hxxps://drive[.]google[.]com/file/d/10vd8CZaUBpv1fCwDLKWFbjmQ9UQ2_oqR/view

Analysis

max time kernel
140s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
27-12-2024 19:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/10vd8CZaUBpv1fCwDLKWFbjmQ9UQ2_oqR/view

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
6100	Install_Xfer_Serum_121b4.exe
892	Install_Xfer_Serum_Update_121b4.exe

Loads dropped DLL 8 IoCs

pid	Process
6100	Install_Xfer_Serum_121b4.exe
6100	Install_Xfer_Serum_121b4.exe
6100	Install_Xfer_Serum_121b4.exe
6100	Install_Xfer_Serum_121b4.exe
892	Install_Xfer_Serum_Update_121b4.exe
892	Install_Xfer_Serum_Update_121b4.exe
892	Install_Xfer_Serum_Update_121b4.exe
892	Install_Xfer_Serum_Update_121b4.exe

Drops desktop.ini file(s) 8 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\desktop.ini	Install_Xfer_Serum_Update_121b4.exe
File created	C:\Program Files (x86)\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\desktop.ini	Install_Xfer_Serum_121b4.exe
File opened for modification	C:\Program Files (x86)\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\desktop.ini	Install_Xfer_Serum_121b4.exe
File created	C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\desktop.ini	Install_Xfer_Serum_121b4.exe
File opened for modification	C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\desktop.ini	Install_Xfer_Serum_121b4.exe
File created	C:\Program Files (x86)\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\desktop.ini	Install_Xfer_Serum_Update_121b4.exe
File opened for modification	C:\Program Files (x86)\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\desktop.ini	Install_Xfer_Serum_Update_121b4.exe
File created	C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\desktop.ini	Install_Xfer_Serum_Update_121b4.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
5	drive.google.com
8	drive.google.com

Drops file in Program Files directory 52 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\PlugIn.ico	Install_Xfer_Serum_121b4.exe
File created	C:\Program Files (x86)\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\desktop.ini	Install_Xfer_Serum_121b4.exe
File opened for modification	C:\Program Files (x86)\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\Contents\Resources	Install_Xfer_Serum_121b4.exe
File created	C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\desktop.ini	Install_Xfer_Serum_121b4.exe
File opened for modification	C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\Contents\Win32	Install_Xfer_Serum_121b4.exe
File opened for modification	C:\Program Files (x86)\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\Contents\Win32\Serum.aaxplugin	Install_Xfer_Serum_Update_121b4.exe
File opened for modification	C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\Contents\Win32\Serum.aaxplugin	Install_Xfer_Serum_Update_121b4.exe
File opened for modification	C:\Program Files (x86)\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\Contents\Win32\Serum.aaxplugin	Install_Xfer_Serum_121b4.exe
File created	C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\PlugIn.ico	Install_Xfer_Serum_121b4.exe
File opened for modification	C:\Program Files (x86)\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin	Install_Xfer_Serum_Update_121b4.exe
File opened for modification	C:\Program Files (x86)\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\Contents\x64	Install_Xfer_Serum_Update_121b4.exe
File created	C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\desktop.ini	Install_Xfer_Serum_Update_121b4.exe
File opened for modification	C:\Program Files (x86)\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\PlugIn.ico	Install_Xfer_Serum_Update_121b4.exe
File opened for modification	C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin	Install_Xfer_Serum_Update_121b4.exe
File opened for modification	C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\desktop.ini	Install_Xfer_Serum_Update_121b4.exe
File opened for modification	C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\Contents\Resources	Install_Xfer_Serum_Update_121b4.exe
File opened for modification	C:\Program Files (x86)\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\Contents	Install_Xfer_Serum_121b4.exe
File opened for modification	C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\Contents\x64\Serum.aaxplugin	Install_Xfer_Serum_121b4.exe
File opened for modification	C:\Program Files (x86)\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\Contents\Win32	Install_Xfer_Serum_Update_121b4.exe
File opened for modification	C:\Program Files (x86)\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\Contents\x64\Serum.aaxplugin	Install_Xfer_Serum_Update_121b4.exe
File opened for modification	C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\PlugIn.ico	Install_Xfer_Serum_Update_121b4.exe
File opened for modification	C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\Contents\x64\Serum.aaxplugin	Install_Xfer_Serum_Update_121b4.exe
File created	C:\Program Files (x86)\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\Contents\Win32\Serum.aaxplugin	Install_Xfer_Serum_121b4.exe
File opened for modification	C:\Program Files (x86)\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\desktop.ini	Install_Xfer_Serum_Update_121b4.exe
File created	C:\Program Files (x86)\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\Contents\x64\Serum.aaxplugin	Install_Xfer_Serum_Update_121b4.exe
File opened for modification	C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\Contents\Win32	Install_Xfer_Serum_Update_121b4.exe
File opened for modification	C:\Program Files (x86)\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin	Install_Xfer_Serum_121b4.exe
File opened for modification	C:\Program Files (x86)\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\Contents\Win32	Install_Xfer_Serum_121b4.exe
File opened for modification	C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin	Install_Xfer_Serum_121b4.exe
File opened for modification	C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\Contents	Install_Xfer_Serum_121b4.exe
File created	C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\Contents\x64\Serum.aaxplugin	Install_Xfer_Serum_121b4.exe
File created	C:\Program Files (x86)\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\desktop.ini	Install_Xfer_Serum_Update_121b4.exe
File opened for modification	C:\Program Files (x86)\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\Contents	Install_Xfer_Serum_Update_121b4.exe
File created	C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\Contents\x64\Serum.aaxplugin	Install_Xfer_Serum_Update_121b4.exe
File created	C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\PlugIn.ico	Install_Xfer_Serum_Update_121b4.exe
File opened for modification	C:\Program Files (x86)\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\desktop.ini	Install_Xfer_Serum_121b4.exe
File opened for modification	C:\Program Files (x86)\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\Contents\x64\Serum.aaxplugin	Install_Xfer_Serum_121b4.exe
File opened for modification	C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\PlugIn.ico	Install_Xfer_Serum_121b4.exe
File opened for modification	C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\Contents\Resources	Install_Xfer_Serum_121b4.exe
File opened for modification	C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\Contents\x64	Install_Xfer_Serum_121b4.exe
File created	C:\Program Files (x86)\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\PlugIn.ico	Install_Xfer_Serum_Update_121b4.exe
File created	C:\Program Files (x86)\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\Contents\Win32\Serum.aaxplugin	Install_Xfer_Serum_Update_121b4.exe
File opened for modification	C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\Contents	Install_Xfer_Serum_Update_121b4.exe
File created	C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\Contents\Win32\Serum.aaxplugin	Install_Xfer_Serum_Update_121b4.exe
File opened for modification	C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\Contents\x64	Install_Xfer_Serum_Update_121b4.exe
File opened for modification	C:\Program Files (x86)\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\PlugIn.ico	Install_Xfer_Serum_121b4.exe
File opened for modification	C:\Program Files (x86)\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\Contents\x64	Install_Xfer_Serum_121b4.exe
File created	C:\Program Files (x86)\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\Contents\x64\Serum.aaxplugin	Install_Xfer_Serum_121b4.exe
File opened for modification	C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\desktop.ini	Install_Xfer_Serum_121b4.exe
File created	C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\Contents\Win32\Serum.aaxplugin	Install_Xfer_Serum_121b4.exe
File opened for modification	C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\Contents\Win32\Serum.aaxplugin	Install_Xfer_Serum_121b4.exe
File opened for modification	C:\Program Files (x86)\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\Contents\Resources	Install_Xfer_Serum_Update_121b4.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Install_Xfer_Serum_Update_121b4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Install_Xfer_Serum_121b4.exe

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral1/files/0x0008000000023d45-2469.dat	nsis_installer_1
behavioral1/files/0x0008000000023d45-2469.dat	nsis_installer_2

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Install_Xfer_Serum_121b4.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	Install_Xfer_Serum_121b4.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
364	msedge.exe
364	msedge.exe
2764	msedge.exe
2764	msedge.exe
2080	identity_helper.exe
2080	identity_helper.exe
5756	msedge.exe
5756	msedge.exe
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe
5484	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
6100	Install_Xfer_Serum_121b4.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	5988	7zG.exe
Token: 35	5988	7zG.exe
Token: SeSecurityPrivilege	5988	7zG.exe
Token: SeSecurityPrivilege	5988	7zG.exe

Suspicious use of FindShellTrayWindow 63 IoCs

pid	Process
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
5988	7zG.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2764 wrote to memory of 3088	2764	msedge.exe	83
PID 2764 wrote to memory of 3088	2764	msedge.exe	83
PID 2764 wrote to memory of 2376	2764	msedge.exe	84
PID 2764 wrote to memory of 2376	2764	msedge.exe	84
PID 2764 wrote to memory of 2376	2764	msedge.exe	84
PID 2764 wrote to memory of 2376	2764	msedge.exe	84
PID 2764 wrote to memory of 2376	2764	msedge.exe	84
PID 2764 wrote to memory of 2376	2764	msedge.exe	84
PID 2764 wrote to memory of 2376	2764	msedge.exe	84
PID 2764 wrote to memory of 2376	2764	msedge.exe	84
PID 2764 wrote to memory of 2376	2764	msedge.exe	84
PID 2764 wrote to memory of 2376	2764	msedge.exe	84
PID 2764 wrote to memory of 2376	2764	msedge.exe	84
PID 2764 wrote to memory of 2376	2764	msedge.exe	84
PID 2764 wrote to memory of 2376	2764	msedge.exe	84
PID 2764 wrote to memory of 2376	2764	msedge.exe	84
PID 2764 wrote to memory of 2376	2764	msedge.exe	84
PID 2764 wrote to memory of 2376	2764	msedge.exe	84
PID 2764 wrote to memory of 2376	2764	msedge.exe	84
PID 2764 wrote to memory of 2376	2764	msedge.exe	84
PID 2764 wrote to memory of 2376	2764	msedge.exe	84
PID 2764 wrote to memory of 2376	2764	msedge.exe	84
PID 2764 wrote to memory of 2376	2764	msedge.exe	84
PID 2764 wrote to memory of 2376	2764	msedge.exe	84
PID 2764 wrote to memory of 2376	2764	msedge.exe	84
PID 2764 wrote to memory of 2376	2764	msedge.exe	84
PID 2764 wrote to memory of 2376	2764	msedge.exe	84
PID 2764 wrote to memory of 2376	2764	msedge.exe	84
PID 2764 wrote to memory of 2376	2764	msedge.exe	84
PID 2764 wrote to memory of 2376	2764	msedge.exe	84
PID 2764 wrote to memory of 2376	2764	msedge.exe	84
PID 2764 wrote to memory of 2376	2764	msedge.exe	84
PID 2764 wrote to memory of 2376	2764	msedge.exe	84
PID 2764 wrote to memory of 2376	2764	msedge.exe	84
PID 2764 wrote to memory of 2376	2764	msedge.exe	84
PID 2764 wrote to memory of 2376	2764	msedge.exe	84
PID 2764 wrote to memory of 2376	2764	msedge.exe	84
PID 2764 wrote to memory of 2376	2764	msedge.exe	84
PID 2764 wrote to memory of 2376	2764	msedge.exe	84
PID 2764 wrote to memory of 2376	2764	msedge.exe	84
PID 2764 wrote to memory of 2376	2764	msedge.exe	84
PID 2764 wrote to memory of 2376	2764	msedge.exe	84
PID 2764 wrote to memory of 364	2764	msedge.exe	85
PID 2764 wrote to memory of 364	2764	msedge.exe	85
PID 2764 wrote to memory of 2148	2764	msedge.exe	86
PID 2764 wrote to memory of 2148	2764	msedge.exe	86
PID 2764 wrote to memory of 2148	2764	msedge.exe	86
PID 2764 wrote to memory of 2148	2764	msedge.exe	86
PID 2764 wrote to memory of 2148	2764	msedge.exe	86
PID 2764 wrote to memory of 2148	2764	msedge.exe	86
PID 2764 wrote to memory of 2148	2764	msedge.exe	86
PID 2764 wrote to memory of 2148	2764	msedge.exe	86
PID 2764 wrote to memory of 2148	2764	msedge.exe	86
PID 2764 wrote to memory of 2148	2764	msedge.exe	86
PID 2764 wrote to memory of 2148	2764	msedge.exe	86
PID 2764 wrote to memory of 2148	2764	msedge.exe	86
PID 2764 wrote to memory of 2148	2764	msedge.exe	86
PID 2764 wrote to memory of 2148	2764	msedge.exe	86
PID 2764 wrote to memory of 2148	2764	msedge.exe	86
PID 2764 wrote to memory of 2148	2764	msedge.exe	86
PID 2764 wrote to memory of 2148	2764	msedge.exe	86
PID 2764 wrote to memory of 2148	2764	msedge.exe	86
PID 2764 wrote to memory of 2148	2764	msedge.exe	86
PID 2764 wrote to memory of 2148	2764	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://drive.google.com/file/d/10vd8CZaUBpv1fCwDLKWFbjmQ9UQ2_oqR/view
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe25bf46f8,0x7ffe25bf4708,0x7ffe25bf4718
  2⤵
  PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,17537901670087361813,17470595363188995464,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
  2⤵
  PID:2376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,17537901670087361813,17470595363188995464,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,17537901670087361813,17470595363188995464,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2680 /prefetch:8
  2⤵
  PID:2148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,17537901670087361813,17470595363188995464,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,17537901670087361813,17470595363188995464,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:1728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,17537901670087361813,17470595363188995464,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4776 /prefetch:1
  2⤵
  PID:912
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,17537901670087361813,17470595363188995464,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5504 /prefetch:8
  2⤵
  PID:496
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,17537901670087361813,17470595363188995464,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5504 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,17537901670087361813,17470595363188995464,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5648 /prefetch:1
  2⤵
  PID:2688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,17537901670087361813,17470595363188995464,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:1
  2⤵
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,17537901670087361813,17470595363188995464,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4868 /prefetch:1
  2⤵
  PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,17537901670087361813,17470595363188995464,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5156 /prefetch:1
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,17537901670087361813,17470595363188995464,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5752 /prefetch:1
  2⤵
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2156,17537901670087361813,17470595363188995464,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6000 /prefetch:8
  2⤵
  PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,17537901670087361813,17470595363188995464,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:1
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,17537901670087361813,17470595363188995464,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4920 /prefetch:1
  2⤵
  PID:5504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2156,17537901670087361813,17470595363188995464,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4608 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,17537901670087361813,17470595363188995464,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4860 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5484

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1404

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3236

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5432

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap1059:82:7zEvent3438
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5988

C:\Users\Admin\Downloads\Serum Full\Install_Xfer_Serum_121b4.exe
"C:\Users\Admin\Downloads\Serum Full\Install_Xfer_Serum_121b4.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:6100

C:\Users\Admin\Downloads\Serum Full\Install_Xfer_Serum_Update_121b4.exe
"C:\Users\Admin\Downloads\Serum Full\Install_Xfer_Serum_Update_121b4.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\Contents\Win32\Serum.aaxplugin

Filesize
3.9MB

MD5
9e37cacd94563b54fc2bdc82697c992c

SHA1
cb9b707d74b296b400a86eb2c6f926284e1b4f5b

SHA256
e639d483c8cedb7fd81639e37c4dcadc425cbb482de4c7ff9e085067e6372ec3

SHA512
1fbd0f86cc8121212c7ff683d362b3ef6dfa2f4386c4f28077b6d193280d556bd9d0bca3428119014c70e5c3e0f74e9e895d133881ad7824ad2f183b537b3ea6

Download Submit
C:\Program Files (x86)\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\Contents\x64\Serum.aaxplugin

Filesize
4.5MB

MD5
79ba13bb4e6da966511e2ecb3c6f73f4

SHA1
3f7d20d64b91df916c4b2a615a1f4ac82bc3bb94

SHA256
b4e2d5c2accf2ec7586933ae36426c4f4c4c1a8f25be8c3a3a67a513d38c0a31

SHA512
e0c8d8bd1018d113040db417b42da6ef6a235b26d6af7843dbda714de42789130045f3c7cbf8070903ca84a617e1c1d03374c1d671fac4b21a87b378e8f5593c

Download Submit
C:\Program Files (x86)\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\PlugIn.ico

Filesize
354KB

MD5
5592ec57ec7fd6c30d5d57af0461965c

SHA1
d9fb4aa7b76f4dad1cbed20e3c94724949e50608

SHA256
a7849a94cd1a1d4a9a59e8e1351449c726fc73a8ea1ee3aed3d9d5c200131807

SHA512
524d183bc4c6b7d93a5005de7707be59680a82ddf97d4a9fdc2601dc43b341666df348bef7ab1bfdf8d5b8faaa1cee5b1b536c453cea5d88500b61841ea47b0a

Download Submit
C:\Program Files (x86)\Common Files\Avid\Audio\Plug-Ins\Serum.aaxplugin\desktop.ini

Filesize
126B

MD5
798095cd31340606c8e81d0a5107d57e

SHA1
39d058c4d45ef84b188f7ece620106124eb3d74e

SHA256
5526ef6345adee7c693e58354dd72b095df152be62ff7298b4c6f6d0f91e2f83

SHA512
9ca995c89d3f23cd2a977fb2826da1f75dc4caa4fe965f9aac3a6d486f6558429a44eaeea35217f85d94ba6d7c2c54ab520c9a1786133b2edd103e36159e53a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0a9dc42e4013fc47438e96d24beb8eff

SHA1
806ab26d7eae031a58484188a7eb1adab06457fc

SHA256
58d66151799526b3fa372552cd99b385415d9e9a119302b99aadc34dd51dd151

SHA512
868d6b421ae2501a519595d0c34ddef25b2a98b082c5203da8349035f1f6764ddf183197f1054e7e86a752c71eccbc0649e515b63c55bc18cf5f0592397e258f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
61cef8e38cd95bf003f5fdd1dc37dae1

SHA1
11f2f79ecb349344c143eea9a0fed41891a3467f

SHA256
ae671613623b4477fbd5daf1fd2d148ae2a09ddcc3804b2b6d4ffcb60b317e3e

SHA512
6fb9b333fe0e8fde19fdd0bd01a1990a4e60a87c0a02bc8297da1206e42f8690d06b030308e58c862e9e77714a585eed7cc1627590d99a10aeb77fc0dd3d864d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
480B

MD5
e0df7adb4a3d5d6dc8c06c37de667396

SHA1
1726732816ae4ad4b6b0eefe644bfd553cb49d06

SHA256
adecf186b0c26bf378b503dcef527856209e8d9b8b03d2571b61d0aa5f24b834

SHA512
81d3cae7eb8076ba106a6207f83b07060c4aac8ce06127139c70018f6744e09d4343287148db36763cdb18a9bbcee8c77bfa8e79b2e8b07f5bb7b630d7efacd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
02ceb757be3994feb73bfbe652079e23

SHA1
9e32886ff0567b987670bdb059dfcc652f133a3a

SHA256
cb075e5db0d0b0f7387994111e523e8915b94fff245f63b41b3f0e1a95abb4de

SHA512
3854470d04df454e9cab30330a0dbafce20b83e27435fa051881a731a19fa9ad3a5d6fe04e75993752a4fab3b3ef09234a72627c24700fbf7c0229bd203ebc59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
ba95b52b0a1a0c7d966eee9960be0dbd

SHA1
3216aa165ae9cc0b6e3c79ebfda705c5786ab046

SHA256
8c59686bec4c806feabb46d833e1088ccad209b010b5e9f01d5bbde18b4c6998

SHA512
df0536306f435401abe12640cb73b7661298a2c983acabd47ec928761806cf3048d6cc15ff5f509cfbdfe3a5749476dd31a9c059d5ed976c67c9c64aaf391b31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3fdf06316165bd06b22c1630aa9c10b1

SHA1
63410257fa174c1fc402fcc95ef6586444b18a20

SHA256
132b14ff7edb679d157d0ed03c57d8335f40eec33a3a9d4f9db2ded63082f229

SHA512
ca143e4ceea12fb0185e2e49d35ec7628743a821e07894d97df7f1a028013784cdd69c1a62dda1544a6be34b17f224d6015801123ad28a5e8fa97dc0004faa5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7d832f7fd66a2da57bdb1dbb641f34c4

SHA1
06a7a96274333fa66f2d33ce268a3d38eda907ff

SHA256
dec685a120b71dda9f9ee17c967426d13b5239509d650e1cf604026cc969471b

SHA512
0634019fa03863bdd2936f1604d0fd98d1e6f2bc49d38cba7d32b2c3ea3b27050897f34335d14361effaf7997d7847f8135af46ddd90210fa3482940c0f3470c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2bf623f923a81ca4dc741f17955e7e54

SHA1
159ce106ec7e3cbd918034fbe69e7187791c3727

SHA256
2dc845077f43b0d0fd157cdc6f793fe9b9f63dcaf4e195987999d497db3bd53e

SHA512
a2a79842ac739c20de569a194db7def0953aa291f391092e3c572284864e004305f4dfd269c939078a1f05f5cc5fb672038f367478dc368f5dd16814952dc447

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
760543aae3e49a787474e08411d8ecba

SHA1
d1f41b2472d1682a4c9df95c30d3c65bf430614f

SHA256
79a0ceb9a693caafacf74d33ac776ffff95c265c4c60aabb74fa55b71937c17f

SHA512
2bfe4dd76c6ced5cd77c12bb8cc4d296b977de36e5ebe1685020868d4d7ddf15f05b73870210fc3790d418183c855db98c0b009e0b4736c2c83047041459a5b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
a3af0c6db6a00de9a0a0a373ce7c396e

SHA1
04f026843e7e5aae18ab5aa54f4b3832dd17ab49

SHA256
be32e870fa0cfdd99d2f1e31e740ca35f95498113dfe58f80a8c4a7fab645d11

SHA512
f48c56b2e7307267d2d6c48b509487b0aa3413a74a720e1203bb7933bb6f1f97038807c3492884abae91ca8606591d5497653356aabdead2db5ab771a4104331

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a472de18-a8ed-475f-be36-3c8ac7ad0750.tmp

Filesize
10KB

MD5
000975627ae258f19433008fe6ee3f11

SHA1
9ec60fdd9d92352ea58769280ebccf41ce9ea74f

SHA256
25612e9aff13f7b290d44cdfa98eb8f4622ccb47231c1004b80d181ee1d5e7d9

SHA512
e694a0471a05b3f28c2f3b0ccb3dfd6b505465e9d84f5d51d59a3a221dc93a1581847bd9eba0a5cc2687a20ed00772a4d2f9a3b177c1c8b28a16876b4bef7162

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsa837F.tmp\modern-header.bmp

Filesize
25KB

MD5
6a7dfbb00ffd72ef54b21f9664b67b53

SHA1
336b2cea8f8d82028e3587b6bb10ef06a2197450

SHA256
12c8ee2d311771db4e2734f25fa2edec27f57829226dff796cd61bea01c90db8

SHA512
bf5b3d24339c9f91c8d4261e1457a8e5ad4a44a0d34032e8415d636a81695fd2e3c61647e00044d61e9379bda9d1c83514cbfb1a77666cbc918d38cfc4f18763

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsa837F.tmp\splash.bmp

Filesize
900KB

MD5
237aa22aff8343665911c8615c4cbfdd

SHA1
d35067296d0fe72cb55e01793846165a0c3b9750

SHA256
ff1f661c015ff0cd9794f5b6cb81755f528c98c522203fcf69550f67d427ff4f

SHA512
6929a3230a4c3b9057ed6e3c5eac2ce9f6a2cf6c3b58bb980aed88006a014adcd591e6bccb5eacec26a016f3bf785d08527464d276d4ee314c3744f3754d3d38

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsx657C.tmp\AdvSplash.dll

Filesize
6KB

MD5
13cc92f90a299f5b2b2f795d0d2e47dc

SHA1
aa69ead8520876d232c6ed96021a4825e79f542f

SHA256
eb1ca2b3a6e564c32677d0cdc388e26b74ef686e071d7dbca44d0bfa10488feb

SHA512
ff4e6e6e7104568fc85ef3a3f0494a5c7822a4ceaf65c584ad534f08f9a472a8d86f0a62f1f86343c61e2540b2254714b7ea43e4b312ff13d8271ff069386fa3

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsx657C.tmp\System.dll

Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsx657C.tmp\modern-wizard.bmp

Filesize
150KB

MD5
fd944873f187518849e6e3336c45f968

SHA1
3ba4d7d455372a329eb44200ecdd2e3075869047

SHA256
54eec84988f8d5d5f1cdfefd74333dbcd85b1ff525b2b1f9cac6de9905cefe1d

SHA512
d2bbbc19e4114fc68c695664bf8c5ba4f04e96f24b002f4e37c8147f946c32c043a97723f6536c4a8895384a2c119fd2fb8042e3e27a16fdf55d4f779e0e1f3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsx657C.tmp\nsDialogs.dll

Filesize
9KB

MD5
c10e04dd4ad4277d5adc951bb331c777

SHA1
b1e30808198a3ae6d6d1cca62df8893dc2a7ad43

SHA256
e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a

SHA512
853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e

Download Submit
C:\Users\Admin\Downloads\Serum Full\Install_Xfer_Serum_Update_121b4.exe

Filesize
18.1MB

MD5
bf780153220b5dab9447de1628993033

SHA1
f20b68a1580828a6ec96382ea68d2d8f077bb8b3

SHA256
f58a1afc1dc58f057f867bba61d28fb42496200665a0a60b9a0024a1834198a5

SHA512
63a7b1dfb7aebaa9e484458e130c654be7e92949a4406dd54bf6eb3b26b565931039e201152fff0f67ba76d8e2405511de5270a0418d3049130978a2933a68f3

Download Submit