netsupport | hxxp://gemini-desktop[.]info

Resubmissions

08-01-2025 03:25

250108-dy5ymstrem 10

08-01-2025 02:37

250108-c3735asndl 10

Analysis

max time kernel
198s
max time network
203s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08-01-2025 02:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://gemini-desktop.info

Score

10^/10

netsupport defense_evasion discovery evasion phishing rat themida trojan

Malware Config

Signatures

NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
rat netsupport
Netsupport family
netsupport

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	client32.exe

Downloads MZ/PE file
A potential corporate email address has been identified in the URL: /static/images/[email protected]
phishing
A potential corporate email address has been identified in the URL: image@url=%2Fstatic%2Fimages%2Fwhite_caret_down.png&w=32&q=75
phishing

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	client32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	client32.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\office.lnk	driver.exe

Executes dropped EXE 4 IoCs

pid	Process
4948	gemini.exe
3048	gemini.tmp
1804	driver.exe
1440	client32.exe

Loads dropped DLL 5 IoCs

pid	Process
1440	client32.exe
1440	client32.exe
1440	client32.exe
1440	client32.exe
1440	client32.exe

Themida packer 9 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/files/0x0007000000023cc4-429.dat	themida
behavioral1/memory/1440-437-0x0000000011000000-0x0000000011B06000-memory.dmp	themida
behavioral1/memory/1440-439-0x0000000011000000-0x0000000011B06000-memory.dmp	themida
behavioral1/memory/1440-440-0x0000000011000000-0x0000000011B06000-memory.dmp	themida
behavioral1/memory/1440-441-0x0000000011000000-0x0000000011B06000-memory.dmp	themida
behavioral1/memory/1440-438-0x0000000011000000-0x0000000011B06000-memory.dmp	themida
behavioral1/memory/1440-452-0x0000000011000000-0x0000000011B06000-memory.dmp	themida
behavioral1/memory/1440-451-0x0000000011000000-0x0000000011B06000-memory.dmp	themida
behavioral1/memory/1440-453-0x0000000011000000-0x0000000011B06000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	client32.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
143	raw.githubusercontent.com
144	raw.githubusercontent.com

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1440	client32.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gemini.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gemini.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	client32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 55 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Mode = "1"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 3a001f44471a0359723fa74489c55595fe6b30ee260001002600efbe10000000ac8f87539918db01ca80bca5a018db01cb5b2f637661db0114000000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "2"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\LogicalViewMode = "3"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e8005398e082303024b98265d99428e115f0000	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\IconSize = "48"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1092616257"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:PID = "0"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Downloads"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByDirection = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupView = "0"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 677364.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
2748	msedge.exe
2748	msedge.exe
2556	msedge.exe
2556	msedge.exe
3620	identity_helper.exe
3620	identity_helper.exe
4860	msedge.exe
4860	msedge.exe
4484	msedge.exe
4484	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3048	gemini.tmp
3048	gemini.tmp
1440	client32.exe
1440	client32.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeSecurityPrivilege	1440	client32.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4484	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2556 wrote to memory of 3872	2556	msedge.exe	83
PID 2556 wrote to memory of 3872	2556	msedge.exe	83
PID 2556 wrote to memory of 4752	2556	msedge.exe	84
PID 2556 wrote to memory of 4752	2556	msedge.exe	84
PID 2556 wrote to memory of 4752	2556	msedge.exe	84
PID 2556 wrote to memory of 4752	2556	msedge.exe	84
PID 2556 wrote to memory of 4752	2556	msedge.exe	84
PID 2556 wrote to memory of 4752	2556	msedge.exe	84
PID 2556 wrote to memory of 4752	2556	msedge.exe	84
PID 2556 wrote to memory of 4752	2556	msedge.exe	84
PID 2556 wrote to memory of 4752	2556	msedge.exe	84
PID 2556 wrote to memory of 4752	2556	msedge.exe	84
PID 2556 wrote to memory of 4752	2556	msedge.exe	84
PID 2556 wrote to memory of 4752	2556	msedge.exe	84
PID 2556 wrote to memory of 4752	2556	msedge.exe	84
PID 2556 wrote to memory of 4752	2556	msedge.exe	84
PID 2556 wrote to memory of 4752	2556	msedge.exe	84
PID 2556 wrote to memory of 4752	2556	msedge.exe	84
PID 2556 wrote to memory of 4752	2556	msedge.exe	84
PID 2556 wrote to memory of 4752	2556	msedge.exe	84
PID 2556 wrote to memory of 4752	2556	msedge.exe	84
PID 2556 wrote to memory of 4752	2556	msedge.exe	84
PID 2556 wrote to memory of 4752	2556	msedge.exe	84
PID 2556 wrote to memory of 4752	2556	msedge.exe	84
PID 2556 wrote to memory of 4752	2556	msedge.exe	84
PID 2556 wrote to memory of 4752	2556	msedge.exe	84
PID 2556 wrote to memory of 4752	2556	msedge.exe	84
PID 2556 wrote to memory of 4752	2556	msedge.exe	84
PID 2556 wrote to memory of 4752	2556	msedge.exe	84
PID 2556 wrote to memory of 4752	2556	msedge.exe	84
PID 2556 wrote to memory of 4752	2556	msedge.exe	84
PID 2556 wrote to memory of 4752	2556	msedge.exe	84
PID 2556 wrote to memory of 4752	2556	msedge.exe	84
PID 2556 wrote to memory of 4752	2556	msedge.exe	84
PID 2556 wrote to memory of 4752	2556	msedge.exe	84
PID 2556 wrote to memory of 4752	2556	msedge.exe	84
PID 2556 wrote to memory of 4752	2556	msedge.exe	84
PID 2556 wrote to memory of 4752	2556	msedge.exe	84
PID 2556 wrote to memory of 4752	2556	msedge.exe	84
PID 2556 wrote to memory of 4752	2556	msedge.exe	84
PID 2556 wrote to memory of 4752	2556	msedge.exe	84
PID 2556 wrote to memory of 4752	2556	msedge.exe	84
PID 2556 wrote to memory of 2748	2556	msedge.exe	85
PID 2556 wrote to memory of 2748	2556	msedge.exe	85
PID 2556 wrote to memory of 1896	2556	msedge.exe	86
PID 2556 wrote to memory of 1896	2556	msedge.exe	86
PID 2556 wrote to memory of 1896	2556	msedge.exe	86
PID 2556 wrote to memory of 1896	2556	msedge.exe	86
PID 2556 wrote to memory of 1896	2556	msedge.exe	86
PID 2556 wrote to memory of 1896	2556	msedge.exe	86
PID 2556 wrote to memory of 1896	2556	msedge.exe	86
PID 2556 wrote to memory of 1896	2556	msedge.exe	86
PID 2556 wrote to memory of 1896	2556	msedge.exe	86
PID 2556 wrote to memory of 1896	2556	msedge.exe	86
PID 2556 wrote to memory of 1896	2556	msedge.exe	86
PID 2556 wrote to memory of 1896	2556	msedge.exe	86
PID 2556 wrote to memory of 1896	2556	msedge.exe	86
PID 2556 wrote to memory of 1896	2556	msedge.exe	86
PID 2556 wrote to memory of 1896	2556	msedge.exe	86
PID 2556 wrote to memory of 1896	2556	msedge.exe	86
PID 2556 wrote to memory of 1896	2556	msedge.exe	86
PID 2556 wrote to memory of 1896	2556	msedge.exe	86
PID 2556 wrote to memory of 1896	2556	msedge.exe	86
PID 2556 wrote to memory of 1896	2556	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument http://gemini-desktop.info
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0x40,0x108,0x7ffe245046f8,0x7ffe24504708,0x7ffe24504718
  2⤵
  PID:3872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,3773575892430292067,2326529277829464265,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,3773575892430292067,2326529277829464265,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,3773575892430292067,2326529277829464265,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2676 /prefetch:8
  2⤵
  PID:1896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3773575892430292067,2326529277829464265,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3773575892430292067,2326529277829464265,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:2472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3773575892430292067,2326529277829464265,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:1
  2⤵
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,3773575892430292067,2326529277829464265,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5364 /prefetch:8
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,3773575892430292067,2326529277829464265,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5364 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3773575892430292067,2326529277829464265,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:1
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3773575892430292067,2326529277829464265,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:1
  2⤵
  PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3773575892430292067,2326529277829464265,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:1
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3773575892430292067,2326529277829464265,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1
  2⤵
  PID:3472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3773575892430292067,2326529277829464265,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5492 /prefetch:1
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2092,3773575892430292067,2326529277829464265,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5456 /prefetch:8
  2⤵
  PID:772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2092,3773575892430292067,2326529277829464265,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6404 /prefetch:8
  2⤵
  PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2092,3773575892430292067,2326529277829464265,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3100 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3773575892430292067,2326529277829464265,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:1
  2⤵
  PID:3932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3773575892430292067,2326529277829464265,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6576 /prefetch:1
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3773575892430292067,2326529277829464265,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6676 /prefetch:1
  2⤵
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3773575892430292067,2326529277829464265,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6820 /prefetch:1
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3773575892430292067,2326529277829464265,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6836 /prefetch:1
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2092,3773575892430292067,2326529277829464265,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=7064 /prefetch:8
  2⤵
  PID:3608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=2092,3773575892430292067,2326529277829464265,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6748 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3773575892430292067,2326529277829464265,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7140 /prefetch:1
  2⤵
  PID:3044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3773575892430292067,2326529277829464265,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6952 /prefetch:1
  2⤵
  PID:1908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,3773575892430292067,2326529277829464265,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5248 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3752

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4460

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4384

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:636

C:\Users\Admin\Downloads\gemini.exe
"C:\Users\Admin\Downloads\gemini.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4948
- C:\Users\Admin\AppData\Local\Temp\is-MOIC8.tmp\gemini.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-MOIC8.tmp\gemini.tmp" /SL5="$90116,107203419,761856,C:\Users\Admin\Downloads\gemini.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3048
- - C:\Users\Admin\AppData\Local\Temp\is-2DMAL.tmp\driver.exe
    "C:\Users\Admin\AppData\Local\Temp\is-2DMAL.tmp\driver.exe"
    3⤵
    - Drops startup file
    - Executes dropped EXE
    PID:1804
  - - C:\Users\Admin\AppData\Roaming\update\client32.exe
      "C:\Users\Admin\AppData\Roaming/update/client32.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Loads dropped DLL
      Checks whether UAC is enabled
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1440
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C del /f /q "C:\Users\Admin\AppData\Local\Temp\is-2DMAL.tmp\driver.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8749e21d9d0a17dac32d5aa2027f7a75

SHA1
a5d555f8b035c7938a4a864e89218c0402ab7cde

SHA256
915193bd331ee9ea7c750398a37fbb552b8c5a1d90edec6293688296bda6f304

SHA512
c645a41180ed01e854f197868283f9b40620dbbc813a1c122f6870db574ebc1c4917da4d320bdfd1cc67f23303a2c6d74e4f36dd9d3ffcfa92d3dfca3b7ca31a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
34d2c4f40f47672ecdf6f66fea242f4a

SHA1
4bcad62542aeb44cae38a907d8b5a8604115ada2

SHA256
b214e3affb02a2ea4469a8bbdfa8a179e7cc57cababd83b4bafae9cdbe23fa33

SHA512
50fba54ec95d694211a005d0e3e6cf5b5677efa16989cbf854207a1a67e3a139f32b757c6f2ce824a48f621440b93fde60ad1dc790fcec4b76edddd0d92a75d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7c2a7d87-e988-4c5c-84cd-21e5db9c80ef.tmp

Filesize
8KB

MD5
478ca9adab7287cf7791c002bc01bec4

SHA1
0f13cd0f394725c01536140d98991446babf6fe6

SHA256
561c0318388bb61b74024bab797597d34f3343818ae988d211ef3f2be9a5aa8c

SHA512
ada3571e3b8c19bd30cbabe914dd3e0b29c79587b1ab4272b33e7e1a3ff5e8fa998b22f578362db31e5e3fff69923b2deebd210e08cf3d1e81e37851b78b08bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011

Filesize
41KB

MD5
ca9e4686e278b752e1dec522d6830b1f

SHA1
1129a37b84ee4708492f51323c90804bb0dfed64

SHA256
b36086821f07e11041fc44b05d2cafe3fb756633e72b07da453c28bd4735ed26

SHA512
600e5d6e1df68423976b1dcfa99e56cb8b8f5cd008d52482fefb086546256a9822025d75f5b286996b19ee1c7cd254f476abf4de0cf8c6205d9f7d5e49b80671

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012

Filesize
215KB

MD5
d79b35ccf8e6af6714eb612714349097

SHA1
eb3ccc9ed29830df42f3fd129951cb8b791aaf98

SHA256
c8459799169b81fdab64d028a9ebb058ea2d0ad5feb33a11f6a45a54a5ccc365

SHA512
f4be1c1e192a700139d7cff5059af81c0234ed5f032796036a1a4879b032ce4eedd16a121bbf776f17bc84a0012846f467ad48b46db4008841c25b779c7d8f5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
552B

MD5
0bf884d3cefe5ef1fa4f94eab1fcb145

SHA1
cc4507f2b8e152b9a4ced067095bf32c1cb11c41

SHA256
b864d013d4480a67be393920ab40c2e125b8eac956ae1d7c8b31455681f1e4ea

SHA512
782cb3ab9efcb9a6dc7603a82224180a8ce1560174c236d4e3c44a9b55c2aafb6c2dfee79924c05f2f21b1ad4b806e0fddae03a46b758727c13276894ff86e12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
1f5d22afa2951aa05434239ac1f0447c

SHA1
dd40549c7f4ef3d77467a3bb9d75ac85019d847d

SHA256
c703af1c4adc5d5eaf1176820a4690d0dbab800f0be927ea55dd9c7f33f25248

SHA512
acfc12c025c9b44de818618c37529868a4858afd958c5ccaccb367ae009f2fd3df8fc38fd9e9d29a345afe87640812aa316031d62e92f8a356940032df9e399f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
f81b5145377801a15be82da26565440b

SHA1
bf317a0c88e2fa59e923d976180fdf77194108a7

SHA256
d0494c77c3c13f880676bd8c521e0d253fd6d1ff1ad4911a190ef171d2d05ed5

SHA512
5c773294538a1a32a1d5d80886ed5cec7a024b7b5859b8489db4971045a72310cab5f133db725528ea940e3da3540d61f440452aab361156c3c5ea6293669a23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
90978a834734a3384a4d231cc67bbb22

SHA1
bc77782b4a5fa97f54b4884c64f4b8b56f802953

SHA256
b9d989515ebd7eeafb2edb2d7b1ec2eb2252adc9394da84c337299f9693c4201

SHA512
6f2fdc72fea75e239bf726a22e6da67ac55e5bb8f6ac4f3794e31049052126bbcedd17e75a110741856e4914338131f9547f9a5dfc33850cb26049a626618e11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1f054a41d9f04a841ae8bf6820f2de17

SHA1
4481a009afa44e5563ac0b5193d9e79c1510c0e6

SHA256
3fcf248629a2ce3a06f8989c370b840e9e711f15099a8df89fbd2821d8094941

SHA512
cadcebcf8c9afcbd1eab3bc10642213da8909a1c2ca60313ce905dbef0330069a6051e12bfad77de36ce18cce4b60201302c6253aec67aa4fc82c2aa2f0d136d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
50b344caed3dadb70ae35a794be5fba2

SHA1
792b9c88d5fe42063f8f32dd8873b9a669e2312d

SHA256
0834738d0d82bebea809348573a1be37331013bd08166db6d8460498c2e0ed72

SHA512
07d98d1e8e56f6aa45f1de6ced816716085f5d5653570aeb7cbf5b6a4302bec8fa5f3537d3078becb4438fbc1527fe049cf25835adb2f8a7954cac0b1f3670b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
4735d9ba8c657a37a7fd9040bd8fcf6b

SHA1
9b5df05f03ed519bc992fda446f1e4a3eedbcd05

SHA256
19d0c7df188ce221f2693f92adcfed6ea910252e2c007b814c3b607132144359

SHA512
c5ad636c2138b38a67ba77b6fed1a8f6450af619b8987e5360c6e25c97d7227ee378b7c40a6a656796d6718208b7d878d766e7fa00cb43d36e2310305a99075a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58cf42.TMP

Filesize
48B

MD5
337f7851604ce1fc5908986945332095

SHA1
0f73f7612ffa90c79df08c317d62e796d1b255ca

SHA256
578ef36d4ddf5c699f000ba8b162e5783aa19937e468bb780fcad914614d9305

SHA512
8b67ded76d258336912464279b0b0c0e1fd194e148f3e9e7364c49006cc27930a3fec977f51bb9af8788ffe8fefc98dd10ed3b26a8d92a8d13cbc96ebb386f5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
ec749070e3fc3448c67a410aefe1061b

SHA1
8ba0577e761343bcae2a8ff28761cafc613dffc7

SHA256
8edb03aa155c25722762403a1501dd596cf115441dc7728812ca5227ca9c97b2

SHA512
101345dd62ffbe295e0a59d424653729a3ed452e760ffd5c1bfd77a2d7f0bc6abddd400848870529d7f650e3dc4f96f3a26cfcc3d9953040762fa9fc05f42427

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
0b639645f3b2a5acde9a996fb8c04bd7

SHA1
8c05eed406dd44989269ac5ff82f77cf625d67da

SHA256
439f4a9c7aa56681bb542eee6dd073fa4370f3815b0bae921c11456474c13326

SHA512
9fee437f03c7bff3b0e87ba8fe2a1317b0497544bf91a2dc61244179f1f48b1200c08b76a211a86545f25f69ca8bc2df6eee7cc7143a2f29bf86c4ee16c403a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
87fde03cc27c4737f771389ea18facdb

SHA1
721b11939a747ebe94dae28540ffc1ff9fdcbcf7

SHA256
e0374cb44472b65f592d7b0e61aa854f7826b69ee8a4b75d41de38c00cf8f053

SHA512
965b6d4d935ff59efa5b8a2346c75b82b125d607914aba9eb2550989974a64841e5cba6c924b9c3c834f9fa5ded01fdd5e20a91f33b3b19616d30df6bf29b5a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\extracted_files\AudioCapture.dll

Filesize
87KB

MD5
7629af8099b76f85d37b3802041503ee

SHA1
f40a5efcb9dee679de22658c6f95c7e9c0f2f0c0

SHA256
2cc8ebea55c06981625397b04575ed0eaad9bb9f9dc896355c011a62febe49b5

SHA512
c209714ffdb0b95595583976340f2eb901eb9895f2f420afc4ca3c12744432e52fbedfd857b56cb347d4475df7678bd42d43f221208a108384e1df5aaf7d19e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-2DMAL.tmp\driver.exe

Filesize
7.2MB

MD5
f0f8cdf115e89e3caab43f50658ba709

SHA1
19dfa9bc7437c7ec11dd4192700f2b9c9b324cef

SHA256
cfc26c6a0f8fec7312ba9c79a3d186cbe01867936c7ade98f201fbf9b6ab90a5

SHA512
697ad6802af19932003ea95ad0210b782d778ae41aefb1192a4ff58b05c1c124d9935df60e16e374dc7c1e0f4e197e4cb423dd10bd81cb8c6c6ffd44f48f972e

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-MOIC8.tmp\gemini.tmp

Filesize
2.9MB

MD5
9e3d21ba2007d8f2d178a26c21ced9f0

SHA1
cf39a2f89bc9d72404b74d19b48938f4ae3ee0fa

SHA256
21a8d0d1ac67a892e8d2e4f04e5fae2683bc43e384ef6d9ee6005ddea1b966a1

SHA512
295c7dc56c943b76fdc07a3505a081de21c2c8860b034c77780d8257ac8008fbeaa9240524ce08b2a6bb13530f780b669ebc5d8c5ebd6b0be840d7549bed76b6

Download Submit
C:\Users\Admin\AppData\Roaming\update\MSVCR100.dll

Filesize
755KB

MD5
0e37fbfa79d349d672456923ec5fbbe3

SHA1
4e880fc7625ccf8d9ca799d5b94ce2b1e7597335

SHA256
8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18

SHA512
2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630

Download Submit
C:\Users\Admin\AppData\Roaming\update\NSM.LIC

Filesize
259B

MD5
4e8ecebce46ceef1f6e29c71b6d3be94

SHA1
2345f5203dc819c33782d8f3632f13e835066392

SHA256
76f0b30a1d93469ab744ac81a2f9f96f180e5df964189d3f9b71aef2673dff46

SHA512
80c0949bc0842e036a3ee3ca2023af9465c3f9d6a18a028b1453630a6b1005c9d9b44747600c41899ad551a57510fbe845a7f06df04763ec278189f22b4d2b3e

Download Submit
C:\Users\Admin\AppData\Roaming\update\PCICHEK.DLL

Filesize
14KB

MD5
3aabcd7c81425b3b9327a2bf643251c6

SHA1
ea841199baa7307280fc9e4688ac75e5624f2181

SHA256
0cff893b1e7716d09fb74b7a0313b78a09f3f48c586d31fc5f830bd72ce8331f

SHA512
97605b07be34948541462000345f1e8f9a9134d139448d4f331cefeeca6dad51c025fcab09d182b86e5a4a8e2f9412b3745ec86b514b0523497c821cb6b8c592

Download Submit
C:\Users\Admin\AppData\Roaming\update\PCICL32.dll

Filesize
4.2MB

MD5
d1356c062414a92b56b7466b562e9161

SHA1
d8e1dfe082de0b9dbdcef8ce1387dc70efc6d027

SHA256
83a44061672cc24c9cf1b8867ffc4ce0a6c3f2f129d32e7b31b58dfc12fbdea3

SHA512
7076bd0da6bdeded0d356e475096df65aa2a2a0acb5f201bf63b6d8c9d80a6084d8ee7bb5016cc210ff1da07cbe4ef7a1e1c18a7d29ab06d8de6d63d78459730

Download Submit
C:\Users\Admin\AppData\Roaming\update\client32.exe

Filesize
117KB

MD5
7d854e511bf1c3b8ddd0d60fed785bfd

SHA1
8a7dab456bbaf4558e19a474b352e8b9373d7629

SHA256
0d67440514fbb244cf374cd3afa99215ef16ea47dc5b3926afd811270e956f2f

SHA512
feb37323d44f11adeced4179205f62d324cc70f8be87bc76ee9565ede1f82fe3b2811fcb4e58639454f304454d4d71a7f86a50b9ddd02a19c55f7b630a8e26bd

Download Submit
C:\Users\Admin\AppData\Roaming\update\client32.ini

Filesize
745B

MD5
c0b2855f369d2c871ac18c4b04faddd6

SHA1
dac354442dce857bfada924d97205674373bcea1

SHA256
748f494f29d88d8ed48af36c65afb67a43e9c1e7a8bf80aa26f085a89e22cc59

SHA512
acf1baa2592fa7d293aed6fc14aa8716393c9870c9496b80d1b9e282f7b4dc5e82aa652de8243ec65fcbaa75a4c769b83d817dee23f1d1961f526af9770698cc

Download Submit
C:\Users\Admin\AppData\Roaming\update\htctl32.dll

Filesize
316KB

MD5
051cdb6ac8e168d178e35489b6da4c74

SHA1
38c171457d160f8a6f26baa668f5c302f6c29cd1

SHA256
6562585009f15155eea9a489e474cebc4dd2a01a26d846fdd1b93fdc24b0c269

SHA512
602ab9999f7164a2d1704f712d8a622d69148eefe9a380c30bc8b310eadedf846ce6ae7940317437d5da59404d141dc2d1e0c3f954ca4ac7ae3497e56fcb4e36

Download Submit
C:\Users\Admin\AppData\Roaming\update\office.lnk

Filesize
1KB

MD5
b645868482618c15ed333b39a72ac60e

SHA1
f2bf858e0014bc0e1a29ae531cba87f0e5895c5a

SHA256
e66e9df50f40aa73dc847f6afdf9852000782841df6b808a75e090e9787604dd

SHA512
24ad17f2f9165070f04a9979a804eeac6eb47c10b4f2d79bac4f8f245aee50abea5d3331098119fe1ed10640194d631cbd55cc8f97a55573cbe2c2052fd5fd62

Download Submit
C:\Users\Admin\AppData\Roaming\update\pcicapi.DLL

Filesize
106KB

MD5
67c53a770390e8c038060a1921c20da9

SHA1
49e63af91169c8ce7ef7de3d6a6fb9f8f739fa3a

SHA256
2dfdc169dfc27462adc98dde39306de8d0526dcf4577a1a486c2eef447300689

SHA512
201e07dbccd83480d6c4d8562e6d0a9e4c52ed12895f0b91d875c2bbcc50b3b1802e11e5e829c948be302bf98ebde7fb2a99476065d1709b3bdbcd5d59a1612d

Download Submit
memory/1440-441-0x0000000011000000-0x0000000011B06000-memory.dmp

Filesize
11.0MB

Download
memory/1440-451-0x0000000011000000-0x0000000011B06000-memory.dmp

Filesize
11.0MB

Download
memory/1440-440-0x0000000011000000-0x0000000011B06000-memory.dmp

Filesize
11.0MB

Download
memory/1440-437-0x0000000011000000-0x0000000011B06000-memory.dmp

Filesize
11.0MB

Download
memory/1440-438-0x0000000011000000-0x0000000011B06000-memory.dmp

Filesize
11.0MB

Download
memory/1440-439-0x0000000011000000-0x0000000011B06000-memory.dmp

Filesize
11.0MB

Download
memory/1440-453-0x0000000011000000-0x0000000011B06000-memory.dmp

Filesize
11.0MB

Download
memory/1440-452-0x0000000011000000-0x0000000011B06000-memory.dmp

Filesize
11.0MB

Download
memory/3048-353-0x0000000000400000-0x00000000006FB000-memory.dmp

Filesize
3.0MB

Download
memory/3048-345-0x0000000000400000-0x00000000006FB000-memory.dmp

Filesize
3.0MB

Download
memory/3048-447-0x0000000000400000-0x00000000006FB000-memory.dmp

Filesize
3.0MB

Download
memory/3048-449-0x0000000000400000-0x00000000006FB000-memory.dmp

Filesize
3.0MB

Download
memory/4948-342-0x0000000000400000-0x00000000004C8000-memory.dmp

Filesize
800KB

Download
memory/4948-450-0x0000000000400000-0x00000000004C8000-memory.dmp

Filesize
800KB

Download
memory/4948-313-0x0000000000400000-0x00000000004C8000-memory.dmp

Filesize
800KB

Download