bc7cacf8352f528b20702cd768f57927f7b4c5b697f61942a8574eee9a7de050

Analysis

max time kernel
122s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
19/02/2024, 16:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

File Minecraft Story Mode.Complete Season.zi...msi
Size

4.5MB
MD5

b63bd820a14d8acfbda0eedd7a884268
SHA1

207cbda7e194c02e076984b3ee8edde9475ae426
SHA256

bc7cacf8352f528b20702cd768f57927f7b4c5b697f61942a8574eee9a7de050
SHA512

c632b2a211f8a3e121c927e83a280db4a871d57764557d4b30e3a343ee018fac91a1d5eb9d53d5b61277fe8930c52850981de6fad104522c3e8afc33932999be
SSDEEP

49152:I9ReWK9YwPhH9D+05jvLHd3P9zmH5HhvRaleHBG5q7vG6f4dCItiGS5oW8XlT45N:KmD+ypP0qlehb+Wai0V4BP

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 5 IoCs

flow	pid	Process
4	3268	msiexec.exe
6	3268	msiexec.exe
34	3836	MsiExec.exe
36	3836	MsiExec.exe
80	4836	powershell.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
59	api.ipify.org
60	api.ipify.org

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Control Panel\International\Geo\Nation	MSI93EE.tmp

Drops file in System32 directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\86844F70250DD8EF225D6B4178798C21_44AD5D0C299F1D4EE038B125B5E5863A	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\86844F70250DD8EF225D6B4178798C21_44AD5D0C299F1D4EE038B125B5E5863A	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94D97B1EC1F43DD6ED4FE7AB95E144BC_8DDC04EFB297854B49541C723EC3D642	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94D97B1EC1F43DD6ED4FE7AB95E144BC_8DDC04EFB297854B49541C723EC3D642	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77003E887FC21E505B9E28CBA30E18ED_8ACE642DC0A43382FABA7AE806561A50	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77003E887FC21E505B9E28CBA30E18ED_8ACE642DC0A43382FABA7AE806561A50	powershell.exe

Drops file in Windows directory 21 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI8486.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8797.tmp	msiexec.exe
File created	C:\Windows\Installer\e57813a.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9380.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI81C3.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI832B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI83E8.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8533.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{BA2F59D5-EAC4-4AF1-92B1-38FC41794BD9}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI93EE.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI83C8.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\AI_A662.ps1	aipackagechainer.exe
File created	C:\Windows\Installer\e578136.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI862E.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI88D0.tmp	msiexec.exe
File opened for modification	C:\Windows\SystemTemp\AI_A662.ps1	aipackagechainer.exe
File opened for modification	C:\Windows\Installer\e578136.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI86BB.tmp	msiexec.exe

Executes dropped EXE 2 IoCs

pid	Process
3120	aipackagechainer.exe
3320	MSI93EE.tmp

Loads dropped DLL 9 IoCs

pid	Process
3836	MsiExec.exe
3836	MsiExec.exe
3836	MsiExec.exe
3836	MsiExec.exe
3836	MsiExec.exe
3836	MsiExec.exe
3836	MsiExec.exe
3836	MsiExec.exe
3836	MsiExec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5720	4836	WerFault.exe	114

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000cdbedf05adb60d680000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000cdbedf050000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900cdbedf05000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dcdbedf05000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000cdbedf0500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\24	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\InterbootContext	aipackagechainer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	aipackagechainer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe

Modifies registry class 21 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5D95F2AB4CAE1FA4291B83CF1497B49D\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5D95F2AB4CAE1FA4291B83CF1497B49D\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5D95F2AB4CAE1FA4291B83CF1497B49D\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5D95F2AB4CAE1FA4291B83CF1497B49D\SourceList\Net	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5D95F2AB4CAE1FA4291B83CF1497B49D\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-768304381-2824894965-3840216961-1000\{F10B770D-3567-4294-98F7-0B9B07755192}	msedge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5D95F2AB4CAE1FA4291B83CF1497B49D\Version = "16777216"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5D95F2AB4CAE1FA4291B83CF1497B49D\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\16EF8B390B1CF7F47B1CF3A018AFFFA0	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5D95F2AB4CAE1FA4291B83CF1497B49D\SourceList\PackageName = "File Minecraft Story Mode.Complete Season.zi...msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5D95F2AB4CAE1FA4291B83CF1497B49D\MainFeature	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5D95F2AB4CAE1FA4291B83CF1497B49D\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\16EF8B390B1CF7F47B1CF3A018AFFFA0\5D95F2AB4CAE1FA4291B83CF1497B49D	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5D95F2AB4CAE1FA4291B83CF1497B49D\PackageCode = "43F352E0A17FF884E86998E210BD8CCA"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5D95F2AB4CAE1FA4291B83CF1497B49D\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5D95F2AB4CAE1FA4291B83CF1497B49D\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5D95F2AB4CAE1FA4291B83CF1497B49D\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5D95F2AB4CAE1FA4291B83CF1497B49D\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5D95F2AB4CAE1FA4291B83CF1497B49D	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5D95F2AB4CAE1FA4291B83CF1497B49D	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5D95F2AB4CAE1FA4291B83CF1497B49D\ProductName = "Global Installs"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
4572	msiexec.exe
4572	msiexec.exe
2396	msedge.exe
2396	msedge.exe
1840	msedge.exe
1840	msedge.exe
4836	powershell.exe
4836	powershell.exe
4836	powershell.exe
592	identity_helper.exe
592	identity_helper.exe
5236	powershell.exe
5236	powershell.exe
5236	powershell.exe
5432	powershell.exe
5432	powershell.exe
5432	powershell.exe
5580	powershell.exe
5580	powershell.exe
5580	powershell.exe
5792	powershell.exe
5792	powershell.exe
5260	msedge.exe
5260	msedge.exe
740	chrome.exe
740	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 20 IoCs

pid	Process
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3268	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3268	msiexec.exe
Token: SeSecurityPrivilege	4572	msiexec.exe
Token: SeCreateTokenPrivilege	3268	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3268	msiexec.exe
Token: SeLockMemoryPrivilege	3268	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3268	msiexec.exe
Token: SeMachineAccountPrivilege	3268	msiexec.exe
Token: SeTcbPrivilege	3268	msiexec.exe
Token: SeSecurityPrivilege	3268	msiexec.exe
Token: SeTakeOwnershipPrivilege	3268	msiexec.exe
Token: SeLoadDriverPrivilege	3268	msiexec.exe
Token: SeSystemProfilePrivilege	3268	msiexec.exe
Token: SeSystemtimePrivilege	3268	msiexec.exe
Token: SeProfSingleProcessPrivilege	3268	msiexec.exe
Token: SeIncBasePriorityPrivilege	3268	msiexec.exe
Token: SeCreatePagefilePrivilege	3268	msiexec.exe
Token: SeCreatePermanentPrivilege	3268	msiexec.exe
Token: SeBackupPrivilege	3268	msiexec.exe
Token: SeRestorePrivilege	3268	msiexec.exe
Token: SeShutdownPrivilege	3268	msiexec.exe
Token: SeDebugPrivilege	3268	msiexec.exe
Token: SeAuditPrivilege	3268	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3268	msiexec.exe
Token: SeChangeNotifyPrivilege	3268	msiexec.exe
Token: SeRemoteShutdownPrivilege	3268	msiexec.exe
Token: SeUndockPrivilege	3268	msiexec.exe
Token: SeSyncAgentPrivilege	3268	msiexec.exe
Token: SeEnableDelegationPrivilege	3268	msiexec.exe
Token: SeManageVolumePrivilege	3268	msiexec.exe
Token: SeImpersonatePrivilege	3268	msiexec.exe
Token: SeCreateGlobalPrivilege	3268	msiexec.exe
Token: SeBackupPrivilege	464	vssvc.exe
Token: SeRestorePrivilege	464	vssvc.exe
Token: SeAuditPrivilege	464	vssvc.exe
Token: SeBackupPrivilege	4572	msiexec.exe
Token: SeRestorePrivilege	4572	msiexec.exe
Token: SeRestorePrivilege	4572	msiexec.exe
Token: SeTakeOwnershipPrivilege	4572	msiexec.exe
Token: SeRestorePrivilege	4572	msiexec.exe
Token: SeTakeOwnershipPrivilege	4572	msiexec.exe
Token: SeRestorePrivilege	4572	msiexec.exe
Token: SeTakeOwnershipPrivilege	4572	msiexec.exe
Token: SeRestorePrivilege	4572	msiexec.exe
Token: SeTakeOwnershipPrivilege	4572	msiexec.exe
Token: SeRestorePrivilege	4572	msiexec.exe
Token: SeTakeOwnershipPrivilege	4572	msiexec.exe
Token: SeRestorePrivilege	4572	msiexec.exe
Token: SeTakeOwnershipPrivilege	4572	msiexec.exe
Token: SeRestorePrivilege	4572	msiexec.exe
Token: SeTakeOwnershipPrivilege	4572	msiexec.exe
Token: SeRestorePrivilege	4572	msiexec.exe
Token: SeTakeOwnershipPrivilege	4572	msiexec.exe
Token: SeRestorePrivilege	4572	msiexec.exe
Token: SeTakeOwnershipPrivilege	4572	msiexec.exe
Token: SeRestorePrivilege	4572	msiexec.exe
Token: SeTakeOwnershipPrivilege	4572	msiexec.exe
Token: SeRestorePrivilege	4572	msiexec.exe
Token: SeTakeOwnershipPrivilege	4572	msiexec.exe
Token: SeRestorePrivilege	4572	msiexec.exe
Token: SeTakeOwnershipPrivilege	4572	msiexec.exe
Token: SeRestorePrivilege	4572	msiexec.exe
Token: SeTakeOwnershipPrivilege	4572	msiexec.exe
Token: SeRestorePrivilege	4572	msiexec.exe

Suspicious use of FindShellTrayWindow 59 IoCs

pid	Process
3268	msiexec.exe
3120	aipackagechainer.exe
224	msiexec.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
3268	msiexec.exe
224	msiexec.exe
3120	aipackagechainer.exe
1840	msedge.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe

Suspicious use of SendNotifyMessage 48 IoCs

pid	Process
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4572 wrote to memory of 4388	4572	msiexec.exe	96
PID 4572 wrote to memory of 4388	4572	msiexec.exe	96
PID 4572 wrote to memory of 3836	4572	msiexec.exe	98
PID 4572 wrote to memory of 3836	4572	msiexec.exe	98
PID 4572 wrote to memory of 3836	4572	msiexec.exe	98
PID 4572 wrote to memory of 3120	4572	msiexec.exe	99
PID 4572 wrote to memory of 3120	4572	msiexec.exe	99
PID 4572 wrote to memory of 3120	4572	msiexec.exe	99
PID 4572 wrote to memory of 3320	4572	msiexec.exe	100
PID 4572 wrote to memory of 3320	4572	msiexec.exe	100
PID 4572 wrote to memory of 3320	4572	msiexec.exe	100
PID 1840 wrote to memory of 5040	1840	msedge.exe	102
PID 1840 wrote to memory of 5040	1840	msedge.exe	102
PID 3120 wrote to memory of 224	3120	aipackagechainer.exe	103
PID 3120 wrote to memory of 224	3120	aipackagechainer.exe	103
PID 3120 wrote to memory of 224	3120	aipackagechainer.exe	103
PID 1840 wrote to memory of 1004	1840	msedge.exe	105
PID 1840 wrote to memory of 1004	1840	msedge.exe	105
PID 1840 wrote to memory of 1004	1840	msedge.exe	105
PID 1840 wrote to memory of 1004	1840	msedge.exe	105
PID 1840 wrote to memory of 1004	1840	msedge.exe	105
PID 1840 wrote to memory of 1004	1840	msedge.exe	105
PID 1840 wrote to memory of 1004	1840	msedge.exe	105
PID 1840 wrote to memory of 1004	1840	msedge.exe	105
PID 1840 wrote to memory of 1004	1840	msedge.exe	105
PID 1840 wrote to memory of 1004	1840	msedge.exe	105
PID 1840 wrote to memory of 1004	1840	msedge.exe	105
PID 1840 wrote to memory of 1004	1840	msedge.exe	105
PID 1840 wrote to memory of 1004	1840	msedge.exe	105
PID 1840 wrote to memory of 1004	1840	msedge.exe	105
PID 1840 wrote to memory of 1004	1840	msedge.exe	105
PID 1840 wrote to memory of 1004	1840	msedge.exe	105
PID 1840 wrote to memory of 1004	1840	msedge.exe	105
PID 1840 wrote to memory of 1004	1840	msedge.exe	105
PID 1840 wrote to memory of 1004	1840	msedge.exe	105
PID 1840 wrote to memory of 1004	1840	msedge.exe	105
PID 1840 wrote to memory of 1004	1840	msedge.exe	105
PID 1840 wrote to memory of 1004	1840	msedge.exe	105
PID 1840 wrote to memory of 1004	1840	msedge.exe	105
PID 1840 wrote to memory of 1004	1840	msedge.exe	105
PID 1840 wrote to memory of 1004	1840	msedge.exe	105
PID 1840 wrote to memory of 1004	1840	msedge.exe	105
PID 1840 wrote to memory of 1004	1840	msedge.exe	105
PID 1840 wrote to memory of 1004	1840	msedge.exe	105
PID 1840 wrote to memory of 1004	1840	msedge.exe	105
PID 1840 wrote to memory of 1004	1840	msedge.exe	105
PID 1840 wrote to memory of 1004	1840	msedge.exe	105
PID 1840 wrote to memory of 1004	1840	msedge.exe	105
PID 1840 wrote to memory of 1004	1840	msedge.exe	105
PID 1840 wrote to memory of 1004	1840	msedge.exe	105
PID 1840 wrote to memory of 1004	1840	msedge.exe	105
PID 1840 wrote to memory of 1004	1840	msedge.exe	105
PID 1840 wrote to memory of 1004	1840	msedge.exe	105
PID 1840 wrote to memory of 1004	1840	msedge.exe	105
PID 1840 wrote to memory of 1004	1840	msedge.exe	105
PID 1840 wrote to memory of 1004	1840	msedge.exe	105
PID 1840 wrote to memory of 2396	1840	msedge.exe	104
PID 1840 wrote to memory of 2396	1840	msedge.exe	104
PID 1840 wrote to memory of 2624	1840	msedge.exe	106
PID 1840 wrote to memory of 2624	1840	msedge.exe	106
PID 1840 wrote to memory of 2624	1840	msedge.exe	106
PID 1840 wrote to memory of 2624	1840	msedge.exe	106
PID 1840 wrote to memory of 2624	1840	msedge.exe	106
PID 1840 wrote to memory of 2624	1840	msedge.exe	106

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I "C:\Users\Admin\AppData\Local\Temp\File Minecraft Story Mode.Complete Season.zi...msi"
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3268

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4572
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:4388
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 5520121CCA56532CA845236331BAE6FA
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  PID:3836
- C:\Users\Admin\AppData\Roaming\GlobalCo\Global Installs\prerequisites\aipackagechainer.exe
  "C:\Users\Admin\AppData\Roaming\GlobalCo\Global Installs\prerequisites\aipackagechainer.exe"
  2⤵
  - Drops file in Windows directory
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3120
- - C:\Windows\SysWOW64\msiexec.exe
    msiexec.exe /i "C:\Users\Admin\AppData\Roaming\GlobalCo\Global Installs\prerequisites\Required Application\GlobalInstaller.msi"
    3⤵
    - Enumerates connected drives
    - Suspicious use of FindShellTrayWindow
    PID:224
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -NoLogo -ExecutionPolicy RemoteSigned -Command "C:\Windows\SystemTemp\AI_A662.ps1 -paths 'C:\Users\Admin\AppData\Roaming\GlobalCo\Global Installs\prerequisites\file_deleter.ps1','C:\Users\Admin\AppData\Roaming\GlobalCo\Global Installs\prerequisites\aipackagechainer.exe','C:\Users\Admin\AppData\Roaming\GlobalCo\Global Installs','C:\Users\Admin\AppData\Roaming\GlobalCo' -retry_count 10"
    3⤵
    - Blocklisted process makes network request
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    PID:4836
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
      4⤵
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      PID:5236
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
      4⤵
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      PID:5432
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
      4⤵
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      PID:5580
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4836 -s 2676
      4⤵
      Program crash
      PID:5720
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
      4⤵
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      PID:5792
- C:\Windows\Installer\MSI93EE.tmp
  "C:\Windows\Installer\MSI93EE.tmp" https://typagesee.io/ty
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:3320
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://typagesee.io/ty
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:1840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcf39f46f8,0x7ffcf39f4708,0x7ffcf39f4718
      4⤵
      PID:5040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,3027858212174802564,17131963857845233889,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,3027858212174802564,17131963857845233889,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
      4⤵
      PID:1004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,3027858212174802564,17131963857845233889,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2768 /prefetch:8
      4⤵
      PID:2624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,3027858212174802564,17131963857845233889,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
      4⤵
      PID:4468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,3027858212174802564,17131963857845233889,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
      4⤵
      PID:3004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,3027858212174802564,17131963857845233889,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4092 /prefetch:1
      4⤵
      PID:4804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,3027858212174802564,17131963857845233889,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5484 /prefetch:8
      4⤵
      PID:4496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,3027858212174802564,17131963857845233889,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5484 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,3027858212174802564,17131963857845233889,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5524 /prefetch:1
      4⤵
      PID:2388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,3027858212174802564,17131963857845233889,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
      4⤵
      PID:5080
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,3027858212174802564,17131963857845233889,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:1
      4⤵
      PID:5228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,3027858212174802564,17131963857845233889,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4064 /prefetch:1
      4⤵
      PID:5220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,3027858212174802564,17131963857845233889,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3884 /prefetch:1
      4⤵
      PID:5160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,3027858212174802564,17131963857845233889,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:1
      4⤵
      PID:5952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,3027858212174802564,17131963857845233889,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3440 /prefetch:1
      4⤵
      PID:5704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,3027858212174802564,17131963857845233889,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5328 /prefetch:1
      4⤵
      PID:2672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2084,3027858212174802564,17131963857845233889,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5224 /prefetch:8
      4⤵
      PID:5336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2084,3027858212174802564,17131963857845233889,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=3844 /prefetch:8
      4⤵
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      PID:5260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,3027858212174802564,17131963857845233889,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3868 /prefetch:1
      4⤵
      PID:6140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,3027858212174802564,17131963857845233889,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5716 /prefetch:1
      4⤵
      PID:4132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,3027858212174802564,17131963857845233889,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
      4⤵
      PID:5168
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,3027858212174802564,17131963857845233889,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6248 /prefetch:1
      4⤵
      PID:5604
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,3027858212174802564,17131963857845233889,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6400 /prefetch:1
      4⤵
      PID:5124

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:464

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3896

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4836 -ip 4836
1⤵
PID:5648

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x11c,0x120,0x124,0x100,0x128,0x7ffd03fb9758,0x7ffd03fb9768,0x7ffd03fb9778
  2⤵
  PID:552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1808 --field-trial-handle=1956,i,5365640229361964145,3771148391288614435,131072 /prefetch:2
  2⤵
  PID:5184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1956,i,5365640229361964145,3771148391288614435,131072 /prefetch:8
  2⤵
  PID:5276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2252 --field-trial-handle=1956,i,5365640229361964145,3771148391288614435,131072 /prefetch:8
  2⤵
  PID:5824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3144 --field-trial-handle=1956,i,5365640229361964145,3771148391288614435,131072 /prefetch:1
  2⤵
  PID:2360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3156 --field-trial-handle=1956,i,5365640229361964145,3771148391288614435,131072 /prefetch:1
  2⤵
  PID:2380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4724 --field-trial-handle=1956,i,5365640229361964145,3771148391288614435,131072 /prefetch:1
  2⤵
  PID:5084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5200 --field-trial-handle=1956,i,5365640229361964145,3771148391288614435,131072 /prefetch:8
  2⤵
  PID:3836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5300 --field-trial-handle=1956,i,5365640229361964145,3771148391288614435,131072 /prefetch:8
  2⤵
  PID:5752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5336 --field-trial-handle=1956,i,5365640229361964145,3771148391288614435,131072 /prefetch:8
  2⤵
  PID:5056
- C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe
  "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe" --reenable-autoupdates --system-level
  2⤵
  PID:5548
- - C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe
    "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x254,0x258,0x25c,0x230,0x260,0x7ff75fcc7688,0x7ff75fcc7698,0x7ff75fcc76a8
    3⤵
    PID:5636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=5368 --field-trial-handle=1956,i,5365640229361964145,3771148391288614435,131072 /prefetch:1
  2⤵
  PID:1628

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:3320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e578139.rbs

Filesize
7KB

MD5
1c4a57bde5d49a1f112038de6ebb4280

SHA1
144baa6615993386cd6ee3ccd988779c55aadbcd

SHA256
ac8f454449403379651e2955c026d3b5e9e4fa33023332a88df711dcb4b6f189

SHA512
136f74442a3f5cc1bd53b3f2c04e893628a72c05d5cf9ceb5c9d12a7be73e70f38bc49f5319ff0addcc8457e81ac53f480b2e3b43be942146c0f0ec21b93780d

Download Submit
C:\Config.Msi\e57813b.rbs

Filesize
438B

MD5
372cd43bce4896f436c2d99f60e9b768

SHA1
8a71426cfc52ac9562c0d3a04bd48b34ba4de511

SHA256
0f1cd31626ff70683736f8e64a6bd36827d8a5ffc561a4d8e4216b0109e7e634

SHA512
8d4045f82daf72f6c4ed94c6f1c44043a8c7ca20efdbd8c8ffa2e44c08ff72942fa37bdf0da477c82a09962454a64e2748bcd46cccc747a79aed7121ddb1b51e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
5b1e61565370ced4389e1fb9cf2eea34

SHA1
b3247b7d4a124b21c5acb430f207dfacf097f1bf

SHA256
98c2b007222adfaa8b008a1088da7cdf8f49a4edea94dda5913549eb607f0f74

SHA512
c9cd08e193323351b5b6ef9e3ad5062e1072242a0d4380e7d6dec73a7ffa23a0283eb8ef5595bfd86a4d87ba53c0c5bdb8a83454e856160f42dba7c7f92ed362

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\357F04AD41BCF5FE18FCB69F60C6680F_D2FED7667885036CFA51478CED551D86

Filesize
1KB

MD5
52ca4020fba04f9a1e9e4892793031e4

SHA1
28400f04b24c7d600d894a896cf620ce65dd2643

SHA256
afaa2182228a6a15a994bee96bda87f6643735510c03d31d4fb6b500da2bbe7c

SHA512
bfba1f16b9702287ca50f9ef70dd521803a9c256d77c6dfeda3224084db94b067fd41f02e7c18c0badb3ed5d26509f937139a2b13e64069fcd449158dc78429d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E

Filesize
1KB

MD5
bb433a1a60aee074b7cc0c69f4cb8d3d

SHA1
4ef2172e5246505b16c7e56783f53ec88293f212

SHA256
618606818ce07a97cbb2f4c77ae93fd25dd4cd3c04843960c3c8930a2af184c8

SHA512
ab57f8771a19b8ad58b09a687fb0989839adc5e8b57a41c72364d8230d95f91c95f78fa44ebd66f99c349cd9b0a5236701ed6754afae4b3fcd827d111b5e97f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

Filesize
724B

MD5
8202a1cd02e7d69597995cabbe881a12

SHA1
8858d9d934b7aa9330ee73de6c476acf19929ff6

SHA256
58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5

SHA512
97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
30b6e45ee1e6ca8dc67a5ab7cc0e09f3

SHA1
cb74140577c39f35844e54a6d0bfb683de44d3e5

SHA256
0e9356143b85a08e251318bed18009b8f4776b8222a0d8c95cd42e71603bb387

SHA512
49dd4c09c6bff3e78847b69d45126e98576637eda54ef08b8994e1ae8a30431a7f9b432f2b3c7f7511e5e12c41338d313a8011fe9396a8f3ba665173f0b4c62c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\357F04AD41BCF5FE18FCB69F60C6680F_D2FED7667885036CFA51478CED551D86

Filesize
540B

MD5
07e4c8eebde8a6ffa41a548d9340054c

SHA1
5652c7ca28fa0a0efec1d6dfbda47c033222fd04

SHA256
4ab31ba6e3850dc8d78fb5d7ff8c9252815f41b37222e50be3b1bb3841b4f179

SHA512
9be51eaa3f58bb499950564afc365ad88934af9c45fd0d1cd3733ff65aff5d08a7c14750c44db4b5a0aef5c92c59209b708c1903c512990850724f26a7e4db05

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E

Filesize
536B

MD5
f312b11e6b4918e08b00dbbabd06f6b4

SHA1
96c5f0f5d1a97cce08fa90fc7e6f94c7438601bb

SHA256
98fe3357bd66ed0e9a3aa70ca47f1e3eff51b3a912e829540cd3fbaa0c258c84

SHA512
89d27d16d20bbca2560700e211517f3c4fc893cc09194a62169aebf70f57eedbe5c1ef5a0c3e38dc239dc0b12062c84761ece876527d18055d525e0d2d168b49

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

Filesize
392B

MD5
3a05fa665f551d0c8a15316a25c68e7e

SHA1
2902bf067dba7897ca14b87974fff04d1ca3b820

SHA256
dd360303a276e5839183965be98f8f8253c0084173d4087d21409a0fef309ffc

SHA512
f97a0e855c4615b4867598f57864bc3e36de28a197aba1c984061ab3b575f309483d458b8133cbd4d2bfbe44beefb85a9ef799e1de9437750174680504c84bf8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007

Filesize
24KB

MD5
b82ca47ee5d42100e589bdd94e57936e

SHA1
0dad0cd7d0472248b9b409b02122d13bab513b4c

SHA256
d3c59060e591b3839ec59cad150c0a38a2a2a6ba4cc4dc5530f68be54f14ef1d

SHA512
58840a773a3a6cb0913e6a542934daecaef9c0eeab626446a29a70cd6d063fdb012229ff2ccfa283e3c05bc2a91a7cac331293965264715bdb9020f162dc7383

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
0a1e8fece682eb5dbbbd061b66267b09

SHA1
d2fedbedd569808a7b7ba497789c7756d6c05b65

SHA256
a43cbd1e54ce2eebc30d95366dd9746dd7a0983d7a4500be05b261fb19746f8c

SHA512
1f27d68128fbb26962a095ec308528261862586994fd0f0daafbd1a0bf179446d0f08a447ff5ff0a7b7ee8b19ce10dbfc64b8f31f21c1489e23d60c45dd18c69

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
b2f36551176df52546e91ced66cb2a9f

SHA1
023410e776c3b0334be25ea0154eafbeaa86aace

SHA256
04f06ab50302e8686112db6881ce5a8f88f1c090f1560bda169fcb90d5678db8

SHA512
98f4d207e126435230e7d4e1f8a9507e0ebda3b2cd26d75e287ef5039942336b95588badb61ab076733bcf141c2b2aa893a5ff03f9eb8c138014c8d420afc0dd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
371B

MD5
8b3ee3f952419a17af5e977930596bdc

SHA1
d1118a883b58462e2ccba23bd3f5fe7174b53c1a

SHA256
564cc5b1f54e8daff4d5da641cc4bb8bb1b6f185027e49dfaebac0a3557a3d2d

SHA512
c0237ddac2b9439396fb5ae5cf839bd50fdbb921f4d06978706a72f019d5ade1453af83d05ad18f2e6fffb65f4afcff652adff8ea76bb8d8015a8a8e312af5f7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
9a6a1d48fc5f52edee54bb8f1c99ac00

SHA1
cba4b6a0570b4876c0aa589bc6512c6686642387

SHA256
e3aecbf44263e447db321d95e8e14e45ae17c8c4bdd07ee3d1a0ad693738c4c7

SHA512
a2b1fd5f155a8f31af1f509eebc3cf98e0cd278f7c9c4afdad7dca298af6fa1711368ffb23dba90b75a31e566b214567f90ebdd283edfbdb83e849b26110aae0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
0b34d57dc5c408438930f41e6b2b8a59

SHA1
f8b224aee7d936183278f2f94aa6e66ccb99f2eb

SHA256
88cf8918d9e8d0693010e3edfe52614f9859362cea638a325ad6dab09b6be8eb

SHA512
0285163a63e6d8300d9e059485fab92ac386f96155acf0a503d97fc5095574d59ebab6fb05857e4d848520b2973f610813906426fa9a7b307079b7005c97f9ec

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
8fba39c5d25f8cf8fa0f90ac5bd06884

SHA1
c85ae822b2a2b262ef0c700fcd6a229f80300e23

SHA256
43f769dd790869d651b7dd240e7cde9fa50c0abe41c3312dc8ca1442a05ba38a

SHA512
5c641c3a50cba37c0cf719b57b2867ef08d049c026db8530aed4ef194bc379cdec2f762445dcc6ee491dca4d81d3e61d0513e729c7a0b0c2d381c3d43fb3cfb1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
242KB

MD5
9e3cc9bfd2aaf44b4bf4cbbf0a02787e

SHA1
e5a13c1b4021d8a5c73c60beebaca7632cef246e

SHA256
c5e430691e38776fdde30058e465dc4dff8198064b72997c4b007ee8493f7b0d

SHA512
c094f95da0c6da94f5ec4af95906cadc64b2e53cad7924e0d2f144ad6ffcd558cfacb93d1885d5e13a9f6899f64c7cc04cad17db207d5cdc1603a7d2bd71abac

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
242KB

MD5
fc088a4133c071bfcba0f223985165fc

SHA1
56f8c6ea5712103c9444e6b3314507315b1e128f

SHA256
af228b1cab1e70d5078bf8278d8bf7dab346cea44773ae7dd22be6e57f5e4c57

SHA512
55872eb8b67fcf2dd51d2b3adaf334424dd2ff940ea1a5fef527e922f20699af2f79332649113963c9cf2818deb5867dbb793a23a1580eedd6127379807efd74

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
115KB

MD5
7ec2a88ffe5e3123b249f7f7dceb3ee3

SHA1
916cf74756d5c2e276aa8a219cb571926cec789e

SHA256
49067634568d70cd3ffd25954322dcafaf73fb0f617e2b200341b24aad76bd22

SHA512
47e74431ba331918cea8d04ff7ea4a2d88130093223bff8837efc0ed6c24cbc04f2a84faffa79a48613cb2575c1d1e7c033bae30f082d6ce0e127d867a1ef90a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
1KB

MD5
d0b07570db70ebeac52efd9130a16373

SHA1
27f6af7bdba4b097c09b10b75c417282c8bb8976

SHA256
3fe45c78c812536fe56c3eeebe7d4621e65cc3a95119cedf9bf316f72eed71c7

SHA512
fb7a161a9e3ffec85a60f46ab7d09a1281d666bbeeb0148d2fda5ec1bdee78682349e418cc8afc39dfdbe9e4fcec207c32d6f70db01e6008ae3c86394e354930

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5e77545b7e1c504b2f5ce7c5cc2ce1fe

SHA1
d81a6af13cf31fa410b85471e4509124ebeaff7e

SHA256
cbb617cd6cde793f367df016b200d35ce3c521ab901bbcb52928576bb180bc11

SHA512
cbc65c61334a8b18ece79acdb30a4af80aa9448c3edc3902b00eb48fd5038bf6013d1f3f6436c1bcb637e78c485ae8e352839ca3c9ddf7e45b3b82d23b0e6e37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

Filesize
194KB

MD5
ac84f1282f8542dee07f8a1af421f2a7

SHA1
261885284826281a99ff982428a765be30de9029

SHA256
193b8f571f3fd65b98dc39601431ff6e91ade5f90ee7790bfc1fba8f7580a4b0

SHA512
9f4f58ab43ddadad903cea3454d79b99a750f05e4d850de5f25371d5bec16fc312015a875b8f418154f1124c400ae1c82e2efd862870cd35c3f0961426c8cd82

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
2fb2ee1170aceda10a3b6795ccb5f08a

SHA1
113af416d870cbe1f3994d260865753484ad4c6f

SHA256
47e0fec3c07b3a7e5f0aa3cad375105ebb0b51bfddaab11cb5dd1aa8b7ad6271

SHA512
3e6c3cd68a5f847b1976cdafa757a49db2bcd590c180d150285c6cf9507e872d8e6a4123e87b49021a70151b4a7555c7d3b890c66a924bb44e886331ce1b22e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
7d9dedead0cf4aa7f0bf3151c006abe9

SHA1
f54103aa1d925db9d8dda8a12a3a73d3d8bf29cb

SHA256
4d3251c48ddbe51b09fe1ea51d9d9775adf39a5529a2447ed5dd172ce6ef410b

SHA512
1d7911696dd1aaf7b413ffd12eea7120a9efc9e39ab859976cb2f4bad090d4774dd8fe8dc4c0f584eb770bb8880ba613dfe0a0c4a87af9bc1416d17c6567eb0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
c7f9d77445dbcc171d1864bc6283f676

SHA1
d25b7f96e454f72914a5be32641551a5832fa334

SHA256
484af9a7ce08d1e6c2f69198684e7dcc0d8f897929712feb7d433eca2d1c5053

SHA512
86110166921ae595b94fa9b4e915983e64866421b1297b417ba430511052727e4ab9032242b0c1219c57d61897b585f09586c9172e2bbfa9ce373f12a34b3693

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
fd9679a0af11521d44ca9f89b47d8974

SHA1
bd41717c8f9060d980335f47130e798b80058ab7

SHA256
be86936af83924cbaf044a85634156b9a78fa3f62041c52233244a68545f623c

SHA512
272340b6d6a3bf63e7447b34d40c17cba3ad3d60ce99adc598403e56872c45c98efacc6bd28136c6e6f4e926baa88319a004ec9a873e34586e6ad7cb70aa327f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
63f897660b0e4719eb7a4f4344749eba

SHA1
3134fcbe59ad85def6e23f354d2e456fb737d052

SHA256
b9e19b877366979c448fd7f9ff6b4b4bbd333f02f8e6aaac44abe651858c6e46

SHA512
7afe8e347acd74a0c834c90fdd10d7b560de8ac5f05ac73c082fa17be7972b7544469cff1e57b1f883d87da14deaee12e67198e782299e50d34204a3305a6987

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d48f9f6d63bcf10c6d2af8b6a089139f

SHA1
8835f38106a6417db69b83a10f5e6993a7acd1fb

SHA256
a83e1d2f127699bae06fe8f90b3dedb3dff2378599deea0abcb645d8f7a0c679

SHA512
70dbfd6acc5cfd77e64ea5f2484323bf008b519fba7dd960bc1fc8698ac4f8bcdd916457862e4f620dbb1b7376c2b2a2d3966d1ce49f35795034d9b059da71be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
d5d7d1adf596a41d06133271cbbb0a3c

SHA1
4e9bcf8f711c68b1d7a7c5afff09abacbf3608d1

SHA256
5562a6ad616e7536b0129c92a2286cf5dabb0920f2098f1078f9551529f9885c

SHA512
ccc1c59cde0b815c4c9c5d308143021df86051ad72f2310d94418a5bfe390ea7cbc4628a6160201f456ad324e6878f6e5d48f1a0f7aee68495cbabc01afb323b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
c65f51072e2f0d6e9489485a12c33dba

SHA1
3413ee2ec5a95e33df3f204718d30b6825e4ed45

SHA256
56e1735d53f770289a08be9a28efc2d757b39546932faf346d479ea53a483caf

SHA512
f1f31c868c8c8c2e0e672df38408f8a2cdc0b7d5c30f3b3a9f7234734219f11727874f5d1b4345244e43b5e2d75c8a902a4898f43fce0b8a585477954b647017

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
347db30e97224ce62472f4c823cea83d

SHA1
3b02a337490ae641a72dbfc4f179e1d5b7ce4a25

SHA256
d9fa40cdea5999a63daf80bd448ab8f544dd8c042e133488b3d4165464b87169

SHA512
c8eb208a527026a5639e10daf0a1a3efbff31df6150a6511833fbd00fbbbb99b19c14c599f7bfd18fcc02df6e7e525aff0ba39bb7720a4feba62ec2910aa7f9e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
6db2d2ceb22a030bd1caa72b32cfbf98

SHA1
fe50f35e60f88624a28b93b8a76be1377957618b

SHA256
7b22b0b16088ab7f7d6f938d7cfe9ae807856662ce3a63e7de6c8107186853e4

SHA512
d5a67a394003f559c98e1a1e9e31c2d473d04cc075b08bb0aab115ce42744da536895df2cec73fa54fc36f38d38e4906680cfacfbf4698ee925f1609fbb07912

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
bd73207fa637aaa7fc773ba8db2a0fd9

SHA1
675c90aa14891fae31aef1f4b6f6a6cb068d9129

SHA256
1317f8b86e2585f492a91d851655d893ea5c586dce6e07696880872d2b47c160

SHA512
f0c001d3f5e4c99105fd973730bafc61edcb38eb3d077d1a697538f3d5e7c65cdfdb8cf81cbdec48789eb416ee6741dbd722bdce57e056170f940a58b23605b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
567784a11b1f5844738f94fdf62abb8d

SHA1
29e218742c82a5b00f1793257c7740e1fc4c6018

SHA256
d7cfc69ea98ae2253d3f7def9d9ca2d3d23a1a867c888e85b8aabf4694dfa4e2

SHA512
6ef78b8aa17961dbbf63f3c4be85df5df094fcc944502d80d9503b4220ce9f7b579663677835c60a67e935c307a8d9b441ea3500879d188a7be663206aea77ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5808f4.TMP

Filesize
372B

MD5
6e95df9dd73689e2430d496d44f0ef0c

SHA1
4330e8976ae79e12ae50fc75f1f93796a420d052

SHA256
31f127b968b4c6c424640a7393ecaeefa952db1d0fe105625936d01753f8f5fa

SHA512
cf86fff3cd6e8a7d14c67b57c3878024b3b582a610e38662f224b5ce8cd81ff132716a47f2d1af1b784e373ab1f357a895c2cfe8bf95191d133203556716874b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
a0dc1600b1bf87d4e96e9ea13e4eab1a

SHA1
263cdaef9c309911205f27164831e55762684dc8

SHA256
8557ff0aae57c684af518c2bb6cd2be4b304e79df2750c7532c879fe55b030d2

SHA512
4e5cf3105da55fc95c85fd12892098639d3a9a237a1c66717f92449c6c6357267d4f7880cd150b0d5ef1a333042dc499198aeac5fdf8f52b19301a19b0a70cae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
1d9a72a976c62df1630861a790473135

SHA1
57bc4e7772f8b7f205ed9454a8939d60d4bf35a8

SHA256
b35753c7fa160cf457e706915f5bd7357ffdd730f85f81f1a910140b0da653c9

SHA512
ec3549319dc5882d0003c68aebdc566fe4f21c419e1ec27bfd1286060713fd7feb18cdf2fe3525211936fa95fdb91a336a5112376e9f666dea7870f9dc2fc18c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-ServerMode

Filesize
9KB

MD5
5d6e581cc7fef94dbbd0edd6fa02a222

SHA1
c6e58a3dc5a596689b48a35593b2e68d60ba3492

SHA256
3f4a1d2b4a1d5559ab640af5afcd450c78e2764e1fc16c202e07c67c631a7262

SHA512
55e2e03d65f43fe94462a559023eb6c43e077c80bb5b7f6cbd5a3b3fb5576b3ab67cf3aab8913333807c2a8e3782afff0760321896b4099740ff6ae564dfd385

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_eqb3kl5p.0yt.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\GlobalCo\Global Installs\prerequisites\Required Application\GlobalInstaller.msi

Filesize
6.9MB

MD5
eef59e4039662a174e6f265d77266141

SHA1
78a8e14ff5b364401c2be47273f31f9be4450578

SHA256
ede0ccb8d5257b4e6ba62e2282dfaf04f38f36e1f33f53de58581266d70ea516

SHA512
c4a0a7433ab9b8868348795331ba38d28700d07df89178f44f582677d98d55958cb6f53fb774215e43e64473ee973ef14707388dff03451aeac7642f0b2b2e4c

Download Submit
C:\Users\Admin\AppData\Roaming\GlobalCo\Global Installs\prerequisites\aipackagechainer.exe

Filesize
893KB

MD5
abd76ca201d9da05f75ee8efd6102262

SHA1
e8746e7fa1c011c1225877b0efa5f2e80941b6b4

SHA256
c3f6f44167c3888b98c7a9621caa81dc867fb99ccc91f8fc40163214444b86d5

SHA512
733f049a19f0d47b058c3d2b68ae834cb01fc399227712133aa2e01f7928aab09c60f0dcf19463101ad097b7a214b9a66088fc38849edddb77755116328d04f4

Download Submit
C:\Users\Admin\AppData\Roaming\GlobalCo\Global Installs\prerequisites\aipackagechainer.ini

Filesize
1KB

MD5
9e55e39b27c28455547d3da477a5c90c

SHA1
63f3c61a8c60e3d2e135402c666031511335072d

SHA256
d3497af972a0467a7ec866fe3d1e0cfd461adc8e46caec7fdd91258e7849b689

SHA512
73e6af779afaa4534a3d9de1056ba0860d9b059fcb0003316986f30816de718720d6b22f85c7587ac56abaffe6cc2fc39e021ac1483af0c59f394ebd3e58397d

Download Submit
C:\Users\Admin\AppData\Roaming\GlobalCo\Global Installs\prerequisites\file_deleter.ps1

Filesize
22KB

MD5
3e8a3a649d86c2e3950e01d5d29964e1

SHA1
17e06bf8ea31ecd2080b82c0c63a64ec75335e10

SHA256
551030656f5935f68edb8bf484a3bd3615abcc5db9fb380ffc7d130589308986

SHA512
92b0e8c4ddd34d264c8632165532ac67f35d47c21bcebbfd94b2a55c09a8db0bbaa59d8c4ae26f0eddac2ea3d33891dd083dc7da8c967ba63e190c434758501e

Download Submit
C:\Windows\Installer\MSI81C3.tmp

Filesize
738KB

MD5
36cd2870d577ff917ba93c9f50f86374

SHA1
e51baf257f5a3c3cd7b68690e36945fa3284e710

SHA256
8d3e94c47af3da706a9fe9e4428b2fefd5e9e6c7145e96927fffdf3dd5e472b8

SHA512
426fe493a25e99ca9630ad4706ca5ac062445391ab2087793637339f3742a5e1af2cedb4682babc0c4e7f9e06fed0b4ed543ddeb6f4e6f75c50349c0354aceda

Download Submit
C:\Windows\Installer\MSI8486.tmp

Filesize
1.1MB

MD5
7e4ef4bc701a5f46a1fee1a9fdc403f1

SHA1
ab00fc0985d7cae8ccfdae1cd4e687192f079d47

SHA256
34fe948e2b005a424f4e8aff9d9ef847d5623b99196fe5f5e9bff4983770d95a

SHA512
7f8013d024142377aad49fc2c5c30376a4b9dd6c732dbbe3d88d2377965ca9e544d7065c7ee5aa1bd9d29b51f19255335c7ac3f85b5079b1cad710dc74bb8748

Download Submit
C:\Windows\Installer\MSI8486.tmp

Filesize
344KB

MD5
9ab1762c1b758c7070bff6f020d4da8d

SHA1
14dc1f79827f1561791d7e85f2292537d48d8afd

SHA256
25fef221e659ad7e6f38e1cfe30171a1280cd22ca49eff215ac2f9ccf4f2d43f

SHA512
a91c95893cf63b09e9bde57816f58c8465dcfc2efc24b4f93a60591b6018b92f4fed381eea030fa7a1d418369b89bc9b0375b9a73a0e5ef13e2a3412a161aa90

Download Submit
C:\Windows\Installer\MSI8533.tmp

Filesize
870KB

MD5
65b853552e16654c53ab4d16920a9182

SHA1
9f8182ef1b58d0d52f4faf1688d4f4e9dd8af5c5

SHA256
80c5e769470bb98c5b1ec3be0a9a51f0821c67e9adc7e3e254bbc41183ceb76f

SHA512
b56c00e78ca901738a4a067709c772cfbdf10d3a049af4e7eb6bd7a0cb0629472d7798dabb0eb82958ae90cd71acc79e5cbc3d26b0f42d3cc7cc8ec2236aa54a

Download Submit
C:\Windows\Installer\MSI93EE.tmp

Filesize
406KB

MD5
0dfa51216250ef1cf96878c6a2151404

SHA1
8f4a62c1722ba08deca4e6fed6ef91f9f7a02673

SHA256
387f2ce4a7d2f6cc82c9058c2a579518b9ec622264b8a72e125bde6797918b2e

SHA512
6e0d4f6237d593ec756216b17832eb2a21df7f9dce12d4dde689416934eac900939fc58eb3e1f181ba55e3e5a9de152ddc7bb3418d25097133a801c85141a026

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
23.0MB

MD5
fea0117a3d0da49a7c515f36f2bf0068

SHA1
14e7b745b3503022e08b1ec19369a4df14fbfb48

SHA256
95f0601b279e8cf7e3eac7fe6cff4ad74f19292f84aa835785f4f6492ffb2bf2

SHA512
ec8fd920beb2f12cb97e5f26983cd2974f70e1c1d66091c293813d3a4f3c84599a834ae310d61b9f286ea10df56d162cb6abd1189aed80c593e8a8ab443df295

Download Submit
\??\Volume{05dfbecd-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{ad351bf9-9200-4e4b-9cca-8d54f0d0c5f9}_OnDiskSnapshotProp

Filesize
6KB

MD5
ee0caebc75d559627b00a4354682689b

SHA1
3fd4992507394f555302428301ce0c13dcd15413

SHA256
fd4756ac290d9a69c2b005f498a3c76c8a4acae4ec488328f69c973831358d7b

SHA512
988e2038e1476d7db9d577d4a5c5db9ec656038dd787f6a2943b87d0fc9633a74724ca11e999e3b8eaa32e1e29cef3e2389839ddaadd03df15182f1fe22e991f

Download Submit
memory/4836-145-0x0000000002C90000-0x0000000002CA0000-memory.dmp

Filesize
64KB

Download
memory/4836-150-0x0000000005B20000-0x0000000005B86000-memory.dmp

Filesize
408KB

Download
memory/4836-236-0x0000000074500000-0x0000000074CB0000-memory.dmp

Filesize
7.7MB

Download
memory/4836-143-0x0000000002B40000-0x0000000002B76000-memory.dmp

Filesize
216KB

Download
memory/4836-144-0x0000000074500000-0x0000000074CB0000-memory.dmp

Filesize
7.7MB

Download
memory/4836-146-0x0000000002C90000-0x0000000002CA0000-memory.dmp

Filesize
64KB

Download
memory/4836-147-0x0000000005310000-0x0000000005938000-memory.dmp

Filesize
6.2MB

Download
memory/4836-148-0x0000000005270000-0x0000000005292000-memory.dmp

Filesize
136KB

Download
memory/4836-183-0x0000000007220000-0x000000000724C000-memory.dmp

Filesize
176KB

Download
memory/4836-170-0x00000000061C0000-0x000000000620C000-memory.dmp

Filesize
304KB

Download
memory/4836-169-0x0000000006100000-0x000000000611E000-memory.dmp

Filesize
120KB

Download
memory/4836-162-0x0000000005C90000-0x0000000005FE4000-memory.dmp

Filesize
3.3MB

Download
memory/4836-149-0x0000000005A40000-0x0000000005AA6000-memory.dmp

Filesize
408KB

Download
memory/5236-245-0x0000000074500000-0x0000000074CB0000-memory.dmp

Filesize
7.7MB

Download
memory/5236-186-0x0000000005050000-0x0000000005060000-memory.dmp

Filesize
64KB

Download
memory/5236-185-0x0000000005050000-0x0000000005060000-memory.dmp

Filesize
64KB

Download
memory/5236-184-0x0000000074500000-0x0000000074CB0000-memory.dmp

Filesize
7.7MB

Download
memory/5432-196-0x0000000074500000-0x0000000074CB0000-memory.dmp

Filesize
7.7MB

Download
memory/5432-197-0x0000000002C70000-0x0000000002C80000-memory.dmp

Filesize
64KB

Download
memory/5432-247-0x0000000074500000-0x0000000074CB0000-memory.dmp

Filesize
7.7MB

Download
memory/5580-209-0x0000000002A20000-0x0000000002A30000-memory.dmp

Filesize
64KB

Download
memory/5580-208-0x0000000002A20000-0x0000000002A30000-memory.dmp

Filesize
64KB

Download
memory/5580-244-0x0000000074500000-0x0000000074CB0000-memory.dmp

Filesize
7.7MB

Download
memory/5580-207-0x0000000074500000-0x0000000074CB0000-memory.dmp

Filesize
7.7MB

Download
memory/5792-221-0x0000000005470000-0x0000000005480000-memory.dmp

Filesize
64KB

Download
memory/5792-246-0x0000000074500000-0x0000000074CB0000-memory.dmp

Filesize
7.7MB

Download
memory/5792-219-0x0000000074500000-0x0000000074CB0000-memory.dmp

Filesize
7.7MB

Download
memory/5792-220-0x0000000005470000-0x0000000005480000-memory.dmp

Filesize
64KB

Download