516ff7ec447e79f48dd8116d58aedb63b92580a768b181a37e8f487599652ef0

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
21/02/2024, 12:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

yes - Copy (2).jpg
Size

12KB
MD5

dfdce4908325a676a447b20a60196cba
SHA1

975a864d82127e0037096ce326d322020764a8d2
SHA256

516ff7ec447e79f48dd8116d58aedb63b92580a768b181a37e8f487599652ef0
SHA512

e68188ab94bc66cdb0047300a857c317a05b02d8b752ac42f364a24922379e452818358a9e02e5e946b8f7724dccb1991eb2f567508e4be1168647134c0ce0cf
SSDEEP

384:NNxTtsCNCcrioZ9AA0r4S/DTB/qdlFif7zo6J5HWeb/i:hKGrioZ9D0rd/DTob4j5W

Score

8^/10

discovery persistence

Malware Config

Signatures

Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2200714112-3788720386-2559682836-1000\Control Panel\International\Geo\Nation	windowsdesktop-runtime-7.0.16-win-x64.exe

Executes dropped EXE 6 IoCs

pid	Process
3404	XAU.exe
1208	windowsdesktop-runtime-7.0.16-win-x64.exe
3532	windowsdesktop-runtime-7.0.16-win-x64.exe
3656	windowsdesktop-runtime-7.0.16-win-x64.exe
3600	windowsdesktop-runtime-7.0.16-win-x64.exe
4720	windowsdesktop-runtime-7.0.16-win-x64.exe

Loads dropped DLL 6 IoCs

pid	Process
3532	windowsdesktop-runtime-7.0.16-win-x64.exe
3600	windowsdesktop-runtime-7.0.16-win-x64.exe
3424	MsiExec.exe
3424	MsiExec.exe
1764	MsiExec.exe
1764	MsiExec.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{ef5af41f-d68c-48f7-bfb0-5055718601fc} = "\"C:\\ProgramData\\Package Cache\\{ef5af41f-d68c-48f7-bfb0-5055718601fc}\\windowsdesktop-runtime-7.0.16-win-x64.exe\" /burn.runonce"	windowsdesktop-runtime-7.0.16-win-x64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
43	camo.githubusercontent.com
47	camo.githubusercontent.com

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Web.HttpUtility.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Resources.Writer.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Emit.Lightweight.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ServiceProcess.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\hostpolicy.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Claims.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.Specialized.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Http.Json.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.CSharp.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Process.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Tracing.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\netstandard.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscorrc.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.MemoryMappedFiles.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Contracts.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.XPath.XDocument.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Primitives.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\WindowsBase.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Serialization.Primitives.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebHeaderCollection.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Handles.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Ping.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ObjectModel.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\.version	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Serialization.Xml.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Globalization.Extensions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.Brotli.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Formats.Tar.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Resources.Reader.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.CompilerServices.VisualC.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Serialization.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Timer.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Data.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Tasks.Extensions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.Uri.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.CoreLib.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Serialization.Formatters.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.Win32.Registry.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Metadata.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Principal.Windows.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Security.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.DiaSymReader.Native.amd64.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.AppContext.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Cng.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.Immutable.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebSockets.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\clretwrc.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Numerics.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Quic.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Csp.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Formats.Asn1.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Windows.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Data.DataSetExtensions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.NameResolution.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ValueTuple.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.TypeConverter.dll	msiexec.exe
File created	C:\Program Files\dotnet\swidtag\Microsoft Windows Desktop Runtime - 7.0.16 (x64).swidtag	windowsdesktop-runtime-7.0.16-win-x64.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.NETCore.App.deps.json	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.NonGeneric.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.VisualBasic.Core.dll	msiexec.exe

Drops file in Windows directory 19 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\e598d13.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB8AA.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e598d18.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e598d1d.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9764.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\e598d18.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC491.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC713.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC9A4.tmp	msiexec.exe
File created	C:\Windows\Installer\e598d1d.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\e598d17.msi	msiexec.exe
File created	C:\Windows\Installer\e598d1c.msi	msiexec.exe
File created	C:\Windows\Installer\e598d13.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\SourceHash{CE4D7AE0-FCBA-486F-A58F-DBA3626FBE4B}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9FD1.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{1B690A4C-381A-40D4-BA4A-3F8ACD5CE797}	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\23	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\23	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\24	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\22\52C64B7E	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0EA7D4ECABCFF6845AF8BD3A26F6EBB4\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{CE4D7AE0-FCBA-486F-A58F-DBA3626FBE4B}v56.64.8781\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\0EA7D4ECABCFF6845AF8BD3A26F6EBB4	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0EA7D4ECABCFF6845AF8BD3A26F6EBB4\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0EA7D4ECABCFF6845AF8BD3A26F6EBB4\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_56.64.8781_x64\Dependents\{ef5af41f-d68c-48f7-bfb0-5055718601fc}	windowsdesktop-runtime-7.0.16-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4A096B1A1834D04ABA4F3A8DCC57E79\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4A096B1A1834D04ABA4F3A8DCC57E79\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{1B690A4C-381A-40D4-BA4A-3F8ACD5CE797}v56.64.8781\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\4943F0DE11D5B484BA6E10C561374AAC\C4A096B1A1834D04ABA4F3A8DCC57E79	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_56.64.8781_x64\Dependents	windowsdesktop-runtime-7.0.16-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_56.64.8781_x64\DisplayName = "Microsoft .NET Runtime - 7.0.16 (x64)"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0EA7D4ECABCFF6845AF8BD3A26F6EBB4\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\dotnet_runtime_56.64.8781_x64	windowsdesktop-runtime-7.0.16-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_56.64.8781_x64\Dependents	windowsdesktop-runtime-7.0.16-win-x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4A096B1A1834D04ABA4F3A8DCC57E79\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_56.64.8781_x64\Dependents\{ef5af41f-d68c-48f7-bfb0-5055718601fc}	windowsdesktop-runtime-7.0.16-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_56.64.8781_x64\Version = "56.64.8781"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0EA7D4ECABCFF6845AF8BD3A26F6EBB4\Version = "943727181"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4A096B1A1834D04ABA4F3A8DCC57E79\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2200714112-3788720386-2559682836-1000_Classes\Local Settings	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{ef5af41f-d68c-48f7-bfb0-5055718601fc}\ = "{ef5af41f-d68c-48f7-bfb0-5055718601fc}"	windowsdesktop-runtime-7.0.16-win-x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0EA7D4ECABCFF6845AF8BD3A26F6EBB4\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\04147B1B3295B4161C8ED46FA6E46912\0EA7D4ECABCFF6845AF8BD3A26F6EBB4	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4A096B1A1834D04ABA4F3A8DCC57E79\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0EA7D4ECABCFF6845AF8BD3A26F6EBB4\ProductName = "Microsoft .NET Runtime - 7.0.16 (x64)"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4A096B1A1834D04ABA4F3A8DCC57E79\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{ef5af41f-d68c-48f7-bfb0-5055718601fc}\DisplayName = "Microsoft Windows Desktop Runtime - 7.0.16 (x64)"	windowsdesktop-runtime-7.0.16-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0EA7D4ECABCFF6845AF8BD3A26F6EBB4\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{CE4D7AE0-FCBA-486F-A58F-DBA3626FBE4B}v56.64.8781\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_56.64.8781_x64	windowsdesktop-runtime-7.0.16-win-x64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\dotnet_runtime_56.64.8781_x64	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C4A096B1A1834D04ABA4F3A8DCC57E79\MainFeature	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4A096B1A1834D04ABA4F3A8DCC57E79\Version = "943727181"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{ef5af41f-d68c-48f7-bfb0-5055718601fc}\Version = "7.0.16.33318"	windowsdesktop-runtime-7.0.16-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\0EA7D4ECABCFF6845AF8BD3A26F6EBB4\Provider	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0EA7D4ECABCFF6845AF8BD3A26F6EBB4\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_56.64.8781_x64	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C4A096B1A1834D04ABA4F3A8DCC57E79	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C4A096B1A1834D04ABA4F3A8DCC57E79\Provider	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4A096B1A1834D04ABA4F3A8DCC57E79	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\{ef5af41f-d68c-48f7-bfb0-5055718601fc}	windowsdesktop-runtime-7.0.16-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\0EA7D4ECABCFF6845AF8BD3A26F6EBB4\MainFeature	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0EA7D4ECABCFF6845AF8BD3A26F6EBB4\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4A096B1A1834D04ABA4F3A8DCC57E79\PackageCode = "4D303290B805CF34A86C47A4FB5AF5B0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4A096B1A1834D04ABA4F3A8DCC57E79\InstanceType = "0"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4A096B1A1834D04ABA4F3A8DCC57E79\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2200714112-3788720386-2559682836-1000\{996AAAED-400D-4E12-9B4B-704A56D755F9}	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0EA7D4ECABCFF6845AF8BD3A26F6EBB4\SourceList\PackageName = "dotnet-runtime-7.0.16-win-x64.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_56.64.8781_x64\ = "{1B690A4C-381A-40D4-BA4A-3F8ACD5CE797}"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4A096B1A1834D04ABA4F3A8DCC57E79\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\4943F0DE11D5B484BA6E10C561374AAC	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_56.64.8781_x64\ = "{CE4D7AE0-FCBA-486F-A58F-DBA3626FBE4B}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0EA7D4ECABCFF6845AF8BD3A26F6EBB4	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0EA7D4ECABCFF6845AF8BD3A26F6EBB4\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0EA7D4ECABCFF6845AF8BD3A26F6EBB4\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_56.64.8781_x64\Version = "56.64.8781"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4A096B1A1834D04ABA4F3A8DCC57E79\ProductName = "Microsoft .NET Host FX Resolver - 7.0.16 (x64)"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4A096B1A1834D04ABA4F3A8DCC57E79\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4A096B1A1834D04ABA4F3A8DCC57E79\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{ef5af41f-d68c-48f7-bfb0-5055718601fc}\Dependents\{ef5af41f-d68c-48f7-bfb0-5055718601fc}	windowsdesktop-runtime-7.0.16-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{ef5af41f-d68c-48f7-bfb0-5055718601fc}\Dependents	windowsdesktop-runtime-7.0.16-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0EA7D4ECABCFF6845AF8BD3A26F6EBB4\PackageCode = "74EEF11D81DB3C6458F196B0238079C8"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0EA7D4ECABCFF6845AF8BD3A26F6EBB4\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0EA7D4ECABCFF6845AF8BD3A26F6EBB4\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\04147B1B3295B4161C8ED46FA6E46912	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_56.64.8781_x64\DisplayName = "Microsoft .NET Host FX Resolver - 7.0.16 (x64)"	msiexec.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 246435.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 388799.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
3768	msedge.exe
3768	msedge.exe
3136	msedge.exe
3136	msedge.exe
1688	identity_helper.exe
1688	identity_helper.exe
4652	msedge.exe
4652	msedge.exe
2896	msedge.exe
2896	msedge.exe
696	msedge.exe
696	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
32	msiexec.exe
32	msiexec.exe
32	msiexec.exe
32	msiexec.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 37 IoCs

pid	Process
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4720	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeIncreaseQuotaPrivilege	4720	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeSecurityPrivilege	32	msiexec.exe
Token: SeCreateTokenPrivilege	4720	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeAssignPrimaryTokenPrivilege	4720	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeLockMemoryPrivilege	4720	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeIncreaseQuotaPrivilege	4720	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeMachineAccountPrivilege	4720	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeTcbPrivilege	4720	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeSecurityPrivilege	4720	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeTakeOwnershipPrivilege	4720	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeLoadDriverPrivilege	4720	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeSystemProfilePrivilege	4720	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeSystemtimePrivilege	4720	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeProfSingleProcessPrivilege	4720	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeIncBasePriorityPrivilege	4720	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeCreatePagefilePrivilege	4720	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeCreatePermanentPrivilege	4720	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeBackupPrivilege	4720	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeRestorePrivilege	4720	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeShutdownPrivilege	4720	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeDebugPrivilege	4720	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeAuditPrivilege	4720	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeSystemEnvironmentPrivilege	4720	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeChangeNotifyPrivilege	4720	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeRemoteShutdownPrivilege	4720	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeUndockPrivilege	4720	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeSyncAgentPrivilege	4720	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeEnableDelegationPrivilege	4720	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeManageVolumePrivilege	4720	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeImpersonatePrivilege	4720	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeCreateGlobalPrivilege	4720	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeRestorePrivilege	32	msiexec.exe
Token: SeTakeOwnershipPrivilege	32	msiexec.exe
Token: SeRestorePrivilege	32	msiexec.exe
Token: SeTakeOwnershipPrivilege	32	msiexec.exe
Token: SeRestorePrivilege	32	msiexec.exe
Token: SeTakeOwnershipPrivilege	32	msiexec.exe
Token: SeRestorePrivilege	32	msiexec.exe
Token: SeTakeOwnershipPrivilege	32	msiexec.exe
Token: SeRestorePrivilege	32	msiexec.exe
Token: SeTakeOwnershipPrivilege	32	msiexec.exe
Token: SeRestorePrivilege	32	msiexec.exe
Token: SeTakeOwnershipPrivilege	32	msiexec.exe
Token: SeRestorePrivilege	32	msiexec.exe
Token: SeTakeOwnershipPrivilege	32	msiexec.exe
Token: SeRestorePrivilege	32	msiexec.exe
Token: SeTakeOwnershipPrivilege	32	msiexec.exe
Token: SeRestorePrivilege	32	msiexec.exe
Token: SeTakeOwnershipPrivilege	32	msiexec.exe
Token: SeRestorePrivilege	32	msiexec.exe
Token: SeTakeOwnershipPrivilege	32	msiexec.exe
Token: SeRestorePrivilege	32	msiexec.exe
Token: SeTakeOwnershipPrivilege	32	msiexec.exe
Token: SeRestorePrivilege	32	msiexec.exe
Token: SeTakeOwnershipPrivilege	32	msiexec.exe
Token: SeRestorePrivilege	32	msiexec.exe
Token: SeTakeOwnershipPrivilege	32	msiexec.exe
Token: SeRestorePrivilege	32	msiexec.exe
Token: SeTakeOwnershipPrivilege	32	msiexec.exe
Token: SeRestorePrivilege	32	msiexec.exe
Token: SeTakeOwnershipPrivilege	32	msiexec.exe
Token: SeRestorePrivilege	32	msiexec.exe
Token: SeTakeOwnershipPrivilege	32	msiexec.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3136 wrote to memory of 3796	3136	msedge.exe	85
PID 3136 wrote to memory of 3796	3136	msedge.exe	85
PID 3136 wrote to memory of 1800	3136	msedge.exe	86
PID 3136 wrote to memory of 1800	3136	msedge.exe	86
PID 3136 wrote to memory of 1800	3136	msedge.exe	86
PID 3136 wrote to memory of 1800	3136	msedge.exe	86
PID 3136 wrote to memory of 1800	3136	msedge.exe	86
PID 3136 wrote to memory of 1800	3136	msedge.exe	86
PID 3136 wrote to memory of 1800	3136	msedge.exe	86
PID 3136 wrote to memory of 1800	3136	msedge.exe	86
PID 3136 wrote to memory of 1800	3136	msedge.exe	86
PID 3136 wrote to memory of 1800	3136	msedge.exe	86
PID 3136 wrote to memory of 1800	3136	msedge.exe	86
PID 3136 wrote to memory of 1800	3136	msedge.exe	86
PID 3136 wrote to memory of 1800	3136	msedge.exe	86
PID 3136 wrote to memory of 1800	3136	msedge.exe	86
PID 3136 wrote to memory of 1800	3136	msedge.exe	86
PID 3136 wrote to memory of 1800	3136	msedge.exe	86
PID 3136 wrote to memory of 1800	3136	msedge.exe	86
PID 3136 wrote to memory of 1800	3136	msedge.exe	86
PID 3136 wrote to memory of 1800	3136	msedge.exe	86
PID 3136 wrote to memory of 1800	3136	msedge.exe	86
PID 3136 wrote to memory of 1800	3136	msedge.exe	86
PID 3136 wrote to memory of 1800	3136	msedge.exe	86
PID 3136 wrote to memory of 1800	3136	msedge.exe	86
PID 3136 wrote to memory of 1800	3136	msedge.exe	86
PID 3136 wrote to memory of 1800	3136	msedge.exe	86
PID 3136 wrote to memory of 1800	3136	msedge.exe	86
PID 3136 wrote to memory of 1800	3136	msedge.exe	86
PID 3136 wrote to memory of 1800	3136	msedge.exe	86
PID 3136 wrote to memory of 1800	3136	msedge.exe	86
PID 3136 wrote to memory of 1800	3136	msedge.exe	86
PID 3136 wrote to memory of 1800	3136	msedge.exe	86
PID 3136 wrote to memory of 1800	3136	msedge.exe	86
PID 3136 wrote to memory of 1800	3136	msedge.exe	86
PID 3136 wrote to memory of 1800	3136	msedge.exe	86
PID 3136 wrote to memory of 1800	3136	msedge.exe	86
PID 3136 wrote to memory of 1800	3136	msedge.exe	86
PID 3136 wrote to memory of 1800	3136	msedge.exe	86
PID 3136 wrote to memory of 1800	3136	msedge.exe	86
PID 3136 wrote to memory of 1800	3136	msedge.exe	86
PID 3136 wrote to memory of 1800	3136	msedge.exe	86
PID 3136 wrote to memory of 3768	3136	msedge.exe	87
PID 3136 wrote to memory of 3768	3136	msedge.exe	87
PID 3136 wrote to memory of 4136	3136	msedge.exe	88
PID 3136 wrote to memory of 4136	3136	msedge.exe	88
PID 3136 wrote to memory of 4136	3136	msedge.exe	88
PID 3136 wrote to memory of 4136	3136	msedge.exe	88
PID 3136 wrote to memory of 4136	3136	msedge.exe	88
PID 3136 wrote to memory of 4136	3136	msedge.exe	88
PID 3136 wrote to memory of 4136	3136	msedge.exe	88
PID 3136 wrote to memory of 4136	3136	msedge.exe	88
PID 3136 wrote to memory of 4136	3136	msedge.exe	88
PID 3136 wrote to memory of 4136	3136	msedge.exe	88
PID 3136 wrote to memory of 4136	3136	msedge.exe	88
PID 3136 wrote to memory of 4136	3136	msedge.exe	88
PID 3136 wrote to memory of 4136	3136	msedge.exe	88
PID 3136 wrote to memory of 4136	3136	msedge.exe	88
PID 3136 wrote to memory of 4136	3136	msedge.exe	88
PID 3136 wrote to memory of 4136	3136	msedge.exe	88
PID 3136 wrote to memory of 4136	3136	msedge.exe	88
PID 3136 wrote to memory of 4136	3136	msedge.exe	88
PID 3136 wrote to memory of 4136	3136	msedge.exe	88
PID 3136 wrote to memory of 4136	3136	msedge.exe	88

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\yes - Copy (2).jpg"
1⤵
PID:5004

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff0a4246f8,0x7fff0a424708,0x7fff0a424718
  2⤵
  PID:3796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,1911306196920669949,8649449105349808586,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:1800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,1911306196920669949,8649449105349808586,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,1911306196920669949,8649449105349808586,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3196 /prefetch:8
  2⤵
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,1911306196920669949,8649449105349808586,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3624 /prefetch:1
  2⤵
  PID:2736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,1911306196920669949,8649449105349808586,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3632 /prefetch:1
  2⤵
  PID:3836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,1911306196920669949,8649449105349808586,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4176 /prefetch:1
  2⤵
  PID:1436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,1911306196920669949,8649449105349808586,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4996 /prefetch:1
  2⤵
  PID:1144
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,1911306196920669949,8649449105349808586,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3696 /prefetch:8
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,1911306196920669949,8649449105349808586,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3696 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,1911306196920669949,8649449105349808586,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:1
  2⤵
  PID:1148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,1911306196920669949,8649449105349808586,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:1
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,1911306196920669949,8649449105349808586,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:1
  2⤵
  PID:1708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,1911306196920669949,8649449105349808586,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:1
  2⤵
  PID:4084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,1911306196920669949,8649449105349808586,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:1
  2⤵
  PID:1536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,1911306196920669949,8649449105349808586,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:1
  2⤵
  PID:764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2112,1911306196920669949,8649449105349808586,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5972 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2112,1911306196920669949,8649449105349808586,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5964 /prefetch:8
  2⤵
  PID:2100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,1911306196920669949,8649449105349808586,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:1
  2⤵
  PID:1044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,1911306196920669949,8649449105349808586,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:1
  2⤵
  PID:1144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,1911306196920669949,8649449105349808586,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6296 /prefetch:1
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,1911306196920669949,8649449105349808586,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:1
  2⤵
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,1911306196920669949,8649449105349808586,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6240 /prefetch:1
  2⤵
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,1911306196920669949,8649449105349808586,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6076 /prefetch:1
  2⤵
  PID:1912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,1911306196920669949,8649449105349808586,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6376 /prefetch:1
  2⤵
  PID:3668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,1911306196920669949,8649449105349808586,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6860 /prefetch:1
  2⤵
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,1911306196920669949,8649449105349808586,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6080 /prefetch:1
  2⤵
  PID:2668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,1911306196920669949,8649449105349808586,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6088 /prefetch:1
  2⤵
  PID:764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,1911306196920669949,8649449105349808586,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7256 /prefetch:1
  2⤵
  PID:1876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,1911306196920669949,8649449105349808586,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1716 /prefetch:1
  2⤵
  PID:3600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,1911306196920669949,8649449105349808586,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1996 /prefetch:1
  2⤵
  PID:928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,1911306196920669949,8649449105349808586,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7472 /prefetch:1
  2⤵
  PID:2796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,1911306196920669949,8649449105349808586,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6660 /prefetch:1
  2⤵
  PID:900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,1911306196920669949,8649449105349808586,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:1
  2⤵
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,1911306196920669949,8649449105349808586,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6276 /prefetch:1
  2⤵
  PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2112,1911306196920669949,8649449105349808586,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=7072 /prefetch:8
  2⤵
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,1911306196920669949,8649449105349808586,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7964 /prefetch:1
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2112,1911306196920669949,8649449105349808586,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=8140 /prefetch:8
  2⤵
  PID:1488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2112,1911306196920669949,8649449105349808586,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7564 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2896
- C:\Users\Admin\Downloads\XAU.exe
  "C:\Users\Admin\Downloads\XAU.exe"
  2⤵
  - Executes dropped EXE
  PID:3404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?framework=Microsoft.NETCore.App&framework_version=7.0.0&arch=x64&rid=win-x64&os=win10&gui=true
    3⤵
    PID:1084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff0a4246f8,0x7fff0a424708,0x7fff0a424718
      4⤵
      PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,1911306196920669949,8649449105349808586,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7760 /prefetch:1
  2⤵
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,1911306196920669949,8649449105349808586,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1
  2⤵
  PID:1464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,1911306196920669949,8649449105349808586,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6624 /prefetch:1
  2⤵
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,1911306196920669949,8649449105349808586,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7856 /prefetch:1
  2⤵
  PID:1164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2112,1911306196920669949,8649449105349808586,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=8428 /prefetch:8
  2⤵
  PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,1911306196920669949,8649449105349808586,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1828 /prefetch:1
  2⤵
  PID:2940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,1911306196920669949,8649449105349808586,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6708 /prefetch:1
  2⤵
  PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,1911306196920669949,8649449105349808586,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8548 /prefetch:1
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,1911306196920669949,8649449105349808586,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8712 /prefetch:1
  2⤵
  PID:3200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,1911306196920669949,8649449105349808586,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7916 /prefetch:1
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2112,1911306196920669949,8649449105349808586,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6932 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:696
- C:\Users\Admin\Downloads\windowsdesktop-runtime-7.0.16-win-x64.exe
  "C:\Users\Admin\Downloads\windowsdesktop-runtime-7.0.16-win-x64.exe"
  2⤵
  - Executes dropped EXE
  PID:1208
- - C:\Windows\Temp\{5F5585D1-4142-46B8-BCC2-AFA15BF68999}\.cr\windowsdesktop-runtime-7.0.16-win-x64.exe
    "C:\Windows\Temp\{5F5585D1-4142-46B8-BCC2-AFA15BF68999}\.cr\windowsdesktop-runtime-7.0.16-win-x64.exe" -burn.clean.room="C:\Users\Admin\Downloads\windowsdesktop-runtime-7.0.16-win-x64.exe" -burn.filehandle.attached=540 -burn.filehandle.self=548
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3532
  - - C:\Windows\Temp\{C91E51C7-7708-4495-88BE-6AE2186541D0}\.be\windowsdesktop-runtime-7.0.16-win-x64.exe
      "C:\Windows\Temp\{C91E51C7-7708-4495-88BE-6AE2186541D0}\.be\windowsdesktop-runtime-7.0.16-win-x64.exe" -q -burn.elevated BurnPipe.{E2B7C355-5091-47F3-8780-5E20506FC6CE} {0B6D29A4-2A53-4014-B9C4-AF1145E8A16B} 3532
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Program Files directory
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      PID:4720
- C:\Users\Admin\Downloads\windowsdesktop-runtime-7.0.16-win-x64.exe
  "C:\Users\Admin\Downloads\windowsdesktop-runtime-7.0.16-win-x64.exe"
  2⤵
  - Executes dropped EXE
  PID:3656
- - C:\Windows\Temp\{F49E9FB9-7EF7-456B-BACA-437E68E5D183}\.cr\windowsdesktop-runtime-7.0.16-win-x64.exe
    "C:\Windows\Temp\{F49E9FB9-7EF7-456B-BACA-437E68E5D183}\.cr\windowsdesktop-runtime-7.0.16-win-x64.exe" -burn.clean.room="C:\Users\Admin\Downloads\windowsdesktop-runtime-7.0.16-win-x64.exe" -burn.filehandle.attached=688 -burn.filehandle.self=540
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,1911306196920669949,8649449105349808586,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1412 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4652

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1364

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:884

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3492

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:32
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 29A3195668B6EB8D7638A8F8E3F02C33
  2⤵
  - Loads dropped DLL
  PID:3424
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 5B00924E0F8DE18E83E9891725446D93
  2⤵
  - Loads dropped DLL
  PID:1764
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 35055ED16B67EB4333FDBD25E75FC2DA
  2⤵
  PID:2168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e598d16.rbs

Filesize
48KB

MD5
e2d78369c389cd2ade02e632c30f0ccf

SHA1
dd1fb3d4c03dad715c9bdb4c86a2ed18302d3b5a

SHA256
e9f3f7b4c2ddc12c1a46c2d4c3e44ebb94659e09d20ea540a40229194cb7a21b

SHA512
86eade7bb78336c5bc747caf18739446580b3ed675811416f20246686ecf509f8d6b6de87dbda1233badb2a81a0e43e38f9a9800490547fdbad9a4ced727ecf4

Download Submit
C:\Config.Msi\e598d1b.rbs

Filesize
9KB

MD5
4dd840ce0216a880e29eb09aaf6c31d5

SHA1
067f15499f56de16a070ff43b670cf1494710855

SHA256
7bf3582373de6b47f6eea8f3b09b562dd14c5da27acceedc8acae7478361e699

SHA512
b113474a22a457363670ec33cc09726f35142d06853e8502e7b11c4ee5aa61d50ee1604d72684efeca92eb78994a7d7eb3b1ee3d712ab41261927dbbbd94ab42

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
91746379e314b064719e43e3422d0388

SHA1
65f1a2b5a93922d589142a6edf99b5b35d986dba

SHA256
0b3cf8ae20afd84c9bf06546e876c84922cb5800526df72a628479f4d5487df7

SHA512
a783d8d9613cf92020fc36fd27d384dbd4e105a1ebd02c4507bf7263e61ff5b377e6d1734b066700782fa64bcbeb11af31ac3972d404625cbdb587cfa3bc0808

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ccf8b7b618672b2da2775b890d06c7af

SHA1
83717bc0ff28b8775a1360ef02882be22e4a5263

SHA256
ef08e2971a9ba903c9b91412275b39aabfd6d4aa5c46ade37d74ff86f0285420

SHA512
eb550889db8c4c0e7d79b2bd85c7d0e61b696df10ce3d76c48ab21b935c7ecc7b12403a00d6570e7d8e4121f72747242c2358f8f0823f804e704bd44ed603b97

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000025

Filesize
86KB

MD5
c3f0bbf0ee23518b558b535ab9b528cb

SHA1
082eab0de19ee5e926f035ba4f7ab69fd093c077

SHA256
17b86e116161512999c6ac1c95ff130c86d66a2130dbc8ba6f9a997414f2e46a

SHA512
b3d9438c4ef89b4143a5c952353bdf52b97eea8ea79ef75b1a40f92a36d466960b1c01e15daafb85de787c20e20e5314bf5373595ca239d8d57d8847f5f6386b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000026

Filesize
28KB

MD5
858bee21ba687552cc13ecd48e2a96c5

SHA1
1ac9084741b244bf43833cc2fad9c05eaad8219e

SHA256
ac691dcffea54520889affb6c8a9db83fe771db130936c5e07bbaf6e24b2c759

SHA512
8796ca2fcb32434242bd953d191badcf3aba3a6bad0826f093686feb2b6fc4e30eae49c564dc030537163f5605611d0791a3302a6af5fcd38ade62ce265cc55b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000027

Filesize
50KB

MD5
1c748ed5d9e29bf94c777342b40986d3

SHA1
45a44769f2f274aafa58ca7cde57a6a34ed55973

SHA256
e89a42cc5e34524c5c37d8535bb24137653f787b7e49e03acbd0a691566f8f1e

SHA512
a33b1b853ca500c7a6b361c64a641c293aec3121d9a493833affd67bcb9f48d87935cd6deb3cdbdd031a75f46f45e1708ee577e1a7982dc134152be20417826c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000028

Filesize
40KB

MD5
43321e26dfa067872dd7c2dbe9bc0882

SHA1
bf06caa5d02452cd31c602d9e08383b093f4b2f8

SHA256
b8658b17d43ae1df70916760a55af62fc1e3e76dcadf0c8be304346d14b138f5

SHA512
d2e2d7eaabbcb7433b7b184d8e98d084f4777f83cd5b1ec89ab749ee4d6160d51ee484d1fe1e82e0b26c8c725fdc3484cdde2502eff9e57ed24a1952e23aaa25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000029

Filesize
137KB

MD5
72cd87e0bbbd80016621110188b26cda

SHA1
089150b6619abe0a2b2c192a33aa5789a445a376

SHA256
b3f31921e75ed5ba88d1ac178e8eb3617f20f1a8ad8e05475782aa888506a769

SHA512
ba88ce0dc2f1f286e12da1f72ae4a28c5a90b3a310ea7b7332a9687954adad33cabd72d7d4775df3463a49c1529d9c6e8e25f603bd67048d1a731855a7c2e0bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002a

Filesize
134KB

MD5
4787dd34ac59f7876fc7a3e8c4d3c01c

SHA1
0a2fa42f0b64a361f9404802fc4eea75da616df5

SHA256
cebb59025c724f97697d4cfabceb05bb69c991351ef578467104cf1cbb35beee

SHA512
fcfe75082898e159cbd1b0a2d449df81c577c04822ba598431c179d40fd9c87e9f01376691993b8c1860c189543c1a16cb8512d60d01270bb411eec229b5caed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003b

Filesize
61KB

MD5
fd0da247c572778b89b15413ad1956e4

SHA1
9009cd302b22b6edb98a97e9569fbb765640f382

SHA256
b6acc64fa2e8e311c90d54dbc05e76cbe0cce81e06ce95c900a62b32d1e0f53d

SHA512
97ecb491ca2365b2d0b6b25919c0d18b754a7d20dfc78bd427139349617a555fc4b8e47e1e7121a7ec8b604da6aebffa662bd87215aeeaaba37d2bd737edd175

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
1475da393e35354f9048f99af71e5ec3

SHA1
6607c7897be926e25e65f78efce85a5f1a41d0dd

SHA256
0e38018aa71f1c940fd0ad3fd5317917b145950a6a8864bd21f16a08a222d911

SHA512
8ff3b4782d59cd2cbf783daf6a8e718c79230b4ee71c3ef87eecc9fd437c26f0000d8bf049f9d68460075f2db6d1fd414cf73cdf330279b8a4565f3ce552eb8e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
aca08d3e1aebe2d112fbe6b3c3c431a4

SHA1
d350935d5205b09e04759112ff553c5e88f721b7

SHA256
27780aa547a3c915899ce99e04c558fd54bc9397f661519a80fcd805e85b95f9

SHA512
d762d03e8d49c8861293da867361728fe72aa9c9b1c7e7a14ec5b9e1abf3da3b0c3179eaaddfd09f966a9b692cb693c4190dc0c299417b5343b7929f43f8ef49

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
10KB

MD5
e3c85857a77776a08c8124e7c1775b41

SHA1
fc1dd012e080b0dd5eecd68001d65a6f61c5dbad

SHA256
4fc34c72990102b1a7c80c574e7a49002e5c311eaa854ec99a67eeedd87d986e

SHA512
671398b68ba9a29885888def5dc6847697578e234f3e99bf27ecdf18d2ff049a94f8d33b4a563a7adffe67cc589ddc44c1eca5b8f3395b42bfdb50654fd6f847

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
9KB

MD5
2d10953efebf034314383d532c8400dc

SHA1
e6f7eec2486ebc682890ba5077d341506a7c1853

SHA256
ec11c2f38797d17b9da16daee6153da6971619865f431128661212dfee880cca

SHA512
0593d16a467f2cdfdfb93e9f6479d8643b0006b08ee351b01e4382ca82533b9b9365b5c2e2dfd82de62327d81ce60cf3669bae8730e710a43a08e27e80052709

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c50da2f22a25b48b7db91e93630c7bf3

SHA1
31da993ef6f43de6ea3805b53f87edf291e53403

SHA256
b7b3513c7ae3126ccc9a1a897057324c5a00b0324aa79121ef54c85eb18f4fa3

SHA512
a6d5f5c548a1bb9cc05e143040091a80f1387996b5dd87f7eeb75da56496f9d84f77e0bd734f459f0ce1a9117e4f302d4269ba92de8a1cc6d774a812522fbb59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c7cbdf3575f0ceb4997e55c2d3c576bb

SHA1
95bb9211e2b14619e4ef2bdd44870d2c8af28ac0

SHA256
6a3ac23c714ea184246c81463ed42ff58cccbf84d42eb81578b356ddd28dbfe9

SHA512
6ec8fb5aac0081fbae0d7ccd0e2e2117f95f6dcd82a67dc4cf206beb967bd666b5ba3270c41ff7489142f034872f72f1991818e0e012f62d75136b8f8c8b549e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
11KB

MD5
c77cad8f6d0301c5b6e67a64560607bc

SHA1
70ae56b2c0556381725364d06e5cd2565001dfdc

SHA256
9a416b899e4543e3a04a329cbb83e2c7079274377fecc33e9024952eb716c29c

SHA512
4bca83fa4e8d9fa728c1e1c153685179ec0c6d205848f72e76393b0008cba0669fee77c66c73812b7e225a4496af33638b720a9dfb93581d1379d2f17bc39091

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
12KB

MD5
1042c2a585d5ddf71533905eba3141f9

SHA1
f9b3cb63842891141e4ca8870496604e607375d4

SHA256
d7031058e40224bc9bf8c3ab41fb7286005ad0836775c2c970600ad22eaf5b6b

SHA512
3f0cbe988e11b4d2199f0b1602cfa1c020b92f24ef6d932a29db3efdae340e7bb37199bcab67e4a032cf58260b18959b3423ae07bb6802235251855308e0c129

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
37ec9029f6035d761071e5dff9e62539

SHA1
3f1d1d67cb2c9d6a1963b35aa3568800026d61c1

SHA256
fd15af934bae6e28b7d65c067d2a844bf51c5f6eef70ef3d63c24aa813347afd

SHA512
83560c03c8ca2787c4c5238b05e08ad72dc07447ef89509876f849ab446797c04151aa0739e6aee36bb4df156e8d7578b8eb2f8467eebc2fe4d4643ea78c483a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
ea7c2dba4df376e04bf5db3544653556

SHA1
616aa32a1bc06f88cb596afdd7832f16c04c83ff

SHA256
6810a3476a1e8783370907b73f84c15127017d9cd2908f33ca8603318cd858f5

SHA512
241863e34ee327f9f523cda4e776b7ac8f93d3b0931bec125e3740adbdf1a1bb8353bd47067b2bfb3b26386f3ea7209a46f06306b0ba11d48dc1be8bec5d49f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
5cabd593572f1fba9f1a64d05e4f515b

SHA1
b107fb936ebe3de6150685e89f4dafd0659bc7be

SHA256
b9d51400b07df1466448ba3f5e90e133dcdecfd386bd3fc2ed3e4d42512905bb

SHA512
d2205ca615aa32add01fc8fdd32773a27250e4acdec93a96b9d65407fd1e7f9307bad095ade5eb3f3884a6a559d84351d7ad0ac5de761bf308330b1d787124e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
b29f80ae69bed5b559e49802ae600c2f

SHA1
088942296a75bc6e8900107855b2ff6cf1a85b63

SHA256
d9dad73491d61bc5320c2a800c357b9cb08afb396a18fbcd828266cd2d97e352

SHA512
731d4fe0792e7135a04e1e635612fbd8f01920b0a3e33b3902b8ed15413c462c82ce101378c41a61ca0fe6fa01dc25d63cfcd04e8b60f84546f338a99680ef76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
30fec71e2f462ef997717a3d2d18f584

SHA1
7dcb93764aca6a828e501fd28ce3449de58b6294

SHA256
b18595b48784d8ebe702720001ba8cae310380abce7a3ab94a4f118705ca6e76

SHA512
2dadcbe62b5e753ea8a11bc8976696d3bca9b38153b47e6aa83b340adebc0f3a1fde4a741d88a9aaf47cace7cd3cd71c0330e9b3d841b3b6ac93d950da7e93bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5814ea.TMP

Filesize
1KB

MD5
b41e9d044efbb5a0a3001cd2910ea47f

SHA1
1539bee453719835e174f7fc2ba4339dcadcf650

SHA256
0adbf2b6c3578038087f3f1f8a5493f94e9bf5be395d4fb250ad846a92c46b96

SHA512
e18b8a1a342151c5124428f9d0b1bc6dc935259839ac3789d7742317f8aecaaf20cd9c1733edbaf38c5a1e3414489e190af985139cfae63018fd72d573387b45

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
fef6a078419d272b836bca55e9adb533

SHA1
fd8cc32bdae219f63b3aa4aa99eaeafd1014b2d0

SHA256
e316de81b7ba4bd013ce8c5a9dad13d6c612b1820296ee11e7a08d4ba58a036c

SHA512
56ab7c940bd167b650779627d27399356068a4e5b22fa76bfa14e50215f8052511f78ed545749e713f8433e31580b2e8c0c3d1a2cf2bd95e1a38925f0ca89dd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
2a37ca1097e48507698e015a6d0a36a4

SHA1
0917ecc013561d60e5265212bc0ab7d715ce3194

SHA256
16693c93452c04f6ea39654acba2910c9dc3eb850deca52bb104983444965e3b

SHA512
752127b4bb4429ff49877b1d30c8355b5d7d0658b45988f60455e3b0bfae6133b1f042d73a339b38ed70e2da7e431280eafa9ccb0606a8fd4b2de3d5f3e9c6f7

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 246435.crdownload

Filesize
6.8MB

MD5
9fbce2bfbf0717da9c4b68e7c8e01389

SHA1
f4794326671932abc3187a9f5191c28926e1b5d5

SHA256
ae6de2be3748541717986d9996014e1ab284eaec18fdf8fca66d64247d65b3cf

SHA512
e989e6eeaaff4ba44ee060ab33791baa485155660e9db3b315e2038b986aa4e301343c775adbd8166acd09cb9b0a9d8674da2ab3121fa0f3b7ac7636112a50d5

Download Submit
C:\Users\Admin\Downloads\XAU.exe

Filesize
256KB

MD5
ab282ed4aa305e8a33b9dcd30291479c

SHA1
deb2160910213e0677150cf4ff72d84ce477e912

SHA256
a4c22e80e76611f034caa078f00f13de83867c2d42772386dd9cf516cd7d8c4a

SHA512
46df69453c55eb1e1d0ceecec69a4d6967dba5835da56fe36bfd0f1e61acad1306bc0719ba5fdaacfec698dc8513a7916cf00cac9bf43268b6aeb05cdc6e32a9

Download Submit
C:\Users\Admin\Downloads\XAU.exe

Filesize
7.2MB

MD5
13d9b5407ee50020e96defc3a7139561

SHA1
ba16b3035d1d76aeef75ae0b167e762a2ebe3a09

SHA256
fd12ca853eff20538727c03a179568eb32858438312c4e8fc7fb66b0051266b7

SHA512
e6cc4f1128597ff6827255208494cdaa5e77e9be22bec22e94e7a097c030874c1dfbbecfd98032bd9f294975e09f47c2be0ae07055b58b2427ff45f1f30c7aa3

Download Submit
C:\Users\Admin\Downloads\windowsdesktop-runtime-7.0.16-win-x64.exe

Filesize
7.1MB

MD5
323a6beda342483c8f3066f765ce0842

SHA1
0712d71042e6aba6e3b37ba9cfea29d214d997b2

SHA256
17416f530e04deb2314545b1e56a24941e2fc77788290d34218c9f31e337ffdf

SHA512
1c40ba097338d98c030602b43b4d00d6664d96fbb08c55e0a6a2de103d893e384eb00d70a91b59577264a2d226d3a17f07fcad2c9292526f8b8b98a542c7d6aa

Download Submit
C:\Users\Admin\Downloads\windowsdesktop-runtime-7.0.16-win-x64.exe

Filesize
2.8MB

MD5
0fb65a1d31d3d85e9091727f84358ad5

SHA1
f4fb106944c8f6453cb090e5b6422d9abd23a00e

SHA256
a90d54e3e1e8affd8f15756208da162b3156386a8b33b222880e5f79cfac4495

SHA512
cb60761430a3a850759bf60ce8d1d396ab127f2cebda297a6e4a27b1049daa187e8c3608b07cd2822e0f9db2fcdc8efd6132ab8e4f321b7d59da0938f857b09f

Download Submit
C:\Users\Admin\Downloads\windowsdesktop-runtime-7.0.16-win-x64.exe

Filesize
2.2MB

MD5
e9b64d34dc647df405ecea6399394a85

SHA1
24b1f05d36c06e21eeb7cdab656655e187d45536

SHA256
d542e3b71005ea2c74c726ed0f714ed749a1676556a203480031ce3c5d218dba

SHA512
d21993ae668c1f40a3cf68aa5e60db2b49b49561cf37e9a3ee61f107cee6206646cd49f82c1429e47e55f87c87a6658a0bf979edb0836f8b55656510a872ea79

Download Submit
C:\Users\Admin\Downloads\windowsdesktop-runtime-7.0.16-win-x64.exe

Filesize
448KB

MD5
f4b9e0daa8e14d6102b890b58afd5bb4

SHA1
59cc98f066b9e4a543754c212c48c11d713c60d3

SHA256
8f488693a9343f2edc7745678c42c949916aec13a6a6407810a35802cba39c5c

SHA512
cff9290dcaef278d12a0ed14d9aa677bdbe8fb5455ba3830a327e6c3f79721cc7fa07dd16c202f5e1c0cadde5113948080b7464c3b1f1077d01cfd79e4171df3

Download Submit
C:\Windows\Installer\MSIC491.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\e598d17.msi

Filesize
4.1MB

MD5
39cac5146b91b30205b73564c901551c

SHA1
f61499e0cb9d8192a3b02506f377c030fdddec2a

SHA256
974e5fcd7a22378fbf48ce27ccd25a48c251d372a9caafbfcecd66bc816ae429

SHA512
f68f405692f5ea0963fb6a10d236f80443d5f7d522689ff8126b4d0e2c69d6244fbe0832237c39851da0ea3335fad6ab882f18d8ed5ac32f7f80699687ebe859

Download Submit
C:\Windows\Installer\e598d18.msi

Filesize
804KB

MD5
3db1b0ad874499a5bd80b9ad2ed2103f

SHA1
77f02d58918daa3cb25364960a1196ce2f711d0f

SHA256
7b32cfc57dae7fe08f7ed00d54771107aeb4b80305a7269f6b9ac2cb19710c35

SHA512
e2214799e8febb31e2dadeef8904e5692fb94f916500960642b780a4b68f9bd2d8d7e62d579418bcced9a7b0f7ff958e672783fc019617d17499e8c5e1b777e1

Download Submit
C:\Windows\Temp\{5F5585D1-4142-46B8-BCC2-AFA15BF68999}\.cr\windowsdesktop-runtime-7.0.16-win-x64.exe

Filesize
610KB

MD5
9656c3086081a41540338b94df6ae084

SHA1
dc87b2d0dde3604437d13d2f89fe9ecb7c7b0373

SHA256
6a7a85e1b9e899ce83ca29eca2e0b34126acf97675991b431b279278a03c41f2

SHA512
7bdfc5943968403b787700f5c4e12d88f34bdca4569fbff21e178c17eba40f8db68135aaf426b990617316c10b86687a08375c611c4a9e5a8db8eb2c2be3e9cc

Download Submit
C:\Windows\Temp\{C91E51C7-7708-4495-88BE-6AE2186541D0}\.ba\bg.png

Filesize
4KB

MD5
9eb0320dfbf2bd541e6a55c01ddc9f20

SHA1
eb282a66d29594346531b1ff886d455e1dcd6d99

SHA256
9095bf7b6baa0107b40a4a6d727215be077133a190f4ca9bd89a176842141e79

SHA512
9ada3a1757a493fbb004bd767fab8f77430af69d71479f340b8b8ede904cc94cd733700db593a4a2d2e1184c0081fd0648318d867128e1cb461021314990931d

Download Submit
C:\Windows\Temp\{C91E51C7-7708-4495-88BE-6AE2186541D0}\.ba\wixstdba.dll

Filesize
197KB

MD5
4356ee50f0b1a878e270614780ddf095

SHA1
b5c0915f023b2e4ed3e122322abc40c4437909af

SHA256
41a8787fdc9467f563438daba4131191aa1eb588a81beb9a89fe8bd886c16104

SHA512
b9e482efe9189683dabfc9feff8b386d7eba4ecf070f42a1eebee6052cfb181a19497f831f1ea6429cfcce1d4865a5d279b24bd738d702902e9887bb9f0c4691

Download Submit
C:\Windows\Temp\{C91E51C7-7708-4495-88BE-6AE2186541D0}\dotnet_hostfxr_7.0.16_win_x64.msi

Filesize
256KB

MD5
fc1e523070ad97a9ccbc37497d4152b7

SHA1
352c9f5181fabbd04e342e1bd17a86196d91c3cc

SHA256
bd53c976f251150602e53f38a523e0701e01865fd85d9716127b2b0f2a390fc6

SHA512
2173adabc8a706cdea481158aa3bd4eb56eb4f88c391bd530c54614d1fc417a5f7b8ecbdef510b2f4bc2977e1fcdc38b8766b563254f488615606940794b0377

Download Submit
C:\Windows\Temp\{C91E51C7-7708-4495-88BE-6AE2186541D0}\dotnet_runtime_7.0.16_win_x64.msi

Filesize
1.8MB

MD5
0f0b728dae6a3693366a7a45da5b818b

SHA1
3562b45e25e63c69472933ea83c3b71a4c830daa

SHA256
c5ab938ee73542cf654dd4276dc9ce2c497d17934579328a12070118afb39cec

SHA512
f1dab19191587096d3f838db693bb10f380b96b03c6606d6a8b5f22f5e3ec1097e42f189c44739c7c384e920b22908b724440f196adc86892039ece13b59e7e8

Download Submit
C:\Windows\Temp\{F49E9FB9-7EF7-456B-BACA-437E68E5D183}\.cr\windowsdesktop-runtime-7.0.16-win-x64.exe

Filesize
64KB

MD5
e7c5e604c109dad92bcb955818ba6b11

SHA1
4d12859bea3d16d1baa552871f7d147a998e378b

SHA256
b0c8982681d61493cdabf356c7b8446abcadde4db4e6374d5dbcfb782c0d655a

SHA512
ebd264cf8de482e24ac65d36bbf9a274a33805735659f577a3431b30c628031aad6f9581cf33beffdc78e6dd41f28811d68b573ecffdd0f748f6dbd76707a274

Download Submit