b5a90c0fd1f9d684635f2f09a30e7e62aa403b851ac50fc947238fb74c20f12d

Resubmissions

01/09/2023, 14:51

230901-r8bz7sfc3w 8

01/09/2023, 14:42

230901-r23jksfb9w 8

Analysis

max time kernel
137s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230831-en
resource tags

arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system
submitted
01/09/2023, 14:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Galaxy Swapper v2.exe
Size

6.1MB
MD5

30e6fd8874332f80242e16c676311df0
SHA1

b28467f3b2b0fa4ded5d3672ee4862c2b03fd042
SHA256

b5a90c0fd1f9d684635f2f09a30e7e62aa403b851ac50fc947238fb74c20f12d
SHA512

9a3c0aa44a6f0da9b95908b30849dfd9809ee7c6d4e997d06598fc8d1de0a13def96da83900bc752b4893dda2d7a8c3288808ca2de5754eff0e1a1839078fc7e
SSDEEP

49152:hEKwcVZQoIagloayZgloayUnyKZZTDty94p9vXOwF9z+my7iAU4jgxBBjHQtDjOw:bFVZQTnDty9692nertup2A

Score

8^/10

discovery persistence

Malware Config

Signatures

Downloads MZ/PE file

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2848203831-2014322062-3611574811-1000\Control Panel\International\Geo\Nation	windowsdesktop-runtime-7.0.10-win-x64.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2848203831-2014322062-3611574811-1000\Control Panel\International\Geo\Nation	Galaxy Swapper v2.exe

Executes dropped EXE 3 IoCs

pid	Process
2420	windowsdesktop-runtime-7.0.10-win-x64.exe
4376	windowsdesktop-runtime-7.0.10-win-x64.exe
3276	windowsdesktop-runtime-7.0.10-win-x64.exe

Loads dropped DLL 64 IoCs

pid	Process
4376	windowsdesktop-runtime-7.0.10-win-x64.exe
5012	MsiExec.exe
5012	MsiExec.exe
2196	MsiExec.exe
2196	MsiExec.exe
4840	MsiExec.exe
4840	MsiExec.exe
3028	MsiExec.exe
3028	MsiExec.exe
3152	Galaxy Swapper v2.exe
3152	Galaxy Swapper v2.exe
3152	Galaxy Swapper v2.exe
3152	Galaxy Swapper v2.exe
3152	Galaxy Swapper v2.exe
3152	Galaxy Swapper v2.exe
3152	Galaxy Swapper v2.exe
3152	Galaxy Swapper v2.exe
3152	Galaxy Swapper v2.exe
3152	Galaxy Swapper v2.exe
3152	Galaxy Swapper v2.exe
3152	Galaxy Swapper v2.exe
3152	Galaxy Swapper v2.exe
3152	Galaxy Swapper v2.exe
3152	Galaxy Swapper v2.exe
3152	Galaxy Swapper v2.exe
3152	Galaxy Swapper v2.exe
3152	Galaxy Swapper v2.exe
3152	Galaxy Swapper v2.exe
3152	Galaxy Swapper v2.exe
3152	Galaxy Swapper v2.exe
3152	Galaxy Swapper v2.exe
3152	Galaxy Swapper v2.exe
3152	Galaxy Swapper v2.exe
3152	Galaxy Swapper v2.exe
3152	Galaxy Swapper v2.exe
3152	Galaxy Swapper v2.exe
3152	Galaxy Swapper v2.exe
3152	Galaxy Swapper v2.exe
3152	Galaxy Swapper v2.exe
3152	Galaxy Swapper v2.exe
3152	Galaxy Swapper v2.exe
3152	Galaxy Swapper v2.exe
3152	Galaxy Swapper v2.exe
3152	Galaxy Swapper v2.exe
3152	Galaxy Swapper v2.exe
3152	Galaxy Swapper v2.exe
3152	Galaxy Swapper v2.exe
3152	Galaxy Swapper v2.exe
3152	Galaxy Swapper v2.exe
3152	Galaxy Swapper v2.exe
3152	Galaxy Swapper v2.exe
3152	Galaxy Swapper v2.exe
3152	Galaxy Swapper v2.exe
3152	Galaxy Swapper v2.exe
3152	Galaxy Swapper v2.exe
3152	Galaxy Swapper v2.exe
3152	Galaxy Swapper v2.exe
3152	Galaxy Swapper v2.exe
3152	Galaxy Swapper v2.exe
3152	Galaxy Swapper v2.exe
3152	Galaxy Swapper v2.exe
3152	Galaxy Swapper v2.exe
3152	Galaxy Swapper v2.exe
3152	Galaxy Swapper v2.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{749f7aca-89a5-4659-92a5-0449fc5fdd78} = "\"C:\\ProgramData\\Package Cache\\{749f7aca-89a5-4659-92a5-0449fc5fdd78}\\windowsdesktop-runtime-7.0.10-win-x64.exe\" /burn.runonce"	windowsdesktop-runtime-7.0.10-win-x64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.10\coreclr.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.10\pt-BR\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.10\pl\WindowsBase.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.10\zh-Hans\UIAutomationTypes.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.10\System.Threading.AccessControl.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.10\pt-BR\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\dotnet.exe	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.10\pl\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.10\System.Net.Http.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.10\System.IO.Compression.Native.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.10\System.Net.WebProxy.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.10\System.Security.Cryptography.OpenSsl.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.10\System.Threading.Tasks.Extensions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.10\zh-Hans\System.Windows.Forms.Primitives.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.10\Microsoft.VisualBasic.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.10\ko\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.10\System.Net.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.10\it\System.Windows.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.10\System.Private.Uri.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.10\System.Security.Principal.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.10\System.Design.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.10\ko\WindowsFormsIntegration.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.10\zh-Hans\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.10\pt-BR\System.Windows.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.10\Microsoft.VisualBasic.Forms.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.10\it\UIAutomationTypes.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.10\tr\System.Windows.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.10\Microsoft.NETCore.App.deps.json	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.10\System.AppContext.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.10\System.Net.ServicePoint.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.10\System.Security.Permissions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.10\cs\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.10\System.Text.RegularExpressions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.10\System.Resources.ResourceManager.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.10\System.Windows.Extensions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.10\de\ReachFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.10\System.Drawing.Common.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.10\ko\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.10\UIAutomationTypes.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.10\System.Diagnostics.Tools.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.10\ru\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.10\clrjit.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.10\System.Text.Encoding.CodePages.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.10\System.IO.UnmanagedMemoryStream.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.10\System.Diagnostics.DiagnosticSource.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.10\mscorlib.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.10\System.Security.Cryptography.X509Certificates.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.10\cs\WindowsFormsIntegration.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.10\zh-Hant\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.10\cs\ReachFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.10\System.Runtime.InteropServices.JavaScript.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.10\System.Resources.Reader.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.10\Microsoft.VisualBasic.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.10\ko\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.10\System.Net.Sockets.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.10\System.Globalization.Calendars.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.10\System.Formats.Asn1.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.10\System.ComponentModel.DataAnnotations.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.10\ja\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.10\it\System.Windows.Forms.Primitives.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.10\System.Web.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.10\System.Linq.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.10\ja\WindowsFormsIntegration.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.10\ru\WindowsFormsIntegration.resources.dll	msiexec.exe

Drops file in Windows directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEFCC.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFD98.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{454BEFFD-28B3-47C0-A7AF-E965B685D2FF}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1BD4.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3B4.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1655.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{8AE22909-0EDC-41D3-A522-602CA7DC3621}	msiexec.exe
File created	C:\Windows\Installer\e58ca0c.msi	msiexec.exe
File created	C:\Windows\Installer\e58ca10.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3B16.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{898266E3-A0E5-4BA3-AF3F-E3C5D626EABA}	msiexec.exe
File opened for modification	C:\Windows\Installer\e58ca0c.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID676.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e58ca11.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICF90.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA7C.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{86377F8B-E35E-4774-B156-35EA6776B231}	msiexec.exe
File created	C:\Windows\Installer\e58ca07.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e58ca02.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e58ca07.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI48.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICCF.tmp	msiexec.exe
File created	C:\Windows\Installer\e58ca02.msi	msiexec.exe
File created	C:\Windows\Installer\e58ca0b.msi	msiexec.exe
File created	C:\Windows\Installer\e58ca11.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI254B.tmp	msiexec.exe
File created	C:\Windows\Installer\e58ca15.msi	msiexec.exe
File created	C:\Windows\Installer\e58ca06.msi	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\21	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1F	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\20	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\21	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1E\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\20	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{749f7aca-89a5-4659-92a5-0449fc5fdd78}\Dependents\{749f7aca-89a5-4659-92a5-0449fc5fdd78}	windowsdesktop-runtime-7.0.10-win-x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\90922EA8CDE03D145A2206C27ACD6312\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E6628985E0A3AB4FAF33E5C6D62AEAB\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DFFEB4543B820C747AFA9E566B582DFF\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\90922EA8CDE03D145A2206C27ACD6312\Provider	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\DFFEB4543B820C747AFA9E566B582DFF\MainFeature	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_7.0_x64\Dependents	windowsdesktop-runtime-7.0.10-win-x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\90922EA8CDE03D145A2206C27ACD6312\Version = "942406812"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\90922EA8CDE03D145A2206C27ACD6312\SourceList\PackageName = "dotnet-runtime-7.0.10-win-x64.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\dotnet_runtime_56.43.64668_x64	windowsdesktop-runtime-7.0.10-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\1E44345F98C50385399EDA2A638439CA	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DFFEB4543B820C747AFA9E566B582DFF\Version = "942406812"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DFFEB4543B820C747AFA9E566B582DFF\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_56.43.64668_x64\ = "{8AE22909-0EDC-41D3-A522-602CA7DC3621}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\90922EA8CDE03D145A2206C27ACD6312\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E6628985E0A3AB4FAF33E5C6D62AEAB\SourceList\Media\1 = ";"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E6628985E0A3AB4FAF33E5C6D62AEAB\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_56.43.64722_x64\ = "{86377F8B-E35E-4774-B156-35EA6776B231}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\CA86F51EA0751C74D0D1FE10686E83D2\B8F77368E53E47741B6553AE76672B13	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\windowsdesktop_runtime_56.43.64722_x64	windowsdesktop-runtime-7.0.10-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_56.43.64668_x64\DisplayName = "Microsoft .NET Runtime - 7.0.10 (x64)"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\90922EA8CDE03D145A2206C27ACD6312	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\90922EA8CDE03D145A2206C27ACD6312\ProductName = "Microsoft .NET Runtime - 7.0.10 (x64)"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\90922EA8CDE03D145A2206C27ACD6312\DeploymentFlags = "3"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DFFEB4543B820C747AFA9E566B582DFF\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_56.43.64722_x64\Version = "56.43.64722"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B8F77368E53E47741B6553AE76672B13\Provider	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\1E44345F98C50385399EDA2A638439CA\3E6628985E0A3AB4FAF33E5C6D62AEAB	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DFFEB4543B820C747AFA9E566B582DFF\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{454BEFFD-28B3-47C0-A7AF-E965B685D2FF}v56.43.64668\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_7.0_x64\Dependents\{749f7aca-89a5-4659-92a5-0449fc5fdd78}	windowsdesktop-runtime-7.0.10-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\90922EA8CDE03D145A2206C27ACD6312	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3E6628985E0A3AB4FAF33E5C6D62AEAB	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E6628985E0A3AB4FAF33E5C6D62AEAB\Version = "942406812"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E6628985E0A3AB4FAF33E5C6D62AEAB\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_7.0_x64\Version = "56.43.64668"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B8F77368E53E47741B6553AE76672B13\Version = "942406866"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{749f7aca-89a5-4659-92a5-0449fc5fdd78}\ = "{749f7aca-89a5-4659-92a5-0449fc5fdd78}"	windowsdesktop-runtime-7.0.10-win-x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E6628985E0A3AB4FAF33E5C6D62AEAB\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_7.0_x64\DisplayName = "Microsoft .NET Host - 7.0.10 (x64)"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\90922EA8CDE03D145A2206C27ACD6312\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E6628985E0A3AB4FAF33E5C6D62AEAB\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\DFFEB4543B820C747AFA9E566B582DFF\Provider	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\4E3F426DBD05F2A509C6867B91443826\DFFEB4543B820C747AFA9E566B582DFF	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\90922EA8CDE03D145A2206C27ACD6312\PackageCode = "F2E640B4640E82C43AC19F09AB3A764F"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\31F2FEB3A105266457E59188F20AAF2E\90922EA8CDE03D145A2206C27ACD6312	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_56.43.64668_x64\Version = "56.43.64668"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_56.43.64668_x64\ = "{898266E3-A0E5-4BA3-AF3F-E3C5D626EABA}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E6628985E0A3AB4FAF33E5C6D62AEAB\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DFFEB4543B820C747AFA9E566B582DFF\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{454BEFFD-28B3-47C0-A7AF-E965B685D2FF}v56.43.64668\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B8F77368E53E47741B6553AE76672B13\MainFeature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B8F77368E53E47741B6553AE76672B13\PackageCode = "384C5BE76C1198C4198035C39B4E17E5"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B8F77368E53E47741B6553AE76672B13\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B8F77368E53E47741B6553AE76672B13\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\90922EA8CDE03D145A2206C27ACD6312\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_56.43.64668_x64\Dependents	windowsdesktop-runtime-7.0.10-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_56.43.64668_x64\Dependents\{749f7aca-89a5-4659-92a5-0449fc5fdd78}	windowsdesktop-runtime-7.0.10-win-x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DFFEB4543B820C747AFA9E566B582DFF\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_56.43.64722_x64\Dependents	windowsdesktop-runtime-7.0.10-win-x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\90922EA8CDE03D145A2206C27ACD6312\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\90922EA8CDE03D145A2206C27ACD6312\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3E6628985E0A3AB4FAF33E5C6D62AEAB\SourceList\PackageName = "dotnet-hostfxr-7.0.10-win-x64.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DFFEB4543B820C747AFA9E566B582DFF\PackageCode = "7C1157C7A8B96EE40A32F1122E01A0EF"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{749f7aca-89a5-4659-92a5-0449fc5fdd78}\DisplayName = "Microsoft Windows Desktop Runtime - 7.0.10 (x64)"	windowsdesktop-runtime-7.0.10-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DFFEB4543B820C747AFA9E566B582DFF\SourceList	msiexec.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 355204.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
4692	msedge.exe
4692	msedge.exe
3612	msedge.exe
3612	msedge.exe
1604	identity_helper.exe
1604	identity_helper.exe
4292	msedge.exe
4292	msedge.exe
1128	msiexec.exe
1128	msiexec.exe
1128	msiexec.exe
1128	msiexec.exe
1128	msiexec.exe
1128	msiexec.exe
1128	msiexec.exe
1128	msiexec.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3276	windowsdesktop-runtime-7.0.10-win-x64.exe
Token: SeIncreaseQuotaPrivilege	3276	windowsdesktop-runtime-7.0.10-win-x64.exe
Token: SeSecurityPrivilege	1128	msiexec.exe
Token: SeCreateTokenPrivilege	3276	windowsdesktop-runtime-7.0.10-win-x64.exe
Token: SeAssignPrimaryTokenPrivilege	3276	windowsdesktop-runtime-7.0.10-win-x64.exe
Token: SeLockMemoryPrivilege	3276	windowsdesktop-runtime-7.0.10-win-x64.exe
Token: SeIncreaseQuotaPrivilege	3276	windowsdesktop-runtime-7.0.10-win-x64.exe
Token: SeMachineAccountPrivilege	3276	windowsdesktop-runtime-7.0.10-win-x64.exe
Token: SeTcbPrivilege	3276	windowsdesktop-runtime-7.0.10-win-x64.exe
Token: SeSecurityPrivilege	3276	windowsdesktop-runtime-7.0.10-win-x64.exe
Token: SeTakeOwnershipPrivilege	3276	windowsdesktop-runtime-7.0.10-win-x64.exe
Token: SeLoadDriverPrivilege	3276	windowsdesktop-runtime-7.0.10-win-x64.exe
Token: SeSystemProfilePrivilege	3276	windowsdesktop-runtime-7.0.10-win-x64.exe
Token: SeSystemtimePrivilege	3276	windowsdesktop-runtime-7.0.10-win-x64.exe
Token: SeProfSingleProcessPrivilege	3276	windowsdesktop-runtime-7.0.10-win-x64.exe
Token: SeIncBasePriorityPrivilege	3276	windowsdesktop-runtime-7.0.10-win-x64.exe
Token: SeCreatePagefilePrivilege	3276	windowsdesktop-runtime-7.0.10-win-x64.exe
Token: SeCreatePermanentPrivilege	3276	windowsdesktop-runtime-7.0.10-win-x64.exe
Token: SeBackupPrivilege	3276	windowsdesktop-runtime-7.0.10-win-x64.exe
Token: SeRestorePrivilege	3276	windowsdesktop-runtime-7.0.10-win-x64.exe
Token: SeShutdownPrivilege	3276	windowsdesktop-runtime-7.0.10-win-x64.exe
Token: SeDebugPrivilege	3276	windowsdesktop-runtime-7.0.10-win-x64.exe
Token: SeAuditPrivilege	3276	windowsdesktop-runtime-7.0.10-win-x64.exe
Token: SeSystemEnvironmentPrivilege	3276	windowsdesktop-runtime-7.0.10-win-x64.exe
Token: SeChangeNotifyPrivilege	3276	windowsdesktop-runtime-7.0.10-win-x64.exe
Token: SeRemoteShutdownPrivilege	3276	windowsdesktop-runtime-7.0.10-win-x64.exe
Token: SeUndockPrivilege	3276	windowsdesktop-runtime-7.0.10-win-x64.exe
Token: SeSyncAgentPrivilege	3276	windowsdesktop-runtime-7.0.10-win-x64.exe
Token: SeEnableDelegationPrivilege	3276	windowsdesktop-runtime-7.0.10-win-x64.exe
Token: SeManageVolumePrivilege	3276	windowsdesktop-runtime-7.0.10-win-x64.exe
Token: SeImpersonatePrivilege	3276	windowsdesktop-runtime-7.0.10-win-x64.exe
Token: SeCreateGlobalPrivilege	3276	windowsdesktop-runtime-7.0.10-win-x64.exe
Token: SeRestorePrivilege	1128	msiexec.exe
Token: SeTakeOwnershipPrivilege	1128	msiexec.exe
Token: SeRestorePrivilege	1128	msiexec.exe
Token: SeTakeOwnershipPrivilege	1128	msiexec.exe
Token: SeRestorePrivilege	1128	msiexec.exe
Token: SeTakeOwnershipPrivilege	1128	msiexec.exe
Token: SeRestorePrivilege	1128	msiexec.exe
Token: SeTakeOwnershipPrivilege	1128	msiexec.exe
Token: SeRestorePrivilege	1128	msiexec.exe
Token: SeTakeOwnershipPrivilege	1128	msiexec.exe
Token: SeRestorePrivilege	1128	msiexec.exe
Token: SeTakeOwnershipPrivilege	1128	msiexec.exe
Token: SeRestorePrivilege	1128	msiexec.exe
Token: SeTakeOwnershipPrivilege	1128	msiexec.exe
Token: SeRestorePrivilege	1128	msiexec.exe
Token: SeTakeOwnershipPrivilege	1128	msiexec.exe
Token: SeRestorePrivilege	1128	msiexec.exe
Token: SeTakeOwnershipPrivilege	1128	msiexec.exe
Token: SeRestorePrivilege	1128	msiexec.exe
Token: SeTakeOwnershipPrivilege	1128	msiexec.exe
Token: SeRestorePrivilege	1128	msiexec.exe
Token: SeTakeOwnershipPrivilege	1128	msiexec.exe
Token: SeRestorePrivilege	1128	msiexec.exe
Token: SeTakeOwnershipPrivilege	1128	msiexec.exe
Token: SeRestorePrivilege	1128	msiexec.exe
Token: SeTakeOwnershipPrivilege	1128	msiexec.exe
Token: SeRestorePrivilege	1128	msiexec.exe
Token: SeTakeOwnershipPrivilege	1128	msiexec.exe
Token: SeRestorePrivilege	1128	msiexec.exe
Token: SeTakeOwnershipPrivilege	1128	msiexec.exe
Token: SeRestorePrivilege	1128	msiexec.exe
Token: SeTakeOwnershipPrivilege	1128	msiexec.exe

Suspicious use of FindShellTrayWindow 63 IoCs

pid	Process
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
4376	windowsdesktop-runtime-7.0.10-win-x64.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3668 wrote to memory of 3612	3668	Galaxy Swapper v2.exe	83
PID 3668 wrote to memory of 3612	3668	Galaxy Swapper v2.exe	83
PID 3612 wrote to memory of 2864	3612	msedge.exe	84
PID 3612 wrote to memory of 2864	3612	msedge.exe	84
PID 3612 wrote to memory of 4172	3612	msedge.exe	85
PID 3612 wrote to memory of 4172	3612	msedge.exe	85
PID 3612 wrote to memory of 4172	3612	msedge.exe	85
PID 3612 wrote to memory of 4172	3612	msedge.exe	85
PID 3612 wrote to memory of 4172	3612	msedge.exe	85
PID 3612 wrote to memory of 4172	3612	msedge.exe	85
PID 3612 wrote to memory of 4172	3612	msedge.exe	85
PID 3612 wrote to memory of 4172	3612	msedge.exe	85
PID 3612 wrote to memory of 4172	3612	msedge.exe	85
PID 3612 wrote to memory of 4172	3612	msedge.exe	85
PID 3612 wrote to memory of 4172	3612	msedge.exe	85
PID 3612 wrote to memory of 4172	3612	msedge.exe	85
PID 3612 wrote to memory of 4172	3612	msedge.exe	85
PID 3612 wrote to memory of 4172	3612	msedge.exe	85
PID 3612 wrote to memory of 4172	3612	msedge.exe	85
PID 3612 wrote to memory of 4172	3612	msedge.exe	85
PID 3612 wrote to memory of 4172	3612	msedge.exe	85
PID 3612 wrote to memory of 4172	3612	msedge.exe	85
PID 3612 wrote to memory of 4172	3612	msedge.exe	85
PID 3612 wrote to memory of 4172	3612	msedge.exe	85
PID 3612 wrote to memory of 4172	3612	msedge.exe	85
PID 3612 wrote to memory of 4172	3612	msedge.exe	85
PID 3612 wrote to memory of 4172	3612	msedge.exe	85
PID 3612 wrote to memory of 4172	3612	msedge.exe	85
PID 3612 wrote to memory of 4172	3612	msedge.exe	85
PID 3612 wrote to memory of 4172	3612	msedge.exe	85
PID 3612 wrote to memory of 4172	3612	msedge.exe	85
PID 3612 wrote to memory of 4172	3612	msedge.exe	85
PID 3612 wrote to memory of 4172	3612	msedge.exe	85
PID 3612 wrote to memory of 4172	3612	msedge.exe	85
PID 3612 wrote to memory of 4172	3612	msedge.exe	85
PID 3612 wrote to memory of 4172	3612	msedge.exe	85
PID 3612 wrote to memory of 4172	3612	msedge.exe	85
PID 3612 wrote to memory of 4172	3612	msedge.exe	85
PID 3612 wrote to memory of 4172	3612	msedge.exe	85
PID 3612 wrote to memory of 4172	3612	msedge.exe	85
PID 3612 wrote to memory of 4172	3612	msedge.exe	85
PID 3612 wrote to memory of 4172	3612	msedge.exe	85
PID 3612 wrote to memory of 4172	3612	msedge.exe	85
PID 3612 wrote to memory of 4172	3612	msedge.exe	85
PID 3612 wrote to memory of 4692	3612	msedge.exe	86
PID 3612 wrote to memory of 4692	3612	msedge.exe	86
PID 3612 wrote to memory of 1844	3612	msedge.exe	87
PID 3612 wrote to memory of 1844	3612	msedge.exe	87
PID 3612 wrote to memory of 1844	3612	msedge.exe	87
PID 3612 wrote to memory of 1844	3612	msedge.exe	87
PID 3612 wrote to memory of 1844	3612	msedge.exe	87
PID 3612 wrote to memory of 1844	3612	msedge.exe	87
PID 3612 wrote to memory of 1844	3612	msedge.exe	87
PID 3612 wrote to memory of 1844	3612	msedge.exe	87
PID 3612 wrote to memory of 1844	3612	msedge.exe	87
PID 3612 wrote to memory of 1844	3612	msedge.exe	87
PID 3612 wrote to memory of 1844	3612	msedge.exe	87
PID 3612 wrote to memory of 1844	3612	msedge.exe	87
PID 3612 wrote to memory of 1844	3612	msedge.exe	87
PID 3612 wrote to memory of 1844	3612	msedge.exe	87
PID 3612 wrote to memory of 1844	3612	msedge.exe	87
PID 3612 wrote to memory of 1844	3612	msedge.exe	87
PID 3612 wrote to memory of 1844	3612	msedge.exe	87
PID 3612 wrote to memory of 1844	3612	msedge.exe	87

C:\Users\Admin\AppData\Local\Temp\Galaxy Swapper v2.exe
"C:\Users\Admin\AppData\Local\Temp\Galaxy Swapper v2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?missing_runtime=true&arch=x64&rid=win10-x64&apphost_version=7.0.9&gui=true
  2⤵
  - Enumerates system info in registry
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa06e546f8,0x7ffa06e54708,0x7ffa06e54718
    3⤵
    PID:2864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,8574428112785859188,15126119785177958928,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
    3⤵
    PID:4172
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,8574428112785859188,15126119785177958928,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2164,8574428112785859188,15126119785177958928,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2916 /prefetch:8
    3⤵
    PID:1844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,8574428112785859188,15126119785177958928,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
    3⤵
    PID:2928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,8574428112785859188,15126119785177958928,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
    3⤵
    PID:712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,8574428112785859188,15126119785177958928,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4552 /prefetch:1
    3⤵
    PID:4228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,8574428112785859188,15126119785177958928,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4604 /prefetch:1
    3⤵
    PID:4844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2164,8574428112785859188,15126119785177958928,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5260 /prefetch:8
    3⤵
    PID:3544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,8574428112785859188,15126119785177958928,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:1
    3⤵
    PID:3352
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2164,8574428112785859188,15126119785177958928,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5976 /prefetch:8
    3⤵
    PID:2244
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,8574428112785859188,15126119785177958928,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6428 /prefetch:8
    3⤵
    PID:3912
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,8574428112785859188,15126119785177958928,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6428 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1604
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,8574428112785859188,15126119785177958928,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6000 /prefetch:1
    3⤵
    PID:3700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,8574428112785859188,15126119785177958928,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6016 /prefetch:1
    3⤵
    PID:1716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,8574428112785859188,15126119785177958928,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6680 /prefetch:1
    3⤵
    PID:4684
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,8574428112785859188,15126119785177958928,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6200 /prefetch:1
    3⤵
    PID:1336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,8574428112785859188,15126119785177958928,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6052 /prefetch:1
    3⤵
    PID:3820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2164,8574428112785859188,15126119785177958928,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7032 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4292
- - C:\Users\Admin\Downloads\windowsdesktop-runtime-7.0.10-win-x64.exe
    "C:\Users\Admin\Downloads\windowsdesktop-runtime-7.0.10-win-x64.exe"
    3⤵
    - Executes dropped EXE
    PID:2420
  - - C:\Windows\Temp\{1BDF6EE9-CE38-4AB7-8C1D-48ECAEE02A37}\.cr\windowsdesktop-runtime-7.0.10-win-x64.exe
      "C:\Windows\Temp\{1BDF6EE9-CE38-4AB7-8C1D-48ECAEE02A37}\.cr\windowsdesktop-runtime-7.0.10-win-x64.exe" -burn.clean.room="C:\Users\Admin\Downloads\windowsdesktop-runtime-7.0.10-win-x64.exe" -burn.filehandle.attached=572 -burn.filehandle.self=584
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of FindShellTrayWindow
      PID:4376
    - - C:\Windows\Temp\{897226A9-B438-4139-A151-1B322B53F8CC}\.be\windowsdesktop-runtime-7.0.10-win-x64.exe
        
        "C:\Windows\Temp\{897226A9-B438-4139-A151-1B322B53F8CC}\.be\windowsdesktop-runtime-7.0.10-win-x64.exe" -q -burn.elevated BurnPipe.{0F671DFB-3A2D-40D0-8056-08900FA437BA} {CDD233FB-4EE2-4937-9E82-5821DDCFEE04} 4376
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:3276

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:440

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4880

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2212

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1128
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding FA8F5FBC94126828A0CE8498806A3A73
  2⤵
  - Loads dropped DLL
  PID:5012
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding FAEDED6BCFF6E63B646D49F6211BD663
  2⤵
  - Loads dropped DLL
  PID:2196
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding F388ADED50AAE8DC2BE04D4E1D696D2D
  2⤵
  - Loads dropped DLL
  PID:4840
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 859FDEA34CFB35859373E5FE8E6D659F
  2⤵
  - Loads dropped DLL
  PID:3028

C:\Users\Admin\AppData\Local\Temp\Galaxy Swapper v2.exe
"C:\Users\Admin\AppData\Local\Temp\Galaxy Swapper v2.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
PID:3152
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C start https://galaxyswapperv2.com/Downloads/Key.php
  2⤵
  PID:1324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://galaxyswapperv2.com/Downloads/Key.php
    3⤵
    PID:4508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffa06e546f8,0x7ffa06e54708,0x7ffa06e54718
      4⤵
      PID:908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,7669976127609044039,3953945514523270810,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
      4⤵
      PID:3108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,7669976127609044039,3953945514523270810,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2356 /prefetch:3
      4⤵
      PID:2704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,7669976127609044039,3953945514523270810,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2896 /prefetch:8
      4⤵
      PID:1260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,7669976127609044039,3953945514523270810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
      4⤵
      PID:1960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,7669976127609044039,3953945514523270810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:1
      4⤵
      PID:4084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2140,7669976127609044039,3953945514523270810,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=2360 /prefetch:8
      4⤵
      PID:1312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,7669976127609044039,3953945514523270810,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5204 /prefetch:8
      4⤵
      PID:2460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,7669976127609044039,3953945514523270810,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5204 /prefetch:8
      4⤵
      PID:712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,7669976127609044039,3953945514523270810,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:1
      4⤵
      PID:532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,7669976127609044039,3953945514523270810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1
      4⤵
      PID:3984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,7669976127609044039,3953945514523270810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:1
      4⤵
      PID:3156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,7669976127609044039,3953945514523270810,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4044 /prefetch:1
      4⤵
      PID:4600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,7669976127609044039,3953945514523270810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4056 /prefetch:1
      4⤵
      PID:1088

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3652

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:116

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x50c 0x244
1⤵
PID:3672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e58ca05.rbs

Filesize
47KB

MD5
23869db4e2b8808e0ead4e65250096a4

SHA1
808b32d8f2b2f8b34e898db2c0c94de399d689a8

SHA256
332dec4c50f045fc783ec97b5a72b3977c2129e859125ba7c5f5adad5e9d399c

SHA512
07275f925b71dfa9e79f64a2fdce308d8c0de54021057a26f1a5967aac9676816a1c8616e6e7f618dfa92c20aac285f68052fe6dd325408f61ef34425ebe50d0

Download Submit
C:\Config.Msi\e58ca0a.rbs

Filesize
8KB

MD5
2afc8c0f9e44d7975438573c27ef5e1b

SHA1
375dd4c741184cbc1b4e8a684c2207350d80bfce

SHA256
ef20d69d221d412c1646cb0073e3cd9835728d3dca4074d70fa4e0dde94cfa36

SHA512
967ec8a01743a7939389bdf23a8ca74a48d863af2960ddba731bb1be593dc4d3a88585afd5d96b58b62b2d90527db361340898f2ee87b32dadf76210296740b1

Download Submit
C:\Config.Msi\e58ca0f.rbs

Filesize
10KB

MD5
4accd8806855aa38cbcc345abd117944

SHA1
561338c4d77b9855c36c5a2330d33a5746c1d10f

SHA256
7767049081edc57ec5915b416cf7afb575832df084488baa170bde581a28c532

SHA512
469acb821d0706c5b423a69288bc7081900426e189d23c7b3a5f2fe2361986649e609a8ecfcd01b16cd83f357e53e70a9c151a9dcbb288e392b95f3c382b23c2

Download Submit
C:\Config.Msi\e58ca14.rbs

Filesize
87KB

MD5
e378dda2a845b3ecb5289565c4a88fa8

SHA1
260933fc0bb9fc946985306a3e09d8d87e39e24c

SHA256
f08e20f82871a899be8764a13556a743da2303d20ad0d6e86334919813849c2d

SHA512
da40b1a0c342f20ed0a164fa6eef3fbc0be858fefeb93cbf42c33ad990e222d739ad5c4e81442a0ee1489b41b7afd81a598e91c734c822c4d89492dfa737b6a5

Download Submit
C:\Program Files\dotnet\LICENSE.txt

Filesize
9KB

MD5
31c5a77b3c57c8c2e82b9541b00bcd5a

SHA1
153d4bc14e3a2c1485006f1752e797ca8684d06d

SHA256
7f6839a61ce892b79c6549e2dc5a81fdbd240a0b260f8881216b45b7fda8b45d

SHA512
ad33e3c0c3b060ad44c5b1b712c991b2d7042f6a60dc691c014d977c922a7e3a783ba9bade1a34de853c271fde1fb75bc2c47869acd863a40be3a6c6d754c0a6

Download Submit
C:\Program Files\dotnet\ThirdPartyNotices.txt

Filesize
85KB

MD5
481ad608d2c3b3a5a0a3a529f2b2569e

SHA1
e271613b837d2cda290808af2bbd104a8c104a10

SHA256
29aec309fa6f036be931222385612088a3d98aa07ac2356243028a3072d0ce86

SHA512
93dde6782e14ac259b8655a89b31f7efe6990f27bc560f90200f3c967645d20fc54510e8fb0346732ea54707728a7075c9b566a936e76586c50681de65c83afb

Download Submit
C:\Program Files\dotnet\host\fxr\7.0.10\hostfxr.dll

Filesize
376KB

MD5
e189d28e7531dcf87f89db07296fe054

SHA1
62579b985072cf1c486ffbcfff583fac678fb63d

SHA256
2174dbb389315f82d58b4344d2498852bb62f1aecc13c3205fa774e5c2bb9a02

SHA512
e67a999f8fdef53e76788d5618ba52b6820104ff02a6c3ce2ea41eccc2d4b30e8a8911ed76638c9ee40446fc6d11a5ae0aa576bf17d454b811778f2873bb5aa0

Download Submit
C:\Program Files\dotnet\host\fxr\7.0.10\hostfxr.dll

Filesize
376KB

MD5
e189d28e7531dcf87f89db07296fe054

SHA1
62579b985072cf1c486ffbcfff583fac678fb63d

SHA256
2174dbb389315f82d58b4344d2498852bb62f1aecc13c3205fa774e5c2bb9a02

SHA512
e67a999f8fdef53e76788d5618ba52b6820104ff02a6c3ce2ea41eccc2d4b30e8a8911ed76638c9ee40446fc6d11a5ae0aa576bf17d454b811778f2873bb5aa0

Download Submit
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.10\Microsoft.NETCore.App.deps.json

Filesize
28KB

MD5
8f75deb343b7697685df5e7c3957b0e0

SHA1
8985dab119c8a337567b85bb8e231b244cb6032f

SHA256
c6baa8088c81d56dc5097422d3659812d58ec274085c0e8a66c9838b874221d9

SHA512
5f0287c15e19fc048c9f1adc79e6aca5d5ff4c43cf2687fda4a22808683db38ed9f5ce62f2cdc6924fedd67139c4a931f719a6f9f6861674b63c511aef03aa63

Download Submit
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.10\Microsoft.NETCore.App.runtimeconfig.json

Filesize
159B

MD5
01da0d56ab33c0ed0e7ac85e5244190f

SHA1
9e1e4b59e590038f769e5fa01fb326109a7f38e5

SHA256
7133274dc5efab688a6efe2f43ca33e78a2498ef39efcad231b0e07ad2c26d17

SHA512
e11967ba33c719da1681a7f98056d40f450788d9b7c8b2f580d8bc7998fc35a78c53fc970301b097c527fab79fd477adad4eafcd75b4bb376d33c3fece9e8926

Download Submit
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.10\System.Private.CoreLib.dll

Filesize
11.1MB

MD5
5140994665a3b2e43c2f9e945ffcdfd6

SHA1
37f7a55499966fc26bc981303f73b6c22be4077f

SHA256
499b4611059887cd4c9d3bd706d3c7164183b446faa09968220e2cf6cc1d0d16

SHA512
14e32d4b43153eb34dfa944fd5eb6daabfa21b26bed6303b35dc387935516afbed9d9955ed8438f3acd3a21e71b113dcd62e88211770573de6cd026848335fe3

Download Submit
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.10\System.Private.CoreLib.dll

Filesize
11.1MB

MD5
5140994665a3b2e43c2f9e945ffcdfd6

SHA1
37f7a55499966fc26bc981303f73b6c22be4077f

SHA256
499b4611059887cd4c9d3bd706d3c7164183b446faa09968220e2cf6cc1d0d16

SHA512
14e32d4b43153eb34dfa944fd5eb6daabfa21b26bed6303b35dc387935516afbed9d9955ed8438f3acd3a21e71b113dcd62e88211770573de6cd026848335fe3

Download Submit
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.10\clrjit.dll

Filesize
1.5MB

MD5
732657670cf7c061072e9240a6fc0731

SHA1
d6f3f2af0b56b19d0d7715aaf50209e02536c502

SHA256
471cdae1ee0560b89c831b939fbc328972c30c7934790bd463368ce98aa4dd0e

SHA512
d49328a7d0dbff11ec7a48ad88e51ff45c9d19b0d83ae9dc0557b293caca3488b109b6055d396ae0f07567bb524ce9a1e39c1205b3cb7736ac8f61ddecd11528

Download Submit
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.10\clrjit.dll

Filesize
1.5MB

MD5
732657670cf7c061072e9240a6fc0731

SHA1
d6f3f2af0b56b19d0d7715aaf50209e02536c502

SHA256
471cdae1ee0560b89c831b939fbc328972c30c7934790bd463368ce98aa4dd0e

SHA512
d49328a7d0dbff11ec7a48ad88e51ff45c9d19b0d83ae9dc0557b293caca3488b109b6055d396ae0f07567bb524ce9a1e39c1205b3cb7736ac8f61ddecd11528

Download Submit
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.10\coreclr.dll

Filesize
4.9MB

MD5
e6e1cf4e5ab2bf6fae04fc23d6e4936c

SHA1
8628914c44e3d75d8f3a14d31039f083a27cb2dc

SHA256
156f788281f8e74bcbcb1aa11289df637c4dfa4b4e8e037766b8af47462c36e5

SHA512
0ffdb60b51c199cd9ca117942047c66245f8d44a167505dfd4571549d5fab9bbe0687f4c7c78851d4225315a21730fa1ddb213a5d08b827c002330f66057d970

Download Submit
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.10\coreclr.dll

Filesize
4.9MB

MD5
e6e1cf4e5ab2bf6fae04fc23d6e4936c

SHA1
8628914c44e3d75d8f3a14d31039f083a27cb2dc

SHA256
156f788281f8e74bcbcb1aa11289df637c4dfa4b4e8e037766b8af47462c36e5

SHA512
0ffdb60b51c199cd9ca117942047c66245f8d44a167505dfd4571549d5fab9bbe0687f4c7c78851d4225315a21730fa1ddb213a5d08b827c002330f66057d970

Download Submit
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.10\hostpolicy.dll

Filesize
385KB

MD5
bc868f56552a4619e3894d201f1795cc

SHA1
84521c1099b28de8a470728a4708ee2dadf0f403

SHA256
0478b74cd29fc2950722a4665b60f3408e5a571a10da364eb975b1620570d745

SHA512
71f3144f3188783e1d762f662805b85bac2ace6dc4b3b0d461c5b718baecc6c1a43e3d951435815e3b4d2b8185663a5ec27be3a6589db1e070a3cd75c9fcd8d5

Download Submit
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.10\hostpolicy.dll

Filesize
385KB

MD5
bc868f56552a4619e3894d201f1795cc

SHA1
84521c1099b28de8a470728a4708ee2dadf0f403

SHA256
0478b74cd29fc2950722a4665b60f3408e5a571a10da364eb975b1620570d745

SHA512
71f3144f3188783e1d762f662805b85bac2ace6dc4b3b0d461c5b718baecc6c1a43e3d951435815e3b4d2b8185663a5ec27be3a6589db1e070a3cd75c9fcd8d5

Download Submit
C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.10\Microsoft.WindowsDesktop.App.deps.json

Filesize
30KB

MD5
ee595fab7a1aee817b656b7f836b2816

SHA1
0212739524f03275c12c61aaab1e4f7d82cec3f3

SHA256
b3ae4750069c500d9b71648df4e11c39493bcec4059618fef237ee2a264ab8d6

SHA512
ab92d2294b303ae639b0a1ba63e0a159c50c5ca0d22cb8caca2a53c25ae9009c8ec238e03361677b581536cfa4174033057ad6c2793c9d3dd412021a9dcaf564

Download Submit
C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.10\Microsoft.WindowsDesktop.App.runtimeconfig.json

Filesize
289B

MD5
53b6bafd989101f77046d0fa461d62ae

SHA1
5c3c0ecd52120742699dd68bf3ea639bedde6be3

SHA256
dcafc3f8553bd4b868045d1ae6a6086906b92a623a231a2748a7b23bdea0aee6

SHA512
c9187f1e546293272c2ec95543a8cd07d6d690e989e53603e6577bed63c365c66d9190dc01fd84f8a06f123ea33203c3f3ab6b61e5ad5b3054c6d90a35b59c9a

Download Submit
C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.10\PresentationFramework.dll

Filesize
15.5MB

MD5
5b026b90891768a088d9ce2c9eec10bc

SHA1
2c7a7e31d1cd9e2435c39447eedfd35e85558019

SHA256
1c4cc818776d7de9a2d9afc60e708d8d823f74dc37009c1ec1c059ef28d4d031

SHA512
47228143266442daa94075466b7721e8948561b59cf298eb7eb49463671cb24d9003ca98721a2a3abf24ba570d1060232e728a148acaa188e7001835edc8c259

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
db7211e1642aac2373b0e3d404468237

SHA1
dba4700b33b269ef98e5bf97171033c728b720dd

SHA256
f695b247235a6cbad1d888558911a1e6b485367b6ad27748a8634dd5f124c5ab

SHA512
4f4f8c4eb0b5b79bc731063c9bf054f68f429052ca8ae8d4fdb19e0c1060f9e47e949ccacf854ab8ca295f250ecc915609d3a7ceaf02d4ccc77e844f559d3a5e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
055ad4a4c912cbb380e14540bee96885

SHA1
8f4ed47a025b6d211be39def324e4b8b4063992f

SHA256
3c315d65856aed99eba8cca018c681d1d6042ec0fcefd80fa9d649b620d52c43

SHA512
c055a10d0433495d3f10deeddc88521bd9194add259571e67e668b43a69ab0cd2ef17fe6423c8b6adda2f9e1c757df0c26161b3d871137bfd9e9134abd36efb8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
184c5c7572a6b42b329aae4e94e9b801

SHA1
adc61339fa23296b5271ac2b7e0de1d7390c4e12

SHA256
ce44f115c3b1677a95d69195266225da59f4dd8cd9d57fd713df35b91cc564b1

SHA512
692f524f7b95da9ef6e247772dc5e949fa3aa34a61675fa5c59698583c1708f0aecf454a06f8deb8bdd7690fce5bc9c76bd2a544ea6354fda15a924480eee820

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
336B

MD5
302577b7aa944b6384502e7a2d56efc8

SHA1
6cdb75a0515f504492ddbee1da28447bb9f267ac

SHA256
e8baa4e6cf8065701af6426102ecd28dc5616d62c9e9b13d85bfd75f4defcf3a

SHA512
8eed7bad978f025fc0e76f25c5edcc735d0911bec24bff08f64ad381356ad33d338b03172e806ed7cf1b0a73eca44da6dc6a8bcf858f1d6da69d0bbcdc590788

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
902B

MD5
561ed91d056157110ca245c9b2a5810a

SHA1
2dc3c7a9282d74a39d69d583b1e275d8f2f10557

SHA256
92f13fd59e906b572f72fa56ff7a8c294d664bd0aa3c5f18557f309a7b73beaa

SHA512
43066b73624c358810e1ec83c472dd9193e15447dae7e9f4dd41d11d141f11e142d21ac9daf1327879a6f2b1dad7e4e6dfc625f8114baede2cd48c17788514d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7a30b6f7e03f05f36014cda1d4f3539a

SHA1
0eb9d95fe141f34c16d10ad3955f84c7c1a0b02c

SHA256
97eb6bba614c1b0ceec408015265a30bfd480852125c69c33b37b83724d91718

SHA512
870e789cb8dbaca81cd3a0bf66ca8608703b8621442ee094fcab67198d9d3b2abc220d85aca470e91bfa0a720e275966bfcce467ef8561309da4a0ce45fc9b87

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3d94741aeb79aa49a840106ffc027953

SHA1
379973a9c4f9b60106fc8d17483b62ba5adf412e

SHA256
a37968f3b068137c2e75ada94d9611b75154b957ff4d8082cb03cd012cc936f1

SHA512
391b4c3e22769454c49edb3568da4031d83353454c2d5e6b0c90cc4c692edfa26f0105e21ce20d451ef0ecab288f3c5bb9af5ca069ced1c66b4628184341bb02

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
03f8d75466592772fde4273ea2e0d211

SHA1
01473cef320745022bb051e0fe1248263a37c14d

SHA256
d3b992c24c91aa1144bfc8d253414dabae03b0e04ae40bf043302fa60576eb6d

SHA512
8e2bf1465e1f01dba5b6e102847570b62aebd31bd0ff6d64f1d6d294e6088a6daaa257a821afe6d2145ba10880550d8b09a9f85865877bd127cb04a45bca4600

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
eef2080f5d214397043726030c3867e1

SHA1
102398046738f96df2f48a0a467cd966cc633c39

SHA256
da4ad2a25858526c2532eaa2ffa3f278577ff35e85383404e4e2a6fb144f15ea

SHA512
ea30589ccb516b5931a29d88c38fa74c45339a7914da2034ff76b7e850c456931faaebf9720c9498af3a7d0dc78288547d474f105a8b0093cb7727981146cd28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
2236cc12bac28f32727898f8e798ea71

SHA1
60b010388e64c9c6b7278329c25ef18895c2e4ce

SHA256
fb27de22688cf0240d03864dcf317d31701e0f0da97f5bbe6e545030f5830d77

SHA512
df522872bcf008bd11e85c5155ead36c0bd2e33a0d44bf3c2ac7f52e6e0df3dcc3067165869509a1ac7167919509672fe7c961619a9f833e8a92a59de456ced6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
aefd77f47fb84fae5ea194496b44c67a

SHA1
dcfbb6a5b8d05662c4858664f81693bb7f803b82

SHA256
4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

SHA512
b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
40d971a5f4ebfa65c4a81c1047f97f7c

SHA1
370bd0487d4ee3fd07a4e8567a1dff297a78ef19

SHA256
3c283896c9418f8e22f1cdb4487172628053f34a0b327973fcf5662c1c142bcf

SHA512
02ab551cca105f1c08fb3f271bab37bffb28d9c1b7fb93354c457c4219f8ae20633c9c9c4be1ee341b836dd2fa2fb3254ef651ccd21ae3b05b768650517873ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
5dbb2b3d80f44532c331796e0e463cc8

SHA1
b587936007ac0c0d5a764375cc67f7e075111cb2

SHA256
12926f274bf232972432731d5b606c6076be53b73d2868f335c62cc3d3ed5663

SHA512
d1668df1496a073498b7f088262418d1cf0e67a91a649f17d89535954e186ad30459c357e8b1322f7b633c5f9fd644d229a0af8b0e5a40874b86a9af28676815

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b5a4cff7c3bc8bf135b53d7a89124904

SHA1
3e2ee9c8a1314024e63639a6a957348a0fd95332

SHA256
676d7d5ca3677be6b1f3cb47b89ce40b5521144aeca16530fa1d022e8114edb0

SHA512
fc2ceb7ac98a49f5010f8437616994f458285b38ea9aa239dc0b80e12ddbd4637624b72de9f045a5c182c624ad5c397136d42de49db8d9b5abf3ec9806d42cb9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f8e13cbc6757149b9627ab6ab6157929

SHA1
cf1e22e1d8d06e68b8e863e18325ef5869f1a04f

SHA256
f8e6515e05d5115bbc775aaf93ef2750a8fa7ec120891ea112cc853b7686eaf2

SHA512
c0005d9f2a01bab5db84ea98a3fcebe0a08d236022bb640a8ec82f87a1958a5d07afe47d22a16da9c0bc5e77fb833d99e694e879311fddd3b959db9709d89cdc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7cb0ca3a85bd2778cdc32ad76b167a70

SHA1
5788b8b5f0357b6c87fe144ba845251da0a4606f

SHA256
8095e8ef295a11fa8b5a9afea0757926446da44e223264246e8a388da1b850eb

SHA512
952d610e43232a6117e597fe084e9a675c35ca8bbf98e85823c5feb7655f0101c9ada0b28f1202cff9242ddb61b3b86c639e0ea85b9f53bef52d409f1cbc4ac0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_7.0.10_(x64)_20230901144326_000_dotnet_runtime_7.0.10_win_x64.msi.log

Filesize
2KB

MD5
f53cf793b59f086082ba13420440a31c

SHA1
f2e8ddbe007755150ffc1428de653c9a4109532f

SHA256
73631a25eec378f80e3b83671f0187c14025ea0b7b48498a89ad5cff945c284e

SHA512
51f81e1ec929e4b8ee32c136d33fffbcc4cbcf6305550bf4042226c0709ac55d01df1e12f51fa810aae0dee9673ad8988dc624affe229cc2a2a286a9315c8e08

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_7.0.10_(x64)_20230901144326_001_dotnet_hostfxr_7.0.10_win_x64.msi.log

Filesize
2KB

MD5
fc863857c58231d164cd94b5aa6b3d48

SHA1
edf6877c0e03efdc5561545d65051aa23df319a3

SHA256
1e5c4204d4a4574d56bf7db6ac831b0e684f4a0fe9fe56379b5eed981cb99302

SHA512
b6f52edeb166acb84b42c880762a83106de84bc8a3675c5dc6db201334c8142aaa0af8731ba4151850e818081d226bb8b16dcbf404f8b5cf028cd6b5b905444f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_7.0.10_(x64)_20230901144326_002_dotnet_host_7.0.10_win_x64.msi.log

Filesize
2KB

MD5
9c0be80c62517a419c30204e00ed71e1

SHA1
7177dedcf882d0ced3720c9b9023b6ef544973c4

SHA256
0567f32e94209d52c5d651dbc58395b6213ed58ba27cb504db2161f50eb994ab

SHA512
ade9a0d6c6f8be7b899e9dc0d52b55e22dbe092ea170d646df9af23ef534e2f19a0f4d6d43d1e23f2a314f6797462a09c8c1ae4b639532d088b0b2edcc10b5c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_7.0.10_(x64)_20230901144326_003_windowsdesktop_runtime_7.0.10_win_x64.msi.log

Filesize
2KB

MD5
aa3e882229b05117ae5d9c1d243ea705

SHA1
47965840a94be092c6151e27dd7159ff99f5c38a

SHA256
5479a9a548bd3a1e5e7f0acb7ee514aebee2647e59456ba5e5800d4a870526c4

SHA512
3e2ee4431d752451ad1a9c7bb1e2dfea7e4b3f42089a10d85c86d2290e42a91c89859ef57fcdd129fdd6bb79621206838600681daa690c0e165603cd33478f1d

Download Submit
C:\Users\Admin\Downloads\windowsdesktop-runtime-7.0.10-win-x64.exe

Filesize
55.0MB

MD5
ae01602869316963295c7fd5a0a8b757

SHA1
1d649d6e71e58beaf631c72309bd3466df4c33f3

SHA256
ee8a1ee89bc046ad94933818b18465eacfdbee3bcaedc9f67e0158b17b20fce6

SHA512
e69fc0f0577dd2c255257521b11cbc5507847d2a092bacf6a7fa3b4b0493390f709fa3cae785dcb7afb271ceb83b804196578f4a6931f9a3f635cae114bb53ec

Download Submit
C:\Users\Admin\Downloads\windowsdesktop-runtime-7.0.10-win-x64.exe

Filesize
55.0MB

MD5
ae01602869316963295c7fd5a0a8b757

SHA1
1d649d6e71e58beaf631c72309bd3466df4c33f3

SHA256
ee8a1ee89bc046ad94933818b18465eacfdbee3bcaedc9f67e0158b17b20fce6

SHA512
e69fc0f0577dd2c255257521b11cbc5507847d2a092bacf6a7fa3b4b0493390f709fa3cae785dcb7afb271ceb83b804196578f4a6931f9a3f635cae114bb53ec

Download Submit
C:\Users\Admin\Downloads\windowsdesktop-runtime-7.0.10-win-x64.exe

Filesize
55.0MB

MD5
ae01602869316963295c7fd5a0a8b757

SHA1
1d649d6e71e58beaf631c72309bd3466df4c33f3

SHA256
ee8a1ee89bc046ad94933818b18465eacfdbee3bcaedc9f67e0158b17b20fce6

SHA512
e69fc0f0577dd2c255257521b11cbc5507847d2a092bacf6a7fa3b4b0493390f709fa3cae785dcb7afb271ceb83b804196578f4a6931f9a3f635cae114bb53ec

Download Submit
C:\Windows\Installer\MSI1655.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI1655.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI1BD4.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI1BD4.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI3B16.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI3B16.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI3B4.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI3B4.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSIA7C.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSIA7C.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSICF90.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSICF90.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSIEFCC.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSIEFCC.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSIFD98.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSIFD98.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSIFD98.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\e58ca06.msi

Filesize
25.9MB

MD5
3b09bf50efedc6b92b537ff4fcdaaca3

SHA1
54e05ef56842aa929e71489f4e816bbd16a25eac

SHA256
0d56dca7685065fac30c56a8bac84e7e058af22cef3186cca051d524ae44a981

SHA512
7e96f5ea56f4b10abe7daaf62f779bb507c840bbef748895a2f3893db7617bbe0d732c89b2e3ca41f77824ead41b6bc3466ba95f6651dcb47fc4cf63b2b13bd5

Download Submit
C:\Windows\Installer\e58ca07.msi

Filesize
808KB

MD5
867efb44d1c9e41bf8271da4891b80e8

SHA1
59cdcafdda45accc48f661a2803a5f115efa9a72

SHA256
bf7f3f331848a36a15886428266a0070003f974501658a89bd9ba9fe0583a756

SHA512
de281c5331d3accd07f535853c4ff4b24448fb1d743a5b15620b35bd46115e2d01a11b645b4ffecf96f215d531451a90ab52065bea1fa6bcca3814b8b7aed18c

Download Submit
C:\Windows\Installer\e58ca15.msi

Filesize
28.6MB

MD5
fd22d7fafd81e572e4900c31e4d26335

SHA1
eb5f9cd03d2f0cfb7fc6182db6be3e20979c3a6a

SHA256
59ce18dcfe91d4df494ff97f149c859236b5a9d470aeb8497b2bcfabe7fd0306

SHA512
01703f082b6d830d6f4f80920a1ee48ad5d2fc45e992c32455a1a226cae995eac271968a0a0e5afd4237a1159a3d90e9a484852b378852caa9ac4926a206bcfd

Download Submit
C:\Windows\Temp\{1BDF6EE9-CE38-4AB7-8C1D-48ECAEE02A37}\.cr\windowsdesktop-runtime-7.0.10-win-x64.exe

Filesize
610KB

MD5
41171a13c942bacb34fd73c40a590740

SHA1
edc607a7937169bb2ac2641e3225f5498afacaa0

SHA256
12a919d5269650efbca7ba4e918c1396e7453e4414bf1be9169e77f969f405a5

SHA512
795e8c3db97ee89642b6c28e76f6c3a3c937712a998c0ef03433ec633daa802f6986225da11cbad2cee7faf88f9e85942fd097566ab1f228b1e14d8a95d5d8c9

Download Submit
C:\Windows\Temp\{1BDF6EE9-CE38-4AB7-8C1D-48ECAEE02A37}\.cr\windowsdesktop-runtime-7.0.10-win-x64.exe

Filesize
610KB

MD5
41171a13c942bacb34fd73c40a590740

SHA1
edc607a7937169bb2ac2641e3225f5498afacaa0

SHA256
12a919d5269650efbca7ba4e918c1396e7453e4414bf1be9169e77f969f405a5

SHA512
795e8c3db97ee89642b6c28e76f6c3a3c937712a998c0ef03433ec633daa802f6986225da11cbad2cee7faf88f9e85942fd097566ab1f228b1e14d8a95d5d8c9

Download Submit
C:\Windows\Temp\{897226A9-B438-4139-A151-1B322B53F8CC}\.ba\bg.png

Filesize
4KB

MD5
9eb0320dfbf2bd541e6a55c01ddc9f20

SHA1
eb282a66d29594346531b1ff886d455e1dcd6d99

SHA256
9095bf7b6baa0107b40a4a6d727215be077133a190f4ca9bd89a176842141e79

SHA512
9ada3a1757a493fbb004bd767fab8f77430af69d71479f340b8b8ede904cc94cd733700db593a4a2d2e1184c0081fd0648318d867128e1cb461021314990931d

Download Submit
C:\Windows\Temp\{897226A9-B438-4139-A151-1B322B53F8CC}\.ba\wixstdba.dll

Filesize
197KB

MD5
4356ee50f0b1a878e270614780ddf095

SHA1
b5c0915f023b2e4ed3e122322abc40c4437909af

SHA256
41a8787fdc9467f563438daba4131191aa1eb588a81beb9a89fe8bd886c16104

SHA512
b9e482efe9189683dabfc9feff8b386d7eba4ecf070f42a1eebee6052cfb181a19497f831f1ea6429cfcce1d4865a5d279b24bd738d702902e9887bb9f0c4691

Download Submit
C:\Windows\Temp\{897226A9-B438-4139-A151-1B322B53F8CC}\.be\windowsdesktop-runtime-7.0.10-win-x64.exe

Filesize
610KB

MD5
41171a13c942bacb34fd73c40a590740

SHA1
edc607a7937169bb2ac2641e3225f5498afacaa0

SHA256
12a919d5269650efbca7ba4e918c1396e7453e4414bf1be9169e77f969f405a5

SHA512
795e8c3db97ee89642b6c28e76f6c3a3c937712a998c0ef03433ec633daa802f6986225da11cbad2cee7faf88f9e85942fd097566ab1f228b1e14d8a95d5d8c9

Download Submit
C:\Windows\Temp\{897226A9-B438-4139-A151-1B322B53F8CC}\.be\windowsdesktop-runtime-7.0.10-win-x64.exe

Filesize
610KB

MD5
41171a13c942bacb34fd73c40a590740

SHA1
edc607a7937169bb2ac2641e3225f5498afacaa0

SHA256
12a919d5269650efbca7ba4e918c1396e7453e4414bf1be9169e77f969f405a5

SHA512
795e8c3db97ee89642b6c28e76f6c3a3c937712a998c0ef03433ec633daa802f6986225da11cbad2cee7faf88f9e85942fd097566ab1f228b1e14d8a95d5d8c9

Download Submit
C:\Windows\Temp\{897226A9-B438-4139-A151-1B322B53F8CC}\.be\windowsdesktop-runtime-7.0.10-win-x64.exe

Filesize
610KB

MD5
41171a13c942bacb34fd73c40a590740

SHA1
edc607a7937169bb2ac2641e3225f5498afacaa0

SHA256
12a919d5269650efbca7ba4e918c1396e7453e4414bf1be9169e77f969f405a5

SHA512
795e8c3db97ee89642b6c28e76f6c3a3c937712a998c0ef03433ec633daa802f6986225da11cbad2cee7faf88f9e85942fd097566ab1f228b1e14d8a95d5d8c9

Download Submit
C:\Windows\Temp\{897226A9-B438-4139-A151-1B322B53F8CC}\dotnet_host_7.0.10_win_x64.msi

Filesize
744KB

MD5
50d398437b49d4c692c597c5507381a6

SHA1
7e89a4c2e169e13b598d0c418c2be92eff451462

SHA256
6c443de369f8a18d7eb2626285c5007fdf0fcc16ad9db95fd09659ea86cb579b

SHA512
7d2784b7babebf8fa141328a59c9d422c945f6cd2e0b0265fc8232406743bbcd6f29eaa10f9c457fbf8bc2758c3bc976c2da04db99f3f80c20794d7404113bfe

Download Submit
C:\Windows\Temp\{897226A9-B438-4139-A151-1B322B53F8CC}\dotnet_hostfxr_7.0.10_win_x64.msi

Filesize
808KB

MD5
867efb44d1c9e41bf8271da4891b80e8

SHA1
59cdcafdda45accc48f661a2803a5f115efa9a72

SHA256
bf7f3f331848a36a15886428266a0070003f974501658a89bd9ba9fe0583a756

SHA512
de281c5331d3accd07f535853c4ff4b24448fb1d743a5b15620b35bd46115e2d01a11b645b4ffecf96f215d531451a90ab52065bea1fa6bcca3814b8b7aed18c

Download Submit
C:\Windows\Temp\{897226A9-B438-4139-A151-1B322B53F8CC}\dotnet_runtime_7.0.10_win_x64.msi

Filesize
25.9MB

MD5
3b09bf50efedc6b92b537ff4fcdaaca3

SHA1
54e05ef56842aa929e71489f4e816bbd16a25eac

SHA256
0d56dca7685065fac30c56a8bac84e7e058af22cef3186cca051d524ae44a981

SHA512
7e96f5ea56f4b10abe7daaf62f779bb507c840bbef748895a2f3893db7617bbe0d732c89b2e3ca41f77824ead41b6bc3466ba95f6651dcb47fc4cf63b2b13bd5

Download Submit
C:\Windows\Temp\{897226A9-B438-4139-A151-1B322B53F8CC}\windowsdesktop_runtime_7.0.10_win_x64.msi

Filesize
28.6MB

MD5
fd22d7fafd81e572e4900c31e4d26335

SHA1
eb5f9cd03d2f0cfb7fc6182db6be3e20979c3a6a

SHA256
59ce18dcfe91d4df494ff97f149c859236b5a9d470aeb8497b2bcfabe7fd0306

SHA512
01703f082b6d830d6f4f80920a1ee48ad5d2fc45e992c32455a1a226cae995eac271968a0a0e5afd4237a1159a3d90e9a484852b378852caa9ac4926a206bcfd

Download Submit