75d167249768d3b15728389b25c65e97f6ad92610b26b7d65fe8e2db83c41e4d

Analysis

max time kernel
173s
max time network
204s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08-11-2024 09:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

farlab_setup.exe
Size

1.7MB
MD5

a7703240793e447ec11f535e808d2096
SHA1

913af985f540dab68be0cdf999f6d7cb52d5be96
SHA256

6a17ebf5da6aa3a1f4813e5f46fdd5d19d026bcfac91f232359f98e43df3c38f
SHA512

57bdcdfcfa11f6b5bf4149be0fee0444fcf67ccececf1009b166b17b7dce30da1a472f1890736186f4ef76e02ed23cc0dd2a41dc9bff94218a059832d4b5c69e
SSDEEP

49152:C9CKxz5eM8JvooqXrFzYA8hVU2AGm63yjpGIcLJjmyGpf8:MCm5eMOooqhomhjrcLS8

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

farlab_setup.tmp

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	farlab_setup.tmp

Executes dropped EXE 5 IoCs

Processes:

farlab_setup.tmpfarlab_setup.tmpFarLabUninstaller.exeNDP472-KB4054531-Web.exeSetup.exe

pid process

1004 farlab_setup.tmp
3868 farlab_setup.tmp
4100 FarLabUninstaller.exe
2136 NDP472-KB4054531-Web.exe
4616 Setup.exe
Loads dropped DLL 4 IoCs

Processes:

farlab_setup.tmpfarlab_setup.tmpSetup.exe

pid process

1004 farlab_setup.tmp
3868 farlab_setup.tmp
4616 Setup.exe
4616 Setup.exe
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

pid	process
1004	farlab_setup.tmp
3868	farlab_setup.tmp
4100	FarLabUninstaller.exe
2136	NDP472-KB4054531-Web.exe
4616	Setup.exe

pid	process
1004	farlab_setup.tmp
3868	farlab_setup.tmp
4616	Setup.exe
4616	Setup.exe

Drops file in Program Files directory 8 IoCs

Processes:

farlab_setup.tmp

description	ioc	process
File created	C:\Program Files (x86)\FarLabUninstaller\is-EG4BF.tmp	farlab_setup.tmp
File created	C:\Program Files (x86)\FarLabUninstaller\is-UGBT0.tmp	farlab_setup.tmp
File opened for modification	C:\Program Files (x86)\FarLabUninstaller\unins000.dat	farlab_setup.tmp
File opened for modification	C:\Program Files (x86)\FarLabUninstaller\FarLabUninstaller.exe	farlab_setup.tmp
File opened for modification	C:\Program Files (x86)\FarLabUninstaller\NDP472-KB4054531-Web.exe	farlab_setup.tmp
File created	C:\Program Files (x86)\FarLabUninstaller\unins000.dat	farlab_setup.tmp
File created	C:\Program Files (x86)\FarLabUninstaller\is-R760C.tmp	farlab_setup.tmp
File created	C:\Program Files (x86)\FarLabUninstaller\is-51HE0.tmp	farlab_setup.tmp

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

farlab_setup.tmpFarLabUninstaller.exeNDP472-KB4054531-Web.exeSetup.exefarlab_setup.exefarlab_setup.tmpfarlab_setup.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	farlab_setup.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FarLabUninstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NDP472-KB4054531-Web.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	farlab_setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	farlab_setup.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	farlab_setup.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Setup.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Setup.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

Processes:

farlab_setup.tmpSetup.exemsedge.exemsedge.exeidentity_helper.exe

pid	process
3868	farlab_setup.tmp
3868	farlab_setup.tmp
4616	Setup.exe
4616	Setup.exe
4616	Setup.exe
4616	Setup.exe
4616	Setup.exe
4616	Setup.exe
4616	Setup.exe
4616	Setup.exe
3776	msedge.exe
3776	msedge.exe
4804	msedge.exe
4804	msedge.exe
4456	identity_helper.exe
4456	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

4804 msedge.exe
4804 msedge.exe
4804 msedge.exe
4804 msedge.exe
4804 msedge.exe
4804 msedge.exe

Suspicious use of FindShellTrayWindow 28 IoCs

Processes:

farlab_setup.tmpFarLabUninstaller.exemsedge.exe

pid	process
3868	farlab_setup.tmp
4100	FarLabUninstaller.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

farlab_setup.exefarlab_setup.tmpfarlab_setup.exefarlab_setup.tmpNDP472-KB4054531-Web.exeFarLabUninstaller.exemsedge.exe

description	pid	process	target process
PID 1724 wrote to memory of 1004	1724	farlab_setup.exe	farlab_setup.tmp
PID 1724 wrote to memory of 1004	1724	farlab_setup.exe	farlab_setup.tmp
PID 1724 wrote to memory of 1004	1724	farlab_setup.exe	farlab_setup.tmp
PID 1004 wrote to memory of 3988	1004	farlab_setup.tmp	farlab_setup.exe
PID 1004 wrote to memory of 3988	1004	farlab_setup.tmp	farlab_setup.exe
PID 1004 wrote to memory of 3988	1004	farlab_setup.tmp	farlab_setup.exe
PID 3988 wrote to memory of 3868	3988	farlab_setup.exe	farlab_setup.tmp
PID 3988 wrote to memory of 3868	3988	farlab_setup.exe	farlab_setup.tmp
PID 3988 wrote to memory of 3868	3988	farlab_setup.exe	farlab_setup.tmp
PID 3868 wrote to memory of 4100	3868	farlab_setup.tmp	FarLabUninstaller.exe
PID 3868 wrote to memory of 4100	3868	farlab_setup.tmp	FarLabUninstaller.exe
PID 3868 wrote to memory of 4100	3868	farlab_setup.tmp	FarLabUninstaller.exe
PID 3868 wrote to memory of 2136	3868	farlab_setup.tmp	NDP472-KB4054531-Web.exe
PID 3868 wrote to memory of 2136	3868	farlab_setup.tmp	NDP472-KB4054531-Web.exe
PID 3868 wrote to memory of 2136	3868	farlab_setup.tmp	NDP472-KB4054531-Web.exe
PID 2136 wrote to memory of 4616	2136	NDP472-KB4054531-Web.exe	Setup.exe
PID 2136 wrote to memory of 4616	2136	NDP472-KB4054531-Web.exe	Setup.exe
PID 2136 wrote to memory of 4616	2136	NDP472-KB4054531-Web.exe	Setup.exe
PID 4100 wrote to memory of 4804	4100	FarLabUninstaller.exe	msedge.exe
PID 4100 wrote to memory of 4804	4100	FarLabUninstaller.exe	msedge.exe
PID 4804 wrote to memory of 2272	4804	msedge.exe	msedge.exe
PID 4804 wrote to memory of 2272	4804	msedge.exe	msedge.exe
PID 4804 wrote to memory of 3948	4804	msedge.exe	msedge.exe
PID 4804 wrote to memory of 3948	4804	msedge.exe	msedge.exe
PID 4804 wrote to memory of 3948	4804	msedge.exe	msedge.exe
PID 4804 wrote to memory of 3948	4804	msedge.exe	msedge.exe
PID 4804 wrote to memory of 3948	4804	msedge.exe	msedge.exe
PID 4804 wrote to memory of 3948	4804	msedge.exe	msedge.exe
PID 4804 wrote to memory of 3948	4804	msedge.exe	msedge.exe
PID 4804 wrote to memory of 3948	4804	msedge.exe	msedge.exe
PID 4804 wrote to memory of 3948	4804	msedge.exe	msedge.exe
PID 4804 wrote to memory of 3948	4804	msedge.exe	msedge.exe
PID 4804 wrote to memory of 3948	4804	msedge.exe	msedge.exe
PID 4804 wrote to memory of 3948	4804	msedge.exe	msedge.exe
PID 4804 wrote to memory of 3948	4804	msedge.exe	msedge.exe
PID 4804 wrote to memory of 3948	4804	msedge.exe	msedge.exe
PID 4804 wrote to memory of 3948	4804	msedge.exe	msedge.exe
PID 4804 wrote to memory of 3948	4804	msedge.exe	msedge.exe
PID 4804 wrote to memory of 3948	4804	msedge.exe	msedge.exe
PID 4804 wrote to memory of 3948	4804	msedge.exe	msedge.exe
PID 4804 wrote to memory of 3948	4804	msedge.exe	msedge.exe
PID 4804 wrote to memory of 3948	4804	msedge.exe	msedge.exe
PID 4804 wrote to memory of 3948	4804	msedge.exe	msedge.exe
PID 4804 wrote to memory of 3948	4804	msedge.exe	msedge.exe
PID 4804 wrote to memory of 3948	4804	msedge.exe	msedge.exe
PID 4804 wrote to memory of 3948	4804	msedge.exe	msedge.exe
PID 4804 wrote to memory of 3948	4804	msedge.exe	msedge.exe
PID 4804 wrote to memory of 3948	4804	msedge.exe	msedge.exe
PID 4804 wrote to memory of 3948	4804	msedge.exe	msedge.exe
PID 4804 wrote to memory of 3948	4804	msedge.exe	msedge.exe
PID 4804 wrote to memory of 3948	4804	msedge.exe	msedge.exe
PID 4804 wrote to memory of 3948	4804	msedge.exe	msedge.exe
PID 4804 wrote to memory of 3948	4804	msedge.exe	msedge.exe
PID 4804 wrote to memory of 3948	4804	msedge.exe	msedge.exe
PID 4804 wrote to memory of 3948	4804	msedge.exe	msedge.exe
PID 4804 wrote to memory of 3948	4804	msedge.exe	msedge.exe
PID 4804 wrote to memory of 3948	4804	msedge.exe	msedge.exe
PID 4804 wrote to memory of 3948	4804	msedge.exe	msedge.exe
PID 4804 wrote to memory of 3948	4804	msedge.exe	msedge.exe
PID 4804 wrote to memory of 3948	4804	msedge.exe	msedge.exe
PID 4804 wrote to memory of 3948	4804	msedge.exe	msedge.exe
PID 4804 wrote to memory of 3948	4804	msedge.exe	msedge.exe
PID 4804 wrote to memory of 3776	4804	msedge.exe	msedge.exe
PID 4804 wrote to memory of 3776	4804	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\farlab_setup.exe
"C:\Users\Admin\AppData\Local\Temp\farlab_setup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Users\Admin\AppData\Local\Temp\is-OO5CL.tmp\farlab_setup.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-OO5CL.tmp\farlab_setup.tmp" /SL5="$7006C,1570064,56832,C:\Users\Admin\AppData\Local\Temp\farlab_setup.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1004
- - C:\Users\Admin\AppData\Local\Temp\farlab_setup.exe
    "C:\Users\Admin\AppData\Local\Temp\farlab_setup.exe" /SILENT
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3988
  - - C:\Users\Admin\AppData\Local\Temp\is-94B0T.tmp\farlab_setup.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-94B0T.tmp\farlab_setup.tmp" /SL5="$701EE,1570064,56832,C:\Users\Admin\AppData\Local\Temp\farlab_setup.exe" /SILENT
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:3868
    - - C:\Program Files (x86)\FarLabUninstaller\FarLabUninstaller.exe
        
        "C:\Program Files (x86)\FarLabUninstaller\FarLabUninstaller.exe" ss1
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:4100
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://farlab.win/pay.php
        6⤵
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:4804
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffa278d46f8,0x7ffa278d4708,0x7ffa278d4718
        7⤵
        
        PID:2272
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,1573472949967493890,2506026937841113401,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2
        7⤵
        
        PID:3948
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,1573472949967493890,2506026937841113401,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3776
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2164,1573472949967493890,2506026937841113401,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2772 /prefetch:8
        7⤵
        
        PID:1756
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1573472949967493890,2506026937841113401,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
        7⤵
        
        PID:3992
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1573472949967493890,2506026937841113401,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
        7⤵
        
        PID:4460
        
        C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,1573472949967493890,2506026937841113401,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5108 /prefetch:8
        7⤵
        
        PID:3628
        
        C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,1573472949967493890,2506026937841113401,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5108 /prefetch:8
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4456
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1573472949967493890,2506026937841113401,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5160 /prefetch:1
        7⤵
        
        PID:3696
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1573472949967493890,2506026937841113401,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:1
        7⤵
        
        PID:4088
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1573472949967493890,2506026937841113401,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:1
        7⤵
        
        PID:2044
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,1573472949967493890,2506026937841113401,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:1
        7⤵
        
        PID:1316
    - - C:\Program Files (x86)\FarLabUninstaller\NDP472-KB4054531-Web.exe
        
        "C:\Program Files (x86)\FarLabUninstaller\NDP472-KB4054531-Web.exe" /q /norestart
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2136
      - C:\9005a0d50ef6d68969\Setup.exe
        
        C:\9005a0d50ef6d68969\\Setup.exe /q /norestart /x86 /x64 /web
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:4616

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4492

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\9005a0d50ef6d68969\1025\LocalizedData.xml

Filesize
80KB

MD5
bd97655af30131b0d8387bab5f20e68d

SHA1
cb42103aea4de739573dacf49ebb527b00dc3e55

SHA256
bfca8cdb158986f6a333ece89daa3081a6a81f89ea868a697113a19121c14f7e

SHA512
c365faed844bb2d750acea77b308df2a9a8b94e2270ce2b75d17b4356262d0d65a4489bc55705a45c4b1bc28bd0cc2b2c1e167a43d3c7321f3e758f128ea7651

Download Submit
C:\9005a0d50ef6d68969\1028\LocalizedData.xml

Filesize
69KB

MD5
5727d5160e0fb5d661eb4e6720430d1b

SHA1
b3b6ba3fda17ca68a20675ae06b3c56d576274b4

SHA256
0ad12bf18aa4fcc557ab9422ebef07ab0b8369395bcf695f0915ea99c689f99f

SHA512
7f0314a621137e4076f4ea22e82a6845912fae3b002ba4455952c683e6be89e5a3de4a7cd8f4df2a360247923ca472a53619a2d3635cdcfc1c66e03e7aac2a31

Download Submit
C:\9005a0d50ef6d68969\1029\LocalizedData.xml

Filesize
85KB

MD5
eae0498ea94f2a7e7982ee773d10d3a5

SHA1
f0bc4a900f0eefd362760b77b7cc1829ac0bb93e

SHA256
309dac84e7aef6b4cca2cd7b1eeef8a30bd910373724ca56e8764fa3b420aa79

SHA512
978b97cb7c8274ed73063c1f9a9bce4d9c0fd9c186de67d2ce3b03d33dd88487b6f480eea481fe9c3687c3008a5403b85a16ba57072ac03baee1ffe1c14fb6e7

Download Submit
C:\9005a0d50ef6d68969\1030\LocalizedData.xml

Filesize
83KB

MD5
c805fa6fd2e634ecd0083074194b3899

SHA1
079f0dc73703b987447cf3ddc1e4761047aeb605

SHA256
2b563a3837a23214d290f11b6acb6836ed065bc17c8965108b385ea3ac91922f

SHA512
ff5e3813a4769e6962c363dc64f251724df98be94b195c805cb8854717d3e633fa2c9ae160c55ee6e3872699e692a6ff8b58d2b8de36579f30edcf324c798e8f

Download Submit
C:\9005a0d50ef6d68969\1031\LocalizedData.xml

Filesize
88KB

MD5
4ce791c97f9a6abae6de28487cbdf24c

SHA1
cb85c4b052eae862a55d0b8bf8f2c57e3412c0a0

SHA256
8e878d95152714e1b77c1c7cb8538501c732e06615bb614d3cd71d0b147beaa4

SHA512
4333de904e66d1ff795d8905a21b8c06830635de4bc25ecd3eb94aef7923937b67d5ff464b2e92249a3c5d61bf19ebae7868c9f5435544bd5c3e80fa925e7e4e

Download Submit
C:\9005a0d50ef6d68969\1032\LocalizedData.xml

Filesize
90KB

MD5
b15beae6eebd44f084681316217c35fd

SHA1
ff93f038e65b85a68b4887f88eb792db1d6fc1ce

SHA256
c00d4950f2497d3de235b7d82a8bb737d17eb789551b2fbe8be822ac59d7db8b

SHA512
9af03bb58e5d6bf1a62c4fd1e86c4809b97b0f10929c6b7bdd5048afd29c8b21755ed73587dc4380dbd0a8302a9873bd0540553feff40a01fa8196a89c074b36

Download Submit
C:\9005a0d50ef6d68969\1033\LocalizedData.xml

Filesize
83KB

MD5
f68f5e6d0ab12908f1d6451ea4b16d61

SHA1
f51ef1ccb08cfdab32c0ceacf5369c353eb036d5

SHA256
65471fdc2a95dd77759ad629bc57db6f4caf039d43d4e756053c30a7d5ff03c9

SHA512
7a64114083903522d319237063d05b619fdc3d4ce9945dd3124773b9f6a57b848007b77f55bcba5f29001c9f4d02ee68f35440c37e8326e96559bae485c0b4c3

Download Submit
C:\9005a0d50ef6d68969\1035\LocalizedData.xml

Filesize
84KB

MD5
cdfc12ff066fef57a60e13a61e2fe9f7

SHA1
c412a703fbc4c436d6f40129dd793ff94188e0ab

SHA256
b9176ebcf72da0b18850a2d23eb90962c90e2c819b0aa2fb4d32b71ae387b82c

SHA512
0bea735854f1148ed044afae2f1da5dd0c8f5b9f3d758371b85656fd4bb98a77e6b495ec95797ec36b36f1029aa4f434c1a8ea1541ca738b8e634999b69ea9d0

Download Submit
C:\9005a0d50ef6d68969\1036\LocalizedData.xml

Filesize
87KB

MD5
8122a6977d478cd6c93ac26998f38f91

SHA1
9a49baefafd4918ea5a538366d4091d2a867e4d9

SHA256
15454de5eb80f0b2bbec3e9855d1841b1ae7c95d38f838ba525cdc8b0270c7c7

SHA512
4ee048f39fb80f4e52dc80384c4566ab65d1aae3d52078d76d6fa63b1761625ba02bf5238532aaebf23c8b46c19448bbbdd9d885d22afe3b92b094a0bd6ea4b7

Download Submit
C:\9005a0d50ef6d68969\1037\LocalizedData.xml

Filesize
78KB

MD5
52529d623cbe2229e179178037852000

SHA1
cdf681bcd3090d7ded20878a7e8759465f429c91

SHA256
2f0078da6c7d15c770d517030dc0d96d540a67a501cd54430637ffb77c23fb44

SHA512
6c4a05fb4e0f15ff297bd1371d0e33e020376b4f85b3bc4faedf92e9521deb2e47b55d1a4aacbc68b76ea6602a4f14d354a51098c8143cb2e5a6db77d97bab4e

Download Submit
C:\9005a0d50ef6d68969\1038\LocalizedData.xml

Filesize
86KB

MD5
17e14f770796e2b7458f1fdb9511da1a

SHA1
c72c4ae5455e9851b6e5f2aabf1f3d78920258d8

SHA256
f73b516104eb7651bb66889799d771c44b8c6bfda501237f3325b6f2133c0af7

SHA512
dac5d1536ddf76d485b1512c4e1fc7d13e21ebd79f112f1cb53bd6d59395cfee9b6cc5afcb26f3bea0c7b190bdc6b19c49fedaadae89e92cf904c22b52fdb4fc

Download Submit
C:\9005a0d50ef6d68969\1040\LocalizedData.xml

Filesize
85KB

MD5
2dd0b542600eddd67f44d35492e5d526

SHA1
8199817fd80d39d5536a6b21d7ee108c16792f81

SHA256
9fde0a246757fdcbd435abf67d10168b1875c9b1a85d51bb821cb7494e3f79d1

SHA512
d76a7fdecdd9ecd70601fec0765e97a1a42315edce8a483b7b22007e5b4de00ff84e09e1cb50a2127ce64b8de92ca38bb8f1acea707061d95c120c194a2cb187

Download Submit
C:\9005a0d50ef6d68969\1041\LocalizedData.xml

Filesize
75KB

MD5
05ae74494480b60daa65cbd7d33e8ff3

SHA1
a54c87632654368909c2e9801f10a76ac864ca28

SHA256
a69cc0439bf7e72a59ac4c2b0f6d80cc8822165421a824bb234924de3e5d69e1

SHA512
16292e5ff02087380ff0b64b3c129af689a050d9562aba0ea9d71e692505d50ffefefd08eaca36f370b86a0f01309ea577336a89d5d5f7f9ea573098bb2f228c

Download Submit
C:\9005a0d50ef6d68969\1042\LocalizedData.xml

Filesize
73KB

MD5
5659c33354875ffe975534d8b4c29675

SHA1
5cf25ba5da9d8c6fd6a6b7ba67bd02c663f48b21

SHA256
92d7923380007234dfed0329779621909bea28bc837c1975ac141ce872caae55

SHA512
38fafc1d3886d8cddff362d690c776280d6b586521c9f7991ff60d6403940820ae44d987f76ffea5f33899e12dcef07d6e12ec8b54245d5523f9a9f9f2adcb20

Download Submit
C:\9005a0d50ef6d68969\1043\LocalizedData.xml

Filesize
85KB

MD5
9841af88c8432f1c28c390205fa25cdf

SHA1
7eff1df19b35080442254f0962e8337038b53024

SHA256
794c11a6abe5a9348cedf44a5421ef20e9de00e7cd34dc80e9d5a80538e45666

SHA512
3ddbfa7f7a3165144ffe6a772bb78d0659db60d71ac4d250ac3ff2a416396123ff9377c928012b5e84e7571ccbe52e132d6f3ad22fa5185878923c48995270ee

Download Submit
C:\9005a0d50ef6d68969\1044\LocalizedData.xml

Filesize
84KB

MD5
be070a2a425774e4016376a7c5efc46e

SHA1
56ccfcca60b97ce227436f72bd56969d4b770557

SHA256
3a9354ac2acaf1671844a4d1c8f0e7c5c86ef183cb30dda4eef5bac02de6b2a7

SHA512
4c0045629f9a9a7d8a84b79303550a26fa8cad308b78656acfe579fc1c1f6dd5fd6d10c23fb87142406117357a1cb2ffe6364025233b70bf776ef0b696f31616

Download Submit
C:\9005a0d50ef6d68969\1045\LocalizedData.xml

Filesize
87KB

MD5
603d2406053837c960df9a66e3af052d

SHA1
7afb11ea418cba19fa1b25d112c7acd110bfc638

SHA256
e2383afcb0c44bab237003b4a8c3dac2bdccada9f42c82ea2004aa04db901edd

SHA512
97d598473cbd9c3b66bbfc8c1f4ba47701bc66a9581262a75f6b4af5d469ff19b134ebd3d6108af3df1f9bee82f8f5f0ba864abb769dbb23677bc427a1247ea3

Download Submit
C:\9005a0d50ef6d68969\1046\LocalizedData.xml

Filesize
84KB

MD5
af1f0f47f381c11a9c4296fcdca0ebbd

SHA1
838f581e6aa7596381d25784d8ca30a48c47eb9e

SHA256
00601e4ff88a8d6f0dcbf65fbbf14142cd86fdc7cb8f251893f70b597ef3a7eb

SHA512
8d326bdb639a797dc5e253936f7b39981f5bdeb112fd46a5d0596d6476ad17e790b43b1b2dce91bf33f27940cc32afa57e535c3f38e93cd30f27d4843a49d9eb

Download Submit
C:\9005a0d50ef6d68969\1049\LocalizedData.xml

Filesize
86KB

MD5
d6f7e810eeaec18464d0ebf0e0589eb6

SHA1
962a25926f8196448821c4b21d5619d42cf3ae6d

SHA256
c43af2be229fa08f1d7f161ff9dd4dfd25a459a05ec8462c3b683ab7bd0cc4f8

SHA512
b78f9f98a9993478c2107eb738f1949d031f12ffbc78e7a4cfa67ff7dbefe5e456712eb6e23eebaaadb6a5645ff25600432e1c5e32f1e4493d090d9b8674bed3

Download Submit
C:\9005a0d50ef6d68969\1053\LocalizedData.xml

Filesize
83KB

MD5
653ff0be9c7132b411bb95d7d6b90d78

SHA1
fd57ee34dd102fe6b8b709bf46829f7b1c0a7c42

SHA256
3c4c96b9ed7f536cbcc698760b7142db8411d6ba4ad784a29727bac2e7df7d9a

SHA512
77ed725595a50492d80ac2c593b25f30ec61a579348acef87e2f25484f2975abfeff946c04de6482be186864c3c9d42a673a3d4b679f19cbe34851d1c1496064

Download Submit
C:\9005a0d50ef6d68969\1055\LocalizedData.xml

Filesize
83KB

MD5
bd0f034d3eff8d3a60f9acccadcfbf56

SHA1
c622870702e94cdf76979093440c22f9127e4b50

SHA256
d1896ac9b20686a00c7d0bf0f8dc8279b9a52f88025b8cc3b161100d224df7c9

SHA512
3d6e93c1498381a5e8bb34969cec3596a5006abc5f1ad1b3bfb3298e763b64f45538be05693c1c70787135ec3af2e813bed45dfd174dcbc0db3b711550737d65

Download Submit
C:\9005a0d50ef6d68969\2052\LocalizedData.xml

Filesize
69KB

MD5
7497b47f7db96dff8e7c1198b7964006

SHA1
fc05395f849d386261b8bb7511893bbe6a4c5467

SHA256
f0b7e9242c27ea1652e9ea6d46b8617e189e31bf093e7e21e38e60d94cea16eb

SHA512
b24f97e32de52ac4cee276c0d4b4089cdcea90ac309f135c3b2273de15badffbed02044aa8f429e52376159e1def2c43c87405fa2a206b4ac55d74040e20951a

Download Submit
C:\9005a0d50ef6d68969\2070\LocalizedData.xml

Filesize
86KB

MD5
382abfa1307279a35a6a70f7de7046e3

SHA1
fabfd301d954d04a1565d23c2f093b1c0ce574c1

SHA256
32a0606e178f5f77b7e13573a910b4fcb7587e9ff4823d3a95cc28dd73074ade

SHA512
b5ada4a1abe2689173f169b5d16b05da34158e55e9ae0b0b77f2de9e47469bbae77c958bbe62d756a8fbd610b995d9be8bd6606d1230371f0c7f2ea89f291046

Download Submit
C:\9005a0d50ef6d68969\3082\LocalizedData.xml

Filesize
85KB

MD5
2bce3f6dd7abbe483ec92a688ef3b76e

SHA1
6a8adc8e3c481aa6e404239cd0ea419c0e98c262

SHA256
df8531355aa11a9a585b63a6fcc96c0c6c480e06a602d88a949bcac1ff7795bd

SHA512
0d03643ed072e5961f5ef5d1ebbd2cb0e730ea5e40c46892e7a83d11f47290f031564d3283fa24c587bf46df8f4e39abe92f38e6a42acded315b16c96d7e7e8d

Download Submit
C:\9005a0d50ef6d68969\DHTMLHeader.html

Filesize
15KB

MD5
cd131d41791a543cc6f6ed1ea5bd257c

SHA1
f42a2708a0b42a13530d26515274d1fcdbfe8490

SHA256
e139af8858fe90127095ac1c4685bcd849437ef0df7c416033554703f5d864bb

SHA512
a6ee9af8f8c2c7acd58dd3c42b8d70c55202b382ffc5a93772af7bf7d7740c1162bb6d38a4307b1802294a18eb52032d410e128072af7d4f9d54f415be020c9a

Download Submit
C:\9005a0d50ef6d68969\ParameterInfo.xml

Filesize
2.6MB

MD5
3ac6a8f0fe4aa7fb0ffe21b548abacbb

SHA1
5e30d7d1057a9e8a8732ad67d672ca7a608657ef

SHA256
68d6fcfd5f2986206763e1b49b86997c94a51260e4f9c02b8037aa5cf3c03142

SHA512
e5bff3554f4dd149e7b1bc3f5eae5d234a7e22e69f3e0d210a67511cf85bb9ce4c3a787a91af89b9d5f2ec91be62719312921716baf29d1f81571b8b2a6e6834

Download Submit
C:\9005a0d50ef6d68969\Setup.exe

Filesize
86KB

MD5
40d87630ef1364a3dc4fd3387212c77d

SHA1
2ab844ca20815c51960ac5d1d75e93897c9f2df2

SHA256
a9d2cc918999858aa1e500a8fbc919b6397da6b44b666e3fc0edd38920748212

SHA512
d81f1e80186f3c9c78a45c235f30da9e6f5cd3ca1f6b153892a1c53decc350b7a5f4f9924f59ab83dc20c31acad783faeebbcb67c9419f74628da6459530c9d3

Download Submit
C:\9005a0d50ef6d68969\SetupEngine.dll

Filesize
868KB

MD5
4c0b492d3e96d742ba8922912976b3f8

SHA1
ee571ea60f3bb2feea2f7a5ff0d02cc7d7524b6e

SHA256
c40f60ab16752e404cae3943f169d8260ad83f380e0c2bd363ad165982608f3e

SHA512
99e44ffa8b50fbfa378310198582404a4f90b2450677b1f152baa55c6e213fbb5fbd31d0207a45876a57837e2a5d642bd613843e77f9f70b0d842d8bcdf0cfad

Download Submit
C:\9005a0d50ef6d68969\UiInfo.xml

Filesize
63KB

MD5
c99059acb88a8b651d7ab25e4047a52d

SHA1
45114125699fa472d54bc4c45c881667c117e5d4

SHA256
b879f9bc5b79349fa7b0bdbe63167be399c5278454c96773885bd70fbfe7c81d

SHA512
b23a7051f94d72d5a1a0914107e5c2be46c0ddee7ca510167065b55e2d1cb25f81927467370700b1cc7449348d152e9562566de501f3ea5673a2072248572e3b

Download Submit
C:\9005a0d50ef6d68969\sqmapi.dll

Filesize
221KB

MD5
6404765deb80c2d8986f60dce505915b

SHA1
e40e18837c7d3e5f379c4faef19733d81367e98f

SHA256
b236253e9ecb1e377643ae5f91c0a429b91c9b30cca1751a7bc4403ea6d94120

SHA512
a5ff302f38020b31525111206d2f5db2d6a9828c70ef0b485f660f122a30ce7028b5a160dd5f5fbcccb5b59698c8df7f2e15fdf19619c82f4dec8d901b7548ba

Download Submit
C:\Program Files (x86)\FarLabUninstaller\FarLabUninstaller.exe

Filesize
295KB

MD5
2e376eb0b1d34d82196ca36e2af62c9a

SHA1
9900e6e87d35d98a46ef1e562af7fd0a3cc483fa

SHA256
7d68d482cbfcabb5aae94131903209271032693317c684d00df5731c8c8f123e

SHA512
a6a4704880cb8df80defd913f070c6e7086e7f8f765dc7c7346dc273eb4b412999462b7c40863bafd9337a5e91199b4a11bc89df97596cda6d2c1d3dea6a3b8b

Download Submit
C:\Program Files (x86)\FarLabUninstaller\NDP472-KB4054531-Web.exe

Filesize
1.4MB

MD5
c84209349f18afe5a41ce04e9ae8f487

SHA1
cedbbf404b166a5e72d035760bcb0fa508e4f4cb

SHA256
4e49c56e4cf9df2e837a8a3010f5a8b4deb096429d56e7fd9ff70ab394663678

SHA512
37006954e3afe07fb02d24894cc34794618b78c27a1b514818985b6cc1fa3e896ed99ba2e4aac3f6469d263819bd94ee70e7113946c51ba83c93b74826fc8fa8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e443ee4336fcf13c698b8ab5f3c173d0

SHA1
9bf70b16f03820cbe3158e1f1396b07b8ac9d75a

SHA256
79e277da2074f9467e0518f0f26ca2ba74914bee82553f935a0ccf64a0119e8b

SHA512
cbf6f6aa0ea69b47f51592296da2b7be1180e7b483c61b4d17ba9ee1a2d3345cbe0987b96f4e25de1438b553db358f330aad8a26e8522601f055c3d5a8313cdd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56a4f78e21616a6e19da57228569489b

SHA1
21bfabbfc294d5f2aa1da825c5590d760483bc76

SHA256
d036661e765ee8fd18978a2b5501e8df6b220e4bca531d9860407555294c96fb

SHA512
c2c3cd1152bb486028fe75ab3ce0d0bc9d64c4ca7eb8860ddd934b2f6e0140d2c913af4fa082b88e92a6a6d20fd483a1cb9813209f371a0f56374bc97d7f863b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
468B

MD5
e6d75dfe9fadfcdf8ac666a50e6c5c05

SHA1
6807b1f1fbe4ce984f323da227ff54842e60428d

SHA256
ba84e40c5401dac15f65ee4c205d33447bced94e5371c40ec613c92ad2c33487

SHA512
4b6caa48ec855c1e29f26bc0f33a53a9a9c1c1c99d936627a066f5865ffa258f306f46d8badfa0271d69f02e6e09dc43f024958e64fe8070fc627b66598b1980

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
665669f69a21b573026de341f1481d65

SHA1
5dfb87d32a3d04668de09e80d71243a5492fcd18

SHA256
d8dc23066bb5494f8b4b3c1e73506e015219736f43bd569fb5f06cad5c144b80

SHA512
61a7334950161a8dbc8ac1c8421dae21ee7cf889a59de84df50447256d5d2ace69eef530520cf063186f5168204d19471b7d4cd5aa4504ff1f9f91f698a25726

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9cb693ad72710e1f3dbe6402007e2aff

SHA1
631007dc10882c04b3991e0cdbd00c29a15d0540

SHA256
396a27383e161d5802a4f625149d5c47549b7d616aefabc5d785aa407e6ba147

SHA512
5813e5768be537fc8e472fbba96b4f70a05ce51269dacc761c25e7fe0c3e9a5f8d2c6b301215b02ddeeaf278513064d8467d43636ebc891c421063a918835573

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
fc44ebecd7e78f0db012aa45a2331017

SHA1
998ba4ef6f78b35a18f451d16ac21bb4f2f99f14

SHA256
46a689089addc3c9fb7f6638f05039e9387ed531bb02c222988944152ada0d38

SHA512
eb980de019b39bf6f7becaef660d0fc3d195f20e8a51e1701e6422c21a6ef7e4743ca2e39a94e7464f18ebb208270d1ae5563a9588fcc580cff5dbb4ca6cbde1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
471a776f10ae823f1784586d40c5ff59

SHA1
2c88b990e6568cca056115905d801d6d8096e7fc

SHA256
2b8873b0e06dd45ec3f6d28d219a349211f4928bb2c6b0943f512bb4fa8e1aea

SHA512
4e64d90d016bfea13d6c63b681106368b8d8ec2ebabbf30f6decf7b74c13135e2956269fa267a615a507cbba5a5b27a175b7190818befe7f860c2084f5ab1f96

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
9ee7508922e70c1cc2be2f0f6bd65510

SHA1
044fccc987a006b83bf3439514f2ea2971c0a817

SHA256
0db431819be2e05d7d91cd8d5d27c9b7dd2ee1b5c8b362db39a6f21973ca480b

SHA512
d37e1e50bc51cb586bc1752b0aab5b749ef2bc3c9d45a2fb23996bc345d41bae377a4d98a336fff3428760ace8a78e810f58feb3eb80bacb096c2a649852398f

Download Submit
C:\Users\Admin\AppData\Local\Temp\HFI4189.tmp.html

Filesize
17KB

MD5
98f82c25e390521fbdac13f348eee2ce

SHA1
27973e4b1d640473f2484e84e9bb7782d1e7a7f3

SHA256
b4dc7a52d459568e7507f71fde2be01a19b9fa38a1e61e4038e9f9971874859e

SHA512
9f5d869261eb2b76c0e10dd6bd4e249dad8943c855ccdba59904761d3e54fe696dad64e395f8cfdade7a0e10b926ed477764a9b9aeeec20065be862ea8aaa403

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-2DRF9.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-2VLV9.tmp\idp.dll

Filesize
216KB

MD5
b37377d34c8262a90ff95a9a92b65ed8

SHA1
faeef415bd0bc2a08cf9fe1e987007bf28e7218d

SHA256
e5a0ad2e37dde043a0dd4ad7634961ff3f0d70e87d2db49761eb4c1f468bb02f

SHA512
69d8da5b45d9b4b996d32328d3402fa37a3d710564d47c474bf9e15c1e45bc15b2858dbab446e6baec0c099d99007ff1099e9c4e66cfd1597f28c420bb50fdcc

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-OO5CL.tmp\farlab_setup.tmp

Filesize
691KB

MD5
9303156631ee2436db23827e27337be4

SHA1
018e0d5b6ccf7000e36af30cebeb8adc5667e5fa

SHA256
bae22f27c12bce1faeb64b6eb733302aff5867baa8eed832397a7ce284a86ff4

SHA512
9fe100fafb1c74728109667b5a2261a31e49c45723de748adaa1d9cb9f8daa389b871056c70066fa3a05be82a5017c8dd590ae149a56d824a9e250d31091a40f

Download Submit
\??\pipe\LOCAL\crashpad_4804_NWNRZSDLFLWVWNBZ

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1004-24-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/1004-7-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/1724-26-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1724-2-0x0000000000401000-0x000000000040B000-memory.dmp

Filesize
40KB

Download
memory/1724-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3868-68-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/3868-32-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/3868-42-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/3868-46-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/3988-70-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3988-20-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3988-22-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3988-40-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4100-71-0x00000000007F0000-0x000000000083C000-memory.dmp

Filesize
304KB

Download
memory/4100-294-0x0000000008610000-0x000000000861E000-memory.dmp

Filesize
56KB

Download
memory/4100-293-0x0000000008630000-0x0000000008668000-memory.dmp

Filesize
224KB

Download
memory/4100-292-0x00000000085B0000-0x00000000085B8000-memory.dmp

Filesize
32KB

Download