hxxps://github[.]com/deadlock-mod-manager/deadlock-mod-manager/releases/download/v1[.]1[.]0/Deadlock[.]Mod[.]Manager_1[.]1[.]0_x64-setup[.]exe

Analysis

user interaction
yes
max time kernel
107s
max time network
107s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/10/2026, 19:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://github.com/deadlock-mod-manager/deadlock-mod-manager/releases/download/v1.1.0/Deadlock.Mod.Manager_1.1.0_x64-setup.exe
Sample261020-ydvbmad18x

Score

8^/10

defense_evasion discovery spyware trojan

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
27	1360	msedge.exe

Executes dropped EXE 3 IoCs

pid	Process
2116	Deadlock.Mod.Manager_1.1.0_x64-setup.exe
3568	Deadlock.Mod.Manager_1.1.0_x64-setup.exe
772	deadlock-mod-manager.exe

Loads dropped DLL 9 IoCs

pid	Process
2116	Deadlock.Mod.Manager_1.1.0_x64-setup.exe
2116	Deadlock.Mod.Manager_1.1.0_x64-setup.exe
3568	Deadlock.Mod.Manager_1.1.0_x64-setup.exe
3568	Deadlock.Mod.Manager_1.1.0_x64-setup.exe
3568	Deadlock.Mod.Manager_1.1.0_x64-setup.exe
3568	Deadlock.Mod.Manager_1.1.0_x64-setup.exe
3568	Deadlock.Mod.Manager_1.1.0_x64-setup.exe
3568	Deadlock.Mod.Manager_1.1.0_x64-setup.exe
3568	Deadlock.Mod.Manager_1.1.0_x64-setup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	deadlock-mod-manager.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4372_1036710718\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4372_1036710718\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4372_1036710718\protocols.json	msedgewebview2.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	deadlock-mod-manager.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	deadlock-mod-manager.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	deadlock-mod-manager.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	deadlock-mod-manager.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Deadlock.Mod.Manager_1.1.0_x64-setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Deadlock.Mod.Manager_1.1.0_x64-setup.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1360	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies registry class 49 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\deadlock-modmanager\shell\open\command	Deadlock.Mod.Manager_1.1.0_x64-setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\dlmm\URL Protocol	Deadlock.Mod.Manager_1.1.0_x64-setup.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\dlmm\shell	Deadlock.Mod.Manager_1.1.0_x64-setup.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\deadlock-mod-manager	deadlock-mod-manager.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\deadlock-modmanager\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Deadlock Mod Manager\\deadlock-mod-manager.exe\" \"%1\""	deadlock-mod-manager.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\dlmm\DefaultIcon	deadlock-mod-manager.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\dlmm\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Deadlock Mod Manager\\deadlock-mod-manager.exe,0"	deadlock-mod-manager.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\deadlock-mod-manager\shell	Deadlock.Mod.Manager_1.1.0_x64-setup.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\deadlock-modmanager\DefaultIcon	Deadlock.Mod.Manager_1.1.0_x64-setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\deadlock-modmanager\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Deadlock Mod Manager\\deadlock-mod-manager.exe\",0"	Deadlock.Mod.Manager_1.1.0_x64-setup.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\deadlock-mod-manager\shell\open\command	deadlock-mod-manager.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\dlmm\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Deadlock Mod Manager\\deadlock-mod-manager.exe\" \"%1\""	deadlock-mod-manager.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\deadlock-mod-manager\ = "URL:dev.stormix.deadlock-mod-manager protocol"	Deadlock.Mod.Manager_1.1.0_x64-setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\deadlock-mod-manager\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Deadlock Mod Manager\\deadlock-mod-manager.exe\",0"	Deadlock.Mod.Manager_1.1.0_x64-setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\dlmm\ = "URL:dev.stormix.deadlock-mod-manager protocol"	Deadlock.Mod.Manager_1.1.0_x64-setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\dlmm\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Deadlock Mod Manager\\deadlock-mod-manager.exe\" \"%1\""	Deadlock.Mod.Manager_1.1.0_x64-setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\dlmm\URL Protocol	deadlock-mod-manager.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\deadlock-mod-manager\shell\open	Deadlock.Mod.Manager_1.1.0_x64-setup.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\deadlock-modmanager\shell	Deadlock.Mod.Manager_1.1.0_x64-setup.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\deadlock-modmanager\shell\open	Deadlock.Mod.Manager_1.1.0_x64-setup.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\dlmm	Deadlock.Mod.Manager_1.1.0_x64-setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\deadlock-modmanager\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Deadlock Mod Manager\\deadlock-mod-manager.exe,0"	deadlock-mod-manager.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\dlmm	deadlock-mod-manager.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\deadlock-mod-manager\URL Protocol	Deadlock.Mod.Manager_1.1.0_x64-setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\deadlock-mod-manager\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Deadlock Mod Manager\\deadlock-mod-manager.exe\" \"%1\""	Deadlock.Mod.Manager_1.1.0_x64-setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\deadlock-mod-manager\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Deadlock Mod Manager\\deadlock-mod-manager.exe,0"	deadlock-mod-manager.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\deadlock-mod-manager\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Deadlock Mod Manager\\deadlock-mod-manager.exe\" \"%1\""	deadlock-mod-manager.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\deadlock-modmanager	deadlock-mod-manager.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\deadlock-modmanager\URL Protocol	deadlock-mod-manager.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\deadlock-modmanager\shell\open\command	deadlock-mod-manager.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\dlmm\shell\open\command	deadlock-mod-manager.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\deadlock-mod-manager\shell\open\command	Deadlock.Mod.Manager_1.1.0_x64-setup.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\deadlock-modmanager	Deadlock.Mod.Manager_1.1.0_x64-setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\deadlock-modmanager\ = "URL:dev.stormix.deadlock-mod-manager protocol"	Deadlock.Mod.Manager_1.1.0_x64-setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\dlmm\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Deadlock Mod Manager\\deadlock-mod-manager.exe\",0"	Deadlock.Mod.Manager_1.1.0_x64-setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\deadlock-mod-manager\ = "URL:dev.stormix.deadlock-mod-manager protocol"	deadlock-mod-manager.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\deadlock-modmanager\DefaultIcon	deadlock-mod-manager.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\dlmm\ = "URL:dev.stormix.deadlock-mod-manager protocol"	deadlock-mod-manager.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-895009113-1202185046-1686627690-1000\{5237D8A9-05C4-4759-A071-EDABB72E3DA7}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\deadlock-mod-manager\DefaultIcon	Deadlock.Mod.Manager_1.1.0_x64-setup.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\dlmm\shell\open	Deadlock.Mod.Manager_1.1.0_x64-setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\deadlock-mod-manager\URL Protocol	deadlock-mod-manager.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\deadlock-mod-manager\DefaultIcon	deadlock-mod-manager.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\deadlock-modmanager\URL Protocol	Deadlock.Mod.Manager_1.1.0_x64-setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\deadlock-modmanager\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Deadlock Mod Manager\\deadlock-mod-manager.exe\" \"%1\""	Deadlock.Mod.Manager_1.1.0_x64-setup.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\dlmm\DefaultIcon	Deadlock.Mod.Manager_1.1.0_x64-setup.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\dlmm\shell\open\command	Deadlock.Mod.Manager_1.1.0_x64-setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\deadlock-modmanager\ = "URL:dev.stormix.deadlock-mod-manager protocol"	deadlock-mod-manager.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\deadlock-mod-manager	Deadlock.Mod.Manager_1.1.0_x64-setup.exe

Modifies system certificate store 2 TTPs 6 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 0f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf157614090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a0b00000001000000180000005300650063007400690067006f00200045004300430000001400000001000000140000003ae10986d4cf19c29676744976dce035c663639a1d0000000100000010000000280cf6042c30a2646644ba7286a3aa97030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df02000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	deadlock-mod-manager.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 040000000100000010000000fa68bcd9b57fadfdc91d068328cc24c1030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df01d0000000100000010000000280cf6042c30a2646644ba7286a3aa971400000001000000140000003ae10986d4cf19c29676744976dce035c663639a0b00000001000000180000005300650063007400690067006f00200045004300430000006200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a53000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf1576142000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	deadlock-mod-manager.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 19000000010000001000000076935b5c5a037216daaf8aac76df42c10f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf157614090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a0b00000001000000180000005300650063007400690067006f00200045004300430000001400000001000000140000003ae10986d4cf19c29676744976dce035c663639a1d0000000100000010000000280cf6042c30a2646644ba7286a3aa97030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df0040000000100000010000000fa68bcd9b57fadfdc91d068328cc24c12000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	deadlock-mod-manager.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 5c000000010000000400000080010000040000000100000010000000fa68bcd9b57fadfdc91d068328cc24c1030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df01d0000000100000010000000280cf6042c30a2646644ba7286a3aa971400000001000000140000003ae10986d4cf19c29676744976dce035c663639a0b00000001000000180000005300650063007400690067006f00200045004300430000006200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a53000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf15761419000000010000001000000076935b5c5a037216daaf8aac76df42c12000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	deadlock-mod-manager.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	deadlock-mod-manager.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0	deadlock-mod-manager.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3568	Deadlock.Mod.Manager_1.1.0_x64-setup.exe
3568	Deadlock.Mod.Manager_1.1.0_x64-setup.exe
772	deadlock-mod-manager.exe
772	deadlock-mod-manager.exe
772	deadlock-mod-manager.exe
772	deadlock-mod-manager.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
4372	msedgewebview2.exe
2220	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeImpersonatePrivilege	3568	Deadlock.Mod.Manager_1.1.0_x64-setup.exe
Token: SeImpersonatePrivilege	3568	Deadlock.Mod.Manager_1.1.0_x64-setup.exe

Suspicious use of FindShellTrayWindow 53 IoCs

pid	Process
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
772	deadlock-mod-manager.exe
772	deadlock-mod-manager.exe
772	deadlock-mod-manager.exe
772	deadlock-mod-manager.exe
772	deadlock-mod-manager.exe
772	deadlock-mod-manager.exe
772	deadlock-mod-manager.exe
772	deadlock-mod-manager.exe
772	deadlock-mod-manager.exe

Suspicious use of SendNotifyMessage 40 IoCs

pid	Process
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
772	deadlock-mod-manager.exe
772	deadlock-mod-manager.exe
772	deadlock-mod-manager.exe
772	deadlock-mod-manager.exe
772	deadlock-mod-manager.exe
772	deadlock-mod-manager.exe
772	deadlock-mod-manager.exe
772	deadlock-mod-manager.exe

Suspicious use of WriteProcessMemory 58 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 2292	2220	msedge.exe	88
PID 2220 wrote to memory of 1360	2220	msedge.exe	90
PID 2220 wrote to memory of 1832	2220	msedge.exe	91
PID 2220 wrote to memory of 1832	2220	msedge.exe	91
PID 2220 wrote to memory of 1832	2220	msedge.exe	91
PID 2220 wrote to memory of 2556	2220	msedge.exe	92
PID 2220 wrote to memory of 2556	2220	msedge.exe	92
PID 2220 wrote to memory of 2744	2220	msedge.exe	93
PID 2220 wrote to memory of 2744	2220	msedge.exe	93
PID 2220 wrote to memory of 2744	2220	msedge.exe	93
PID 2220 wrote to memory of 3760	2220	msedge.exe	94
PID 2220 wrote to memory of 3760	2220	msedge.exe	94
PID 2220 wrote to memory of 3760	2220	msedge.exe	94
PID 2220 wrote to memory of 1728	2220	msedge.exe	95
PID 2220 wrote to memory of 1728	2220	msedge.exe	95
PID 2220 wrote to memory of 1728	2220	msedge.exe	95
PID 2220 wrote to memory of 3940	2220	msedge.exe	96
PID 2220 wrote to memory of 3940	2220	msedge.exe	96
PID 2220 wrote to memory of 3940	2220	msedge.exe	96
PID 2220 wrote to memory of 2772	2220	msedge.exe	98
PID 2220 wrote to memory of 984	2220	msedge.exe	99
PID 2220 wrote to memory of 2772	2220	msedge.exe	98
PID 2220 wrote to memory of 984	2220	msedge.exe	99
PID 2220 wrote to memory of 2416	2220	msedge.exe	100
PID 2220 wrote to memory of 1648	2220	msedge.exe	101
PID 2220 wrote to memory of 2416	2220	msedge.exe	100
PID 2220 wrote to memory of 2416	2220	msedge.exe	100
PID 2220 wrote to memory of 1648	2220	msedge.exe	101
PID 2220 wrote to memory of 396	2220	msedge.exe	104
PID 2220 wrote to memory of 4564	2220	msedge.exe	105
PID 2220 wrote to memory of 1472	2220	msedge.exe	106
PID 2220 wrote to memory of 1472	2220	msedge.exe	106
PID 2220 wrote to memory of 1472	2220	msedge.exe	106
PID 2220 wrote to memory of 1592	2220	msedge.exe	109
PID 2220 wrote to memory of 1592	2220	msedge.exe	109
PID 2220 wrote to memory of 1592	2220	msedge.exe	109
PID 2220 wrote to memory of 1476	2220	msedge.exe	110
PID 2220 wrote to memory of 1476	2220	msedge.exe	110
PID 2220 wrote to memory of 2116	2220	msedge.exe	113
PID 2220 wrote to memory of 3568	2220	msedge.exe	116
PID 2220 wrote to memory of 1088	2220	msedge.exe	122
PID 2220 wrote to memory of 404	2220	msedge.exe	123
PID 2220 wrote to memory of 1464	2220	msedge.exe	124
PID 772 wrote to memory of 4372	772	deadlock-mod-manager.exe	126
PID 4372 wrote to memory of 1120	4372	msedgewebview2.exe	127
PID 4372 wrote to memory of 1904	4372	msedgewebview2.exe	129
PID 4372 wrote to memory of 1904	4372	msedgewebview2.exe	129
PID 4372 wrote to memory of 1904	4372	msedgewebview2.exe	129
PID 4372 wrote to memory of 4684	4372	msedgewebview2.exe	130
PID 4372 wrote to memory of 5144	4372	msedgewebview2.exe	131
PID 4372 wrote to memory of 5144	4372	msedgewebview2.exe	131
PID 4372 wrote to memory of 5548	4372	msedgewebview2.exe	132
PID 4372 wrote to memory of 5548	4372	msedgewebview2.exe	132
PID 4372 wrote to memory of 5548	4372	msedgewebview2.exe	132
PID 2220 wrote to memory of 4024	2220	msedge.exe	134
PID 2220 wrote to memory of 4024	2220	msedge.exe	134
PID 4372 wrote to memory of 2156	4372	msedgewebview2.exe	136
PID 4372 wrote to memory of 2156	4372	msedgewebview2.exe	136

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/deadlock-mod-manager/deadlock-mod-manager/releases/download/v1.1.0/Deadlock.Mod.Manager_1.1.0_x64-setup.exe
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x214,0x248,0x7ff85f6dc188,0x7ff85f6dc194,0x7ff85f6dc1a0
  2⤵
  PID:2292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1884,i,8074670245266743471,8470733639370068331,524288 --field-trial-handle=2900,i,13381900683921559412,13705984435991669564,262144 --variations-seed-version --mojo-platform-channel-handle=2976 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:1360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1768,i,11052807561965576453,10068086997058174291,262144 --field-trial-handle=2900,i,13381900683921559412,13705984435991669564,262144 --variations-seed-version --mojo-platform-channel-handle=2896 /prefetch:2
  2⤵
  PID:1832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2228,i,5314186576776770889,16797772423588952836,524288 --field-trial-handle=2900,i,13381900683921559412,13705984435991669564,262144 --variations-seed-version --mojo-platform-channel-handle=2988 /prefetch:8
  2⤵
  PID:2556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,1044464862693012555,12754338519429955598,2097152 --field-trial-handle=2900,i,13381900683921559412,13705984435991669564,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:2744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,2337695127141297817,7811015296827921394,2097152 --field-trial-handle=2900,i,13381900683921559412,13705984435991669564,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:3760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4240,i,13638474425194966169,7934408922214730083,2097152 --field-trial-handle=2900,i,13381900683921559412,13705984435991669564,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:1
  2⤵
  PID:1728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4252,i,7436603229848658925,7309550012544025063,2097152 --field-trial-handle=2900,i,13381900683921559412,13705984435991669564,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:2
  2⤵
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5280,i,7694694005428786961,11743440869460384448,524288 --field-trial-handle=2900,i,13381900683921559412,13705984435991669564,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:8
  2⤵
  PID:2772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5268,i,1250234914341582678,16061347692736504316,524288 --field-trial-handle=2900,i,13381900683921559412,13705984435991669564,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:8
  2⤵
  PID:984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5816,i,6307024610038447286,1352208664298217624,2097152 --field-trial-handle=2900,i,13381900683921559412,13705984435991669564,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:1
  2⤵
  PID:2416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5800,i,12554750047591998298,17099996339400833273,524288 --field-trial-handle=2900,i,13381900683921559412,13705984435991669564,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:8
  2⤵
  PID:1648
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3628,i,11409265138268820097,8234571760874900498,524288 --field-trial-handle=2900,i,13381900683921559412,13705984435991669564,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:8
  2⤵
  PID:1068
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3628,i,11409265138268820097,8234571760874900498,524288 --field-trial-handle=2900,i,13381900683921559412,13705984435991669564,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:8
  2⤵
  PID:396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5296,i,17343655011019076411,12695672073785504301,524288 --field-trial-handle=2900,i,13381900683921559412,13705984435991669564,262144 --variations-seed-version --mojo-platform-channel-handle=5660 /prefetch:8
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6480,i,15327195028044068901,7392474324030336975,2097152 --field-trial-handle=2900,i,13381900683921559412,13705984435991669564,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:1
  2⤵
  PID:1472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6716,i,15107771262622755946,4347283327319297306,2097152 --field-trial-handle=2900,i,13381900683921559412,13705984435991669564,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:1
  2⤵
  PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6900,i,2319754012619557862,11548167560505892985,524288 --field-trial-handle=2900,i,13381900683921559412,13705984435991669564,262144 --variations-seed-version --mojo-platform-channel-handle=6932 /prefetch:8
  2⤵
  PID:1476
- C:\Users\Admin\Downloads\Deadlock.Mod.Manager_1.1.0_x64-setup.exe
  "C:\Users\Admin\Downloads\Deadlock.Mod.Manager_1.1.0_x64-setup.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2116
- C:\Users\Admin\Downloads\Deadlock.Mod.Manager_1.1.0_x64-setup.exe
  "C:\Users\Admin\Downloads\Deadlock.Mod.Manager_1.1.0_x64-setup.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3568
- - C:\Users\Admin\AppData\Local\Deadlock Mod Manager\deadlock-mod-manager.exe
    "C:\Users\Admin\AppData\Local\Deadlock Mod Manager\deadlock-mod-manager.exe"
    3⤵
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Modifies trusted root certificate store through registry
    - Reads the TCP/IP host and domain name from the registry
    - Modifies registry class
    - Modifies system certificate store
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:772
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=deadlock-mod-manager.exe --webview-exe-version=1.1.0 --user-data-dir="C:\Users\Admin\AppData\Local\dev.stormix.deadlock-mod-manager\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=772.2908.15166249804382111808
      4⤵
      Drops file in Program Files directory
      Enumerates system info in registry
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of WriteProcessMemory
      PID:4372
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\dev.stormix.deadlock-mod-manager\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\dev.stormix.deadlock-mod-manager\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7ff85b30b078,0x7ff85b30b084,0x7ff85b30b090
        5⤵
        
        PID:1120
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\dev.stormix.deadlock-mod-manager\EBWebView" --webview-exe-name=deadlock-mod-manager.exe --webview-exe-version=1.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1728,i,4440280363117682963,6635646099898499051,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1724 /prefetch:2
        5⤵
        
        PID:1904
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\dev.stormix.deadlock-mod-manager\EBWebView" --webview-exe-name=deadlock-mod-manager.exe --webview-exe-version=1.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1928,i,4440280363117682963,6635646099898499051,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2052 /prefetch:3
        5⤵
        
        PID:4684
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\dev.stormix.deadlock-mod-manager\EBWebView" --webview-exe-name=deadlock-mod-manager.exe --webview-exe-version=1.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2384,i,4440280363117682963,6635646099898499051,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:8
        5⤵
        
        PID:5144
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\dev.stormix.deadlock-mod-manager\EBWebView" --webview-exe-name=deadlock-mod-manager.exe --webview-exe-version=1.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3664,i,4440280363117682963,6635646099898499051,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:1
        5⤵
        
        PID:5548
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\dev.stormix.deadlock-mod-manager\EBWebView" --webview-exe-name=deadlock-mod-manager.exe --webview-exe-version=1.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4712,i,4440280363117682963,6635646099898499051,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4632 /prefetch:8
        5⤵
        
        PID:2156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6480,i,14329218179310444026,15407120077855693002,524288 --field-trial-handle=2900,i,13381900683921559412,13705984435991669564,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:8
  2⤵
  PID:1088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6700,i,7526835699501306067,16682155079505475395,524288 --field-trial-handle=2900,i,13381900683921559412,13705984435991669564,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:8
  2⤵
  PID:404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4292,i,10166781308446817459,14155065141999452105,524288 --field-trial-handle=2900,i,13381900683921559412,13705984435991669564,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:8
  2⤵
  PID:1464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6048,i,16602981121129161094,6688716968797082805,524288 --field-trial-handle=2900,i,13381900683921559412,13705984435991669564,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:8
  2⤵
  PID:4024

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1088

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

protocols.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4372_1036710718\protocols.json
Size 3KB
SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
MD5 5e2067a92dcfcb05537479c384a89725
SHA1 eeed29b07d865ac4d46629fddadad629d0ad4e2b
SHA512 c96c5f9cb7a169ad91b070b567cf9fa8f35951ccc5aa930e97dbeccbeac27f7e9dde1379138c9ba6b0d10339f9cb053ef21f19f06d7560f97d5d23a27c8ed4f6
TLSH
T17D7184B7862088194E360AB4AA0DF10DF93702DF2AF598D3B27D455F1F712BB3946249
MD5 SHA1 SHA512 TLSH

Submit Download

deadlock-mod-manager.exe

Path C:\Users\Admin\AppData\Local\Deadlock Mod Manager\deadlock-mod-manager.exe
Size 29.8MB
SHA256 53e8b6b6893a0bd58a1b543f08cc2f00916404289f2afc4560fca26110b607a6
MD5 40a499e509cffe17e98d538561939e2e
SHA1 4d6725088070e3c172d9e7b0eca5c147181eca11
SHA512 134119557da7d53fedccf885f64d9bc3858660202cd21fde4033dddda3ce1bef94c8170d7bfb3a0c2dac2735b94867f01e53b8aeceafde2819babfed8cb4cc12
SSDEEP 786432:lLQuBzaI6DkLs0HTUCEFtmjo0QUqg3TYUA6XOpfT9XWO:8T0QUqg3TRAUEr9XWO
TLSH
T17067E103F66280E8D06EC1B4835AD533EB72B89D0934B2AF5BD45B212F6AF506F1D359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uninstall.exe

Path C:\Users\Admin\AppData\Local\Deadlock Mod Manager\uninstall.exe
Size 77KB
SHA256 ae43ce2bde8bfe6505c68f2345778cc4bfca2fc1626c4a5084991c7e93ed2275
MD5 bfce974e887c7f1d32c493ae07ae580e
SHA1 4743ad30ac64a57a47b9c6f482a6cb3d40759494
SHA512 4776dfa6f27ce4748b153a7db8a0604855a03aa772dca56b089d3e76949e025f6f208c6b77f47e9d5152c8958fbd1fff5ccc29c1f95d3c7f5f95632a39387bc7
SSDEEP 1536:brX4tpfcUjrwLxZYE8ksuXgdLeAyNxJSvavQXF3nxdSCJS/zRLtu2A:PX47fcIrwR8ksuXceAslv83nxdST15uT
TLSH
T15273DF007BA0C4B7D9B20B304D7A9BB76FF6E52111646B1B13405B5EBD32682DE1E763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2ed3b7f0-82f9-4ee0-8e39-1549e71f5d9b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\2ed3b7f0-82f9-4ee0-8e39-1549e71f5d9b.tmp
Size 18KB
SHA256 f046e4616298fa871b35483f9ef1e5d40712db69c4edaf390512d406dedf0ea6
MD5 c0bc136d896c065127ebfbb613de6a7f
SHA1 ccaacf3a279eedf396bbd6fb0c4960919d4686fc
SHA512 8156fa1439c91441cd07167d0a09115f8f83d955700299e88338ec101511b161aaf3e64987ddee34b25c7a9ece490a766ae4d53125362c7e8621dc2844b94339
SSDEEP 192:uVTULHcP1cZLxRm88SvjiVCsNEYiQyXjFUb7OQmiU1JEKX4h//S+Ztao0qvlatlk:HQkUSvZsNElZSbW7Ih//S+ZJhvIIld
TLSH
T1F3827C366C78AD3B4AA79541F28A36038FB0D157DAC95FE4D6CD6B1D01DA29C2307D22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4887b4bd-a16a-4bc8-af14-28ba6102d921.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4887b4bd-a16a-4bc8-af14-28ba6102d921.tmp
Size 18KB
SHA256 0506a49dd99135f1b10a26c14b79a1beda12eb3745a7ad953a1c14d2175aa0f5
MD5 3a1f01d8153c9546f26072579ac97728
SHA1 a13596ca7b43ab9c0114222eae10b4dd87fa1d6f
SHA512 0f8ac6293d82a913544c0700fd02eff58c5fbb2fc846d4cc68fc1d2a2cdf8c5e66e3c43af7ab12e01f9bc1995676b975f7308a30a0f5ea701a2b4df3bc29afa4
SSDEEP 192:uJTULHcP1cZLxRm88SvjiVCsNEYhQyXjFUb7OQmiU1JEKX4h//S+Ztao0qvlatlk:7QkUSvZsNE8ZSbW7Ih//S+ZJhvIIld
TLSH
T14B827C366C78AD374AA79541F28A36038FB0D157DBC95FE4D6CDAB1D01DA29C2307E22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

556efe64-d9f1-400c-8e22-4b093fe999ea.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\556efe64-d9f1-400c-8e22-4b093fe999ea.tmp
Size 8KB
SHA256 15c4e595ff26dd0f08705f8e26625e7f00c792cce2ab30194c24ad6257977e6a
MD5 7e9614686549b09cf543c142ef5a9883
SHA1 d19e79ca67ef3aa9963adf7692aa71bab449e97f
SHA512 32c8ede62751509a07d21740998ffbe1150ff5e6effa0df0a4bc566104a1462039a244f9450ce983f953605621f0bee98bcaf02fb11e732385758f6286bfed39
SSDEEP 96:KqONkiQsjpfbUmjH5ih/cIPURHl8h4otop5QaDWBKP4v+Y1xf//ojdqxERtIgBCN:BONm6JUm0QmiUyJGso//S+gBC/Q2U6
TLSH
T1A402D839AC787C7B8EF39E45B0877B239FA4106BA6916F94DAD81E1C01D725C2307D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5d377ebc-7a57-457b-8ff3-ced61c377f86.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\5d377ebc-7a57-457b-8ff3-ced61c377f86.tmp
Size 8KB
SHA256 571c5da864bfb281c96a2ce324f4b6b10b95bc054eaafe12f8642ef50be6d7a0
MD5 3b9269d9c727dc86b43db9e50604815c
SHA1 ee387c1247716bcaf56d66b826cbb90c650131dc
SHA512 5ed2ef296fc548e6bb3a19f4cc0651c558eeebc61d343dae342f7ec13f7a6fcc0e7ce014a0a803e4ead5c406322cf2adcdc113877e9426d5aa75cdf6dc14cddb
SSDEEP 96:/qONk5QsjpfbUnH5ih/cIPURHl8h4otop5QVDWBeP4v+Y1xf//ojdqxERtIsx6LN:iON96JUQQmiUyAG4o//S+ZlNx0qvU6
TLSH
T123121936B8B8AC7B5DA39981B08736134EA04167EBC56FD4D6DD2E1C05DB29C230BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fa8c74ff-e540-47f4-9f78-8f36c62e2e8b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\fa8c74ff-e540-47f4-9f78-8f36c62e2e8b.tmp
Size 105KB
SHA256 ebf0f1691f49d860fa202d63b050ce2cad38a0496d2658dba8550bd94b28fce4
MD5 7e383905ea5e52c72981148e0ba96a63
SHA1 69b00ea95b83255ffb3f785258efe9e2849602af
SHA512 9017a3852bc1710a7236871d7d43724c12d99f4aac743e58adc0ed0e10a6b4d51529c2fd094425d056a04de8831ea1cbb443ebf8f28e3ebce5c3178e7f66be02
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7q:fwUQC5VwBIiElEd2K57P7q
TLSH
T1F0B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 04d384e503ac7726cb96f043e69cad98489c2eafc2665c80e33cb016d873b6e5
MD5 c5a323aac1462c81d1642ed0f7b1b5a2
SHA1 c07fc90a5c5d549ecbf33b4bc8cb6cb9ca204f88
SHA512 222a743460a5faf30304aa1d67f0e10e2db3eb1a339b1bbf5ca524b4a2fcaa1361289e4358333bae502b5bb38029cddb6902b4cd64293b0ad42b474cee75f892
TLSH
T1B2D02BA4A3D839C9E112183602214366348D40A15057E010CCA0518907C91538281460
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0e249170bbcfe30a2a7f421f287b6f81c1c4b71b07e845351f15d008b660ff09
MD5 81d112607d82fd2070ddb7aeeb981683
SHA1 14d14f6413d240f3629ae2eba8f5d1139dc415d0
SHA512 983c5ff8fde2dccf9dc8cf1c11f0008f124b59c2922b2ae470dc2c7595c82289abfd0b4819d73f1bf062a77e62e9ed53318e5f62978a688554f46d0a6c41cbfb
TLSH
T1CFD02BA463D83DC9E512183602204366348D40A15057E111CCA0518907CA1938281460
MD5 SHA1 SHA512 TLSH

Submit Download

20b2ad6b-78ec-4b97-a7b7-09c9c96ee397.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\20b2ad6b-78ec-4b97-a7b7-09c9c96ee397.tmp
Size 9KB
SHA256 344b50ec3d976f86cd9d040b1974537dedb310d6eb470ba42b839e8891dad3e8
MD5 b73ebf9275a6fa54793d4af89937e154
SHA1 082523d277a623413a5695db8e1a36e043f60614
SHA512 55d715f1aff7da2a60506f1bde99a3b6b0c147bc4b822d777c615445f9c87ff674d85a70d6285c5cb763cc502119f554e891b9d1afefa25f9afadeecb4f66528
SSDEEP 192:sxZkRPnn/f0s+lIdpJHW6+WNGY36cyIVIgrJ:sxZkJn/f0s+WJHbGXG9
TLSH
T15E22B7526E38A57B8CCBD219BB25BF13D5FA503261D11E98EAFC861C05E6ACD130780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5e759ef7-359c-4982-aec0-55f44daf7a94.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5e759ef7-359c-4982-aec0-55f44daf7a94.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

67c83053-9760-4275-ba57-d4053b091e3c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\67c83053-9760-4275-ba57-d4053b091e3c.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7a6f2477-cee8-4f26-b531-fe928221f29b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7a6f2477-cee8-4f26-b531-fe928221f29b.tmp
Size 10KB
SHA256 541b19533cb018702f4130a42640869aaf63444025085384eb8c93c73f08b019
MD5 ec9ea207da6b040d56ead521d3e20d41
SHA1 dea7f61e4f5558fe1a2d34182ff67b213e1a8a40
SHA512 5644a36726d221a35e07e3e7693c67e85885b3e2d8d8ca591e4176a18d4899c3ea568d5563085f889f6b61c2eee732b774a19ddf968864b13d95d290f59e00de
SSDEEP 192:sxZkRP5n/f0sblIdpJHW6+WNGY36LqIVIg5sJ:sxZk/n/f0sbWJHbGXZO
TLSH
T1EA22C8526E28697B8CCBE219BB557F13E6F9503261911E98E6FC861C05E7ACD130780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

904e9c12-ea9a-4402-854c-fde5e04938bc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\904e9c12-ea9a-4402-854c-fde5e04938bc.tmp
Size 10KB
SHA256 6773fc8935c1f3767cf6b9a2688854507997047bb1639a6118c38a2a94b50607
MD5 daf446df14f7e8b4043d7a645948a887
SHA1 1daf634a6ca2485a98bfecf0d02c8fd28f992ef7
SHA512 62e150f8f37b5a02e57aaaf6642e1eebba1512c50480fa69cda049bb19fc886823906268bc0cdfab42951fe3955c4a3f01ef68f87d31303da2d2156b85efb3ca
SSDEEP 192:sxZkRP5n/f0sblIdpLHW6+WNGY361zN+VIg5sJ:sxZk/n/f0sbWLHbGX1CO
TLSH
T10A22B8526E38697B8CCBE219BB557F13E6F9503261911E88E6FC861C05E7ACD130780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9458388c-858c-4b83-9744-d2c63bc2d713.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9458388c-858c-4b83-9744-d2c63bc2d713.tmp
Size 27KB
SHA256 04060a39fb719e673a02fdae04c52d49d4f31f279f61c429da9d9737d592545f
MD5 1633dc2ba82e6c8d2bc8777b4ccc96fe
SHA1 a95cb437885bc853b4dffd912fc58d98a94e99b4
SHA512 dcdd89a2b1a4e752671a442fa251908cda8d76d5f9c9758da71dac817f7f802479b44e865d808901fbdfb402ab381daf7b5d09bb06b0970c93cf5a708a5636bf
SSDEEP 768:dxKlm7QWvUYe08F1+UoAYDCx9Tuqh0VfUC9xbog/OVh/LlpPs/GroLUO:dxKlm7QWvUYe0u1ja8/L/E/9Lf
TLSH
T1D2C2FB3B640CCB7E4FC05A9DDC5A6F976EA802C7A6588D4087FA984C02C77EA51264DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 d666feefd99e65860f1689ecd7277d6238e771322e6132cf5e351042f030f0e1
MD5 4767d7a2323e72cf5857f8d926bf44dd
SHA1 1d8879be15dda9d2c68cd9e9d8d999d51e72747f
SHA512 e61615b34ed69c00c283898ff32ae99720496facceb09c94247aa16e6a81677eb349abd40a8f35a97a3d11632abd37c5f030660f0821bbe8ec9404fb66cad2a9
TLSH
T146516145C5A280B2FBDA697091D1138F353C79A393AB2D6635CCF77B0B8BB055234806
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 8854c504614e05d5fa7aa651c5f543a9daf0932e5ceb3160888119be1b2e0d5b
MD5 4babced487043704a0cf483b861ecc5a
SHA1 5fec0d618e1cc57c51bee057626c72830b1cf442
SHA512 2a7835cf5b004c0e4cfc951026bedbfa4c28e1091391d8a99064de5eaac46df0afc5d1eedac6723d786562ca782c111295e12b71b32d96cdbca44d418ddd8b57
TLSH
T1AE516045C5A280B2FBDA697092D1138F353CB9A393AB2D6634CCF77B4B8BB055234806
MD5 SHA1 SHA512 TLSH

Submit Download

ac386e7a-4754-4899-b8f8-1e11fa817285.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\ac386e7a-4754-4899-b8f8-1e11fa817285.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

2c8f6bc7-ef0c-4478-9df2-752f54c862f9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\2c8f6bc7-ef0c-4478-9df2-752f54c862f9.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

41df06fb-0ccf-4e1d-9c5f-407e86ca5093.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\41df06fb-0ccf-4e1d-9c5f-407e86ca5093.tmp
Size 1KB
SHA256 870b47e2b45bf34951218018c2f46a36d21e158907fadc92c1310ae750fbd98d
MD5 77b4c7b06c88cff99c6eacb3de05b70a
SHA1 9f94b9a70e1744e5699c383b78ca4b3bb665bc88
SHA512 b3192e33f41c603dbecfba288d4d28ff4143d14fa02919bf2a82f8966f8a194cdc5763bd1971ac96e259467d555bc6e4f58d3bcb8345a47d3bcf592aa40fc804
TLSH
T16621D2F783E1956E8A0157F0AA18AE1BCE2D0511831C7C1A85E4BF27D3E3475E102A9F
MD5 SHA1 SHA512 TLSH

Submit Download

d7e56b5f-797c-40f3-8ecb-22d7022eb731.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\d7e56b5f-797c-40f3-8ecb-22d7022eb731.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 598181c729ce33fd9ad8aca70e682fe40be009ec8bf61c5d1b95b5f00dd9e0ad
MD5 290e3bbfa7796da2c2ee125e1c02abe2
SHA1 02fcbd1b1f75e85350554d8874199f3435650665
SHA512 cb777e7f5b54a357bb31a9ee028d815caa545baa427ba4b6e088c3baf72601b83333384bc7ead0829759ef1756b11a790cbbb1c77e9d2b2527a2d096fd36038b
SSDEEP 96:KILSKEkOKK4KP6ce0KDqeul+KOA9agKDiyg:Ep/Mjlhvg
TLSH
T12FD10D11727B024139BE295882B5872B525631733018EB2BBFBC51B1CE6FE185DFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c479ba38-71e9-4fc1-87f0-aa4c96532fb3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c479ba38-71e9-4fc1-87f0-aa4c96532fb3.tmp
Size 10KB
SHA256 0d00270eee1ec7abb0e9238c6c4a54d8585d1e5fe43e2af25446756fec54141b
MD5 a2094cd7850c647f48e8871bb7f4ccc6
SHA1 9de87240f103cca6beeec9aea4efc815a54f66b8
SHA512 f5e7dd799a0e304559317c83be3afa2d86f43a0e52bcdd365b4dc508cc371fbdcb1a536cf37a029a13ac4d8198e95ac2403bf8d1a2b774749533dc87e8b52d6b
SSDEEP 192:sxZkRP5n/f0sclIdpJHW6+WNGY36cRIVIg5GJ:sxZk/n/f0scWJHbGX3k
TLSH
T1F822C8526E38657B8CCBD21ABB65BF13D6FA503261D01E98E6FC861C05E6ACD130780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

51ec76ad-565e-4b73-ba1b-797da6eac8d6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\51ec76ad-565e-4b73-ba1b-797da6eac8d6.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a274556a-3ade-420f-b415-5b9bf4ee52bc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a274556a-3ade-420f-b415-5b9bf4ee52bc.tmp
Size 21KB
SHA256 def891f049154a925fa9e8b63e52da20c0fd909179303d7f6469a9f460a67595
MD5 176e1da476fb7ce55e133caf7499f1ca
SHA1 c29c3d46e987c5862e5d113c52f956139062f781
SHA512 0c9deaa051475b60e4283031ee564571eb9aafcf028e676dfe12a1b06943a8bcf338765006b0ee9bb793db9d9e3c3e12fdddf3210b3db192c2277a334765a0a5
SSDEEP 384:hiF6QkUSv1GsNM8TUNTUlIl8ZSbW7Ih//S+ZLhvIIld:IFiQZwgQU/KuhvLL
TLSH
T199A24C375C689D3B9EAB5A41F24A3203CFB091A7DAC59AA4E7CD9A1D01DB1DC2307D12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a74b59d-604a-4ff3-9b4a-2b371f5f2a39.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\5a74b59d-604a-4ff3-9b4a-2b371f5f2a39.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

f39e9964-f0e2-4a12-bf84-365fef60b6a8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f39e9964-f0e2-4a12-bf84-365fef60b6a8.tmp
Size 18KB
SHA256 1eda7475408f495a9d4063b0859c027d56ad644a8a980b519af3549521d2ba1b
MD5 8aad24bf19ee52a416481959191edc84
SHA1 a1a7aeca8f040b32b86e5a12438d34ce465b0212
SHA512 acd066ce022cf6d617dda5bdb9a47337644b328e671b100b984d0904b6137607b317fd344041319488edc5819f976f2e91c9ec259c5aac0c4e14b70d8a9e591c
SSDEEP 192:uV2ULHcP1cZLxRm88SvjiVNsNEBQyXjFUb7GQmiU13EKX4h//S+Zcao0qvlatljw:QQkUSvOsNEBZSbutIh//S+Z2hvIIld
TLSH
T181827C366C78AD3B4AA79541F28A36038F70D167DAC55FE4D5CDAB2D01DA29C2307E22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 06a3ee308ef15adf6af3c6ec4b9b7377de3efe56591c7fe8f2dc16b088f7c992
MD5 e7320b76054f4698f2b5b7585b3d63ec
SHA1 f8f6fb9ce0776d737547a37d3f5dd2c16604a1c8
SHA512 c4e7a099a4f1ab6c5ea6a30a53547a26006a2a9fdab8e60b4fb9e3d211da8f6f02f77b20bc35541a357ee7ea3c295e8ea6de9ffd2f00f7b046cb955223254deb
TLSH
T1E741FB58E6FA1148B3B76F1AABF6696D487B7D373E06D45E00010E8F0623B01C961B37
MD5 SHA1 SHA512 TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsmC8FA.tmp\System.dll
Size 12KB
SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
TLSH
T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

modern-wizard.bmp

Path C:\Users\Admin\AppData\Local\Temp\nsmC8FA.tmp\modern-wizard.bmp
Size 25KB
SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
TLSH
T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsmC8FA.tmp\nsDialogs.dll
Size 9KB
SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
MD5 8f0e7415f33843431df308bb8e06af81
SHA1 1314272e6ad3be1985d4a1607b890a34b0bde8b5
SHA512 5450b2070c40b257c28ba9a472d762f91b78928d1e8d4d88e0576992065a61fb9a6513006e6b5947c415c9e02ae80a90a85b58da7e016a424331c8cd596ed684
SSDEEP 96:obEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YHNqkzfFc:obEvCu5e81785qHFcU0PuAw0uytIFc
TLSH
T19D12F892E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis_tauri_utils.dll

Path C:\Users\Admin\AppData\Local\Temp\nsrD52F.tmp\nsis_tauri_utils.dll
Size 33KB
SHA256 5ba143b5db4a87d32d6e7802e033330aae56cbceabe0d1e3ba41948385ad4709
MD5 948eaa3cb78c2dcdd9eb1ab120ae0f65
SHA1 75197fee3c6a814fe035788d1c34ead39349b860
SHA512 f7c511e8c73ef6ee9b72c88cd73b2d454a6ffc12144118df2276ea3f5c34175df0d9d15a435035575ca2b171789fe348d7a9028b702b47dda749ee17e03ae7c1
SSDEEP 768:K/wOD4gzTVpAVk2h5Rsekk55aCukBFKpnp0jdhK7W+qVG:8wODZzTrAV5Oevq4DtXHVG
TLSH
T188F24A48FDC57EBAE2CF05710809467E4A6FC8081700C96BE3722EA3D5A67329ED525F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

29211d31-d658-43cf-8538-e2c42487db05.tmp

Path C:\Users\Admin\AppData\Local\dev.stormix.deadlock-mod-manager\EBWebView\29211d31-d658-43cf-8538-e2c42487db05.tmp
Size 16KB
SHA256 bea09f223a812136b9bc0116b4979f7eddfea40ef06685d6f9dfe6085808ff6f
MD5 a96067f869cefe02ac015fa76d315caa
SHA1 ccd5357094d2cc41eb9c5b3b80c137797d97bb18
SHA512 835c811d9f63c12496c5ed27a12efb4ea2f41433280c53576f36aaae49e9cfe5b91bae42d3248101f7e036cf58924c36e8cf83eff1bbeb78f3b679ed93caa102
SSDEEP 384:zv+OBqImmJvGBLx3NaFMJFwNbM/E9xbg6rh:CcvGtlNLixBV
TLSH
T1EC72AD7A28252B3728A7C90AFA8C274BDBA4615380D53BE8DEED5F0E416B0D40352D19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

32d48df0-4cd0-4a39-b1f2-2042b3d7a0b3.tmp

Path C:\Users\Admin\AppData\Local\dev.stormix.deadlock-mod-manager\EBWebView\32d48df0-4cd0-4a39-b1f2-2042b3d7a0b3.tmp
Size 392B
SHA256 0be98dbb822b9fbeead54a9e0e1ddbe8a7ab2df78f776819c4257344fb404701
MD5 bf52e3444d8b230479ba9ce03b79556e
SHA1 28a5c0b98a4488f6f7895d86d0ac44f94dc104f3
SHA512 a60ee429a0fd2b3e3324b0b73ceb2289816e0401b5b934a98eeff4a033a90d3f6d1c9d92e2ed74d9b14c78ef47e490c6f7d4f4c56433dbe683665d5741739686
TLSH
T1CAE00443D70145D0C0340570C4531F111F43D074044413C50F1503C47D347007D70DC0
MD5 SHA1 SHA512 TLSH

Submit Download

6b79526d-d4fa-4fc2-ab04-5c89fea11047.tmp

Path C:\Users\Admin\AppData\Local\dev.stormix.deadlock-mod-manager\EBWebView\6b79526d-d4fa-4fc2-ab04-5c89fea11047.tmp
Size 2KB
SHA256 d978b5c95a8d588c6f9f604191d85576dc0483465b7916f2a6a71c616abfb82f
MD5 c5b11933459fa53d14053e4b43110ff9
SHA1 b65608055b0aa10b54750fab2826312cae4028d8
SHA512 f91dcf7f66c268b71f65b9e545ef0c3918140982ff636ea3d66f7869143d2fd4ee1d087ec76e1795c38d0695674c7190119680e78dfdaae20a253cf9dd7fe1bb
TLSH
T1D451C6B3B8047B374592D949BA453F17AF759062A6912FA4EADD0F1801D76DD1302C3A
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.fingerprint

Path C:\Users\Admin\AppData\Local\dev.stormix.deadlock-mod-manager\EBWebView\AutoLaunchProtocolsComponent\1.0.0.12\manifest.fingerprint
Size 66B
SHA256 e84df839eb3dee2a10ba66de65c372c6e2bba0cbab46a39af041f4eeaab1ffe8
MD5 06d2b48de0edcb3e022ed639f0fb0085
SHA1 32f93d5a76998c407087269794026d1ea028828f
SHA512 3c883d4c342f95f28e4a76c73ce7151e8a76d6f5b2c86f90a9ee7f9976ae7e1be94c963489b326d2ff5f7c6423b29552d9aa09b65c17396c2f66ce271fe19506
TLSH
T1F3A022E32CE8880EACEC0AAB020A0AFA0ECC8000020280C80008080220028F0008CA8C
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\dev.stormix.deadlock-mod-manager\EBWebView\AutoLaunchProtocolsComponent\1.0.0.12\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\dev.stormix.deadlock-mod-manager\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 1585d6fb58473d30f37a1e6301e95ca0c94e10590748c8b0ef364cd9dfb0d37b
MD5 f8c00a7f07101b77a15d8d291fa91781
SHA1 5319af9d62c3f70f5818c606004a1a68ee0c42f3
SHA512 bef876c0a7567ce273e3255d7eb168d04c3b1a45c9d0c4c8d91ba8e9d1c2ccadb9561acc8b8ea4431d80ec1090566b0521e5e03efe45dcf9d564a8db158959bf
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\dev.stormix.deadlock-mod-manager\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 5eb9e853c83d618e66d5709b4ac068466c07f2506d036afd1e07df8f1ecdcabd
MD5 5af374ce4be34332f0417b94b2b5c6ad
SHA1 e5ed61cfe0626128dd1ca431ecebddb89f10dc85
SHA512 bab4ddccd42fc9f1263e864338b673e9ab6b04d8ab68375ce148baf08b717006afbe3d3a7640c8e2ce0cb9a067113961b98d327994d5eb52165cccfce4463d7b
TLSH
T14DD0122232428174E03020332002A28E0800D10B41A95084542D856D1A144500B06452
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\dev.stormix.deadlock-mod-manager\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

0de14360-a016-4cd8-bb1a-a9d3bc1a478c.tmp

Path C:\Users\Admin\AppData\Local\dev.stormix.deadlock-mod-manager\EBWebView\Default\0de14360-a016-4cd8-bb1a-a9d3bc1a478c.tmp
Size 6KB
SHA256 621f9acffa928c3edfea48f34fe9ae23cd333716f20f6c62643295e14fbd75ea
MD5 db9a497a4a5ac9cafc4d6fe62b7bd7e7
SHA1 c91a648977545c19b4d5cb591bb3df8693a08091
SHA512 3c341e13263ef43b7d7c25456296c1986143426ab1ed32cc381beb721d7518ec135e9a77621a161cd09c60f53220895ae1947aa4376fcce8ce53cab48d694c63
SSDEEP 96:sts05oaRObb9RffkZ8i0vhEZktLm/7qx+WVHMSm+uecJEGsMH9dQjm+gd8iMOB:sts0VefMZ8paAa/S+WiTjsWdL0iMC
TLSH
T166D1D9425E687A774CC7F61A7B35BF16E6F6506221C40E98EBFC8A1C04E66CC6207D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\dev.stormix.deadlock-mod-manager\EBWebView\Default\Code Cache\js\index-dir\temp-index
Size 48B
SHA256 c1133f050b0437c33c888f3a890c2d339c424599de3be3a39d7f8b34e9a06527
MD5 ae7e6be98626659eb437ccf29ce7966d
SHA1 6cabc04a28af725ce058a6ebcf92a46801b6c1e7
SHA512 9d41bbc747af0acf38727132883a281685790e9308a79611784c8a8417fd2b80b70305a0db1f978d439c9f8b99246379087b090d0485878cc920b86974f2f287
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\dev.stormix.deadlock-mod-manager\EBWebView\Default\Code Cache\js\index-dir\temp-index
Size 72B
SHA256 e914093f73cd5af607aa5321b563119ae255b48daa5c61b8f7e8c1619bdb85f0
MD5 e22cb3ce00a80066178a1fb601fa7546
SHA1 2b6b4a2b8838eabf870d29f38c0d07d02ff14b2c
SHA512 56a4b712eed2a1e122acfbfcb2a1d05e4108a2320d8ed94abafabbb7bd1596c28411aa6e58df07b75159f2cb9cc976fe8286c798bfa0a9cfea154e04c46bb3f7
TLSH
T1D4A00252074D5462C250677262D111E736715E9A1613171758E870A5CDB23444312081
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\dev.stormix.deadlock-mod-manager\EBWebView\Default\DawnWebGPUCache\index
Size 256KB
SHA256 986e5da9b40c7c373b0d66f39a5b5a919755d324b498e23857c08fbdcf97a837
MD5 29a1acd438ad793b313c3f763f147e8c
SHA1 80f261c7520f0f7900536a0adaba52b82e03e904
SHA512 d0b07af1a929f631d17b2694a478c7dafed29702149a8c959fd1d877aabf41dda67c565302c0a8c5151c42e34b417eaa91893af3641079cdbde3ae6a9adaa92d
SSDEEP 3:LstlNllkll/lHEc:LsX3lEtkc
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\dev.stormix.deadlock-mod-manager\EBWebView\Default\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\dev.stormix.deadlock-mod-manager\EBWebView\Default\GPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\dev.stormix.deadlock-mod-manager\EBWebView\Default\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\dev.stormix.deadlock-mod-manager\EBWebView\Default\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

3e65aaaf-a00f-427a-b26b-b6b059a5e60f.tmp

Path C:\Users\Admin\AppData\Local\dev.stormix.deadlock-mod-manager\EBWebView\Default\Network\3e65aaaf-a00f-427a-b26b-b6b059a5e60f.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

3f8eac35-a137-4a1f-9933-bd8c73b4b598.tmp

Path C:\Users\Admin\AppData\Local\dev.stormix.deadlock-mod-manager\EBWebView\Default\Network\3f8eac35-a137-4a1f-9933-bd8c73b4b598.tmp
Size 59B
SHA256 c257f929cff0e4380bf08d9f36f310753f7b1ccb5cb2ab811b52760dd8cb9572
MD5 78bfcecb05ed1904edce3b60cb5c7e62
SHA1 bf77a7461de9d41d12aa88fba056ba758793d9ce
SHA512 2420dff6eb853f5e1856cdab99561a896ea0743fcff3e04b37cb87eddf063770608a30c6ffb0319e5d353b0132c5f8135b7082488e425666b2c22b753a6a4d73
TLSH
T1D2A0026ADA612D881B4A839026187553807B0445130982FDE43877A841561AE582C865
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\dev.stormix.deadlock-mod-manager\EBWebView\Default\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\dev.stormix.deadlock-mod-manager\EBWebView\Default\Preferences
Size 6KB
SHA256 9b27e694a9c26b41b40420df18ad429d178e47a95738854849d519de925856cb
MD5 6daf1eff64fb968e4ad441978018e53f
SHA1 616f860cdd519d672e1444c0952dcf700c4ff6dd
SHA512 f06106e412c68f5d407e220e57251df874e2c91da2c57d6f3e749e93065e201f1a7dbb3f75e7ebab1fa29bcddde0c819c99146b1557b848a6dc9f45f0827460b
SSDEEP 96:sts05oRObb9BffkZ8i0vhEZktLm/7qx+WVHMSm+uecJ5G1idQjm+griMEB:sts0KGfMZ8paAa/S+WiT5GwdL9iM8
TLSH
T1ACD1B8425E287A774CCBE61A7F35BB16D6F6106271D40E98EBFD8A1C08D66CC630790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\dev.stormix.deadlock-mod-manager\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\dev.stormix.deadlock-mod-manager\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\dev.stormix.deadlock-mod-manager\EBWebView\Local State
Size 1KB
SHA256 9bb16c0ae6ec3efd5a7392f2bf5ff7377980e21826f71de5a88f4b2819ed5791
MD5 fcb94caa8d880487dd1358ca7155c28f
SHA1 a944c615a02e2e1c634edaee16e63dfc83231a13
SHA512 95f845ed612659d5fd01141651cba327162e73651fe6eb5892b1db829ad9443b26c22bd2754e04908202e811767822d49b81186e044288f5de3bd9b2be305f55
TLSH
T1FA2195B3F8443B766440D845B2413B8F2FA0803662505F28F5DE4F1942E70EC422BD36
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\dev.stormix.deadlock-mod-manager\EBWebView\RevisitationBloomfilter
Size 392B
SHA256 4a3242f99096e1b9f4575aa82f33f3832e2f97bed750eceb35563adb98966a6a
MD5 f857c9b67ece2ed2555a6b7a6ee4fd66
SHA1 6349ced90fd5df4c56dbb1cb84e8cf6e753aa85f
SHA512 a396e1646da995a82044c5f875643987a5fda9139a7e92b0549e5cc6002fa2b5d2c38791b056660ca1125da1ec1886f8e7f0fdf18372baec4a895d9660a50737
MD5 SHA1 SHA512

Submit Download

d52673ef-94b1-4b35-97e3-5d3323a2edea.tmp

Path C:\Users\Admin\AppData\Local\dev.stormix.deadlock-mod-manager\EBWebView\d52673ef-94b1-4b35-97e3-5d3323a2edea.tmp
Size 16KB
SHA256 b782ac9617d2b498623bbe45dfb7f60073e85d255fc2980cfbc8a047ca10f7fa
MD5 5f1f130cbd058eff70322bfa86ff4e28
SHA1 937fc8cc49c6bbdc85dcfdbf78a2d7efbfb0a4a2
SHA512 1b6655da880a22c4589d16f252278443ef823c373375c302782cada90f40c78a90fad60f7ab4f084133865d3e69da49c19e4ac5710eb69e8fdafa02262c2ce73
SSDEEP 384:zv+OBqImmJvGBLx3NaFMJFXNbx/E9xbg6rh:ycvGtlNjixBV
TLSH
T1FF72ADBA28252B3728A7C90AFA8C274BDB75625380D52BE8CEED5F0E416F1C41352D19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e2e47a6f-97c7-459a-b0a1-75d3b41b7dc9.tmp

Path C:\Users\Admin\AppData\Local\dev.stormix.deadlock-mod-manager\EBWebView\e2e47a6f-97c7-459a-b0a1-75d3b41b7dc9.tmp
Size 1KB
SHA256 0cea1aa7543ff74c3d4d65495fcffbac54dc928b32aec6b1acb7b81d977c85a9
MD5 9bfa380e5e0e92c982e143fff8438e67
SHA1 4ae8503248384f2f0c6c5ec288915c85b47af51b
SHA512 c704a7dec9521fcc9bc9181d8d6ec5566277bdea4916f4e62e69119689d85b4c64469cdf87d6d7c3719d164c8371b6d108d22a8bb6feb889a917c403ada141e6
TLSH
T1D83185F3F8903B365841E94AB2412F4F6F708037A1505E58B6DE4F2842E71DC552BD3A
MD5 SHA1 SHA512 TLSH

Submit Download

eae55f9d-1759-4166-b77e-d1c6d8b85c13.tmp

Path C:\Users\Admin\AppData\Local\dev.stormix.deadlock-mod-manager\EBWebView\eae55f9d-1759-4166-b77e-d1c6d8b85c13.tmp
Size 3KB
SHA256 0c7144813ec0cd960d3539929c3c90a1d152f7bac27c6e08c18ccddd32b1c906
MD5 7a7dd12cbab37f64ec7a8d56feca7458
SHA1 c7b7c5e7c274152632b013b3fe3a32314835108e
SHA512 24fea37c3e20b90213b3af1fe8e079a4369a1b05414d220faef080de0d416d87dac995287c488953126641e559ff5afa8799fa7ba5d306922da79029fd4d8af5
TLSH
T1A7718467B864AA3749A2DD45B9852B0ABBA59037E1943FA8DAED0F1C01D72D81342C27
MD5 SHA1 SHA512 TLSH

Submit Download

Deadlock Mod Manager.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Deadlock Mod Manager.lnk
Size 1KB
SHA256 ddbad7ec064317e3a2ea7cbc338581db7b777254d09269118eaf08fd8f6af563
MD5 cd9359b764e25c0491a30f3a88e1bead
SHA1 733df850381f83ebf774564d48f7a99ea0ba4a53
SHA512 09fe62897b3029590858e043f690e4405bfaf5324eb72ab5799655d59cc78dbc700dfa262e03a5eff00bd0f9aca7d2c42471974198f27a2f07178335925e81be
TLSH
T14221F18496ED1715E2BBCD7B5DF351626E717C55B6254F0D004042042C277C6CE88FEB
MD5 SHA1 SHA512 TLSH

Submit Download

Deadlock Mod Manager.lnk

Path C:\Users\Admin\Desktop\Deadlock Mod Manager.lnk
Size 1KB
SHA256 25a591802169cb83adec12badfb2622a752d9784988882606dc558fbb83303a5
MD5 23a8f8e65da214a21ab56e13549920c5
SHA1 f8f028d710151d6a097f38a3852a91bc9740eae6
SHA512 460984160ada868c07d4ad180d085f9f5a7e5d722f7d6117beac53d1b0e6eb65af5e62c5d29007474183281b1c95649b8cb0d13a4face0a71a5c8ab12971542d
TLSH
T1C021F1819AFD0724E2BBCD7B5EF351526E7078657A254F0D008042142D237D6CE88BAB
MD5 SHA1 SHA512 TLSH

Submit Download

f24e1c6d-c07d-4052-8a84-d28d36920a8f.tmp

Path C:\Users\Admin\Downloads\f24e1c6d-c07d-4052-8a84-d28d36920a8f.tmp
Size 22.0MB
SHA256 11e8a0996099e04fcc1a6059f2b5b04ebdc8b572356cb955763b2b8ea5b2d948
MD5 3c179980faf79828861aeab7d7f99e76
SHA1 84f38cf09b89d69489dc7ef92ff1c8fd2e0f24b3
SHA512 fe8c74455707473678406f72e8e7d7b935000fee68286b070d6f08ad0906dac8fdf4b7302cb74fc7a5d1e4e830e771ec47ee0fbe2868faebc83270cad428ef6c
SSDEEP 393216:A8Cz2Mk9jNmZTlVH6VFtDqKCUv3F/8OBO4T4S2SZY9cuZnVe1VD2AYcaqCAMEEUv:A1gs5VHstqdGF/VY40aZ+pUJYLtAME9x
TLSH
T1903733E0C4D09CE6F9AE8EF5CB00A7DFFD7D809B31D275B2A912817C852166119EF680
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1904-334-0x00007FF87B1F0000-0x00007FF87B1F1000-memory.dmp

Download

memory/5144-422-0x00007FF879AD0000-0x00007FF879AD1000-memory.dmp

Download

memory/5144-421-0x00007FF87B1F0000-0x00007FF87B1F1000-memory.dmp

Download

memory/5548-440-0x00007FF87B1F0000-0x00007FF87B1F1000-memory.dmp

Download