08bb33136f48f33a26e042c8d508c842be67e6fdb480afdbf4800254eb73ab33

Analysis

max time kernel
243s
max time network
246s
platform
windows10-1703_x64
resource
win10-20230220-de
resource tags

arch:x64arch:x86image:win10-20230220-delocale:de-deos:windows10-1703-x64systemwindows
submitted
12-03-2023 13:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fraudware(1).exe
Size

4.2MB
MD5

c0e320c137f767b9621057620cece831
SHA1

29d555d24a32fde067313c591e16585b9405e88f
SHA256

08bb33136f48f33a26e042c8d508c842be67e6fdb480afdbf4800254eb73ab33
SHA512

1334cc7d4e3ee4634a9923538037ca0dc0fdda47f9a9a90454261f15daf154373244dd163a784618993f85c7ecbec80c4d1f9e4b430ca967c0ab10530c2eee6e
SSDEEP

98304:W1SfLMN63+KAb9FUDLrm3vokWn0H3I0ZBre6iCkCnqaUp3BX0YgGM1DDsH75x:QSfAN63+YCoJnAZBRYqPUpxX0Yv43Ux

Score

8^/10

microsoft discovery persistence phishing

Malware Config

Signatures

Downloads MZ/PE file

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Control Panel\International\Geo\Nation	fraudware(1).exe
Key value queried	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Control Panel\International\Geo\Nation	fraudware.exe

Executes dropped EXE 6 IoCs

pid	Process
1628	windowsdesktop-runtime-7.0.3-win-x86.exe
4776	windowsdesktop-runtime-7.0.3-win-x86.exe
4592	windowsdesktop-runtime-7.0.3-win-x86.exe
1824	windowsdesktop-runtime-7.0.3-win-x86.exe
4432	windowsdesktop-runtime-7.0.3-win-x86.exe
2188	fraudware.exe

Loads dropped DLL 64 IoCs

pid	Process
4776	windowsdesktop-runtime-7.0.3-win-x86.exe
1824	windowsdesktop-runtime-7.0.3-win-x86.exe
2596	MsiExec.exe
4364	MsiExec.exe
1056	MsiExec.exe
3624	MsiExec.exe
2188	fraudware.exe
2188	fraudware.exe
2188	fraudware.exe
2188	fraudware.exe
2188	fraudware.exe
2188	fraudware.exe
2188	fraudware.exe
2188	fraudware.exe
2188	fraudware.exe
2188	fraudware.exe
2188	fraudware.exe
2188	fraudware.exe
2188	fraudware.exe
2188	fraudware.exe
2188	fraudware.exe
2188	fraudware.exe
2188	fraudware.exe
2188	fraudware.exe
2188	fraudware.exe
2188	fraudware.exe
2188	fraudware.exe
2188	fraudware.exe
2188	fraudware.exe
2188	fraudware.exe
2188	fraudware.exe
2188	fraudware.exe
2188	fraudware.exe
2188	fraudware.exe
2188	fraudware.exe
2188	fraudware.exe
2188	fraudware.exe
2188	fraudware.exe
2188	fraudware.exe
2188	fraudware.exe
2188	fraudware.exe
2188	fraudware.exe
2188	fraudware.exe
2188	fraudware.exe
2188	fraudware.exe
2188	fraudware.exe
2188	fraudware.exe
2188	fraudware.exe
2188	fraudware.exe
2188	fraudware.exe
2188	fraudware.exe
2188	fraudware.exe
2188	fraudware.exe
2188	fraudware.exe
2188	fraudware.exe
2188	fraudware.exe
2188	fraudware.exe
2188	fraudware.exe
2188	fraudware.exe
2188	fraudware.exe
2188	fraudware.exe
2188	fraudware.exe
2188	fraudware.exe
2188	fraudware.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	windowsdesktop-runtime-7.0.3-win-x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{fb2a04f5-0485-4389-92b0-58b42022183d} = "\"C:\\ProgramData\\Package Cache\\{fb2a04f5-0485-4389-92b0-58b42022183d}\\windowsdesktop-runtime-7.0.3-win-x86.exe\" /burn.runonce"	windowsdesktop-runtime-7.0.3-win-x86.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe

Detected potential entity reuse from brand microsoft.
phishing microsoft

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\7.0.3\System.Globalization.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.3\ru\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.3\cs\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.3\ko\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.3\zh-Hant\System.Windows.Forms.Primitives.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\7.0.3\System.Runtime.InteropServices.RuntimeInformation.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\7.0.3\msquic.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.3\pt-BR\System.Windows.Forms.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.3\es\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.3\zh-Hans\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\7.0.3\System.Security.Principal.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.3\ko\System.Windows.Forms.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\7.0.3\System.Security.Cryptography.OpenSsl.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.3\System.Security.Cryptography.Xml.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.3\ja\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\7.0.3\System.Formats.Asn1.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.3\zh-Hant\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.3\UIAutomationClientSideProviders.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.3\tr\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\7.0.3\System.IO.IsolatedStorage.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\dotnet.exe	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.3\ko\UIAutomationClient.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.3\zh-Hant\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\7.0.3\System.AppContext.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.3\ru\UIAutomationTypes.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\7.0.3\System.Text.RegularExpressions.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.3\ja\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.3\UIAutomationTypes.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.3\cs\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\7.0.3\System.Private.Xml.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.3\System.Windows.Extensions.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.3\ru\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\7.0.3\System.ObjectModel.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\7.0.3\System.IO.Compression.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\7.0.3\System.Net.WebClient.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.3\tr\System.Windows.Forms.Primitives.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.3\ru\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\7.0.3\System.Drawing.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\7.0.3\System.Private.Xml.Linq.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\7.0.3\System.Threading.Timer.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.3\it\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.3\PresentationFramework-SystemCore.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.3\de\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.3\System.Drawing.Common.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\7.0.3\System.Collections.NonGeneric.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.3\pt-BR\ReachFramework.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.3\zh-Hant\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\7.0.3\System.Diagnostics.StackTrace.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\7.0.3\System.Collections.Immutable.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\7.0.3\System.Diagnostics.TraceSource.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.3\PresentationFramework-SystemXmlLinq.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.3\ko\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\7.0.3\System.Net.NetworkInformation.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.3\ko\System.Windows.Forms.Primitives.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.3\System.Security.Cryptography.Pkcs.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\7.0.3\System.Reflection.TypeExtensions.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\7.0.3\System.Net.HttpListener.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\7.0.3\System.IO.Compression.Brotli.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.3\cs\UIAutomationClient.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.3\ru\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.3\UIAutomationProvider.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.3\cs\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.3\pl\ReachFramework.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\7.0.3\WindowsBase.dll	msiexec.exe

Drops file in Windows directory 31 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e585280.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI99F5.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC1A5.tmp	msiexec.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{F2A02615-10E6-48B3-99A7-D75A26368E3C}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5F9F.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{BB03DB96-5698-4533-80D4-5C0AF7277073}	msiexec.exe
File opened for modification	C:\Windows\Installer\e585288.msi	msiexec.exe
File created	C:\Windows\Installer\e58528b.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI907E.tmp	msiexec.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdge.exe
File created	C:\Windows\Installer\e58528f.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e585280.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI87DC.tmp	msiexec.exe
File created	C:\Windows\Installer\e585288.msi	msiexec.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\Installer\e585287.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7E27.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8E49.tmp	msiexec.exe
File created	C:\Windows\Installer\e585284.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e585284.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI89B4.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{32B0A87E-7D42-4C57-880E-74E8618B3F67}	msiexec.exe
File created	C:\Windows\Installer\e58528c.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e58528c.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{67194A35-F76A-4E14-9704-ECCD6B4326BC}	msiexec.exe
File created	C:\Windows\Installer\e585283.msi	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1F	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\20	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\21	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1E\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\20	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\21	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\CTLs	MicrosoftEdge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E78A0B2324D775C488E0478E16B8F376\ProductName = "Microsoft .NET Host - 7.0.3 (x86)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_56.15.55219_x86\ = "{67194A35-F76A-4E14-9704-ECCD6B4326BC}"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing\NewTabPage	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\PersistedStorageItemTable\System\{5BCF5D99-A098-4E34-89B9-68BABA7620 = "0"	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\microsoft.com\ = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\microsoft.com\Total = "114"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E78A0B2324D775C488E0478E16B8F376	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main\OperationalData = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-SubSysId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionLow = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies\CacheLimit = "1"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\TrustedPublisher\CRLs	MicrosoftEdge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E78A0B2324D775C488E0478E16B8F376\Language = "1033"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DeviceId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionHigh = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\EdpDomStorage\Total\ = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Settings\Cache	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\Total\ = "24514"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "14"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\51620A2F6E013B84997A7DA56263E8C3\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{F2A02615-10E6-48B3-99A7-D75A26368E3C}v56.15.55162\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\53A49176A67F41E47940CEDCB63462CB	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E78A0B2324D775C488E0478E16B8F376\SourceList\PackageName = "dotnet-host-7.0.3-win-x86.msi"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\www.bing.com\ = "24514"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\dotnet_runtime_56.15.55162_x86	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLsVisitCount\url1 = "1"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{AEBA21FA-782A-4A90-978D-B7216 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\PersistedStorageItemTable\System\{9694123D-F187-47BC-850E-70FA537CC9 = 0114020000000000c0000000000000464c0000000114020000000000c0000000000000468300000020000000e3a6c99aeb54d901e3a6c99aeb54d9018ba3459beb54d90134cb420000000000010000000000000000000000000000009f0314001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800b0003100000000000000000010004d6963726f736f66742e4d6963726f736f6674456467655f3877656b796233643862627765007c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e004d006900630072006f0073006f006600740045006400670065005f003800770065006b00790062003300640038006200620077006500000034005c0031000000000000000000100054656d70537461746500440009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000540065006d00700053007400610074006500000018005c00310000000000000000001000446f776e6c6f61647300440009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000044006f0077006e006c006f00610064007300000018006800320034cb42006c56997020004652415544577e312e45584500004c0009000400efbe6c5698706c5698702e00000000000000000000000000000000000000000000000000750900016600720061007500640077006100720065002e0065007800650000001c000000a30000001c000000010000001c0000003400000000000000a200000018000000030000008eed8d221000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e4d6963726f736f6674456467655f3877656b7962336438626277655c54656d7053746174655c446f776e6c6f6164735c6672617564776172652e657865000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a0580000000000000072646f747863636c000000000000000080c88b7b741f8740a5f5f41c7370c9a6f8b29f285ab1ed11b674ea90d2442c9880c88b7b741f8740a5f5f41c7370c9a6f8b29f285ab1ed11b674ea90d2442c98d2000000090000a08d00000031535053e28a5846bc4c3843bbfc139326986dce7100000004000000001f0000002f00000053002d0031002d0035002d00320031002d0033003300340036003900330039003800360039002d0032003800330035003500390034003200380032002d0033003700370035003100360035003900320030002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d000000680000000048000000f0e6dcfb000000000000d01200000000000000000000000000000000	browser_broker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\69BD30BB89653354084DC5A07F720737\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CacheLimit = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\PersistedStorageItemTable\System\{3C99A278-5C11-4239-936B-C991BBED6C = 0114020000000000c0000000000000464c0000000114020000000000c0000000000000468300000020000000fd1d7b39eb54d901fd1d7b39eb54d90159c07d70eb54d901707b27030000000001000000000000000000000000000000d50314001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800b0003100000000000000000010004d6963726f736f66742e4d6963726f736f6674456467655f3877656b796233643862627765007c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e004d006900630072006f0073006f006600740045006400670065005f003800770065006b00790062003300640038006200620077006500000034005c0031000000000000000000100054656d70537461746500440009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000540065006d00700053007400610074006500000018005c00310000000000000000001000446f776e6c6f61647300440009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000044006f0077006e006c006f00610064007300000018009e003200707b27036c567370200057494e444f577e312e4558450000820009000400efbe6c5643706c5643702e00000000000000000000000000000000000000000000000000a798dd00770069006e0064006f00770073006400650073006b0074006f0070002d00720075006e00740069006d0065002d0037002e0030002e0033002d00770069006e002d007800380036002e0065007800650000001c000000be0000001c000000010000001c0000003400000000000000bd00000018000000030000008eed8d221000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e4d6963726f736f6674456467655f3877656b7962336438626277655c54656d7053746174655c446f776e6c6f6164735c77696e646f77736465736b746f702d72756e74696d652d372e302e332d77696e2d7838362e657865000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a0580000000000000072646f747863636c000000000000000080c88b7b741f8740a5f5f41c7370c9a6d5b29f285ab1ed11b674ea90d2442c9880c88b7b741f8740a5f5f41c7370c9a6d5b29f285ab1ed11b674ea90d2442c98d2000000090000a08d00000031535053e28a5846bc4c3843bbfc139326986dce7100000004000000001f0000002f00000053002d0031002d0035002d00320031002d0033003300340036003900330039003800360039002d0032003800330035003500390034003200380032002d0033003700370035003100360035003900320030002d00310030003000300000000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d000000680000000048000000f0e6dcfb000000000000d01200000000000000000000000000000000	browser_broker.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\7841BFE021F534149111215561734262	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\bing.com\NumberOfSubdomains = "1"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode\SettingsVersion = "2"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\FirstRecoveryTime = c7407ea65a45d901	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_56.15.55162_x86\ = "{F2A02615-10E6-48B3-99A7-D75A26368E3C}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_7.0_x86\ = "{32B0A87E-7D42-4C57-880E-74E8618B3F67}"	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\DisallowDefaultBrowserPrompt = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge	MicrosoftEdgeCP.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\windowsdesktop-runtime-7.0.3-win-x86.exe.44w8qim.partial:Zone.Identifier	browser_broker.exe
File opened for modification	C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\fraudware.exe.e572vyw.partial:Zone.Identifier	browser_broker.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4100	msiexec.exe
4100	msiexec.exe
4100	msiexec.exe
4100	msiexec.exe
4100	msiexec.exe
4100	msiexec.exe
4100	msiexec.exe
4100	msiexec.exe

Suspicious behavior: MapViewOfSection 6 IoCs

pid	Process
3508	MicrosoftEdgeCP.exe
3508	MicrosoftEdgeCP.exe
3508	MicrosoftEdgeCP.exe
3508	MicrosoftEdgeCP.exe
3508	MicrosoftEdgeCP.exe
3508	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4864	MicrosoftEdge.exe
Token: SeDebugPrivilege	4864	MicrosoftEdge.exe
Token: SeDebugPrivilege	4864	MicrosoftEdge.exe
Token: SeDebugPrivilege	4864	MicrosoftEdge.exe
Token: SeDebugPrivilege	3732	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3732	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3732	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3732	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3552	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3552	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4864	MicrosoftEdge.exe
Token: SeShutdownPrivilege	4432	windowsdesktop-runtime-7.0.3-win-x86.exe
Token: SeIncreaseQuotaPrivilege	4432	windowsdesktop-runtime-7.0.3-win-x86.exe
Token: SeSecurityPrivilege	4100	msiexec.exe
Token: SeCreateTokenPrivilege	4432	windowsdesktop-runtime-7.0.3-win-x86.exe
Token: SeAssignPrimaryTokenPrivilege	4432	windowsdesktop-runtime-7.0.3-win-x86.exe
Token: SeLockMemoryPrivilege	4432	windowsdesktop-runtime-7.0.3-win-x86.exe
Token: SeIncreaseQuotaPrivilege	4432	windowsdesktop-runtime-7.0.3-win-x86.exe
Token: SeMachineAccountPrivilege	4432	windowsdesktop-runtime-7.0.3-win-x86.exe
Token: SeTcbPrivilege	4432	windowsdesktop-runtime-7.0.3-win-x86.exe
Token: SeSecurityPrivilege	4432	windowsdesktop-runtime-7.0.3-win-x86.exe
Token: SeTakeOwnershipPrivilege	4432	windowsdesktop-runtime-7.0.3-win-x86.exe
Token: SeLoadDriverPrivilege	4432	windowsdesktop-runtime-7.0.3-win-x86.exe
Token: SeSystemProfilePrivilege	4432	windowsdesktop-runtime-7.0.3-win-x86.exe
Token: SeSystemtimePrivilege	4432	windowsdesktop-runtime-7.0.3-win-x86.exe
Token: SeProfSingleProcessPrivilege	4432	windowsdesktop-runtime-7.0.3-win-x86.exe
Token: SeIncBasePriorityPrivilege	4432	windowsdesktop-runtime-7.0.3-win-x86.exe
Token: SeCreatePagefilePrivilege	4432	windowsdesktop-runtime-7.0.3-win-x86.exe
Token: SeCreatePermanentPrivilege	4432	windowsdesktop-runtime-7.0.3-win-x86.exe
Token: SeBackupPrivilege	4432	windowsdesktop-runtime-7.0.3-win-x86.exe
Token: SeRestorePrivilege	4432	windowsdesktop-runtime-7.0.3-win-x86.exe
Token: SeShutdownPrivilege	4432	windowsdesktop-runtime-7.0.3-win-x86.exe
Token: SeDebugPrivilege	4432	windowsdesktop-runtime-7.0.3-win-x86.exe
Token: SeAuditPrivilege	4432	windowsdesktop-runtime-7.0.3-win-x86.exe
Token: SeSystemEnvironmentPrivilege	4432	windowsdesktop-runtime-7.0.3-win-x86.exe
Token: SeChangeNotifyPrivilege	4432	windowsdesktop-runtime-7.0.3-win-x86.exe
Token: SeRemoteShutdownPrivilege	4432	windowsdesktop-runtime-7.0.3-win-x86.exe
Token: SeUndockPrivilege	4432	windowsdesktop-runtime-7.0.3-win-x86.exe
Token: SeSyncAgentPrivilege	4432	windowsdesktop-runtime-7.0.3-win-x86.exe
Token: SeEnableDelegationPrivilege	4432	windowsdesktop-runtime-7.0.3-win-x86.exe
Token: SeManageVolumePrivilege	4432	windowsdesktop-runtime-7.0.3-win-x86.exe
Token: SeImpersonatePrivilege	4432	windowsdesktop-runtime-7.0.3-win-x86.exe
Token: SeCreateGlobalPrivilege	4432	windowsdesktop-runtime-7.0.3-win-x86.exe
Token: SeRestorePrivilege	4100	msiexec.exe
Token: SeTakeOwnershipPrivilege	4100	msiexec.exe
Token: SeRestorePrivilege	4100	msiexec.exe
Token: SeTakeOwnershipPrivilege	4100	msiexec.exe
Token: SeRestorePrivilege	4100	msiexec.exe
Token: SeTakeOwnershipPrivilege	4100	msiexec.exe
Token: SeRestorePrivilege	4100	msiexec.exe
Token: SeTakeOwnershipPrivilege	4100	msiexec.exe
Token: SeRestorePrivilege	4100	msiexec.exe
Token: SeTakeOwnershipPrivilege	4100	msiexec.exe
Token: SeRestorePrivilege	4100	msiexec.exe
Token: SeTakeOwnershipPrivilege	4100	msiexec.exe
Token: SeRestorePrivilege	4100	msiexec.exe
Token: SeTakeOwnershipPrivilege	4100	msiexec.exe
Token: SeRestorePrivilege	4100	msiexec.exe
Token: SeTakeOwnershipPrivilege	4100	msiexec.exe
Token: SeRestorePrivilege	4100	msiexec.exe
Token: SeTakeOwnershipPrivilege	4100	msiexec.exe
Token: SeRestorePrivilege	4100	msiexec.exe
Token: SeTakeOwnershipPrivilege	4100	msiexec.exe
Token: SeRestorePrivilege	4100	msiexec.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
1824	windowsdesktop-runtime-7.0.3-win-x86.exe
1824	windowsdesktop-runtime-7.0.3-win-x86.exe
1824	windowsdesktop-runtime-7.0.3-win-x86.exe
2188	fraudware.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4864	MicrosoftEdge.exe
3508	MicrosoftEdgeCP.exe
3508	MicrosoftEdgeCP.exe
1824	windowsdesktop-runtime-7.0.3-win-x86.exe
1236	MicrosoftEdgeCP.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3508 wrote to memory of 3732	3508	MicrosoftEdgeCP.exe	70
PID 3508 wrote to memory of 3732	3508	MicrosoftEdgeCP.exe	70
PID 3508 wrote to memory of 3732	3508	MicrosoftEdgeCP.exe	70
PID 3508 wrote to memory of 3732	3508	MicrosoftEdgeCP.exe	70
PID 3508 wrote to memory of 3732	3508	MicrosoftEdgeCP.exe	70
PID 3508 wrote to memory of 3732	3508	MicrosoftEdgeCP.exe	70
PID 3508 wrote to memory of 3732	3508	MicrosoftEdgeCP.exe	70
PID 3508 wrote to memory of 3732	3508	MicrosoftEdgeCP.exe	70
PID 3508 wrote to memory of 3732	3508	MicrosoftEdgeCP.exe	70
PID 3508 wrote to memory of 3732	3508	MicrosoftEdgeCP.exe	70
PID 3508 wrote to memory of 3732	3508	MicrosoftEdgeCP.exe	70
PID 4892 wrote to memory of 1628	4892	browser_broker.exe	75
PID 4892 wrote to memory of 1628	4892	browser_broker.exe	75
PID 4892 wrote to memory of 1628	4892	browser_broker.exe	75
PID 1628 wrote to memory of 4776	1628	windowsdesktop-runtime-7.0.3-win-x86.exe	77
PID 1628 wrote to memory of 4776	1628	windowsdesktop-runtime-7.0.3-win-x86.exe	77
PID 1628 wrote to memory of 4776	1628	windowsdesktop-runtime-7.0.3-win-x86.exe	77
PID 4892 wrote to memory of 4592	4892	browser_broker.exe	78
PID 4892 wrote to memory of 4592	4892	browser_broker.exe	78
PID 4892 wrote to memory of 4592	4892	browser_broker.exe	78
PID 4592 wrote to memory of 1824	4592	windowsdesktop-runtime-7.0.3-win-x86.exe	79
PID 4592 wrote to memory of 1824	4592	windowsdesktop-runtime-7.0.3-win-x86.exe	79
PID 4592 wrote to memory of 1824	4592	windowsdesktop-runtime-7.0.3-win-x86.exe	79
PID 1824 wrote to memory of 4432	1824	windowsdesktop-runtime-7.0.3-win-x86.exe	80
PID 1824 wrote to memory of 4432	1824	windowsdesktop-runtime-7.0.3-win-x86.exe	80
PID 1824 wrote to memory of 4432	1824	windowsdesktop-runtime-7.0.3-win-x86.exe	80
PID 4100 wrote to memory of 2596	4100	msiexec.exe	82
PID 4100 wrote to memory of 2596	4100	msiexec.exe	82
PID 4100 wrote to memory of 2596	4100	msiexec.exe	82
PID 4100 wrote to memory of 4364	4100	msiexec.exe	83
PID 4100 wrote to memory of 4364	4100	msiexec.exe	83
PID 4100 wrote to memory of 4364	4100	msiexec.exe	83
PID 4100 wrote to memory of 1056	4100	msiexec.exe	84
PID 4100 wrote to memory of 1056	4100	msiexec.exe	84
PID 4100 wrote to memory of 1056	4100	msiexec.exe	84
PID 4100 wrote to memory of 3624	4100	msiexec.exe	85
PID 4100 wrote to memory of 3624	4100	msiexec.exe	85
PID 4100 wrote to memory of 3624	4100	msiexec.exe	85
PID 3508 wrote to memory of 3732	3508	MicrosoftEdgeCP.exe	70
PID 3508 wrote to memory of 3732	3508	MicrosoftEdgeCP.exe	70
PID 3508 wrote to memory of 3732	3508	MicrosoftEdgeCP.exe	70
PID 3508 wrote to memory of 3732	3508	MicrosoftEdgeCP.exe	70
PID 3508 wrote to memory of 1236	3508	MicrosoftEdgeCP.exe	89
PID 3508 wrote to memory of 1236	3508	MicrosoftEdgeCP.exe	89
PID 3508 wrote to memory of 1236	3508	MicrosoftEdgeCP.exe	89
PID 3508 wrote to memory of 3164	3508	MicrosoftEdgeCP.exe	90
PID 3508 wrote to memory of 3164	3508	MicrosoftEdgeCP.exe	90
PID 3508 wrote to memory of 3164	3508	MicrosoftEdgeCP.exe	90
PID 3508 wrote to memory of 3164	3508	MicrosoftEdgeCP.exe	90
PID 3508 wrote to memory of 3164	3508	MicrosoftEdgeCP.exe	90
PID 3508 wrote to memory of 3164	3508	MicrosoftEdgeCP.exe	90
PID 3508 wrote to memory of 3164	3508	MicrosoftEdgeCP.exe	90
PID 3508 wrote to memory of 3164	3508	MicrosoftEdgeCP.exe	90
PID 3508 wrote to memory of 3164	3508	MicrosoftEdgeCP.exe	90
PID 3508 wrote to memory of 3164	3508	MicrosoftEdgeCP.exe	90
PID 4892 wrote to memory of 2188	4892	browser_broker.exe	94
PID 4892 wrote to memory of 2188	4892	browser_broker.exe	94
PID 4892 wrote to memory of 2188	4892	browser_broker.exe	94
PID 3508 wrote to memory of 3164	3508	MicrosoftEdgeCP.exe	90
PID 3508 wrote to memory of 3164	3508	MicrosoftEdgeCP.exe	90
PID 3508 wrote to memory of 3164	3508	MicrosoftEdgeCP.exe	90
PID 3508 wrote to memory of 3164	3508	MicrosoftEdgeCP.exe	90
PID 3508 wrote to memory of 3164	3508	MicrosoftEdgeCP.exe	90
PID 3508 wrote to memory of 3164	3508	MicrosoftEdgeCP.exe	90

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\fraudware(1).exe
"C:\Users\Admin\AppData\Local\Temp\fraudware(1).exe"
1⤵
- Checks computer location settings
PID:3180

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4864

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:4892
- C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\windowsdesktop-runtime-7.0.3-win-x86.exe
  "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\windowsdesktop-runtime-7.0.3-win-x86.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1628
- - C:\Windows\Temp\{D3BD8C42-8F24-42BF-B744-549FE2FACC58}\.cr\windowsdesktop-runtime-7.0.3-win-x86.exe
    "C:\Windows\Temp\{D3BD8C42-8F24-42BF-B744-549FE2FACC58}\.cr\windowsdesktop-runtime-7.0.3-win-x86.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\windowsdesktop-runtime-7.0.3-win-x86.exe" -burn.filehandle.attached=528 -burn.filehandle.self=536
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4776
- C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\windowsdesktop-runtime-7.0.3-win-x86.exe
  "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\windowsdesktop-runtime-7.0.3-win-x86.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4592
- - C:\Windows\Temp\{FD824BED-F1A2-4E69-BB25-60547734A492}\.cr\windowsdesktop-runtime-7.0.3-win-x86.exe
    "C:\Windows\Temp\{FD824BED-F1A2-4E69-BB25-60547734A492}\.cr\windowsdesktop-runtime-7.0.3-win-x86.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\windowsdesktop-runtime-7.0.3-win-x86.exe" -burn.filehandle.attached=528 -burn.filehandle.self=536
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1824
  - - C:\Windows\Temp\{0CAC6E22-8534-4A93-B92E-2E6CAA7334A2}\.be\windowsdesktop-runtime-7.0.3-win-x86.exe
      "C:\Windows\Temp\{0CAC6E22-8534-4A93-B92E-2E6CAA7334A2}\.be\windowsdesktop-runtime-7.0.3-win-x86.exe" -q -burn.elevated BurnPipe.{125F87F0-00AC-45D3-8133-B53F8DF4BB9D} {A259BF30-B981-4877-ABF1-CDED8E2FC9A7} 1824
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of AdjustPrivilegeToken
      PID:4432
- C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\fraudware.exe
  "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\fraudware.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of FindShellTrayWindow
  PID:2188

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3508

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3732

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3552

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:312

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:2192

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4100
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 60A748C4F70DE51EEC0D95675BCBA871
  2⤵
  - Loads dropped DLL
  PID:2596
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 28F6C3AFEDED8783635CFDC62582B97F
  2⤵
  - Loads dropped DLL
  PID:4364
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 14A874D1C5388648695120A05F42D1B6
  2⤵
  - Loads dropped DLL
  PID:1056
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 7D69D9081E90F0B7281F70CA636F69A2
  2⤵
  - Loads dropped DLL
  PID:3624

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1236

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
PID:3164

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:3444

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:3328

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e585282.rbs

Filesize
48KB

MD5
2e903562052de0cc0c7b158e68aceb9c

SHA1
aabab8c659f3878ea45d3379093a95361044c1b6

SHA256
6ccb1ff52b2acf5b0f04a3b576f0062e1b13cd0fcb550273e9e370fdcdc03d10

SHA512
32c0b4229698f2880c4618b3ef5744852458ddbd9c7b3708f23afee272d4e4340dd9e2e7d7504ce23281f0956ba6a261107885f979104bf150d255d2207f3210

Download Submit
C:\Config.Msi\e585286.rbs

Filesize
8KB

MD5
09f0470a7e95cbf103e0fad007fbb1e1

SHA1
41048bae5378e84da649ea966ccff86cc2b4de1f

SHA256
b09469e24023a49334eeced4a0825dc8269cb63e8ffa5a9d8f7785e591cc7395

SHA512
e0fe7f3ffb602f01cbea05e866bf23d7658d770a4e641322875ef5ffd64ec1ab5673c03cb1cae1def9781222f1cbf2b3db05d6f42d488219be9867a64dc298c9

Download Submit
C:\Config.Msi\e58528a.rbs

Filesize
9KB

MD5
7e67b41f4556a381072368d309ff9c05

SHA1
400cf9719518b8cc85886fbb9cd03baa13600526

SHA256
55269ec1f55b8149473862427bb527281d537a367121f46850d16634287eac03

SHA512
1119bc474703b06cad1765942fcbca32eb50f4f1c6657deb1793dab87e4694932cf48e3eb46cf2be724eacd2b996d5bbfb8764384cbc517f8d6ae61bd38fa402

Download Submit
C:\Config.Msi\e58528e.rbs

Filesize
89KB

MD5
81ed5a39c5fbc88990973db8b3aca47b

SHA1
76661478a9e07278a0a8a95fea24319c3784e3b2

SHA256
1d6f20f9bf57025b2077366c4d59e0f83d47114687fe571873055265cb43f1a0

SHA512
4a2ec9df5d6252c53b9353f2f106b300237c748e8bc57f3abbcdea8cc3b3ce0394694e0c0ec6c91dbd48392c27264ae8fe3c6f7ca3bca5c7b8a647c438fce48a

Download Submit
C:\Program Files (x86)\dotnet\LICENSE.txt

Filesize
9KB

MD5
31c5a77b3c57c8c2e82b9541b00bcd5a

SHA1
153d4bc14e3a2c1485006f1752e797ca8684d06d

SHA256
7f6839a61ce892b79c6549e2dc5a81fdbd240a0b260f8881216b45b7fda8b45d

SHA512
ad33e3c0c3b060ad44c5b1b712c991b2d7042f6a60dc691c014d977c922a7e3a783ba9bade1a34de853c271fde1fb75bc2c47869acd863a40be3a6c6d754c0a6

Download Submit
C:\Program Files (x86)\dotnet\ThirdPartyNotices.txt

Filesize
85KB

MD5
481ad608d2c3b3a5a0a3a529f2b2569e

SHA1
e271613b837d2cda290808af2bbd104a8c104a10

SHA256
29aec309fa6f036be931222385612088a3d98aa07ac2356243028a3072d0ce86

SHA512
93dde6782e14ac259b8655a89b31f7efe6990f27bc560f90200f3c967645d20fc54510e8fb0346732ea54707728a7075c9b566a936e76586c50681de65c83afb

Download Submit
C:\Program Files (x86)\dotnet\host\fxr\7.0.3\hostfxr.dll

Filesize
309KB

MD5
a4d2d248335a692f7fa8cdb6824cb34e

SHA1
f09ec808964d0f5158d07a2e7aad6d91cffd573d

SHA256
7fe0fa5155466b4e4957194262a249d6d09ca7824ca185809c7e33dffdc8251e

SHA512
b7a0aa659b159a498621af329fc5d0494620fbe0dbeb4fc5f5598367e0dd173f4f7fade0b62b2961c0ae126437cb53213f90f072c72b2a52b24883413b5367df

Download Submit
C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\7.0.3\Microsoft.NETCore.App.deps.json

Filesize
27KB

MD5
1d45f8a5519359d0b84d86800a099b0c

SHA1
15e51bfb1e1c2b9455c78dcd16c0b1a579d2272f

SHA256
180cb4a1dfcc06d3678f775b4e17123bab1673d66e103b41ec9c1546f3bc7071

SHA512
61e719522903ca2d0132af47e979acab30d121beb20c7333fc70101ed8d875c9c91fc5518a9040183bf55839fb841042dc275d3db1e6a23e9aa910c6d2c309ba

Download Submit
C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\7.0.3\Microsoft.NETCore.App.runtimeconfig.json

Filesize
159B

MD5
01da0d56ab33c0ed0e7ac85e5244190f

SHA1
9e1e4b59e590038f769e5fa01fb326109a7f38e5

SHA256
7133274dc5efab688a6efe2f43ca33e78a2498ef39efcad231b0e07ad2c26d17

SHA512
e11967ba33c719da1681a7f98056d40f450788d9b7c8b2f580d8bc7998fc35a78c53fc970301b097c527fab79fd477adad4eafcd75b4bb376d33c3fece9e8926

Download Submit
C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\7.0.3\System.Collections.dll

Filesize
242KB

MD5
c4581dda34d63e74a3f5cc74c9c0a49f

SHA1
9eb941a85e9db42eae8f7363e69bf5a993ba27e5

SHA256
00d4259974f94c76d11f200255329ff9a47f0a1cdad2396e69a84035158e5d11

SHA512
a2ae634baec71dfec97e777cd8ba1413fdfdfc2f207d69e0eff4e5295725499c5f052e3109e8b426be2b8f3cde87620f1bf9d491e1003e4efae279f86e1375ab

Download Submit
C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\7.0.3\System.Private.CoreLib.dll

Filesize
10.5MB

MD5
be808b0b183847ad62e9e4ab0e4ad2ea

SHA1
8ef82070d065cfe226d674311e338189e1cee2e4

SHA256
9c07f7174facf1ad17d701b137cc5f6c5308a295e0f3b32ff81b71e4ce5d26c0

SHA512
f7f7e45d244bca670486868511ca1a5398f33984afd755bf7a303de1caf55aebd3e476bb55f88feb2ad1b8bac57e69fd16e856abe57ee38358bf84dd2c39c68a

Download Submit
C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\7.0.3\System.Reflection.Emit.Lightweight.dll

Filesize
15KB

MD5
613bc087a845007d995d0d99a41e7705

SHA1
9377e1aac7af4ed6833a179abcbb07d29a53fb19

SHA256
318fa62931230a70a1d5eccf553bf18df93f3fca08044301d76c4ad3aecd8462

SHA512
8e9149d942be844ae62d694a8a7c175cbf0933e5f8e8afcb6bbf3351afe577b5ab6ab7d5171d2b56d9d7d47ffcd73002a040f010378bec800ee2a475f67c3d24

Download Submit
C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\7.0.3\System.Runtime.dll

Filesize
42KB

MD5
a5f668eb60f8b7a33c038233897c28d6

SHA1
ccad7cf466a12071496fa09227943dd74e9d2697

SHA256
641bd9dcef1c6c550dab50e2aed28879c0dcc772ea3fffbf7d2570de4d86ae0b

SHA512
97163e48d577c2e9511ac737a9b35e83068860b1d205adbe57d7428198fb375cf3e82b402e1cd21b7fde39c966a46f6b3eba35d84f415b767e1077111e84520a

Download Submit
C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\7.0.3\System.Security.Cryptography.Csp.dll

Filesize
16KB

MD5
38b371979b8d4b336f422c54d03e46f2

SHA1
22dabdeb0528e887aec6c6d2fc468204c4b97aeb

SHA256
cb7ff8a28ac50c1dc9a789516d45775a31a8652a5890b402efb60d192da17411

SHA512
263be53c032747fef76eeffa1e94fef1c1932831343882473bf301d23b3ca63621c5444d47f138aa36cce7e3b1153482c9a7b36a444438c739d0849d0fbaa1c8

Download Submit
C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\7.0.3\System.Security.Cryptography.Primitives.dll

Filesize
15KB

MD5
05c0bc1fb780824fefffe0650b2a6371

SHA1
01a76b27265de0c53ed6d5431f2f1f5a6f75fbff

SHA256
47ded0c792e0464c27f6824601393733dd1abfeb63c973567422fd95026b04a4

SHA512
0282acf2c48a5b7043952c9acac4c73e949883c9ccfc3bbdedeac4ee884861fa4ba539babb1429952af622ed40810b6371f7f208d7657030c4bedf76b31fdd9a

Download Submit
C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\7.0.3\System.Security.Cryptography.dll

Filesize
1.6MB

MD5
65de2a3c3488fd8f4b5bfd55f2422741

SHA1
6b8fb9132437d4e8fb2c5b47c62f028a77f281f4

SHA256
a3b06d2f05edd87be4c198ce8c19ea8794efd67e29f8bfe43681cd3fab0b0750

SHA512
4dab09f4cbb7036a0bf286b745948d4c8e58e0297195fbb69be6700d1d81ebd1359f13294b84b7eb8ba205ffe0d46a82dff5a9d98dee1d521ce990fb78faecf6

Download Submit
C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\7.0.3\clrjit.dll

Filesize
1.3MB

MD5
e9e4413821fc22cfdb7b053e16674150

SHA1
8c3dca23248b8d29e7082361c6497e838c7df96a

SHA256
c01dc5853924b9a2fef74ac3f24c717816ee1f5317ccf85c6bc5d97cff9d1777

SHA512
30e134977b15f8fb4881bcaf4f895d8540a1bf9f89d8b8572017bb5dff2a8b0571a6b2eb19cabd1314f4a2e44ebbbac06bbb722ad5292f670cb47c54ff760741

Download Submit
C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\7.0.3\coreclr.dll

Filesize
4.1MB

MD5
d0522111556501497f810fd5eabfb2a4

SHA1
89b631e4cf8071062e0f623858a78a10e48f036a

SHA256
268e81afe95861e0fb53956cc7f1dbe46f010549770e85ca3a94d86c4fcc2fab

SHA512
5cfc1e6444ddd93af5860bb77127b42016eee660c2b64005b74a8ff4a1cc19252be227f876493c93ba980bd75c487a628d25be02d0c981ef9dd42d9f87764f42

Download Submit
C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\7.0.3\hostpolicy.dll

Filesize
323KB

MD5
acf423d85fa46acee241772dd6eaf11c

SHA1
bdb9f01b751e4d98877514de80ab619669d7bda6

SHA256
93de550b3519ea26128dc0f9ff7d76ac27ce02f8bc8f9a9643747188410014c4

SHA512
fec15a836966ea2d309adf14867274eb53c1a366820b442bae07013a0dc3440d56737419df028f36569c9a71043be18b7e50309b2b19ad7382aca0fa1ba55163

Download Submit
C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\7.0.3\mscorrc.dll

Filesize
134KB

MD5
7e107967e77c801fb5df2f58cf86b109

SHA1
024cbf9d9f51e14ef41bb9abd58b10f6e57d72d2

SHA256
85ad33ef2e849dc5b2ab8cb5092c65eda4f3eacb8fca90213a3fc0a7a47c8ccd

SHA512
51d784416e849d7353263dae3f414ab303914a49ae97452e5c960671ef809341e1c480a0c1e10afbfa9b5d087bae27fd318d3d70e37e86ce1a47eba9a4b9de3c

Download Submit
C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.3\Microsoft.WindowsDesktop.App.deps.json

Filesize
30KB

MD5
638475af05ddd1f04e7fcfa20294bc53

SHA1
f1272bdaf2ea5b4c6b4d979c97fb716b212630da

SHA256
5ac4f67e29e0985b8bcf6b6f77e17fdc5d1375aefdc07c16295b0363c45cdb08

SHA512
50d01fff1e39356e2de4246e11abe7bb5ec8ce7ea77753a4e4dcb4ae86bcdb8f29b6c78f6930ad229a34328c7fca411c3da3b6b6c47a0be3c77590f5690bbfae

Download Submit
C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.3\Microsoft.WindowsDesktop.App.runtimeconfig.json

Filesize
288B

MD5
9457be36c8f8f029d4ca2382501b23ea

SHA1
dd9ec7d6395a529b9973755b77b80fa38b205ede

SHA256
9994c7ce7ad25af5040b0cdaa73c882883fa95cc9050e6e2c4547963984c4b52

SHA512
58bcd8e7d8d367385c7d1b53ad4d1bde384b74e5e879e42069ac1947abf5728d6f66028c87f440c60db7e96514cd068f8ae4d883ea43ce3555577225192abbb4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Filesize
4KB

MD5
f7dcb24540769805e5bb30d193944dce

SHA1
e26c583c562293356794937d9e2e6155d15449ee

SHA256
6b88c6ac55bbd6fea0ebe5a760d1ad2cfce251c59d0151a1400701cb927e36ea

SHA512
cb5ad678b0ef642bf492f32079fe77e8be20c02de267f04b545df346b25f3e4eb98bb568c4c2c483bb88f7d1826863cb515b570d620766e52476c8ee2931ea94

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\KIQVE9IA\edgecompatviewlist[1].xml

Filesize
74KB

MD5
d4fc49dc14f63895d997fa4940f24378

SHA1
3efb1437a7c5e46034147cbbc8db017c69d02c31

SHA256
853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1

SHA512
cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\3DTZOHG2\warmup[1].gif

Filesize
43B

MD5
325472601571f31e1bf00674c368d335

SHA1
2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a

SHA256
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

SHA512
717ea0ff7f3f624c268eccb244e24ec1305ab21557abb3d6f1a7e183ff68a2d28f13d1d2af926c9ef6d1fb16dd8cbe34cd98cacf79091dddc7874dcee21ecfdc

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\NZ8WDUW8\fRSNKQanUHk53F1a1Bi8UA71Qt4.br[1].js

Filesize
289B

MD5
9085e17b6172d9fc7b7373762c3d6e74

SHA1
dab3ca26ec7a8426f034113afa2123edfaa32a76

SHA256
586d8f94486a8116af00c80a255cba96c5d994c5864e47deac5a7f1ae1e24b0d

SHA512
b27b776cb4947eef6d9e2a33b46e87796a6d4c427f4759c08cf5aa0ee410a5f12e89ca6ab9cddd86c8471037e3c505f43c8b7fc6d8417f97f9fe3c5c47216bc4

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\NZ8WDUW8\fraudware[1].exe

Filesize
4.2MB

MD5
c0e320c137f767b9621057620cece831

SHA1
29d555d24a32fde067313c591e16585b9405e88f

SHA256
08bb33136f48f33a26e042c8d508c842be67e6fdb480afdbf4800254eb73ab33

SHA512
1334cc7d4e3ee4634a9923538037ca0dc0fdda47f9a9a90454261f15daf154373244dd163a784618993f85c7ecbec80c4d1f9e4b430ca967c0ab10530c2eee6e

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\R5GANFNN\sXBuN34gVodVFZ4ibhvLSgv15Ks.br[1].js

Filesize
4KB

MD5
56b91eab01144db91d100617ba0ef2a6

SHA1
5994c12e9338175d82e2ee3053265f738d858e20

SHA256
ee7f4b86a5c2b3d2781d6a0ba8f3deff6ef943d21a5a92f435453c87b99f9509

SHA512
84715f3b86201e40ddf0b6e052c2fdfb8cb9c6fb79fe42df01ed4ac26197993439cdd917480ca21e5c04f6c39725695cbcf1e7ec7f4726573390f62088bbf85a

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\XVNNUUDI\dotnet.microsoft[1].xml

Filesize
13B

MD5
c1ddea3ef6bbef3e7060a1a9ad89e4c5

SHA1
35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

SHA256
b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

SHA512
6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\6YR0ATBC\favicon-trans-bg-blue-mg[1].ico

Filesize
4KB

MD5
30967b1b52cb6df18a8af8fcc04f83c9

SHA1
aaf67cd84fcd64fb2d8974d7135d6f1e4fc03588

SHA256
439b6089e45ef1e0c37ef88764d5c99a3b2752609c4e2af3376480d7ffcfaf2e

SHA512
7cb3c09a81fbd301741e7cf5296c406baf1c76685d354c54457c87f6471867390a1aeed9f95701eb9361d7dfacce31afd1d240841037fc1de4a120c66c1b088c

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\6YR0ATBC\favicon[1].ico

Filesize
16KB

MD5
12e3dac858061d088023b2bd48e2fa96

SHA1
e08ce1a144eceae0c3c2ea7a9d6fbc5658f24ce5

SHA256
90cdaf487716184e4034000935c605d1633926d348116d198f355a98b8c6cd21

SHA512
c5030c55a855e7a9e20e22f4c70bf1e0f3c558a9b7d501cfab6992ac2656ae5e41b050ccac541efa55f9603e0d349b247eb4912ee169d44044271789c719cd01

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\Q0ZNMC4U\suggestions[1].de-DE

Filesize
18KB

MD5
cc5361b5fdccfc6830217e2eb9972dd8

SHA1
e4a1206d9190eccea3e6a116c954d11da0aeba66

SHA256
afd57b0b6d8166e25bbef7cbc97522677c11c9a930fd4d4a204d1b7ae6258492

SHA512
ef63961bd7f0d3357d352a8f9c8ea57d0271e0fb664b1be179c38cd2d559bbaa4864f64f3521f26f868cc074f97994e2658c6d652021a39dc5207d45411691bc

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\ImageStore\9e9tajz\imagestore.dat

Filesize
17KB

MD5
4e2a9db0b78af5edb01046b1a791502f

SHA1
6e1ab8a71f3fe9421d666a6007e040682c7ec2dc

SHA256
ad571a02aaf7e6ba93c0a3a0dc5d6e7bb4b5a3671457b977074935abc94c92f7

SHA512
f42ec847e7e3271c2ca999cb975940a07a8d53c5531d954e16cde3e39cfd27f7f2a14e24b83405fa0dc7808d16f3c0cefd1ddfcdeb82322767f1541584840d62

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\Microsoft\Windows\3720402701\2219095117.pri

Filesize
207KB

MD5
e2b88765ee31470114e866d939a8f2c6

SHA1
e0a53b8511186ff308a0507b6304fb16cabd4e1f

SHA256
523e419d2fa2e780239812d36caa37e92f8c3e6a5cd9f18f0d807c593effa45e

SHA512
462e8e6b4e63fc6781b6a9935b332a1dc77bfb88e1de49134f86fd46bd1598d2e842902dd9415a328e325bd7cdee766bd9473f2695acdfa769ffe7ba9ae1953d

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\fraudware.exe

Filesize
4.2MB

MD5
c0e320c137f767b9621057620cece831

SHA1
29d555d24a32fde067313c591e16585b9405e88f

SHA256
08bb33136f48f33a26e042c8d508c842be67e6fdb480afdbf4800254eb73ab33

SHA512
1334cc7d4e3ee4634a9923538037ca0dc0fdda47f9a9a90454261f15daf154373244dd163a784618993f85c7ecbec80c4d1f9e4b430ca967c0ab10530c2eee6e

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\fraudware.exe

Filesize
4.2MB

MD5
c0e320c137f767b9621057620cece831

SHA1
29d555d24a32fde067313c591e16585b9405e88f

SHA256
08bb33136f48f33a26e042c8d508c842be67e6fdb480afdbf4800254eb73ab33

SHA512
1334cc7d4e3ee4634a9923538037ca0dc0fdda47f9a9a90454261f15daf154373244dd163a784618993f85c7ecbec80c4d1f9e4b430ca967c0ab10530c2eee6e

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\fraudware.exe.e572vyw.partial

Filesize
4.2MB

MD5
c0e320c137f767b9621057620cece831

SHA1
29d555d24a32fde067313c591e16585b9405e88f

SHA256
08bb33136f48f33a26e042c8d508c842be67e6fdb480afdbf4800254eb73ab33

SHA512
1334cc7d4e3ee4634a9923538037ca0dc0fdda47f9a9a90454261f15daf154373244dd163a784618993f85c7ecbec80c4d1f9e4b430ca967c0ab10530c2eee6e

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\windowsdesktop-runtime-7.0.3-win-x86.exe

Filesize
50.5MB

MD5
f43180083f6e9eff738dd79a4cfcb3e5

SHA1
bfef9ddee860e676648d828f8dbef6ae8f8d2f82

SHA256
3c96006c4e0e8ef7bae63a01da93895f20dc746e58cad88de33067a844de767d

SHA512
8aad7c1766f11337dfeb8774b28d7462b742609f27dbf6ee0f1ad300f0bf7def00f75d47b151b433e3811dec4144521972c30f1772c86dbabc465d2e8299db7e

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\windowsdesktop-runtime-7.0.3-win-x86.exe

Filesize
50.5MB

MD5
f43180083f6e9eff738dd79a4cfcb3e5

SHA1
bfef9ddee860e676648d828f8dbef6ae8f8d2f82

SHA256
3c96006c4e0e8ef7bae63a01da93895f20dc746e58cad88de33067a844de767d

SHA512
8aad7c1766f11337dfeb8774b28d7462b742609f27dbf6ee0f1ad300f0bf7def00f75d47b151b433e3811dec4144521972c30f1772c86dbabc465d2e8299db7e

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\windowsdesktop-runtime-7.0.3-win-x86.exe

Filesize
50.5MB

MD5
f43180083f6e9eff738dd79a4cfcb3e5

SHA1
bfef9ddee860e676648d828f8dbef6ae8f8d2f82

SHA256
3c96006c4e0e8ef7bae63a01da93895f20dc746e58cad88de33067a844de767d

SHA512
8aad7c1766f11337dfeb8774b28d7462b742609f27dbf6ee0f1ad300f0bf7def00f75d47b151b433e3811dec4144521972c30f1772c86dbabc465d2e8299db7e

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\windowsdesktop-runtime-7.0.3-win-x86.exe

Filesize
50.5MB

MD5
f43180083f6e9eff738dd79a4cfcb3e5

SHA1
bfef9ddee860e676648d828f8dbef6ae8f8d2f82

SHA256
3c96006c4e0e8ef7bae63a01da93895f20dc746e58cad88de33067a844de767d

SHA512
8aad7c1766f11337dfeb8774b28d7462b742609f27dbf6ee0f1ad300f0bf7def00f75d47b151b433e3811dec4144521972c30f1772c86dbabc465d2e8299db7e

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\windowsdesktop-runtime-7.0.3-win-x86.exe.44w8qim.partial

Filesize
50.5MB

MD5
f43180083f6e9eff738dd79a4cfcb3e5

SHA1
bfef9ddee860e676648d828f8dbef6ae8f8d2f82

SHA256
3c96006c4e0e8ef7bae63a01da93895f20dc746e58cad88de33067a844de767d

SHA512
8aad7c1766f11337dfeb8774b28d7462b742609f27dbf6ee0f1ad300f0bf7def00f75d47b151b433e3811dec4144521972c30f1772c86dbabc465d2e8299db7e

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\NZ8WDUW8\fraudware[1].exe

Filesize
79KB

MD5
c0fc6003d86073f531e3f8786f99c86a

SHA1
6bcb7532f1a041c05b9d610f196f7901db7b467c

SHA256
6f578afb87503a47a2f46700db63babdbc8a7ad6f460c435c8783cac6192a43d

SHA512
54810acd9201965c8b9201c0a4b07a807e3f2b6c792e73b32be05ce96335ceb3e17d29c1cbd5d2cfab497d80fc4a771c741611a400a3d850ca034ce233e5ad80

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\NZ8WDUW8\windowsdesktop-runtime-7.0.3-win-x86[1].exe

Filesize
32KB

MD5
6defd223575360e22a853348e9196111

SHA1
4ed0d43dc36ed79dc2e3d3d45446c0e0dfa79c60

SHA256
74fa6516b24292fb9be03ca39b09d4854e2d68809dd3f91284a4905b9fd15d0f

SHA512
ebd6acd07a8ff531974f8ff6368038473dabffae31a63fead9e871d5a72bf20f1484c01cd2f8897b897957cb3711c311e929c576fbae6d1c0c2bb0f84a7e7855

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\Windows\3720402701\2219095117.pri

Filesize
207KB

MD5
e2b88765ee31470114e866d939a8f2c6

SHA1
e0a53b8511186ff308a0507b6304fb16cabd4e1f

SHA256
523e419d2fa2e780239812d36caa37e92f8c3e6a5cd9f18f0d807c593effa45e

SHA512
462e8e6b4e63fc6781b6a9935b332a1dc77bfb88e1de49134f86fd46bd1598d2e842902dd9415a328e325bd7cdee766bd9473f2695acdfa769ffe7ba9ae1953d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_7.0.3_(x86)_20230312140344_000_dotnet_runtime_7.0.3_win_x86.msi.log

Filesize
2KB

MD5
aa361f15d10cae63259115bf1585bfe8

SHA1
87911a6b926140d58a951affdb9074c74fdf836d

SHA256
8871bd8bcc0e8ee83b622bd678e71d2c07d5e6e710f362dae48dc7dd4ae015cf

SHA512
fa43b0a8782ed97e16c0b86ac4b14e8d2978392cb416e995831c3d0ac3960ac492321af9703d469216a5a099ff07bf262cee3da621f96779ac735081d1fc0a36

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_7.0.3_(x86)_20230312140344_001_dotnet_hostfxr_7.0.3_win_x86.msi.log

Filesize
2KB

MD5
e73c2f6865c7fd9299995c735149a3a9

SHA1
65507e681ea8f717893e03a8220f495fd8f0e310

SHA256
a1d07defd9d4e201ee5e89af93b3fc18388ced4dbc09313360a5cb0479d1cd58

SHA512
e4ea38730db6e834223f8f5cb3e7f92d5ea0cea44708a31a58755105b268afeb8167e3671fb65f4c8a982e137720090dd48eb43299c80c47ece8dba151d8b7ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_7.0.3_(x86)_20230312140344_002_dotnet_host_7.0.3_win_x86.msi.log

Filesize
2KB

MD5
93c877788da39fdaa4544fd6d5870946

SHA1
2f72b1a75811cb4626cb1c2dcafa1debc48f897f

SHA256
c8237a1e08ea46d339e34459954c9193d92141cb3b2c22bbbb4ba76007a11433

SHA512
9ffa03516d591f6c62fa87d909a863c6799e95fe6c11a8db8cae9e9c0f309ecf67480e2ce4f663f55429037d8c43dbdefecdf1b26c61baa33baf5d1fc6d56aa1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_7.0.3_(x86)_20230312140344_003_windowsdesktop_runtime_7.0.3_win_x86.msi.log

Filesize
3KB

MD5
03ecc74f021e3302b6af35b3c5df0a98

SHA1
00ca5529a0c6025c7b5fc90e1395e61b9b783250

SHA256
fa731f3c0feff217eb83fd6dfd3398f2d26d075da5dd0768345efc698bebd646

SHA512
f465a58fc9824c62fb6af56b38c45e880f98e9bc6a677d7507b0c8aac7081098f685cc6d70286a90f6532a17a700cedd903b7e19f1bc5f61ad4137948546fcfd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tmp5191.tmp

Filesize
2KB

MD5
6cadc06d58c03c18decf96d161b7787e

SHA1
4874902ecea4bffddb26da85e1e5373bc0b77d17

SHA256
befebda6bb99b475e9551c5558e1d4798f839b983473cf4d41988bcc3725adfc

SHA512
a9bc1863a519d246a586eab9cd2b5624fc42a6ce1289c3b73e37ee4000a315f70c2b9cec8a89a591fcc1c301fd0b8c2c7cf3a8e8a918eeb1031d4fb019be45c4

Download Submit
C:\Windows\Installer\MSI7E27.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI89B4.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI907E.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI907E.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSIC1A5.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\e585283.msi

Filesize
23.7MB

MD5
39e4e8171e1e55e12a5bec591df77846

SHA1
2e25665bd0dcf71ea2b06ad3d9453000b26949ea

SHA256
8d95e807a443223ef1b9fe75d28ce3caa41c22852ce604adde52919784968c04

SHA512
28f923306db56a9d0f4793673e4c19a27f36015be5f4e0d1d5da3cc9a63f1d91ec0191f1765d21b36ce592864108ead62711f6eb3e5826f4d06e02aeaaf8309d

Download Submit
C:\Windows\Installer\e585284.msi

Filesize
784KB

MD5
52e5fa1e64b01371a66c74baa073ab34

SHA1
9611ff79e16992f20e1ccd5af891876ed2f8b0ac

SHA256
4c3cce6153f35f2a0e2dd1d08985847b18048b1b9ff2cfa3acf6dad19b09a49c

SHA512
9a0b02cd69cd8fc081f378a83fed71f32d2d62198ab2cd902493f4c8156e5014bc66d7c8504677a133fd7a054e78c81ab368c1a2f8ef89220bd43fcf40350d6d

Download Submit
C:\Windows\Installer\e58528f.msi

Filesize
26.3MB

MD5
bf54008dd962e9a78e33b73ef509de5e

SHA1
01383ed606e640ae5a8edc948c488cb16916461a

SHA256
9e7f4b8bf3767252a70792a0c78949bd4cb376f425c321b7ba4fb93bf1d1f533

SHA512
cc1010675dfc6d1504d1653599476b33f4e916196d86cae9981c5a5075faa635f6ff12096b3b636aa83e97ff38dbf6cff40f7eedc4540a9b2d13e7bf804edbb6

Download Submit
C:\Windows\Temp\{0CAC6E22-8534-4A93-B92E-2E6CAA7334A2}\.ba\wixstdba.dll

Filesize
197KB

MD5
4356ee50f0b1a878e270614780ddf095

SHA1
b5c0915f023b2e4ed3e122322abc40c4437909af

SHA256
41a8787fdc9467f563438daba4131191aa1eb588a81beb9a89fe8bd886c16104

SHA512
b9e482efe9189683dabfc9feff8b386d7eba4ecf070f42a1eebee6052cfb181a19497f831f1ea6429cfcce1d4865a5d279b24bd738d702902e9887bb9f0c4691

Download Submit
C:\Windows\Temp\{0CAC6E22-8534-4A93-B92E-2E6CAA7334A2}\.be\windowsdesktop-runtime-7.0.3-win-x86.exe

Filesize
610KB

MD5
da1cc17375aa343220f00dae76579e07

SHA1
c305fb832c281f304a22bddd22776a3801d2b654

SHA256
dcf9d382b76d8373da10bd33fa0b5aeb12eb9481fff0fa39c6d896f9758b608c

SHA512
f9e27f7fe94f3b1ae1e006a6f7324f7e7efe54809aa6136389ba8884f173bcf1ddbd4f88a800147113c03835dd1d353346ce735d48365b08219f6104a9f8bd4e

Download Submit
C:\Windows\Temp\{0CAC6E22-8534-4A93-B92E-2E6CAA7334A2}\.be\windowsdesktop-runtime-7.0.3-win-x86.exe

Filesize
610KB

MD5
da1cc17375aa343220f00dae76579e07

SHA1
c305fb832c281f304a22bddd22776a3801d2b654

SHA256
dcf9d382b76d8373da10bd33fa0b5aeb12eb9481fff0fa39c6d896f9758b608c

SHA512
f9e27f7fe94f3b1ae1e006a6f7324f7e7efe54809aa6136389ba8884f173bcf1ddbd4f88a800147113c03835dd1d353346ce735d48365b08219f6104a9f8bd4e

Download Submit
C:\Windows\Temp\{0CAC6E22-8534-4A93-B92E-2E6CAA7334A2}\.be\windowsdesktop-runtime-7.0.3-win-x86.exe

Filesize
610KB

MD5
da1cc17375aa343220f00dae76579e07

SHA1
c305fb832c281f304a22bddd22776a3801d2b654

SHA256
dcf9d382b76d8373da10bd33fa0b5aeb12eb9481fff0fa39c6d896f9758b608c

SHA512
f9e27f7fe94f3b1ae1e006a6f7324f7e7efe54809aa6136389ba8884f173bcf1ddbd4f88a800147113c03835dd1d353346ce735d48365b08219f6104a9f8bd4e

Download Submit
C:\Windows\Temp\{0CAC6E22-8534-4A93-B92E-2E6CAA7334A2}\dotnet_host_7.0.3_win_x86.msi

Filesize
732KB

MD5
d4c6c8b437b75119c4573e46a0250ff3

SHA1
0c17a99ea3ad8ffa49de6736ece4081d64a1406a

SHA256
23f26490066425e101c5efaeafe386bd4843ee1c74356cba306731eeaa041176

SHA512
184ca2bdff6fa95838640274490210a628a74238bb64a978ab047eabfc1d94e6af2dd4ad8c1d8040e1aaf33d59bb545a3c5e42e2079b1f0f31b980c3a386d1e8

Download Submit
C:\Windows\Temp\{0CAC6E22-8534-4A93-B92E-2E6CAA7334A2}\dotnet_hostfxr_7.0.3_win_x86.msi

Filesize
784KB

MD5
52e5fa1e64b01371a66c74baa073ab34

SHA1
9611ff79e16992f20e1ccd5af891876ed2f8b0ac

SHA256
4c3cce6153f35f2a0e2dd1d08985847b18048b1b9ff2cfa3acf6dad19b09a49c

SHA512
9a0b02cd69cd8fc081f378a83fed71f32d2d62198ab2cd902493f4c8156e5014bc66d7c8504677a133fd7a054e78c81ab368c1a2f8ef89220bd43fcf40350d6d

Download Submit
C:\Windows\Temp\{0CAC6E22-8534-4A93-B92E-2E6CAA7334A2}\dotnet_runtime_7.0.3_win_x86.msi

Filesize
23.7MB

MD5
39e4e8171e1e55e12a5bec591df77846

SHA1
2e25665bd0dcf71ea2b06ad3d9453000b26949ea

SHA256
8d95e807a443223ef1b9fe75d28ce3caa41c22852ce604adde52919784968c04

SHA512
28f923306db56a9d0f4793673e4c19a27f36015be5f4e0d1d5da3cc9a63f1d91ec0191f1765d21b36ce592864108ead62711f6eb3e5826f4d06e02aeaaf8309d

Download Submit
C:\Windows\Temp\{0CAC6E22-8534-4A93-B92E-2E6CAA7334A2}\windowsdesktop_runtime_7.0.3_win_x86.msi

Filesize
26.3MB

MD5
bf54008dd962e9a78e33b73ef509de5e

SHA1
01383ed606e640ae5a8edc948c488cb16916461a

SHA256
9e7f4b8bf3767252a70792a0c78949bd4cb376f425c321b7ba4fb93bf1d1f533

SHA512
cc1010675dfc6d1504d1653599476b33f4e916196d86cae9981c5a5075faa635f6ff12096b3b636aa83e97ff38dbf6cff40f7eedc4540a9b2d13e7bf804edbb6

Download Submit
C:\Windows\Temp\{9A753F13-CD14-4E5B-8BA3-D345DFD737C5}\.ba\bg.png

Filesize
4KB

MD5
9eb0320dfbf2bd541e6a55c01ddc9f20

SHA1
eb282a66d29594346531b1ff886d455e1dcd6d99

SHA256
9095bf7b6baa0107b40a4a6d727215be077133a190f4ca9bd89a176842141e79

SHA512
9ada3a1757a493fbb004bd767fab8f77430af69d71479f340b8b8ede904cc94cd733700db593a4a2d2e1184c0081fd0648318d867128e1cb461021314990931d

Download Submit
C:\Windows\Temp\{D3BD8C42-8F24-42BF-B744-549FE2FACC58}\.cr\windowsdesktop-runtime-7.0.3-win-x86.exe

Filesize
610KB

MD5
da1cc17375aa343220f00dae76579e07

SHA1
c305fb832c281f304a22bddd22776a3801d2b654

SHA256
dcf9d382b76d8373da10bd33fa0b5aeb12eb9481fff0fa39c6d896f9758b608c

SHA512
f9e27f7fe94f3b1ae1e006a6f7324f7e7efe54809aa6136389ba8884f173bcf1ddbd4f88a800147113c03835dd1d353346ce735d48365b08219f6104a9f8bd4e

Download Submit
C:\Windows\Temp\{D3BD8C42-8F24-42BF-B744-549FE2FACC58}\.cr\windowsdesktop-runtime-7.0.3-win-x86.exe

Filesize
610KB

MD5
da1cc17375aa343220f00dae76579e07

SHA1
c305fb832c281f304a22bddd22776a3801d2b654

SHA256
dcf9d382b76d8373da10bd33fa0b5aeb12eb9481fff0fa39c6d896f9758b608c

SHA512
f9e27f7fe94f3b1ae1e006a6f7324f7e7efe54809aa6136389ba8884f173bcf1ddbd4f88a800147113c03835dd1d353346ce735d48365b08219f6104a9f8bd4e

Download Submit
C:\Windows\Temp\{FD824BED-F1A2-4E69-BB25-60547734A492}\.cr\windowsdesktop-runtime-7.0.3-win-x86.exe

Filesize
610KB

MD5
da1cc17375aa343220f00dae76579e07

SHA1
c305fb832c281f304a22bddd22776a3801d2b654

SHA256
dcf9d382b76d8373da10bd33fa0b5aeb12eb9481fff0fa39c6d896f9758b608c

SHA512
f9e27f7fe94f3b1ae1e006a6f7324f7e7efe54809aa6136389ba8884f173bcf1ddbd4f88a800147113c03835dd1d353346ce735d48365b08219f6104a9f8bd4e

Download Submit
C:\Windows\Temp\{FD824BED-F1A2-4E69-BB25-60547734A492}\.cr\windowsdesktop-runtime-7.0.3-win-x86.exe

Filesize
610KB

MD5
da1cc17375aa343220f00dae76579e07

SHA1
c305fb832c281f304a22bddd22776a3801d2b654

SHA256
dcf9d382b76d8373da10bd33fa0b5aeb12eb9481fff0fa39c6d896f9758b608c

SHA512
f9e27f7fe94f3b1ae1e006a6f7324f7e7efe54809aa6136389ba8884f173bcf1ddbd4f88a800147113c03835dd1d353346ce735d48365b08219f6104a9f8bd4e

Download Submit
\Program Files (x86)\dotnet\host\fxr\7.0.3\hostfxr.dll

Filesize
309KB

MD5
a4d2d248335a692f7fa8cdb6824cb34e

SHA1
f09ec808964d0f5158d07a2e7aad6d91cffd573d

SHA256
7fe0fa5155466b4e4957194262a249d6d09ca7824ca185809c7e33dffdc8251e

SHA512
b7a0aa659b159a498621af329fc5d0494620fbe0dbeb4fc5f5598367e0dd173f4f7fade0b62b2961c0ae126437cb53213f90f072c72b2a52b24883413b5367df

Download Submit
\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\7.0.3\System.Collections.dll

Filesize
242KB

MD5
c4581dda34d63e74a3f5cc74c9c0a49f

SHA1
9eb941a85e9db42eae8f7363e69bf5a993ba27e5

SHA256
00d4259974f94c76d11f200255329ff9a47f0a1cdad2396e69a84035158e5d11

SHA512
a2ae634baec71dfec97e777cd8ba1413fdfdfc2f207d69e0eff4e5295725499c5f052e3109e8b426be2b8f3cde87620f1bf9d491e1003e4efae279f86e1375ab

Download Submit
\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\7.0.3\System.Private.CoreLib.dll

Filesize
10.5MB

MD5
be808b0b183847ad62e9e4ab0e4ad2ea

SHA1
8ef82070d065cfe226d674311e338189e1cee2e4

SHA256
9c07f7174facf1ad17d701b137cc5f6c5308a295e0f3b32ff81b71e4ce5d26c0

SHA512
f7f7e45d244bca670486868511ca1a5398f33984afd755bf7a303de1caf55aebd3e476bb55f88feb2ad1b8bac57e69fd16e856abe57ee38358bf84dd2c39c68a

Download Submit
\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\7.0.3\System.Reflection.Emit.Lightweight.dll

Filesize
15KB

MD5
613bc087a845007d995d0d99a41e7705

SHA1
9377e1aac7af4ed6833a179abcbb07d29a53fb19

SHA256
318fa62931230a70a1d5eccf553bf18df93f3fca08044301d76c4ad3aecd8462

SHA512
8e9149d942be844ae62d694a8a7c175cbf0933e5f8e8afcb6bbf3351afe577b5ab6ab7d5171d2b56d9d7d47ffcd73002a040f010378bec800ee2a475f67c3d24

Download Submit
\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\7.0.3\System.Runtime.dll

Filesize
42KB

MD5
a5f668eb60f8b7a33c038233897c28d6

SHA1
ccad7cf466a12071496fa09227943dd74e9d2697

SHA256
641bd9dcef1c6c550dab50e2aed28879c0dcc772ea3fffbf7d2570de4d86ae0b

SHA512
97163e48d577c2e9511ac737a9b35e83068860b1d205adbe57d7428198fb375cf3e82b402e1cd21b7fde39c966a46f6b3eba35d84f415b767e1077111e84520a

Download Submit
\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\7.0.3\System.Runtime.dll

Filesize
42KB

MD5
a5f668eb60f8b7a33c038233897c28d6

SHA1
ccad7cf466a12071496fa09227943dd74e9d2697

SHA256
641bd9dcef1c6c550dab50e2aed28879c0dcc772ea3fffbf7d2570de4d86ae0b

SHA512
97163e48d577c2e9511ac737a9b35e83068860b1d205adbe57d7428198fb375cf3e82b402e1cd21b7fde39c966a46f6b3eba35d84f415b767e1077111e84520a

Download Submit
\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\7.0.3\System.Security.Cryptography.Csp.dll

Filesize
16KB

MD5
38b371979b8d4b336f422c54d03e46f2

SHA1
22dabdeb0528e887aec6c6d2fc468204c4b97aeb

SHA256
cb7ff8a28ac50c1dc9a789516d45775a31a8652a5890b402efb60d192da17411

SHA512
263be53c032747fef76eeffa1e94fef1c1932831343882473bf301d23b3ca63621c5444d47f138aa36cce7e3b1153482c9a7b36a444438c739d0849d0fbaa1c8

Download Submit
\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\7.0.3\System.Security.Cryptography.Csp.dll

Filesize
16KB

MD5
38b371979b8d4b336f422c54d03e46f2

SHA1
22dabdeb0528e887aec6c6d2fc468204c4b97aeb

SHA256
cb7ff8a28ac50c1dc9a789516d45775a31a8652a5890b402efb60d192da17411

SHA512
263be53c032747fef76eeffa1e94fef1c1932831343882473bf301d23b3ca63621c5444d47f138aa36cce7e3b1153482c9a7b36a444438c739d0849d0fbaa1c8

Download Submit
\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\7.0.3\System.Security.Cryptography.Primitives.dll

Filesize
15KB

MD5
05c0bc1fb780824fefffe0650b2a6371

SHA1
01a76b27265de0c53ed6d5431f2f1f5a6f75fbff

SHA256
47ded0c792e0464c27f6824601393733dd1abfeb63c973567422fd95026b04a4

SHA512
0282acf2c48a5b7043952c9acac4c73e949883c9ccfc3bbdedeac4ee884861fa4ba539babb1429952af622ed40810b6371f7f208d7657030c4bedf76b31fdd9a

Download Submit
\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\7.0.3\System.Security.Cryptography.Primitives.dll

Filesize
15KB

MD5
05c0bc1fb780824fefffe0650b2a6371

SHA1
01a76b27265de0c53ed6d5431f2f1f5a6f75fbff

SHA256
47ded0c792e0464c27f6824601393733dd1abfeb63c973567422fd95026b04a4

SHA512
0282acf2c48a5b7043952c9acac4c73e949883c9ccfc3bbdedeac4ee884861fa4ba539babb1429952af622ed40810b6371f7f208d7657030c4bedf76b31fdd9a

Download Submit
\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\7.0.3\System.Security.Cryptography.dll

Filesize
1.6MB

MD5
65de2a3c3488fd8f4b5bfd55f2422741

SHA1
6b8fb9132437d4e8fb2c5b47c62f028a77f281f4

SHA256
a3b06d2f05edd87be4c198ce8c19ea8794efd67e29f8bfe43681cd3fab0b0750

SHA512
4dab09f4cbb7036a0bf286b745948d4c8e58e0297195fbb69be6700d1d81ebd1359f13294b84b7eb8ba205ffe0d46a82dff5a9d98dee1d521ce990fb78faecf6

Download Submit
\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\7.0.3\clrjit.dll

Filesize
1.3MB

MD5
e9e4413821fc22cfdb7b053e16674150

SHA1
8c3dca23248b8d29e7082361c6497e838c7df96a

SHA256
c01dc5853924b9a2fef74ac3f24c717816ee1f5317ccf85c6bc5d97cff9d1777

SHA512
30e134977b15f8fb4881bcaf4f895d8540a1bf9f89d8b8572017bb5dff2a8b0571a6b2eb19cabd1314f4a2e44ebbbac06bbb722ad5292f670cb47c54ff760741

Download Submit
\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\7.0.3\coreclr.dll

Filesize
4.1MB

MD5
d0522111556501497f810fd5eabfb2a4

SHA1
89b631e4cf8071062e0f623858a78a10e48f036a

SHA256
268e81afe95861e0fb53956cc7f1dbe46f010549770e85ca3a94d86c4fcc2fab

SHA512
5cfc1e6444ddd93af5860bb77127b42016eee660c2b64005b74a8ff4a1cc19252be227f876493c93ba980bd75c487a628d25be02d0c981ef9dd42d9f87764f42

Download Submit
\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\7.0.3\hostpolicy.dll

Filesize
323KB

MD5
acf423d85fa46acee241772dd6eaf11c

SHA1
bdb9f01b751e4d98877514de80ab619669d7bda6

SHA256
93de550b3519ea26128dc0f9ff7d76ac27ce02f8bc8f9a9643747188410014c4

SHA512
fec15a836966ea2d309adf14867274eb53c1a366820b442bae07013a0dc3440d56737419df028f36569c9a71043be18b7e50309b2b19ad7382aca0fa1ba55163

Download Submit
\Windows\Installer\MSI7E27.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
\Windows\Installer\MSI89B4.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
\Windows\Installer\MSI907E.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
\Windows\Installer\MSIC1A5.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
\Windows\Temp\{0CAC6E22-8534-4A93-B92E-2E6CAA7334A2}\.ba\wixstdba.dll

Filesize
197KB

MD5
4356ee50f0b1a878e270614780ddf095

SHA1
b5c0915f023b2e4ed3e122322abc40c4437909af

SHA256
41a8787fdc9467f563438daba4131191aa1eb588a81beb9a89fe8bd886c16104

SHA512
b9e482efe9189683dabfc9feff8b386d7eba4ecf070f42a1eebee6052cfb181a19497f831f1ea6429cfcce1d4865a5d279b24bd738d702902e9887bb9f0c4691

Download Submit
\Windows\Temp\{9A753F13-CD14-4E5B-8BA3-D345DFD737C5}\.ba\wixstdba.dll

Filesize
197KB

MD5
4356ee50f0b1a878e270614780ddf095

SHA1
b5c0915f023b2e4ed3e122322abc40c4437909af

SHA256
41a8787fdc9467f563438daba4131191aa1eb588a81beb9a89fe8bd886c16104

SHA512
b9e482efe9189683dabfc9feff8b386d7eba4ecf070f42a1eebee6052cfb181a19497f831f1ea6429cfcce1d4865a5d279b24bd738d702902e9887bb9f0c4691

Download Submit
memory/3732-309-0x0000016D6A030000-0x0000016D6A032000-memory.dmp

Filesize
8KB

Download
memory/3732-300-0x0000016D69DF0000-0x0000016D69DF2000-memory.dmp

Filesize
8KB

Download
memory/3732-576-0x0000016D538B0000-0x0000016D538C0000-memory.dmp

Filesize
64KB

Download
memory/3732-177-0x0000016D538A0000-0x0000016D538A2000-memory.dmp

Filesize
8KB

Download
memory/3732-437-0x0000016D69D20000-0x0000016D69D40000-memory.dmp

Filesize
128KB

Download
memory/3732-346-0x0000016D6AA60000-0x0000016D6AB60000-memory.dmp

Filesize
1024KB

Download
memory/3732-314-0x0000016D6A200000-0x0000016D6A202000-memory.dmp

Filesize
8KB

Download
memory/3732-312-0x0000016D6A050000-0x0000016D6A052000-memory.dmp

Filesize
8KB

Download
memory/3732-445-0x0000016D6BB60000-0x0000016D6BC60000-memory.dmp

Filesize
1024KB

Download
memory/3732-455-0x0000016D6C200000-0x0000016D6C300000-memory.dmp

Filesize
1024KB

Download
memory/3732-573-0x0000016D538B0000-0x0000016D538C0000-memory.dmp

Filesize
64KB

Download
memory/3732-545-0x0000016D6A670000-0x0000016D6A770000-memory.dmp

Filesize
1024KB

Download
memory/3732-307-0x0000016D6A020000-0x0000016D6A022000-memory.dmp

Filesize
8KB

Download
memory/3732-303-0x0000016D6A010000-0x0000016D6A012000-memory.dmp

Filesize
8KB

Download
memory/3732-547-0x0000016D6A670000-0x0000016D6A770000-memory.dmp

Filesize
1024KB

Download
memory/3732-567-0x0000016D538B0000-0x0000016D538C0000-memory.dmp

Filesize
64KB

Download
memory/3732-568-0x0000016D538B0000-0x0000016D538C0000-memory.dmp

Filesize
64KB

Download
memory/3732-180-0x0000016D538D0000-0x0000016D538D2000-memory.dmp

Filesize
8KB

Download
memory/3732-569-0x0000016D538B0000-0x0000016D538C0000-memory.dmp

Filesize
64KB

Download
memory/3732-294-0x0000016D69C50000-0x0000016D69C52000-memory.dmp

Filesize
8KB

Download
memory/3732-570-0x0000016D538B0000-0x0000016D538C0000-memory.dmp

Filesize
64KB

Download
memory/3732-571-0x0000016D538B0000-0x0000016D538C0000-memory.dmp

Filesize
64KB

Download
memory/3732-283-0x0000016D69AF0000-0x0000016D69AF2000-memory.dmp

Filesize
8KB

Download
memory/3732-182-0x0000016D538F0000-0x0000016D538F2000-memory.dmp

Filesize
8KB

Download
memory/3732-574-0x0000016D538B0000-0x0000016D538C0000-memory.dmp

Filesize
64KB

Download
memory/3732-572-0x0000016D538B0000-0x0000016D538C0000-memory.dmp

Filesize
64KB

Download
memory/4864-410-0x00000248A4830000-0x00000248A4831000-memory.dmp

Filesize
4KB

Download
memory/4864-120-0x000002489E120000-0x000002489E130000-memory.dmp

Filesize
64KB

Download
memory/4864-409-0x00000248A4820000-0x00000248A4821000-memory.dmp

Filesize
4KB

Download
memory/4864-162-0x00000248A3520000-0x00000248A3522000-memory.dmp

Filesize
8KB

Download
memory/4864-161-0x00000248A3300000-0x00000248A3302000-memory.dmp

Filesize
8KB

Download
memory/4864-159-0x000002489E9F0000-0x000002489E9F2000-memory.dmp

Filesize
8KB

Download
memory/4864-157-0x000002489E5E0000-0x000002489E5E1000-memory.dmp

Filesize
4KB

Download
memory/4864-138-0x000002489E700000-0x000002489E710000-memory.dmp

Filesize
64KB

Download