hxxps://drive[.]google[.]com/file/d/1ArvMukQ-CmWfXPLjRFahkw_5etvjCRAG/view

Analysis

max time kernel
177s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
17-09-2024 17:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1ArvMukQ-CmWfXPLjRFahkw_5etvjCRAG/view

Score

7^/10

discovery link pdf upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 2 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x00070000000234dd-166.dat	acprotect
behavioral1/files/0x00070000000234de-174.dat	acprotect

Executes dropped EXE 2 IoCs

pid	Process
5656	Setup (1).exe
5752	Setup (1).tmp

Loads dropped DLL 13 IoCs

pid	Process
5752	Setup (1).tmp
5752	Setup (1).tmp
5752	Setup (1).tmp
5752	Setup (1).tmp
5752	Setup (1).tmp
5752	Setup (1).tmp
5752	Setup (1).tmp
5752	Setup (1).tmp
5752	Setup (1).tmp
5752	Setup (1).tmp
5752	Setup (1).tmp
5752	Setup (1).tmp
5752	Setup (1).tmp

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00070000000234de-174.dat	upx
behavioral1/memory/5752-177-0x0000000003500000-0x00000000035A6000-memory.dmp	upx
behavioral1/memory/5752-179-0x0000000003500000-0x00000000035A6000-memory.dmp	upx
behavioral1/memory/5752-381-0x0000000003500000-0x00000000035A6000-memory.dmp	upx

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops desktop.ini file(s) 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\desktop.ini	Setup (1).tmp
File opened for modification	C:\Program Files\Common Files\Avid\Audio\Plug-Ins\SerumFX.aaxplugin\desktop.ini	Setup (1).tmp
File opened for modification	C:\Program Files (x86)\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\desktop.ini	Setup (1).tmp
File opened for modification	C:\Program Files (x86)\Common Files\Avid\Audio\Plug-Ins\SerumFX.aaxplugin\desktop.ini	Setup (1).tmp

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\N:	Setup (1).tmp
File opened (read-only)	\??\O:	Setup (1).tmp
File opened (read-only)	\??\P:	Setup (1).tmp
File opened (read-only)	\??\R:	Setup (1).tmp
File opened (read-only)	\??\V:	Setup (1).tmp
File opened (read-only)	\??\Y:	Setup (1).tmp
File opened (read-only)	\??\I:	Setup (1).tmp
File opened (read-only)	\??\L:	Setup (1).tmp
File opened (read-only)	\??\K:	Setup (1).tmp
File opened (read-only)	\??\Q:	Setup (1).tmp
File opened (read-only)	\??\J:	Setup (1).tmp
File opened (read-only)	\??\S:	Setup (1).tmp
File opened (read-only)	\??\T:	Setup (1).tmp
File opened (read-only)	\??\U:	Setup (1).tmp
File opened (read-only)	\??\Z:	Setup (1).tmp
File opened (read-only)	\??\A:	Setup (1).tmp
File opened (read-only)	\??\G:	Setup (1).tmp
File opened (read-only)	\??\H:	Setup (1).tmp
File opened (read-only)	\??\M:	Setup (1).tmp
File opened (read-only)	\??\W:	Setup (1).tmp
File opened (read-only)	\??\X:	Setup (1).tmp
File opened (read-only)	\??\B:	Setup (1).tmp
File opened (read-only)	\??\E:	Setup (1).tmp

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
7	drive.google.com
10	drive.google.com

Drops file in Program Files directory 52 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Xfer Records\Serum\Uninstall\xfs-r4e.ico	Setup (1).tmp
File opened for modification	C:\Program Files\Common Files\Avid\Audio\Plug-Ins\SerumFX.aaxplugin\PlugIn.ico	Setup (1).tmp
File created	C:\Program Files\Xfer Records\Serum\Xfer Serum (64Bit).lnk	Setup (1).tmp
File opened for modification	C:\Program Files\Steinberg\VSTPlugins\Serum_x64.dll	Setup (1).tmp
File created	C:\Program Files\Xfer Records\Serum\Uninstall\is-H4N57.tmp	Setup (1).tmp
File created	C:\Program Files\Common Files\Avid\Audio\Plug-Ins\SerumFX.aaxplugin\is-2UIPR.tmp	Setup (1).tmp
File created	C:\Program Files\Steinberg\VSTPlugins\is-E45S9.tmp	Setup (1).tmp
File opened for modification	C:\Program Files (x86)\Steinberg\VSTPlugins\Serum.exe	Setup (1).tmp
File created	C:\Program Files (x86)\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\is-2A3T0.tmp	Setup (1).tmp
File opened for modification	C:\Program Files (x86)\Common Files\Avid\Audio\Plug-Ins\SerumFX.aaxplugin\desktop.ini	Setup (1).tmp
File opened for modification	C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\PlugIn.ico	Setup (1).tmp
File opened for modification	C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\desktop.ini	Setup (1).tmp
File opened for modification	C:\Program Files (x86)\Steinberg\VSTPlugins\Serum.dll	Setup (1).tmp
File created	C:\Program Files\Xfer Records\Serum\Uninstall\is-FOQF5.tmp	Setup (1).tmp
File created	C:\Program Files (x86)\Common Files\Avid\Audio\Plug-Ins\SerumFX.aaxplugin\Contents\x64\is-O0IAN.tmp	Setup (1).tmp
File created	C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\is-SFPCI.tmp	Setup (1).tmp
File opened for modification	C:\Program Files (x86)\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin	Setup (1).tmp
File opened for modification	C:\Program Files (x86)\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\PlugIn.ico	Setup (1).tmp
File opened for modification	C:\Program Files (x86)\Common Files\Avid\Audio\Plug-Ins\SerumFX.aaxplugin\PlugIn.ico	Setup (1).tmp
File opened for modification	C:\Program Files\Common Files\Avid\Audio\Plug-Ins\SerumFX.aaxplugin\desktop.ini	Setup (1).tmp
File created	C:\Program Files\Xfer Records\Serum\Uninstall\unins000.dat	Setup (1).tmp
File created	C:\Program Files (x86)\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\Contents\x64\is-A9QLU.tmp	Setup (1).tmp
File created	C:\Program Files\Common Files\Avid\Audio\Plug-Ins\SerumFX.aaxplugin\Contents\x64\is-MA39B.tmp	Setup (1).tmp
File opened for modification	C:\Program Files\Xfer Records\Serum\Uninstall\unins000.dat	Setup (1).tmp
File opened for modification	C:\Program Files\Steinberg\VSTPlugins\SerumFX_x64.dll	Setup (1).tmp
File opened for modification	C:\Program Files (x86)\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\desktop.ini	Setup (1).tmp
File created	C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\Contents\Win32\is-6RVIH.tmp	Setup (1).tmp
File created	C:\Program Files\Xfer Records\Serum\Xfer Serum (32Bit).lnk	Setup (1).tmp
File created	C:\Program Files\Xfer Records\Serum\Uninstall\is-GS213.tmp	Setup (1).tmp
File opened for modification	C:\Program Files\Xfer Records\Serum\Uninstall\Skin.cjstyles	Setup (1).tmp
File opened for modification	C:\Program Files\Xfer Records\Serum\Uninstall\ISSkinU.dll	Setup (1).tmp
File created	C:\Program Files (x86)\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\Contents\Win32\is-68DJE.tmp	Setup (1).tmp
File created	C:\Program Files (x86)\Common Files\Avid\Audio\Plug-Ins\SerumFX.aaxplugin\is-PO6CA.tmp	Setup (1).tmp
File created	C:\Program Files\Steinberg\VSTPlugins\is-5A8GD.tmp	Setup (1).tmp
File created	C:\Program Files (x86)\Steinberg\VSTPlugins\is-SKBIM.tmp	Setup (1).tmp
File opened for modification	C:\Program Files (x86)\Steinberg\VSTPlugins\SerumFX.dll	Setup (1).tmp
File opened for modification	C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin	Setup (1).tmp
File created	C:\Program Files\Steinberg\VSTPlugins\is-JLJIV.tmp	Setup (1).tmp
File opened for modification	C:\Program Files\Common Files\Avid\Audio\Plug-Ins\SerumFX.aaxplugin	Setup (1).tmp
File created	C:\Program Files (x86)\Steinberg\VSTPlugins\is-83R9B.tmp	Setup (1).tmp
File created	C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\Contents\x64\is-7FSN9.tmp	Setup (1).tmp
File created	C:\Program Files\Common Files\Avid\Audio\Plug-Ins\SerumFX.aaxplugin\is-5M62B.tmp	Setup (1).tmp
File created	C:\Program Files\Common Files\Avid\Audio\Plug-Ins\SerumFX.aaxplugin\Contents\Win32\is-MTGGN.tmp	Setup (1).tmp
File created	C:\Program Files (x86)\Steinberg\VSTPlugins\is-V2J3J.tmp	Setup (1).tmp
File opened for modification	C:\Program Files\Steinberg\VSTPlugins\Serum_x64.exe	Setup (1).tmp
File created	C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\is-A6NQ1.tmp	Setup (1).tmp
File created	C:\Program Files\Xfer Records\Serum\Uninstall\is-EGOSB.tmp	Setup (1).tmp
File created	C:\Program Files (x86)\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\is-ESI4O.tmp	Setup (1).tmp
File created	C:\Program Files\Xfer Records\Serum\is-5H03M.tmp	Setup (1).tmp
File opened for modification	C:\Program Files (x86)\Common Files\Avid\Audio\Plug-Ins\SerumFX.aaxplugin	Setup (1).tmp
File created	C:\Program Files (x86)\Common Files\Avid\Audio\Plug-Ins\SerumFX.aaxplugin\is-2SITK.tmp	Setup (1).tmp
File created	C:\Program Files (x86)\Common Files\Avid\Audio\Plug-Ins\SerumFX.aaxplugin\Contents\Win32\is-U7IV0.tmp	Setup (1).tmp

HTTP links in PDF interactive object 1 IoCs

Detects HTTP links in interactive objects within PDF files.

pdf link

resource	yara_rule
behavioral1/files/0x00070000000234fd-494.dat	pdf_with_link_action

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup (1).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup (1).tmp

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3980	msedge.exe
3980	msedge.exe
3176	msedge.exe
3176	msedge.exe
5000	identity_helper.exe
5000	identity_helper.exe
5240	msedge.exe
5240	msedge.exe
5752	Setup (1).tmp
5752	Setup (1).tmp
5212	msedge.exe
5212	msedge.exe
5212	msedge.exe
5212	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5752	Setup (1).tmp

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeRestorePrivilege	5576	7zG.exe
Token: 35	5576	7zG.exe
Token: SeSecurityPrivilege	5576	7zG.exe
Token: SeSecurityPrivilege	5576	7zG.exe
Token: 33	4824	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4824	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 62 IoCs

pid	Process
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
5576	7zG.exe
5752	Setup (1).tmp

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
5656	Setup (1).exe
5752	Setup (1).tmp
5752	Setup (1).tmp

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3176 wrote to memory of 3192	3176	msedge.exe	82
PID 3176 wrote to memory of 3192	3176	msedge.exe	82
PID 3176 wrote to memory of 3628	3176	msedge.exe	83
PID 3176 wrote to memory of 3628	3176	msedge.exe	83
PID 3176 wrote to memory of 3628	3176	msedge.exe	83
PID 3176 wrote to memory of 3628	3176	msedge.exe	83
PID 3176 wrote to memory of 3628	3176	msedge.exe	83
PID 3176 wrote to memory of 3628	3176	msedge.exe	83
PID 3176 wrote to memory of 3628	3176	msedge.exe	83
PID 3176 wrote to memory of 3628	3176	msedge.exe	83
PID 3176 wrote to memory of 3628	3176	msedge.exe	83
PID 3176 wrote to memory of 3628	3176	msedge.exe	83
PID 3176 wrote to memory of 3628	3176	msedge.exe	83
PID 3176 wrote to memory of 3628	3176	msedge.exe	83
PID 3176 wrote to memory of 3628	3176	msedge.exe	83
PID 3176 wrote to memory of 3628	3176	msedge.exe	83
PID 3176 wrote to memory of 3628	3176	msedge.exe	83
PID 3176 wrote to memory of 3628	3176	msedge.exe	83
PID 3176 wrote to memory of 3628	3176	msedge.exe	83
PID 3176 wrote to memory of 3628	3176	msedge.exe	83
PID 3176 wrote to memory of 3628	3176	msedge.exe	83
PID 3176 wrote to memory of 3628	3176	msedge.exe	83
PID 3176 wrote to memory of 3628	3176	msedge.exe	83
PID 3176 wrote to memory of 3628	3176	msedge.exe	83
PID 3176 wrote to memory of 3628	3176	msedge.exe	83
PID 3176 wrote to memory of 3628	3176	msedge.exe	83
PID 3176 wrote to memory of 3628	3176	msedge.exe	83
PID 3176 wrote to memory of 3628	3176	msedge.exe	83
PID 3176 wrote to memory of 3628	3176	msedge.exe	83
PID 3176 wrote to memory of 3628	3176	msedge.exe	83
PID 3176 wrote to memory of 3628	3176	msedge.exe	83
PID 3176 wrote to memory of 3628	3176	msedge.exe	83
PID 3176 wrote to memory of 3628	3176	msedge.exe	83
PID 3176 wrote to memory of 3628	3176	msedge.exe	83
PID 3176 wrote to memory of 3628	3176	msedge.exe	83
PID 3176 wrote to memory of 3628	3176	msedge.exe	83
PID 3176 wrote to memory of 3628	3176	msedge.exe	83
PID 3176 wrote to memory of 3628	3176	msedge.exe	83
PID 3176 wrote to memory of 3628	3176	msedge.exe	83
PID 3176 wrote to memory of 3628	3176	msedge.exe	83
PID 3176 wrote to memory of 3628	3176	msedge.exe	83
PID 3176 wrote to memory of 3628	3176	msedge.exe	83
PID 3176 wrote to memory of 3980	3176	msedge.exe	84
PID 3176 wrote to memory of 3980	3176	msedge.exe	84
PID 3176 wrote to memory of 4612	3176	msedge.exe	85
PID 3176 wrote to memory of 4612	3176	msedge.exe	85
PID 3176 wrote to memory of 4612	3176	msedge.exe	85
PID 3176 wrote to memory of 4612	3176	msedge.exe	85
PID 3176 wrote to memory of 4612	3176	msedge.exe	85
PID 3176 wrote to memory of 4612	3176	msedge.exe	85
PID 3176 wrote to memory of 4612	3176	msedge.exe	85
PID 3176 wrote to memory of 4612	3176	msedge.exe	85
PID 3176 wrote to memory of 4612	3176	msedge.exe	85
PID 3176 wrote to memory of 4612	3176	msedge.exe	85
PID 3176 wrote to memory of 4612	3176	msedge.exe	85
PID 3176 wrote to memory of 4612	3176	msedge.exe	85
PID 3176 wrote to memory of 4612	3176	msedge.exe	85
PID 3176 wrote to memory of 4612	3176	msedge.exe	85
PID 3176 wrote to memory of 4612	3176	msedge.exe	85
PID 3176 wrote to memory of 4612	3176	msedge.exe	85
PID 3176 wrote to memory of 4612	3176	msedge.exe	85
PID 3176 wrote to memory of 4612	3176	msedge.exe	85
PID 3176 wrote to memory of 4612	3176	msedge.exe	85
PID 3176 wrote to memory of 4612	3176	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/file/d/1ArvMukQ-CmWfXPLjRFahkw_5etvjCRAG/view
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffeed946f8,0x7fffeed94708,0x7fffeed94718
  2⤵
  PID:3192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2216,1632027223092988910,1163667018257703953,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2240 /prefetch:2
  2⤵
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2216,1632027223092988910,1163667018257703953,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2652 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2216,1632027223092988910,1163667018257703953,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2816 /prefetch:8
  2⤵
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,1632027223092988910,1163667018257703953,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:2868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,1632027223092988910,1163667018257703953,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,1632027223092988910,1163667018257703953,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4208 /prefetch:1
  2⤵
  PID:3756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,1632027223092988910,1163667018257703953,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5328 /prefetch:1
  2⤵
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2216,1632027223092988910,1163667018257703953,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5596 /prefetch:8
  2⤵
  PID:3080
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2216,1632027223092988910,1163667018257703953,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5596 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2216,1632027223092988910,1163667018257703953,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5776 /prefetch:8
  2⤵
  PID:628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,1632027223092988910,1163667018257703953,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5936 /prefetch:1
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,1632027223092988910,1163667018257703953,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5372 /prefetch:1
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,1632027223092988910,1163667018257703953,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5880 /prefetch:1
  2⤵
  PID:3408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,1632027223092988910,1163667018257703953,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5456 /prefetch:1
  2⤵
  PID:1432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,1632027223092988910,1163667018257703953,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5364 /prefetch:1
  2⤵
  PID:2712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2216,1632027223092988910,1163667018257703953,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5764 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2216,1632027223092988910,1163667018257703953,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3144 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5212

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4456

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3484

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1944

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Serum (v1.334)\" -spe -an -ai#7zMap30820:90:7zEvent92
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5576

C:\Users\Admin\Downloads\Serum (v1.334)\Serum\Setup (1).exe
"C:\Users\Admin\Downloads\Serum (v1.334)\Serum\Setup (1).exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5656
- C:\Users\Admin\AppData\Local\Temp\is-IPU0E.tmp\Setup (1).tmp
  "C:\Users\Admin\AppData\Local\Temp\is-IPU0E.tmp\Setup (1).tmp" /SL5="$40180,163673546,189440,C:\Users\Admin\Downloads\Serum (v1.334)\Serum\Setup (1).exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops desktop.ini file(s)
  - Enumerates connected drives
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:5752
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /C ""C:\Users\Admin\AppData\Local\Temp\is-4NMGL.tmp\UninstReg.cmd""
    3⤵
    PID:5728
  - - C:\Windows\system32\mode.com
      mode con: cols=38 lines=5
      4⤵
      PID:5800
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Xfer Records Serum-r4e_is1" /v "DisplayVersion" /t REG_SZ /d "1.3.3.4" /f
      4⤵
      PID:5872
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Xfer Records Serum-r4e_is1" /v "Publisher" /t REG_SZ /d "Xfer Records" /f
      4⤵
      PID:5868
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Xfer Records Serum-r4e_is1" /v "Comments" /t REG_SZ /d "r4e 2021" /f
      4⤵
      PID:5848
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Xfer Records Serum-r4e_is1" /v "URLInfoAbout" /t REG_SZ /d "https://www.xferrecords.com" /f
      4⤵
      PID:5732
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" ver "
      4⤵
      PID:5892
  - - C:\Windows\system32\findstr.exe
      findstr /i "10\.0\."
      4⤵
      PID:5876
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Xfer Records Serum-r4e_is1" /v "EstimatedSize" /t REG_DWORD /d "221217" /f
      4⤵
      PID:5936

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x498 0x41c
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Common Files\Avid\Audio\Plug-Ins\SerumFX.aaxplugin\PlugIn.ico

Filesize
114KB

MD5
d26f40e07c4a966eaa00047b0ecd52c7

SHA1
9be25fd336f0440572c84b9a6151c33504ab4ce4

SHA256
55cd7afec149dc5accbb0821c98250785f8e503d0c29f1c0c989a7fea915c1ab

SHA512
88ae4281c7ddcdf673beb0fc1247716eb2462866e65bfbcbb56c71a9c3d127bdfe4627c7f137af1dfad45fb504b98b1a088a06d8e891c041f2e40e0ff8b9a631

Download Submit
C:\Program Files (x86)\Common Files\Avid\Audio\Plug-Ins\SerumFX.aaxplugin\desktop.ini

Filesize
126B

MD5
798095cd31340606c8e81d0a5107d57e

SHA1
39d058c4d45ef84b188f7ece620106124eb3d74e

SHA256
5526ef6345adee7c693e58354dd72b095df152be62ff7298b4c6f6d0f91e2f83

SHA512
9ca995c89d3f23cd2a977fb2826da1f75dc4caa4fe965f9aac3a6d486f6558429a44eaeea35217f85d94ba6d7c2c54ab520c9a1786133b2edd103e36159e53a1

Download Submit
C:\Program Files (x86)\Steinberg\VSTPlugins\Serum.exe

Filesize
2.8MB

MD5
d9c0eda65a4783677c788d446bf6220c

SHA1
20acc2c7340926173ff336c71033c568dcdf57a2

SHA256
cbf4b859b4e2fb2ecd01d235fce59a53f78a210a2b013283bbb0c331a51d0030

SHA512
f2063243d570e708a244c4902b2c199b6c4b1ec041c956e08127aba375d4938e69fb8b8bab03873aa020f8f30d4a055dfc490d6219c4bc2aa5678b4eeed2b616

Download Submit
C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\Contents\Win32\Serum.aaxplugin

Filesize
4.2MB

MD5
3bad615bed6ca7a0aa70b56c4b9db0e2

SHA1
71f67e4e6255ad0010331544913fd1f4b33ccaf9

SHA256
a103e4033dbbd829219d39bda52dd72f7959b6ea26ac5fcd7f6b89fde9c98aff

SHA512
b74b723cb9f28f88a26128150738b3f2d4c6d67664e03701e6d890f8b1e1303951bec94913cfadba156ebe87eb4723fb02ba6ec3b7fc3b9e8c48532018c84490

Download Submit
C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\Contents\x64\Serum.aaxplugin

Filesize
5.0MB

MD5
3acee4936a33b89294b2545fad67e817

SHA1
a0082b987127a8f7c70f0816a0b9620facb0842e

SHA256
a27cbad97ea037613a1668d165676d2594c221444224677be25de537cd716251

SHA512
5f300bd47edc96236a3c827ed12b466e3d1e48145a03a1dbca0c782179282b6a92c305762b3632f9e04871eeb9c66eed516362330c89c2dae3cf9aa37a4f4a44

Download Submit
C:\Program Files\Common Files\Avid\Audio\Plug-Ins\SerumFX.aaxplugin\Contents\Win32\SerumFX.aaxplugin

Filesize
4.2MB

MD5
a1c02d3f255ae8583c26f62161a13070

SHA1
d10433edf9fed747dc1ca869020eb663773477d0

SHA256
bd53c7e2c8373740406bae0c2d0da2727595685b57162289f109c37692837905

SHA512
5a758bb293f1452632969c24f8a8dcafeee53c968366902807cb4199e251dac1ad0223dee3fc8ff7d423059602ab39eb8b6ef974b861c6ff5ab46db8dcb54ad4

Download Submit
C:\Program Files\Common Files\Avid\Audio\Plug-Ins\SerumFX.aaxplugin\Contents\x64\SerumFX.aaxplugin

Filesize
5.0MB

MD5
dc068e0381a3847e01e273e758ec8822

SHA1
043e667d39e1f413089a49feba07bd2f3dade868

SHA256
bb41d6ddeab770dd6a4fce7de6b754279ce07321272389ac2b9bee87097afa1c

SHA512
ffcf0b00d0d0b9c8f671d77fbe983f945354b46a43b1557ed16e3cb7acfe6f1cf7b022f95daf6f3aaa3fecd087414c290e48b4c64c2a77f48d126882ba3f4237

Download Submit
C:\Program Files\Steinberg\VSTPlugins\Serum_x64.exe

Filesize
3.8MB

MD5
ef9d81419ff6bf74090b7478328619ac

SHA1
bf87683d61d35e418698655a2e0fdd5b46872e71

SHA256
ec14d471c0b8c2676ceaead7ec78ba65d1f1d8600abbb83f623ab760d4e121ac

SHA512
8dc28a1cd90ce98726d303a6b4ebc0d82e1c41abfc9a12947107fc08a88dd90ba90c5e1cd5832a6d9b36f7d798bb8af402901c05352883a1a2c68f61827140a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
111c361619c017b5d09a13a56938bd54

SHA1
e02b363a8ceb95751623f25025a9299a2c931e07

SHA256
d7be4042a1e3511b0dbf0ab5c493245e4ac314440a4ae0732813db01a21ef8bc

SHA512
fc16a4ad0b56899b82d05114d7b0ca8ee610cdba6ff0b6a67dea44faf17b3105109335359b78c0a59c9011a13152744a7f5d4f6a5b66ea519df750ef03f622b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
983cbc1f706a155d63496ebc4d66515e

SHA1
223d0071718b80cad9239e58c5e8e64df6e2a2fe

SHA256
cc34b8f8e3f4bfe4c9a227d88f56ea2dd276ca3ac81df622ff5e9a8ec46b951c

SHA512
d9cf2ca46d9379902730c81e615a3eb694873ffd535c6bb3ded2dc97cdbbfb71051ab11a07754ed6f610f04285605b702b5a48a6cfda3ee3287230c41c9c45cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
408B

MD5
a0a4c7006fc6d12380b5b4215b85f147

SHA1
bb3daca9c45b21bf5d140473b66401e952a93276

SHA256
5c803ae27646f8a1f11fea5de56a2acf813547f517173dd1bdd5bc55ac08b66c

SHA512
f31c8a707af8006b8bf79f1f62aa07c48e1f3cab4b19229d8c33accf0555b89e58fea85a2a7d8bc9af10ea30438e41f6447e45bdc2707304fca6078ce4c64af3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
7a426d2f15378d74e6905a47668d748d

SHA1
c3f391090f61c458b315c313a5102f6efe651f2d

SHA256
dad348d2ea29c58d484786b47563f6aa2a345d0e7c27c9c947376a382d70c4fc

SHA512
1009a03a0860f61959399603b35f8d089459c0c2ad5af7b5f59f5f049bb469a89af7b0e1292a68e176fd97c4c8ff1f28ae012b8437c6be2913296ef5cf4b3063

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
09508dafeb1a04f51eb47c47b4c6df8f

SHA1
1a33124f9064ec20adec34d1cfe6ce9740fac2b4

SHA256
79978e10fb359c127f03afabc8c06aed5aa9a0e95f694a99c984e0d789b953db

SHA512
1bc2de607456a43567bffdae5294c0589e3a162b24a7b6eab8358f90d6b827b217446f1296da4452e3044ec5ee3425aeb4118c8e8621e794cf66aa868294f148

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
bd0f99ce5c3b3bbb0172fa9cbd283184

SHA1
74b2cefe449cda8f39759c5d4219b162494b0d29

SHA256
a5f145edf0cad6d521879d14f8fce7ffd4e5c2ff264844eaf31e539927e82cc6

SHA512
2b48ad7e4f20ae659c18bd79525c38c73ad3f76d488d4fbe711c645983263e956685bc8d36ffc82a52a631ef2af666c901db3451659ad970a99ffdd4b58d0611

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
22a4c1edd4f5c9513567f4835cbc9723

SHA1
521ef202858a2155d93990fd4970d1b1095dcfad

SHA256
29734e57e13e76cd67f3429312f28fe1b4dbbfcbbe4aa80e5e853dc8f55b0561

SHA512
a3e8f09ba58912abf6b00b8d3a07c08f34937676f6c74cfe4860c3c65f8ec7f8d84173a26f053f621b717ea76a3d300c5ff06e9e1c26a8a7831ef27e3a6dec39

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
ddbcbc3af15c691ac46bff1c82c7622d

SHA1
5e7dfcc852cc05670159669706d88fe4b9959232

SHA256
1ac80d3ef196c5475381b45e597fcadaedc80ca60cd2686ce6a542fadde79831

SHA512
5f95c8be6e02228dd12b56c7ad289a2399f7909bb68df39bc083850039d6085ac1ad9187995e295516c50deabd5fad1f5f6e395d1a2e7cf67409867d5a014626

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
cea0ae0ba95be37ed071e545ae34d521

SHA1
9765facb928c8c2fba36f5d5699ccaff386c18b2

SHA256
00f3363ec1856052a8ad7881e34c4c0708237dc8ad664f59c5700c9e82c34b25

SHA512
077d038da2685ce7e9cfd58a94e9a1e4e7c0401805b8a42b49e2609232f42471dd61f5ab9d2c4feb5c387c7263e04fa98aa43df4923def671c43b5bebb9b6d10

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-4NMGL.tmp\BASS.dll

Filesize
91KB

MD5
26295a0baf87955f2e37735af135ca45

SHA1
97f468d3ebaca4774ce69f6f55c998b93a912540

SHA256
0bd42c13dd0a5c881e80f161f7548b093c4fd99a747c13568af983e2c76cd71a

SHA512
6760c5fe3621b1d9c84a5c974c28d796cfba83dba4ff0e9f9eb0ed19cb47a6fc6a1322f58193eb4d638e214f7e61e9543f6f9235c2be8888bcd075fa7650b20a

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-4NMGL.tmp\CallbackCtrl.dll

Filesize
4KB

MD5
f07e819ba2e46a897cfabf816d7557b2

SHA1
8d5fd0a741dd3fd84650e40dd3928ae1f15323cc

SHA256
68f42a7823ed7ee88a5c59020ac52d4bbcadf1036611e96e470d986c8faa172d

SHA512
7ed26d41ead2ace0b5379639474d319af9a3e4ed2dd9795c018f8c5b9b533fd36bfc1713a1f871789bf14884d186fd0559939de511dde24673b0515165d405af

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-4NMGL.tmp\ISSkinU.dll

Filesize
385KB

MD5
7d9087c4e2f9ab2db78a46ab52a7f360

SHA1
15624c6e5ae4b2689a6975a8faf9f0efbd940b7d

SHA256
ff1374abd93690f5e6e591bae23b49aacc8bbe8b7b05b539ec8aee755070a0e3

SHA512
70375fe15072531de481a0ff95473fa152178d2fd5f0610712cd4fd63ed9da9a40c669442021c23937465ee1e81c39e38332444f10463b5a4fda2048ec4f1d5a

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-4NMGL.tmp\Music_Stroke.png

Filesize
2KB

MD5
4de136ea1d0ef7f705721de73948f6cc

SHA1
c90a3caa5090ad43973224964dc917bc7bc947cd

SHA256
921b4e067067a29826ef3abc8a758ea6327be5177b333a87a8be27af71c4abcd

SHA512
6bf01b9d5321c755dab9a4434876178395e34bee7d735d727fbf37e17e796c53e54713f3dcb98139f54a1ea1fde1edd8f89560cf8612baa0c65a65732d0e8d30

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-4NMGL.tmp\PlayerBG.png

Filesize
561B

MD5
12266ac7625adf8b2d974dc7c456c4b0

SHA1
ce09c3bbcf49760adf9014f27886d4d762f338cb

SHA256
7d19086479b58651eac558e74101670a6343dd9eb3690980ef5842f1c71d7650

SHA512
f583080f7bd70c826e06358998a4e4976b833a5aaf8df3c3044a37076b14e7ceee209fa67980211cf7e6c39306958495f43b949ce5a9143734ef5999325b8766

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-4NMGL.tmp\Skin.cjstyles

Filesize
381KB

MD5
d050af615a4268b9229cf6e7e6589072

SHA1
a079cd3ce89e1b4c54fa22377bc44b26a445c569

SHA256
4fdae26567f43e9f936be5ef23bad8fca78bb53d9c2277afb65d0524529039a6

SHA512
0630c309c37423c8032403655fc51017ad3eb12311a31be839e4b864fedde5c722c27f998fb4f1d8fef1b0d34a6b1e2ebd50375b2bdb36b69dc9b15de9d8fea7

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-4NMGL.tmp\UninstReg.cmd

Filesize
913B

MD5
a35a816ed4b5da7fee375f38e1e5c2f2

SHA1
1202a1f5b954c580c928578f7ba8a1e1d5289b0f

SHA256
0440038b5099fc89fc9ef962c93cf9450c4932f841e981507701a556662e4828

SHA512
0d1e21190c6b0bdc4f93fb261c4e1708212e3c8f22b913c1f9074d107c08cbf746ccd1743bc522f522e325c72fd8e3655e262fe85f9cc5f7b348ce782f91005c

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-4NMGL.tmp\VolMax.png

Filesize
330B

MD5
d39a3a7a4cc172763c50c82f385926ef

SHA1
1e90a0207716e993d4535b5bcd66f091311db69f

SHA256
b3c2ee422a4e617d3e3e6d3a8c69bf79335b317a21ab95bb525bd710a8da17b5

SHA512
9ffb047bdbd58d33949208f8a372c6424dbd6bddba679221b23b038c529421d4c94f694ba80234d71c8378877288b5acf80854a6e5db145b9a1710de87712b25

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-4NMGL.tmp\VolMin.png

Filesize
250B

MD5
439a83f5b3af1c9489a9018103e57095

SHA1
3095e60b35ebe91ebb264c24c2348aeb5a373b95

SHA256
f48bad936959242e695719b09439ca2dd05fa23c2a6fc0eaf9b4a4fe0ce7627b

SHA512
3d22b5c7d9f414f5ecdcb01bd26944d57c73ad1e96ef2a302347d7ae2056d61f1449ac236d03f8aabc9db8c63e00f3d25ee3b69a059501a2dfc907caf1b8f3b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-4NMGL.tmp\VolSlider.png

Filesize
218B

MD5
cf673f94267bbafd257f170beccb1584

SHA1
836799aece9156ea25932a9442338e1930e6bb17

SHA256
eccdbccd4870aded10ec95a86843dadaf1b385024d6616a9edb106ff9f2018a3

SHA512
9c0c46075cddc1b66614fac060393be74eb8017087c47e4c7e7ce2520ef85a9ee743a5605379dc19c410aa90da456910346b322ebb0f0f6763ef36881af94ae7

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-4NMGL.tmp\WaterLib.dll

Filesize
123KB

MD5
b4ae1b26b68545a823f067738a6877f9

SHA1
a90a812cac906afb2fbe2a400746de67c845ecb0

SHA256
57ec9023fddd0e0dedffc93bae937442eebd648a4d14383b22fb1a787582cbbc

SHA512
64b6e3ac5eba6231dabe61b73feb8bbeb2015cf871858aa0163fbc84b41912f8453aa16d6939f4d82f235929dbe333c5534965ceb2c83c67720f5f336ca3ccef

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-4NMGL.tmp\botva2.dll

Filesize
41KB

MD5
ef899fa243c07b7b82b3a45f6ec36771

SHA1
4a86313cc8766dcad1c2b00c2b8f9bbe0cf8bbbe

SHA256
da7d0368712ee419952eb2640a65a7f24e39fb7872442ed4d2ee847ec4cfde77

SHA512
3f98b5ad9adfad2111ebd1d8cbab9ae423d624d1668cc64c0bfcdbfedf30c1ce3ea6bc6bcf70f7dd1b01172a4349e7c84fb75d395ee5af73866574c1d734c6e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-4NMGL.tmp\imageanimator.dll

Filesize
236KB

MD5
eb1e975ff55d454aeef95752bbed4312

SHA1
7f848786b2a44c38d6b7115cebbc35df3c3378ee

SHA256
ee98ceb9c2ca4fc8cecc10346e42b06370b94b304eb48aeef86e9bd6869f45cf

SHA512
003a89e439c19a49a68bffd6134df46f975f1f64a585d3303652e76e2a2b11a6ebedc8761c38b491470c003fd0d9f69ce8cdd08f3f074c7df336787c718e1c1c

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-IPU0E.tmp\Setup (1).tmp

Filesize
1.5MB

MD5
a01c8baf9a555c3388f5d41545bbc97e

SHA1
551e7c2386734a5f6afa77259262bd0ef109f4de

SHA256
0b09e25806976b6a0180e767286b3c5f726421e29a4145b0a5639fae502f839b

SHA512
3d7e5a9c57e418c18549c890e75dd560418c394f6d05594b1a01875c8bdcde65bd417cfbcd3f4937b6d694d9188ddefaaad236e18a03e8dc0db991f6109e2566

Download Submit
C:\Users\Admin\Documents\Xfer\Serum Presets\Serum_Manual.pdf

Filesize
806KB

MD5
e3dc4c84a7d3643721e1479a83b0a630

SHA1
30bf1a2bcf05ecde3adf7cc590252569351efc09

SHA256
1c31cc753606a1e16c11089831b21a01acb804eac008be6b8c6cffe64a3a0ccc

SHA512
a431839d10f92ea8cd5fba8502426aab71176c2b131a8d1a8403710fc297ab1d37cc78e95156bf02e6cfe17981ff65c94537e76fdfeeae4564396160844ebb9b

Download Submit
C:\Users\Admin\Documents\Xfer\Serum Presets\Skins\Default\1x\is-394SE.tmp

Filesize
1KB

MD5
5bb22ab624d9c111ccff980846e21c99

SHA1
a200fec196a8f0a4b798d3fa73f2e715ed547835

SHA256
a0a1c6ea69b0a6a1aa6d6bd6bd295e8df710ab4f819c1aeecf2c5786f26d1059

SHA512
0b9c2a9a0b18bebe29790355affeab7cdfcf4955e7464c9660c08d737850ad3ec7c8457be8980e567a8d922fe28beec8f29ed4ae30ca4a1e05896669ea26736d

Download Submit
C:\Users\Admin\Documents\Xfer\Serum Presets\Skins\Promethium\1x\is-N62MF.tmp

Filesize
1KB

MD5
c2636cab1581b01001bd665189fda63c

SHA1
76b394eea28541efc8574bd7773a35e1fca67ce5

SHA256
7f489f7a78e8153edd85b24f6f724a21895d10d5c8f40197c7af7e68960bda66

SHA512
5387376cc01d2d638c628d20c0471d582896641b9a5236bd78f76331a92b173d59a3d09cdda38fa2c648a07c3716972e657f5ab4868557d5bc928bcb36d721d7

Download Submit
C:\Users\Admin\Documents\Xfer\Serum Presets\Skins\Promethium\1x\is-O65F9.tmp

Filesize
1KB

MD5
3d370826d1b4c223b7975cbc2a064eb1

SHA1
8eabeabf9798ee63cf7cbe3df3f2c22c5aa4798c

SHA256
d34652d56f2a61d28d1c350fc180a1ce1642c29bcb5fe05a77b9b256711468f4

SHA512
b502d2dd5e572705a7d7a75060ecd5c20e8f0f7307dfad659ebd3c62079d48bba0b3ba80117b62412ad2bc0eb114e8037c9e8ae9201b30acd72e9217861e4d6a

Download Submit
C:\Users\Admin\Documents\Xfer\Serum Presets\Skins\Promethium\2x\is-6I7ML.tmp

Filesize
2KB

MD5
5d857b9000d78b502e2ffb8d0e6647de

SHA1
0e27ede07ddb9dcc6ddf1f9831c4c70988ca066c

SHA256
f8e352e45b99c51541c641e79336b0ac71bed60de31f866caed96e42b42adae4

SHA512
d3ebb20a9cff226947e477aa990982e0a8a4b27202e7b915d66622531e9e7832a3a1e9ecb86c5d27688498a88d3fbcec3b4272a340be8a4a03e52db99d5161f7

Download Submit
C:\Users\Admin\Documents\Xfer\Serum Presets\Skins\Promethium\2x\is-N7R50.tmp

Filesize
2KB

MD5
2b4d9090fdb2bdedb973155412b06ab8

SHA1
11d7b407d00d081414fbed0f35b8cfb491e0e90f

SHA256
981ca03de861ee80f0049bd33abbbcc2322aaa23499f31c6bf274750cc14dfd8

SHA512
6d0428b866103203b38fb06b22364c8e3591adf23fcc0b32d7f5de048348a4af1e2d7913f39de84e7e47eca3c41995365959c2a1c77243a3d5f42809c5d14072

Download Submit
memory/5656-148-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/5752-190-0x0000000010000000-0x0000000010061000-memory.dmp

Filesize
388KB

Download
memory/5752-215-0x0000000010000000-0x0000000010061000-memory.dmp

Filesize
388KB

Download
memory/5752-210-0x0000000076690000-0x0000000076C43000-memory.dmp

Filesize
5.7MB

Download
memory/5752-212-0x00000000754B0000-0x00000000756C0000-memory.dmp

Filesize
2.1MB

Download
memory/5752-217-0x0000000076CA0000-0x0000000076D4F000-memory.dmp

Filesize
700KB

Download
memory/5752-216-0x0000000076690000-0x0000000076C43000-memory.dmp

Filesize
5.7MB

Download
memory/5752-243-0x0000000076690000-0x0000000076C43000-memory.dmp

Filesize
5.7MB

Download
memory/5752-245-0x0000000010000000-0x0000000010061000-memory.dmp

Filesize
388KB

Download
memory/5752-247-0x00000000754B0000-0x00000000756C0000-memory.dmp

Filesize
2.1MB

Download
memory/5752-244-0x00000000754B0000-0x00000000756C0000-memory.dmp

Filesize
2.1MB

Download
memory/5752-234-0x0000000010000000-0x0000000010061000-memory.dmp

Filesize
388KB

Download
memory/5752-236-0x0000000077270000-0x0000000077353000-memory.dmp

Filesize
908KB

Download
memory/5752-235-0x0000000077170000-0x000000007724C000-memory.dmp

Filesize
880KB

Download
memory/5752-233-0x0000000074C70000-0x0000000074D92000-memory.dmp

Filesize
1.1MB

Download
memory/5752-231-0x00000000754B0000-0x00000000756C0000-memory.dmp

Filesize
2.1MB

Download
memory/5752-221-0x0000000010000000-0x0000000010061000-memory.dmp

Filesize
388KB

Download
memory/5752-220-0x0000000074C70000-0x0000000074D92000-memory.dmp

Filesize
1.1MB

Download
memory/5752-219-0x0000000075430000-0x00000000754A4000-memory.dmp

Filesize
464KB

Download
memory/5752-218-0x00000000754B0000-0x00000000756C0000-memory.dmp

Filesize
2.1MB

Download
memory/5752-242-0x0000000010000000-0x0000000010061000-memory.dmp

Filesize
388KB

Download
memory/5752-241-0x0000000074C70000-0x0000000074D92000-memory.dmp

Filesize
1.1MB

Download
memory/5752-240-0x0000000075430000-0x00000000754A4000-memory.dmp

Filesize
464KB

Download
memory/5752-239-0x00000000754B0000-0x00000000756C0000-memory.dmp

Filesize
2.1MB

Download
memory/5752-238-0x0000000076CA0000-0x0000000076D4F000-memory.dmp

Filesize
700KB

Download
memory/5752-237-0x0000000076690000-0x0000000076C43000-memory.dmp

Filesize
5.7MB

Download
memory/5752-232-0x0000000075430000-0x00000000754A4000-memory.dmp

Filesize
464KB

Download
memory/5752-230-0x0000000076CA0000-0x0000000076D4F000-memory.dmp

Filesize
700KB

Download
memory/5752-229-0x0000000076690000-0x0000000076C43000-memory.dmp

Filesize
5.7MB

Download
memory/5752-228-0x0000000010000000-0x0000000010061000-memory.dmp

Filesize
388KB

Download
memory/5752-227-0x0000000074C70000-0x0000000074D92000-memory.dmp

Filesize
1.1MB

Download
memory/5752-226-0x0000000075430000-0x00000000754A4000-memory.dmp

Filesize
464KB

Download
memory/5752-225-0x0000000077580000-0x00000000775A5000-memory.dmp

Filesize
148KB

Download
memory/5752-224-0x00000000754B0000-0x00000000756C0000-memory.dmp

Filesize
2.1MB

Download
memory/5752-223-0x0000000076CA0000-0x0000000076D4F000-memory.dmp

Filesize
700KB

Download
memory/5752-222-0x0000000076690000-0x0000000076C43000-memory.dmp

Filesize
5.7MB

Download
memory/5752-208-0x0000000077170000-0x000000007724C000-memory.dmp

Filesize
880KB

Download
memory/5752-214-0x0000000074C70000-0x0000000074D92000-memory.dmp

Filesize
1.1MB

Download
memory/5752-213-0x0000000075430000-0x00000000754A4000-memory.dmp

Filesize
464KB

Download
memory/5752-211-0x0000000076CA0000-0x0000000076D4F000-memory.dmp

Filesize
700KB

Download
memory/5752-206-0x0000000074C70000-0x0000000074D92000-memory.dmp

Filesize
1.1MB

Download
memory/5752-207-0x0000000010000000-0x0000000010061000-memory.dmp

Filesize
388KB

Download
memory/5752-209-0x0000000077270000-0x0000000077353000-memory.dmp

Filesize
908KB

Download
memory/5752-205-0x00000000754B0000-0x00000000756C0000-memory.dmp

Filesize
2.1MB

Download
memory/5752-203-0x0000000076690000-0x0000000076C43000-memory.dmp

Filesize
5.7MB

Download
memory/5752-204-0x0000000076CA0000-0x0000000076D4F000-memory.dmp

Filesize
700KB

Download
memory/5752-360-0x00000000061C0000-0x0000000006201000-memory.dmp

Filesize
260KB

Download
memory/5752-359-0x00000000061C0000-0x0000000006201000-memory.dmp

Filesize
260KB

Download
memory/5752-358-0x0000000003390000-0x00000000033E7000-memory.dmp

Filesize
348KB

Download
memory/5752-199-0x0000000077580000-0x00000000775A5000-memory.dmp

Filesize
148KB

Download
memory/5752-200-0x0000000010000000-0x0000000010061000-memory.dmp

Filesize
388KB

Download
memory/5752-201-0x0000000010000000-0x0000000010061000-memory.dmp

Filesize
388KB

Download
memory/5752-202-0x0000000077270000-0x0000000077353000-memory.dmp

Filesize
908KB

Download
memory/5752-381-0x0000000003500000-0x00000000035A6000-memory.dmp

Filesize
664KB

Download
memory/5752-198-0x0000000010000000-0x0000000010061000-memory.dmp

Filesize
388KB

Download
memory/5752-411-0x00000000061C0000-0x0000000006201000-memory.dmp

Filesize
260KB

Download
memory/5752-412-0x00000000061C0000-0x0000000006201000-memory.dmp

Filesize
260KB

Download
memory/5752-187-0x0000000075760000-0x00000000757DA000-memory.dmp

Filesize
488KB

Download
memory/5752-188-0x0000000010000000-0x0000000010061000-memory.dmp

Filesize
388KB

Download
memory/5752-189-0x0000000075760000-0x00000000757DA000-memory.dmp

Filesize
488KB

Download
memory/5752-191-0x0000000075760000-0x00000000757DA000-memory.dmp

Filesize
488KB

Download
memory/5752-192-0x0000000077580000-0x00000000775A5000-memory.dmp

Filesize
148KB

Download
memory/5752-193-0x0000000010000000-0x0000000010061000-memory.dmp

Filesize
388KB

Download
memory/5752-194-0x0000000075760000-0x00000000757DA000-memory.dmp

Filesize
488KB

Download
memory/5752-195-0x0000000077580000-0x00000000775A5000-memory.dmp

Filesize
148KB

Download
memory/5752-196-0x0000000074E30000-0x0000000074E60000-memory.dmp

Filesize
192KB

Download
memory/5752-197-0x0000000010000000-0x0000000010061000-memory.dmp

Filesize
388KB

Download
memory/5752-186-0x0000000010000000-0x0000000010061000-memory.dmp

Filesize
388KB

Download
memory/5752-185-0x0000000075760000-0x00000000757DA000-memory.dmp

Filesize
488KB

Download
memory/5752-179-0x0000000003500000-0x00000000035A6000-memory.dmp

Filesize
664KB

Download
memory/5752-177-0x0000000003500000-0x00000000035A6000-memory.dmp

Filesize
664KB

Download
memory/5752-170-0x0000000003390000-0x00000000033E7000-memory.dmp

Filesize
348KB

Download
memory/5752-169-0x0000000003390000-0x00000000033E7000-memory.dmp

Filesize
348KB

Download