82B
- SHA256 1b68144734c4b66791f27add5d425f3620775585718a03d0f9b110ba3a4d88db
- MD5 eca1d2e32987c5c9fd85f21a0c92d672
- SHA1 918c96cf4b87d846161401284f9bf811c56b5fcf
- SHA512 c4256b480eefa97b455e5e0f716884b554edb99c7a3e4b116a46590c63acf14ea14ff52c5814f5c8bfca2b4a309bda65de07b72fe8731a235478eb7e5e7e2d7c
- TLSH T170A01218014004F80090FE034239A1281A308509646500B5948101445545D0802C8DBA
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\python3.14\test\cjkencodings\is-BVM3EWUJE4.tmp
- Size 1KB
- SHA256 a6bbfb8ecb911d13581f7713391f8c0ceea1edd41537fdb300bbb4d62dd72e9b
- MD5 cc34bcc252d8014250b2fbc0a7880ead
- SHA1 89a79425e089c311137adcdcf0a11dfa9d8a4e58
- SHA512 c6fb4a793870993a9f1310ce59697397e5334dbb92031ab49a3ecc33c55e84737e626e815754c5ddbe7835b15d3817bf07d2b4c80ea5fd956792b4db96c18c2f
- TLSH T15711A27CA38A69364475C3A575CC76F9E508ECADED83B776043EC020B838A4DE0146B0
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\python3.14\test\test_importlib\builtin\is-EO6JKOHQCX.tmp
- Size 58B
- SHA256 cb9a3ce8f18e7d0a0cadb73cc9264772462de953499534736998d3c54f8c7c3c
- MD5 14ecf70dffdc7864f518117261e2f415
- SHA1 44076dfaa493a1a58c1970a2eadb75bbbc13a578
- SHA512 8c471291ee94b3fba4b132fbd832700eea718369bf1a229e3801c259ff67c7fc20d469bb82e128d41ab49b8cc7b005fa5e7af11e511daa55517d01028b610eea
- TLSH T1EAA002A6E05357426DA191082D40322493B2C4271F4010418A455263D3506684918C98
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\python3.14\test\test_importlib\builtin\is-U13SF03ZPM.tmp
- Size 142B
- SHA256 8962a375442bddd8d49865f3bf601c2c7a741fe947d8ec667358bb640cd0d19b
- MD5 573f3e9529bb06f937daa093920c0875
- SHA1 e49852d0090cd26a41d4d2a0073fb40fc8e1f064
- SHA512 fbce919c98b2e65ff00163011f2754bb95c8b1ee0d5c82c666c8800533c78af58e932ffe95dafce526d9fa4345c7dfdd92483a526c7b40603e720bdefd475ee6
- TLSH T18CC02B41C4F3F0100000CB043B006DF1AD2CBC373C2220D1F10C4150D77219982934CC
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\python3.14\test\test_pydoc\is-RCGQ0AOLI8.tmp
- Size 132B
- SHA256 9b2cce72fa8c7a7e688a79d55e15ea4914078c81058b0289ceb80cd5b69821c9
- MD5 96b87aa9b82712699b04a89939f197f7
- SHA1 83739dad3ced8534178c5486f5168ce4fb687fbb
- SHA512 ba0bacfc98aab2b2f6e0294cebc2fb6bc5786bdc512b38ba177ae21af6993020001ec083f87a6102ae37bb567a97dad3350b20cc65329f62472762158b06e2e0
- TLSH T126C02B56C4F3B0108240C10436007D724C187C331C826054F1484260D352018C293494
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Programs\GIMP 3\lib\python3.14\test\test_unittest\namespace_test_pkg\noop\is-ADFZC9DUDZ.tmp
- Size 110B
- SHA256 ca0d1af9a86e0385990873c970af3f3729b44b9721fdd75a14de686475e7e52d
- MD5 7532dbb7fcad422b14b54f5efcaee16d
- SHA1 44930c2c94f56151486ac1b24c8c9f2ddf9e2ad8
- SHA512 83738b5e449234d32ec10ae9e474e3c5b4c80ddd7769652dd3df85d5ec0035b6055aeb92eeebe6175343a2c6dc02a5b87445a75eee30ad5ac68110776406c9bd
- TLSH T17BB0126DE0270B21F0835EE98C0E97551338ACDA0E892C27FCFE93409B1470048E6C5C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Programs\GIMP 3\share\gimp\3.0\icons\Legacy\scalable\apps\is-ARCKATF2IV.tmp
- Size 3KB
- SHA256 6322b92ffce987312813cc2f3cf2e08086232aa9a8253c33115fdc7cd9bc51b4
- MD5 0a22b25d9a9aaa2d6f31da7f50c6d9b6
- SHA1 8b9a6676ec2ceaf026f1a00dd280bcef45887771
- SHA512 c5c154196802f0f8525bbc8c1c2e6f11d26389601a00f344f94e1a6ea223ebe97470b9f6c70532165240cd487eeb24aeea878480676fcb034127b22028418c6e
- TLSH T10A811016F2B604EA812E42B47AD5BA07810E32E38B940C27BD9C4979DF095D3737F786
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Programs\GIMP 3\share\gimp\3.0\icons\Legacy\scalable\apps\is-I04QBK6UB4.tmp
- Size 3KB
- SHA256 408e2b0429070d792cc7f9c8807060daa5231beef28a0d608cf3e33b22938f16
- MD5 a4a7a4891f805d928c9e531e8f56244e
- SHA1 a1925e5d4aa9ec50302f0283c8eacc1cfe378d6c
- SHA512 8ab3cc3fb8bafca6c3f279960911619f6d275af79789bc1cc34d9e8358aaae4a5b0f2ddf145405108baa4631faaa5623ac74ccef0883c4a3b410407557b9448a
- TLSH T16E713044F5F298E7D12EC145EEE1B905860AB05382894869BDED0779EF064C2B37F3E9
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Programs\GIMP 3\share\gimp\3.0\icons\Legacy\scalable\apps\is-XMV1WXGPUD.tmp
- Size 3KB
- SHA256 3b3407c2fa3fe4151689e132e07c19eadc6dcad9154bce69cec9be00f57bfdd5
- MD5 f4941b4e456da0a19f843af257636227
- SHA1 82299dc75e38d71f5d5cd10b3e12e442c044ab39
- SHA512 48d856a3e4e1406380c41407bd76bda5cc0336eae358f4b1353d20e4ab793556a0eaab245296d7ccb0650b35b8f8d7c4aef4324f880cac94f2b74d81533d2f30
- TLSH T127715140F5F288D7D12DC146EED1B905820EB04382894C69BEDD4779EF164C2A77A3E5
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Programs\GIMP 3\share\icons\Adwaita\16x16\places\is-CJIW63SXDC.tmp
- Size 333B
- SHA256 dc62059ee4fca7026c5f05a9a167aa95ab89266adc429548f290a648c3d5feaf
- MD5 a799a65c820d4850e8a0474369ae3f4e
- SHA1 8fe8e0091b8c07e0a18f60bcf9b0897e61bd5a91
- SHA512 cefd2ed84d7c58fd6c4d43f54c8e4ec46e8d3e22bb7f76db3cf44198ca98010e59e4894463514ba1b76331b9f8624815c10380ed7936c9b1ed4b6e0b500f4308
- TLSH T115E028E3435DAF65C7C43636491502414C0EC13C0591D75A0F800232CDA71C46DEFDD1
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Programs\GIMP 3\share\icons\Adwaita\scalable\places\is-YE86RM6Y9Y.tmp
- Size 1KB
- SHA256 1ad4aea2e388f553fd958fa0ce8120fb80d48319a004d48ce777d89e051c179d
- MD5 b6d42954c65e4da94572ebc815e6b2a7
- SHA1 538fe32772d564aa718451e1ac0f50fe3d759c48
- SHA512 ec78ae76614a1b291a903f4e2c8bf265d6e35725a4807441c2f4ab7f0bc8830f36147ae76009951521f6e6dc9e1810486e18df504de0181aaecf95137383440a
- TLSH T17A41AC7C6BA1869DF28D8E72A1FC4401211F21BBA24070A173FD2E551B75A81CE8FED5
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Programs\GIMP 3\share\icons\Adwaita\symbolic\devices\is-5NB8QAL62Q.tmp
- Size 543B
- SHA256 edbcdcbca98efa81f57cdfda0ce01a03c324e27e1d224f82a3b640a5443cbe68
- MD5 52de95d7a71c7bda09817e960e182472
- SHA1 4c05e9174c6b26ad3b3cf42172a77c68b32274e4
- SHA512 cb98ec3d32c26f99548d5b0fa79f583238c36d37ef7e92513f672b668c8358b22c55f674252d45d7cc5fb8f5e024f6fd1b53001a8fda8d18be1d2ca22bc44d97
- TLSH T199F050AC26F924FD9BDE58F54D39584C7B6BF8E635403051A58C2C901735CD28CABCD9
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Programs\GIMP 3\share\icons\Adwaita\symbolic\devices\is-EGVVCCD1ZM.tmp
- Size 629B
- SHA256 400909b4e6008b6a90e83e5bac3338ca96b068a6e765b548ce8af87e090054b1
- MD5 48281857472b1a6c0917cecbee2b39b8
- SHA1 0e45fb15f77bc37909e56fee9d807d5f96f60f53
- SHA512 39cc48c2ec5af9bb7d51c02f3cfffdd1ca3a31c698ffc91c96ce86fad241f7aa0a5b3ccb9a205d7639fe5307dedcf9ea0d3518baebb17b5399ae93517a88ccfd
- TLSH T1CEF0780C2AE9B27C7AEC0EE05A7B4CB403A7F3B2060074A2854C2D114C34D8A6DDFE94
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Programs\GIMP 3\share\icons\Adwaita\symbolic\devices\is-X6QET9F2S5.tmp
- Size 652B
- SHA256 4901616f75ba2773b3cfcc738a22a153d71cc99ae2f83d0a2fe240338869ea54
- MD5 52484033f8a0604a6e4f005d85a376e4
- SHA1 3b34f00d1c6a7eb4b2c03a189ac07e3a9310821d
- SHA512 e816211a0c5ac1c84ab6cf69a532841e8641b7b83339e5363a2d9b9cb8cbe6b9ccf28ce06fe6a0c9ba0b6e50379d149b35be726d44d579bb91d152c1a7132568
- TLSH T1A7F04E6C3FD9117C5FAF15F59D376CD42AC775D207443052458C5D848236C874EAB998
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Programs\GIMP 3\share\icons\Adwaita\symbolic\status\is-6Y46IZP5YE.tmp
- Size 488B
- SHA256 cdfb44e001493bbc89b85916f6a3b53e3acce6f91403d4df5332ab9b5ade9ce0
- MD5 bc2d93156697f0f46cce120436e19a66
- SHA1 483981f5e7ed5f1c20ea1eb47400267e08f437d3
- SHA512 445613569635b35ae7e4f7db48f0f57d9ad0ca11c5e14561c225dfdc4fb5c368e7edeb0db84a913d3df70be01be515253f824d88ee1c830a7a58e796832b4a34
- TLSH T13FF05924AFA617BC287A4DE41A7785A42166F2A3054CB0E1510C1C408637CD24D8AECC
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Programs\GIMP 3\share\icons\Adwaita\symbolic\status\is-D8JTCC5NVI.tmp
- Size 457B
- SHA256 1ae63c45551ac54158a0d5a8131feeb56f1055f9099dd2fb7a60cd8630ec7bae
- MD5 4086c6b784c91a658b45245459300762
- SHA1 7ab92edbd7420b425c7b810016373d127bcd2c01
- SHA512 9268645996e86cedf54f2994aba88f871e90740b48a3c7dd386b63142647df0fecb99b913f0d36fa6300bba7f2619d3316def1aff971ef407cb41982f31e323d
- TLSH T1E1F054147EEE003D77B944A10C7745483A6BB164060CB073A54C28408737CD94DEFDDC
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Programs\GIMP 3\share\icons\Adwaita\symbolic\status\is-EI8PQVNYLX.tmp
- Size 1KB
- SHA256 86ca7c95e67b5e593ea1a8b6810ee3f7f5c07369ff0bc98a08d28ab487144fbd
- MD5 b12063fafd00569c20a83c76e1b421d3
- SHA1 ba7b426b43cafe6f59630429c1578a56fbc227d4
- SHA512 b7ca8ee104b6b17e66bf2d133c169a7e5e9dafb68d9671d6d9c26d3821918c467f02da69180b1a6c997051e186eec4f0d8b8dc2de6075762e82fe97a5aab2225
- TLSH T14B21885A736951B8FBEF26B01D775886788BB4E642C0B0A0A68C7444C737D878ED58C4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Programs\GIMP 3\share\icons\Adwaita\symbolic\status\is-VHKV411K6F.tmp
- Size 1KB
- SHA256 818f6738b6c21c6c09350a888dc73274e2411b221b70d5bfa11d9a45cc94d166
- MD5 3b0bfc1d340f4d43d09f745ef212cad6
- SHA1 6f53c5d0257d5bca3db7f91c8c6980629e337080
- SHA512 fe3bbedfe550dd8f1e754fde7b1c98585ea2d4bb5f04096ccebbac244971a36ac2fc68a502ab64d04cc89635d6ca7f210f5753dad4494f4db2e72763bb0b51ec
- TLSH T14B3190B4374D9240BBCD34B19CFA85577B6735B60654B05E666829C0D5331CA4FFACC4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Programs\GIMP 3\share\locale\ca\LC_MESSAGES\is-BW6FP8WWRY.tmp
- Size 285KB
- SHA256 e26f0d39d34955c7c5815d58c6cfe9970b8a8cfdc2c6b40737a93f60ffd12f04
- MD5 4c4e51b98ba52bd37c26fd578aa429be
- SHA1 66203e9f1f5a392a74a8e6da55bc7ecc4bbe9af5
- SHA512 97665860f5bd483ace99fb832bde2bf89dd7cd2f4b37f6e00c53a2dfb95e81edb5e80ffebb2642d7695da87e1670ee0ff81e9bde2c03c66534612af6cbdc88c6
- SSDEEP 6144:By7Q8Txze6upJTGb5jO94FSqwEiIL4M3N5T9+6iJKkr6F1YoUcsOiA3EgcFjPRLr:8uwTwEiIL4M3Nd9+64Kkr6F1YoUcsOi1
- TLSH T1BA5419168AC41F13C4A3023EA3CAC147EBF8D0986359DB45F25C51387DCBEA89E67799
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\GIMP 3\share\locale\ca\LC_MESSAGES\is-EREBIJ01MO.tmp
- Size 108KB
- SHA256 4b2cb2f579a78fc8ba3dc6814b6efcf74239ec09c1c5c89ffe467ac1b0d4b68c
- MD5 58c0e6812ad0775fa6ba95fed6c64c53
- SHA1 afb98e0d4d905621ec22ce0e0d866e7d4af59fcf
- SHA512 8a2c581ddffacff6ce022f89c863c2ae336b12a4c10b51f139099f2cf6510ac77b126132cba38fe8b42bbddefbb2a8dcf0acad7fbf239ab1d2d9d68a3713cbde
- SSDEEP 3072:+mPRydqQKNrFeXorpfRFWzCN1v3s7INWxxsVklkxKgJ8ApaJFkIC08hiAk:+mPRIyrFeXorpfRFWzCN1Ps8gxSVbKQS
- TLSH T167B35D539AC01A12C947127FE7B3E123E3E4C5890725F74BE20D95DA2CC2F646D7B29A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\GIMP 3\share\locale\cs\LC_MESSAGES\is-SMR6C3LU6D.tmp
- Size 202KB
- SHA256 41a0a401c49586cec84e8bb7b892bbbee28114231b2cf5664b93416f2d1cba6f
- MD5 ba08201abdf1cc44246b82caeec30bca
- SHA1 49bc1d9ca9369753812f452164aed11de8b1b8e1
- SHA512 e199eb7eae0ac86afacf59749f59fe3d1d127ce3822d9895a551f5068840a0dfcc88e09afec38a579d0388d5e4620f5d47787376de511ab91dceba32d1c80046
- SSDEEP 6144:VMSCl+hrnoi+ZsjUYPSYZBxaBcxMa/9xr9VRoF:VCQnor
- TLSH T1D3144B0A52422379D62F227463AFA1A4933C82BC4366EB495C8D91751CC3A739DFB5FC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\GIMP 3\share\locale\de\LC_MESSAGES\is-QJRIJ2OSUL.tmp
- Size 282KB
- SHA256 2e1df2ae33f806c10ea014ef7606528e39af1aa1fcd7d6309fa3950d6057f2e4
- MD5 11c3c11e5a0fa022d5b9fb3ce2d63dfc
- SHA1 922eaa2e79f1cab370dadf98a976d6eff204bed5
- SHA512 ecde57b76a6c97e4bfd5287f9df6d7e4046f04718e7c397e1b83c526260c56f2ab08178f6247dc5c602c20e2c598358aa5d5aed14b4b73894140eb044d42b5db
- SSDEEP 6144:NP1jjLTmR/yOrup7TGb5BzirFSqw7t/NYT1Lrb9kign+OJU0MT:tVyDuy0w7t/NmRrb9kig+OJU0MT
- TLSH T13A544A029D451F3BC11A1375736A8C83BFB9D2AE8395C74A505CD0393E839B15EBE29E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\GIMP 3\share\locale\el\LC_MESSAGES\is-LE4R3BF9OX.tmp
- Size 281KB
- SHA256 9b3039e00a18e6fe05f675078e1e2e4e10a0e3492e5c611894c4762350c27a6c
- MD5 e9ff7b989806575539708fb65c779aff
- SHA1 1b8d4d9f2edc252370b230672b7d09ac08ab55ee
- SHA512 de74b2eadd29003050ec8c5277edf3f70b83fd9fdb5f883fb1727b88f9e264a5e068aac0ad4f7694de703a887eb6dabcd495b15100e5fc947a109dd145d5c2d3
- SSDEEP 3072:PL869wOhvWzLgcY068vb++ZsjUYPrDZDer/xFLYKYcIo2Zv3:j2OFWPFRi+ZsjUYPMY+av3
- TLSH T1155451EFB5842FFEC04A643646D9B07823A21C2CD74AD7D8A529C6307DE90619E32D5F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\GIMP 3\share\locale\el\LC_MESSAGES\is-QWE7PCWEWT.tmp
- Size 67KB
- SHA256 54df64bc96081833e7639e199712b90c6f88bf032ded255286ef09c2e6ff327f
- MD5 6d0f9f0d37455e628d66ac051f236a5e
- SHA1 80a91078b3009694df96b232c00413bebe5ef594
- SHA512 1e249373010a74d60c7079c866698d4c4232ef47e319ee2743e24644cd4609c21b71f737326af16667659ab8ac66f168230a66c7f0a3b50b4f431b10ff963ac3
- SSDEEP 768:MkzZjVDAzFwn28YEclaQgvp9zvIQNNfEocz6CjoXLXPoten8Fipx3VAvP4qXz1m2:nDcEclo/LfE/z6CjobXIe8rvIq
- TLSH T1FD6372DFF5542AEFC046947A41E9E0B83386AD2CD745D7D86238CB24BCED1619922E0F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\GIMP 3\share\locale\es\LC_MESSAGES\is-QNMTHSF410.tmp
- Size 51KB
- SHA256 e36d60d4132ea7d98476f1c71c3554937904890467bcb274a34a8ea2db9216c1
- MD5 66c35f07eafa8166161a92e6bb78e05a
- SHA1 9d02faa84549d7d01bcceec76dfa3c1321e66953
- SHA512 79ac17a24ad3e0a065af3e6f7dd051377b363241900ebf32e1eca2e4450620fd05ab51029f014d3202fe3a216d2802512bbe0c03e8d333fc3c1cbefde0945348
- SSDEEP 768:nPkNgPwE9H8RpjKm75IOLbn28YEcl+CgA9VvIQNNfEl93VpB2x+Q4jYFXbjk:nPPH8DjKOtLWEclQuFfEn3fB2i+0
- TLSH T15E333B96FAC40323C067127EF3CAD543A2F9C1DA9646C79E7168912C30C5F98C61BB9B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\GIMP 3\share\locale\hu\LC_MESSAGES\is-FA0WI7QY3O.tmp
- Size 398KB
- SHA256 348b9ac6588103af89a9d1ae76e0b1e7a60a9db587df7a0fe2155dc9cdfd3971
- MD5 953eb15a81c37f10072e5b0e773620f3
- SHA1 68308d4d6dca4c78c2b7a451838a1e595e5a7aac
- SHA512 f459154336999bc3cbcd8ff9700a00fd17938426d472b4da6c05383b38311deed82b95876987e125388409d55402c6260a91ea69338ad02c9b65fb4b31792073
- SSDEEP 6144:IFDB8de61WKrlNYE+ItRtKjHqgw7HviohPppIE8t1Eq+J0PdkU9toOo9xA0:mSRlcKTHvicBmEFYdBon5
- TLSH T148845AB2CD765E38E67C067E0CB719364781A6CFDD82C90F62A5F67035932817A432B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\GIMP 3\share\locale\it\LC_MESSAGES\is-PELEDYZ2T7.tmp
- Size 200KB
- SHA256 c74f9a556ea5b981e145d183fe4b1715930750112fbb718b70ebd04736801960
- MD5 48b6c94c49739ab4670570e9cc50d9a8
- SHA1 bd9fd5d10b3f4cbfdb61272552df0b50717b7a2d
- SHA512 4aceb2d50f9299f360993e6067a33dac6882fdaac279ddcdcdb60141aecacab2230a53e496f66fc53b4112fad7aa0baaae1b8c8b077cd1c69258e5f0d783795d
- SSDEEP 6144:bmWqoS7QoeNk0bUv8VdKKuw8rg/AcZ58wgcz1/mXHziUcnWLb+U/uwZtPW:FkwJVdKKuw8rg/AcZS0
- TLSH T1B5144C359DC01622C957037593A6A041E33AC4DCFB4AAB55664E423C2FCBD64BF7F28A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\GIMP 3\share\locale\ja\LC_MESSAGES\is-G0RUQV0VYF.tmp
- Size 586KB
- SHA256 f8fd1c1e2d44feac43a068a9cfc2ebc5406fbf9a75c3843d4f356bbc9723e832
- MD5 5c3160b46937b1069ab1a3a0e34aac26
- SHA1 9f4583ba2afd12995f00204fc9c40edd0a2ab39e
- SHA512 12e301effd3f0d3555a675fbc59fcf019e65c8ce4fc4e8b4e6298e79219889744979108711ef72e8405eea2ccfc3d1e251c281228a387d7ac085c7ffa0afd020
- SSDEEP 12288:ZdEeMDFEuc6t0OvzUJtXqAfYaUq9ZaTZK4:Uc6tcBYtBTZL
- TLSH T160D4E92EF3C16E35D81302B318AF71D06672DC5FEA96F726542CE0383A616DDE252A74
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\GIMP 3\share\locale\kk\LC_MESSAGES\is-N4Y402Q3OV.tmp
- Size 663KB
- SHA256 60fe13461435afed2bf654167ba36f3fd85503f36feb0c4dbcc59e2c13d59bea
- MD5 c7e968b08319a4f3b71cb43f4fd6384d
- SHA1 e3525b92dae132d256668951af07fba113a51728
- SHA512 8240c2d8a982840c86b4a7f86d67c5fb9115c8fa484ed0a79fde8ccfc81fc269e732b5ecbb9ead593a54cc36aa088c2b1be4857cafd1965ab1176e8c03aede99
- SSDEEP 12288:IsaCCfTWEuc6tY0vzUJtjMy/6CTqKhoY/v56W0i/b6sgCeI6Pcv9LTlPa2Mcg+xM:JbCfoc6to9G
- TLSH T19CE47254628A6CFFE312E1B72C4576596DB640BCBB97A3432454B87E39FE1A0073A343
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\GIMP 3\share\locale\lt\LC_MESSAGES\is-5M54FU9N1Q.tmp
- Size 531KB
- SHA256 f0921ed7ea05fdf619cc60aca182becea0c324e9a20b3fdc593962ab2f8d68b2
- MD5 0727c6a9105a1267491072930aa98257
- SHA1 02e3c486cb856a0d69239a4f41f6b0d02c3fe3b1
- SHA512 aa34708b817d9faba8f67b32d5c534a65fd79678fb8a3ac8c6012e496972243403ff0ef9fb4325205c44b6833dbe44dc38496b900f3c1cad6c6ff3522aea0381
- SSDEEP 6144:M+rsc3hkudvIdJtxTQ8g/uxW6t04KYC2e3FvzUJQybhQ0VJ4dz6WBFGhxdtlwpQM:reQgdJtEuc6t0dvzUJt6AdJ+
- TLSH T1E2C44C0BF2802F36DA1712F656FBC1B1CBB4D19D53A2D956A05CF03C36A71E8262B749
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\GIMP 3\share\locale\nn\LC_MESSAGES\is-IWXKTV4XSK.tmp
- Size 192KB
- SHA256 2432a8f739e5dd7da9d0fac78eed107bc8940b29ef7fdbba462f2cefee999bf8
- MD5 623bb8e7091fcd535d837acb2b74fce2
- SHA1 ccecd7edcf7fd1639a1b69906cce24fc222d1ed7
- SHA512 1dd5619eb8a125aa4af4342d177248cac3db0132d7ee24704137852109d5a84244eec029e25671fe4aa9bd4321eadf265ceb0797bcc562394c8cffef95857600
- SSDEEP 6144:9nrPATNk0bUv8idKKuw8rg/AcK5W2VSI+:9jABkwJidKKuw8rg/AcKTSI+
- TLSH T141146B12EF402736C524027292AA595953BCD1D9C3968F9BA78DD0753EC3DB02FBF298
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\GIMP 3\share\locale\pt\LC_MESSAGES\is-HHD3SS0XLP.tmp
- Size 202KB
- SHA256 c0df75cd97972a994ae46372bec49ce7fe479f49608c7f31addf17db0d857a71
- MD5 a89e36b9922322e8a48ed4a11ba42e0d
- SHA1 30d3a4a0435a85da07d443542847e373b4d91570
- SHA512 987bb4bf9fa7f6aa7b27c10a953308dd0bd5dc7bed28351d0d4be6fc702345df1639643c27b275d45018b83ae0c4c372da2665a801c8adde4283dbf8d5c5d53f
- SSDEEP 3072:jYgv4MnsPbWC6N70bU18idKKuw8rg/AceT57bvRi9lgNtjYm8r+rQGj:/v3n6QN70bU18idKKuw8rg/AcK5LdL
- TLSH T1A7144A295EC00722C5170376735B991367B48099A34ACF87A31E82353EC6EA4EE7F79D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\GIMP 3\share\locale\ta\LC_MESSAGES\is-F00X5RI2MK.tmp
- Size 104KB
- SHA256 72caec8dbc81852c73f440e445b59007266922ca49f0cd7b7beb370d44313c13
- MD5 9cbc829689c102754d39d5a4a158c639
- SHA1 486d239cdbc90dabe61fd43ed9e38c94d785a27a
- SHA512 f66486688d929dc49a80327713a7ea34b205031209611610ce4999b0d1544fc47411f9f0fdb5dff082159e013c86b561b350066d9e18e9abbcc7359970d64613
- SSDEEP 1536:L+4xCq0pr8htt3nlVMgeuzCN1IFkyLOOGEnluObji36dY:L+4xCqU8VMgeuzCN1cGETnY
- TLSH T102A3CACE427DED89CE8318BF431853A453A8A145C526E3A2B8B99E459CDCDACCF3417D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\GIMP 3\share\locale\uk\LC_MESSAGES\is-4FLAJBU4NR.tmp
- Size 500KB
- SHA256 8528a15d82719cbe7a5cba335cb31391ef05b21a2c177ab8a21611860a7dfd9f
- MD5 ff363d8dfd1f86b7ef14ee6e3231e88e
- SHA1 79c4a01c82983782a028d4046a32e307f0782e7d
- SHA512 b601f953863f2efe67f966b290bef06639f40e45969a00f5a3db43801b95e64b2fb727f4603a1efe07a681bffb0757a01d5dd8d06379c809de8d815888de8905
- SSDEEP 12288:PQvtkXnuShYqjoHvid6nEfidTlFk7wTmO6f:Y1kXzoHvidSA
- TLSH T178B48552DAB90EAFC3159177D8A13A562F9111FE3B5AC30B2460FEBD32E3012563D399
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\GIMP 3\share\locale\zh_HK\LC_MESSAGES\is-3AOBNPAVIB.tmp
- Size 169KB
- SHA256 dceda1a517315c390902fe815b872498c0e7634034e590d75fbec9778cef95fd
- MD5 79f777f584e36440f74d5587a0f1a4cf
- SHA1 ad92d112ae9ccf0e9427869144ae00302ea938e2
- SHA512 3a7498c9f00272f3ebbf2f46c977fc184770ef68e2cc8b7316dcdc4b71fbaac0b00eed20cdc62c12dc917f58eff72b16584d0dee32e0a95ee7b0061b55444d8b
- SSDEEP 3072:prq9YZbem80VGyHG40nWcDCJjUYPq7V2Jn32TN6:pm9YBs6XeFDCJjUYPafTQ
- TLSH T153044A0357C82B7AC51A603173AF61D6873494BC83B7DB0DAD9980792C838666FF76E4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-AGI4V8Y8PZ.tmp\gimp.tmp
- Size 4.9MB
- SHA256 d707931d020ad49c98645bd680cceb3d86a648eb34490ae1d5ffe2afc0b06670
- MD5 84d91a3e7c7637e1e152d3125acbaf85
- SHA1 f6963775cfe78722e6f3404d4b3850db6237d0b4
- SHA512 d96017a5b0fdad641eff5d85e9305fae65799573eb600e196e9895c0a8a38bbb3d87821f2202e0eedd90515bcdc8752e4e2029aa81d9a150d14d30a3d1643b64
- SSDEEP 98304:dvdHRh7cGM90sD72C77bK3UnzmmC333p3337:PHnsDqif/z8
- TLSH T12F368C63B344A13AD0771A3A5C7FA6485A3F7E202A168C477BF4195C4E3A6403D3A76F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\GIMP 3.2.4.lnk
- Size 1KB
- SHA256 50f40dc2eb58ecb78e4702c3a175123a986e25f05b6942eaf2af2c04ee5b392d
- MD5 513ee901b7c3d9e5d7356b0b07fed1a4
- SHA1 1ee21071e4db62f1f0fbf205a4c360c352a0f7e4
- SHA512 d1bea5cfba361bbc93539bc1769ee6d0630b9b6fb0b9084dc6660fff56ced2cda26a6de3aa3a3714f61642b78bc8b297e339338d4a1840bba5724effc163013b
- TLSH T17F21F30E39C23B2AC3B2D77440A6BB7D9373E842E7665F09504552462A46345F584F5F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\Desktop\GIMP 3.2.4.lnk
- Size 1KB
- SHA256 d580c6bef3b1a1469078cc184c6001bc2250e767800162bdf7fe9e6eb99ee236
- MD5 1f8bf97b705a50ed7b8496c73db16ef8
- SHA1 8e66d0806b3b67f9fd2ab1224a566cf1f45ecc12
- SHA512 a875237ec3fe91f2187e8c0cfe1b9144e1fe4d39d3f0b6efb6a436d8552686e138ffa06022f40bd952e70c5b36abee1a4b6d4c5541844660eea639d444b1382c
- TLSH T16B21F00A79C3172AC3B2EB7841F77BBA9367F44297665F06604592062A06381F584F5F
- MD5 SHA1 SHA512 TLSH