1210198cba67e2324b493118f6f20e425d737f791d4dd60e7a491dcfe53ce4e1

Analysis

max time kernel
141s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26/01/2024, 15:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Galaxy Swapper v2.exe
Size

4.7MB
MD5

4bacf7451e3527f4d4b33f6194d1fa07
SHA1

1799413946f92bcb306604d557e7c73422913ab3
SHA256

1210198cba67e2324b493118f6f20e425d737f791d4dd60e7a491dcfe53ce4e1
SHA512

674a92f36a0b6130a7c7cdadd8a137bbe388eadb87c1e4621993eb45000c69182b768f70bb57e5e63fd06e4876908176de59ee8ddda1a410d43d1c8c3e5432bd
SSDEEP

49152:uMwkjJCUR8vJiIwBDwXkYRY6BqatCNO4JT2F8aHE1vTvO+cq2+qwZ9z+my7iA84Z:TNJuhFqwXXRYgqatNcj2ZTeDluupSR

Score

8^/10

discovery persistence

Malware Config

Signatures

Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Control Panel\International\Geo\Nation	windowsdesktop-runtime-7.0.15-win-x64.exe

Executes dropped EXE 3 IoCs

pid	Process
4556	windowsdesktop-runtime-7.0.15-win-x64.exe
2088	windowsdesktop-runtime-7.0.15-win-x64.exe
2256	windowsdesktop-runtime-7.0.15-win-x64.exe

Loads dropped DLL 9 IoCs

pid	Process
2088	windowsdesktop-runtime-7.0.15-win-x64.exe
1300	MsiExec.exe
1300	MsiExec.exe
1080	MsiExec.exe
1080	MsiExec.exe
1656	MsiExec.exe
1656	MsiExec.exe
1700	MsiExec.exe
1700	MsiExec.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{678ecfdb-8552-4dd3-9bd7-ed16b0f23ae2} = "\"C:\\ProgramData\\Package Cache\\{678ecfdb-8552-4dd3-9bd7-ed16b0f23ae2}\\windowsdesktop-runtime-7.0.15-win-x64.exe\" /burn.runonce"	windowsdesktop-runtime-7.0.15-win-x64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.15\de\System.Windows.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.15\fr\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.15\System.Transactions.Local.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.15\System.Text.Encoding.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.15\System.Threading.Timer.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.15\System.Net.WebProxy.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.15\WindowsBase.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.15\ru\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.15\System.Net.WebSockets.Client.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.15\System.Web.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.15\ko\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.15\pl\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.15\System.Text.Encoding.CodePages.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.15\System.Linq.Queryable.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.15\ja\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.15\pt-BR\UIAutomationTypes.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.15\tr\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.15\de\System.Windows.Forms.Primitives.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.15\es\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.15\System.Runtime.CompilerServices.VisualC.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.15\ru\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.15\cs\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.15\System.Net.WebSockets.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\ThirdPartyNotices.txt	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.15\it\WindowsBase.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.15\ru\UIAutomationTypes.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.15\System.Xml.Linq.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.15\System.Xml.XmlDocument.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.15\System.IO.Compression.FileSystem.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.15\zh-Hans\WindowsBase.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.15\System.Diagnostics.PerformanceCounter.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.15\ja\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.15\cs\System.Windows.Forms.Primitives.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.15\System.Diagnostics.DiagnosticSource.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.15\pt-BR\ReachFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.15\cs\UIAutomationClient.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.15\PresentationUI.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.15\System.Drawing.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.15\PresentationFramework-SystemDrawing.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.15\System.Resources.Extensions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.15\System.Net.Http.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.15\pl\ReachFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.15\PresentationFramework.Luna.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.15\System.Reflection.TypeExtensions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.15\System.Diagnostics.Debug.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.15\System.Resources.Writer.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.15\tr\WindowsBase.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.15\pt-BR\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.15\fr\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.15\System.Reflection.Metadata.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.15\System.Xml.XmlSerializer.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.15\Microsoft.VisualBasic.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.15\zh-Hant\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.15\ja\WindowsFormsIntegration.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.15\zh-Hans\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.15\System.Threading.Tasks.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.15\System.Diagnostics.Contracts.dll	msiexec.exe
File created	C:\Program Files\dotnet\host\fxr\7.0.15\hostfxr.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.15\System.Windows.Forms.Primitives.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.15\System.Net.Primitives.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.15\System.Console.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.15\fr\WindowsFormsIntegration.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.15\de\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.15\mscorlib.dll	msiexec.exe

Drops file in Windows directory 35 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e587ccc.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\4BDB0BE2D7DB01E48AEC155392D01AB6	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\4BDB0BE2D7DB01E48AEC155392D01AB6\56.60.5674\fileCoreHostExe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8122.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI918F.tmp	msiexec.exe
File created	C:\Windows\Installer\e587cd5.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI96E1.tmp	msiexec.exe
File created	C:\Windows\Installer\e587cdb.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA04C.tmp	msiexec.exe
File created	C:\Windows\Installer\e587cd1.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9A00.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9374.tmp	msiexec.exe
File created	C:\Windows\Installer\e587cd6.msi	msiexec.exe
File created	C:\Windows\Installer\e587cdc.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI843F.tmp	msiexec.exe
File created	C:\Windows\Installer\e587cd0.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{2EB0BDB4-BD7D-4E10-A8CE-5135290DA16B}	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\4BDB0BE2D7DB01E48AEC155392D01AB6\56.60.5674	msiexec.exe
File opened for modification	C:\Windows\Installer\e587ccc.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\e587cd6.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9B39.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9DCB.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{727E0F2E-97AA-4723-93C2-A7E55A09338E}	msiexec.exe
File created	C:\Windows\Installer\e587ce0.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB0A9.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e587cdc.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{C4FF47FF-99CD-4699-8B6D-10834B3F0554}	msiexec.exe
File opened for modification	C:\Windows\Installer\e587cd1.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{D0210A10-A37D-4B32-B1EE-BB02E519C76C}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI95E6.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI97BD.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\4BDB0BE2D7DB01E48AEC155392D01AB6\56.60.5674\fileCoreHostExe	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\22\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\23	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\24	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\25	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\23	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\24	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_56.60.5674_x64\ = "{D0210A10-A37D-4B32-B1EE-BB02E519C76C}"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4BDB0BE2D7DB01E48AEC155392D01AB6\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E2F0E727AA793274392C7A5EA59033E8\Provider	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E2F0E727AA793274392C7A5EA59033E8\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{727E0F2E-97AA-4723-93C2-A7E55A09338E}v56.60.5778\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{678ecfdb-8552-4dd3-9bd7-ed16b0f23ae2}\Dependents\{678ecfdb-8552-4dd3-9bd7-ed16b0f23ae2}	windowsdesktop-runtime-7.0.15-win-x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\01A0120DD73A23B41BEEBB205E917CC6\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\01A0120DD73A23B41BEEBB205E917CC6\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{D0210A10-A37D-4B32-B1EE-BB02E519C76C}v56.60.5674\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_56.60.5674_x64\Dependents	windowsdesktop-runtime-7.0.15-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4BDB0BE2D7DB01E48AEC155392D01AB6\ProductName = "Microsoft .NET Host - 7.0.15 (x64)"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E2F0E727AA793274392C7A5EA59033E8\Version = "943462034"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\dotnet_runtime_56.60.5674_x64	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\01A0120DD73A23B41BEEBB205E917CC6\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4BDB0BE2D7DB01E48AEC155392D01AB6\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\4E3F426DBD05F2A509C6867B91443826\4BDB0BE2D7DB01E48AEC155392D01AB6	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_56.60.5778_x64\Dependents\{678ecfdb-8552-4dd3-9bd7-ed16b0f23ae2}	windowsdesktop-runtime-7.0.15-win-x64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\{678ecfdb-8552-4dd3-9bd7-ed16b0f23ae2}	windowsdesktop-runtime-7.0.15-win-x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E2F0E727AA793274392C7A5EA59033E8\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\59FA3D7BFC257875E13E7DC1865144BB\E2F0E727AA793274392C7A5EA59033E8	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\01A0120DD73A23B41BEEBB205E917CC6\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\01A0120DD73A23B41BEEBB205E917CC6\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{D0210A10-A37D-4B32-B1EE-BB02E519C76C}v56.60.5674\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_56.60.5674_x64\Dependents\{678ecfdb-8552-4dd3-9bd7-ed16b0f23ae2}	windowsdesktop-runtime-7.0.15-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_56.60.5778_x64\Dependents	windowsdesktop-runtime-7.0.15-win-x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FF74FF4CDC999964B8D60138B4F35045\DeploymentFlags = "3"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4BDB0BE2D7DB01E48AEC155392D01AB6\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E2F0E727AA793274392C7A5EA59033E8	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_56.60.5674_x64\ = "{C4FF47FF-99CD-4699-8B6D-10834B3F0554}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\01A0120DD73A23B41BEEBB205E917CC6\MainFeature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\01A0120DD73A23B41BEEBB205E917CC6\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{678ecfdb-8552-4dd3-9bd7-ed16b0f23ae2}\DisplayName = "Microsoft Windows Desktop Runtime - 7.0.15 (x64)"	windowsdesktop-runtime-7.0.15-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\01A0120DD73A23B41BEEBB205E917CC6\PackageCode = "7EC420DEF15AA5D4DB685F6E84F3E033"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\4E3F426DBD05F2A509C6867B91443826	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4BDB0BE2D7DB01E48AEC155392D01AB6\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\59FA3D7BFC257875E13E7DC1865144BB	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_56.60.5674_x64\DisplayName = "Microsoft .NET Host FX Resolver - 7.0.15 (x64)"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_56.60.5674_x64	windowsdesktop-runtime-7.0.15-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4BDB0BE2D7DB01E48AEC155392D01AB6\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4BDB0BE2D7DB01E48AEC155392D01AB6\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\FF74FF4CDC999964B8D60138B4F35045\Provider	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\FF74FF4CDC999964B8D60138B4F35045\MainFeature	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FF74FF4CDC999964B8D60138B4F35045\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FF74FF4CDC999964B8D60138B4F35045\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\01A0120DD73A23B41BEEBB205E917CC6	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_56.60.5778_x64\DisplayName = "Microsoft Windows Desktop Runtime - 7.0.15 (x64)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_7.0_x64\DisplayName = "Microsoft .NET Host - 7.0.15 (x64)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4BDB0BE2D7DB01E48AEC155392D01AB6\Provider	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_56.60.5778_x64\ = "{727E0F2E-97AA-4723-93C2-A7E55A09338E}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E2F0E727AA793274392C7A5EA59033E8\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{727E0F2E-97AA-4723-93C2-A7E55A09338E}v56.60.5778\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FF74FF4CDC999964B8D60138B4F35045\SourceList\PackageName = "dotnet-runtime-7.0.15-win-x64.msi"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FF74FF4CDC999964B8D60138B4F35045\Assignment = "1"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FF74FF4CDC999964B8D60138B4F35045\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\3A568CC26CB513C4B0175451F58CBAD1\01A0120DD73A23B41BEEBB205E917CC6	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4BDB0BE2D7DB01E48AEC155392D01AB6\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{2EB0BDB4-BD7D-4E10-A8CE-5135290DA16B}v56.60.5674\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4BDB0BE2D7DB01E48AEC155392D01AB6	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4BDB0BE2D7DB01E48AEC155392D01AB6\PackageCode = "47BAB96A74E97A34BA3AF3E0AA344DFB"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_7.0_x64	windowsdesktop-runtime-7.0.15-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_7.0_x64\Dependents	windowsdesktop-runtime-7.0.15-win-x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E2F0E727AA793274392C7A5EA59033E8\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E2F0E727AA793274392C7A5EA59033E8\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FF74FF4CDC999964B8D60138B4F35045\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4BDB0BE2D7DB01E48AEC155392D01AB6\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E2F0E727AA793274392C7A5EA59033E8\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{678ecfdb-8552-4dd3-9bd7-ed16b0f23ae2}\Dependents	windowsdesktop-runtime-7.0.15-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_56.60.5674_x64\DisplayName = "Microsoft .NET Runtime - 7.0.15 (x64)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E2F0E727AA793274392C7A5EA59033E8\SourceList\PackageName = "windowsdesktop-runtime-7.0.15-win-x64.msi"	msiexec.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 965213.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
5064	msedge.exe
5064	msedge.exe
1384	msedge.exe
1384	msedge.exe
5068	identity_helper.exe
5068	identity_helper.exe
1388	msedge.exe
1388	msedge.exe
4540	msiexec.exe
4540	msiexec.exe
4540	msiexec.exe
4540	msiexec.exe
4540	msiexec.exe
4540	msiexec.exe
4540	msiexec.exe
4540	msiexec.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2256	windowsdesktop-runtime-7.0.15-win-x64.exe
Token: SeIncreaseQuotaPrivilege	2256	windowsdesktop-runtime-7.0.15-win-x64.exe
Token: SeSecurityPrivilege	4540	msiexec.exe
Token: SeCreateTokenPrivilege	2256	windowsdesktop-runtime-7.0.15-win-x64.exe
Token: SeAssignPrimaryTokenPrivilege	2256	windowsdesktop-runtime-7.0.15-win-x64.exe
Token: SeLockMemoryPrivilege	2256	windowsdesktop-runtime-7.0.15-win-x64.exe
Token: SeIncreaseQuotaPrivilege	2256	windowsdesktop-runtime-7.0.15-win-x64.exe
Token: SeMachineAccountPrivilege	2256	windowsdesktop-runtime-7.0.15-win-x64.exe
Token: SeTcbPrivilege	2256	windowsdesktop-runtime-7.0.15-win-x64.exe
Token: SeSecurityPrivilege	2256	windowsdesktop-runtime-7.0.15-win-x64.exe
Token: SeTakeOwnershipPrivilege	2256	windowsdesktop-runtime-7.0.15-win-x64.exe
Token: SeLoadDriverPrivilege	2256	windowsdesktop-runtime-7.0.15-win-x64.exe
Token: SeSystemProfilePrivilege	2256	windowsdesktop-runtime-7.0.15-win-x64.exe
Token: SeSystemtimePrivilege	2256	windowsdesktop-runtime-7.0.15-win-x64.exe
Token: SeProfSingleProcessPrivilege	2256	windowsdesktop-runtime-7.0.15-win-x64.exe
Token: SeIncBasePriorityPrivilege	2256	windowsdesktop-runtime-7.0.15-win-x64.exe
Token: SeCreatePagefilePrivilege	2256	windowsdesktop-runtime-7.0.15-win-x64.exe
Token: SeCreatePermanentPrivilege	2256	windowsdesktop-runtime-7.0.15-win-x64.exe
Token: SeBackupPrivilege	2256	windowsdesktop-runtime-7.0.15-win-x64.exe
Token: SeRestorePrivilege	2256	windowsdesktop-runtime-7.0.15-win-x64.exe
Token: SeShutdownPrivilege	2256	windowsdesktop-runtime-7.0.15-win-x64.exe
Token: SeDebugPrivilege	2256	windowsdesktop-runtime-7.0.15-win-x64.exe
Token: SeAuditPrivilege	2256	windowsdesktop-runtime-7.0.15-win-x64.exe
Token: SeSystemEnvironmentPrivilege	2256	windowsdesktop-runtime-7.0.15-win-x64.exe
Token: SeChangeNotifyPrivilege	2256	windowsdesktop-runtime-7.0.15-win-x64.exe
Token: SeRemoteShutdownPrivilege	2256	windowsdesktop-runtime-7.0.15-win-x64.exe
Token: SeUndockPrivilege	2256	windowsdesktop-runtime-7.0.15-win-x64.exe
Token: SeSyncAgentPrivilege	2256	windowsdesktop-runtime-7.0.15-win-x64.exe
Token: SeEnableDelegationPrivilege	2256	windowsdesktop-runtime-7.0.15-win-x64.exe
Token: SeManageVolumePrivilege	2256	windowsdesktop-runtime-7.0.15-win-x64.exe
Token: SeImpersonatePrivilege	2256	windowsdesktop-runtime-7.0.15-win-x64.exe
Token: SeCreateGlobalPrivilege	2256	windowsdesktop-runtime-7.0.15-win-x64.exe
Token: SeRestorePrivilege	4540	msiexec.exe
Token: SeTakeOwnershipPrivilege	4540	msiexec.exe
Token: SeRestorePrivilege	4540	msiexec.exe
Token: SeTakeOwnershipPrivilege	4540	msiexec.exe
Token: SeRestorePrivilege	4540	msiexec.exe
Token: SeTakeOwnershipPrivilege	4540	msiexec.exe
Token: SeRestorePrivilege	4540	msiexec.exe
Token: SeTakeOwnershipPrivilege	4540	msiexec.exe
Token: SeRestorePrivilege	4540	msiexec.exe
Token: SeTakeOwnershipPrivilege	4540	msiexec.exe
Token: SeRestorePrivilege	4540	msiexec.exe
Token: SeTakeOwnershipPrivilege	4540	msiexec.exe
Token: SeRestorePrivilege	4540	msiexec.exe
Token: SeTakeOwnershipPrivilege	4540	msiexec.exe
Token: SeRestorePrivilege	4540	msiexec.exe
Token: SeTakeOwnershipPrivilege	4540	msiexec.exe
Token: SeRestorePrivilege	4540	msiexec.exe
Token: SeTakeOwnershipPrivilege	4540	msiexec.exe
Token: SeRestorePrivilege	4540	msiexec.exe
Token: SeTakeOwnershipPrivilege	4540	msiexec.exe
Token: SeRestorePrivilege	4540	msiexec.exe
Token: SeTakeOwnershipPrivilege	4540	msiexec.exe
Token: SeRestorePrivilege	4540	msiexec.exe
Token: SeTakeOwnershipPrivilege	4540	msiexec.exe
Token: SeRestorePrivilege	4540	msiexec.exe
Token: SeTakeOwnershipPrivilege	4540	msiexec.exe
Token: SeRestorePrivilege	4540	msiexec.exe
Token: SeTakeOwnershipPrivilege	4540	msiexec.exe
Token: SeRestorePrivilege	4540	msiexec.exe
Token: SeTakeOwnershipPrivilege	4540	msiexec.exe
Token: SeRestorePrivilege	4540	msiexec.exe
Token: SeTakeOwnershipPrivilege	4540	msiexec.exe

Suspicious use of FindShellTrayWindow 59 IoCs

pid	Process
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
2088	windowsdesktop-runtime-7.0.15-win-x64.exe
1384	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2824 wrote to memory of 1384	2824	Galaxy Swapper v2.exe	93
PID 2824 wrote to memory of 1384	2824	Galaxy Swapper v2.exe	93
PID 1384 wrote to memory of 4216	1384	msedge.exe	94
PID 1384 wrote to memory of 4216	1384	msedge.exe	94
PID 1384 wrote to memory of 3508	1384	msedge.exe	98
PID 1384 wrote to memory of 3508	1384	msedge.exe	98
PID 1384 wrote to memory of 3508	1384	msedge.exe	98
PID 1384 wrote to memory of 3508	1384	msedge.exe	98
PID 1384 wrote to memory of 3508	1384	msedge.exe	98
PID 1384 wrote to memory of 3508	1384	msedge.exe	98
PID 1384 wrote to memory of 3508	1384	msedge.exe	98
PID 1384 wrote to memory of 3508	1384	msedge.exe	98
PID 1384 wrote to memory of 3508	1384	msedge.exe	98
PID 1384 wrote to memory of 3508	1384	msedge.exe	98
PID 1384 wrote to memory of 3508	1384	msedge.exe	98
PID 1384 wrote to memory of 3508	1384	msedge.exe	98
PID 1384 wrote to memory of 3508	1384	msedge.exe	98
PID 1384 wrote to memory of 3508	1384	msedge.exe	98
PID 1384 wrote to memory of 3508	1384	msedge.exe	98
PID 1384 wrote to memory of 3508	1384	msedge.exe	98
PID 1384 wrote to memory of 3508	1384	msedge.exe	98
PID 1384 wrote to memory of 3508	1384	msedge.exe	98
PID 1384 wrote to memory of 3508	1384	msedge.exe	98
PID 1384 wrote to memory of 3508	1384	msedge.exe	98
PID 1384 wrote to memory of 3508	1384	msedge.exe	98
PID 1384 wrote to memory of 3508	1384	msedge.exe	98
PID 1384 wrote to memory of 3508	1384	msedge.exe	98
PID 1384 wrote to memory of 3508	1384	msedge.exe	98
PID 1384 wrote to memory of 3508	1384	msedge.exe	98
PID 1384 wrote to memory of 3508	1384	msedge.exe	98
PID 1384 wrote to memory of 3508	1384	msedge.exe	98
PID 1384 wrote to memory of 3508	1384	msedge.exe	98
PID 1384 wrote to memory of 3508	1384	msedge.exe	98
PID 1384 wrote to memory of 3508	1384	msedge.exe	98
PID 1384 wrote to memory of 3508	1384	msedge.exe	98
PID 1384 wrote to memory of 3508	1384	msedge.exe	98
PID 1384 wrote to memory of 3508	1384	msedge.exe	98
PID 1384 wrote to memory of 3508	1384	msedge.exe	98
PID 1384 wrote to memory of 3508	1384	msedge.exe	98
PID 1384 wrote to memory of 3508	1384	msedge.exe	98
PID 1384 wrote to memory of 3508	1384	msedge.exe	98
PID 1384 wrote to memory of 3508	1384	msedge.exe	98
PID 1384 wrote to memory of 3508	1384	msedge.exe	98
PID 1384 wrote to memory of 3508	1384	msedge.exe	98
PID 1384 wrote to memory of 5064	1384	msedge.exe	96
PID 1384 wrote to memory of 5064	1384	msedge.exe	96
PID 1384 wrote to memory of 3976	1384	msedge.exe	97
PID 1384 wrote to memory of 3976	1384	msedge.exe	97
PID 1384 wrote to memory of 3976	1384	msedge.exe	97
PID 1384 wrote to memory of 3976	1384	msedge.exe	97
PID 1384 wrote to memory of 3976	1384	msedge.exe	97
PID 1384 wrote to memory of 3976	1384	msedge.exe	97
PID 1384 wrote to memory of 3976	1384	msedge.exe	97
PID 1384 wrote to memory of 3976	1384	msedge.exe	97
PID 1384 wrote to memory of 3976	1384	msedge.exe	97
PID 1384 wrote to memory of 3976	1384	msedge.exe	97
PID 1384 wrote to memory of 3976	1384	msedge.exe	97
PID 1384 wrote to memory of 3976	1384	msedge.exe	97
PID 1384 wrote to memory of 3976	1384	msedge.exe	97
PID 1384 wrote to memory of 3976	1384	msedge.exe	97
PID 1384 wrote to memory of 3976	1384	msedge.exe	97
PID 1384 wrote to memory of 3976	1384	msedge.exe	97
PID 1384 wrote to memory of 3976	1384	msedge.exe	97
PID 1384 wrote to memory of 3976	1384	msedge.exe	97

C:\Users\Admin\AppData\Local\Temp\Galaxy Swapper v2.exe
"C:\Users\Admin\AppData\Local\Temp\Galaxy Swapper v2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?framework=Microsoft.NETCore.App&framework_version=7.0.0&arch=x64&rid=win-x64&os=win10&gui=true
  2⤵
  - Enumerates system info in registry
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff436446f8,0x7fff43644708,0x7fff43644718
    3⤵
    PID:4216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2176,8749679918310891770,6028060486440877603,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2176,8749679918310891770,6028060486440877603,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2696 /prefetch:8
    3⤵
    PID:3976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2176,8749679918310891770,6028060486440877603,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
    3⤵
    PID:3508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,8749679918310891770,6028060486440877603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
    3⤵
    PID:5020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,8749679918310891770,6028060486440877603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
    3⤵
    PID:4200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,8749679918310891770,6028060486440877603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4936 /prefetch:1
    3⤵
    PID:5088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,8749679918310891770,6028060486440877603,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
    3⤵
    PID:4336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,8749679918310891770,6028060486440877603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3832 /prefetch:1
    3⤵
    PID:3248
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2176,8749679918310891770,6028060486440877603,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5368 /prefetch:8
    3⤵
    PID:2540
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2176,8749679918310891770,6028060486440877603,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5368 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,8749679918310891770,6028060486440877603,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:1
    3⤵
    PID:2724
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,8749679918310891770,6028060486440877603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4956 /prefetch:1
    3⤵
    PID:2760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,8749679918310891770,6028060486440877603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5784 /prefetch:1
    3⤵
    PID:4940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2176,8749679918310891770,6028060486440877603,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5792 /prefetch:8
    3⤵
    PID:2700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,8749679918310891770,6028060486440877603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5384 /prefetch:1
    3⤵
    PID:3328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2176,8749679918310891770,6028060486440877603,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6376 /prefetch:8
    3⤵
    PID:464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2176,8749679918310891770,6028060486440877603,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5960 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1388
- - C:\Users\Admin\Downloads\windowsdesktop-runtime-7.0.15-win-x64.exe
    "C:\Users\Admin\Downloads\windowsdesktop-runtime-7.0.15-win-x64.exe"
    3⤵
    - Executes dropped EXE
    PID:4556
  - - C:\Windows\Temp\{C6F8E1D9-ADC0-4084-B9D7-A14D297E03AB}\.cr\windowsdesktop-runtime-7.0.15-win-x64.exe
      "C:\Windows\Temp\{C6F8E1D9-ADC0-4084-B9D7-A14D297E03AB}\.cr\windowsdesktop-runtime-7.0.15-win-x64.exe" -burn.clean.room="C:\Users\Admin\Downloads\windowsdesktop-runtime-7.0.15-win-x64.exe" -burn.filehandle.attached=568 -burn.filehandle.self=676
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of FindShellTrayWindow
      PID:2088
    - - C:\Windows\Temp\{429007D8-E9C9-4CE9-A695-6E7D74EDE452}\.be\windowsdesktop-runtime-7.0.15-win-x64.exe
        
        "C:\Windows\Temp\{429007D8-E9C9-4CE9-A695-6E7D74EDE452}\.be\windowsdesktop-runtime-7.0.15-win-x64.exe" -q -burn.elevated BurnPipe.{48375460-2EB6-40F4-B5EF-79075CDC8E7F} {766EBFAE-82B6-427E-807A-F229DFA67EAB} 2088
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:2256

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3256

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4020

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4540
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 78A9032DB464C6DDF71B67266837B94F
  2⤵
  - Loads dropped DLL
  PID:1300
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 08BFC23452F3FAC6A5D053F732FC5E9B
  2⤵
  - Loads dropped DLL
  PID:1080
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 35696235B4CA232A40A92264075DF19E
  2⤵
  - Loads dropped DLL
  PID:1656
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 0581209FFAC8E5C9CD8C237E45743CE5
  2⤵
  - Loads dropped DLL
  PID:1700

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e587ccf.rbs

Filesize
48KB

MD5
520806788e8484082d0a7c88ecf3f8f8

SHA1
bb2cb7843566ae27d13e2282546f115f22eba9d3

SHA256
3fb46d72071d9ad13e645a4ef83d1b124378c1992e6f96f1eab0864772c20484

SHA512
b9cf337e7bf2e6c08088ba13bb82aa51685e4fdaa75a1e988566d232835c09e6f1d321782f2bdc47681ba5b9540a7a0c266c217961e60d8814a0a8f782cfb13c

Download Submit
C:\Config.Msi\e587cd4.rbs

Filesize
9KB

MD5
bf5429b7246607920481ab93ee956cab

SHA1
13f51e81bf422673035f1eb8419391db0892c375

SHA256
8042d18599c4d4a8cb50e237a1d110eb66f2e1f2e7eb72ecb96b66a6d977f639

SHA512
6712649952d61f7c276643651040a95bcd45584c72fd534f90441a31dcdbf6ff35b7055c906e8ebaad39c453241e0a24eb972ce5c563484c9b851aa47777f929

Download Submit
C:\Config.Msi\e587cd9.rbs

Filesize
10KB

MD5
4692adcdb060194f290a28f5f6de6774

SHA1
e8d09f1ccfc96de89d378bcb5e635bccefa7422f

SHA256
47e78c2e61989b180b2826ab4e7ed0acbe0c71b51e2c0c62c5d8d5b7eeb79b98

SHA512
d0514cd18ce33cefa5a71fcf86a66c33c3fbe46303a67e8b0a2767c54d6309e4feb0e030b71074d45636861aa9ce82b455ce78517e4c94b2a2f0a76d6d148471

Download Submit
C:\Config.Msi\e587cdf.rbs

Filesize
87KB

MD5
0307bcb73baf781f05ee149481c9d430

SHA1
bc247d68ac2f40c7f19805e6d97627f6c06ca82d

SHA256
9ce4b7cf5e2847e8a20fc31f71fe09a46862cfd31ecfd93bddee26ff7c3c5b71

SHA512
565c4cc879267d9f0a7caa3b4302fc24823c0f60a0a46040e66199a27d30019fcd382160a7d8cc581cdfb72f85b39cd645c4a67cee0a914dde921aa6ba68ce2c

Download Submit
C:\Program Files\dotnet\ThirdPartyNotices.txt

Filesize
85KB

MD5
5c13a5ea8c8cc3474240981d0ffa88ff

SHA1
1d8d3ce27d9dc3d9fb4fa4b06c20137d25879d80

SHA256
4f9bb3901879bafae3a17c6c4009ee5c15384a06fc234bed78937969079c77da

SHA512
32ea79ff5194d8a18e75f277aed5610b4955db15b0abbcc2664cf07f372bebfc57eb665ad078dc3da3ce5ee0d8856140c2a1bc7032b578dd103d43998d682d88

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d5564ccbd62bac229941d2812fc4bfba

SHA1
0483f8496225a0f2ca0d2151fab40e8f4f61ab6d

SHA256
d259ff04090cbde3b87a54554d6e2b8a33ba81e9483acbbe3e6bad15cbde4921

SHA512
300cda7933e8af577bdc1b20e6d4279d1e418cdb0571c928b1568bfea3c231ba632ccb67313ae73ddeae5586d85db95caffaedd23e973d437f8496a8c5a15025

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
360B

MD5
8b9949f6ada77e0b91e1f917a3a4e609

SHA1
647fea4f94b773c48efa8d43a7dc2535cae0b98c

SHA256
b8ebebf4297958f961bf06b8ab46f9123b38166e9a9cf63f168b5b3bde1ab695

SHA512
3754641af8d1cfad7d1125dd494030d84869e2adef8a08e63ea635b2bc829f469783dd050178e3aef355f1ff04121b23065b2249ddd4b8c43d3d78136d6c66cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
902B

MD5
067bac0390c75a3e0fbdb10dc1f5f0cc

SHA1
23b7eef22164ffc2e2bc55b4ba524e9efaca121e

SHA256
fc39a898ecbd5b212d5502663766f965058fa813f44c90782299440511777c98

SHA512
ea02a053d15d6cd1a823bbf6604f9247dac74bba8bc9a2d6b7d793c5700b40a6d2dd1c662c7b0aaaaa055219de70d66c37e749d7d51f02d6929cc32488600330

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1002B

MD5
a91059e463fa78e8a5430790ceddc212

SHA1
16b496415496bba0ddb2276e4acfb52645599f66

SHA256
0c953a265d43232781b41ac183bc3a500f96bcc0b6bd98abf26decb8595038c9

SHA512
59067542c2afc317d211e322e98f6c6530e7e3fefef0560475a376e5ef53f6832f1ee58e106143fb102bc5b4b591fbfaab0aca2262062eab0bfbb252f5c0c85c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1d313f93fee7befda1e846c963767ea7

SHA1
9c8d99ef29fcdf20b82a657c534b7fedd986339a

SHA256
7c67186b76d02ef12fa3865beb534d91594b62f7e008f15d00ff55b112c9209a

SHA512
bc24e3b2f91fe86b6427f9a1ee2f8d58d7790b557bb8c0b2c89e2abfb192128d707b16519f5edefaeda9bf8b371bdb9d3379419091c210e54aef6541c57ef356

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3343a30d1e867dc23f54a3ffe94437b7

SHA1
72e29f1b5558d1ca631a38e5237ed59ada95c878

SHA256
417006832c4bfa29323b083ee85f727959896193f6c7b32c67cadd7415955df2

SHA512
ed116b42b984ef036bf6fdad147798fc3d7d67f2410b1e5a8f4ad44b0a6d945944b76614bf8daf2e0e0b1601ccae2023877d97c5c9969a8b318ae9816eb47813

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ed34dfe61411adb21692031e9c051b9d

SHA1
5f0a41cbe65aa9a5f9deed5fd8838d2542216535

SHA256
9329593e952de419a454bbd2e5ba73a1f76ad88496a6ace9b4b910cf5f7c5588

SHA512
cb3a955657a3235163f0d5be629125e14c8b4802280dee4dbf3d13acff0db18a8eba9e012509d1cb24396489628030fbda873d00c1820a1bb5ed12833dd04338

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c9fe4e2529993f667044f404016d7f80

SHA1
b7ebb9dd9792f04c304b140cf31cb77e15392272

SHA256
3fca20661202a1c7f54001cfeb2974f1b8e2431dfc4e6163f03e346f2918bc6f

SHA512
49b6c90da74846c3d83655c3c3d7a8f6acd0791faeaf3bd30d86c7fa512f970296f616114ca6f10c3386bfe40d880ddaac9061fd7824496fc87c3d1012e4e6b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
1d1c7c7f0b54eb8ba4177f9e91af9dce

SHA1
2b0f0ceb9a374fec8258679c2a039fbce4aff396

SHA256
555c13933eae4e0b0e992713ed8118e2980442f89fbdfb06d3914b607edbbb18

SHA512
4c8930fe2c805c54c0076408aba3fbfb08c24566fba9f6a409b5b1308d39c7b26c96717d43223632f1f71d2e9e68a01b43a60031be8f1ca7a541fe0f56f4d9f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
707B

MD5
90acc1204f12f39f32b2de2a079a616d

SHA1
cb1d85b1be420ac7fba9214f7044458093e82ad8

SHA256
0b77d759e78eed20262cf3acad2bac8ee4b2d10d5ab54094398b76f8656adeb0

SHA512
d25f61949768e7149d2e1a39f48a83e9cf03534e532d406bbc3b8096ee1d2f44048465d02d51e9cdf7ebd3ef3ceb3ee503701fbcf7c2349e5254688fe01d5863

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
539B

MD5
e462d03da4a0cb0760f957fa56e9eae6

SHA1
b518e93659a008e9dc3d7b35f4cf67d0743fec1b

SHA256
8c9c0833433fd255ac95616dd4f5b70f57efc61b92bd7e8059c2a04bacbde500

SHA512
a50b24331bd1d9b6777cbbb10d5d8a29c4e8388e75201cbe8fe7172c2aff3652649a802aedbde022ddf29588767dfcc780750c461f0c0f4f2fecf3b73b0e1aba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57fd7a.TMP

Filesize
203B

MD5
0f09187544871f4c95c2c192f21384d9

SHA1
a20e9b78c67e05a4f78b1068db63a98eeb225643

SHA256
9a34cd64e854af4a94b64bdbc618c04ee31e58ef7b832b8152b23e4ad418ee49

SHA512
8e7195b87b7ff493034a83b25063b0796ba78317b861219f7ffccddd6efbbbe663d5c898349b9ec986426d1da6f634452a7022f071766f216b4a06a07e610d1b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
cb2e1457f8554228e0d5dfb5e1f204c1

SHA1
7ed18febabe78188fa458dfccf9998ef454169ce

SHA256
5ab5f2df9a17132267a1f03d9dbc8114574acdb21832d58d41f54969eacc20a8

SHA512
89f86a0b43c32ceae1a7902cc138c1a0bf011df927142b764988da6cbaada030627d0a67fc5c47c9af02ced39ccf347e53cf689abc9d896522210711e69e1c91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
0a46b2d3dd2e375b040b0672deb9b8f9

SHA1
3b977061bc57b905aff24fae7aa7813c6381e169

SHA256
a114e81548fd4edb56823755ddcce0744aee2af3be477cec48bda6fb4e6b4a53

SHA512
5e6f515656fc1bce528b288a84432e9f602181df5869e2af576b769deb70a60983993272890422bd820b0f88b4408c372e652872bcf4cb987aeed53cfb1a33a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
a875e9f2ce2612b29667ac992dbd1f05

SHA1
477b8339a56468c451386853ba870b6dd0c008f1

SHA256
d51cc8aae1eb104abd6462170074b87528c7f0cce25430236ea620b1e4d09bfe

SHA512
dcaefd42e1fb4de0e3bf2de377c7a3e7d7aabc944fb1c29666d83c15197b39b1022c114630e26f3521d940edc2f8fd702c96ddbd6d6345a83f1feb3c3fbfe76a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_7.0.15_(x64)_20240126154753_000_dotnet_runtime_7.0.15_win_x64.msi.log

Filesize
2KB

MD5
8338138c7643683367033f415657e09e

SHA1
4e6bab52da1065ae2b13b8e1543ac6a46fb49747

SHA256
34d97be578d5b5ad873971cb4a45d1a154f66db1e8fccee0e6c8b1b94ce7c788

SHA512
f6748d514d6f775343b1b68ac745fe2fa91ec67ab16f2e237cae3a3d71b990d15c3415f2a4b2e5bf9d150d9c05f6d7cd1144bf0e9de5d658cd391d9993156885

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_7.0.15_(x64)_20240126154753_001_dotnet_hostfxr_7.0.15_win_x64.msi.log

Filesize
2KB

MD5
9886985b904a6f1c0991ba59ba8b60db

SHA1
a59f9ac28942c6d4784d9f4be288c6273485102b

SHA256
2972c49a90bb9e1681a465ddd78e873427bb28536761f2514f721bc774ae39bc

SHA512
e278c5816c23d55c01937bc56de7c3c0dcfa9a3f4ead18ed557d75059d7c6347e508f78a1406aab48a755fc1a9261de8de80ebf074f54871f8436af7eca67c77

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_7.0.15_(x64)_20240126154753_002_dotnet_host_7.0.15_win_x64.msi.log

Filesize
2KB

MD5
536d60ea94469996aa0252e5bc61656b

SHA1
6356e918e8b731b1085a2252769281f7470ed171

SHA256
6bd818cd7fcdb560b608b3704bbd46191ba60187e570396bcf813ba26a6de923

SHA512
d535f78e5f560158eb0b25a308958f89cf3489d301ca737ec47ae8ff08ed2037a1cdc43a2a0db103c9427d021fd32b99ec74bb7cd3da4c28f217914dc43a8a9d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_7.0.15_(x64)_20240126154753_003_windowsdesktop_runtime_7.0.15_win_x64.msi.log

Filesize
2KB

MD5
388b51649dad76b146e43bf83c34abbe

SHA1
26552979ed786e6792aefcc32816fe74d685364b

SHA256
dc1b3590865674477d9ead9b39a6627ccbc4b61421563b29b9bc1e4425d154aa

SHA512
09f9595d7518bab51a5c5d0d26b711ff93f5c2f18cf26b0cdf8dd96d6ecd6e3fd46fcbb46a3fc4937e2e65801513ebcaad358949c8190c1e56e634a2ea632457

Download Submit
C:\Users\Admin\Downloads\windowsdesktop-runtime-7.0.15-win-x64.exe

Filesize
30.0MB

MD5
271b4cf43711d0c54befda3cbaa48f22

SHA1
eb5d83783cdacaeb49af9bdd61a280ad539644f1

SHA256
59600e77728ce160922986af1d74df4186115a4510c4f5745c23e5ad61c37768

SHA512
a50ae7084a5ecf375ff9e21a64c9bae5ff2b50e8306cc5d9589aaade323fa89abebf5d374af883b177ba49d66b86472b0bd70a481fe74f59910b0f7007435d82

Download Submit
C:\Users\Admin\Downloads\windowsdesktop-runtime-7.0.15-win-x64.exe

Filesize
12.8MB

MD5
24fcc42f9e801ec0bb94fca4fe9a21fa

SHA1
75945431e098be5bbdc966d347a61ebacf929946

SHA256
949092c1e276b5be181cc6efe718c56b9fc77d36ab0905fea160ed504195af21

SHA512
96616e69d09915c16c3817f7469abb1211f79f5f8a28580e2882a61fffb0d3bb3739488545686d87df60f2c714cb93b4b16f93388b0d38d50710f652d88183ed

Download Submit
C:\Users\Admin\Downloads\windowsdesktop-runtime-7.0.15-win-x64.exe

Filesize
19.0MB

MD5
7f2158e000818adf9829a581f40f9852

SHA1
78046f4371d58aec63061e4a2a0089c6baa89841

SHA256
4cb1b4be0b30c34a904b222e3bbaeb78e1cb510cc3f81a6cf1d6460758e5a8cf

SHA512
d6be32f2676308ed72a13cc118a016be1f21c6cadb5e2839ffcf88789d58da1ab027d3eec7db6c51b8ce62388bbf65ec0dfa12e34bcaa821bb7160b4bd95a49b

Download Submit
C:\Windows\Installer\MSI8122.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\e587ccc.msi

Filesize
962KB

MD5
d54218f075eb73158dc6cecfac637a7a

SHA1
6e1663740a76f2c5ea94780b40bd6a8bad42405c

SHA256
c9b58ae04cf94c6915b65eddef89d2054bc4edfac3a77cc54191140fac49a3f7

SHA512
54ca4ade12bf08adc83571e9c23e8b9452625a827067cebf85e9dab5f6f5514b9202d42d0cd6a5e440e3114d181d11819451fa12cc42c9c34647a6128cd1efbc

Download Submit
C:\Windows\Installer\e587ce0.msi

Filesize
620KB

MD5
e7c99faafa34680af1988a493c9aaa43

SHA1
080e151c7f3742878fc8a71b1e52f49700ccad72

SHA256
c9ed26901a7529cd959c0aab59e3fdd87dc75742ea12f448a57450a3a7f103e5

SHA512
731c0feb095871f5a2b016c14ffbd62b146a459db7534f282178434ebdf26edfe354d222cf30262bfd2dd7d62b6671a57c472db5fba6940a205a810c8a720c95

Download Submit
C:\Windows\Temp\{429007D8-E9C9-4CE9-A695-6E7D74EDE452}\.ba\bg.png

Filesize
4KB

MD5
9eb0320dfbf2bd541e6a55c01ddc9f20

SHA1
eb282a66d29594346531b1ff886d455e1dcd6d99

SHA256
9095bf7b6baa0107b40a4a6d727215be077133a190f4ca9bd89a176842141e79

SHA512
9ada3a1757a493fbb004bd767fab8f77430af69d71479f340b8b8ede904cc94cd733700db593a4a2d2e1184c0081fd0648318d867128e1cb461021314990931d

Download Submit
C:\Windows\Temp\{429007D8-E9C9-4CE9-A695-6E7D74EDE452}\.ba\wixstdba.dll

Filesize
197KB

MD5
4356ee50f0b1a878e270614780ddf095

SHA1
b5c0915f023b2e4ed3e122322abc40c4437909af

SHA256
41a8787fdc9467f563438daba4131191aa1eb588a81beb9a89fe8bd886c16104

SHA512
b9e482efe9189683dabfc9feff8b386d7eba4ecf070f42a1eebee6052cfb181a19497f831f1ea6429cfcce1d4865a5d279b24bd738d702902e9887bb9f0c4691

Download Submit
C:\Windows\Temp\{429007D8-E9C9-4CE9-A695-6E7D74EDE452}\dotnet_host_7.0.15_win_x64.msi

Filesize
744KB

MD5
58ebd7bd6984491f452d7703116f0925

SHA1
a521e77e3b872f54701340fb8107060c62b4fc49

SHA256
b9234dd78a0cdb9ba4deb68a976b9a650f2fd211905f3ef30fea6f79a98627f6

SHA512
296536d442f230631643966e204816f6be01ecd9725d97ab83312b3314dae6f06780b572735abb436c5cf98a6999fa793540f06938c42a6a8d1da2fec6755990

Download Submit
C:\Windows\Temp\{429007D8-E9C9-4CE9-A695-6E7D74EDE452}\dotnet_hostfxr_7.0.15_win_x64.msi

Filesize
808KB

MD5
b3af438bf294d5b416e10a373782ef75

SHA1
a78e91daa38440cb41d19894baffb505bf1c36a2

SHA256
3effc9ddf7dff0993858e67df6db15d0f48410190266d5f5b109f516207d44d2

SHA512
6cb60c10ea6fe62e39b9e27955a048bf62c64ea11fc982fceb55fffb184e7c149828ebec80596b16b30b0776714ab43aeaeed6758774abb6b5afeab3db3658af

Download Submit
C:\Windows\Temp\{429007D8-E9C9-4CE9-A695-6E7D74EDE452}\dotnet_runtime_7.0.15_win_x64.msi

Filesize
1.3MB

MD5
d26494bc697b70f56fe1ad78d40dca3d

SHA1
6ad554e49483ce542be6625c0f4108146a4ad65c

SHA256
37ea38a37f9cc8f189856b22f4ec7866db06cc2250a0d88301e9d8611b82140f

SHA512
d5f2d3aecc132eeecc25a6e1a9bf05bbdb8c9ded592583fea2a7961a7792efc1a567fce30ec0f731fc5005cc722e3fa1f3c70a4631b70076cd9f7ea1f6b23a43

Download Submit
C:\Windows\Temp\{429007D8-E9C9-4CE9-A695-6E7D74EDE452}\windowsdesktop_runtime_7.0.15_win_x64.msi

Filesize
996KB

MD5
ffb0bd2081a48bf3d85f12022872b49d

SHA1
ae7f7415d1ef5cc8155c4b8e4208c9282fe80e41

SHA256
4677212c34b296718e0a145cc8cd234c1f4a3a4c8c74aaac52019b3162378b82

SHA512
d1428eb90b57a85b7c2ac40308fbd6e5a415027dbe04484884bcfbf373f65b4e0499bc3bb80c9f3b9186b5b6187c22a1a4e71940e8a84436db231669082002d5

Download Submit
C:\Windows\Temp\{C6F8E1D9-ADC0-4084-B9D7-A14D297E03AB}\.cr\windowsdesktop-runtime-7.0.15-win-x64.exe

Filesize
610KB

MD5
ea1e554e02b09aeba526503524f53129

SHA1
0f4b401ce6bc9ad17da0aaa23c02b2061b9d1d44

SHA256
4178b0b96f8d16e799d53bd83cecedf7d8ad36306061acadfa7fc3886344c825

SHA512
638e1a2224c5d4b5e397f86b5bc8a43f6fed36c29888c33916b99c9ce9208bbb28218870f9980ec0594b3feddff0f50493194ae28a51a3feaf0a99f19ca643b3

Download Submit