06571761c8429a3f2b6bd3a35ebd9729eb1e1fd5015fa0ce26fe8ed37d04f9b1

Resubmissions

10/07/2026, 01:27

260710-bvhmtscz2y7

10/07/2026, 00:39

10/07/2026, 00:38

10/07/2026, 00:05

10/07/2026, 00:01

09/07/2026, 23:54

Analysis

user interaction
yes
max time kernel
862s
max time network
855s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/07/2026, 00:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Gateway-v1.0.1-win.zip
Size 3.8MB
Sample260710-adbbracs21
SHA256 06571761c8429a3f2b6bd3a35ebd9729eb1e1fd5015fa0ce26fe8ed37d04f9b1
MD5 9e7ba4339b64595933a34e67ce87dbbf
SHA1 a969dea0c3662512b9ffaf04ad8a8a2498d0602e
SHA512 499c40d5449c08c80e5b9c1bc4c243278b7e0e57d13bb996f7786328da9b2678b587f363cc1fa55d939914a3b21f78ea25e54d31bb70ac77911c0c8e146f1c2f
SSDEEP 98304:XjTWJwOk9XFjR0kXsTeadEqvYZoRk3M9p7D+nlUBsZMUIGxrBaJWdB:WRcXZR0kueW9p7qlUExjaJWdB
TLSH
T1891633F98A983894FE0258F0F558F870935D2138F67256172A8ED2C3B4C75672BCF998
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery installer persistence ransomware

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
159	5180	chrome.exe

Executes dropped EXE 14 IoCs

pid	Process
5812	Gateway Installer.tmp
4432	Gateway_x64.exe
2324	Gateway_x64.exe
4624	Gateway_x64.exe
3360	Gateway_x64.exe
3192	Gateway_x64.exe
4244	VC_redist.x64.exe
260	VC_redist.x64.exe
6124	VC_redist.x64.exe
2556	VC_redist.x64.exe
4016	VC_redist.x64.exe
4152	VC_redist.x64.exe
5132	VC_redist.x64.exe
3948	Gateway_x64.exe

Loads dropped DLL 8 IoCs

pid	Process
260	VC_redist.x64.exe
4152	VC_redist.x64.exe
4848	VC_redist.x64.exe
6916	Taskmgr.exe
6916	Taskmgr.exe
6916	Taskmgr.exe
2480	msedge.exe
2480	msedge.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0} = "\"C:\\ProgramData\\Package Cache\\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\\VC_redist.x64.exe\" /burn.runonce"	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0} = "\"C:\\ProgramData\\Package Cache\\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\\VC_redist.x64.exe\" /burn.runonce"	VC_redist.x64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\VST3\Gateway.vst3\Desktop.ini	Gateway Installer.tmp

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe

Drops file in System32 directory 51 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\mfc140enu.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140jpn.dll	msiexec.exe
File created	C:\Windows\system32\mfc140rus.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_atomic_wait.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140fra.dll	msiexec.exe
File created	C:\Windows\system32\mfc140deu.dll	msiexec.exe
File created	C:\Windows\system32\mfc140u.dll	msiexec.exe
File created	C:\Windows\system32\vcruntime140_1.dll	msiexec.exe
File created	C:\Windows\system32\mfcm140u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcruntime140_1.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_2.dll	msiexec.exe
File created	C:\Windows\system32\vcomp140.dll	msiexec.exe
File created	C:\Windows\system32\vcruntime140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140kor.dll	msiexec.exe
File created	C:\Windows\system32\mfc140cht.dll	msiexec.exe
File created	C:\Windows\system32\mfc140jpn.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vccorlib140.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_1.dll	msiexec.exe
File created	C:\Windows\system32\vcamp140.dll	msiexec.exe
File created	C:\Windows\system32\vccorlib140.dll	msiexec.exe
File created	C:\Windows\system32\vcruntime140_threads.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfcm140u.dll	msiexec.exe
File created	C:\Windows\system32\mfc140chs.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_codecvt_ids.dll	msiexec.exe
File created	C:\Windows\system32\concrt140.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_atomic_wait.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfcm140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140esn.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140ita.dll	msiexec.exe
File created	C:\Windows\system32\mfc140enu.dll	msiexec.exe
File created	C:\Windows\system32\mfc140ita.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcomp140.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_2.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_codecvt_ids.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140chs.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140deu.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140rus.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_1.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcamp140.dll	msiexec.exe
File created	C:\Windows\system32\mfc140.dll	msiexec.exe
File created	C:\Windows\system32\mfc140esn.dll	msiexec.exe
File created	C:\Windows\system32\mfc140fra.dll	msiexec.exe
File created	C:\Windows\system32\mfc140kor.dll	msiexec.exe
File created	C:\Windows\system32\mfcm140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcruntime140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\concrt140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140cht.dll	msiexec.exe

Drops file in Program Files directory 20 IoCs

description	ioc	Process
File created	C:\Program Files\Gateway\is-4293QNZYQ4.tmp	Gateway Installer.tmp
File created	C:\Program Files\Common Files\VST3\Gateway.vst3\is-STRCKA9AN7.tmp	Gateway Installer.tmp
File opened for modification	C:\Program Files\Common Files\VST3\Gateway.vst3\PlugIn.ico	Gateway Installer.tmp
File created	C:\Program Files\Gateway\is-SJPRFTUAP0.tmp	Gateway Installer.tmp
File created	C:\Program Files\Gateway\is-CXGQGYY5A7.tmp	Gateway Installer.tmp
File opened for modification	C:\Program Files\Gateway\unins000.dat	Gateway Installer.tmp
File opened for modification	C:\Program Files\Gateway\Gateway_x64.exe	Gateway Installer.tmp
File created	C:\Program Files\Gateway\unins000.dat	Gateway Installer.tmp
File opened for modification	C:\Program Files\Common Files\VST3\Gateway.vst3\Desktop.ini	Gateway Installer.tmp
File opened for modification	C:\Program Files\Common Files\VST3\Gateway.vst3	Gateway Installer.tmp
File created	C:\Program Files\Gateway\is-M7HJO8C7L2.tmp	Gateway Installer.tmp
File created	C:\Program Files\Common Files\VST3\Gateway.vst3\Contents\x86_64-win\is-4WP1TACYAA.tmp	Gateway Installer.tmp
File created	C:\Program Files\Common Files\VST3\Gateway.vst3\is-ZC8Y01C7F7.tmp	Gateway Installer.tmp
File created	C:\Program Files\Common Files\VST3\Gateway.vst3\Contents\Resources\is-V8PSYMZI80.tmp	Gateway Installer.tmp
File created	C:\Program Files\Gateway\is-H2GN8022NL.tmp	Gateway Installer.tmp
File created	C:\Program Files\Gateway\is-SZHJ9FF47V.tmp	Gateway Installer.tmp
File created	C:\Program Files\Common Files\VST3\Gateway.vst3\Contents\Resources\is-99EBLGCSRS.tmp	Gateway Installer.tmp
File created	C:\Program Files\Gateway\InstallationLogFile.log	Gateway Installer.tmp
File opened for modification	C:\Program Files\Gateway\readme.rtf	WINWORD.EXE
File created	C:\Program Files\Gateway\~$readme.rtf	WINWORD.EXE

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2480_486401454\classification.js	msedge.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2480_1373629302\edge_autofill_global_block_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2480_1373629302\v1FieldTypes.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2480_1166651351\domain_actions.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2480_1778165063\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2480_1073005510\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2480_1373629302\autofill_bypass_cache_forms.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2480_1373629302\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2480_1073005510\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2480_1407930560\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2480_486401454\travel-facilitated-booking-bing.js	msedge.exe
File created	C:\Windows\SystemTemp\~DFA88E7A677BDF0A82.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2480_1373629302\regex_patterns.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2480_486401454\extraction.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2480_1910794045\deny_domains.list	msedge.exe
File opened for modification	C:\Windows\Installer\e64f689.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{6FA797CF-6B76-4B6D-87EE-768F92008720}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9A4.tmp	msiexec.exe
File created	C:\Windows\Installer\e64f69e.msi	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2480_1160611759\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2480_486401454\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2480_1910794045\deny_full_domains.list	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2480_1160611759\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2480_1784342719\LICENSE	msedge.exe
File opened for modification	C:\Windows\Installer\MSIF87A.tmp	msiexec.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2480_1160611759\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2480_1073005510\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\~DFE0D61A15E11070E1.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2480_1160611759\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2480_1073005510\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2480_1760576389\crl-set	msedge.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\Installer\MSIFA6F.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFEA692EA4F8454A64.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2480_768077705\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2480_768077705\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2480_1784342719\manifest.json	msedge.exe
File opened for modification	C:\Windows\Installer\e64f676.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{931A2CF0-2404-45EA-82F5-345735AE6A90}	msiexec.exe
File created	C:\Windows\SystemTemp\~DFD794E9BCD9E83FB3.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2480_697002124\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2480_1166651351\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2480_1778165063\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2480_1910794045\deny_etld1_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2480_1760576389\manifest.json	msedge.exe
File created	C:\Windows\Installer\e64f689.msi	msiexec.exe
File created	C:\Windows\Installer\e64f676.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFB2838CA2F1859365.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2480_1784342719\_metadata\verified_contents.json	msedge.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\e64f688.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFF9DA328D9BDFC4B1.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2480_486401454\automation.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2480_486401454\travel-facilitated-booking-kayak.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2480_1784342719\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2480_1910794045\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\~DF9CC0DE49527AFFCF.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFAD19AC0934BF1B92.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI751.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2480_697002124\arbitration_metadata.txt	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gateway Installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gateway Installer.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4636	msedge.exe
5180	chrome.exe
4324	msedge.exe

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/2788-0-0x0000000000C90000-0x0000000000D79000-memory.dmp	innosetup
behavioral2/memory/2788-8-0x0000000000C90000-0x0000000000D79000-memory.dmp	innosetup
behavioral2/memory/2788-67-0x0000000000C90000-0x0000000000D79000-memory.dmp	innosetup

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	Taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	Taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	Taskmgr.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 19 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.51,bundle\ = "{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}"	VC_redist.x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0FC2A1394042AE54285F437553EAA609\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\FC797AF667B6D6B478EE67F829007802	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\FC797AF667B6D6B478EE67F829007802\VC_Runtime_Additional	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FC797AF667B6D6B478EE67F829007802\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FC797AF667B6D6B478EE67F829007802\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{336B6873-BAA8-4808-837F-6F71DC3B55FE}	msedge.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8800A266DCF6DD54E97A86760485EA5D\SourceList\Media	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8800A266DCF6DD54E97A86760485EA5D	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0FC2A1394042AE54285F437553EAA609\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0FC2A1394042AE54285F437553EAA609\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{931A2CF0-2404-45EA-82F5-345735AE6A90}v14.51.36247\\packages\\vcRuntimeMinimum_amd64\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14\ = "{6FA797CF-6B76-4B6D-87EE-768F92008720}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14\DisplayName = "Microsoft Visual C++ 2022 X64 Additional Runtime - 14.51.36247"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.51,bundle\Version = "14.51.36247.0"	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FC797AF667B6D6B478EE67F829007802\ProductName = "Microsoft Visual C++ 2022 X64 Additional Runtime - 14.51.36247"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.30,bundle	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\0FC2A1394042AE54285F437553EAA609\VC_Runtime_Minimum	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0FC2A1394042AE54285F437553EAA609\Version = "238259607"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14	VC_redist.x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A567BD6FA501A947AD1F646E53EEC14\SourceList	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14\ = "{931A2CF0-2404-45EA-82F5-345735AE6A90}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\0FC2A1394042AE54285F437553EAA609\Servicing_Key	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A567BD6FA501A947AD1F646E53EEC14\SourceList\Media	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A567BD6FA501A947AD1F646E53EEC14\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\88AAB0B9F51EF1A3CA0C2B609EDD7FC1\FC797AF667B6D6B478EE67F829007802	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.51,bundle\DisplayName = "Microsoft Visual C++ v14 Redistributable (x64) - 14.51.36247"	VC_redist.x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\0FC2A1394042AE54285F437553EAA609	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0FC2A1394042AE54285F437553EAA609\SourceList\PackageName = "vc_runtimeMinimum_x64.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14\Dependents\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FC797AF667B6D6B478EE67F829007802\PackageCode = "7BBAFE5243E5BA648BB1E5A7E34354F7"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14	VC_redist.x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14\Dependents\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}	VC_redist.x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14\Dependents\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0FC2A1394042AE54285F437553EAA609\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.51,bundle\DisplayName = "Microsoft Visual C++ v14 Redistributable (x64) - 14.51.36247"	VC_redist.x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8800A266DCF6DD54E97A86760485EA5D\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14\Version = "14.51.36247"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14\DisplayName = "Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.51.36247"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0FC2A1394042AE54285F437553EAA609\ProductName = "Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.51.36247"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FC797AF667B6D6B478EE67F829007802\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.51,bundle	VC_redist.x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\09A86F63C932FD435BC8463B1035EC53	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\09A86F63C932FD435BC8463B1035EC53\0FC2A1394042AE54285F437553EAA609	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FC797AF667B6D6B478EE67F829007802\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\88AAB0B9F51EF1A3CA0C2B609EDD7FC1	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FC797AF667B6D6B478EE67F829007802\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14	VC_redist.x64.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.51,bundle	VC_redist.x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0FC2A1394042AE54285F437553EAA609\SourceList\Media	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FC797AF667B6D6B478EE67F829007802\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FC797AF667B6D6B478EE67F829007802\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FC797AF667B6D6B478EE67F829007802\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	chrome.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8800A266DCF6DD54E97A86760485EA5D	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\09A86F63C932FD435BC8463B1035EC53	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\0FC2A1394042AE54285F437553EAA609\Provider	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0FC2A1394042AE54285F437553EAA609\PackageCode = "0C8085736BA341746BF212F118CB3024"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14\Version = "14.51.36247"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\FC797AF667B6D6B478EE67F829007802\Provider	msiexec.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
3332	WINWORD.EXE
3332	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5812	Gateway Installer.tmp
5812	Gateway Installer.tmp
2480	msedge.exe
2480	msedge.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
4936	msedge.exe
4936	msedge.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2888	taskmgr.exe
6916	Taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 23 IoCs

pid	Process
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2888	taskmgr.exe
Token: SeSystemProfilePrivilege	2888	taskmgr.exe
Token: SeCreateGlobalPrivilege	2888	taskmgr.exe
Token: SeShutdownPrivilege	3344	chrome.exe
Token: SeCreatePagefilePrivilege	3344	chrome.exe
Token: SeShutdownPrivilege	3344	chrome.exe
Token: SeCreatePagefilePrivilege	3344	chrome.exe
Token: SeShutdownPrivilege	3344	chrome.exe
Token: SeCreatePagefilePrivilege	3344	chrome.exe
Token: SeShutdownPrivilege	3344	chrome.exe
Token: SeCreatePagefilePrivilege	3344	chrome.exe
Token: SeShutdownPrivilege	3344	chrome.exe
Token: SeCreatePagefilePrivilege	3344	chrome.exe
Token: SeShutdownPrivilege	3344	chrome.exe
Token: SeCreatePagefilePrivilege	3344	chrome.exe
Token: SeShutdownPrivilege	3344	chrome.exe
Token: SeCreatePagefilePrivilege	3344	chrome.exe
Token: SeShutdownPrivilege	3344	chrome.exe
Token: SeCreatePagefilePrivilege	3344	chrome.exe
Token: SeShutdownPrivilege	3344	chrome.exe
Token: SeCreatePagefilePrivilege	3344	chrome.exe
Token: SeShutdownPrivilege	3344	chrome.exe
Token: SeCreatePagefilePrivilege	3344	chrome.exe
Token: SeShutdownPrivilege	3344	chrome.exe
Token: SeCreatePagefilePrivilege	3344	chrome.exe
Token: SeShutdownPrivilege	3344	chrome.exe
Token: SeCreatePagefilePrivilege	3344	chrome.exe
Token: SeShutdownPrivilege	3344	chrome.exe
Token: SeCreatePagefilePrivilege	3344	chrome.exe
Token: SeShutdownPrivilege	3344	chrome.exe
Token: SeCreatePagefilePrivilege	3344	chrome.exe
Token: SeShutdownPrivilege	3344	chrome.exe
Token: SeCreatePagefilePrivilege	3344	chrome.exe
Token: SeShutdownPrivilege	3344	chrome.exe
Token: SeCreatePagefilePrivilege	3344	chrome.exe
Token: SeShutdownPrivilege	3344	chrome.exe
Token: SeCreatePagefilePrivilege	3344	chrome.exe
Token: SeShutdownPrivilege	3344	chrome.exe
Token: SeCreatePagefilePrivilege	3344	chrome.exe
Token: SeShutdownPrivilege	3344	chrome.exe
Token: SeCreatePagefilePrivilege	3344	chrome.exe
Token: SeShutdownPrivilege	3344	chrome.exe
Token: SeCreatePagefilePrivilege	3344	chrome.exe
Token: SeShutdownPrivilege	3344	chrome.exe
Token: SeCreatePagefilePrivilege	3344	chrome.exe
Token: SeShutdownPrivilege	3344	chrome.exe
Token: SeCreatePagefilePrivilege	3344	chrome.exe
Token: SeShutdownPrivilege	3344	chrome.exe
Token: SeCreatePagefilePrivilege	3344	chrome.exe
Token: SeShutdownPrivilege	3344	chrome.exe
Token: SeCreatePagefilePrivilege	3344	chrome.exe
Token: SeShutdownPrivilege	3344	chrome.exe
Token: SeCreatePagefilePrivilege	3344	chrome.exe
Token: SeShutdownPrivilege	3344	chrome.exe
Token: SeCreatePagefilePrivilege	3344	chrome.exe
Token: SeShutdownPrivilege	3344	chrome.exe
Token: SeCreatePagefilePrivilege	3344	chrome.exe
Token: SeShutdownPrivilege	3344	chrome.exe
Token: SeCreatePagefilePrivilege	3344	chrome.exe
Token: SeShutdownPrivilege	3344	chrome.exe
Token: SeCreatePagefilePrivilege	3344	chrome.exe
Token: SeShutdownPrivilege	3344	chrome.exe
Token: SeCreatePagefilePrivilege	3344	chrome.exe
Token: SeShutdownPrivilege	3344	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5812	Gateway Installer.tmp
3352	msedge.exe
3352	msedge.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe

Suspicious use of SetWindowsHookEx 28 IoCs

pid	Process
3332	WINWORD.EXE
3332	WINWORD.EXE
3332	WINWORD.EXE
3332	WINWORD.EXE
3332	WINWORD.EXE
3332	WINWORD.EXE
3332	WINWORD.EXE
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
5788	msiexec.exe
2888	taskmgr.exe
2888	taskmgr.exe
2888	taskmgr.exe
6916	Taskmgr.exe
6916	Taskmgr.exe
6916	Taskmgr.exe
6916	Taskmgr.exe
6916	Taskmgr.exe
6916	Taskmgr.exe
6916	Taskmgr.exe
6916	Taskmgr.exe
6916	Taskmgr.exe
6916	Taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2788 wrote to memory of 5812	2788	Gateway Installer.exe	94
PID 5812 wrote to memory of 3332	5812	Gateway Installer.tmp	95
PID 3352 wrote to memory of 3704	3352	msedge.exe	110
PID 3352 wrote to memory of 4324	3352	msedge.exe	111
PID 3352 wrote to memory of 3920	3352	msedge.exe	112
PID 3352 wrote to memory of 3920	3352	msedge.exe	112
PID 3352 wrote to memory of 3920	3352	msedge.exe	112
PID 3352 wrote to memory of 4412	3352	msedge.exe	114
PID 3352 wrote to memory of 4412	3352	msedge.exe	114
PID 3352 wrote to memory of 5928	3352	msedge.exe	115
PID 3352 wrote to memory of 4340	3352	msedge.exe	116
PID 3352 wrote to memory of 5928	3352	msedge.exe	115
PID 3352 wrote to memory of 5928	3352	msedge.exe	115
PID 3352 wrote to memory of 4340	3352	msedge.exe	116
PID 3352 wrote to memory of 4340	3352	msedge.exe	116
PID 3352 wrote to memory of 3452	3352	msedge.exe	117
PID 3352 wrote to memory of 1080	3352	msedge.exe	118
PID 3352 wrote to memory of 3452	3352	msedge.exe	117
PID 3352 wrote to memory of 3452	3352	msedge.exe	117
PID 3352 wrote to memory of 1080	3352	msedge.exe	118
PID 3352 wrote to memory of 1080	3352	msedge.exe	118
PID 3352 wrote to memory of 2360	3352	msedge.exe	121
PID 3352 wrote to memory of 2360	3352	msedge.exe	121
PID 3352 wrote to memory of 2360	3352	msedge.exe	121
PID 3352 wrote to memory of 4556	3352	msedge.exe	122
PID 3352 wrote to memory of 4556	3352	msedge.exe	122
PID 3352 wrote to memory of 3832	3352	msedge.exe	123
PID 3352 wrote to memory of 3832	3352	msedge.exe	123
PID 3352 wrote to memory of 3832	3352	msedge.exe	123
PID 3352 wrote to memory of 3916	3352	msedge.exe	124
PID 3352 wrote to memory of 4748	3352	msedge.exe	125
PID 3352 wrote to memory of 3916	3352	msedge.exe	124
PID 3352 wrote to memory of 4748	3352	msedge.exe	125
PID 3352 wrote to memory of 1584	3352	msedge.exe	127
PID 3352 wrote to memory of 5488	3352	msedge.exe	130
PID 3352 wrote to memory of 5488	3352	msedge.exe	130
PID 3352 wrote to memory of 5352	3352	msedge.exe	131
PID 3352 wrote to memory of 5352	3352	msedge.exe	131
PID 3352 wrote to memory of 2480	3352	msedge.exe	132
PID 2480 wrote to memory of 1924	2480	msedge.exe	133
PID 2480 wrote to memory of 5496	2480	msedge.exe	135
PID 2480 wrote to memory of 4636	2480	msedge.exe	136
PID 2480 wrote to memory of 5496	2480	msedge.exe	135
PID 2480 wrote to memory of 5496	2480	msedge.exe	135
PID 2480 wrote to memory of 5948	2480	msedge.exe	137
PID 2480 wrote to memory of 5948	2480	msedge.exe	137
PID 2480 wrote to memory of 3196	2480	msedge.exe	139
PID 2480 wrote to memory of 4688	2480	msedge.exe	140
PID 2480 wrote to memory of 5604	2480	msedge.exe	141
PID 2480 wrote to memory of 4100	2480	msedge.exe	142
PID 2480 wrote to memory of 1028	2480	msedge.exe	145
PID 2480 wrote to memory of 1028	2480	msedge.exe	145
PID 2480 wrote to memory of 5040	2480	msedge.exe	146
PID 2480 wrote to memory of 5040	2480	msedge.exe	146
PID 2480 wrote to memory of 6072	2480	msedge.exe	152
PID 2480 wrote to memory of 6072	2480	msedge.exe	152
PID 3716 wrote to memory of 3360	3716	cmd.exe	153
PID 3716 wrote to memory of 3192	3716	cmd.exe	154
PID 2480 wrote to memory of 4936	2480	msedge.exe	158
PID 2480 wrote to memory of 1468	2480	msedge.exe	159
PID 2480 wrote to memory of 1468	2480	msedge.exe	159
PID 2480 wrote to memory of 5924	2480	msedge.exe	160
PID 2480 wrote to memory of 5924	2480	msedge.exe	160
PID 2480 wrote to memory of 4728	2480	msedge.exe	161

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\Gateway-v1.0.1-win.zip
1⤵
PID:5676

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3308

C:\Users\Admin\AppData\Local\Temp\05b87d05-9850-4354-85e5-b0789e2d5ccf_Gateway-v1.0.1-win.zip.ccf\Gateway Installer.exe
"C:\Users\Admin\AppData\Local\Temp\05b87d05-9850-4354-85e5-b0789e2d5ccf_Gateway-v1.0.1-win.zip.ccf\Gateway Installer.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2788
- C:\Users\Admin\AppData\Local\Temp\is-OZPXSFMZFS.tmp\Gateway Installer.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-OZPXSFMZFS.tmp\Gateway Installer.tmp" /SL5="$C014A,3360457,893952,C:\Users\Admin\AppData\Local\Temp\05b87d05-9850-4354-85e5-b0789e2d5ccf_Gateway-v1.0.1-win.zip.ccf\Gateway Installer.exe"
  2⤵
  - Executes dropped EXE
  - Drops desktop.ini file(s)
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5812
- - C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Program Files\Gateway\readme.rtf" /o ""
    3⤵
    - Drops file in Program Files directory
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious use of SetWindowsHookEx
    PID:3332

C:\Program Files\Gateway\Gateway_x64.exe
"C:\Program Files\Gateway\Gateway_x64.exe"
1⤵
- Executes dropped EXE
PID:4432

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4492

C:\Program Files\Gateway\Gateway_x64.exe
"C:\Program Files\Gateway\Gateway_x64.exe"
1⤵
- Executes dropped EXE
PID:2324

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Program Files\Gateway\NeuralAmpModeler manual.pdf
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ffb4f68c188,0x7ffb4f68c194,0x7ffb4f68c1a0
  2⤵
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2064,i,17634695766040087313,10964307726067427422,524288 --field-trial-handle=2436,i,10507792842520782044,9242241568806421470,262144 --variations-seed-version --mojo-platform-channel-handle=2496 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1988,i,7737884258613316966,13995842543603512625,262144 --field-trial-handle=2436,i,10507792842520782044,9242241568806421470,262144 --variations-seed-version --mojo-platform-channel-handle=2432 /prefetch:2
  2⤵
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2460,i,11351009218230936876,4938379901096237092,524288 --field-trial-handle=2436,i,10507792842520782044,9242241568806421470,262144 --variations-seed-version --mojo-platform-channel-handle=3028 /prefetch:13
  2⤵
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3588,i,9418421242725184446,7212410009239537474,2097152 --field-trial-handle=2436,i,10507792842520782044,9242241568806421470,262144 --variations-seed-version --mojo-platform-channel-handle=3832 /prefetch:1
  2⤵
  PID:5928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3596,i,16712760865528511514,16408758672043304088,2097152 --field-trial-handle=2436,i,10507792842520782044,9242241568806421470,262144 --variations-seed-version --mojo-platform-channel-handle=3848 /prefetch:1
  2⤵
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4288,i,8441626209434893999,12109523905156280402,2097152 --field-trial-handle=2436,i,10507792842520782044,9242241568806421470,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:1
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4300,i,14076368794250581813,7014897952615068378,2097152 --field-trial-handle=2436,i,10507792842520782044,9242241568806421470,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:9
  2⤵
  PID:1080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --init-isolate-as-foreground --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4876,i,3100916097747659816,8361257667346325495,2097152 --field-trial-handle=2436,i,10507792842520782044,9242241568806421470,262144 --variations-seed-version --mojo-platform-channel-handle=3992 /prefetch:9
  2⤵
  PID:2360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5392,i,10101152876723248980,11121874405648111108,524288 --field-trial-handle=2436,i,10507792842520782044,9242241568806421470,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:14
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5644,i,17827823557178759908,15484570874707424718,2097152 --field-trial-handle=2436,i,10507792842520782044,9242241568806421470,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:15
  2⤵
  PID:3832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5800,i,15215242208965204793,3166569828794590250,524288 --field-trial-handle=2436,i,10507792842520782044,9242241568806421470,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:14
  2⤵
  PID:3916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5656,i,10824076591804527905,11832574596404661213,524288 --field-trial-handle=2436,i,10507792842520782044,9242241568806421470,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:14
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6500,i,9484354472863372808,13773014490113006723,524288 --field-trial-handle=2436,i,10507792842520782044,9242241568806421470,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:14
  2⤵
  PID:5880
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6500,i,9484354472863372808,13773014490113006723,524288 --field-trial-handle=2436,i,10507792842520782044,9242241568806421470,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:14
  2⤵
  PID:1584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6700,i,16580531674816450097,15709374429964814087,524288 --field-trial-handle=2436,i,10507792842520782044,9242241568806421470,262144 --variations-seed-version --mojo-platform-channel-handle=6696 /prefetch:14
  2⤵
  PID:5488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7020,i,3678304019628902087,7798674326920546204,524288 --field-trial-handle=2436,i,10507792842520782044,9242241568806421470,262144 --variations-seed-version --mojo-platform-channel-handle=6716 /prefetch:14
  2⤵
  PID:5352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2480
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x270,0x7ffb4f68c188,0x7ffb4f68c194,0x7ffb4f68c1a0
    3⤵
    PID:1924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1928,i,16069146051780120440,9244209390726663568,262144 --field-trial-handle=2716,i,11909493535136899572,5394925767473423705,262144 --variations-seed-version --mojo-platform-channel-handle=2712 /prefetch:2
    3⤵
    PID:5496
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2152,i,7693068161097336308,15436962858407613086,524288 --field-trial-handle=2716,i,11909493535136899572,5394925767473423705,262144 --variations-seed-version --mojo-platform-channel-handle=2828 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2468,i,3800411787768829711,15438222336790247242,524288 --field-trial-handle=2716,i,11909493535136899572,5394925767473423705,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:13
    3⤵
    PID:5948
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4416,i,9895305072942574940,10543806671834758104,524288 --field-trial-handle=2716,i,11909493535136899572,5394925767473423705,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:14
    3⤵
    PID:5356
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4416,i,9895305072942574940,10543806671834758104,524288 --field-trial-handle=2716,i,11909493535136899572,5394925767473423705,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:14
    3⤵
    PID:3196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1224,i,11731906447599769047,7533532077068201549,524288 --field-trial-handle=2716,i,11909493535136899572,5394925767473423705,262144 --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:14
    3⤵
    PID:4688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1228,i,3699997256581606273,10082368543258690785,524288 --field-trial-handle=2716,i,11909493535136899572,5394925767473423705,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:14
    3⤵
    PID:5604
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1232,i,17197933024119669251,12339885731159291243,524288 --field-trial-handle=2716,i,11909493535136899572,5394925767473423705,262144 --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:14
    3⤵
    PID:4100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4924,i,12305742283529607338,7376859399280381447,524288 --field-trial-handle=2716,i,11909493535136899572,5394925767473423705,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:14
    3⤵
    PID:1028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5000,i,4236233570706470660,8244533750534693593,524288 --field-trial-handle=2716,i,11909493535136899572,5394925767473423705,262144 --variations-seed-version --mojo-platform-channel-handle=4992 /prefetch:14
    3⤵
    PID:5040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=816,i,6951600026318945326,3606357059602755299,524288 --field-trial-handle=2716,i,11909493535136899572,5394925767473423705,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:14
    3⤵
    PID:6072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4256,i,4649712513506558730,11616951839209453355,262144 --field-trial-handle=2716,i,11909493535136899572,5394925767473423705,262144 --variations-seed-version --mojo-platform-channel-handle=1432 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5060,i,1432300719479763122,5321458612327036893,524288 --field-trial-handle=2716,i,11909493535136899572,5394925767473423705,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:14
    3⤵
    PID:1468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3952,i,717456645394169503,5161837643960823840,524288 --field-trial-handle=2716,i,11909493535136899572,5394925767473423705,262144 --variations-seed-version --mojo-platform-channel-handle=3956 /prefetch:14
    3⤵
    PID:5924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5024,i,2007669112427926707,17190392937423294374,524288 --field-trial-handle=2716,i,11909493535136899572,5394925767473423705,262144 --variations-seed-version --mojo-platform-channel-handle=2960 /prefetch:14
    3⤵
    PID:4728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4148,i,12585430423257794569,7373619829295124718,524288 --field-trial-handle=2716,i,11909493535136899572,5394925767473423705,262144 --variations-seed-version --mojo-platform-channel-handle=3880 /prefetch:14
    3⤵
    PID:5420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2964,i,8929427032706032732,15072882466542361441,524288 --field-trial-handle=2716,i,11909493535136899572,5394925767473423705,262144 --variations-seed-version --mojo-platform-channel-handle=4692 /prefetch:14
    3⤵
    PID:2668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1432,i,9888261812129948922,2153771792189624839,524288 --field-trial-handle=2716,i,11909493535136899572,5394925767473423705,262144 --variations-seed-version --mojo-platform-channel-handle=5016 /prefetch:14
    3⤵
    PID:3580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5292,i,14734644493324941185,13895345477756030646,524288 --field-trial-handle=2716,i,11909493535136899572,5394925767473423705,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:14
    3⤵
    PID:2908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3544,i,1748461454278780330,16933463779529706914,524288 --field-trial-handle=2716,i,11909493535136899572,5394925767473423705,262144 --variations-seed-version --mojo-platform-channel-handle=2964 /prefetch:14
    3⤵
    PID:4124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5008,i,1684787564503684701,12120521700869324808,524288 --field-trial-handle=2716,i,11909493535136899572,5394925767473423705,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:14
    3⤵
    PID:5792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5060,i,8803014444041944536,280717617808586532,524288 --field-trial-handle=2716,i,11909493535136899572,5394925767473423705,262144 --variations-seed-version --mojo-platform-channel-handle=3852 /prefetch:14
    3⤵
    PID:5132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5420,i,8257395530362493025,249563864422651819,524288 --field-trial-handle=2716,i,11909493535136899572,5394925767473423705,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:14
    3⤵
    PID:4044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3544,i,3203087327630516772,4456174879141065832,524288 --field-trial-handle=2716,i,11909493535136899572,5394925767473423705,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:14
    3⤵
    PID:6676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5416,i,7673863215399901517,12360787538053190664,524288 --field-trial-handle=2716,i,11909493535136899572,5394925767473423705,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:14
    3⤵
    PID:1428

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5348

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:792

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1564

C:\Program Files\Gateway\Gateway_x64.exe
"C:\Program Files\Gateway\Gateway_x64.exe"
1⤵
- Executes dropped EXE
PID:4624

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3716
- C:\Program Files\Gateway\Gateway_x64.exe
  Gateway_x64.exe
  2⤵
  - Executes dropped EXE
  PID:3360
- C:\Program Files\Gateway\Gateway_x64.exe
  Gateway_x64.exe
  2⤵
  - Executes dropped EXE
  PID:3192

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2888

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:5180

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
PID:3344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffb61e8c728,0x7ffb61e8c734,0x7ffb61e8c740
  2⤵
  PID:5992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1624,i,4093474154506117418,1550470028988433714,262144 --field-trial-handle=1992,i,13162579794920410810,9998485957942988480,262144 --variations-seed-version --mojo-platform-channel-handle=1984 /prefetch:2
  2⤵
  PID:2372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1492,i,17171049987183984000,4231735814178495113,524288 --field-trial-handle=1992,i,13162579794920410810,9998485957942988480,262144 --variations-seed-version --mojo-platform-channel-handle=2124 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:5180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2288,i,6189886432660647216,3789517718423550035,524288 --field-trial-handle=1992,i,13162579794920410810,9998485957942988480,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:13
  2⤵
  PID:1888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3428,i,15542368755383311479,16304817294864700896,2097152 --field-trial-handle=1992,i,13162579794920410810,9998485957942988480,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:5352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3248,i,14934242774828916987,10819313747150848590,2097152 --field-trial-handle=1992,i,13162579794920410810,9998485957942988480,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:4948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4688,i,13169128497244686637,1271009032471593916,2097152 --field-trial-handle=1992,i,13162579794920410810,9998485957942988480,262144 --variations-seed-version --mojo-platform-channel-handle=4700 /prefetch:1
  2⤵
  PID:5788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4844,i,16621033221412962159,16695630679142554764,524288 --field-trial-handle=1992,i,13162579794920410810,9998485957942988480,262144 --variations-seed-version --mojo-platform-channel-handle=4832 /prefetch:14
  2⤵
  PID:3068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4884,i,7826460264754727820,11056493213164806097,524288 --field-trial-handle=1992,i,13162579794920410810,9998485957942988480,262144 --variations-seed-version --mojo-platform-channel-handle=4992 /prefetch:14
  2⤵
  PID:1256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5032,i,4627184650743493517,2457676765106070983,524288 --field-trial-handle=1992,i,13162579794920410810,9998485957942988480,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:14
  2⤵
  PID:2532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5396,i,8220610315482626858,2224167619693917704,524288 --field-trial-handle=1992,i,13162579794920410810,9998485957942988480,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:14
  2⤵
  PID:1288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5484,i,16661355327491546973,1290038428627935141,2097152 --field-trial-handle=1992,i,13162579794920410810,9998485957942988480,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:1
  2⤵
  PID:5428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5508,i,6589725121633966283,12832010445300195377,2097152 --field-trial-handle=1992,i,13162579794920410810,9998485957942988480,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:1
  2⤵
  PID:4152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5484,i,962278718020861982,13358693086834333325,524288 --field-trial-handle=1992,i,13162579794920410810,9998485957942988480,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:14
  2⤵
  PID:5792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5828,i,9746983743545294107,9498665707550895999,2097152 --field-trial-handle=1992,i,13162579794920410810,9998485957942988480,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:1
  2⤵
  PID:4880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5972,i,14490566961407718212,12105264199656094102,2097152 --field-trial-handle=1992,i,13162579794920410810,9998485957942988480,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:1
  2⤵
  PID:4388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6040,i,16515176460684646992,4287259627499396172,2097152 --field-trial-handle=1992,i,13162579794920410810,9998485957942988480,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:4528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6456,i,2208781841905455580,9954166531997773849,2097152 --field-trial-handle=1992,i,13162579794920410810,9998485957942988480,262144 --variations-seed-version --mojo-platform-channel-handle=4828 /prefetch:1
  2⤵
  PID:3760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5688,i,9274343994363923428,11990854250493731955,524288 --field-trial-handle=1992,i,13162579794920410810,9998485957942988480,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:14
  2⤵
  PID:6124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5604,i,10528169504388576263,10670458635879677886,2097152 --field-trial-handle=1992,i,13162579794920410810,9998485957942988480,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:1
  2⤵
  PID:5916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6296,i,9058985844846878183,2766143770391061819,2097152 --field-trial-handle=1992,i,13162579794920410810,9998485957942988480,262144 --variations-seed-version --mojo-platform-channel-handle=6456 /prefetch:1
  2⤵
  PID:5808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6092,i,6331054161283018640,10846174911165943810,2097152 --field-trial-handle=1992,i,13162579794920410810,9998485957942988480,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:1
  2⤵
  PID:3108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3224,i,12350453792822015947,777977365834233202,524288 --field-trial-handle=1992,i,13162579794920410810,9998485957942988480,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:14
  2⤵
  PID:1728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=4816,i,8760946778284348333,9629445765202056093,2097152 --field-trial-handle=1992,i,13162579794920410810,9998485957942988480,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:1
  2⤵
  PID:1468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=4800,i,7367550909004439652,17670609680823206625,2097152 --field-trial-handle=1992,i,13162579794920410810,9998485957942988480,262144 --variations-seed-version --mojo-platform-channel-handle=4812 /prefetch:9
  2⤵
  PID:3120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=6568,i,1860372667166748410,4593660236277834679,2097152 --field-trial-handle=1992,i,13162579794920410810,9998485957942988480,262144 --variations-seed-version --mojo-platform-channel-handle=4732 /prefetch:1
  2⤵
  PID:3116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=4772,i,17207520826852232670,6760167230985078910,2097152 --field-trial-handle=1992,i,13162579794920410810,9998485957942988480,262144 --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:1
  2⤵
  PID:2344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=3460,i,8085423882274712175,8655852965121821327,2097152 --field-trial-handle=1992,i,13162579794920410810,9998485957942988480,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:4320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4812,i,859763426915976145,9915444660804357189,524288 --field-trial-handle=1992,i,13162579794920410810,9998485957942988480,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:14
  2⤵
  PID:5100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4776,i,16893513666972904933,3563786797147918723,524288 --field-trial-handle=1992,i,13162579794920410810,9998485957942988480,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:14
  2⤵
  PID:1600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5788,i,1279675085146474430,16083607702564660051,524288 --field-trial-handle=1992,i,13162579794920410810,9998485957942988480,262144 --variations-seed-version --mojo-platform-channel-handle=4812 /prefetch:14
  2⤵
  PID:6064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4752,i,11097091740750684477,16267422189721391067,524288 --field-trial-handle=1992,i,13162579794920410810,9998485957942988480,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:14
  2⤵
  PID:2776
- C:\Users\Admin\Downloads\VC_redist.x64.exe
  "C:\Users\Admin\Downloads\VC_redist.x64.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4244
- - C:\Windows\Temp\{AA6BDFCD-3F62-4F96-9409-E3CEDA1F5B01}\.cr\VC_redist.x64.exe
    "C:\Windows\Temp\{AA6BDFCD-3F62-4F96-9409-E3CEDA1F5B01}\.cr\VC_redist.x64.exe" -burn.clean.room="C:\Users\Admin\Downloads\VC_redist.x64.exe" -burn.filehandle.attached=748 -burn.filehandle.self=752
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:260
  - - C:\Windows\Temp\{D138DDAD-8023-4DBA-B6B3-7AB23A18C807}\.be\VC_redist.x64.exe
      "C:\Windows\Temp\{D138DDAD-8023-4DBA-B6B3-7AB23A18C807}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{5670D44C-60CF-457D-8612-E3E2E8CF80D8} {4B7A508E-361E-4EE4-A6CE-0B848B11C9FD} 260
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:6124
    - - C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={0e3bb569-69d6-4c34-bff9-c2f81db5e5f0} -burn.filehandle.self=1204 -burn.embedded BurnPipe.{DC69EF0A-D477-4957-9921-C16D39AC725B} {4341FEC0-BC8A-44DE-9C77-9DDF3D39024F} 6124
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3340
      - C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=556 -burn.filehandle.self=576 -uninstall -quiet -burn.related.upgrade -burn.ancestors={0e3bb569-69d6-4c34-bff9-c2f81db5e5f0} -burn.filehandle.self=1204 -burn.embedded BurnPipe.{DC69EF0A-D477-4957-9921-C16D39AC725B} {4341FEC0-BC8A-44DE-9C77-9DDF3D39024F} 6124
        6⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:4848
        
        C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{6AA5323C-F165-41E2-9A07-BD28C706C3B0} {5A9A53E0-6F01-4B30-9E11-2B92CF8D20C4} 4848
        7⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3560

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3924

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4760

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:4752

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:1028

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5788

C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe
"C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe" /burn.runonce
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2556
- C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe
  "C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260710011750.log"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4016
- - C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe
    "C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe" -burn.filehandle.attached=576 -burn.filehandle.self=596 /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260710011750.log"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:4152
  - - C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe
      "C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{ECEC04CA-67BC-4BBE-A41A-CAE5872DEC36} {0B45FA29-5172-445A-8194-B18C585952E9} 4152
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:5132

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{F32D97DF-E3E5-4CB9-9E3E-0EB5B4E49801}
1⤵
PID:3560

C:\Program Files\Gateway\Gateway_x64.exe
"C:\Program Files\Gateway\Gateway_x64.exe"
1⤵
- Executes dropped EXE
PID:3948

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe"
1⤵
PID:6608
- C:\Windows\system32\Taskmgr.exe
  taskmgr.exe
  2⤵
  PID:6780
- C:\Windows\system32\Taskmgr.exe
  taskmgr.exe
  2⤵
  - Loads dropped DLL
  - Checks SCSI registry key(s)
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:6916

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e64f67b.rbs

Path C:\Config.Msi\e64f67b.rbs
Size 19KB
SHA256 6ba9389f348ea99d3426cadc6234579fdac68040998088da516ae849dd7e68a4
MD5 9967483584754d8fd0499ad33536bed5
SHA1 10a8a9700c54649cb245431ce47031a71f248c45
SHA512 45790a04e9a97ee0f8950f26dd506bb4a1466d0753525414aace69e780dfd479040b14817fc8aab077c932c943e02ad4b4cc8ee7ba3a041545ed5563b79ee690
SSDEEP 192:lpRR1kRx15dXcFUADIc1f+W+y4+ogPDnI67:lpRR6RxTeC81f/con7
TLSH
T117920C426A80C9E2D8766B30CD635F653B76DBD5A350438B50DC90348F93BCA2F9D68E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e64f687.rbs

Path C:\Config.Msi\e64f687.rbs
Size 19KB
SHA256 d159c68813bf393cf63d22258d01babea9b9cfe52d152111e92f428955a7a6cd
MD5 a950ef6d505b5961a501aa5c0950dc99
SHA1 b5ea1fab61d7a66718b796baca3dddc42630c61d
SHA512 59973352375797a85369cffb73876cb7e69bc4bb8cad8bfddde45bb75dcf0dbab0de40b5cbeecddf18f224865283914912197d0a793147ff9b373298f4d62455
SSDEEP 384:lshpsucPI+wHORW6VrhiIR1Jk4JkjLP2F:lshpsucPI+wHORW61MIFPUiF
TLSH
T123921D01BA44C5E3D4A62B30EE5B27243B35D7D9A721674B84DCC1308F877C5AF9E68A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e64f68e.rbs

Path C:\Config.Msi\e64f68e.rbs
Size 21KB
SHA256 0347c788b04c230eb7c496259f07e3c247edfa16d4fe3cf249c91e8e97fe1305
MD5 ce0c9f6e55b506967d3fc92781742b66
SHA1 56af47bce26ee5dc1d1b46040c97ad2b0c1cad04
SHA512 a675b0240c8588439d21b651b28be8d3af23bd9cf67f6f06afc71c7009054edd7f7d4b149d0b6447dde79b28d52c72325d967412dbd1a97479901257bcbd491c
SSDEEP 384:ZCRxGRAnAKxNAUhUC7xJjrMNYPzIbSf4gQvWGxi7inhkP:ZSQwAKhkmf
TLSH
T1E7A21C03768099E3D86627B1CD671BA83B32D7D99350434B10ECD1384F633D76E9AA9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e64f69d.rbs

Path C:\Config.Msi\e64f69d.rbs
Size 21KB
SHA256 d71ad03447534112d30cf6530b374c56066c63799b1b15500549ee9fa1751857
MD5 6a80a57b344cb9ec6a6459da46ab65ce
SHA1 8fef2aee7fb1288ddd1594d31f8b857f93c8dc02
SHA512 9af99f6b67b22579250ab825adaf0653ac7e49780b636a0ccc3b6e94b6604457cb0b78d539434b3b603a0ee643d730fa85c97edf65ffc95b5824b24860e62532
SSDEEP 384:ZJOphE89gMipMzZjr4/mU7salckU72eC6RKK5saMgVJ94J9C60esUp:ZJOphE89gMipMzZ3umUVKianQw60/0
TLSH
T19AA2B902BA049593D8A72B70DD9B4B143BBAD3D99791534B04CDC0305E837DB2FDEA9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Gateway_x64.exe

Path C:\Program Files\Gateway\Gateway_x64.exe
Size 3.3MB
SHA256 0e77f36c23fe945f93e7542c80778fc7df9e8b2ddd4d50e1d295d8f24d7b3e5f
MD5 be852867d4bc651fe49e35f188ca0db0
SHA1 03c702f35c2b7952121184ce78da534c2f52ce49
SHA512 43d18edbab32ec947ccfa85076bbd8cdf6459a0ebc1b3631685b30cb93b82e4995913d039f43347f385db6012611acf3cf6fce71fb5b6a7f06d12eba8993bea6
SSDEEP 49152:4WLMkWuToZtZgTBpJzpqRLtQfd3ltUCNfxcYqMCw7MjwLQSVhXfm4aEa:nndLUCNfxcYqMXLa3Ea
TLSH
T1EEF5E116F3A581FCD02BD178DA5A961BFB71780503209BDF12E00AA65F67BE10E7B361
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NeuralAmpModeler manual.pdf

Path C:\Program Files\Gateway\NeuralAmpModeler manual.pdf
Size 7KB
SHA256 58af5e8b27a909d8a070b009dec1a5b20af35ea9aa59d78a10cddf589e48a031
MD5 ee05ebbb3276ee5006a7cfecbe071345
SHA1 e838c8404e370e62466e1096d51472e83d8888a6
SHA512 d1d5f9cc13d518d7a28d892849e159888bebfa2914f63933cb92858441b5a3e185396804088501805ba2e8a0ce26cbd5f1c703ba40131ceec1142d17b6441111
SSDEEP 192:V0KWSNApsCmr2QUxjXjTvujWame+kpDZlRL4qelOH:PviQUxjXjLujWwp9lfelOH
TLSH
T105F14CB5DCAD5C8DFD86C502963E346A477DB23372C528C24C2C0B46E062588EDA7AF7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ThirdPartyNotices.txt

Path C:\Program Files\Gateway\ThirdPartyNotices.txt
Size 20KB
SHA256 3fd8dec280ce1a4428d8a34fa725c3512297f6cae4ba2bd129d670fbff53cec8
MD5 c4b2b71a4dbf89ae9ae71d659880e43a
SHA1 c2d73ad011c2496435a9ec6f2bc21698f80873f5
SHA512 45f36999d6133467238ef1956ddb7eb647197da72acffd9af8b603be9089188ea8a3ef2f583c8235bb961209cf4d0ea8f3798aa7dc7efb2bdf4daab7a8ade14b
SSDEEP 384:KijYYhNYYNYZLYOjYAYhv1KHHR8JqYN+mpSf9Y+vYCTY/QmI:KA0rsh95Bf1H/QmI
TLSH
T15C92961F7F5A437218D2C3A52559ACC5F22BB15E7B5F1684306EE24D237701886FF868
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

readme.rtf

Path C:\Program Files\Gateway\readme.rtf
Size 823B
SHA256 1129848116a17cb651001245854368dbaae604ce8c2be7ea459fdac9f3f8de08
MD5 306e82cfc6483f7f778a079951edaafc
SHA1 2afde345a695dd582b02ee8a9dedab40cc58ae1a
SHA512 9b6728232919edd7aa936014b3240c668133120612615210881878c6ff766038b097bbfa024f3cdf148a31798646a633645a64473a67775d190ac9752e04081c
TLSH
T1BD01EFF3CE0040A80FA462629DFA44C9A7A64791FDB8FCC9A6B318A4692C5F97117844
MD5 SHA1 SHA512 TLSH

Submit Download

F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

Path C:\Users\Admin\AppData\Local\D3DSCache\b2f445235d7531f3\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
Size 4B
SHA256 7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba
MD5 f49655f856acb8884cc0ace29216f511
SHA1 cb0f1f87ec0455ec349aaa950c600475ac7b7b6b
SHA512 599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8
MD5 SHA1 SHA512

Submit Download

settings.ini

Path C:\Users\Admin\AppData\Local\Gateway\settings.ini
Size 168B
SHA256 038b85ee98c7e033e9029367849509bcf3f17f3438143e78cb68b72c6d3aa05f
MD5 5c8b8c568c15c655200f5a9b5af211e5
SHA1 8250439491e2c5ebe0d75754ef69751c884d338d
SHA512 a81592bf92017f3d2bc0633c3e4dde680ad297416579b9b765baa080eee69293588ffc8e2864d41db9e2cc5ffa674926aadfd74a8086630db7a0ba7c95ef2c67
TLSH
T1B3C08C40570CEE0C0A7271303C3F2320B0CB2A1CA29AD13D0008CC286C40103853FA5D
MD5 SHA1 SHA512 TLSH

Submit Download

5977ed02-6655-42a7-b9cd-c31ca5281ad1.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\5977ed02-6655-42a7-b9cd-c31ca5281ad1.tmp
Size 12KB
SHA256 e3e1b30e5868aa17bd175954cbc9d3aed795a659b511ccfcd3750f27ea27f959
MD5 d981ab34684d690430afc5f23aff881b
SHA1 d9aa6c85a1011c33f9c03793c9f94d2b596b6e0b
SHA512 5c802b6af9e55a91c1a31396c5321956fede762dbca1e6fffd12cd6cf447b4a7a2c21df195099ed065832d0f7b30333255f005d8ce0655efa293422cb063793e
SSDEEP 192:dRHcBz2b483v7s4PRpBEgSx964Hsb+WNwExgXP2KXB+iXp2yCMPyIsnAUgE:dRHmz0tfZXabwePTBDp2v+E
TLSH
T12342962FB9645A7B6DD6D219F9217B97E3F5102225E02E44E7FC8A2C12E76CC3213417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 360B
SHA256 0914765875ede77fe652c47568e820910c0f268e69e34d53fa000957f54188f7
MD5 768e2f8e74472309baa65efe2bffb8df
SHA1 416d5f032ad4ed2b376286ac4f0d0aa292c549f5
SHA512 84e4c813d884391106adb8cc383639951c57175d85e57612bb3d55c6c08842ae72fdf5ba61a1d5b42bd2681e49215fa039d2ae8324a2b32bde6364ac2090a766
TLSH
T1C4E02BB1309D679BCB84417115578DBC65B0EB7C0B801252D241D0BFD1A30F74DA2BB5
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 0180cc7dcfa7d8eeb52cf68dc901fafad93454902794215d46392276ff23eec6
MD5 c8024872a061ba558287f2b87bf7d6a0
SHA1 3fbb6436911500e8fd7c67a99f7795839fb6910a
SHA512 8b5e2886a6e3dce12bae672f3963d264ccef623bc567c2eb9cdba0db501ff64b87e40fde8521223403e8202c445d52c2b48a4f0e6c4cee0acbdcc874beb018be
SSDEEP 96:DXM9ZmUkSBsgZJvPcTA1eummPmIzzhO5dYK:DX+EtSBsgZJvPcTA1eumm+IztO5mK
TLSH
T129C18DFBC3D8862D891156F89B156F1FCE2E0A14432C3C36C8D8BE5B93E2872D21165E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 857B
SHA256 cfe08252833fac332247c1ee293b0c76121df4e5804c4fc626132c29ca7dd3c2
MD5 80364bb621df44830ab7a899ad10837a
SHA1 70b3c879c843b315f0fa253a7cb35a5bb5c8e978
SHA512 d42ed310073e8a5680fa8d261f91c5f206c99ba371dfdebe8879ddedeaab633c9ba8bac06f46fcf6d68c865e39d8ebd323d33d989283a78bf2bb404c45743201
TLSH
T1D411A3ABE13DB8B7103A156F5D04B8055C76F836015258F4DE9AC32CA0D24F7070740B
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 9b973a6f03f81d2b3e0ea2021265e1b919c0a7fac1ffb3b79adc19d2fb361bcf
MD5 5dddccb4f8de9b9db609a52853bf03dc
SHA1 3a24703561b833d75d867b23d26281b4df7991a6
SHA512 d0df4e3aab13c39ced0597e559813165be6af8a19cd58b05b8f79a4404d320c791232fda3e900ba464d91a99b9149b0a2960d30365193e5cb9b59ae2a793b825
SSDEEP 192:dRHcBzQb483v7sAPRp2Egx964Hsb+WNngXP4iXp2zCDVyIsnAUge:dRHmzStfBX6bw4PBp2Wle
TLSH
T1F432852EB964667B6DCBC219F9217B93D7F5102225E43E84E7F88A2C11E76CC3217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 56d56e0e7021a4d37cec99b0aed09f36d7cb81f957a946bf705a0fdee2b0d144
MD5 172e76a58f1bf3853908dcf553adcb9d
SHA1 3995b1d48caf2b419ca3d05143db2b64687b5162
SHA512 c1fce574a526ac7a42ef1ecaac99363456c9adc59074ad9d0bdb675af309f30179eb203cdbe74ca8d5fbbe1abdbc4050eebfe76dd87c3ec83f497e24195284df
SSDEEP 192:dRHcBz2b483v7sAPRp2EgSx964Hsb+WNixgXP2KXB+iXp2RkDVyIsnAUgE:dRHmz0tfBXfbwdPTBDp2OlE
TLSH
T12A42972FB964667B6DCAD219F9217B97E3F5102225E02E84E7FC8A2C11E76CC7213417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 dcae0cc0a089936e73793b66cbf9c636aed175e4fae2ecc05ef291560c49ada3
MD5 0cf482b349f3c6c844ee4882029bf48c
SHA1 39304eb46b1bbc8ee8da110c5ee9cb7715b3285f
SHA512 2a2e131d8c5bf1eba1b71bdd86d668b3300e95a1bad400510079ec7b995a22585d6c1eb3da1158e44854ac9e6ad2db4cb96e825b57029497debb8230c505daa6
SSDEEP 384:lzjxQ7KxkXqKf/pUZNCgVLH2HfgslzSXODxQ+ErU3U1JHGj7RqI1:l/xQ7KxkXqKf/pUZNCgVLH2HfgsNAONZ
TLSH
T117520867648D9A3F0FD8DA8CD8237F4FADF501576668092497FA9C0803E9BCA114A1F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 5356c11a98529df862039584f4e0e224b9873e94612a16b58299510087519569
MD5 00745004de9d190b7c9968860679a502
SHA1 55538c7ebb26bd229c4ed47c1681cca7a417a759
SHA512 b90682fe803403d77e365c47d7def3226a21679fa51c76706d423d6b673b3411a346797dd8d5f2b9034c592c15f3cef6bcae9ae03e603d766534dfa96886d3ae
TLSH
T1B3B0023CD45E1657CF1A9B7253C191C033740D61D7C7D56B51A2265C9D633D74607335
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 f98a6c4a1b39a2bd10e0e7a43d06ceeece3fbd6843873841a305cbc63efebe47
MD5 d8df3216dae3f7d1388e9cf915e00b16
SHA1 d9b5fb0a6ab77383f6a58c3c3ef9f52b6deebe91
SHA512 3da2e8b511544cc2d973a1b502845778ebb57c059352e34ff6f74556d50b1f787405988c125e90143aedacd854fdd6ad5a4fe2b207450ed1b57700289c571a50
TLSH
T140A0022455C51961CD10527270E24741736149141FB1CB0358E2075C985B1C49E02105
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe64dca5.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe64dca5.TMP
Size 48B
SHA256 31fa6a21ca9db9967a1ffa50b35e240eaf6f37c4065c7fdac63916fabb0824fc
MD5 c06d7c4e7a148761f67295989cc8bccd
SHA1 15cb6a3b6fcface14bf94b27cac84ecf2f0d45cc
SHA512 a7cddf6e45f3d804a5075c17e03f8fba19f93fa13782fc95ce8d14a3570e3c976bb5d553931ee0f7cfb031f8ba753a403f025f898e9aae6c9345259ccd0df1ab
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe657b46.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Network Persistent State~RFe657b46.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 121KB
SHA256 63b6b5af216e74597b75813cd03cea925f40ec375b14253a751a1e17fa5a2087
MD5 2b95ae8144d43c06c744b875767015af
SHA1 36a1b1e81c8d0d9f2a54a2804240a2cddfc4f4c0
SHA512 5e59dcca43f2772a3891f2144d7e905f6f310f3ca2c3a8846cd4bf17f115aeb5d9e1babb177c82497f8cb964b64a40b27cb376bf107752a96c634f3395cc6c15
SSDEEP 3072:wPVqcG/evTgTSAou8VOulWhIuEQDYNiHS0VqURvL:wPlRvTo+OulWhfd8IyiJ
TLSH
T1DCC31234ECBF1E65456ECA27BCA7B9020CB4993CD854C68972B963CFC543CA403B5D9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 157KB
SHA256 dce118fd2a1d8a65fe0f42d8cce9e5663a271ec7403d75f2817649585e658355
MD5 66e5653e5b3d9f297ec9b49ee6bd7137
SHA1 0880f5741fda3972e8af0bbbd85374fa4368a0c6
SHA512 14cda754a516c0e604cc6a30d5c8abe3df831c8b64e66d430535c3e665f10767c85d73b77538e479e56e904625a3b5ac6b7b30e5eda3c62e29cc0a8409dea45f
SSDEEP 3072:kH4DWBciVDsKHPVqcG/evTgTSAou8VOulWhIuEQDYNiHS0VqURvL:kHDBNDbHPlRvTo+OulWhfd8IyiJ
TLSH
T1D9F31230ECBF5E990CBA5B277863BD820CB4555CD8A0C68D7579B3CFC586C6013A8D68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 121KB
SHA256 2c825e36d4a467794ed1fa45a3acbc07d4e9456acf7d80f0d8e720eec610146a
MD5 01b265e25b8835c948ccf1ec9fc00a4f
SHA1 2abfb56b7904739afb0a8f2f1ee5ab88c8101736
SHA512 73e3c19dc0d93b381f67de2f30fd952d387647bfd548bce0de39a47b022e51ab4dbc4087fcbd452019bfa345995f1c7f2830d3979b8e300852325468b711a66e
SSDEEP 3072:DPVqcG/evTgTSAou8VOulWhIuEQDYNiHS0VqURvL:DPlRvTo+OulWhfd8IyiJ
TLSH
T1B7C31234ECBF1E65456ECA27BCA7B9020CB4993CD854C68972B963CFC543CA403B5D9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 3b7fb490c1ec4a2ff97b1513a8890f24943e36cd3292c24ecaf97849607ea4b4
MD5 0d3b0968a9bbfb813c65904db54f2584
SHA1 809373589b43bfbf952a52cb92aa206495d20f7a
SHA512 aa3a89d193c81895d54422778b88b4bb4539e00166e9a4dca68ed134c0482a5c8ec4936aa020acd97c3b9928bc1d37b79016106cf6bab876a23ac7da8b4ffc39
SSDEEP 96:gC6yd+cAOIt5aDVmufj7jcbRDotok5xCDHB6/dGyv95SLhbb2Jv4a:gCrLA/TE57cDUDehUweSLhbKl
TLSH
T1D0A1E771B4B95EB35DB9C588F4827E83DF78A113A9226E84D9DC5F0C10E75EC1382A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2c336ab3-3759-4ad6-aa22-7c9f9c2aebd3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\2c336ab3-3759-4ad6-aa22-7c9f9c2aebd3.tmp
Size 55KB
SHA256 022fe2a33d079d7b36de46fb233bb9c97f2fe94a1bebf4a552ff410f253fe650
MD5 5cf2e81157252069baff0af9940a5df8
SHA1 2a632cbf4ed469ae1cb01020c1a15d6ff287341c
SHA512 025eb6cef5807f77e2dcdec8c2eabde4cc787976796505d4fc2293a482825c61ac4df469c00d2afec4e91e5a10bfc8e8180680bad429f089d5332cb100aad831
SSDEEP 768:9Fkj+9336wgLMUZRpNzc4ReyIsUKTOOGwhPjuMG23X/Y+S+6IB8Ap799IBBd9MS:f933Wtc44bsUKTbhP823fS+zrgBBd+S
TLSH
T1FB43BE39DC118E3BDDF61B85B70A3A47EEE4127B85E86C98DBD85F4C41935DC834A811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8aaa68aad07ba45abe53bd513aa5f7e7b21bd1b29db6e1d5c1e0a79a5f4eb890
MD5 74012bbce5fada7634c1da1b567562b3
SHA1 09db27f38f27e35986cfd407b57f6f83c8fc59f8
SHA512 c1a6a98f972793c84274c29552107bfe07b775c7c8121e5fdf137ebf9a7cc3f4eb43fe9eadfc842e7b92ca7281bbcea3d660bdd8fc9adc56add068510c41e48d
TLSH
T1FBD02BE07640890CC980203335F75240920189108401D1480040F335CC845C1257E0CF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e413e02b9e80ee8d76d52c1043fc32251e2d7634d4b2fbd970df9ace9d91831a
MD5 22959b3a06a842ac30237dd57e8a3801
SHA1 0b7c28071a592034aa2607038000f085c7bb6362
SHA512 644add9ab912ad7fdfc55bc7a1b84482c75cc9bc69a59d169bae63a0400619d999846ebbadb0ef2bd6d35c2bd08a5f07053b600874dd5dfcbda7e8f3076131fe
TLSH
T1A5D02BE476408A0CC980203335F6524092018910D801D1480040B325CC845C1257F0DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 edd724ae02065da2db5d4fb2d931abe87b77121d5364ebcf66498d2c70417bda
MD5 27e7fcf948898aa2933519c736b883b1
SHA1 ea222f30869d6154d56f769824efd453be54cf76
SHA512 353b074cc3641e2dc26ba2d92c4afe866edcaaa2d729a91e36a192605c58c7b96d184c65f8d0f156fdb28e55c664e22fabc1199567072a12b27f5f9c1a35b6cb
TLSH
T1C2D023707A35BAC3C22C1072D4314700B22646027702D1416140920DCC7C0C0BBDEBCF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a124d319af5210afa306e537217d55e81f322943df8d29043c0a28d915f74910
MD5 f8272141716ea8a4a3bfc374afa9d293
SHA1 2d2ac4144899f14c9602fe9bd51c4fdc888cbb67
SHA512 8350ef5ece35bf845c268a9cb083cf911431e0300114d795549ea743d5c2cf50f4f2a94b2ae74f236be86be7221bc23afe73cb709ce65d9316ca92e29d765672
TLSH
T18CD023B47B756D47C70B3471B521C75177939740BA15E0615150620DDC794D07BDE1CF
MD5 SHA1 SHA512 TLSH

Submit Download

70a1eb23-c0f4-4e43-9972-d3ced6e76e70.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\70a1eb23-c0f4-4e43-9972-d3ced6e76e70.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 fd5d9d14bb0f719690b54ffd93f7a5eca188ab59d7f299140f2ec48c81fcf1c8
MD5 b84314315bd020509859a9eb67acc40a
SHA1 c9ab421adf721b405e60cb78b11c09929f6b6f95
SHA512 8591f95f7ec07ff29e32eb7dc7f40e5ca45fd1ec487053ff75ca45729c9b6233e11f111dad9509c19804aedb6a4b775de776205a55896de9053721b694b86e18
TLSH
T128E02BE6C862DC7759FD0B1874541F86D78013172650860F3F3DD61C8FB863A4186D6D
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 7e619710d33c7f52ff4d7fc6fea5977ee3593d755fbb8ec9e1038cda2213847f
MD5 4d3c557cdae87ed8c4d71f6001b8db99
SHA1 29026cc10cdc1291927271f36432b9cf370f2ea1
SHA512 e120fbbc3a1033964e93202491b07fbf623862bc2895ec992e36698e956bb6a77c54b79e61e645f857c768e817331d5defc545fc3e4ee92f0e8edb92721e1bf7
SSDEEP 192:DXphvj827FzmBQBcg6qJtO1NZvDXzhtz77hLf9wa/w0XUwR0:9hbHF0qCfph57h2wZR
TLSH
T11F13E63E73075E4ADFC6183D9C17DBBD2B36D4E8EAC061070235325D6261BA18C8E7A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 0d89e2e15fae802b41d3cae2f277b8e031d0f443e86a326bbe12cc414f108513
MD5 5391126080b90289710170f4b9437d63
SHA1 5a09739cfe14f0720254de35ac22c062d2d22362
SHA512 678e3bb0189d9f784f7db717284bf5cefe5d433621a3688be755282f7b1b7ee7b733d4e2582b0efd3561ec28955032209cf48f31606f6cb6a9bebc9446e263cc
SSDEEP 768:jtqNF4AL34eL/TAYL/rdinaczv3648oF5WD+YsycB6Nm4pyXGMWD3py6gob4KFPf:j9+PL/TVL/rMzx8oF44SpI0jk63PCgP
TLSH
T1DE445EF71952601BCBA842F5E6033A3ED177451E7CD2E8E9D2784C852829F31B6BDE84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 c77c73b59663e8d1fc93ac5f654d651b2dd2a3b21242cce947333a8cabe4e50d
MD5 e1f9ba175e1401486d4c60c662b0f3e8
SHA1 8b41638ccf3f8341f8dd38f891047c3f996f00c4
SHA512 65026d58929885d4deb00bb8fc9381a7c135ae02b6d042aa2b55ae4ad1b155324b2e11f27a1680633c25793970bf1cda21e2a5602f9d6961e9b1d72d15ac66f7
SSDEEP 1536:Hi49G+PNaMuANdbg1tWkjIiHMXhJDh8Dz+rWReIHl+3RtZb4GOsfdGjdSGT2NcTL:Hv9G+HNF7JiHv6InPp70r
TLSH
T13A2528EECB682C82CE6B877074E0E9077E712182F64DD0D39944C5D897D6B8176E82BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 4a760df35bc037621388a8abb76a9e41cb8ddeca92d6b67e4362a4f33e145954
MD5 52186bb1041bcc95e62f2b030dbc1986
SHA1 34a0436487490daeb3a0c5899ec04946e0461a3f
SHA512 fdd4b8b4252f5110bdb8667af8acac9f08d828a1446aff7ce72381178f6ab0caca4417f15673e002f7739d2f9fcb64931c4f93c4c1107fdace245da4915446e8
SSDEEP 24576:7HIyij4MP0Sk4XFZZ4dKAUCV/NXX2TCJ5l0Hq:7oynMP0LcTb4/NXX2TCwq
TLSH
T11A167EEDCA7858C3CD639A30B4F0E9877C7413C3F595C1D68898C584026BBC5BFAA669
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 8573abd8924c3bc9058f100526b01ae8581b31c5bfb74e55a48155fc2c83843d
MD5 7fd57054712de14161f18f82cb591837
SHA1 9a7cdd7053001789768f038866a4bd07968c6a7c
SHA512 01470b81be98a1d87ae69bdc46b869788bd91de785c439a8632ae858319035406e955899a0d2d64b7aac3a3dd7b919b9be919302c48599cbd2fe8ccc71ce444a
TLSH
T1BF51FACB432714E7E7AC48756DE28C6E3E75D5E900CFAED16D4865B88A4A31B7CC1092
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5fee60.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5fee60.TMP
Size 2KB
SHA256 b61ef2cf559d117cd0f3f5d66a1bd6a17f73d07ae791c3928304da4db980ad56
MD5 4e41d66b9d69db4fc44d979ed13c97e6
SHA1 7badaffffb335c6b55081017acb1e60a1a01ff43
SHA512 af967312c69c79286e9afd564ba5e13dd3e42b58e7a0df5b89690acccbd8ac0b8fa8196908ec2321e25b98de098b778468a43394c1d8a2829b2833409fb53424
TLSH
T12551D9CB432714E7E3AC48756DE28C6E3E75D5E900CFEED0AD4865B85A9A31B6CD0092
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 343B
SHA256 5c1ce0d58d1fea6eee11399f5060892c0b109f0be6931e6a8fb0ea8bd599f55d
MD5 991e2b2d0be893ba6c4954ad61917608
SHA1 acb089d4d210c0384783bdc41ac89de8b570ce71
SHA512 8fbc0fbcf4319c638b307dab9b9d4650b38ddc296c959e4efe52188910c2cbf317bc7f496caa47349bf1c4b96f4448f21fed694891d3045c4b3812b5ad14c6b0
TLSH
T18CE0D8E8D4C7C19DA5503CC65234770C81C879C3D7B66E0317448CC87B06151FF5A75A
MD5 SHA1 SHA512 TLSH

Submit Download

EdgeHubAppUsageSQLite.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db
Size 32KB
SHA256 5cd448d3cc8bf29eec4bf5ef1a5403d2c7479323703c01f087856a594c7f1bac
MD5 9f892e5d41448b57863251579bd24fa0
SHA1 30c6b1b395f7e2ab4f30623b35aca53402b06322
SHA512 0cd6f6d534bf71ed4ac6979c7294f5d5fd46083b4a0bfd2de41fb484c5b0315a3b44d6aa28ffe53702627a5d28fbc42174ae9dd38e7d92215505daa5cb3138d6
SSDEEP 24:TLZHDDNzWjJ0npnyX7yNUs9vb7OkIbzXagfjH/6W5LLZ5FtIQmQNVqYp2:TdD4jJ/0UC+lf5bCWxLZ5FOQrVTp2
TLSH
T1F8E2A08C3B12F511C4ED733EA0C1C5E05ABD683D464DB1B1913C9D769D635A2F49E11A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 342B
SHA256 39dfdec86949f152a1471442545245ac5f3372b56428a6f61dffac0a3ec159e7
MD5 829a3c6987490c82e6ba954662c1d61b
SHA1 3799630075c4e24b21e810bb5896dd5ecb96c9b5
SHA512 0fe38650c2f79854b11bb4f6564fa45639e74cf8e644f7913c55cc92ee0ebe58c20307360aa83432e6521c046c39ccf2d2e1098695cae563817d0f4af593e30a
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 322B
SHA256 cafe0b8801c53831dcf87f48cf92549b2a2746f7589f92da6c671b5d8ffac580
MD5 fadf6448f4e32ba686e0598e7e34bf3f
SHA1 2d0cd557679e5d7dd2e675072dda96fda3dbab8f
SHA512 629f6b14d59150979cea6d03a8907b5f591d9f6cef8878898d9a0189a20e79a1e6efa3b6747c2b9d68aaa06f0affa518ae95e14174d7d50842eb8cfcbb24f581
TLSH
T1B1E048A448C9C55BF054ECD34374630E8BA134C6A6953F011B8DD85C7647555BB9D364
MD5 SHA1 SHA512 TLSH

Submit Download

computed_hashes.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json
Size 429B
SHA256 b829b0df7e3f2391bfba70090eb4ce2ba6a978ccd665eebf1073849bdd4b8fb9
MD5 5d1d9020ccefd76ca661902e0c229087
SHA1 dcf2aa4a1c626ec7ffd9abd284d29b269d78fcb6
SHA512 5f6e72720e64a7ac19f191f0179992745d5136d41dcdc13c5c3c2e35a71eb227570bd47c7b376658ef670b75929abeebd8ef470d1e24b595a11d320ec1479e3c
TLSH
T10AE055170A1A50B79BB8DB90EE525CA2E8A0A6B1C50438D63E608234B68A11F738347D
MD5 SHA1 SHA512 TLSH

Submit Download

verified_contents.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\verified_contents.json
Size 1KB
SHA256 d23b2ba94ba22bbb681e6362ae5870acd8a3280fa9e7241b86a9e12982968947
MD5 738e757b92939b24cdbbd0efc2601315
SHA1 77058cbafa625aafbea867052136c11ad3332143
SHA512 dca3e12dd5a9f1802db6d11b009fce2b787e79b9f730094367c9f26d1d87af1ea072ff5b10888648fb1231dd83475cf45594bb0c9915b655ee363a3127a5ffc2
TLSH
T12B317466C8683D56267A63348E2D0602EB57C2BB0050640EB5AC558D4F7115FE242FAF
MD5 SHA1 SHA512 TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 224KB
SHA256 16ab63106efc4fcae8cc16f7560ae5a4062dae9ffdd624b919a94db26102ec5a
MD5 7dad5db3c769bad3a6fe1ebbe20e7a4c
SHA1 08a45631a2290316556bee9be4ea9090763b3d0e
SHA512 e0a7d05982c46578af3710c37a8c343a1a2d1a8cc1b94d087a9324c5f6620c49e658f8df35d27516cd4aa4ae0430371f3aeb9bdb869fa435de54346a3d0083d8
SSDEEP 96:rkoADtejzH+bF+UIYysX0fxQp97oEHt/DfLjLqL/BZHbbEOVpZf24JkMfXSFR+Cw:rkoAkH+bF+UI3iWGVoWN3qL/XHVVV63
TLSH
T1FA240F0E5F342722CDBD913669E744A35C7DF03F8B5326DA6C6114B5CEE2652A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 334B
SHA256 88a48006f6cdf9827728f8a1ada21231ad9e5ea0378c85d4edaf2cbd91198a43
MD5 29ec9001436bb90f4e248d9e34e36486
SHA1 5afc59ed26a1f33c30b5fb8e89b8ab84c67f6f68
SHA512 4e5b4898405a6abe698af104f95560fd5dbe6c3d243283806cfd69385920e39cf15ea853f515aaf46c033c9f807c8a49d16b6856fa77e460a714f072e8f77a6c
TLSH
T181E0D871C8CEC569934464474338B70CC7E0349AD6892B015F85A86CB441004EBDD6E5
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 24KB
SHA256 b437c319930eab8c57e5bcbb0e578ea5fdfbc0c2059bb8117d87e26eb4ec5069
MD5 c064a0069c3af191acdee30a81cb2fe5
SHA1 34a858d4236d0e23ca5b9150df897a99091abed8
SHA512 6dc91f2767495cf492f5b5ac2bc2fc5014d09c066cd12f3a7b1159b623ec96d9494685d8b75c478ab70d61e8784ba22649726f4d48b88f4d12caeec0fc20b6d3
SSDEEP 48:Txk/LopFMaty423w/a9NUuTjAw7oWMwb7kWFX9uI:qDeMatha9RAqMk7km
TLSH
T154B21F8D1F347152D0F08B3ADDD188532E7C152DD3A336999E1960F28DA25AFF9160BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 284c852cd1b28be7679de5ced43aa6b58f00f628e0579d447146c21cd4e6b631
MD5 1b1b976e94185342d8dc4c8ccb8000b9
SHA1 f13119bba53e0edc1d1f5d759a8fd010ffbb3efd
SHA512 aa88a2d23ec31440ac763e0f1521cab9fbc77317a5cd0103c71f6051fcefacaa5c4ab6b112b7326e5b9d6e0f5d035f321ab1ecec3c0d070ccc6770104f85c8d0
TLSH
T1F141BEF7C3E4956E890146F4AA147E1BCE1D0915432C3C5AC9E4AF1BA3E2471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 188B
SHA256 4b59f8ee11a051c9a864110a7f32f75c19256fa443bf824532557febbce3b762
MD5 e8bc53664b093df8231ecbc2fcc04d05
SHA1 b6385a08c547943092f38ed88bf4049d8879d30f
SHA512 dccf2d1db8fcbf8cdf2f111c316016c9324fbf7f0b19063f91faf91de536719025c43e779017807aa17a917ea6edf3f3bb592b5e609ebc0316779914f67e14ac
TLSH
T1A2C0129290F9E4F37025457E19C4AC817EB9E435045154A1D9E6833DA1940BBAA1202D
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 fa5181fbe2d208bc8697c1cf94f883d014823e29f17efcdfc625934fe93add90
MD5 69db3750163593461314c1fb09b878dd
SHA1 1e5490223ff5de6a4f3586d6236d9b9c264dc515
SHA512 a812675377ea01d29f6342f0487eb226270c18f7be617b4b9a45f1cc2767534896ecc3eada6a71f65796fec3be2fb20baa9e9608c2b285c7f0e56619c9112d44
SSDEEP 192:sxRvRJyM/jK1Ml8+Cdv/fn+s/WpVqVsFpZMYszoA8p49/g6+WNIYHYGOwchqrgP3:sxRvpkh/f+s/WvCSnMeU/5ItGOTqq3
TLSH
T18562D8156A349D7BDCCBD21CFA557F63D6F81523A2901E44AAFC8A1C00E7AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 1857c0e8034d53ca64f2151367fd38376e4c0dce2235f61ab8c1a37033f36462
MD5 1d9fa44b56dfaff60472ed3d1eea8950
SHA1 c7567b9581eb580812af8d645d2567bb3a923f8f
SHA512 68b86de15c5caaedbbc66123298a8227fe0eeb2258d06b3253b36cda9e7688137fbb0e1f102c1eedcfda63b543afde058b888dee39b1bcc10f581da73890dcbc
SSDEEP 192:sxRQRJyM/jK1Ml8+Cdv/fn+s0WpVqHszpZM75szoA8p49/g6+WNIYHYGOwchqcGv:sxRQpkh/f+s0Wv8enM7XU/5ItGOTqn3
TLSH
T11F62C715A9345977DCCBD21DFA567F93D6F81423A2901E44AAFCCA1C04E7AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 cf9fdc46432b2f0cbe869a9bf63bb405e95df4aeb2ee15bf2d1307bcf7712775
MD5 766611b92ad84e73123915ba06c42b69
SHA1 feb77397db150bce6c5d6014e64a1bdba26f3f74
SHA512 e1cd2d55ea4dce4eec7642437d4b27ba662b396a7b212764288fb886deedc92f147744dfe215c47eb177951aebddfc60eb26c6bc76cb1615f449ad2d72d0233d
SSDEEP 192:sxRQRJyMqZjK1Ml8+Cdv/fn+s0WpVqHszpZM75szoA8pe9/g6+WNIYHY2OwchqcC:sxRQGkh/f+s0Wv8enM7Xu/5It2OTqnjP
TLSH
T16B72C715A9385D37DCCBD21DFA567F93D6F81423A2901E44AAFC8A1C04E66DD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 c308eae072637a4a748caced9affd713033e6dbf8880768fe56117abd0ac17bd
MD5 a403ed29d147c4a7b277e88534a7e341
SHA1 dd8c538bab78ef3c55399b770df16b4f48dfac60
SHA512 c803d6226883cad5fef38d0f27c432b47974362fbd5e2e1edbae512b07c3820e2c5cc6225b60a5c090b148000c5778f085cb3527ad30c7bc542a4147e22726d0
SSDEEP 768:wGedPg7pLuL7X6WgoufDM8F1+UoAYDCx9Tuqh0VfUC9xbog/OVojOu4YjroSV862:wGedPsE7X6WgoufDMu1ja3jOVYQA2
TLSH
T1F0E2EB3B680CCB7E4F804EDCEC29BE9FADA801CB56D8895447EA840C03C67EB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 338B
SHA256 acc9c37ce14fff139a8fcb91c23e3eaf39809b3f3ca20821361656dd92ac6a58
MD5 560ba9efb6f7b1b46b886fecf7c9580f
SHA1 fd88aae2a3315613eb5e899a1eb6a4d1da59def2
SHA512 fbee27ebdc5c71c273836038e22247e27fc476539e394ce69ebdcb5c3c389882d8c1e7ddd189e0f016c25b3e61d7cf59cee36a0f32e6502758348199bb6dcd80
TLSH
T122E02620A5DAD2BEA1AA64C30374A70D92E47487D2C83F027FC9DC486943584FBA6698
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 c412218b57cb9ea88f153ae76f402a7bb0628ab08749f5905c9d403b0a45f3f9
MD5 f8fcbd1322c47e0209be4e300d6d71a9
SHA1 279683872ea8cd71b7db1ef782de568e7e25132c
SHA512 4bd39d099ec6b0a43228ec21bed336e1d8d505084931b0bae6ef70ac645d6e938ee0b498312fa4cb1f1f8de93a303ed22653fca43ba53bfa7ba4e41212c8d718
TLSH
T1F5E0D17056CEC62B6159A8474724E30CC5A37445E7DB17126F4DE8887207140B7D7251
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 7aaf8259f75d5c7a2986890c40c5af5a6bbc5760221b8f231e5c039dea8538fd
MD5 4cf02712218709230ee483fd31b0276d
SHA1 30cab5cae634afc87c0af1989695f6eeef6aeba7
SHA512 47606b119d45dd2142e9fe7c270fae61160a73decf0a011897dd44f9568fafe93d1bec025e6662efff17ea3c269e0d83a0e65bdddeffc073cc6482b394cf5b4d
TLSH
T1AEE020B0A9C5CB3A9254E4874378B71D82F0788693C53B01EB48E8586502110F7792A0
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 bf6bd6e521c7a4b56008064b31fe7ad5a5366b39fdf0ae9df49e0bbba202db63
MD5 9ca82e62d90cabaa9aee369e64903b6f
SHA1 49a1e97a56a923a6ee28335c560b6e3ebcac7aef
SHA512 0e5490a0d2128d90715529f6769e02af0989a3fbae433fd1393ff2408355f70a1d13b24c3cf5d0c527b592070e8191ab3c73918be112085bc413b15944ac713f
SSDEEP 24:KSxYQExY8xYxxYVPxYaSxY3xY3xY+1xYnxYODxYlI4xYVxY+KXxYthPxYrxY+1RZ:KIzIhKAg0zyR0ILKJKM1GI/KbSITyG
TLSH
T11491A250B17A0601397D690C9264AE16F1C1B0E330B8A92E7FE911661FA7E11CFFD6DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 cd764eb1163b764ec2b9b0f2c6d2b9fbc1b745a879f4a507b36630dac1861721
MD5 af97664347c584a2a78b8204ef71ae34
SHA1 1b36c1ad8795d54bfcc5abfd9a3045a00c98cd24
SHA512 7c97e7d924e6b3f3763a1028f7f7868c2e48b6e3a74c130d4302a6bd419bba69e74ca00d3df3d0c076172c3d7710e60aa1ae48f5fa521a632febd61ffd0b23a5
SSDEEP 384:DNrRZyCSDnxTICfMEhIKyll7svbFKfk7:xFZJSDni9yI1l7svbF9
TLSH
T17E44840A7B747001EDE6D9721CB080771E3CB16D8F26A6916DA254694DB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 12KB
SHA256 957189e3f98d5f9f045b3246d81c729a5dd6c2a5169bc7d4cc8d4cf70bec43fb
MD5 0f38c181d15addfa75db6de6e9a9b9e5
SHA1 b21359da7a01e1268b2ee778b2353f5851ff7b63
SHA512 b78502539b7bf4189c2006069552b098a84c884f999b8dfdec2442542862f2752e29200973380e5a486ded5c35b0f75bfcff95773b6b479b18e441f2b378b05a
SSDEEP 192:UQrIII6b6MIME1YcYPqiOyyAsUlrquuspk:UQrIII6b6MIMiBIkyrs+Es
TLSH
T14442756A17051B77C26E5F761366CA489BD448824072262E31623C1F8EF3F9796C7AF2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 322B
SHA256 667c6e87775a68a412896266835709781bb14945f9c281322a65e06640e9aaeb
MD5 b471e6963e85cdc3ef3d7b575e71ec6c
SHA1 0e6ff4e359c087e3a6347f4021f2aec2d70dc58d
SHA512 dce00d29ccc5e5bdf77425c96322620cfd8e5832f4ec3a19cedbb8bd7e658506e55a7543aec38b918af848553bf3986c698b3ac5ba07d063c828f0967b6b845f
TLSH
T104E02620E8CEC1AEF058648702B5530CC3E038CBEBAA2E071F41C48CB443120FBEA6A1
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 13f2fdf5b3fc3f3a6dfac3d1fb31f7771f2357f797f269a26a8b2369b4ceeb84
MD5 d176a7d1260f9704c12efe4cb4e49fa4
SHA1 34050d8fee1ac6f8afb689a131b92941840919d4
SHA512 4faeff98ce9c696dc1a5de4ef15f668cfd87db9f0677835b0f836d163f7bea30a98a95b9ab8b19860a1756b1c9c6c8448f48687e911e629e33a771a46afbd666
TLSH
T152210451F330D108E54E923A607E9B260338D8438FB8ED0F44B670792E75B141E8B2E6
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 340B
SHA256 105678b48a3ad7edbb19449537ed8e32ee0f667059b277da680d464ee65bdb64
MD5 93a1b6206bd6e4bb913b077be8b3687d
SHA1 5784eee5f1b9b9c4269c864e57e13ecbe4d4d01a
SHA512 008502d59bd9e9d2ce649dbb43cdbcb9486d7eae78e47096e300c1300ee4ba1a3759f3d91f0c9955ba035b4788a19526f931036ac2a155810230cadd9d7e6d14
TLSH
T1ADE0D824A4C9C19FB054649303B5934CC2D238DAEAA92F021F418C4C7542141BB5E261
MD5 SHA1 SHA512 TLSH

Submit Download

7db13b8c-540a-43e1-a97f-b48e05181967.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\7db13b8c-540a-43e1-a97f-b48e05181967.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 5ce4b70714a14d6edd3984aff6ffbf91500bc469237550e8fd2812a4b6ad0e23
MD5 c2cc02209692a818860bc7cca262985b
SHA1 eace9a5e211534271e6c46edbfb65dcd62031ffd
SHA512 ba7e89b94315fd7c09b67a6a9ad133e4c1b566da570f2096d931cc8263bac30d4f9ec28d491e3f20ed22b7bb5b71ab7037692a40d790e4a0d5292d02fde33f58
SSDEEP 3:MsEllllkEthXllkl2zEflxI/:/M/xT02z
TLSH
T1B2440404FFC0040DD50010304051C77033F0D4104535574334D30473DCC75400D74440
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 9319a453c459bfe130c27749277bb17b6e06ca48999e91ed97badba972a4c84c
MD5 e0e3fa179d9a9e2d1c1aa98b7a29606c
SHA1 099ce220046b005d8a30592c9389ddc390a15145
SHA512 ee3c0d1e3e88e8ad601cca2a03cc27ab3b013e9892c2e153444ce9876a9fadcb7f4aa1ee7ac916c9f131d5840c06b5d14e85689b8c93f79fc12db5066c77dbdf
SSDEEP 3:MsEllllkEthXllkl2zEflWhEt:/M/xT02zb
TLSH
T1C0440204AF808549C9001430406183602370E45505115743289508229CC69C00C14010
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 72e9fe83fabfe1a5c2605b19fa5d992018eb6e331f5a50bb9d6e6b6cd8187892
MD5 25bcfea2290e2e601ba46f550312f034
SHA1 0b41d30e0dcef714e08cecd30f93d8651f50edad
SHA512 53c5ad6b87ccb57876f52c5f823fe72c57b6a91f3129d4d3135e04c2537436ec6ccaa1cc5b6f63f1490dd705f3cecf8cd77f0eb61fce08a1c077f99bd249e9eb
SSDEEP 768:Wj+933zLNDZIO00U8TNzc4ReyIsPv8X9sgBqb9MD:F933zU8Ttc44bsXJgBqb+D
TLSH
T1B9139D3DAC258D7F9CEEB709720E29A66DE4023BC0B95C98E7D90B0CC57259CF756812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 a9be07f1b932c28d5aeee68ee1c50f40193bb5d4e75a61635c6a69580776daa4
MD5 bab1d0a9eefe61ce0737b3dbc004a6c3
SHA1 04d4a628b008d4fd250ada72ced9c4c2bbcb8795
SHA512 90641000e86ff16cc251f8b8ef7b0bfb64ce62d13e214d9721406f3bccd15fdf7ae0c32e9c690305db6e88e815f558bfe7a4e55679df3ea0f65bbecd954b0450
SSDEEP 768:3j+9334MNDZIO00UA2Nzc4ReyIsM799IBBI9MS:69335UA2tc44bsMgBBI+S
TLSH
T11203BE39AC258D7BDCEA6B46B20E3A567DF4023BC1E82C58DBD95F0C85536ACE317412
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 ac85d7fa009d8eaf23913a60900a66a7c8bb509ae83f5ccfbd6259a0dac5483f
MD5 dad12fe99604c9551a13b778763957da
SHA1 bda4ce2b5cdd0ffd2218457f955bf5ee09dcb606
SHA512 612e956f387d33104f9611ce1f94eedc50cc480cf57859fbb9cc8f8d3d7b183b5a9cc59b0ea42d3b6dfbc58f702d0134890afa9c761de813e946a43601e39200
SSDEEP 768:Krv+4UNbdt3z5NDZIO00U8DNzc4ReyIsPloC:KbsbT3tU8Dtc44bsdh
TLSH
T16C03CE32B868CD63ACFA9646F54732837EF4206780C91E94DADA5F4C058B2EE171F913
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 9232610ba2ef5771fc86654a60a0cba3695e83d5d3c37eea29741ab7db95ec6f
MD5 cd02f2bcec83b2c63118ff6c4b5c7345
SHA1 121e295093f1a16379a698a06da173fad300cf30
SHA512 b221d157d2642a3d4de92a9cc1112e2ac9e05c09c3d8891aab94df54b4eaea9cb8e5344cb9f670450da089e94b4ad87ce5d02af2cd9617c8f9c9f83210a1440b
SSDEEP 768:6rv+4UNbds3SzDZIO00UPNzc4ReyIsXveVH1S5D:6bsbS30UPtc44bs/EH1Y
TLSH
T1A603CF32E8788A77BCF6A686B54B76533EF8511782881E94C5DE2F0C468B1DD131B923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 72c3f5f1fb1beb08acb09ec468b4f21775648c6dc399b96e636e03c37f5c8199
MD5 6fffbb37a25451ca0fd1ce8b982bd702
SHA1 ee40866929229bc347edfc804e39a3c5cc43adb8
SHA512 12428583e6d01cb824604849c36a07a1e8fa4e989833b90dfc76b8ca17621c72308867209d2c01fca5956783d24393968b7668b119a1b1b6b86c4bfd4ec73707
SSDEEP 3:MsEllllkEthXllkl2zEfly:/M/xT02z
TLSH
T14B44040C7FC11CCDC50034304451C37033F4F4500511574335D10573DCCF5400C10000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 7ae3abeff1a7ac2b396b3e38dc9d2900c37a4fa3623cd6a74cdc34b502978149
MD5 d7023fa4d2528dc28cb0aaefeff697bf
SHA1 a9d914b66ca62916a33ca38b55ff971687cec7f8
SHA512 a12e587ee1c0f13ff6b3da22343b7611d6985799073cd0898decd626042b0e3a69747a3419b461a74ae1dee8d439eef7f39e61fafbf6bc2d3be40d501161b36b
TLSH
T13221FEE26D6E1AC2D1BE0EBFE0873AEC54D8D21AF1D4347A1888ED94923D91E154187F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 2b7c607fd6a639934c6f7311f36aa760dd4a600f84b9f8e2d066832856488091
MD5 a36353281ee63c90e6d74b67255fe9ed
SHA1 f8aa66a70fe63c5f2aae1964243c68b3617d9c57
SHA512 9950368809a0ccd2b7cadae6c5ad4af6b981a19210a81b38ebe99aa0a683ffdc822d6bec67c6e4cf1ddbf1d47b71b7aeae4380c6552f5d5b6298fb649949ae69
TLSH
T1D3312FE25C2D1AC1D0BE0EEFE48B29EC84E8D216F19434392898ED94567D91E258087F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 21075672ed04fcc0ad86c96036a015a0479bc539f9eb22ed2ee07d5f51ed51d5
MD5 a8b716843d7c8f9dba996daed984824f
SHA1 0c96d6d123c2416eb76b7da62e37d23071beadb7
SHA512 5d339045c75561891f8b131b85aa5713a39f0c762a24cffd19d9577849262e259f66a06264e6b97d4d7a2b39170891003f4bfd55c6f8d31f9da107ab6548e117
TLSH
T1DE21F0E15C3D2AC1D1BE0EBFF0873AEC90D89216F5D4347A2898ED94823D91E158187F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 732B
SHA256 a5548ca519cf47ecb420c8f1299a8a50517fa463459a704ef2ff17c4db35117a
MD5 b2c40634bbfa57be0d4fad8adfbd6ccb
SHA1 6f8b9ba2f40d9aa42d217ed2bc6dbcdedd1763ad
SHA512 3cfbef4e4a4a7d8fa1530c69ea34fbc3b84627888361a9d201b21e6ead15f5d4e51fea8bc95edd07415b6d2d06a3c19beb1bcea3195e05a6d8af4939b95f77b5
TLSH
T1220110D29C7E26C2C5AA0FBFD08B26EC44C4A516F098747A1CCCF9D4823980E148243E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 757c40068c8b44526fedddbae76f4ef49d46e6f99e9c5b6ac7daee04f31c52bc
MD5 d3c09492385327b4a73e8682955af55b
SHA1 240fab0985703fee85cf6f4073e03764bdb8aa5c
SHA512 09a4d78749d0d19904aa74f079fa2811f4b5de2b62305c89fc775606945a876578959e3f95cfb06258b2450dae9c4ed8a80ecdef86debcfb139ef6a47615ec6c
TLSH
T15A11F0D25D6D19C2C5BE0FAFE0877AFD40D8D216F194707A1888ED54427991E114147F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 612B
SHA256 98d9b184e4c7220b5aaf7ae412b0c1b3f32e3dc4933afcf852538b8082017b9e
MD5 c20138f2b92ee0645ce99eebc563daa6
SHA1 8e20392ea25dec3d3cef957c8ebbe1a0c589ea3b
SHA512 151098a27cb44d715d48210b12b95a9d1341beb7ca1de3096edc0434ba70c3d274e446604c7692d7a4d92af7b41872166747a30fd452fd0279407a6993fc02c0
TLSH
T15DF00CD28C3E21C2C5EA0F7ED04B2AF884D46507F0887439088DEAD4C17A80F118247E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 852B
SHA256 142a7cc7a4933a976aae32a9d04e1758464486092207243f09edbbad51f1d934
MD5 95fe84d83629d03e0bc6e035f44a5cae
SHA1 2af304ef821c70f2d00b47a3e3872c17d33e40e7
SHA512 266ac6fd03731d757bebdacd0d27aa0326e022f9791d7892445f595285b17def95b722da875c974360a7567be530324d0d91a3310008958cbca0f09f04676301
TLSH
T14E0112D25C3D26C2C5BE0FBFD08776E844C4911AF19474BA1C8CE994827980E208243E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 9107e613905835c00077a499d2faa20bb70b974e6309d1f2f33ae52933318f07
MD5 2012d4de563c653f56f62ccbf46db598
SHA1 fb24881003593f1ceb79019e52ce5ee9e94c889c
SHA512 c03d6584395c1c97c75af7dc6df57df358d3957035521bb6833c538679683aebe0410bb12586472b84dc98111e703984dd37868464fa9c66fdafb423e763b555
TLSH
T10CF00E829C3E25C086E90F7FE44725F840C46517B0883879088DE9D8813A40F11414BE
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 972B
SHA256 590065152acec5cf42dffc28eb04749514feaa899eb2ae04edce7d38a148fbda
MD5 30ae49636160992413baf749cf492c9d
SHA1 93edd7244143177356c931699cb8a266bad04660
SHA512 b986d2486431c75ee9ea0acd7d891c2d40042dfe9185910eedc52db52d68de586df47518bb97647f325416a600eb0e7b794c9d5db9242f3417882791a266829e
TLSH
T11E1114D25C7E26C2D5BE0FBF90877AEC44C4D616F194347A1C88ED94417981E154147E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

00c989c9-2350-4e88-b83f-1d52496f467f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\00c989c9-2350-4e88-b83f-1d52496f467f.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

Gateway Installer.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-OZPXSFMZFS.tmp\Gateway Installer.tmp
Size 4.2MB
SHA256 1053f98eb1af6618d742b01f8ca95649a4c92bcb1073cb5f95d039db1ee4dcaa
MD5 928d65ec8564b076670ee122b518ed01
SHA1 364a8167272ea558bc897aff8f6ee669ea724e7d
SHA512 c64e6b403d364f3b7c55cdb7100cad718795370fc04f4a2aa4de1716745a824cc01b0b182ed592687ea4d53fa227a1cc99d9915f0141d30fb0b96c79e99dd79d
SSDEEP 98304:5YU5hnuOajWwMPdCpepI3GrwrA+Js333Ph:7xuHjWfZIzeh
TLSH
T1D7268F03F388753EE4571A3A583FA280983F7A213915CD4B6BFC295C8F396416D2A797
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3344_1624125785\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3352_16426355\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.dat

Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
Size 332B
SHA256 3039780bcb2a8c570c76e24381fef40afe14ab68aacb86b2218e8572706e887a
MD5 99ad26bbc53392536bc332f5e1a30a83
SHA1 917a20e37736974f67006c715b6fbdf496d858d8
SHA512 af7676f49683c978affaa3ac38b7ad0f1259983d8295368b76ddbafcea89458c794a6e07955a8c0a17c010244f0f9a6c1d91de55510008f212cd4dadd8fbeeb9
TLSH
T1BDE08C6B2395E3F457BC63A17939ACD443F34D04C65B022213CE0C952C2AA03385B85F
MD5 SHA1 SHA512 TLSH

Submit Download

VC_redist.x64.exe

Path C:\Users\Admin\Downloads\VC_redist.x64.exe
Size 17.9MB
SHA256 843068991daaa1f73ad9f6239bce4d0f6a07a51f18c37ea2a867e9beca71295c
MD5 8da7373f3ec287fe1c3ad72a7b2922f0
SHA1 46adcdfbe9aebe767657b7a802cc366f827ced77
SHA512 c42c82cfd5eaa2165b600f6109cb14ff4308cdf4cff656a1375b4a933f1630bfe54c99c4d0fb9ed3bea4dc4e4fdaa3db8e7c58356cca07c2954f4c297757d62d
SSDEEP 393216:rCpQ/hbBWGW1tkWSz61gUM0SOm53TgypRvlxoMtBpMw4OrW:rCpQpbQ1tBj1gR0SP53tRvlLpM2K
TLSH
T133173332A4742132F6F16437F968F1307E3CA72863D09D99D3C8AD99396488267F725B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e64f688.msi

Path C:\Windows\Installer\e64f688.msi
Size 208KB
SHA256 bab5d0257e6a18a4a008e683442e3077b38172dd61af3cb1c588b46724a714e2
MD5 929579267bee38006631f56eff1d4366
SHA1 1bda1592ce7edca6c30421c2c8a00ba3ddf448d8
SHA512 ea52b41f16c06a53e1b9f8d2d4268b2dfaf89968bfd97e033f13bd26ee44bfb3e6b377c873900224ab6e4e3b0b7dcb5037ae0f46c77d3afd6266b4f1dffac44d
SSDEEP 3072:K9laht5Xel69YGnfxC2WB/bEPcefrKROjibDPxriTE:0laZeKFxCnBheIdlu
TLSH
T1F324AF12B5808033DAFE1A350578DB615F3DBE608E544A9B6364B6AC1E717C0CF36AB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2480_1784342719\LICENSE
Size 1KB
SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
MD5 ee002cb9e51bb8dfa89640a406a1090a
SHA1 49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2
SHA512 d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c
TLSH
T17D31535723840B9306DA2B4566AEBDC4B0DDC02D7F27AE05186EF394537B52ED8B3443
MD5 SHA1 SHA512 TLSH

Submit Download

wixstdba.dll

Path C:\Windows\Temp\{4367BDB2-CAC1-4C1E-9E04-A1E651B8B436}\.ba\wixstdba.dll
Size 215KB
SHA256 e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e
MD5 f68f43f809840328f4e993a54b0d5e62
SHA1 01da48ce6c81df4835b4c2eca7e1d447be893d39
SHA512 a7a799ecf1784fb5e8cd7191bf78b510ff5b07db07363388d7b32ed21f4fddc09e34d1160113395f728c0f4e57d13768a0350dbdb207d9224337d2153dc791e1
SSDEEP 6144:K6EZdi6e93SuDeTKZxQfsRy26BqbUHYJe:K62i6eNSYeuZ2sRDK
TLSH
T15E24AF12B5D0907AEBFB19305939E5216DBDBA210FA0C9CE5348AD2B2E705C1DB36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logo.png

Path C:\Windows\Temp\{D138DDAD-8023-4DBA-B6B3-7AB23A18C807}\.ba\logo.png
Size 1KB
SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
MD5 d6bd210f227442b3362493d046cea233
SHA1 ff286ac8370fc655aea0ef35e9cf0bfcb6d698de
SHA512 464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b
TLSH
T1CF312CF34748B7A7D30581351471819AD242FFD8F9CE291E35CD5307664018115C75CF
MD5 SHA1 SHA512 TLSH

Submit Download

VC_redist.x64.exe

Path C:\Windows\Temp\{D138DDAD-8023-4DBA-B6B3-7AB23A18C807}\.be\VC_redist.x64.exe
Size 615KB
SHA256 dbcc159853d8b83c1df0a0a698127ab98e926af1b6dee86e96f541dc94b34948
MD5 2de7a2a87f61fd6ead5276047feaf36c
SHA1 d9a03aa94dfb0f485a9fd281d89d2edd499408f7
SHA512 ea8dac8d0cf79b2d8302a4405ba2d44be8dbca316038d90f19bce6d0760685105771e87b1e905ff58e6ee10e154ec9ad6c00fc575dd8c82ea4eed856fb5569ac
SSDEEP 12288:73mgqnIZuYfCYqFet4CovkM7RVYnE2EwCeYG1LM7d:73WnIZuMCxezot7rgd4e2d
TLSH
T1AAD48D32A5614033FBF105B3B928A6303E7CE728275188A9D7D4BD1D7EA84C1A7F7256
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2788-8-0x0000000000C90000-0x0000000000D79000-memory.dmp

Download

memory/2788-0-0x0000000000C90000-0x0000000000D79000-memory.dmp

Download

memory/2788-67-0x0000000000C90000-0x0000000000D79000-memory.dmp

Download

memory/2888-772-0x00000231555A0000-0x00000231555A1000-memory.dmp

Download

memory/2888-775-0x00000231555A0000-0x00000231555A1000-memory.dmp

Download

memory/2888-765-0x00000231555A0000-0x00000231555A1000-memory.dmp

Download

memory/2888-776-0x00000231555A0000-0x00000231555A1000-memory.dmp

Download

memory/2888-774-0x00000231555A0000-0x00000231555A1000-memory.dmp

Download

memory/2888-773-0x00000231555A0000-0x00000231555A1000-memory.dmp

Download

memory/2888-771-0x00000231555A0000-0x00000231555A1000-memory.dmp

Download

memory/2888-767-0x00000231555A0000-0x00000231555A1000-memory.dmp

Download

memory/3332-91-0x00007FFB356C0000-0x00007FFB356D0000-memory.dmp

Download

memory/3332-90-0x00007FFB356C0000-0x00007FFB356D0000-memory.dmp

Download

memory/3332-55-0x00007FFB356C0000-0x00007FFB356D0000-memory.dmp

Download

memory/3332-54-0x00007FFB356C0000-0x00007FFB356D0000-memory.dmp

Download

memory/3332-57-0x00007FFB333D0000-0x00007FFB333E0000-memory.dmp

Download

memory/3332-56-0x00007FFB356C0000-0x00007FFB356D0000-memory.dmp

Download

memory/3332-92-0x00007FFB356C0000-0x00007FFB356D0000-memory.dmp

Download

memory/3332-62-0x00007FFB333D0000-0x00007FFB333E0000-memory.dmp

Download

memory/3332-53-0x00007FFB356C0000-0x00007FFB356D0000-memory.dmp

Download

memory/3332-52-0x00007FFB356C0000-0x00007FFB356D0000-memory.dmp

Download

memory/3332-93-0x00007FFB356C0000-0x00007FFB356D0000-memory.dmp

Download

memory/3340-1797-0x0000000000BC0000-0x0000000000C37000-memory.dmp

Download

memory/3560-1794-0x0000000000BC0000-0x0000000000C37000-memory.dmp

Download

memory/4848-1796-0x0000000000BC0000-0x0000000000C37000-memory.dmp

Download

memory/5812-63-0x00000000002D0000-0x000000000071B000-memory.dmp

Download

memory/5812-6-0x00000000011B0000-0x00000000011B1000-memory.dmp

Download

memory/5812-10-0x00000000011B0000-0x00000000011B1000-memory.dmp

Download

memory/5812-9-0x00000000002D0000-0x000000000071B000-memory.dmp

Download