hxxps://mega[.]nz/folder/fapgjJZK#hAVvsNvxZPW3WWQXw0j6bg

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 20:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://mega.nz/folder/fapgjJZK#hAVvsNvxZPW3WWQXw0j6bg
Sample260910-zpewrawcph

Score

7^/10

discovery installer

Malware Config

Signatures

Executes dropped EXE 6 IoCs

pid	Process
1200	Flat_1.4.3_WiN_amd64_Installer.exe
3396	Flat_1.4.3_WiN_amd64_Installer.exe
3960	Flat_1.4.3_WiN_amd64_Installer.tmp
736	Flat_1.4.3_WiN_amd64_Installer.tmp
4976	synthv-flat.exe
3904	synthv-studio.mz

Loads dropped DLL 1 IoCs

pid	Process
3904	synthv-studio.mz

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
3904	synthv-studio.mz
3904	synthv-studio.mz

Drops file in Program Files directory 56 IoCs

description	ioc	Process
File created	C:\Program Files\Synthesizer V Studio Flat\clf-data\is-ZQWOBQBHYJ.tmp	Flat_1.4.3_WiN_amd64_Installer.tmp
File created	C:\Program Files\Synthesizer V Studio Flat\is-3QPCI6ERLS.tmp	Flat_1.4.3_WiN_amd64_Installer.tmp
File created	C:\Program Files\Synthesizer V Studio Flat\is-T94PGT41WC.tmp	Flat_1.4.3_WiN_amd64_Installer.tmp
File created	C:\Program Files\Synthesizer V Studio Flat\is-K7QU6V31G2.tmp	Flat_1.4.3_WiN_amd64_Installer.tmp
File created	C:\Program Files\Synthesizer V Studio Flat\clf-data\is-VRFCMD6SRM.tmp	Flat_1.4.3_WiN_amd64_Installer.tmp
File created	C:\Program Files\Synthesizer V Studio Flat\clf-data\is-XYUQ4RDEJ8.tmp	Flat_1.4.3_WiN_amd64_Installer.tmp
File created	C:\Program Files\Synthesizer V Studio Flat\clf-data\is-NH39P6YJQV.tmp	Flat_1.4.3_WiN_amd64_Installer.tmp
File created	C:\Program Files\Synthesizer V Studio Flat\clf-data\is-K86B73OTR1.tmp	Flat_1.4.3_WiN_amd64_Installer.tmp
File created	C:\Program Files\Synthesizer V Studio Flat\fonts\is-LDXY7N32YD.tmp	Flat_1.4.3_WiN_amd64_Installer.tmp
File created	C:\Program Files\Synthesizer V Studio Flat\is-ZBX1GTO31B.tmp	Flat_1.4.3_WiN_amd64_Installer.tmp
File created	C:\Program Files\Synthesizer V Studio Flat\clf-data\is-7S1KPC0G68.tmp	Flat_1.4.3_WiN_amd64_Installer.tmp
File created	C:\Program Files\Synthesizer V Studio Flat\clf-data\is-A6ZAGVGQL8.tmp	Flat_1.4.3_WiN_amd64_Installer.tmp
File created	C:\Program Files\Synthesizer V Studio Flat\clf-data\is-N2V2BWMAPG.tmp	Flat_1.4.3_WiN_amd64_Installer.tmp
File created	C:\Program Files\Synthesizer V Studio Flat\clf-data\is-8626RNLXF2.tmp	Flat_1.4.3_WiN_amd64_Installer.tmp
File created	C:\Program Files\Synthesizer V Studio Flat\clf-data\is-X4R41DQSX2.tmp	Flat_1.4.3_WiN_amd64_Installer.tmp
File created	C:\Program Files\Synthesizer V Studio Flat\clf-data\is-9GJL0RGJD0.tmp	Flat_1.4.3_WiN_amd64_Installer.tmp
File created	C:\Program Files\Synthesizer V Studio Flat\clf-data\is-SG03WSTSTO.tmp	Flat_1.4.3_WiN_amd64_Installer.tmp
File created	C:\Program Files\Synthesizer V Studio Flat\clf-data\is-QUNLAYO6MH.tmp	Flat_1.4.3_WiN_amd64_Installer.tmp
File created	C:\Program Files\Synthesizer V Studio Flat\clf-data\is-6UHPO9L90R.tmp	Flat_1.4.3_WiN_amd64_Installer.tmp
File created	C:\Program Files\Synthesizer V Studio Flat\clf-data\is-9X8DNS55JZ.tmp	Flat_1.4.3_WiN_amd64_Installer.tmp
File created	C:\Program Files\Synthesizer V Studio Flat\is-HZUKAMXIKY.tmp	Flat_1.4.3_WiN_amd64_Installer.tmp
File created	C:\Program Files\Synthesizer V Studio Flat\is-FWADNBNV0Z.tmp	Flat_1.4.3_WiN_amd64_Installer.tmp
File created	C:\Program Files\Synthesizer V Studio Flat\is-VF063LV331.tmp	Flat_1.4.3_WiN_amd64_Installer.tmp
File created	C:\Program Files\Synthesizer V Studio Flat\clf-data\is-0OOYGKER5R.tmp	Flat_1.4.3_WiN_amd64_Installer.tmp
File created	C:\Program Files\Common Files\VST3\is-IMOKOL7UZ3.tmp	Flat_1.4.3_WiN_amd64_Installer.tmp
File opened for modification	C:\Program Files\Synthesizer V Studio Flat\synthv-flat.dll	Flat_1.4.3_WiN_amd64_Installer.tmp
File opened for modification	C:\Program Files\Synthesizer V Studio Flat\synthv-studio.dll	Flat_1.4.3_WiN_amd64_Installer.tmp
File created	C:\Program Files\Synthesizer V Studio Flat\is-NUCUT6LKAX.tmp	Flat_1.4.3_WiN_amd64_Installer.tmp
File created	C:\Program Files\Synthesizer V Studio Flat\clf-data\is-03WVOINA7U.tmp	Flat_1.4.3_WiN_amd64_Installer.tmp
File created	C:\Program Files\Synthesizer V Studio Flat\clf-data\is-JBPKKWPC7Q.tmp	Flat_1.4.3_WiN_amd64_Installer.tmp
File created	C:\Program Files\Synthesizer V Studio Flat\clf-data\is-9KUZUCYLPK.tmp	Flat_1.4.3_WiN_amd64_Installer.tmp
File created	C:\Program Files\Synthesizer V Studio Flat\clf-data\is-651MA7MI71.tmp	Flat_1.4.3_WiN_amd64_Installer.tmp
File opened for modification	C:\Program Files\Synthesizer V Studio Flat\unins000.dat	Flat_1.4.3_WiN_amd64_Installer.tmp
File created	C:\Program Files\Synthesizer V Studio Flat\is-75Q0QL2QY7.tmp	Flat_1.4.3_WiN_amd64_Installer.tmp
File created	C:\Program Files\Synthesizer V Studio Flat\is-2H827O7UA6.tmp	Flat_1.4.3_WiN_amd64_Installer.tmp
File created	C:\Program Files\Synthesizer V Studio Flat\clf-data\is-FMYMFLHMGJ.tmp	Flat_1.4.3_WiN_amd64_Installer.tmp
File created	C:\Program Files\Synthesizer V Studio Flat\clf-data\is-2VKS6RF6G0.tmp	Flat_1.4.3_WiN_amd64_Installer.tmp
File created	C:\Program Files\Synthesizer V Studio Flat\clf-data\is-SC51W5JJ31.tmp	Flat_1.4.3_WiN_amd64_Installer.tmp
File created	C:\Program Files\Synthesizer V Studio Flat\clf-data\is-71OXSSYMBV.tmp	Flat_1.4.3_WiN_amd64_Installer.tmp
File created	C:\Program Files\Synthesizer V Studio Flat\clf-data\is-OIZI09EKXP.tmp	Flat_1.4.3_WiN_amd64_Installer.tmp
File created	C:\Program Files\Synthesizer V Studio Flat\clf-data\is-16RG8UB089.tmp	Flat_1.4.3_WiN_amd64_Installer.tmp
File created	C:\Program Files\Synthesizer V Studio Flat\is-D8OPT6QF8G.tmp	Flat_1.4.3_WiN_amd64_Installer.tmp
File opened for modification	C:\Program Files\Synthesizer V Studio Flat\synthv-flat.exe	Flat_1.4.3_WiN_amd64_Installer.tmp
File opened for modification	C:\Program Files\Synthesizer V Studio Flat\flat-manager.exe	Flat_1.4.3_WiN_amd64_Installer.tmp
File opened for modification	C:\Program Files\Synthesizer V Studio Flat\flat-manager.dll	Flat_1.4.3_WiN_amd64_Installer.tmp
File created	C:\Program Files\Synthesizer V Studio Flat\is-M33BJEH1SZ.tmp	Flat_1.4.3_WiN_amd64_Installer.tmp
File created	C:\Program Files\Synthesizer V Studio Flat\is-51ZA615VKQ.tmp	Flat_1.4.3_WiN_amd64_Installer.tmp
File created	C:\Program Files\Synthesizer V Studio Flat\clf-data\is-GOHQ0OE9BB.tmp	Flat_1.4.3_WiN_amd64_Installer.tmp
File created	C:\Program Files\Synthesizer V Studio Flat\clf-data\is-QZM2VZC2F7.tmp	Flat_1.4.3_WiN_amd64_Installer.tmp
File created	C:\Program Files\Synthesizer V Studio Flat\unins000.dat	Flat_1.4.3_WiN_amd64_Installer.tmp
File created	C:\Program Files\Synthesizer V Studio Flat\is-C31CIZLWJG.tmp	Flat_1.4.3_WiN_amd64_Installer.tmp
File created	C:\Program Files\Synthesizer V Studio Flat\is-LHPXD4OSHH.tmp	Flat_1.4.3_WiN_amd64_Installer.tmp
File created	C:\Program Files\Synthesizer V Studio Flat\clf-data\is-WOARTV1A91.tmp	Flat_1.4.3_WiN_amd64_Installer.tmp
File created	C:\Program Files\Synthesizer V Studio Flat\clf-data\is-XR5WORYISZ.tmp	Flat_1.4.3_WiN_amd64_Installer.tmp
File created	C:\Program Files\Synthesizer V Studio Flat\clf-data\is-SP795XHEQI.tmp	Flat_1.4.3_WiN_amd64_Installer.tmp
File created	C:\Program Files\Synthesizer V Studio Flat\clf-data\is-6NLBIK2T1X.tmp	Flat_1.4.3_WiN_amd64_Installer.tmp

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Flat_1.4.3_WiN_amd64_Installer.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Flat_1.4.3_WiN_amd64_Installer.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Flat_1.4.3_WiN_amd64_Installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Flat_1.4.3_WiN_amd64_Installer.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2864	msedge.exe

Inno Setup is an open-source installation builder for Windows applications. 6 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral1/memory/1200-344-0x0000000000CC0000-0x0000000000DA6000-memory.dmp	innosetup
behavioral1/memory/3396-347-0x0000000000CC0000-0x0000000000DA6000-memory.dmp	innosetup
behavioral1/memory/1200-374-0x0000000000CC0000-0x0000000000DA6000-memory.dmp	innosetup
behavioral1/memory/3396-375-0x0000000000CC0000-0x0000000000DA6000-memory.dmp	innosetup
behavioral1/memory/3396-410-0x0000000000CC0000-0x0000000000DA6000-memory.dmp	innosetup
behavioral1/memory/1200-835-0x0000000000CC0000-0x0000000000DA6000-memory.dmp	innosetup

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134335472105960109"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 53 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sfpks	Flat_1.4.3_WiN_amd64_Installer.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Dreamtonics.s5pfile\DefaultIcon	Flat_1.4.3_WiN_amd64_Installer.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.svp\ = "Dreamtonics.svpfile"	Flat_1.4.3_WiN_amd64_Installer.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Dreamtonics.svpfile\shell\open\command\ = "\"C:\\Program Files\\Synthesizer V Studio Flat\\synthv-flat.exe\" \"%1\""	Flat_1.4.3_WiN_amd64_Installer.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Dreamtonics.svpkfile\shell\open\command	Flat_1.4.3_WiN_amd64_Installer.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Dreamtonics.svpkfile\shell	Flat_1.4.3_WiN_amd64_Installer.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\OPSV.sfpkfile	Flat_1.4.3_WiN_amd64_Installer.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\OPSV.sfpkfile\DefaultIcon	Flat_1.4.3_WiN_amd64_Installer.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\OPSV.sfpksfile\DefaultIcon\ = "C:\\Program Files\\Synthesizer V Studio Flat\\svpk-icon.ico"	Flat_1.4.3_WiN_amd64_Installer.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Dreamtonics.s5pfile	Flat_1.4.3_WiN_amd64_Installer.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Dreamtonics.svpfile\shell\open\command	Flat_1.4.3_WiN_amd64_Installer.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\OPSV.sfpkfile\DefaultIcon\ = "C:\\Program Files\\Synthesizer V Studio Flat\\svpk-icon.ico"	Flat_1.4.3_WiN_amd64_Installer.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\OPSV.sfpkfile\shell\open\command	Flat_1.4.3_WiN_amd64_Installer.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\OPSV.sfpkfile\shell	Flat_1.4.3_WiN_amd64_Installer.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\OPSV.sfpksfile\DefaultIcon	Flat_1.4.3_WiN_amd64_Installer.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\OPSV.sfpksfile\shell\open\command\ = "\"C:\\Program Files\\Synthesizer V Studio Flat\\flat-manager.exe\" \"%1\""	Flat_1.4.3_WiN_amd64_Installer.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.s5p\ = "Dreamtonics.s5pfile"	Flat_1.4.3_WiN_amd64_Installer.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Dreamtonics.s5pfile\ = "Synthesizer V Editor Project"	Flat_1.4.3_WiN_amd64_Installer.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Dreamtonics.svpfile\ = "Synthesizer V Studio Project"	Flat_1.4.3_WiN_amd64_Installer.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Dreamtonics.svpfile\DefaultIcon\ = "C:\\Program Files\\Synthesizer V Studio Flat\\svp-icon.ico"	Flat_1.4.3_WiN_amd64_Installer.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\OPSV.sfpksfile\shell\open\command	Flat_1.4.3_WiN_amd64_Installer.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Dreamtonics.svpfile\DefaultIcon	Flat_1.4.3_WiN_amd64_Installer.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.svpk	Flat_1.4.3_WiN_amd64_Installer.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Dreamtonics.svpkfile\ = "Synthesizer V Studio Installation Package"	Flat_1.4.3_WiN_amd64_Installer.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Dreamtonics.svpkfile\shell\open\command\ = "\"C:\\Program Files\\Synthesizer V Studio Flat\\synthv-flat.exe\" \"%1\""	Flat_1.4.3_WiN_amd64_Installer.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\OPSV.sfpkfile\shell\open	Flat_1.4.3_WiN_amd64_Installer.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\OPSV.sfpkfile\shell\open\command\ = "\"C:\\Program Files\\Synthesizer V Studio Flat\\flat-manager.exe\" \"%1\""	Flat_1.4.3_WiN_amd64_Installer.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\OPSV.sfpksfile\ = "Synthesizer V Studio Flat Installation Package"	Flat_1.4.3_WiN_amd64_Installer.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\OPSV.sfpksfile\shell	Flat_1.4.3_WiN_amd64_Installer.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Dreamtonics.svpkfile\DefaultIcon	Flat_1.4.3_WiN_amd64_Installer.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sfpk\ = "OPSV.sfpkfile"	Flat_1.4.3_WiN_amd64_Installer.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\OPSV.sfpksfile\shell\open	Flat_1.4.3_WiN_amd64_Installer.tmp
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Dreamtonics.s5pfile\shell	Flat_1.4.3_WiN_amd64_Installer.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Dreamtonics.s5pfile\shell\open	Flat_1.4.3_WiN_amd64_Installer.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Dreamtonics.svpfile	Flat_1.4.3_WiN_amd64_Installer.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Dreamtonics.svpkfile\shell\open	Flat_1.4.3_WiN_amd64_Installer.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\OPSV.sfpkfile\ = "Synthesizer V Studio Flat Installation Package"	Flat_1.4.3_WiN_amd64_Installer.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sfpks\ = "OPSV.sfpksfile"	Flat_1.4.3_WiN_amd64_Installer.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\OPSV.sfpksfile	Flat_1.4.3_WiN_amd64_Installer.tmp
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{453C1202-9910-4777-A4DC-D83152F9325C}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.s5p	Flat_1.4.3_WiN_amd64_Installer.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Dreamtonics.s5pfile\DefaultIcon\ = "C:\\Program Files\\Synthesizer V Studio Flat\\svp-icon.ico"	Flat_1.4.3_WiN_amd64_Installer.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Dreamtonics.s5pfile\shell\open\command\ = "\"C:\\Program Files\\Synthesizer V Studio Flat\\synthv-flat.exe\" \"%1\""	Flat_1.4.3_WiN_amd64_Installer.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.svp	Flat_1.4.3_WiN_amd64_Installer.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Dreamtonics.svpfile\shell	Flat_1.4.3_WiN_amd64_Installer.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Dreamtonics.svpfile\shell\open	Flat_1.4.3_WiN_amd64_Installer.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.svpk\ = "Dreamtonics.svpkfile"	Flat_1.4.3_WiN_amd64_Installer.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Dreamtonics.s5pfile\shell\open\command	Flat_1.4.3_WiN_amd64_Installer.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Dreamtonics.svpkfile	Flat_1.4.3_WiN_amd64_Installer.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Dreamtonics.svpkfile\DefaultIcon\ = "C:\\Program Files\\Synthesizer V Studio Flat\\svpk-icon.ico"	Flat_1.4.3_WiN_amd64_Installer.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sfpk	Flat_1.4.3_WiN_amd64_Installer.tmp

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3960	Flat_1.4.3_WiN_amd64_Installer.tmp
3960	Flat_1.4.3_WiN_amd64_Installer.tmp
3904	synthv-studio.mz
3904	synthv-studio.mz
3904	synthv-studio.mz
3904	synthv-studio.mz
3904	synthv-studio.mz
3904	synthv-studio.mz
3904	synthv-studio.mz
3904	synthv-studio.mz
1088	msedge.exe
1088	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3904	synthv-studio.mz

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
3960	Flat_1.4.3_WiN_amd64_Installer.tmp

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3904	synthv-studio.mz
3904	synthv-studio.mz

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 2436 wrote to memory of 1952	2436	msedge.exe	84
PID 2436 wrote to memory of 2864	2436	msedge.exe	85
PID 2436 wrote to memory of 1576	2436	msedge.exe	86
PID 2436 wrote to memory of 4920	2436	msedge.exe	87
PID 2436 wrote to memory of 1576	2436	msedge.exe	86
PID 2436 wrote to memory of 4920	2436	msedge.exe	87
PID 2436 wrote to memory of 4920	2436	msedge.exe	87
PID 2436 wrote to memory of 5000	2436	msedge.exe	88
PID 2436 wrote to memory of 5000	2436	msedge.exe	88
PID 2436 wrote to memory of 5000	2436	msedge.exe	88
PID 2436 wrote to memory of 4876	2436	msedge.exe	89
PID 2436 wrote to memory of 4876	2436	msedge.exe	89
PID 2436 wrote to memory of 4876	2436	msedge.exe	89
PID 2436 wrote to memory of 4624	2436	msedge.exe	91
PID 2436 wrote to memory of 4624	2436	msedge.exe	91
PID 2436 wrote to memory of 4624	2436	msedge.exe	91
PID 2436 wrote to memory of 3824	2436	msedge.exe	92
PID 2436 wrote to memory of 3824	2436	msedge.exe	92
PID 2436 wrote to memory of 3824	2436	msedge.exe	92
PID 2436 wrote to memory of 4656	2436	msedge.exe	97
PID 2436 wrote to memory of 1932	2436	msedge.exe	98
PID 2436 wrote to memory of 4656	2436	msedge.exe	97
PID 2436 wrote to memory of 1932	2436	msedge.exe	98
PID 2436 wrote to memory of 2432	2436	msedge.exe	102
PID 2436 wrote to memory of 4152	2436	msedge.exe	103
PID 2436 wrote to memory of 4152	2436	msedge.exe	103
PID 2436 wrote to memory of 4424	2436	msedge.exe	107
PID 2436 wrote to memory of 4424	2436	msedge.exe	107
PID 2436 wrote to memory of 4528	2436	msedge.exe	112
PID 2436 wrote to memory of 4128	2436	msedge.exe	113
PID 2436 wrote to memory of 2020	2436	msedge.exe	114
PID 2436 wrote to memory of 4812	2436	msedge.exe	115
PID 2436 wrote to memory of 4812	2436	msedge.exe	115
PID 2436 wrote to memory of 3648	2436	msedge.exe	116
PID 2436 wrote to memory of 3648	2436	msedge.exe	116
PID 2436 wrote to memory of 3648	2436	msedge.exe	116
PID 2436 wrote to memory of 4504	2436	msedge.exe	117
PID 2436 wrote to memory of 2460	2436	msedge.exe	118
PID 2436 wrote to memory of 2460	2436	msedge.exe	118
PID 2436 wrote to memory of 1200	2436	msedge.exe	119
PID 2436 wrote to memory of 3396	2436	msedge.exe	121
PID 1200 wrote to memory of 3960	1200	Flat_1.4.3_WiN_amd64_Installer.exe	123
PID 3396 wrote to memory of 736	3396	Flat_1.4.3_WiN_amd64_Installer.exe	122
PID 2436 wrote to memory of 1912	2436	msedge.exe	125
PID 2436 wrote to memory of 1912	2436	msedge.exe	125
PID 3960 wrote to memory of 4976	3960	Flat_1.4.3_WiN_amd64_Installer.tmp	127
PID 4976 wrote to memory of 3904	4976	synthv-flat.exe	128
PID 2436 wrote to memory of 1088	2436	msedge.exe	130

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://mega.nz/folder/fapgjJZK#hAVvsNvxZPW3WWQXw0j6bg
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffb719fc188,0x7ffb719fc194,0x7ffb719fc1a0
  2⤵
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1840,i,8385636590043051376,793229949882147210,524288 --field-trial-handle=2508,i,10818049400043050732,12866188190461515485,262144 --variations-seed-version --mojo-platform-channel-handle=2564 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2236,i,9275707538802612360,6420533271291919590,524288 --field-trial-handle=2508,i,10818049400043050732,12866188190461515485,262144 --variations-seed-version --mojo-platform-channel-handle=2572 /prefetch:8
  2⤵
  PID:1576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,894569620208697957,6776086247830833814,262144 --field-trial-handle=2508,i,10818049400043050732,12866188190461515485,262144 --variations-seed-version --mojo-platform-channel-handle=2504 /prefetch:2
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3416,i,5129785848473875192,7108337586978924864,2097152 --field-trial-handle=2508,i,10818049400043050732,12866188190461515485,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3420,i,14647737562492042343,13683494336059811914,2097152 --field-trial-handle=2508,i,10818049400043050732,12866188190461515485,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4120,i,15709675306200581539,16592643029717711172,2097152 --field-trial-handle=2508,i,10818049400043050732,12866188190461515485,262144 --variations-seed-version --mojo-platform-channel-handle=4156 /prefetch:1
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4132,i,13548778766315424290,8792078439008391811,2097152 --field-trial-handle=2508,i,10818049400043050732,12866188190461515485,262144 --variations-seed-version --mojo-platform-channel-handle=4184 /prefetch:2
  2⤵
  PID:3824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5024,i,12206943742843009692,3812477948437285873,524288 --field-trial-handle=2508,i,10818049400043050732,12866188190461515485,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3596,i,8334791991238633834,12348572046296909716,524288 --field-trial-handle=2508,i,10818049400043050732,12866188190461515485,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:1932
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,6316497280865446001,3240592781274466380,524288 --field-trial-handle=2508,i,10818049400043050732,12866188190461515485,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  PID:2984
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,6316497280865446001,3240592781274466380,524288 --field-trial-handle=2508,i,10818049400043050732,12866188190461515485,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5996,i,8497509920984022263,17636261858154502144,524288 --field-trial-handle=2508,i,10818049400043050732,12866188190461515485,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:8
  2⤵
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6560,i,9530137970038151251,3804391485274130077,524288 --field-trial-handle=2508,i,10818049400043050732,12866188190461515485,262144 --variations-seed-version --mojo-platform-channel-handle=6504 /prefetch:8
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4404,i,11698361698746112781,10337741780098641746,524288 --field-trial-handle=2508,i,10818049400043050732,12866188190461515485,262144 --variations-seed-version --mojo-platform-channel-handle=3416 /prefetch:8
  2⤵
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4312,i,10270406875325203282,8260747893670460918,524288 --field-trial-handle=2508,i,10818049400043050732,12866188190461515485,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:8
  2⤵
  PID:4128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4396,i,11727311067870480143,12503863128503131226,524288 --field-trial-handle=2508,i,10818049400043050732,12866188190461515485,262144 --variations-seed-version --mojo-platform-channel-handle=120 /prefetch:8
  2⤵
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6756,i,11222334377123360273,5876619253033108813,524288 --field-trial-handle=2508,i,10818049400043050732,12866188190461515485,262144 --variations-seed-version --mojo-platform-channel-handle=6780 /prefetch:8
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6764,i,9208601007855173947,17062442258120206789,2097152 --field-trial-handle=2508,i,10818049400043050732,12866188190461515485,262144 --variations-seed-version --mojo-platform-channel-handle=6716 /prefetch:1
  2⤵
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4128,i,6551583514728826323,18039908036184800207,524288 --field-trial-handle=2508,i,10818049400043050732,12866188190461515485,262144 --variations-seed-version --mojo-platform-channel-handle=6960 /prefetch:8
  2⤵
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7140,i,9869052893666637721,2321509289336237728,524288 --field-trial-handle=2508,i,10818049400043050732,12866188190461515485,262144 --variations-seed-version --mojo-platform-channel-handle=7144 /prefetch:8
  2⤵
  PID:2460
- C:\Users\Admin\Downloads\Flat_1.4.3_WiN_amd64_Installer.exe
  "C:\Users\Admin\Downloads\Flat_1.4.3_WiN_amd64_Installer.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1200
- - C:\Users\Admin\AppData\Local\Temp\is-7JISJWENCN.tmp\Flat_1.4.3_WiN_amd64_Installer.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-7JISJWENCN.tmp\Flat_1.4.3_WiN_amd64_Installer.tmp" /SL5="$70112,78211310,881664,C:\Users\Admin\Downloads\Flat_1.4.3_WiN_amd64_Installer.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3960
  - - C:\Program Files\Synthesizer V Studio Flat\synthv-flat.exe
      "C:\Program Files\Synthesizer V Studio Flat\synthv-flat.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4976
    - - C:\Program Files\Synthesizer V Studio Flat\synthv-studio.mz
        
        "C:\Program Files\Synthesizer V Studio Flat\synthv-flat.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of SetWindowsHookEx
        
        PID:3904
- C:\Users\Admin\Downloads\Flat_1.4.3_WiN_amd64_Installer.exe
  "C:\Users\Admin\Downloads\Flat_1.4.3_WiN_amd64_Installer.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3396
- - C:\Users\Admin\AppData\Local\Temp\is-2OAG4QINN0.tmp\Flat_1.4.3_WiN_amd64_Installer.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-2OAG4QINN0.tmp\Flat_1.4.3_WiN_amd64_Installer.tmp" /SL5="$D022A,78211310,881664,C:\Users\Admin\Downloads\Flat_1.4.3_WiN_amd64_Installer.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5752,i,7296655270854855699,1303813833466014377,524288 --field-trial-handle=2508,i,10818049400043050732,12866188190461515485,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:8
  2⤵
  PID:1912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=756,i,3370318303253027130,1462836155746822438,262144 --field-trial-handle=2508,i,10818049400043050732,12866188190461515485,262144 --variations-seed-version --mojo-platform-channel-handle=760 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1088

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4728

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3c4 0x3bc
1⤵
PID:2744

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

f0.dnni

Path C:\Program Files\Synthesizer V Studio Flat\f0.dnni
Size 1.7MB
SHA256 5a21cadf5012e838661d982e68f9a84038427ad0b44631bc088e2631871cd95e
MD5 485465e238c914c2488aac22f5702eb5
SHA1 ff0129581b6505dd450cd9fb0a5868b039ffda5f
SHA512 b0e7fdc6306539dc4ca5bbbfb88b4b09e51df389c3e0a03f7a7c5d5eedfab4c22ddf1703d78661f3bc1ee33d1dd01d08a7dffa11410b4012a22e600dc3ca55b6
SSDEEP 49152:IB4kTJEvKgc+cSVG9VmBY4vMhvEdq1so71Olp:IQ1RcSIVmHM9Eeso71C
TLSH
T16585330893A5175FF5D024F97432F6FCBF286DEF816B4B8762EC240759E42825A4389E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

flat-manager.exe

Path C:\Program Files\Synthesizer V Studio Flat\flat-manager.exe
Size 156KB
SHA256 a67554e695ad4ddf9c7903f5b6ec8ec6ac9e60323c72902413261707e1083673
MD5 5ce788dd1ffc43f7ae1931f20e7e1554
SHA1 f08c6606449e1b2951d6debd0a8366550a9a4ca6
SHA512 6ae56238ed8cc07bb791a32e8c964e2dd7cb2cb456d8ce5fe46244754d22ca06474ef79f085637348dcd575de462295e80bbb4885ed4ecc224f2332d8857dc99
SSDEEP 3072:GdEmOsmSnRSCR6+Cf5kxj7Dp/dC7ArEbgTaJoPd:sEIV0fKH8krg3m
TLSH
T187F30852311A98DADD1B28F14C0FD6A0924DB9EE922587CF39D3771A0AF3392107BD5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NotoSansCJKjp-Regular.otf

Path C:\Program Files\Synthesizer V Studio Flat\fonts\NotoSansCJKjp-Regular.otf
Size 15.7MB
SHA256 f18253affd968c8ea592d8df6d84b1d4c5d3a46d267e53a1f6749e6c4f76a23d
MD5 7ed4b9a7daaf1d1c71903a92059434fb
SHA1 03d1f98398da4ba4137aa177d419a2240ebe17fe
SHA512 993b2457eb9b9ffa3f023e9bfac77f97444df196047951dd22de0fa683b97eb5ff46fc01bb34697c9307794b0f9d8a24fbff531416bfd7d11597a8cfac891c61
SSDEEP 393216:WaxAaLuP4Khf/ypeQIesikPbvTuYbRvl8bJTimvAOopd/NtZCnpI4w1FT1IixLtv:WlaCP46f/ZQIykPbruYlvl8F//YhJCnM
TLSH
T145F6127E68FC6828CC57D1367646A53E66D90848854FE0FCE4D39FB23EE52240B6D6C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ornamentation.dnni

Path C:\Program Files\Synthesizer V Studio Flat\ornamentation.dnni
Size 1.1MB
SHA256 3d4a66d8e0b1872ff60f72d3814e5a6c137b1c78e02e238321d9d4ab50ab0b13
MD5 29e39a81c40ece169b476fe79f667664
SHA1 98b880efdbee283049d27e51d5ec8e39ad32b351
SHA512 24e5e358de7d6257dd7fe23d52355a189b08f87c1be42d4f0a66f7931a7b879e727fb0cfeb13b02b176d637ec2f62292c365046a8e7808867f135df62c7db487
SSDEEP 24576:zTS+kBf1Vwh9P5AYaaKI3yngUgRnwwlXzGaIz1KM5Rlx7:8BtVYPrKI3GgjOwlD1Iz1KM5RP7
TLSH
T1B63523017324A60BC60D1A711E93E2C663A0FD7B2F478341F1F26AAB69317861EDF65D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

synthv-flat.dll

Path C:\Program Files\Synthesizer V Studio Flat\synthv-flat.dll
Size 6.4MB
SHA256 82190eb21bf4a39fb34078ea777fc563d283c07193ffdfcff8703b85be965f2b
MD5 e179955074f813a45954ad54dcb7f4ae
SHA1 a6e6dc9dd07e071d565dabdde4cc45efe0b597e0
SHA512 f0c3e0d782acbb17e6d261ed91c8598b0ab32585e60efe0173a1246d86c52b35e8cc17dbebcd3ab944fec2f19e481986a7acb29a7f36432c6ddf9391a8a7d32d
SSDEEP 98304:O5yvYL1k6FF65Y/4GxZFr6vHbXanMC2nN+V:KUHeU7Xa4N
TLSH
T101665B2BE56A109DCA6ED1B0C35BA331BA30B894037479EF6650DBB02E61FD0177EB54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

synthv-flat.exe

Path C:\Program Files\Synthesizer V Studio Flat\synthv-flat.exe
Size 160KB
SHA256 5020faa0f9c9aec1ec901fd8fc80278de24f33a715dda0e70e0259d220a854be
MD5 e7fce33a5bc36cad6c90ee455b9688c7
SHA1 8e11f154d768c365ca51296005d82cbff8a44faf
SHA512 dac7069b82645980c2d71ac66676095e6537de8842a813a041142db064180ecda76beaf0b11510f88d6969990e16462ad5c92d3b64691075f18cde4614863eb3
SSDEEP 1536:4Ii/mm1uXtyQhvur3rHOZmeRf5I1kS/BUtsm4xir3rPKG+n3wsAbWqGTs:4smeLhvu7Lof54/BUT4ObPc3MSqG
TLSH
T1A8F36C73322FDAADDD2D0C39410895C5E7E4EEBED72905D32DE0764B04BA7E1087A866
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

synthv-studio.mz

Path C:\Program Files\Synthesizer V Studio Flat\synthv-studio.mz
Size 19.9MB
SHA256 efe4128ca9ebc8940fe336b2f6c22a9c6086bb24abb313736b8950e75d134d2f
MD5 0882046b99e3cb3d0907b8b049b74669
SHA1 26d4e00f633faf05a46ca26189776aa69dea87f4
SHA512 fa872fdeb2c7d0a7933944114931e3dffb4fbf82cd94036e1d26649062e98db6b7a03909cca23aeb54a7ab76c47f13fd0a2b61f3e3362979c54b66e2d603997e
SSDEEP 393216:n8FgKWbOghzGHYoSYYqZSdOGxM+4NmijOgyNNF25aBYwlks:qMbvzLYlZwOGxMlmLBPYYYw/
TLSH
T1032733AB516A52E5CF8147B42B8B18EC34C4785480FDA918768F5622F7A1C7E40DFEB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cc11c2ba3ec4cb292b61dd36af338e083bb0ce5868e654b17f3c58ecf3c8fdfb
MD5 22bfe5ff5070c92c37e54f6f278efd25
SHA1 2fc94025f3a738879f1fcececb95937cbaa0cdd1
SHA512 b57abd220e674cf733b39ea299fc66d6fe964ab448ae0758482efe80597e3678909cd989b9635acc0317001af0fe6dbbbccfd3cf110ec5ad1b9e4c084de22188
TLSH
T16FD09220B719A2C3E24704BA94A6AB52A916C57AA0B7F7017232640CAE65089F28F192
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 201729318e073e437978c4f830a6df095e397d14193bbab8cb94016e3e0e1540
MD5 038903102cb76ddedd18207430e00005
SHA1 e694b970e01eb43fddfb00d36857e2b64f8c931b
SHA512 bacb50167c8d736bccc259f2ffbffff915c7c6dc188c6c2c1476ded8cbd822ff968f690173d1b8e35c352ec62f9ace3913a556b80bc1a59211be000ee9ea7447
TLSH
T17DD092207759A6C3E24704BA94A5AB52A916C57AA0B7F7027232640CAE66089F28F192
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 c29ffe80475c47c3b4d604e3671f252b4afbaa80b8c518686eb18e0c7aa7387e
MD5 dabdb31d0e9aebfac9328afbdb33d3c2
SHA1 5be96d6062f1e8d2623a9ab53917cb24e6d774d2
SHA512 666fc31867ec2ba2902be4a9b3be7c39d403029fcdd6fe2e4fc510d90b72850735175714a5a92350a4efca6e164487c2cb60ad34603ac829e825868ff4f4f6c7
TLSH
T1C2711B370FF74462DB64B7B1ACE0C1033431C6C7F927AE669CE4AA7D1D187518998049
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5886a0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5886a0.TMP
Size 3KB
SHA256 2f7938191be40e4d513b6e5fc624960788a9b7c523774df215c4e923265617d3
MD5 8268603466a2a2fbff4c9a48e5aa8e2d
SHA1 f58c45b5b313c20bb30bbd49ba1d3089fee1d2b1
SHA512 0a7298201d03961261ef0b058dd1812dd6894a65d49f379433fe00fe70bebbaab7dea7b079fd05a976bc2cbb5c49cce53416532f7dc4aad25ff73f6825d9c31d
TLSH
T12D7119370FF70062DB61B7B1ACE0C2033471C6C7F927AE66ACE46ABD1D287418D98008
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\p\Paths\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 d24f58cde0cdd508fd5940ff7333092e0b88fc7bde211a44258852a046642705
MD5 e992a9299d108f11718145daceb2a778
SHA1 b0529a110f3db2dadbed5502c931e48cdf8a784d
SHA512 92db9fe19618f99c6970b6f447106b651fe5575c92e7a1829494b791b8d3fa9c11960fe68e68624da60da86e08d3f64168c252a9436c88517df80d0b4ee733f3
TLSH
T1AE31BEF783B185AEDE1152F09A04AF1BCE5C0512539C3C5A86D4AF57A3B3471E111A4B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 0173958e63ad91a041b9a20aa4be0f0c6a02c4db1da103999debce02fe8e8d72
MD5 3e0a840b1903b4918991f9e6c8470110
SHA1 5bfcc5740c280a35ca19595fc06476dcb45a442e
SHA512 6dc7d14bdba2e49799fd0627ed6de03db0727e2e04bd32aa81efcd3beabb5ec0cd5c024da76fbcd5d265f378438881275cc647292df4ac10870b86048f097f85
SSDEEP 192:sxZ3R2yM/jK1Ml8MWc/fGsiqTnIdpLPHW6+WNQCp/YIaklTIgrJ:sxZ3suc/fGs3ELHb7//9
TLSH
T12A52D9126A34A97BCCDBD209B955BF53D6F9547292900D44AAFCDA1C04E7BEC220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 bdea382659725550378f107be25035c37f7db768420a9f88dc767c7f45fc5d12
MD5 f0c4ad1d7584348503c76fa1a57a272f
SHA1 0497a5a8dd0b8ee93670fbce6da3df24aa85a31f
SHA512 a7ab0a789856d2448262203aab0cbfb0c31a9da46d0edd053224dcc6a337375fc9fe7d4cfbbd01d2be47d2c839ed7f4115bbd8b5791965aab3c374e9882dc844
SSDEEP 192:sxZ3R2yM/jK1Ml8UQtnc/fGsMwTnIdppPHW6+WNQTphXYICmvlTIg57J:sxZ3sqtc/fGsDEVHbkX9b
TLSH
T17552DA12AA34A977CCDBD20DB9557F53D6F9547292900E44AAFCDA1C04E7BED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 cc1953c0ee8c94198db52387d098b53200ec851be0154cd36fa367ab72063e40
MD5 3ac2412227e4426b25b76f89bec998a1
SHA1 51a9320ba0504e5bc2691e3bf01805ffab31a8d6
SHA512 d23f43997f2c79858ad56aa39d82eb3b9242691769f90163a79b92ab4cf661c238ea986152fe70abfb26c30b88918779deec96f2ec6480fd0e7e7f87cfca379d
SSDEEP 192:sxZ3R2yM/jK1Ml8Mnc/fGsMwTnIdpLPHW6+WNQTphXYIBMlTIg57J:sxZ3svc/fGsDELHbkXcb
TLSH
T13A52C8126A34A97BCCDBD20DB9557F53D5F9547292900E54AAFCDA1C04E7BEC220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 a38d04372e307b77c745595e9e962a4c59db76a2b55ef66394684067c1c4be56
MD5 de04a05013f872cd78c5f5e95c94bacd
SHA1 104e655ab9b415c868b08d36e498808ce6bf8f44
SHA512 58a5b4a33bea0eaf8711fd0d37338dbc9318e2d152d665a3085826134be47a6bf4c8aa07343d0b13be9d09d3bd134536765ba7cf18d525d2762172e65e30ce58
SSDEEP 768:0cxPsqxXlWvJD6T8F1+UoAYDCx9Tuqh0VfUC9xbog/OVk4Ll6AR9xkroKpk:0cxPsqxXlWvJD6Tu1ja54LAs9xvKu
TLSH
T11DD21C3B694CCB7D4F840E6CEC26AFD76ED801CB66988D4447FA894C03CB2EA51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 b9df2a0f2ad5e29a502506c7102a1fbc32b8a16a4f2ba4c8fc002b45115a14d0
MD5 d8f3c0f7fab7caf6ffc3f9001d49f021
SHA1 cbb94fedb72177a8601f483d6c7de3df95daec2e
SHA512 9907030145b8c964b463fa78a8cb299a510212523d4534304d0d2824c3ebcb94b43514ac4c06b95fab2b7c6dd6d0ee3480630389963bb6ef38556d1f11ff69ba
TLSH
T187A00232095480A5C4100272967301A4661188201A0A226590A44164DC51189411742D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe589a28.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe589a28.TMP
Size 48B
SHA256 577652871552922ca5e29024b91afbb8224ac747845eefc1de13555fad44d104
MD5 b324772083a20fbf6ca05db67bb40baa
SHA1 7bf6a8c1bb2392f69b721b6bf67849ce4c68bc42
SHA512 6ebaafa29914a3b375416fb4b8affaba7343c4cecdb208348dec7a198e2963bb38039b3c4c589d14c4796cac597bf4e057b882933fb25272ea4630f8bf1c7af2
MD5 SHA1 SHA512

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 1KB
SHA256 8c1efa50dcc68a657be834a87c735067b8c9a36163609dfb126952323dd8cfb4
MD5 91339e05d13983ddabccd2b218ad1970
SHA1 5dfa0f06a7dab799046ebe1d5fb80225c6035383
SHA512 f1f497b5fafbbb375bb48f733a197ecee981bd2b85c533614043995f6384b857b457a5eae5086bbfb789617f812a04bcdc824f46efccff7b41525e2c0fe44a69
TLSH
T1CA214481F3A910547E89B5C1C289AA03F4B13F5B160DE935271E84F58F44C180F6ED71
MD5 SHA1 SHA512 TLSH

Submit Download

e7d81b62-9b45-4f0e-a081-450f99b52e16.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\e7d81b62-9b45-4f0e-a081-450f99b52e16.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 c95db93f69895f5731bc1c212ebb51a3e0b63ebd35bc096a2de49369378ddce2
MD5 6f486160396e07707863b2d56d20102d
SHA1 290fe24025453bd86356e9db16101e733601cf7e
SHA512 2c478f935ee69d6ce3febc797f6d85e80b43972b00e5c1bde9e8f96416a5245dbbee1595d8af3cc8566f3eeb0bfb156c91f96bba5bc4b4d023f476be3ff44127
SSDEEP 384:bZcIhsNhDCBb8HSVRNPOwG9OY3xuvzxV+MhdpiBYo+:DhQgHPOwG9n34184piC5
TLSH
T188828D716C646C775DEBA145FD4733038EB8807BAAC86E80D5ED6F1D01CB6A8131AC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 f5e07bd60982382d516a31c35350cb5f265bc00eac509a0df33ff43ac5e8d50a
MD5 3057334f38ca5808cb70851b7973d8be
SHA1 cab30fc2ca182fccda9494141086043590dd1da9
SHA512 b4e05c008ca8dd6dee99de708cab683bf38339c15ad5bf0d5f526e7917cb117cbea4aa554328fe386143e79bf2aebdf23c2fdf960071c9533dbb75f413234bc4
SSDEEP 384:eiFgZcIpsNz8TUNTUlIlgCBbMYSVRNPOwG9Of3xuvzxV+MhdpiBYo+:1FepuwgJgHPOwG9g34184piC5
TLSH
T189C229F258D79C76D9AE5743AB7E2E038EBCC067B5849A40B3895A0CCC861BFD306C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 2d3b7c38dfbaf15c2dfffa3e33cc5825a0c0cd14281e1093e370172f4f82ea32
MD5 3364e1660343d04aa8368617d05b4758
SHA1 e9ca5124059f7c3eeadc0e7b681c7fa32e51e943
SHA512 cc8065630d761b908648e09d013510e86a15c12f7be431789dcf593e5882e81065a155174cb60ab2a394195f79352ddd76641cca10991fff6f0fde21249c3bbb
SSDEEP 384:eiFPZcIpsNo8TUNTUlIlgCBbcYSVRNPOwG9OD3xuvzxV+MhdpiBYo+:1FHpLwgpgHPOwG9w34184piC5
TLSH
T17BC229F258D75C76D9AE5743AB7E2E038EBCC067B5849A40B3995A0CCC861BFD30AC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 2553327f09c506777ff47ef7eae6c2d6cf42497e81ef4f7909d25cf05cdbb311
MD5 ce075fdc2042ad598ca61bfcabae6f04
SHA1 961ee69fbdd04a1102c4a546ff70eb3a841755f0
SHA512 c0d8908c74af132ee9ee092ce33ce57bdaeb70cbb510e3bc28dfefac47f9f47351b1a968089f546db66d7be1cac215871c5db6b775624773bc3044b21917642c
SSDEEP 384:eiFQZcIdsNz8TUNTUlIlgCBbkYSVRNPOwG9Oz3xuvzxV+MhdpiBYo+:1FuduwgRgHPOwG9+34184piC5
TLSH
T183C229F258D79D76D9AE5703AB7E2E038EBCC067B5849A40B3895A0CCC861BFD306C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 0f959e4deca830e4dd61a5e1c6d87031074c0aaa9c8157d26c7f7e6267f070c7
MD5 95c9133f12db080225f0c38fc01ab223
SHA1 4e580d04fe24261c44b5b8e1cf34eb7f2e3760f1
SHA512 f758cb42b75bd11177db0f29698991b2a4ecdc9d3efc11d49fad92b1d4cb7b1331ec22d0d3b6770b7aaac0199b9804873b9d69d6e8deb39bc10a76f619fe3430
SSDEEP 384:BZcIhsNh0CBb8HSVRNPOwG9OY3xuvzxV+MhdpiBYo+:JhrgHPOwG9n34184piC5
TLSH
T11F827D7168646D775DEFA145FD4733038EB8807BAAC86F80D5ED6F1D01CB6A8131AC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 5e11f2f7b3ef449b76a817d827b8f8b0fc3077887f7c8cb2a0c1f87d7806f432
MD5 3257c8f645d15f021aa7c744fb82f5bb
SHA1 3daeef83fc126e9b9f6102845d43f2706ea2b2d9
SHA512 09e04307f1f240731fe7cb49f531bf7e1003d3770caa600f5a6dbe3ea7b09ac06c966e8af873235bab34bb9aaa07493d6cc0e0d5a461681c73e640bf72c32ac2
SSDEEP 384:eiFTZcIIsNo8TUNTUlIlgCBbcYSVRNPOwG9OD3xuvzxV+MhdpiBYo+:1FLILwgpgHPOwG9w34184piC5
TLSH
T125C229F258D75C76D9AE5743AB7E2E038EBCC067B5849A40B3985A0CCC861BFD30AC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d98d51ecd111d799f303711eee0ea08af0d7030caeb9127166abbc03c302199b
MD5 56fc5bfd5a05890ecfd9abc8edddfe2f
SHA1 e8ee67df3e3394bbab85045daac910114180352b
SHA512 4380a6aba63b6fedea5ac90ff1975cf7c7f43bc62a5689382b860ef84ca3888a0bc71109a373446f6df5ae4b135c89fdcd03e98c6f4eb7e96ca4c179bc419cca
SSDEEP 192:tONY6JkRtQmiUyOYW+RNPOmlhPXh3MRmoU6:tONY6Ur2W+RNPOwvMU6
TLSH
T13202E7356D386C7B9EE3AE09B98B27175FA4207BB9952F80DAD81F0C01D765C2307836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 911312008030be1f147179e5cba6f49bf124527778cd1e69fee7684b1d114767
MD5 88b58cf656ceaa33d9e480014e73227a
SHA1 b94a1d5132c3aaacf6700cb1be3c9e2e98ac2f34
SHA512 1404a811df022718ece635f58fdb2697fd79be6c33b1e8d9c83a8e375c9e07cda4d8319e7c0b5d09e55eeaaac9cfa0978de6e5a5f7f5926a63ad18a2f45aa5f9
SSDEEP 384:pZcIwsNhgCBbkHSVRNPOwG9OY3xuvzxV+MhdpiBYo+:hwPgHPOwG9n34184piC5
TLSH
T190826D716C646D775DEBA145F94733038EB8807BAAC86F80D5ED6F1D01CB698231AC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 0a2cfec00a100aa9576d37538e6439ea8eec7965852b431b76e33268480e3ae0
MD5 49e05af1f3345f482d3bf7010087a533
SHA1 cb91d65ade75b225636ad4acd354d6c869c3f283
SHA512 ae3ab6f87b49fb6a3924f15f9c00275b1944ba8cfe139ef41201e189674dc7563e6e8b5fa141ab961520643ce69854eb70a25fe69ff69ea9219433ca96f24d04
SSDEEP 192:yONNS6JkRLQmiUyWYO+RNPOmlhPoB9SFiVcxqGTU6:yONU6U9YO+RNPOwG9OF3U6
TLSH
T1D2121A32AC789C775EE36845F98732138EB4513BEA896F80D5DD2E0C01DF69C230AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 1d3fafe2b5dd5ce3de59534dfe6c8e1559c091c87e3f74208e508a526c7cb730
MD5 15356d8dd7ac2c58e2ea7701f7feb9da
SHA1 438237dd8e74fa724f9d6029fe1a728b42d81198
SHA512 fce16d81dbb6cd79683ec0af73fdb5a1091bb07b4e765e181e29fd6a5a9f45523241a0d96327c206118aef9007a634453f016026fc669a494a411d2e1a2666a2
TLSH
T15B41185CA6EA1148B3B76F56AFF6986D487BBD772E07D45E10010E4F0A63B40C8A1B37
MD5 SHA1 SHA512 TLSH

Submit Download

Flat_1.4.3_WiN_amd64_Installer.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-7JISJWENCN.tmp\Flat_1.4.3_WiN_amd64_Installer.tmp
Size 4.2MB
SHA256 070cd43ecfb8dbeb89e037a1043d91e57ecda8e20f2f1a251143175fdc0fd38d
MD5 bbef85b5a180eda4adddbda379e280ad
SHA1 466505761932b4ece5bf80baee569367792ba8bd
SHA512 9247456496c91b84d8ce11828d972d95171f7f71a131ee12144c01757f754d6c61d87bf696064e347aa559d6cdddbeb1bd27feb99a7332a2774a370a6c8376ab
SSDEEP 98304:Q9SZUvl30aj90ZFcvdQ0hdgvminQLMj+Jp333O:nItJj90Z6RgKw3
TLSH
T1BA168E03B388753EE4B71A3A883FA654583F7A213A26CD4B6BF40D5C4F396416D2A747
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

is-W0NGS6JR2D.tmp

Path C:\Users\Admin\Documents\OPSV\Dreamtonics\Synthesizer V Studio\htmls\flat-manager\monacoeditorwork\is-W0NGS6JR2D.tmp
Size 11.6MB
SHA256 f1f9d0ebeee50d4ee4a37e1c1abed3f40093db334d1b643dccabc1368aa59326
MD5 d4793a11db2f1b8b46c0ec71d8c87bc4
SHA1 6d8222e8861010737d5ce0387aae62f596d76e2b
SHA512 fa94d9168994d71ad2d6397e9bf5277126871556a484344ea0a0d5a80d44b5794cc4f17df4e652b0d435b829ae06fa3bfe07bb00ff823595a5e9ed7eb3fdc162
SSDEEP 49152:3SsBzp4UvcDLhjO46svNlC4txNBeXwG6wrYQnDz3ikxE/XiZgqxNeZCyVmLPNMZX:3b4UveLoVimLPNMnJ
TLSH
T121C6196A79E324320257B17AAF6F9045B635A043310CDC947F9C93A05F4AD7862F7BE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

session-3904

Path C:\Users\Admin\Documents\OPSV\Dreamtonics\Synthesizer V Studio\recovery\session-3904
Size 16B
SHA256 a71be1d30b19ff7c7f3de49815313844267d5efad4e5144f97a426f816dc0b0d
MD5 be32553e926a8be49c2ca9ca455066b8
SHA1 ec1c8e7f28f2da1e3c0ecb424f973a65a151a7b6
SHA512 db3b4bc8b9d95459439122904b94f2aafcc913113f5f7ef30455fbd4b388fd49f53ba14cb61764695d845170816b1b76fc42b1c27c2effaa3516869f058e4ae6
MD5 SHA1 SHA512

Submit Download

settings.xml

Path C:\Users\Admin\Documents\OPSV\Dreamtonics\Synthesizer V Studio\settings\settings.xml
Size 129B
SHA256 fa2bcaa706e3c86e1e0d97e837791fb43d1651d2c3d48a34704e1e09a427b07e
MD5 9d968cb5e460c8d43313c6d5e26fe62f
SHA1 1b92704da5123f487ea7388e81f0675777232c44
SHA512 380b0cf5af126f795787e7d5c71a4feb9e8c2390362cb1f458598c57da5ce5e30b1148a4abd77cbb6b24ee77ebd214d84cb8790a7a7510623ab61af60297a02d
TLSH
T12BB092EA2102AD6A17A35A219A5ACD441271A5ED09C21A6426AB09A3254A8D807C728D
MD5 SHA1 SHA512 TLSH

Submit Download

de-de.txt

Path C:\Users\Admin\Documents\OPSV\Dreamtonics\Synthesizer V Studio\translations\de-de.txt
Size 23KB
SHA256 64da88425dc5a0969747ccb94de667790c7209d228d5042723a4328b0b53c408
MD5 c6ac734c6c9f5fa0faec173aa475dbe1
SHA1 5470ff2cd54456a623f54877bd66bf3a05418952
SHA512 894cc36878a01abc526fa9dfb8cf15590c530731b232defc5fec02ac04935093d69867e769179bb6080f67f1b4b3d841e386885bceab3bfb5a4f6ca14296d52e
SSDEEP 384:qn7a9fjGPSXUtpzq4ztTYEO0L4xbWD/naV73nv/L+Z1zEjrqueg2l8ocZjV6:njGaktpRYEO0MxbW7ahs18h0lbX
TLSH
T152B2A53999038A3416F9C345A1128E6BFA158F52533C281D359FD60D0FAF82B52EB37E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

es-la.txt

Path C:\Users\Admin\Documents\OPSV\Dreamtonics\Synthesizer V Studio\translations\es-la.txt
Size 36KB
SHA256 80cd3f3ef915de1f8f03cb7b9271f95de81e83d7da1c9821957a97425ecc1aa5
MD5 6d23cd853562992d2a279d9fa4084503
SHA1 4dad73af04a6944a4ca5f6a42a6245eef7a1cfa8
SHA512 0cc130ebc16192b79bd2687b555ea067942f095911783335a8b04b057a15dacf757bcae99d7a74211536811f080f81f3376b600448912b9ea5d94cc33a7eb734
SSDEEP 768:oNvyxjGy1nKXOSKPqkxMTEaEk6g1Gi2XtujfcVF8BTuZhC:ow1KXQPqkxMwkpH2XtGcVF8BTuZhC
TLSH
T1F403A43CE6C20F3014F6424AA112D623F5904B56337D885E709F965C2BADE5F86E73AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fr-fr.txt

Path C:\Users\Admin\Documents\OPSV\Dreamtonics\Synthesizer V Studio\translations\fr-fr.txt
Size 24KB
SHA256 06575bbf6a0481397388984d250c708fcc52531d73908c6d977ad7d54316e28a
MD5 8bffff707c0c6f0606329a624e25697e
SHA1 a9046a39e2eeb6252a195bac2c5fc62df63ab735
SHA512 7f1a67960b88042b4992cf3c37382103aabc1221717c83c1e5283475e301587c7bf65db6ba358b8b4318adc7944ae0775d1cd979a04fd7442def2daed8c1f1ca
SSDEEP 384:EWJHZGA4BTWDHNGiuVEiQ+kZXZlFpSQvRf4kyhVm:bJ5F4BiDHNGiuVE9+kZ5f4M
TLSH
T1AEB2A529E5C1553004F6429AF112DA17F9288F96237C1A2C78CBDA0D0BAE96F93D737D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ja-jp.txt

Path C:\Users\Admin\Documents\OPSV\Dreamtonics\Synthesizer V Studio\translations\ja-jp.txt
Size 64KB
SHA256 84c566fd018aad6ac564f3130177b8e9805d13ea900145f2e37f4e0c3f78e7ca
MD5 4184e13972f55b780f97c08e5b975e5a
SHA1 7ff7536deff2206c5786ce3e120f3fe18597f806
SHA512 e254a211dda019c411b957471d658c2f90beb23b88610dea95346e06c15fbd35af0736f4b82ca8132c5825a434723ac17355202a8e36fa9e53c266af357443c1
SSDEEP 768:MYFadikqjwh0fTbkqbeEzoxw+WY93KScgdaf4llv2EXMjpp61G5VBCjjKb9hYE9D:MD/GrKEc1WY93KScgWo2EXXSVB9/YA73
TLSH
T1D153702CD38158384872C2B614497AC2EA068F0AEE7E2A2D342FD42D6F6C55FE5D577C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ko-kr.txt

Path C:\Users\Admin\Documents\OPSV\Dreamtonics\Synthesizer V Studio\translations\ko-kr.txt
Size 40KB
SHA256 00da6d869882a957c298d5693ce78328ef7ce344d811de0bab9b8e9649bb718f
MD5 cdbb34d071bc814e199765084ffbfbc2
SHA1 2681822e0aed92d8c038e61928477217f1a6c629
SHA512 31ab4270e6dacfecac8d1042634ebb7187c23cf40bf7edc4bad2fe6e737af3253bb469c1763f20457e760c7a83900cd6cc7e1a9fabf19e64d972d414d739c577
SSDEEP 768:6ASPHr+7fDeGjrPFiEHna1v4o9cBAPb1GrWh90CojgBBzPA:0cSIF7na1vT9GARPh9AgBBz4
TLSH
T14603C6B9B4830A6811F7850DA851A154E6818B27BB3E084CBC4FCD0C8F6D97B45DB7BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pt-br.txt

Path C:\Users\Admin\Documents\OPSV\Dreamtonics\Synthesizer V Studio\translations\pt-br.txt
Size 27KB
SHA256 1f9273b4ef529f4a880aa424d2e209457db6617d663124eaf1850c301207bc07
MD5 b158253e4b8e1e9b8704f3f3d5ecad5b
SHA1 5d5c040eb6608d6af98dfcdeda171c81ff02dfa2
SHA512 c206429f8ab06476e04ca94405bad3310398e5e2538bde6228264a980af726933a74a1311a2a3bd2ef49756782dae13d61e5a3344684add3e480f1f47ae3f5fc
SSDEEP 768:GEF6VrP6kcgugQ7etpjTuBxC8AHWLCl1GJwxhEmL5yLSz:GEFIP6DhE56XCfewxhPZ
TLSH
T121C2B93DDA800EF409AF034B716B9A17B6548F62760C806E725F871D2BEDC6446EF366
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ru-ru.txt

Path C:\Users\Admin\Documents\OPSV\Dreamtonics\Synthesizer V Studio\translations\ru-ru.txt
Size 55KB
SHA256 96cce95962b0139871c827f81b3d93b57c3a2da1c2812453d3d7213c3f20bfb2
MD5 b3db5203fd9d8507516ca790ca61fe68
SHA1 777a6fe39ef0495e9228eac059e3e3b0b86774e6
SHA512 b2c20f322f3c74cfd3e2ff2fcab12bfa53c0fe28aeb39c9608d5ea106114bc54686d5031d8cdefc6a59c79bc0b9cdee03f199be9fb78db7be236eaef9ef4cc4b
SSDEEP 1536:SjEsLi1XUgtcUA+e1o9fECnXGXjdFprjyv:SjEZzuCpXUjVyv
TLSH
T1BB430E25524665A90165B04BD8047D09BC6A0BBE3F7F37DD343A2D2E36FE42782E932D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vi-vn.txt

Path C:\Users\Admin\Documents\OPSV\Dreamtonics\Synthesizer V Studio\translations\vi-vn.txt
Size 38KB
SHA256 3cb414b37a6df85373c213f39cb1fa63bae616cf6fb17a34f502b718c225288a
MD5 8a78e7dcef75bf86bb0287967dbb31c2
SHA1 3361c7b36e95cc8df0473871c205033e248ec32c
SHA512 d83be15e71603aea521452ef558f352cb4b55aad6e370ed718b69596ea02bc7a2ff2c5e1b717132f4a6e8f68fe29d22047af16d52aa41ca413e626b06703422f
SSDEEP 768:j7SgvljZglpNnAOy6XkEQhFCEmDrWSwQuP21G+lsN7PeKSuk19JH:j7SGjuTNnosChFCEmDrfwQOwLls9PeKW
TLSH
T1F403C629A2C12A3644BE821DC049405AFEDE8F1E735C8E6D359F542C1F3EC576AE176C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zh-cn.txt

Path C:\Users\Admin\Documents\OPSV\Dreamtonics\Synthesizer V Studio\translations\zh-cn.txt
Size 52KB
SHA256 be7da8849d43405177efe21d785e4ce0afcbc4779e28d49e28382de8d50a42c7
MD5 673725d6d0a80fb435628fb327300b9e
SHA1 c82cc74d505be2f02521f84b9a7e8a26bad09d40
SHA512 f24ca98128c808c2a7a2b3b88a17bf85648e1e58a0cbc82a440f5ffdf5dcefa9c6840234c1d0ffb007b951df4c450ff4034e618352bbc63fcfc49df451a0d3c3
SSDEEP 1536:KKJEzUqGqg8p8mj+pBGLzHx6n667Ew0oo0F3m:UTw0
TLSH
T15933E67ED501CA742477824A6159152BF9100B1A633D4E1C3C5FA60E6FAD83F2AEE37E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zh-tw.txt

Path C:\Users\Admin\Documents\OPSV\Dreamtonics\Synthesizer V Studio\translations\zh-tw.txt
Size 52KB
SHA256 4bd211ef5624cca13efe4cbf18417b3093defba00b749d739b7e8b5395a0c67a
MD5 fa0e12a55825f05ce9f828f7d6e0a4f3
SHA1 0839a209e5c9c68e7f5a38258d8aa1f5de916ec5
SHA512 cc10faa22ab7bb6b8e5c5228174b3584a87464cfb8f06f0a69059ec5374c776497a8d429893b0234973787146121f021c8e9d81b790fd33db3608cb804601b91
SSDEEP 768:gPrNP7Ip7nc8HIJzQQNJZxsOs5oEH3F23I4K5RIBDIesatbmlAkV0MqYg91G19it:g5P+ykAZxsJNH3F0I4Kplmql6DhB0md
TLSH
T18533D67ED442CE28247782497156196AE9140F1A2B3D0D1C3C5FAA0E6F7D83F56EA33E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/736-376-0x0000000000AD0000-0x0000000000F11000-memory.dmp

Download

memory/736-407-0x0000000000AD0000-0x0000000000F11000-memory.dmp

Download

memory/736-409-0x0000000000AD0000-0x0000000000F11000-memory.dmp

Download

memory/1200-344-0x0000000000CC0000-0x0000000000DA6000-memory.dmp

Download

memory/1200-374-0x0000000000CC0000-0x0000000000DA6000-memory.dmp

Download

memory/1200-835-0x0000000000CC0000-0x0000000000DA6000-memory.dmp

Download

memory/3396-347-0x0000000000CC0000-0x0000000000DA6000-memory.dmp

Download

memory/3396-375-0x0000000000CC0000-0x0000000000DA6000-memory.dmp

Download

memory/3396-410-0x0000000000CC0000-0x0000000000DA6000-memory.dmp

Download

memory/3904-843-0x0000000000620000-0x0000000000632000-memory.dmp

Download

memory/3904-838-0x0000000140000000-0x0000000142CEB000-memory.dmp

Download

memory/3904-837-0x00007FFB80C60000-0x00007FFB80C62000-memory.dmp

Download

memory/3904-836-0x00007FFB80C50000-0x00007FFB80C52000-memory.dmp

Download

memory/3960-834-0x0000000000C00000-0x0000000001041000-memory.dmp

Download

memory/3960-441-0x0000000000C00000-0x0000000001041000-memory.dmp

Download

memory/3960-825-0x0000000000C00000-0x0000000001041000-memory.dmp

Download

memory/3960-377-0x0000000000C00000-0x0000000001041000-memory.dmp

Download

memory/3960-430-0x0000000000C00000-0x0000000001041000-memory.dmp

Download