Resubmissions
10/07/2026, 01:27
260710-bvhmtscz2y710/07/2026, 00:39
260710-az15ascw3y710/07/2026, 00:38
260710-ay3xhacw3w710/07/2026, 00:05
260710-adbbracs21810/07/2026, 00:01
260710-aa3a3ab181709/07/2026, 23:54
260709-3xtlnab15z7Analysis
- user interaction
yes - max time kernel
630s - max time network
609s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
10/07/2026, 00:05
Behavioral task
behavioral1
Sample
Gateway-v1.0.1-win.zip
Resource
win10v2004-20260513-en
windows10-2004-x64
19 signatures
150 seconds
Behavioral task
behavioral2
Sample
Gateway-v1.0.1-win.zip
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
30 signatures
150 seconds
General
- Target Gateway-v1.0.1-win.zip
- Size 3.8MB
- Sample260710-adbbracs21
- SHA256 06571761c8429a3f2b6bd3a35ebd9729eb1e1fd5015fa0ce26fe8ed37d04f9b1
- MD5 9e7ba4339b64595933a34e67ce87dbbf
- SHA1 a969dea0c3662512b9ffaf04ad8a8a2498d0602e
- SHA512 499c40d5449c08c80e5b9c1bc4c243278b7e0e57d13bb996f7786328da9b2678b587f363cc1fa55d939914a3b21f78ea25e54d31bb70ac77911c0c8e146f1c2f
- SSDEEP 98304:XjTWJwOk9XFjR0kXsTeadEqvYZoRk3M9p7D+nlUBsZMUIGxrBaJWdB:WRcXZR0kueW9p7qlUExjaJWdB
- TLSH T1891633F98A983894FE0258F0F558F870935D2138F67256172A8ED2C3B4C75672BCF998
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation Gateway Installer.tmp - Executes dropped EXE 5 IoCs
pid Process 2580 Gateway Installer.tmp 4040 Gateway_x64.exe 1780 Gateway_x64.exe 1028 Gateway_x64.exe 1468 Gateway_x64.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\VST3\Gateway.vst3\Desktop.ini Gateway Installer.tmp - Drops file in Program Files directory 21 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\VST3\Gateway.vst3 Gateway Installer.tmp File created C:\Program Files\Gateway\unins000.dat Gateway Installer.tmp File created C:\Program Files\Gateway\is-29SZ7FNKJD.tmp Gateway Installer.tmp File created C:\Program Files\Common Files\VST3\Gateway.vst3\is-VRBQAMXVDJ.tmp Gateway Installer.tmp File created C:\Program Files\Common Files\VST3\Gateway.vst3\is-KNVXVWG8XF.tmp Gateway Installer.tmp File created C:\Program Files\Gateway\is-PYZZYR0ZXG.tmp Gateway Installer.tmp File created C:\Program Files\Gateway\is-ZDEPIRRTES.tmp Gateway Installer.tmp File opened for modification C:\Program Files\Gateway\InstallationLogFile.log Gateway Installer.tmp File created C:\Program Files\Common Files\VST3\Gateway.vst3\Contents\Resources\is-VRCK6JZB8G.tmp Gateway Installer.tmp File opened for modification C:\Program Files\Common Files\VST3\Gateway.vst3\Desktop.ini Gateway Installer.tmp File created C:\Program Files\Common Files\VST3\Gateway.vst3\Contents\Resources\is-3FVSKVAE25.tmp Gateway Installer.tmp File created C:\Program Files\Gateway\is-BKB4YO26MA.tmp Gateway Installer.tmp File opened for modification C:\Program Files\Gateway\unins000.dat Gateway Installer.tmp File created C:\Program Files\Gateway\InstallationLogFile.log Gateway Installer.tmp File created C:\Program Files\Gateway\~$readme.rtf WINWORD.EXE File created C:\Program Files\Gateway\is-8N4873UOW3.tmp Gateway Installer.tmp File created C:\Program Files\Common Files\VST3\Gateway.vst3\Contents\x86_64-win\is-2YWF4O8SZY.tmp Gateway Installer.tmp File opened for modification C:\Program Files\Common Files\VST3\Gateway.vst3\PlugIn.ico Gateway Installer.tmp File opened for modification C:\Program Files\Gateway\readme.rtf WINWORD.EXE File opened for modification C:\Program Files\Gateway\Gateway_x64.exe Gateway Installer.tmp File created C:\Program Files\Gateway\is-FEDBSBEFL2.tmp Gateway Installer.tmp - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gateway Installer.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gateway Installer.exe - Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
resource yara_rule behavioral1/memory/2548-0-0x0000000000810000-0x00000000008F9000-memory.dmp innosetup behavioral1/memory/2548-7-0x0000000000810000-0x00000000008F9000-memory.dmp innosetup behavioral1/memory/2548-62-0x0000000000810000-0x00000000008F9000-memory.dmp innosetup - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings Gateway Installer.tmp - Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 2972 WINWORD.EXE 2972 WINWORD.EXE - Suspicious behavior: EnumeratesProcesses 51 IoCs
pid Process 2580 Gateway Installer.tmp 2580 Gateway Installer.tmp 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 3676 taskmgr.exe Token: SeSystemProfilePrivilege 3676 taskmgr.exe Token: SeCreateGlobalPrivilege 3676 taskmgr.exe - Suspicious use of FindShellTrayWindow 60 IoCs
pid Process 2580 Gateway Installer.tmp 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe - Suspicious use of SendNotifyMessage 59 IoCs
pid Process 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe 3676 taskmgr.exe - Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 2972 WINWORD.EXE 2972 WINWORD.EXE 2972 WINWORD.EXE 2972 WINWORD.EXE 2972 WINWORD.EXE 2972 WINWORD.EXE 2972 WINWORD.EXE - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2548 wrote to memory of 2580 2548 Gateway Installer.exe 109 PID 2580 wrote to memory of 2972 2580 Gateway Installer.tmp 110 PID 704 wrote to memory of 1468 704 cmd.exe 132
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\Gateway-v1.0.1-win.zip1⤵PID:4876
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2064
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_Gateway-v1.0.1-win.zip\known-issues.txt1⤵PID:828
-
C:\Users\Admin\AppData\Local\Temp\Temp1_Gateway-v1.0.1-win.zip\Gateway Installer.exe"C:\Users\Admin\AppData\Local\Temp\Temp1_Gateway-v1.0.1-win.zip\Gateway Installer.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\is-NAL7I9DNBP.tmp\Gateway Installer.tmp"C:\Users\Admin\AppData\Local\Temp\is-NAL7I9DNBP.tmp\Gateway Installer.tmp" /SL5="$B0266,3360457,893952,C:\Users\Admin\AppData\Local\Temp\Temp1_Gateway-v1.0.1-win.zip\Gateway Installer.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Program Files\Gateway\readme.rtf" /o ""3⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2972
-
-
-
C:\Program Files\Gateway\Gateway_x64.exe"C:\Program Files\Gateway\Gateway_x64.exe"1⤵
- Executes dropped EXE
PID:4040
-
C:\Program Files\Gateway\Gateway_x64.exe"C:\Program Files\Gateway\Gateway_x64.exe"1⤵
- Executes dropped EXE
PID:1780
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\Gateway\changelog.txt1⤵PID:3368
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\Gateway\InstallationLogFile.log1⤵PID:4100
-
C:\Program Files\Gateway\Gateway_x64.exe"C:\Program Files\Gateway\Gateway_x64.exe"1⤵
- Executes dropped EXE
PID:1028
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3676
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:704 -
C:\Program Files\Gateway\Gateway_x64.exeGateway_x64.exe2⤵
- Executes dropped EXE
PID:1468
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Gateway\Gateway_x64.exe
- Size 3.3MB
- SHA256 0e77f36c23fe945f93e7542c80778fc7df9e8b2ddd4d50e1d295d8f24d7b3e5f
- MD5 be852867d4bc651fe49e35f188ca0db0
- SHA1 03c702f35c2b7952121184ce78da534c2f52ce49
- SHA512 43d18edbab32ec947ccfa85076bbd8cdf6459a0ebc1b3631685b30cb93b82e4995913d039f43347f385db6012611acf3cf6fce71fb5b6a7f06d12eba8993bea6
- SSDEEP 49152:4WLMkWuToZtZgTBpJzpqRLtQfd3ltUCNfxcYqMCw7MjwLQSVhXfm4aEa:nndLUCNfxcYqMXLa3Ea
- TLSH T1EEF5E116F3A581FCD02BD178DA5A961BFB71780503209BDF12E00AA65F67BE10E7B361
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Gateway\InstallationLogFile.log
- Size 7KB
- SHA256 8e8458b753c381b040b2b264f24d762359d7e175cd72a8dd28df3e1bbdc27d87
- MD5 9bcf3d3a0d1173dff0b01b0e9a4a8b4b
- SHA1 92546223cc9d283874d3b5cb96fd1d7d37ba3fc2
- SHA512 47b2151d09cd80cb3f6bb307d86fa036068cf67d188ed24e331ec37fe133c77ad3436df04995d20d39e0ce5c7a5759f9b997ce5f57e2805f86ed32c3bc0d37db
- SSDEEP 96:fXr9ReRP/jQaZTCLGDEWRj4OPzM4N4qm4Y4v4y444B4o74UOCUvfiRVLLwZBjCc:/r4P/2C3uKAXc/gBfCZyByjCc
- TLSH T1CFF126414F3A525071873241FB1A2F4A9A8ABC0B3F09353537E989869B87D03DFE92A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Gateway\ThirdPartyNotices.txt
- Size 20KB
- SHA256 3fd8dec280ce1a4428d8a34fa725c3512297f6cae4ba2bd129d670fbff53cec8
- MD5 c4b2b71a4dbf89ae9ae71d659880e43a
- SHA1 c2d73ad011c2496435a9ec6f2bc21698f80873f5
- SHA512 45f36999d6133467238ef1956ddb7eb647197da72acffd9af8b603be9089188ea8a3ef2f583c8235bb961209cf4d0ea8f3798aa7dc7efb2bdf4daab7a8ade14b
- SSDEEP 384:KijYYhNYYNYZLYOjYAYhv1KHHR8JqYN+mpSf9Y+vYCTY/QmI:KA0rsh95Bf1H/QmI
- TLSH T15C92961F7F5A437218D2C3A52559ACC5F22BB15E7B5F1684306EE24D237701886FF868
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Gateway\changelog.txt
- Size 65B
- SHA256 b7a116c4b0a04c40103d7cd9895e0d6133be3c6e5cd93021ede31f38e82cc1bf
- MD5 f4a194cc251cf3689a4ad3379955a4b2
- SHA1 90deb8aa57eb464aaab292b406ec50e1c1191122
- SHA512 0daa93207fd1900d9e63a39f72ac414fc6fd0a74f8b6286404ff2a2c44474efb5f1979857fec6e500c0b6d43ee5c56e5c28aa38abde79448d9f421536104fa10
- TLSH T108A001A0A2AF469C2AECB8288AA4290020DD6994A05419023388286908E284C215D729
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Gateway\readme.rtf
- Size 823B
- SHA256 1129848116a17cb651001245854368dbaae604ce8c2be7ea459fdac9f3f8de08
- MD5 306e82cfc6483f7f778a079951edaafc
- SHA1 2afde345a695dd582b02ee8a9dedab40cc58ae1a
- SHA512 9b6728232919edd7aa936014b3240c668133120612615210881878c6ff766038b097bbfa024f3cdf148a31798646a633645a64473a67775d190ac9752e04081c
- TLSH T1BD01EFF3CE0040A80FA462629DFA44C9A7A64791FDB8FCC9A6B318A4692C5F97117844
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Gateway\settings.ini
- Size 168B
- SHA256 038b85ee98c7e033e9029367849509bcf3f17f3438143e78cb68b72c6d3aa05f
- MD5 5c8b8c568c15c655200f5a9b5af211e5
- SHA1 8250439491e2c5ebe0d75754ef69751c884d338d
- SHA512 a81592bf92017f3d2bc0633c3e4dde680ad297416579b9b765baa080eee69293588ffc8e2864d41db9e2cc5ffa674926aadfd74a8086630db7a0ba7c95ef2c67
- TLSH T1B3C08C40570CEE0C0A7271303C3F2320B0CB2A1CA29AD13D0008CC286C40103853FA5D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Setup Log 2026-07-10 #001.txt
- Size 7KB
- SHA256 3203f069624453ddcd7a63de025d8375dbce19b11ecdf03ad75c71b0cf52dfdd
- MD5 d1ca367f519f34284b64ffacfe7067c4
- SHA1 76a6b583dbf0676a211c12c8bd07a7384fb49b18
- SHA512 dc13ef40268b71375390f9ada7810a1dbd5bd18752cd2ba6f9c816d6c7668f09f5ad300446f3b0bff0b5ebc24cbd3909d45240d6cf334d640cfd287f9173d372
- SSDEEP 96:fXr9ReRP/jQaZTCLGDEWRj4OPzM4N4qm4Y4v4y444B4o74UOCUvfiRVLLwZBjCfu:/r4P/2C3uKAXc/gBfCZyByjCfu
- TLSH T145F127414F3A525071873241FB1A2F4A9A8ABC0B3F09353537E9C9869B87D03DFE92A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-NAL7I9DNBP.tmp\Gateway Installer.tmp
- Size 4.2MB
- SHA256 1053f98eb1af6618d742b01f8ca95649a4c92bcb1073cb5f95d039db1ee4dcaa
- MD5 928d65ec8564b076670ee122b518ed01
- SHA1 364a8167272ea558bc897aff8f6ee669ea724e7d
- SHA512 c64e6b403d364f3b7c55cdb7100cad718795370fc04f4a2aa4de1716745a824cc01b0b182ed592687ea4d53fa227a1cc99d9915f0141d30fb0b96c79e99dd79d
- SSDEEP 98304:5YU5hnuOajWwMPdCpepI3GrwrA+Js333Ph:7xuHjWfZIzeh
- TLSH T1D7268F03F388753EE4571A3A583FA280983F7A213915CD4B6BFC295C8F396416D2A797
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
- Size 313B
- SHA256 edf38658586b8b7bab219d2ed9634d99b1279d949f44a6aca844f02d55ce4558
- MD5 6b309a746a0ee926a1127fb30636fb76
- SHA1 ebae2fa85cf3d338ac1ea1de3cd2ff8bff5a5b38
- SHA512 fe680d931091df424dc56818ddb0262a38b6b1a136b61538c03cb33203cc6b0209e6d11c077bd9a85eaa0941014f5b1447085e06d846042a02dd283b53469eac
- TLSH T18DE0E28F47ACDBF1833D92E574B0ACF19BF3894CCA66512129C84CDA1CA600331EB488
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC
- Size 2B
- SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
- MD5 f3b25701fe362ec84616a93a45ce9998
- SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
- SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
- MD5 SHA1 SHA512