Overview

overview

7

Static

static

3

Enscape-4....w3.rar

windows7-x64

3

Enscape-4....w3.rar

windows10-2004-x64

3

Enscape-4....w3.exe

windows7-x64

7

Enscape-4....w3.exe

windows10-2004-x64

7

Enscape-4....er.dll

windows7-x64

1

Enscape-4....er.dll

windows10-2004-x64

1

Enscape-4....ME.txt

windows7-x64

1

Enscape-4....ME.txt

windows10-2004-x64

1

Analysis

  • max time kernel
    152s
  • max time network
    163s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/06/2024, 16:13

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Enscape-4.1.0.1388-preview3/Enscape-4.1.0.1388-preview3.exe
  • Size 430.0MB
  • Sample240625-tpem4asgnn
  • SHA256 804848fa10a4d73273f555a3d13fa11e535249f06e319e447b41d26f4c48b87a
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
discoverypersistence

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 7 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 22 IoCs
  • Loads dropped DLL 16 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 51 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 15 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 9 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\Enscape-4.1.0.1388-preview3\Enscape-4.1.0.1388-preview3.exe
    "C:\Users\Admin\AppData\Local\Temp\Enscape-4.1.0.1388-preview3\Enscape-4.1.0.1388-preview3.exe"
    1⤵
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3964
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\setvrlservice.exe -dump
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:712
      • C:\Users\Admin\AppData\Local\Temp\setvrlservice.exe
        C:\Users\Admin\AppData\Local\Temp\setvrlservice.exe -dump
        3⤵
        • Executes dropped EXE
        PID:4088
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\get_compatible_vc_redist_version.bat 2>nul
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2804
      • C:\Windows\system32\reg.exe
        reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\VisualStudio\14.0\VC\Runtimes\X64"
        3⤵
          PID:468
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\VisualStudio\14.0\VC\Runtimes\X64" /V Version |findstr /ri "REG_SZ"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2024
          • C:\Windows\system32\reg.exe
            reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\VisualStudio\14.0\VC\Runtimes\X64" /V Version
            4⤵
              PID:4944
            • C:\Windows\system32\findstr.exe
              findstr /ri "REG_SZ"
              4⤵
                PID:4732
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\VisualStudio\14.0\VC\Runtimes\X64" /V Installed |findstr /ri "REG_DWORD"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:4840
              • C:\Windows\system32\reg.exe
                reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\VisualStudio\14.0\VC\Runtimes\X64" /V Installed
                4⤵
                  PID:916
                • C:\Windows\system32\findstr.exe
                  findstr /ri "REG_DWORD"
                  4⤵
                    PID:3376
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\VisualStudio\14.0\VC\Runtimes\X64" /V Minor |findstr /ri "REG_DWORD"
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:5064
                  • C:\Windows\system32\reg.exe
                    reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\VisualStudio\14.0\VC\Runtimes\X64" /V Minor
                    4⤵
                      PID:3948
                    • C:\Windows\system32\findstr.exe
                      findstr /ri "REG_DWORD"
                      4⤵
                        PID:5100
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\get_compatible_net48_version.bat 2>nul
                    2⤵
                    • Suspicious use of WriteProcessMemory
                    PID:3688
                    • C:\Windows\system32\reg.exe
                      reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full"
                      3⤵
                        PID:4568
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full" /v Version |findstr /ri "REG_SZ"
                        3⤵
                        • Suspicious use of WriteProcessMemory
                        PID:536
                        • C:\Windows\system32\reg.exe
                          reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full" /v Version
                          4⤵
                            PID:4916
                          • C:\Windows\system32\findstr.exe
                            findstr /ri "REG_SZ"
                            4⤵
                              PID:4924
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /c reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full" /v Release |findstr /ri "REG_DWORD"
                            3⤵
                            • Suspicious use of WriteProcessMemory
                            PID:1700
                            • C:\Windows\system32\reg.exe
                              reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full" /v Release
                              4⤵
                                PID:3080
                              • C:\Windows\system32\findstr.exe
                                findstr /ri "REG_DWORD"
                                4⤵
                                  PID:748
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\list_compatible_netcore_versions.bat 8 0 5 2>nul
                              2⤵
                              • Suspicious use of WriteProcessMemory
                              PID:4424
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /c dotnet --list-runtimes |findstr /C:"Microsoft.NETCore.App"
                                3⤵
                                • Suspicious use of WriteProcessMemory
                                PID:1412
                                • C:\Program Files\dotnet\dotnet.exe
                                  dotnet --list-runtimes
                                  4⤵
                                    PID:3952
                                  • C:\Windows\system32\findstr.exe
                                    findstr /C:"Microsoft.NETCore.App"
                                    4⤵
                                      PID:1804
                                • C:\Program Files\Enscape\redist\VC_redist.x64.exe
                                  "C:\Program Files\Enscape\redist\VC_redist.x64.exe" /quiet /norestart /install
                                  2⤵
                                  • Executes dropped EXE
                                  • Suspicious use of WriteProcessMemory
                                  PID:748
                                  • C:\Windows\Temp\{28786708-836B-4180-8231-918755194AE2}\.cr\VC_redist.x64.exe
                                    "C:\Windows\Temp\{28786708-836B-4180-8231-918755194AE2}\.cr\VC_redist.x64.exe" -burn.clean.room="C:\Program Files\Enscape\redist\VC_redist.x64.exe" -burn.filehandle.attached=540 -burn.filehandle.self=548 /quiet /norestart /install
                                    3⤵
                                    • Checks computer location settings
                                    • Executes dropped EXE
                                    • Loads dropped DLL
                                    • Suspicious use of WriteProcessMemory
                                    PID:1352
                                    • C:\Windows\Temp\{53D6E4BD-24EF-4D49-BF0E-C4FB5DA60D93}\.be\VC_redist.x64.exe
                                      "C:\Windows\Temp\{53D6E4BD-24EF-4D49-BF0E-C4FB5DA60D93}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{9B0723B3-72FA-4E1A-B311-63089F2EFBFB} {AE0F6913-CE6D-443E-917D-B6023B20DD8E} 1352
                                      4⤵
                                      • Executes dropped EXE
                                      • Adds Run key to start application
                                      • Modifies registry class
                                      • Suspicious use of AdjustPrivilegeToken
                                      • Suspicious use of WriteProcessMemory
                                      PID:4304
                                      • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
                                        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={c649ede4-f16a-4486-a117-dcc2f2a35165} -burn.filehandle.self=1028 -burn.embedded BurnPipe.{A5963CF7-06B7-4821-883A-F054C9BC9915} {5841E924-66F3-4835-B656-E3D9E94B3A04} 4304
                                        5⤵
                                        • Suspicious use of WriteProcessMemory
                                        PID:2388
                                        • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
                                          "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=516 -burn.filehandle.self=536 -uninstall -quiet -burn.related.upgrade -burn.ancestors={c649ede4-f16a-4486-a117-dcc2f2a35165} -burn.filehandle.self=1028 -burn.embedded BurnPipe.{A5963CF7-06B7-4821-883A-F054C9BC9915} {5841E924-66F3-4835-B656-E3D9E94B3A04} 4304
                                          6⤵
                                          • Loads dropped DLL
                                          PID:3464
                                          • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
                                            "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{F431A021-00C7-4372-B7BD-6E327F369DCD} {661D419B-20E3-4E54-9229-9B3709BCF0B8} 3464
                                            7⤵
                                            • Modifies registry class
                                            PID:4568
                                • C:\Program Files\Enscape\redist\ndp48-x86-x64-allos-enu.exe
                                  "C:\Program Files\Enscape\redist\ndp48-x86-x64-allos-enu.exe" /q /norestart
                                  2⤵
                                  • Executes dropped EXE
                                  PID:1504
                                  • F:\e2ebe4536b8aa711bfec71\Setup.exe
                                    F:\e2ebe4536b8aa711bfec71\\Setup.exe /q /norestart /x86 /x64 /redist
                                    3⤵
                                    • Executes dropped EXE
                                    • Loads dropped DLL
                                    • Checks processor information in registry
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:2740
                                • C:\Program Files\Enscape\registration\Enscape.Installer.Runtime.exe
                                  "C:\Program Files\Enscape\registration\Enscape.Installer.Runtime.exe" install -archicad -all-users "C:\Program Files\Enscape"
                                  2⤵
                                  • Checks computer location settings
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  PID:1076
                                • C:\Program Files\Enscape\registration\Enscape.Installer.Runtime.exe
                                  "C:\Program Files\Enscape\registration\Enscape.Installer.Runtime.exe" install -revit -all-users "C:\Program Files\Enscape"
                                  2⤵
                                  • Checks computer location settings
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  PID:3056
                                • C:\Program Files\Enscape\registration\Enscape.Installer.Runtime.exe
                                  "C:\Program Files\Enscape\registration\Enscape.Installer.Runtime.exe" install -rhino -all-users "C:\Program Files\Enscape"
                                  2⤵
                                  • Checks computer location settings
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  PID:1432
                                • C:\Program Files\Enscape\registration\Enscape.Installer.Runtime.exe
                                  "C:\Program Files\Enscape\registration\Enscape.Installer.Runtime.exe" install -sketchup -all-users "C:\Program Files\Enscape"
                                  2⤵
                                  • Checks computer location settings
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  PID:4656
                                • C:\Program Files\Enscape\registration\Enscape.Installer.Runtime.exe
                                  "C:\Program Files\Enscape\registration\Enscape.Installer.Runtime.exe" install -vectorworks -all-users "C:\Program Files\Enscape"
                                  2⤵
                                  • Checks computer location settings
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  PID:3504
                                • C:\Program Files\Enscape\registration\Enscape.Installer.Runtime.exe
                                  "C:\Program Files\Enscape\registration\Enscape.Installer.Runtime.exe" deploymentsettings -all-users "en-US" -eulaAcceptance
                                  2⤵
                                  • Checks computer location settings
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  PID:2548
                                • C:\Windows\SYSTEM32\cmd.exe
                                  "cmd" /c echo start "" "C:\Program Files\Chaos\VRLService\vrlsupervisor.exe" start --vrol-path "C:\Program Files\Chaos\VRLService\vrol.exe"
                                  2⤵
                                    PID:5112
                                  • C:\Windows\explorer.exe
                                    "explorer" "C:\Program Files\Chaos\VRLService\start.bat"
                                    2⤵
                                      PID:1052
                                    • C:\Program Files\Chaos\VRLService\vrlctl.exe
                                      "C:\Program Files\Chaos\VRLService\vrlctl.exe" browser
                                      2⤵
                                      • Executes dropped EXE
                                      PID:5036
                                      • C:\Windows\System32\rundll32.exe
                                        C:\Windows\System32\rundll32.exe url.dll,FileProtocolHandler http://localhost:30304
                                        3⤵
                                          PID:3020
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://localhost:30304/
                                            4⤵
                                            • Enumerates system info in registry
                                            • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                            • Suspicious use of FindShellTrayWindow
                                            • Suspicious use of SendNotifyMessage
                                            PID:4060
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8c13a46f8,0x7ff8c13a4708,0x7ff8c13a4718
                                              5⤵
                                                PID:1132
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,13239362981672349590,967378834398121675,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
                                                5⤵
                                                  PID:1192
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,13239362981672349590,967378834398121675,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2348 /prefetch:3
                                                  5⤵
                                                    PID:1624
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,13239362981672349590,967378834398121675,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2672 /prefetch:8
                                                    5⤵
                                                      PID:2700
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,13239362981672349590,967378834398121675,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2336 /prefetch:1
                                                      5⤵
                                                        PID:2180
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,13239362981672349590,967378834398121675,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:1
                                                        5⤵
                                                          PID:4624
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,13239362981672349590,967378834398121675,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4832 /prefetch:1
                                                          5⤵
                                                            PID:5376
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,13239362981672349590,967378834398121675,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4260 /prefetch:1
                                                            5⤵
                                                              PID:5460
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,13239362981672349590,967378834398121675,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3640 /prefetch:8
                                                              5⤵
                                                                PID:5624
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,13239362981672349590,967378834398121675,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3640 /prefetch:8
                                                                5⤵
                                                                  PID:5808
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,13239362981672349590,967378834398121675,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1
                                                                  5⤵
                                                                    PID:5816
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,13239362981672349590,967378834398121675,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:1
                                                                    5⤵
                                                                      PID:5824
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,13239362981672349590,967378834398121675,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4924 /prefetch:1
                                                                      5⤵
                                                                        PID:6096
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,13239362981672349590,967378834398121675,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
                                                                        5⤵
                                                                          PID:228
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,13239362981672349590,967378834398121675,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1856 /prefetch:1
                                                                          5⤵
                                                                            PID:5952
                                                                    • C:\Program Files\Chaos\UnifiedLogin\ulasupervisor.exe
                                                                      "C:\Program Files\Chaos\UnifiedLogin\ulasupervisor.exe" createFile --path "C:\Program Files\Chaos\UnifiedLogin\start.bat" --content "start \"\" \"C:\Program Files\Chaos\UnifiedLogin\ulasupervisor.exe\""
                                                                      2⤵
                                                                      • Executes dropped EXE
                                                                      PID:1088
                                                                    • C:\Windows\explorer.exe
                                                                      "explorer" "C:\Program Files\Chaos\UnifiedLogin\start.bat"
                                                                      2⤵
                                                                        PID:208
                                                                    • C:\Windows\system32\vssvc.exe
                                                                      C:\Windows\system32\vssvc.exe
                                                                      1⤵
                                                                      • Checks SCSI registry key(s)
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      PID:1616
                                                                    • C:\Windows\system32\srtasks.exe
                                                                      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
                                                                      1⤵
                                                                        PID:1540
                                                                      • C:\Windows\system32\msiexec.exe
                                                                        C:\Windows\system32\msiexec.exe /V
                                                                        1⤵
                                                                        • Enumerates connected drives
                                                                        • Drops file in System32 directory
                                                                        • Drops file in Windows directory
                                                                        • Modifies data under HKEY_USERS
                                                                        • Modifies registry class
                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                        PID:3972
                                                                      • C:\Windows\explorer.exe
                                                                        C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                        1⤵
                                                                          PID:4772
                                                                          • C:\Windows\system32\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /c ""C:\Program Files\Chaos\VRLService\start.bat" "
                                                                            2⤵
                                                                              PID:4304
                                                                              • C:\Program Files\Chaos\VRLService\vrlsupervisor.exe
                                                                                "C:\Program Files\Chaos\VRLService\vrlsupervisor.exe" start --vrol-path "C:\Program Files\Chaos\VRLService\vrol.exe"
                                                                                3⤵
                                                                                • Executes dropped EXE
                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                PID:4876
                                                                                • C:\Program Files\Chaos\VRLService\vrol.exe
                                                                                  "C:\Program Files\Chaos\VRLService\vrol.exe"
                                                                                  4⤵
                                                                                  • Executes dropped EXE
                                                                                  PID:3924
                                                                                • C:\Program Files\Chaos\VRLService\vrol.exe
                                                                                  "C:\Program Files\Chaos\VRLService\vrol.exe"
                                                                                  4⤵
                                                                                  • Executes dropped EXE
                                                                                  PID:552
                                                                                • C:\Program Files\Chaos\VRLService\vrol.exe
                                                                                  "C:\Program Files\Chaos\VRLService\vrol.exe"
                                                                                  4⤵
                                                                                  • Executes dropped EXE
                                                                                  PID:3724
                                                                          • C:\Windows\explorer.exe
                                                                            C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                            1⤵
                                                                              PID:4616
                                                                              • C:\Windows\system32\cmd.exe
                                                                                C:\Windows\system32\cmd.exe /c ""C:\Program Files\Chaos\UnifiedLogin\start.bat" "
                                                                                2⤵
                                                                                  PID:2388
                                                                                  • C:\Program Files\Chaos\UnifiedLogin\ulasupervisor.exe
                                                                                    "C:\Program Files\Chaos\UnifiedLogin\ulasupervisor.exe"
                                                                                    3⤵
                                                                                    • Executes dropped EXE
                                                                                    PID:2804
                                                                                    • C:\Program Files\Chaos\UnifiedLogin\ula.exe
                                                                                      "C:\Program Files\Chaos\UnifiedLogin\ula.exe"
                                                                                      4⤵
                                                                                      • Executes dropped EXE
                                                                                      PID:5140
                                                                                    • C:\Program Files\Chaos\UnifiedLogin\ula.exe
                                                                                      "C:\Program Files\Chaos\UnifiedLogin\ula.exe"
                                                                                      4⤵
                                                                                      • Executes dropped EXE
                                                                                      PID:1708
                                                                                    • C:\Program Files\Chaos\UnifiedLogin\ula.exe
                                                                                      "C:\Program Files\Chaos\UnifiedLogin\ula.exe"
                                                                                      4⤵
                                                                                      • Executes dropped EXE
                                                                                      PID:5900
                                                                              • C:\Windows\System32\CompPkgSrv.exe
                                                                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                1⤵
                                                                                  PID:1080
                                                                                • C:\Windows\System32\CompPkgSrv.exe
                                                                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                  1⤵
                                                                                    PID:4864

                                                                                  Network

                                                                                        MITRE ATT&CK Enterprise v15

                                                                                        Replay Monitor

                                                                                        Loading Replay Monitor...

                                                                                        Downloads

                                                                                        e58757e.rbs
                                                                                        • Path C:\Config.Msi\e58757e.rbs
                                                                                        • Size 19KB
                                                                                        • SHA256 e4c2c6412016a695d2795cb4b127890c16c23caf2c037f80df3bfe177dcbf930
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        e58758a.rbs
                                                                                        • Path C:\Config.Msi\e58758a.rbs
                                                                                        • Size 19KB
                                                                                        • SHA256 51045255239152cf8ff438ccd3c5101769bb02f1134a5944a97196817dea1f4b
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        e587591.rbs
                                                                                        • Path C:\Config.Msi\e587591.rbs
                                                                                        • Size 21KB
                                                                                        • SHA256 28d66e1966418340b99e488994c019f3da8077b097466989afd9ce4846716fcd
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        e5875a0.rbs
                                                                                        • Path C:\Config.Msi\e5875a0.rbs
                                                                                        • Size 21KB
                                                                                        • SHA256 4a3bf9ca6673fd75b01a3fa4511719d7a8def28453e800d5e9383b3d7b552d1d
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        ulasupervisor.exe
                                                                                        • Path C:\Program Files\Chaos\UnifiedLogin\ulasupervisor.exe
                                                                                        • Size 7.6MB
                                                                                        • SHA256 65d51cf6b2102ed5554e5aad4881cd11072f820b58f97b8594a76f51cec07363
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        installer.exe
                                                                                        • Path C:\Program Files\Chaos\UnifiedLogin\uninstall\installer.exe
                                                                                        • Size 6.4MB
                                                                                        • SHA256 b96e97fa7d45f90999c4919304df6a286a1c64d347a6212cf6a73c4703467d6b
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        templog.log
                                                                                        • Path C:\Program Files\Chaos\UnifiedLogin\uninstall\templog.log
                                                                                        • Size 2KB
                                                                                        • SHA256 c3d220e1da4c91477ad946a26c7f3c4be53453b33a1f6feb448bc8e6fc33c75f
                                                                                        • MD5 SHA1 SHA512
                                                                                        Submit Download

                                                                                        install.log
                                                                                        • Path C:\Program Files\Chaos\VRLService\uninstall\install.log
                                                                                        • Size 3KB
                                                                                        • SHA256 d0c8243ff41fe07bd0b11932de7a2a49c50fabf147e00136cc47f0591f32faff
                                                                                        • MD5 SHA1 SHA512
                                                                                        Submit Download

                                                                                        vrlsupervisor.exe
                                                                                        • Path C:\Program Files\Chaos\VRLService\vrlsupervisor.exe
                                                                                        • Size 5.5MB
                                                                                        • SHA256 063544aee1c6ed29339d3fad5fe078b01f4a3981453e6944508e949c31f1a466
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        chaos_installs_cleanup.log
                                                                                        • Path C:\Program Files\Common Files\ChaosGroup\chaos_installs_cleanup.log
                                                                                        • Size 45B
                                                                                        • SHA256 cad8c840f4c42cea8814101da0adf1ba6bb7ea334fd059f87a93729c33a7946c
                                                                                        • MD5 SHA1 SHA512
                                                                                        Submit Download

                                                                                        EnscapeMaterial.rfa
                                                                                        • Path C:\Program Files\Enscape\Enscape.Revit.Plugin-net8.0-windows7.0\Data\RevitFamilies\2025\EnscapeMaterial.rfa
                                                                                        • Size 456KB
                                                                                        • SHA256 ca2b61579242de2919d78e84d5189e6638d3cfbc075539bdaf285e3269527cbe
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        Enscape.Sketchup.Plugin.2021.runtimeconfig.json
                                                                                        • Path C:\Program Files\Enscape\Enscape.Sketchup.Plugin.Host-net8.0\Enscape.Sketchup.Plugin.2021.runtimeconfig.json
                                                                                        • Size 374B
                                                                                        • SHA256 73a3c729eae68f7312e3ac61ddb19e702bccdb87280a302e81b926c09ea4accb
                                                                                        • MD5 SHA1 SHA512
                                                                                        Submit Download

                                                                                        Fog.glsl
                                                                                        • Path C:\Program Files\Enscape\RendererHost\Renderer\SystemData\Shaders\Fog.glsl
                                                                                        • Size 208KB
                                                                                        • SHA256 3015b9be29ac0d6544318998c9be652be4aae8699e3a26edfb94953b7de3743e
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        LightCullCamIntersections.glsl
                                                                                        • Path C:\Program Files\Enscape\RendererHost\Renderer\SystemData\Shaders\LightCullCamIntersections.glsl
                                                                                        • Size 57KB
                                                                                        • SHA256 dddafb5056129918a9e9c5d6b4d8e788c0e4763daaef043fe63363f9570b8843
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        TemporalAA.glsl
                                                                                        • Path C:\Program Files\Enscape\RendererHost\Renderer\SystemData\Shaders\TemporalAA.glsl
                                                                                        • Size 36KB
                                                                                        • SHA256 27e976c6c8886c24f81646ac8c9952ea373ef1b115be5995260aed9da4311ad8
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        enscape.launch.json
                                                                                        • Path C:\Program Files\Enscape\enscape.launch.json
                                                                                        • Size 186B
                                                                                        • SHA256 0569ef65fc76e0b70a5ae00f6cd12360b0408b4ada66e15a842301e609ea5cca
                                                                                        • MD5 SHA1 SHA512
                                                                                        Submit Download

                                                                                        VC_redist.x64.exe
                                                                                        • Path C:\Program Files\Enscape\redist\VC_redist.x64.exe
                                                                                        • Size 24.2MB
                                                                                        • SHA256 1ad7988c17663cc742b01bef1a6df2ed1741173009579ad50a94434e54f56073
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        Enscape.Core.dll
                                                                                        • Path C:\Program Files\Enscape\registration\Enscape.Core.dll
                                                                                        • Size 208KB
                                                                                        • SHA256 de5bd6e9b1d4b90198101e097b6a871474488b6eb5cdd79295b24a38c0d3b3ed
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        Enscape.Installer.Runtime.dll
                                                                                        • Path C:\Program Files\Enscape\registration\Enscape.Installer.Runtime.dll
                                                                                        • Size 23KB
                                                                                        • SHA256 b4ca5899c2c3349bd1c7c04522d30a3586425a95bcd065d7899abfa8e535f281
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        Enscape.Installer.Runtime.exe
                                                                                        • Path C:\Program Files\Enscape\registration\Enscape.Installer.Runtime.exe
                                                                                        • Size 140KB
                                                                                        • SHA256 53bb696dcbb85246e69406bf2afc9feb0a498e394108a464d6787832e809deda
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        Enscape.Installer.Runtime.runtimeconfig.json
                                                                                        • Path C:\Program Files\Enscape\registration\Enscape.Installer.Runtime.runtimeconfig.json
                                                                                        • Size 339B
                                                                                        • SHA256 7746764cce1fc0f9b62e6a44e820851a7b9ad77fe4ef604bb9d3dfb3ce634407
                                                                                        • MD5 SHA1 SHA512
                                                                                        Submit Download

                                                                                        Enscape.PluginRegistration.dll
                                                                                        • Path C:\Program Files\Enscape\registration\Enscape.PluginRegistration.dll
                                                                                        • Size 98KB
                                                                                        • SHA256 19d8c4c640ff8a980ce392aeb9d271db53233e008764f9909015ecf295fd898a
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        Newtonsoft.Json.dll
                                                                                        • Path C:\Program Files\Enscape\registration\Newtonsoft.Json.dll
                                                                                        • Size 695KB
                                                                                        • SHA256 22c649f75fce5be7c7ccda8880473b634ef69ecf33f5d1ab8ad892caf47d5a07
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        settings.dat
                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                        • Size 152B
                                                                                        • SHA256 2ebd5229b9dc642afba36a27c7ac12d90196b1c50985c37e94f4c17474e15411
                                                                                        • MD5 SHA1 SHA512
                                                                                        Submit Download

                                                                                        settings.dat
                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                        • Size 152B
                                                                                        • SHA256 e6bbd4933b9baa1df4bb633319174de07db176ec215e71c8568d27c5c577184d
                                                                                        • MD5 SHA1 SHA512
                                                                                        Submit Download

                                                                                        Preferences
                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                        • Size 5KB
                                                                                        • SHA256 178aa39d53c927cc748dcc7a4da219d433e7ac93e3873b00746e4c651b6d211a
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        Preferences
                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                        • Size 6KB
                                                                                        • SHA256 89b9569d25c58d0cce0d5df037bb52d84afd22969a06101cf4aa258908065bd6
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        Preferences
                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                        • Size 6KB
                                                                                        • SHA256 829340310cfd3166ef44073fdfa998dba7079c5aad4afbb5e45599e4e36054db
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        CURRENT
                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                                                                        • Size 16B
                                                                                        • SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
                                                                                        • MD5 SHA1 SHA512
                                                                                        Submit Download

                                                                                        Local State
                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                        • Size 11KB
                                                                                        • SHA256 776cfd826b08db1e740b4510d8c26e9bf723a4e1b93b1f2b7e92b47c843f3c14
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        HFID165.tmp.html
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\HFID165.tmp.html
                                                                                        • Size 17KB
                                                                                        • SHA256 3201377c506ce6f00b461735db5166c72904b61c3d224698882e2cce2c75fca2
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        dd_vcredist_amd64_20240625161811_000_vcRuntimeMinimum_x64.log
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20240625161811_000_vcRuntimeMinimum_x64.log
                                                                                        • Size 2KB
                                                                                        • SHA256 b2cc71db22c7a92e6c2ee55d1dae3b055b5afea8fce7633f5ee05dd0be80c986
                                                                                        • MD5 SHA1 SHA512
                                                                                        Submit Download

                                                                                        dd_vcredist_amd64_20240625161811_001_vcRuntimeAdditional_x64.log
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20240625161811_001_vcRuntimeAdditional_x64.log
                                                                                        • Size 4KB
                                                                                        • SHA256 5a51733d88b8e9aa22f6794fcbc33e405e984c2ddea4f64e48c96896b6dd42c6
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        get_compatible_net48_version.bat
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\get_compatible_net48_version.bat
                                                                                        • Size 1KB
                                                                                        • SHA256 4ac5bc5e7b3f567d630a0996116e9156a9a7530b3d3b397b450e2ac2a490bdb3
                                                                                        • MD5 SHA1 SHA512
                                                                                        Submit Download

                                                                                        get_compatible_vc_redist_version.bat
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\get_compatible_vc_redist_version.bat
                                                                                        • Size 1KB
                                                                                        • SHA256 47792215e12c5c5672c0b7c79e1e54e4625bdc9d7d15f2b6b02ebad26cb218ba
                                                                                        • MD5 SHA1 SHA512
                                                                                        Submit Download

                                                                                        list_compatible_netcore_versions.bat
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\list_compatible_netcore_versions.bat
                                                                                        • Size 3KB
                                                                                        • SHA256 db1a6bd0b1041022a24009bc1c704f8199295b24f77a19359ab4d8cd9a2a0835
                                                                                        • MD5 SHA1 SHA512
                                                                                        Submit Download

                                                                                        setvrlservice.exe
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\setvrlservice.exe
                                                                                        • Size 234KB
                                                                                        • SHA256 8cb4579eec4d247774d2187fca2eb1825815950e1b9152516ad76b74427ea9de
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        vri4.tmp
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\vri4.tmp
                                                                                        • Size 42B
                                                                                        • SHA256 d9ced4e4853299fc25d47669ec997b34a692950ee24c844e73f25cdef2b27321
                                                                                        • MD5 SHA1 SHA512
                                                                                        Submit Download

                                                                                        VC_redist.x64.exe
                                                                                        • Path C:\Windows\Temp\{28786708-836B-4180-8231-918755194AE2}\.cr\VC_redist.x64.exe
                                                                                        • Size 635KB
                                                                                        • SHA256 ab1164dcaf6c7d7d4905881f332a7b6f854be46e36b860c44d9eedc96ab6607a
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        logo.png
                                                                                        • Path C:\Windows\Temp\{53D6E4BD-24EF-4D49-BF0E-C4FB5DA60D93}\.ba\logo.png
                                                                                        • Size 1KB
                                                                                        • SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
                                                                                        • MD5 SHA1 SHA512
                                                                                        Submit Download

                                                                                        wixstdba.dll
                                                                                        • Path C:\Windows\Temp\{53D6E4BD-24EF-4D49-BF0E-C4FB5DA60D93}\.ba\wixstdba.dll
                                                                                        • Size 191KB
                                                                                        • SHA256 a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        cab2C04DDC374BD96EB5C8EB8208F2C7C92
                                                                                        • Path C:\Windows\Temp\{53D6E4BD-24EF-4D49-BF0E-C4FB5DA60D93}\cab2C04DDC374BD96EB5C8EB8208F2C7C92
                                                                                        • Size 5.4MB
                                                                                        • SHA256 97aef328363e120e786841903bb51a17547aa84f64d5d3525940ec5a69b9a627
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        cab5046A8AB272BF37297BB7928664C9503
                                                                                        • Path C:\Windows\Temp\{53D6E4BD-24EF-4D49-BF0E-C4FB5DA60D93}\cab5046A8AB272BF37297BB7928664C9503
                                                                                        • Size 955KB
                                                                                        • SHA256 8717dc81d0345d8b81aa85e776fd3e0e6010dba974bf0f5660071e6d680c4526
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        vcRuntimeAdditional_x64
                                                                                        • Path C:\Windows\Temp\{53D6E4BD-24EF-4D49-BF0E-C4FB5DA60D93}\vcRuntimeAdditional_x64
                                                                                        • Size 188KB
                                                                                        • SHA256 401ffa2ef4f070e211ef3f6e4f8a2a7af2bc9ea0119bbacad040669ab6221bba
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        vcRuntimeMinimum_x64
                                                                                        • Path C:\Windows\Temp\{53D6E4BD-24EF-4D49-BF0E-C4FB5DA60D93}\vcRuntimeMinimum_x64
                                                                                        • Size 188KB
                                                                                        • SHA256 d48c8e848a219bceb638b2505132756cb908703fe75dee78bdf475435420dc49
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        LocalizedData.xml
                                                                                        • Path F:\e2ebe4536b8aa711bfec71\1025\LocalizedData.xml
                                                                                        • Size 80KB
                                                                                        • SHA256 b092668e0825f7f498acdc1bf10e1d2cb6ca99497389142cf9af815f25a4b712
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        LocalizedData.xml
                                                                                        • Path F:\e2ebe4536b8aa711bfec71\1028\LocalizedData.xml
                                                                                        • Size 69KB
                                                                                        • SHA256 53742293b25149b19d8677b15f6424fc71e308014b1bcf883e6949d1dab3961c
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        LocalizedData.xml
                                                                                        • Path F:\e2ebe4536b8aa711bfec71\1029\LocalizedData.xml
                                                                                        • Size 85KB
                                                                                        • SHA256 cbb0da2d1efa7de6736e67c978848d53acf8b502bf3daf43ce40b05076145a7c
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        LocalizedData.xml
                                                                                        • Path F:\e2ebe4536b8aa711bfec71\1030\LocalizedData.xml
                                                                                        • Size 83KB
                                                                                        • SHA256 59884541554376a26143b105fa924b9f9961254d22db8dedf7de7f3495d7a1dd
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        LocalizedData.xml
                                                                                        • Path F:\e2ebe4536b8aa711bfec71\1031\LocalizedData.xml
                                                                                        • Size 88KB
                                                                                        • SHA256 961efe11e9e3e553269cb14dc1b942e9ac68b86740d59aa35e4ff6e5913532dd
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        LocalizedData.xml
                                                                                        • Path F:\e2ebe4536b8aa711bfec71\1032\LocalizedData.xml
                                                                                        • Size 90KB
                                                                                        • SHA256 6c5a6e11a85c9e172e7748a9a9f19f8598870a63a103a7ac18cbbd0cdf026475
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        LocalizedData.xml
                                                                                        • Path F:\e2ebe4536b8aa711bfec71\1033\LocalizedData.xml
                                                                                        • Size 83KB
                                                                                        • SHA256 05fc9352b918a710d51f68873fc522528265455b77014e8b0cd66c5e7aa71dc3
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        LocalizedData.xml
                                                                                        • Path F:\e2ebe4536b8aa711bfec71\1035\LocalizedData.xml
                                                                                        • Size 84KB
                                                                                        • SHA256 1e828840ae8728ac809624845597406d4025d6da7797b38f02946a30a48bfe7c
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        LocalizedData.xml
                                                                                        • Path F:\e2ebe4536b8aa711bfec71\1036\LocalizedData.xml
                                                                                        • Size 87KB
                                                                                        • SHA256 ab3d5571b57b7bb705bffe13f37bd73894b0d12d09cc1fb1b438493a863c324c
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        LocalizedData.xml
                                                                                        • Path F:\e2ebe4536b8aa711bfec71\1037\LocalizedData.xml
                                                                                        • Size 78KB
                                                                                        • SHA256 e9877973bef23498b586a9cf03230fc45a9ea8a3f75decfa062b03bd31974b06
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        LocalizedData.xml
                                                                                        • Path F:\e2ebe4536b8aa711bfec71\1038\LocalizedData.xml
                                                                                        • Size 86KB
                                                                                        • SHA256 e4261c9b8c779d58883820a531a19594d238f0ca9ecac399505c569b0cccdbc7
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        LocalizedData.xml
                                                                                        • Path F:\e2ebe4536b8aa711bfec71\1040\LocalizedData.xml
                                                                                        • Size 85KB
                                                                                        • SHA256 2ec36fb871853f60085bc972e08156483384f8c1d6e000f5db1cc8cccad05f8c
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        LocalizedData.xml
                                                                                        • Path F:\e2ebe4536b8aa711bfec71\1041\LocalizedData.xml
                                                                                        • Size 75KB
                                                                                        • SHA256 ae28910c1ef16ce70a5e97c5d02390ad8d64f80966e2be3c4a56db0c4038442d
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        LocalizedData.xml
                                                                                        • Path F:\e2ebe4536b8aa711bfec71\1042\LocalizedData.xml
                                                                                        • Size 73KB
                                                                                        • SHA256 e86656ef2092c0e6caf5b8b0bca2d6ce5def273609c22187ae91236605d2e273
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        LocalizedData.xml
                                                                                        • Path F:\e2ebe4536b8aa711bfec71\1043\LocalizedData.xml
                                                                                        • Size 85KB
                                                                                        • SHA256 8afdf3d2c0fd2370889e3fd96bc2742831cdc6041af0a407123c27f8d76d68a6
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        LocalizedData.xml
                                                                                        • Path F:\e2ebe4536b8aa711bfec71\1044\LocalizedData.xml
                                                                                        • Size 84KB
                                                                                        • SHA256 3c309a5509d42e6485e9123bc6af5ec43cf2faa8afead5062676e85ab7f96add
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        LocalizedData.xml
                                                                                        • Path F:\e2ebe4536b8aa711bfec71\1045\LocalizedData.xml
                                                                                        • Size 87KB
                                                                                        • SHA256 2f0beba8a56cccaddfe6e0ecc3130d0efafb7f84cc0fa4e8db9d85c840e24241
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        LocalizedData.xml
                                                                                        • Path F:\e2ebe4536b8aa711bfec71\1046\LocalizedData.xml
                                                                                        • Size 84KB
                                                                                        • SHA256 aadbd1df74fc82a43f86f1f40d5065a802b2db71652525a78d258fda3197a743
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        LocalizedData.xml
                                                                                        • Path F:\e2ebe4536b8aa711bfec71\1049\LocalizedData.xml
                                                                                        • Size 86KB
                                                                                        • SHA256 a787b2f493c3248991877f61e210bb0231d357d06aa2671917d2ad4e528c9f67
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        LocalizedData.xml
                                                                                        • Path F:\e2ebe4536b8aa711bfec71\1053\LocalizedData.xml
                                                                                        • Size 83KB
                                                                                        • SHA256 874e5d7e45603ad70ca353e8dc6bf42944594f911d17c79be8966dc01d27eb73
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        LocalizedData.xml
                                                                                        • Path F:\e2ebe4536b8aa711bfec71\1055\LocalizedData.xml
                                                                                        • Size 83KB
                                                                                        • SHA256 8ce790eca06bae1b01f40f732580adea86d4c22b28d1e701e033c6c9983500c2
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        LocalizedData.xml
                                                                                        • Path F:\e2ebe4536b8aa711bfec71\2052\LocalizedData.xml
                                                                                        • Size 69KB
                                                                                        • SHA256 93e519e8cc173a3f1aa8dd8113ad4a1be0b5b8d40e1d0a1563dba2054b50433a
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        LocalizedData.xml
                                                                                        • Path F:\e2ebe4536b8aa711bfec71\2070\LocalizedData.xml
                                                                                        • Size 86KB
                                                                                        • SHA256 193090f4472f1a1c5ed10ab97fa4bf77bd4ff3f172f380ef4a53fef39989159a
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        LocalizedData.xml
                                                                                        • Path F:\e2ebe4536b8aa711bfec71\3082\LocalizedData.xml
                                                                                        • Size 85KB
                                                                                        • SHA256 9e224a5f7a5c83df1ab31743520a05252c3cdcc9e97526264da716166d2b29f9
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        DHTMLHeader.html
                                                                                        • Path F:\e2ebe4536b8aa711bfec71\DHTMLHeader.html
                                                                                        • Size 15KB
                                                                                        • SHA256 e139af8858fe90127095ac1c4685bcd849437ef0df7c416033554703f5d864bb
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        ParameterInfo.xml
                                                                                        • Path F:\e2ebe4536b8aa711bfec71\ParameterInfo.xml
                                                                                        • Size 2.7MB
                                                                                        • SHA256 3dbf5ef577ea2d96461dcfd31d5be2f3066519a154a5000691e9596ff438d3e7
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        Setup.exe
                                                                                        • Path F:\e2ebe4536b8aa711bfec71\Setup.exe
                                                                                        • Size 119KB
                                                                                        • SHA256 60dd7d10b3f88f1b17e39464bb2d7ca77c9267b846d90cf5728a518a117bd21b
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        SetupEngine.dll
                                                                                        • Path F:\e2ebe4536b8aa711bfec71\SetupEngine.dll
                                                                                        • Size 893KB
                                                                                        • SHA256 236bf2b5cf6014b8ee22484afe172ace512cc99dba85080b082d47e9e189ea5c
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        UiInfo.xml
                                                                                        • Path F:\e2ebe4536b8aa711bfec71\UiInfo.xml
                                                                                        • Size 63KB
                                                                                        • SHA256 b879f9bc5b79349fa7b0bdbe63167be399c5278454c96773885bd70fbfe7c81d
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        sqmapi.dll
                                                                                        • Path F:\e2ebe4536b8aa711bfec71\sqmapi.dll
                                                                                        • Size 223KB
                                                                                        • SHA256 048d51885874d62952e150d69489bcfb643a5131ce8b70a49f10dfb34832702c
                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                        Submit Download

                                                                                        memory/552-2202-0x0000000000B00000-0x0000000001ED7000-memory.dmp
                                                                                        Download

                                                                                        memory/552-2204-0x0000000000B00000-0x0000000001ED7000-memory.dmp
                                                                                        Download

                                                                                        memory/1708-2206-0x0000000000980000-0x0000000002BA4000-memory.dmp
                                                                                        Download

                                                                                        memory/1708-2203-0x0000000000980000-0x0000000002BA4000-memory.dmp
                                                                                        Download

                                                                                        memory/2388-1621-0x00000000008E0000-0x0000000000957000-memory.dmp
                                                                                        Download

                                                                                        memory/3464-1620-0x00000000008E0000-0x0000000000957000-memory.dmp
                                                                                        Download

                                                                                        memory/3924-2187-0x0000000000B00000-0x0000000001ED7000-memory.dmp
                                                                                        Download

                                                                                        memory/3924-2189-0x0000000000B00000-0x0000000001ED7000-memory.dmp
                                                                                        Download

                                                                                        memory/3924-2154-0x0000000000B00000-0x0000000001ED7000-memory.dmp
                                                                                        Download

                                                                                        memory/4568-1583-0x00000000008E0000-0x0000000000957000-memory.dmp
                                                                                        Download

                                                                                        memory/5140-2191-0x0000000000980000-0x0000000002BA4000-memory.dmp
                                                                                        Download

                                                                                        memory/5140-2173-0x0000000000980000-0x0000000002BA4000-memory.dmp
                                                                                        Download