rhadamanthys | 3802dd9ae43b910b50d7c718b14b7d6765b1e2b22cc5dc70c34ef381843173e5

Analysis

max time kernel
352s
max time network
356s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03/08/2024, 06:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

.html
Size

367B
MD5

3b8307ef19d66fd00abf5228ffa0a0d2
SHA1

4f1f15dba825d0f9319ea0da6c3b0e9abe5a2515
SHA256

3802dd9ae43b910b50d7c718b14b7d6765b1e2b22cc5dc70c34ef381843173e5
SHA512

acf0da0fe726c5fd0df3dbd2e4f97b7349077311ef95c29cd78772ab69d261df701c29ffcf40a682147e1125efe816e8c775164662f382c5a42b4c794d95ebee

Score

10^/10

rhadamanthys credential_access discovery execution spyware stealer

Malware Config

Signatures

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 2960 created 2808	2960	snss1.exe	50

Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3084	powershell.exe
1244	powershell.exe
1532	powershell.exe
3916	powershell.exe
4436	powershell.exe
1480	powershell.exe
2676	powershell.exe
4992	powershell.exe

Downloads MZ/PE file

.NET Reactor proctector 1 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
behavioral1/files/0x0007000000023441-862.dat	net_reactor

Executes dropped EXE 8 IoCs

pid	Process
3416	Gatherum.exe
3452	Gatherum.exe
2960	snss1.exe
3628	snss2.exe
4664	snss3.exe
3432	snss4.exe
4992	Gatherum.exe
1060	snss1.exe

Loads dropped DLL 64 IoCs

pid	Process
3416	Gatherum.exe
3416	Gatherum.exe
3416	Gatherum.exe
3416	Gatherum.exe
3452	Gatherum.exe
3452	Gatherum.exe
3452	Gatherum.exe
3452	Gatherum.exe
3452	Gatherum.exe
3452	Gatherum.exe
3452	Gatherum.exe
3452	Gatherum.exe
3452	Gatherum.exe
3452	Gatherum.exe
3452	Gatherum.exe
3452	Gatherum.exe
3452	Gatherum.exe
3452	Gatherum.exe
3452	Gatherum.exe
3452	Gatherum.exe
3452	Gatherum.exe
3452	Gatherum.exe
3452	Gatherum.exe
3452	Gatherum.exe
3452	Gatherum.exe
3452	Gatherum.exe
3452	Gatherum.exe
3452	Gatherum.exe
3452	Gatherum.exe
3452	Gatherum.exe
3452	Gatherum.exe
3452	Gatherum.exe
3452	Gatherum.exe
3452	Gatherum.exe
3452	Gatherum.exe
3452	Gatherum.exe
3452	Gatherum.exe
3452	Gatherum.exe
3452	Gatherum.exe
3452	Gatherum.exe
3452	Gatherum.exe
3452	Gatherum.exe
3452	Gatherum.exe
3452	Gatherum.exe
3452	Gatherum.exe
3452	Gatherum.exe
3452	Gatherum.exe
3452	Gatherum.exe
3452	Gatherum.exe
3452	Gatherum.exe
3452	Gatherum.exe
3452	Gatherum.exe
3452	Gatherum.exe
3452	Gatherum.exe
3452	Gatherum.exe
4992	Gatherum.exe
4992	Gatherum.exe
4992	Gatherum.exe
4992	Gatherum.exe
4992	Gatherum.exe
4992	Gatherum.exe
4992	Gatherum.exe
4992	Gatherum.exe
4992	Gatherum.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
41	ipapi.co
42	ipapi.co

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\FileRepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF	chrome.exe
File created	\??\c:\windows\system32\driverstore\filerepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF	chrome.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Gatherum\System.Configuration.ConfigurationManager.dll	Gatherum.exe
File created	C:\Program Files (x86)\Gatherum\System.ComponentModel.dll	Gatherum.exe
File created	C:\Program Files (x86)\Gatherum\System.Diagnostics.StackTrace.dll	Gatherum.exe
File created	C:\Program Files (x86)\Gatherum\pl\UIAutomationClient.resources.dll	Gatherum.exe
File created	C:\Program Files (x86)\Gatherum\System.Threading.Tasks.dll	Gatherum.exe
File created	C:\Program Files (x86)\Gatherum\System.Windows.Forms.Primitives.dll	Gatherum.exe
File created	C:\Program Files (x86)\Gatherum\Microsoft.DiaSymReader.Native.amd64.dll	Gatherum.exe
File created	C:\Program Files (x86)\Gatherum\System.Threading.dll	Gatherum.exe
File created	C:\Program Files (x86)\Gatherum\tr\System.Windows.Controls.Ribbon.resources.dll	Gatherum.exe
File opened for modification	C:\Program Files (x86)\Gatherum\Gatherum website.url	Gatherum.exe
File created	C:\Program Files (x86)\Gatherum\clrgc.dll	Gatherum.exe
File created	C:\Program Files (x86)\Gatherum\de\UIAutomationClient.resources.dll	Gatherum.exe
File created	C:\Program Files (x86)\Gatherum\es\UIAutomationClient.resources.dll	Gatherum.exe
File created	C:\Program Files (x86)\Gatherum\fr\WindowsFormsIntegration.resources.dll	Gatherum.exe
File created	C:\Program Files (x86)\Gatherum\zh-Hant\System.Windows.Controls.Ribbon.resources.dll	Gatherum.exe
File created	C:\Program Files (x86)\Gatherum\System.Diagnostics.DiagnosticSource.dll	Gatherum.exe
File created	C:\Program Files (x86)\Gatherum\System.Xml.XmlSerializer.dll	Gatherum.exe
File created	C:\Program Files (x86)\Gatherum\ru\PresentationUI.resources.dll	Gatherum.exe
File created	C:\Program Files (x86)\Gatherum\System.IO.dll	Gatherum.exe
File created	C:\Program Files (x86)\Gatherum\System.Private.DataContractSerialization.dll	Gatherum.exe
File created	C:\Program Files (x86)\Gatherum\System.Security.AccessControl.dll	Gatherum.exe
File created	C:\Program Files (x86)\Gatherum\de\UIAutomationProvider.resources.dll	Gatherum.exe
File created	C:\Program Files (x86)\Gatherum\System.Security.Cryptography.Csp.dll	Gatherum.exe
File created	C:\Program Files (x86)\Gatherum\it\ReachFramework.resources.dll	Gatherum.exe
File created	C:\Program Files (x86)\Gatherum\System.DirectoryServices.dll	Gatherum.exe
File created	C:\Program Files (x86)\Gatherum\fr\PresentationFramework.resources.dll	Gatherum.exe
File created	C:\Program Files (x86)\Gatherum\System.Reflection.Emit.Lightweight.dll	Gatherum.exe
File created	C:\Program Files (x86)\Gatherum\de\ReachFramework.resources.dll	Gatherum.exe
File created	C:\Program Files (x86)\Gatherum\zh-Hans\UIAutomationClient.resources.dll	Gatherum.exe
File created	C:\Program Files (x86)\Gatherum\System.Memory.dll	Gatherum.exe
File created	C:\Program Files (x86)\Gatherum\System.Threading.Overlapped.dll	Gatherum.exe
File created	C:\Program Files (x86)\Gatherum\System.Web.dll	Gatherum.exe
File created	C:\Program Files (x86)\Gatherum\PresentationFramework.Aero2.dll	Gatherum.exe
File created	C:\Program Files (x86)\Gatherum\System.Diagnostics.EventLog.Messages.dll	Gatherum.exe
File created	C:\Program Files (x86)\Gatherum\System.Diagnostics.EventLog.dll	Gatherum.exe
File created	C:\Program Files (x86)\Gatherum\System.Text.Encoding.dll	Gatherum.exe
File created	C:\Program Files (x86)\Gatherum\System.Security.Cryptography.OpenSsl.dll	Gatherum.exe
File created	C:\Program Files (x86)\Gatherum\ru\System.Windows.Forms.resources.dll	Gatherum.exe
File created	C:\Program Files (x86)\Gatherum\zh-Hant\ReachFramework.resources.dll	Gatherum.exe
File created	C:\Program Files (x86)\Gatherum\System.Dynamic.Runtime.dll	Gatherum.exe
File created	C:\Program Files (x86)\Gatherum\System.Numerics.Vectors.dll	Gatherum.exe
File created	C:\Program Files (x86)\Gatherum\mscorlib.dll	Gatherum.exe
File created	C:\Program Files (x86)\Gatherum\ko\UIAutomationClient.resources.dll	Gatherum.exe
File created	C:\Program Files (x86)\Gatherum\pl\System.Windows.Input.Manipulations.resources.dll	Gatherum.exe
File created	C:\Program Files (x86)\Gatherum\System.Text.Encodings.Web.dll	Gatherum.exe
File created	C:\Program Files (x86)\Gatherum\System.dll	Gatherum.exe
File created	C:\Program Files (x86)\Gatherum\cs\ReachFramework.resources.dll	Gatherum.exe
File created	C:\Program Files (x86)\Gatherum\ru\System.Windows.Forms.Primitives.resources.dll	Gatherum.exe
File created	C:\Program Files (x86)\Gatherum\cs\UIAutomationProvider.resources.dll	Gatherum.exe
File created	C:\Program Files (x86)\Gatherum\es\WindowsFormsIntegration.resources.dll	Gatherum.exe
File created	C:\Program Files (x86)\Gatherum\tr\PresentationUI.resources.dll	Gatherum.exe
File created	C:\Program Files (x86)\Gatherum\PresentationNative_cor3.dll	Gatherum.exe
File created	C:\Program Files (x86)\Gatherum\System.Security.Principal.Windows.dll	Gatherum.exe
File created	C:\Program Files (x86)\Gatherum\System.Text.Encoding.Extensions.dll	Gatherum.exe
File created	C:\Program Files (x86)\Gatherum\System.Threading.Tasks.Dataflow.dll	Gatherum.exe
File created	C:\Program Files (x86)\Gatherum\System.Xml.XPath.XDocument.dll	Gatherum.exe
File created	C:\Program Files (x86)\Gatherum\zh-Hant\PresentationUI.resources.dll	Gatherum.exe
File created	C:\Program Files (x86)\Gatherum\System.Threading.Channels.dll	Gatherum.exe
File created	C:\Program Files (x86)\Gatherum\de\UIAutomationClientSideProviders.resources.dll	Gatherum.exe
File created	C:\Program Files (x86)\Gatherum\ko\UIAutomationClientSideProviders.resources.dll	Gatherum.exe
File created	C:\Program Files (x86)\Gatherum\System.Linq.Parallel.dll	Gatherum.exe
File created	C:\Program Files (x86)\Gatherum\System.Runtime.Serialization.dll	Gatherum.exe
File created	C:\Program Files (x86)\Gatherum\System.Windows.dll	Gatherum.exe
File created	C:\Program Files (x86)\Gatherum\de\System.Windows.Input.Manipulations.resources.dll	Gatherum.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 3 IoCs

pid	pid_target	Process	procid_target
4888	2960	WerFault.exe	120
4616	2960	WerFault.exe	120
3964	4664	WerFault.exe	135

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gatherum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	snss1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	openwith.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	snss2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	snss3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	snss4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	snss1.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	snss2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	snss2.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 55 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 3a001f44471a0359723fa74489c55595fe6b30ee260001002600efbe10000000fd26f173d7e4da01c0c589fce1e4da01cdeccfa771e5da0114000000	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\IconSize = "48"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "2"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:PID = "0"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Downloads"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e8005398e082303024b98265d99428e115f0000	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1092616257"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\LogicalViewMode = "3"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Mode = "1"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByDirection = "1"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupView = "0"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	chrome.exe

Suspicious behavior: EnumeratesProcesses 47 IoCs

pid	Process
4488	chrome.exe
4488	chrome.exe
4992	powershell.exe
4992	powershell.exe
3084	powershell.exe
3084	powershell.exe
1244	powershell.exe
1244	powershell.exe
1532	powershell.exe
1532	powershell.exe
1532	powershell.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
2960	snss1.exe
2960	snss1.exe
3432	openwith.exe
3432	openwith.exe
3432	openwith.exe
3432	openwith.exe
3628	snss2.exe
3628	snss2.exe
3628	snss2.exe
3628	snss2.exe
3628	snss2.exe
3628	snss2.exe
3628	snss2.exe
3628	snss2.exe
3628	snss2.exe
3628	snss2.exe
3628	snss2.exe
3628	snss2.exe
3628	snss2.exe
3628	snss2.exe
3916	powershell.exe
3916	powershell.exe
3916	powershell.exe
4436	powershell.exe
4436	powershell.exe
4436	powershell.exe
1480	powershell.exe
1480	powershell.exe
1480	powershell.exe
2676	powershell.exe
2676	powershell.exe
2676	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4580	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4488	chrome.exe
Token: SeCreatePagefilePrivilege	4488	chrome.exe
Token: SeShutdownPrivilege	4488	chrome.exe
Token: SeCreatePagefilePrivilege	4488	chrome.exe
Token: SeShutdownPrivilege	4488	chrome.exe
Token: SeCreatePagefilePrivilege	4488	chrome.exe
Token: SeShutdownPrivilege	4488	chrome.exe
Token: SeCreatePagefilePrivilege	4488	chrome.exe
Token: SeShutdownPrivilege	4488	chrome.exe
Token: SeCreatePagefilePrivilege	4488	chrome.exe
Token: SeShutdownPrivilege	4488	chrome.exe
Token: SeCreatePagefilePrivilege	4488	chrome.exe
Token: SeShutdownPrivilege	4488	chrome.exe
Token: SeCreatePagefilePrivilege	4488	chrome.exe
Token: SeShutdownPrivilege	4488	chrome.exe
Token: SeCreatePagefilePrivilege	4488	chrome.exe
Token: SeShutdownPrivilege	4488	chrome.exe
Token: SeCreatePagefilePrivilege	4488	chrome.exe
Token: SeShutdownPrivilege	4488	chrome.exe
Token: SeCreatePagefilePrivilege	4488	chrome.exe
Token: SeShutdownPrivilege	4488	chrome.exe
Token: SeCreatePagefilePrivilege	4488	chrome.exe
Token: SeShutdownPrivilege	4488	chrome.exe
Token: SeCreatePagefilePrivilege	4488	chrome.exe
Token: SeShutdownPrivilege	4488	chrome.exe
Token: SeCreatePagefilePrivilege	4488	chrome.exe
Token: SeShutdownPrivilege	4488	chrome.exe
Token: SeCreatePagefilePrivilege	4488	chrome.exe
Token: SeShutdownPrivilege	4488	chrome.exe
Token: SeCreatePagefilePrivilege	4488	chrome.exe
Token: SeShutdownPrivilege	4488	chrome.exe
Token: SeCreatePagefilePrivilege	4488	chrome.exe
Token: SeShutdownPrivilege	4488	chrome.exe
Token: SeCreatePagefilePrivilege	4488	chrome.exe
Token: SeShutdownPrivilege	4488	chrome.exe
Token: SeCreatePagefilePrivilege	4488	chrome.exe
Token: SeShutdownPrivilege	4488	chrome.exe
Token: SeCreatePagefilePrivilege	4488	chrome.exe
Token: SeShutdownPrivilege	4488	chrome.exe
Token: SeCreatePagefilePrivilege	4488	chrome.exe
Token: SeShutdownPrivilege	4488	chrome.exe
Token: SeCreatePagefilePrivilege	4488	chrome.exe
Token: SeShutdownPrivilege	4488	chrome.exe
Token: SeCreatePagefilePrivilege	4488	chrome.exe
Token: SeShutdownPrivilege	4488	chrome.exe
Token: SeCreatePagefilePrivilege	4488	chrome.exe
Token: SeShutdownPrivilege	4488	chrome.exe
Token: SeCreatePagefilePrivilege	4488	chrome.exe
Token: SeShutdownPrivilege	4488	chrome.exe
Token: SeCreatePagefilePrivilege	4488	chrome.exe
Token: SeShutdownPrivilege	4488	chrome.exe
Token: SeCreatePagefilePrivilege	4488	chrome.exe
Token: SeShutdownPrivilege	4488	chrome.exe
Token: SeCreatePagefilePrivilege	4488	chrome.exe
Token: SeShutdownPrivilege	4488	chrome.exe
Token: SeCreatePagefilePrivilege	4488	chrome.exe
Token: SeShutdownPrivilege	4488	chrome.exe
Token: SeCreatePagefilePrivilege	4488	chrome.exe
Token: SeShutdownPrivilege	4488	chrome.exe
Token: SeCreatePagefilePrivilege	4488	chrome.exe
Token: SeShutdownPrivilege	4488	chrome.exe
Token: SeCreatePagefilePrivilege	4488	chrome.exe
Token: SeShutdownPrivilege	4488	chrome.exe
Token: SeCreatePagefilePrivilege	4488	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe
4488	chrome.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3416	Gatherum.exe
3452	Gatherum.exe
4580	chrome.exe
4992	Gatherum.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4488 wrote to memory of 3032	4488	chrome.exe	82
PID 4488 wrote to memory of 3032	4488	chrome.exe	82
PID 4488 wrote to memory of 1104	4488	chrome.exe	83
PID 4488 wrote to memory of 1104	4488	chrome.exe	83
PID 4488 wrote to memory of 1104	4488	chrome.exe	83
PID 4488 wrote to memory of 1104	4488	chrome.exe	83
PID 4488 wrote to memory of 1104	4488	chrome.exe	83
PID 4488 wrote to memory of 1104	4488	chrome.exe	83
PID 4488 wrote to memory of 1104	4488	chrome.exe	83
PID 4488 wrote to memory of 1104	4488	chrome.exe	83
PID 4488 wrote to memory of 1104	4488	chrome.exe	83
PID 4488 wrote to memory of 1104	4488	chrome.exe	83
PID 4488 wrote to memory of 1104	4488	chrome.exe	83
PID 4488 wrote to memory of 1104	4488	chrome.exe	83
PID 4488 wrote to memory of 1104	4488	chrome.exe	83
PID 4488 wrote to memory of 1104	4488	chrome.exe	83
PID 4488 wrote to memory of 1104	4488	chrome.exe	83
PID 4488 wrote to memory of 1104	4488	chrome.exe	83
PID 4488 wrote to memory of 1104	4488	chrome.exe	83
PID 4488 wrote to memory of 1104	4488	chrome.exe	83
PID 4488 wrote to memory of 1104	4488	chrome.exe	83
PID 4488 wrote to memory of 1104	4488	chrome.exe	83
PID 4488 wrote to memory of 1104	4488	chrome.exe	83
PID 4488 wrote to memory of 1104	4488	chrome.exe	83
PID 4488 wrote to memory of 1104	4488	chrome.exe	83
PID 4488 wrote to memory of 1104	4488	chrome.exe	83
PID 4488 wrote to memory of 1104	4488	chrome.exe	83
PID 4488 wrote to memory of 1104	4488	chrome.exe	83
PID 4488 wrote to memory of 1104	4488	chrome.exe	83
PID 4488 wrote to memory of 1104	4488	chrome.exe	83
PID 4488 wrote to memory of 1104	4488	chrome.exe	83
PID 4488 wrote to memory of 1104	4488	chrome.exe	83
PID 4488 wrote to memory of 3480	4488	chrome.exe	84
PID 4488 wrote to memory of 3480	4488	chrome.exe	84
PID 4488 wrote to memory of 5040	4488	chrome.exe	85
PID 4488 wrote to memory of 5040	4488	chrome.exe	85
PID 4488 wrote to memory of 5040	4488	chrome.exe	85
PID 4488 wrote to memory of 5040	4488	chrome.exe	85
PID 4488 wrote to memory of 5040	4488	chrome.exe	85
PID 4488 wrote to memory of 5040	4488	chrome.exe	85
PID 4488 wrote to memory of 5040	4488	chrome.exe	85
PID 4488 wrote to memory of 5040	4488	chrome.exe	85
PID 4488 wrote to memory of 5040	4488	chrome.exe	85
PID 4488 wrote to memory of 5040	4488	chrome.exe	85
PID 4488 wrote to memory of 5040	4488	chrome.exe	85
PID 4488 wrote to memory of 5040	4488	chrome.exe	85
PID 4488 wrote to memory of 5040	4488	chrome.exe	85
PID 4488 wrote to memory of 5040	4488	chrome.exe	85
PID 4488 wrote to memory of 5040	4488	chrome.exe	85
PID 4488 wrote to memory of 5040	4488	chrome.exe	85
PID 4488 wrote to memory of 5040	4488	chrome.exe	85
PID 4488 wrote to memory of 5040	4488	chrome.exe	85
PID 4488 wrote to memory of 5040	4488	chrome.exe	85
PID 4488 wrote to memory of 5040	4488	chrome.exe	85
PID 4488 wrote to memory of 5040	4488	chrome.exe	85
PID 4488 wrote to memory of 5040	4488	chrome.exe	85
PID 4488 wrote to memory of 5040	4488	chrome.exe	85
PID 4488 wrote to memory of 5040	4488	chrome.exe	85
PID 4488 wrote to memory of 5040	4488	chrome.exe	85
PID 4488 wrote to memory of 5040	4488	chrome.exe	85
PID 4488 wrote to memory of 5040	4488	chrome.exe	85
PID 4488 wrote to memory of 5040	4488	chrome.exe	85
PID 4488 wrote to memory of 5040	4488	chrome.exe	85
PID 4488 wrote to memory of 5040	4488	chrome.exe	85

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2808
- C:\Windows\SysWOW64\openwith.exe
  "C:\Windows\system32\openwith.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3432

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffff93ccc40,0x7ffff93ccc4c,0x7ffff93ccc58
  2⤵
  PID:3032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1904,i,1618401791406520531,1780789052488235375,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1900 /prefetch:2
  2⤵
  PID:1104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2092,i,1618401791406520531,1780789052488235375,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2140 /prefetch:3
  2⤵
  PID:3480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2148,i,1618401791406520531,1780789052488235375,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2252 /prefetch:8
  2⤵
  PID:5040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3116,i,1618401791406520531,1780789052488235375,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3136 /prefetch:1
  2⤵
  PID:900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3124,i,1618401791406520531,1780789052488235375,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:2200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4616,i,1618401791406520531,1780789052488235375,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4628 /prefetch:8
  2⤵
  PID:1272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4872,i,1618401791406520531,1780789052488235375,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4996 /prefetch:1
  2⤵
  PID:2092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=4644,i,1618401791406520531,1780789052488235375,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5104 /prefetch:1
  2⤵
  PID:1424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=5192,i,1618401791406520531,1780789052488235375,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5156 /prefetch:1
  2⤵
  PID:2764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5472,i,1618401791406520531,1780789052488235375,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5504 /prefetch:8
  2⤵
  PID:4508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5512,i,1618401791406520531,1780789052488235375,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5672 /prefetch:8
  2⤵
  PID:512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5628,i,1618401791406520531,1780789052488235375,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5532 /prefetch:8
  2⤵
  PID:1960
- C:\Users\Admin\Downloads\Gatherum.exe
  "C:\Users\Admin\Downloads\Gatherum.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3416
- - C:\Program Files (x86)\Gatherum\Gatherum.exe
    "C:\Program Files (x86)\Gatherum\Gatherum.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:3452
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" /command Add-MpPreference -ExclusionPath 'C:\Users\Admin'; Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4992
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" /command Add-MpPreference -ExclusionPath 'C:\Users\Admin'; Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3084
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" /command Add-MpPreference -ExclusionPath 'C:\Users\Admin'; Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1244
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" /command Add-MpPreference -ExclusionPath 'C:\Users\Admin'; Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1532
  - - C:\Users\Admin\AppData\Local\Temp\88c4ac3b-afd6-436a-a9b7-82c45bb82694\snss1.exe
      "C:\Users\Admin\AppData\Local\Temp\88c4ac3b-afd6-436a-a9b7-82c45bb82694\snss1.exe"
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:2960
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2960 -s 480
        5⤵
        Program crash
        
        PID:4888
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2960 -s 476
        5⤵
        Program crash
        
        PID:4616
  - - C:\Users\Admin\AppData\Local\Temp\88c4ac3b-afd6-436a-a9b7-82c45bb82694\snss2.exe
      "C:\Users\Admin\AppData\Local\Temp\88c4ac3b-afd6-436a-a9b7-82c45bb82694\snss2.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      PID:3628
  - - C:\Users\Admin\AppData\Local\Temp\88c4ac3b-afd6-436a-a9b7-82c45bb82694\snss3.exe
      "C:\Users\Admin\AppData\Local\Temp\88c4ac3b-afd6-436a-a9b7-82c45bb82694\snss3.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4664
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4664 -s 260
        5⤵
        Program crash
        
        PID:3964
  - - C:\Users\Admin\AppData\Local\Temp\88c4ac3b-afd6-436a-a9b7-82c45bb82694\snss4.exe
      "C:\Users\Admin\AppData\Local\Temp\88c4ac3b-afd6-436a-a9b7-82c45bb82694\snss4.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=5380,i,1618401791406520531,1780789052488235375,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5100 /prefetch:8
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:3792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=4476,i,1618401791406520531,1780789052488235375,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5228 /prefetch:1
  2⤵
  PID:1268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=3372,i,1618401791406520531,1780789052488235375,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5712 /prefetch:1
  2⤵
  PID:3640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=5896,i,1618401791406520531,1780789052488235375,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5728 /prefetch:1
  2⤵
  PID:2052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=3404,i,1618401791406520531,1780789052488235375,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5208 /prefetch:1
  2⤵
  PID:768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5928,i,1618401791406520531,1780789052488235375,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5704 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:4580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=6096,i,1618401791406520531,1780789052488235375,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=6088 /prefetch:8
  2⤵
  PID:312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=4808,i,1618401791406520531,1780789052488235375,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:1384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --field-trial-handle=6116,i,1618401791406520531,1780789052488235375,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5768 /prefetch:1
  2⤵
  PID:680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --field-trial-handle=6304,i,1618401791406520531,1780789052488235375,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=6220 /prefetch:1
  2⤵
  PID:676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5768,i,1618401791406520531,1780789052488235375,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4316 /prefetch:8
  2⤵
  PID:4416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=6496,i,1618401791406520531,1780789052488235375,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=6516 /prefetch:8
  2⤵
  PID:2932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --field-trial-handle=4864,i,1618401791406520531,1780789052488235375,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=6664 /prefetch:1
  2⤵
  PID:4512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3744,i,1618401791406520531,1780789052488235375,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3716 /prefetch:3
  2⤵
  PID:372

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:4968

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2960 -ip 2960
1⤵
PID:3424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 2960 -ip 2960
1⤵
PID:832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4664 -ip 4664
1⤵
PID:3816

C:\Program Files (x86)\Gatherum\Gatherum.exe
"C:\Program Files (x86)\Gatherum\Gatherum.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:4992
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" /command Add-MpPreference -ExclusionPath 'C:\Users\Admin'; Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:3916
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" /command Add-MpPreference -ExclusionPath 'C:\Users\Admin'; Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4436
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" /command Add-MpPreference -ExclusionPath 'C:\Users\Admin'; Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1480
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" /command Add-MpPreference -ExclusionPath 'C:\Users\Admin'; Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2676
- C:\Users\Admin\AppData\Local\Temp\8ebf54a0-9126-4e26-ab86-84694be8a52f\snss1.exe
  "C:\Users\Admin\AppData\Local\Temp\8ebf54a0-9126-4e26-ab86-84694be8a52f\snss1.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Gatherum\Gatherum.dll

Filesize
540KB

MD5
35b286810cd31b5e01575cb49857dc43

SHA1
b86d80f3ca9728645b05e726fbd30211f143d169

SHA256
aaba12f641a8ab286779503af86128000e995eb9b9ff5770ca6f3abb51bae003

SHA512
005023e05bdac5dda5bf2d520654f883764aa4dbea102dec1b64db8e2dd6b9496690acdda3a17bb09922ebcd0671cc976a8bf5bc1dbb010c6aa68e3dccd31fe8

Download Submit
C:\Program Files (x86)\Gatherum\Gatherum.exe

Filesize
309KB

MD5
68d791e28a7a4a0c7a682d1f52b3a3c6

SHA1
db185e530379129746c44ca2832b5a38a0ceed4d

SHA256
7b42825fee6663cf665f5e453ed424304987cd800eb50a66f01afcaf8ecb6fff

SHA512
3f1fa7e6eacdb67eb779d8998b604186584b223ac59c44cc7273b847e5db0176cfc2225f70d86b37ca574e80d348b7a1018136954662b61bbf4009d03c18b67a

Download Submit
C:\Program Files (x86)\Gatherum\System.Collections.Concurrent.dll

Filesize
270KB

MD5
38d21e067d7673194a84cced59066ac8

SHA1
e64362176f714b23603f3a67f1e741f12e35a832

SHA256
483130bfd1e57a0cbfd8a4f3c6e2353ac3f246276f9476c83cca1cadbc47ef47

SHA512
3fa6f78ff0cb527a8e82261549f24a8609d005821ac5c5e7257670dffd55472a134af3ef78d73779758303ae5a90728181cd4caebc871c5cfa4c309141201baf

Download Submit
C:\Program Files (x86)\Gatherum\System.Collections.Specialized.dll

Filesize
102KB

MD5
cc26e9e30ffab763a1e54c0ef3713382

SHA1
c3be6646b7a4576ebd7729dbf4dccbd1fc159d51

SHA256
0cbabb81eae22f4c07c6c846054d207ae3f25da15649eb7fa29e4e2cecd24db4

SHA512
c8e57fb70cfa7667f9a5484c99eedd0bf34004ee26e9642e99a6b90624caa804af571d8aaafa7e9b121550af58205f8ed197b4ddb928210d394ff0b4c1897149

Download Submit
C:\Program Files (x86)\Gatherum\System.Collections.dll

Filesize
254KB

MD5
92063926c04f2e4bf5b5fde16542831d

SHA1
e7be34eaff2d3d8796911d21f1fdbb93bf231dec

SHA256
9193aaef3ea8f19408f88c25fcaf5880e7836d1c35028d7e4077f6090b083541

SHA512
e855ee37980d1da2d143ee39133b05fff81937e529cffe74433e73088549daabd3abadbf05f3765bf3ffffd50313f0ed966efec0eb244d7363241affd73cc29f

Download Submit
C:\Program Files (x86)\Gatherum\System.ComponentModel.Primitives.dll

Filesize
78KB

MD5
1c59c00ab0850af4b4d2bafd6be47db3

SHA1
4c6185b2f42987e25a5fdf2aa30cf4150de25d5b

SHA256
133ec34432ab8fa4f63ade636193864b6a62a089a0c98d746f5532c8a52f437b

SHA512
8425c02c4afb274e862e4ed5dd1c766ebfa1bcf5bf59018d86238014a52603331a8b7c1e233f5a1f22171e90132ddd585db0d2561ff2cd287d703397afdff4b1

Download Submit
C:\Program Files (x86)\Gatherum\System.Drawing.Primitives.dll

Filesize
130KB

MD5
b5ca10a41cc865048491f617678722a9

SHA1
afe171d9d676b78983b802e18ef8e00927073c64

SHA256
cbe9fbb1d1e4850460854474ffd8c01ddcc756dcb33a86d1674c0cb2e2a0b026

SHA512
2afdce56b7eec6deb82f8b2d5ec3029b5a0ee1e8bbf2e0ff9a0a5310bf265ddcdf63660546b4dbcc3c5fb0cba3cbb94f2408fe5cb4d14dbe0e74aba6dd5a2192

Download Submit
C:\Program Files (x86)\Gatherum\System.IO.FileSystem.dll

Filesize
15KB

MD5
35e27f4c681085a4b096826ee8ea4f53

SHA1
cf3ea4304e5558c8fdd4422e4d72509cd91ea719

SHA256
7bd41c6b12b73e6e90476f2d56db8581664abe07e7ab9bf2917bb254ed1d75ad

SHA512
1f9e6519ff29524e57cb0b3576ab118014293aade8f30027ef44b1f29a8e9a54e7bcb3b288a92dba996053b16016807d93fa9f44f2c43666ddc6425ddd7ae4b9

Download Submit
C:\Program Files (x86)\Gatherum\System.Memory.dll

Filesize
154KB

MD5
7e999da530c21a292cec8a642127b8c8

SHA1
6585d0260ae98bab2ad1eaba0f9cfe8ebb8a0b3f

SHA256
3af25e0c81c1462d0db86f55c4e5fd8c048c70685f9a566d29d499bc46935fb4

SHA512
a18b6649b5c2f9f96bf639863df9faad436759200a64f91fb2d955f33c71ce4b2d5798be982f692a247ac864d8acb63fb731b31c06333e5c7d9a9c895ecd6451

Download Submit
C:\Program Files (x86)\Gatherum\System.Private.CoreLib.dll

Filesize
12.6MB

MD5
805cf170e27dd31219a6b873c17dce88

SHA1
ac90fa4690a8b54b6248dcb4c41a2c9a74547667

SHA256
ba7e61a00e7a4634b5c5a79b83126f75580ceec235c613000c3efbc01826cad0

SHA512
fa946aae906b66cb5570155a1c77340f2b6d4efb9be16068da03a8f1c5b5f37ad847d65cd1416017db19375dc6a72670300da4c766e6d9bb1a00374f492bd866

Download Submit
C:\Program Files (x86)\Gatherum\System.Private.Xml.Linq.dll

Filesize
394KB

MD5
60ed8b2bffc748d6a2a1fed8fa923368

SHA1
be411429b9a649a495124558c5e5d95a83525d58

SHA256
0b63cebb991d1911a607993ea5b4639f34a2b0b381a73973542db2d3591e9f90

SHA512
b0a4ac2aa96d827258bb30f098512741ad3f93585e05ceae0255e15cd8dc9ab8048788902c1eb32a813e9c69c8a923200a716b4e00f579c22a0b425665e575f8

Download Submit
C:\Program Files (x86)\Gatherum\System.Private.Xml.dll

Filesize
7.6MB

MD5
46aebfbd6d7e74d4d558da62d7600d25

SHA1
9c1cd44ab8b5e283967427e91cbddddfc0c2bf5a

SHA256
834e304221e742a831be5c5178892258e689eae35b730172e74161af2785aab9

SHA512
9c4499d174a988cc3830aafcc42f79defff37b16198f49cf5d2dc86f88809fcb44e0c300351f813d46addf9998f64448c50213f1721c6a307aad21c205db1524

Download Submit
C:\Program Files (x86)\Gatherum\System.Runtime.InteropServices.dll

Filesize
94KB

MD5
49c86e36b713e2b7daeb7547cede45fb

SHA1
75fe38864362226d2cce32b2c25432b1fd18ba37

SHA256
756de3f5f2e07b478ac046a0ac976b992ef6bc653a1be2bb1e28524a4ff8d67d

SHA512
a9bd42b626158c540be04f8d392620daba544a55b7438d6caefe93b9df10ec2219f28959c4e0d706a86b92008275de94dfdf19de730787cdacf46d99fc45e3a9

Download Submit
C:\Program Files (x86)\Gatherum\System.Runtime.dll

Filesize
42KB

MD5
53501b2f33c210123a1a08a977d16b25

SHA1
354e358d7cf2a655e80c4e4a645733c3db0e7e4d

SHA256
1fc86ada2ec543a85b8a06a9470a7b5aaa91eb03cfe497a32cd52a1e043ea100

SHA512
9ef3b47ddd275de9dfb5ded34a69a74af2689ebcb34911f0e4ffef9e2faf409e2395c7730bce364b5668b2b3b3e05a7b5998586563fb15e22c223859b2e77796

Download Submit
C:\Program Files (x86)\Gatherum\System.Security.Cryptography.Algorithms.dll

Filesize
17KB

MD5
8f3b379221c31a9c5a39e31e136d0fda

SHA1
e57e8efe5609b27e8c180a04a16fbe1a82f5557d

SHA256
c99c6b384655e1af4ae5161fe9d54d95828ae17b18b884b0a99258f1c45aa388

SHA512
377f4e611a7cf2d5035f4622c590572031a476dd111598168acea1844aaa425c0fe012c763fbc16290c7b32c6c7df7b2563c88227e3dbc5d2bd02250c9d368d9

Download Submit
C:\Program Files (x86)\Gatherum\System.Security.Cryptography.Csp.dll

Filesize
15KB

MD5
c7f55dbc6f5090194c5907054779e982

SHA1
efa17e697b8cfd607c728608a3926eda7cd88238

SHA256
16bc1f72938d96deca5ce031a29a43552385674c83f07e4f91d387f5f01b8d0a

SHA512
ae0164273b04afdec2257ae30126a8b44d80ee52725009cc917d28d09fcfb19dfbbb3a817423e98af36f773015768fed9964331d992ad1830f6797b854c0c355

Download Submit
C:\Program Files (x86)\Gatherum\System.Security.Cryptography.Primitives.dll

Filesize
15KB

MD5
777ac34f9d89c6e4753b7a7b3be4ca29

SHA1
27e4bd1bfd7c9d9b0b19f3d6008582b44c156443

SHA256
6703e8d35df4b6389f43df88cc35fc3b3823fb3a7f04e5eb540b0af39f5fa622

SHA512
a791fa27b37c67ace72956680c662eb68f053fa8c8f4205f6ed78ecb2748d27d9010a8de94669d0ee33a8fca885380f8e6cfad9f475b07f60d34cdcb02d57439

Download Submit
C:\Program Files (x86)\Gatherum\System.Security.Cryptography.dll

Filesize
2.0MB

MD5
75f18d3666eb009dd86fab998bb98710

SHA1
b273f135e289d528c0cfffad5613a272437b1f77

SHA256
4582f67764410785714a30fa05ffaaad78fe1bc8d4689889a43c2af825b2002e

SHA512
9e110e87e00f42c228729e649903ad649b962ae28900d486ee8f96c47acca094dbace608f9504745abf7e69597cdef3c6b544b5194703882a0a7f27b011fa8d5

Download Submit
C:\Program Files (x86)\Gatherum\System.Threading.Thread.dll

Filesize
15KB

MD5
72d839e793c4f3200d4c5a6d4aa28d20

SHA1
fbc25dd97b031a6faddd7e33bc500719e8eead19

SHA256
84c9a95609878542f00fe7da658f62d1a6943a43e6346af80d26bcff069a4dbd

SHA512
a414cd9d7cf6a04709f3bdbef0295349b845a8301171ed6394e97b9993f35816383b958736c814f91c359a783cca86ee04802856486d4b4e0ab90a45da39db1d

Download Submit
C:\Program Files (x86)\Gatherum\System.Threading.dll

Filesize
82KB

MD5
32aa6e809d0ddb57806c6c23b584440e

SHA1
6bd651b9456f88a28f7054af475031afe52b7b64

SHA256
e8d1f5c422ee0ba3b235b22028ab92dc77c1ff9774edc0b940cad7224a30ba7d

SHA512
fe43b3d6ed5c37d59a44636d3c7522a88d83e6ec074bf69d3cbb6e5454fdd8f0523ea10fdf6fd452cbd0e2fc159cf9d03dfad6b30e80e400e7f1773b5a2e8632

Download Submit
C:\Program Files (x86)\Gatherum\System.Windows.Forms.Primitives.dll

Filesize
2.9MB

MD5
8129c2d72bcba8b50576e7c43e558832

SHA1
f4892f78d2496f3a2e1fa2380ff68fbeb62e2dca

SHA256
5794a3996a0b4ab9cb13f3de0f87d50462615a7d0eb1d243d9324a682c1b58cb

SHA512
40fafbf9590d2b2c8f487f44708e9e97ddce03b1487be5c7cb3d4c92bdb7100a98aebada379f63003f0dd9d447ee2b0b9dfa0b057320ac05f7f77b31c5ffa97d

Download Submit
C:\Program Files (x86)\Gatherum\System.Windows.Forms.dll

Filesize
12.9MB

MD5
a51632facb386d55cc3bc1f0822e4222

SHA1
59144c26183277304933fd8bb5da7d363fcc11fa

SHA256
efc52dbbef5202d9ff424d7adc6e2249b66450a5fd5414891776fc617b00123e

SHA512
2a8d8e2ee8168e6f79476616385320f463ebc161c7393db2b18a7d35ca0111c5100b83954c5eabfe32b12cac3dbfdc514271dde4cc4468dd26235eb7020d9c14

Download Submit
C:\Program Files (x86)\Gatherum\clrjit.dll

Filesize
1.7MB

MD5
8b81a3f0521b10e9de59507fe8efd685

SHA1
0516ff331e09fbd88817d265ff9dd0b647f31acb

SHA256
0759c8129bc761fe039e1cacb92c643606591cb8149a2ed33ee16babc9768dcb

SHA512
ea11c04b92a76957dcebe9667bef1881fc9afa0f8c1547e23ada8125aa9e40d36e0efaf5749da346ba40c66da439cbd15bf98453e1f8dab4fe1efd5618fdc176

Download Submit
C:\Program Files (x86)\Gatherum\coreclr.dll

Filesize
4.8MB

MD5
9369162a572d150dca56c7ebcbb19285

SHA1
81ce4faeecbd9ba219411a6e61d3510aa90d971d

SHA256
871949a2ec19c183ccdacdea54c7b3e43c590eaf445e1b58817ee1cb3ce366d5

SHA512
1eb5eb2d90e3dd38023a3ae461f717837ce50c2f9fc5e882b0593ab81dae1748bdbb7b9b0c832451dfe3c1529f5e1894a451365b8c872a8c0a185b521dbcd16b

Download Submit
C:\Program Files (x86)\Gatherum\hostfxr.dll

Filesize
342KB

MD5
16532d13721ba4eac3ca60c29eefb16d

SHA1
f058d96f8e93b5291c07afdc1d891a8cc3edc9a0

SHA256
5aa15c6119b971742a7f824609739198a3c7c499370ed8b8df5a5942f69d9303

SHA512
9da30d469b4faed86a4bc62617b309f34e6bda66a3021b4a27d197d4bcb361f859c1a7c0aa2d16f0867ad93524b62a5f4e5ae5cf082da47fece87fc3d32ab100

Download Submit
C:\Program Files (x86)\Gatherum\hostpolicy.dll

Filesize
388KB

MD5
a7e9ed205cf16318d90734d184f220d0

SHA1
10de2d33e05728e409e254441e864590b77e9637

SHA256
02c8dbe7bf1999352fc561cb35b51c6a88c881a4223c478c91768fdaf8e47b62

SHA512
3ecbaf20946e27d924a38c5a2bf11bac7b678b8c4ebf6f436c923ea935982500e97f91d0e934b7fd6b1fc2a2fd34e7d7b31dbbe91314a218724b3b2fd64c4052

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000016

Filesize
209KB

MD5
3e552d017d45f8fd93b94cfc86f842f2

SHA1
dbeebe83854328e2575ff67259e3fb6704b17a47

SHA256
27d9c4613df7a3c04da0b79c13217aa69992b441acb7e44bf2a7578ca87d97d6

SHA512
e616436f2f15615429c7c5c37de3990c3e86c5e1da7d75a0f524fc458b75d44a5be1a3648a628d63e1cf8aa062e08b538f2f2bc9c6a0b42157beb24f82c571d9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
053b41d1e3c395c0df4afa891bcb25c4

SHA1
fdf9f676ac875e6a5c00869910ef97ca9a046ee6

SHA256
bf008ac44ba8a64d65551b4214ea6bdfc9442731202e9b9f5074d94d11de78e4

SHA512
b9d8952ba670eb5f7f5ff9970fbb25cc084dc55012b23c0b7511423b8b6584643cea1564fe215f34e67050fb1f53c3f0089bef5b4d43cc775dc73240eacc94eb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
d10e0bcc8ebe5d0d1960074d48b4f438

SHA1
f60fc489f7455a9ef734f25b72a10c4247eb3827

SHA256
9867c833198e83777c0e18808de7d7ab19c4b50e3b5f68174a9107eaf382b14b

SHA512
ef60008960fb31a1088284ce29bfc43b7833dbb49075c50bbe32ed574a4619bcabc902d6b3b3112b2fbcb0da3b47539516879573a1d1f20672886fe75ee595c1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
2f3e0233ee1eafd719c866ed7bf589e8

SHA1
f7998769179718d9326194b1cb07cc214fa2a25f

SHA256
7c1cc0839712b17f887971ffcbc010521ec88aa42f4b349a9e84a8367b308bfc

SHA512
072d30127bf3663884025ed13bf64d22e19c11e8ba1fe88a1967d8acc316edc4aafa6bc7dda845ccac24856ef10a8db58d1b477c48342b86e2293ffb2320a768

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
730453ab246f0cd720a2362dd51137cd

SHA1
1be786afd539238df14f3f7239ebbc5680d57103

SHA256
b4347a88e28b41f66b4a5972ad7ef2887f89d0a9450ef98e463ec330787c2966

SHA512
9669f82875431d98ec55a11dc1a83815207f2e5ac416ff62181d53f7621675385e32c5095b04ebc0dd632365eb05d01d049cf3bcff1b95eeb20cbe181d0c2a9f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
4738e29773880040030b51aae74b2bbb

SHA1
dab97192b84c954b46aba9df4acb38316cfc8253

SHA256
48ea26fd981b8af636c6d68287d8fd5bc652cff3c343c51ae33147cdcfb30deb

SHA512
ac07dc86087f884750947777820efdbb3d01262b5d5237520918934a33ab01871bc57e5696cdadb396cab160d64fd470aef79c85ef8139635a1b416023c838fe

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
6KB

MD5
7ef0cd70419065a3690ed87e8cc9baa1

SHA1
42135f3a996aaf82db854c6de0a200abf9a4a2d8

SHA256
989dbb1965fa90b1e7c5802e77ab393e73eb7fd035d18e91bcc8918d5b3b5e39

SHA512
82a9f55f992ffb84b0d17ff06b86523d0c13bc33633accdf065a01852d4bee9d8babb2d52f0f3a0864bc1eaa9b9e2cb9cc9ffb698de387d190a548788fe856b3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
74af63de513bf852d0184638adc191a0

SHA1
a43744d51c8be337fb8a42f5d4daa587cfe40e43

SHA256
e03291c7302d793b4843a94cff01fa4907dc095889748037c27a29cba5e4951f

SHA512
793d7445275cfdbb54b083d2238481a464ee483df841a32bfb8d5784f15c86c5e9a9b8b9112e52e309d50d7794200ebfebb57f27837a3a3400c5ca3fc8b3f4b7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
854B

MD5
894a4af9ecb19fae0de286708a146473

SHA1
97631e346350dd5df85e350a55cc7b6053951ef3

SHA256
b26f9cf7247f728404a1883484f87adfb9a92a389f5fd7f5ef57363b3259fa05

SHA512
4a08fe9f1618622563eb97a7d934e5f10aeffd3d741fdd55977a8a577f2706c0537fdcd9027e9a7a71848b4d226807015142e669d774c4011be1a74abb2ef759

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
35335fb7256a34ef3ff4c869b23e202a

SHA1
a1d7cf008bb902aa358bdff1d7416cf42f146e34

SHA256
45d7e25b6e0fe2565bab3175998b2fb6767507ad8e8b16cccdeb675521f2a881

SHA512
1643681ae939aa6aaede92fbb2532f587b5fdece8fc48770c65d708bd4ea3f0495aa08e744377ce75003dfd2e295f0cba8f0a06220cc5b1d83379993f895cdfa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
524B

MD5
7a62aac15485742f7edc9a8b544595c6

SHA1
13cfaed73bd60a45117564cf351c818794189472

SHA256
04dd958d183b4866c3569c561d30401a5f6a86498ff0cbd4892793be56737e01

SHA512
7e31d786fbf7813f222a56386a6e2c1a0044d9eb8bf82249ad00d3ec4f924064f733c1c1174281463dbd6817fd82a4f21f48d5f7d3fb5cb2cfee04c66d1f39cd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
854B

MD5
0e47879cb578fe8804ba174a0da51dbe

SHA1
c4d9441a0139df83ee7d2248ee69cd15f6607a6d

SHA256
6c3f0f3f94b5d9cdcf2257dcb2b662bb4c9ec101bb1460ddf83255ab56128357

SHA512
2be9ce8be120673c21be7c6e9bcc2564ecbb9f97752d1ee7a407f27a768f3fffdc0891cacc568804a0d55564a120c3d397933148b16412c12aba8109dcaf5a5f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
f104fc3dd07676607eae2ad8a1e7d9f7

SHA1
b07bbeb7f0a583e4e3281597bbc8203e7f101ee5

SHA256
e7b979291e2a851f388cccc19b126aff70a2cfbbafd7a10ba7676f8ce5074bf3

SHA512
83dd64d6db29037c48cc2071f5d1ab7a36565e1fc722a1cd7d953fd9d417c1010ca0370c27d4106b5ce15705a6d78dd82d492957c0a1b434c135fc18fbc8cffd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
7d6b4778ecdb847b14c59128e2549bbc

SHA1
936aab4a8b266770b75fb2b1d897665a9276ddda

SHA256
2f745a2f4246997ddcb667c91519d90440c6f5f10cb906a9698a0169860fe052

SHA512
780c0c2d9ac0d2d9950e08d23755eb66c893ec76f91cf297d9b606503c600670e3ba5cf42aa42952aa1d5c16affdd4c6081d6c245b2ab7a5fddb8f99b16a8dff

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
4e418259c830e14d3d0e112a65dea8f9

SHA1
16086a2246f317d26e73094a83092678f36b0417

SHA256
32247c4e7be6d473bc226976bfba76c8ba4519847ad0cbe3414eef27d99a9a0c

SHA512
bbdeaeaaa2609d86d08a38609680767b16fb73bc46a20c2abfefd1a3abd934dba10a2855c94e6c70b25e48db2f8c366b37d8e7b3ae5deca9f354f28986662968

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
12KB

MD5
53d0c1a7d5226eb7571f6986ab899b2e

SHA1
ed45b38bbb72cd0a06c056d231278de8cbd01dfd

SHA256
cfc1088ab991f0263b9f07b214ba351e9df1c4ae62c7f6e6022109ecb761e5de

SHA512
9555957f5af53298668ea4d42b1a9cb3a9a31585c4a226d91297191e5ecf8abd2696db763c78254be081b1d57db1930b78bd036dc8a7bd50f494b3447c28a86f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
df092dff7d52c414864f1a02b8ce8bdf

SHA1
50b862b495d8ae0fa435347e6b4554e35abd0061

SHA256
1c0ed0c37e9958ecf9ca2a0287b34caad9d867cd504d57f5b69ba7e2f1739178

SHA512
40973b11b3227219bc26498e6225e44a30e9ca5186782a8733684d3c505aeca942edf34dcd90c75875551d3c5054dd0588d125c11938372d5d98133648439763

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
13KB

MD5
648681ad7c0e1a310f192071afd1ebf3

SHA1
8b9326eb73b210b5f257631c5127ae7edabcfb04

SHA256
e9b807a785d1be9124392a4cf5ac4e29117209993b066ddc2b3999ba240776d2

SHA512
ca3ab3ba7c254f7d70572af9381fbf1e4f920601da9628661382482a18e88630e9c58d6bdaa03872db8c697f319e6c30c92d394eae8cc241d6b7e40c38a4349c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
13KB

MD5
a2be45235392d81f8413e26204a60e83

SHA1
f05e44d3745715c26c0a2867a760f5e8d42d1c58

SHA256
3ed5b06721c4d54172ab39d575f607af1f420957ef7561e3bc76097341cb6f83

SHA512
94e9743d27f81ad508573f47aecfbee4655e5c5ae67e1134f287ef0127fa511434857a855537df1c9e0a846747f5c273f4e33157d902343014e79af8a2ec7f5b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
13KB

MD5
72d145640ea6f6b25a09df77f2172003

SHA1
ee1489bc8d976dc8c69e53aec64453735b643af5

SHA256
414feee9560939a5a773f5a914ee1dee05de0523583d0b95ec82458962944a6c

SHA512
a4648c935ea66eac3ebdc6e440b6ca077992215667543117cb0656aed35acf74d3a2e359e18580feb2600dee9e536304d8aa12d0cbcf93ff3ed15654a3e71d96

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
13KB

MD5
387e3ab98e66d93d60b03b73ca1344a5

SHA1
0a07b56e265e88a9d02265dc88bddc636a361d9f

SHA256
b90e2b6900ec089daa90c564d0d63598d5681cd8a2c1847120732ccf0bdd0ad1

SHA512
0a891cc5bbda3d5c40a5868fa73e2503aadc0099f52b141457ada458a36f8e3098b24eb5909cc3e8d9dd4d2dc97eba660060cdbc60e91ab399feef7b9e9a4966

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
49a3038657b46f1dd5d475c4602d3fde

SHA1
3cb78b74d412fc4e1b6b064e4a7ce173981e8404

SHA256
3019a6f149c3e8c83f4ff21eae0266e68a04f37072ef83ed94d3d1b04b8c5e06

SHA512
d41c288e1031ba7fed2c3ff1fd6e9e4ae2023893b9cd6540ddc078348dc456ae24289244626c89bb68856fe2b224b5364c0d8f98ce2ec90587b52745ec28b193

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
13KB

MD5
de75a00b0c92f2276dc65098427a8024

SHA1
acc541568468e7f56110ea40f9cd7aa75caab704

SHA256
9debd88b12ebdd140d85c0dbe1ec7607d1a02335892607eb76d37ab276133988

SHA512
27e5ed8429aee6bf39544e885cfe00175e428efe446eb0a6f3143f4407111f416dedac362c5eccbe605b18259dd5c8967c65467317c61e325f994537ad2f89b2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
12KB

MD5
a03336d6306e9e71f4df7077241f55a5

SHA1
507681e01c940cc302189cea4430f02d2c3b9b21

SHA256
d0ddaee2c7e43cd6a7fe35c833d32b546374f53a0c34b3852a650ae3ba606db5

SHA512
6a660e13ed93533e9c159cb8e8d3cbd9745050ceae1a1caa4b74081e436db2ce1403f456629e00ee6dda0fbe297a12208a0ad9bcf7db8a3813546a31749ab5be

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
62b494d69598de0d39b359157a8deb93

SHA1
fdb215bdf885cf02827225f6fd7172d03915e44b

SHA256
d9e9890ab80655bf214d7993a7a835e9f38993563f8fb8f3f6312d91f1b9061e

SHA512
8d06559f3f5553fc2b3c7b9f0b21e770ce9ddbf2da77d5438d0c10ed7eeb35a2fa208e739c12846cd0664c400a5d71d7ed6e79d9bca75d2b9d5cf8d9c36563ce

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
13KB

MD5
ad8c81ac870bbaecfbdb893f62a02c5f

SHA1
aa6724fdedd2a9872dff39ee0ab9914666775781

SHA256
1aa102f2608c3f48a0b03b5f3b9cc30c04486ef378aea17c0272ac5259462535

SHA512
52db07ec9c2e2a14f27e8261c30a9aa99330a14ef22e50172f441bdec586a30392b6498d2f60259a314d335baccdd5765b0519afe0bf1016134c03438fda3e99

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
96B

MD5
9427763cd4bb9b7f96512416335d7298

SHA1
5e7d51ab1293db3031fc2ec05ab99154bc7b6e10

SHA256
eacb1a03ebee6bdfd7f113f973eed94f7139fff5445ee64b98e1f7954163ab37

SHA512
d03e3d4f5208ede026f027c2aea825b6fddbaf5d9bae20c60be06b3e82f5e20d00db49d3ab8f918f1aceed52a4ed3391aeca6b9552079791acb2d81b21cd9eea

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
99KB

MD5
ea13c7809935c2bce8f48e1c31d4d4c1

SHA1
2f3f500cdecac9a6ade17912a548c7f9c84d27b7

SHA256
257e618b30a921a6ef13fbfdd48cb74d50b09138ebcfa6b39f04fee2c0993d6f

SHA512
c1570b5fa2788ef1eb033da7d7ba5f12cb1d8c740ce891be3843c4a0919d54d04456657bfd643d10a67a26c0e126bc146f1b9aaa508bf3fcf4f0889b61db1f9c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
99KB

MD5
ca993c6d4bc1259726c34d496c7d60e1

SHA1
7feb88081b1ec1a8423b02d3b0ec0327950a5249

SHA256
78522c4ad4b24d3f4a2ab600ea4fe89d097248df000ccb1efb8ce86a21923199

SHA512
b9ede2f9dd1c0f82b3741f48aca1d72d27aa0788cf07ff36533975cd687c9c5c0c6a2984355bc4b1e4e30884c2fec398a69b261801ecc03b5f812a6389dfb115

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
99KB

MD5
fdd8a195ac9bbaef2eca0afa8da67848

SHA1
64c0f0dab2133dde7219f30317429099a5b5eb03

SHA256
435390016d971f27075d2a36522b4d2b7d8c38abca3e7339a2c279c388b5697d

SHA512
65dfa467eab2333b52ea38acd0dbe0d3da622aa31a91a30ba3bc63a5e3b427da1fcf264916172b78e25c9f72d393e9f81670a169f1e2b40978f43fefcc678b51

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
99KB

MD5
9a857b59e3729b764f76de4653de2e57

SHA1
7a855de31272799405c6345267d56e341245bc27

SHA256
22aad58b28f69b7705cc9087771ed333cbb4731c1049529cacdec98e7163dd23

SHA512
8ce44baf49125949c212ec3b1b1c5d3961ceadd8676789c659976ce78ea717f7273814b3e2405c05d65a4ac30dfc77b26a8d7e5511756addc4bad758ed5f9628

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hooydmvz.wte.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\nslD1B5.tmp\InstallOptions.dll

Filesize
15KB

MD5
d095b082b7c5ba4665d40d9c5042af6d

SHA1
2220277304af105ca6c56219f56f04e894b28d27

SHA256
b2091205e225fc07daf1101218c64ce62a4690cacac9c3d0644d12e93e4c213c

SHA512
61fb5cf84028437d8a63d0fda53d9fe0f521d8fe04e96853a5b7a22050c4c4fb5528ff0cdbb3ae6bc74a5033563fc417fc7537e4778227c9fd6633ae844c47d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nslD1B5.tmp\LangDLL.dll

Filesize
5KB

MD5
50016010fb0d8db2bc4cd258ceb43be5

SHA1
44ba95ee12e69da72478cf358c93533a9c7a01dc

SHA256
32230128c18574c1e860dfe4b17fe0334f685740e27bc182e0d525a8948c9c2e

SHA512
ed4cf49f756fbf673449dca20e63dce6d3a612b61f294efc9c3ccebeffa6a1372667932468816d3a7afdb7e5a652760689d8c6d3f331cedee7247404c879a233

Download Submit
C:\Users\Admin\AppData\Local\Temp\nslD1B5.tmp\System.dll

Filesize
12KB

MD5
4add245d4ba34b04f213409bfe504c07

SHA1
ef756d6581d70e87d58cc4982e3f4d18e0ea5b09

SHA256
9111099efe9d5c9b391dc132b2faf0a3851a760d4106d5368e30ac744eb42706

SHA512
1bd260cabe5ea3cefbbc675162f30092ab157893510f45a1b571489e03ebb2903c55f64f89812754d3fe03c8f10012b8078d1261a7e73ac1f87c82f714bce03d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nslD1B5.tmp\ioSpecial.ini

Filesize
1KB

MD5
846822e25707af1070e925159f0c90ed

SHA1
858805c1129d48c52e00ef24be8c0d3be83e0782

SHA256
b307db19d6fa9cbb40538b96a203878d2afccb371bbcb33f3f3b81a7072ac651

SHA512
0815b06cd4eaf646bc6f8265340475fbeb5e1d337b40553aa6d9ab5958852f4957b1cd5268bd066a4a69e1b1fac5877951c386248db39bd51eabe4e28a8e101a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nslD1B5.tmp\ioSpecial.ini

Filesize
1KB

MD5
fa5f2e38614878063f574c83807cd155

SHA1
937a9df45157e5e90cadf4bac176426dec7053d8

SHA256
4c36a6b18325669e8012f7c239b736c6a0ae4b97177df7204b3a42425f70c895

SHA512
c4065ca92fe9b3e2ad448d2d8fe981866502f64a44846c2bc232a38de989bafd4ffd3ee72b17982361b102e2b3a2240640143eb78cf7eb43a856da664635fd04

Download Submit
C:\Users\Admin\AppData\Local\Temp\nslD1B5.tmp\ioSpecial.ini

Filesize
1KB

MD5
45c5093356ba1810c89f0801511342d7

SHA1
1b7d51fb437cd39aeb7184ef4df2b27dcb3f31b5

SHA256
a6059d663a64ff496ea63d877a4f95113f10a5af4ff71e33aa97c3009627f0fc

SHA512
c6fd0eba63a817d10b3f506755a0e9f49f649fb6a9a2f568b38e2bffe7c64fe07c76adf5759456b8ee44b45c8fe4c35511e2bc7276263aac03e1f5e05e9082cc

Download Submit
C:\Users\Admin\Downloads\Gatherum.exe

Filesize
47.3MB

MD5
47885f35e2f75dd2dc9161c6133dbacd

SHA1
f6c8f87215c010816194803b59c15f43b6b912ba

SHA256
07ae2e341a291c245fb61a7fddfbc7a610cf354c403a12a0a170ecf5c5353b45

SHA512
c6bcb5c82a74991a9e0922da31bf49294e41ef7d426a5badf4c08b52b3539fd973b7b975d584e1d9a0dbc7d3dd80936795a4eba09e4ef5b30c98aae874d60034

Download Submit
memory/2960-992-0x0000000003770000-0x0000000003B70000-memory.dmp

Filesize
4.0MB

Download
memory/2960-991-0x0000000003770000-0x0000000003B70000-memory.dmp

Filesize
4.0MB

Download
memory/2960-993-0x00007FF802AF0000-0x00007FF802CE5000-memory.dmp

Filesize
2.0MB

Download
memory/2960-995-0x0000000075AA0000-0x0000000075CB5000-memory.dmp

Filesize
2.1MB

Download
memory/3432-1001-0x0000000075AA0000-0x0000000075CB5000-memory.dmp

Filesize
2.1MB

Download
memory/3432-996-0x0000000000920000-0x0000000000929000-memory.dmp

Filesize
36KB

Download
memory/3432-998-0x0000000002710000-0x0000000002B10000-memory.dmp

Filesize
4.0MB

Download
memory/3432-999-0x00007FF802AF0000-0x00007FF802CE5000-memory.dmp

Filesize
2.0MB

Download
memory/3628-1342-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Filesize
972KB

Download
memory/4992-913-0x00000165AB040000-0x00000165AB062000-memory.dmp

Filesize
136KB

Download