hxxp://a[.]directfiledl[.]com/getfile?id=66958171&s=4F60071B

Analysis

max time kernel
608s
max time network
594s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
05/03/2024, 20:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://a.directfiledl.com/getfile?id=66958171&s=4F60071B

Score

8^/10

discovery persistence

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 4 IoCs

pid	Process
3256	vulkan.exe
4336	windowsdesktop-runtime-7.0.16-win-x64.exe
5056	windowsdesktop-runtime-7.0.16-win-x64.exe
2620	windowsdesktop-runtime-7.0.16-win-x64.exe

Loads dropped DLL 9 IoCs

pid	Process
5056	windowsdesktop-runtime-7.0.16-win-x64.exe
3692	MsiExec.exe
3692	MsiExec.exe
3472	MsiExec.exe
3472	MsiExec.exe
1904	MsiExec.exe
1904	MsiExec.exe
4536	MsiExec.exe
4536	MsiExec.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{ef5af41f-d68c-48f7-bfb0-5055718601fc} = "\"C:\\ProgramData\\Package Cache\\{ef5af41f-d68c-48f7-bfb0-5055718601fc}\\windowsdesktop-runtime-7.0.16-win-x64.exe\" /burn.runonce"	windowsdesktop-runtime-7.0.16-win-x64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
12	raw.githubusercontent.com
40	raw.githubusercontent.com
41	raw.githubusercontent.com

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.Concurrent.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemXmlLinq.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\clrgc.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.CSharp.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Linq.Parallel.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Timer.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscorlib.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Http.Json.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.FileSystem.AccessControl.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Numerics.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Channels.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Aero.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.DiaSymReader.Native.amd64.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.Uri.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.TextWriterTraceListener.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Windows.Forms.Design.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Classic.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\ReachFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.OpenSsl.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Transactions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Handles.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Configuration.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Windows.Forms.Design.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\UIAutomationClient.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\ReachFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Security.Permissions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\UIAutomationTypes.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Design.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Linq.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Linq.Expressions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.ZipFile.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.Specialized.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationCore.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Xaml.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.XPath.XDocument.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\UIAutomationClient.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Csp.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.CodeDom.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Diagnostics.EventLog.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Threading.AccessControl.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Resources.Reader.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Web.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Principal.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Windows.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Globalization.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Pipes.AccessControl.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Windows.Forms.Primitives.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Extensions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Primitives.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\UIAutomationClient.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe

Drops file in Windows directory 51 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\e5ee353.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF966561C020E11370.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\B61D15F98E24A4A42882574055142AEA\56.64.8781	msiexec.exe
File created	C:\Windows\SystemTemp\~DF3732BD442ED07438.TMP	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\e5ee34e.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA1E9.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC0BD.tmp	msiexec.exe
File created	C:\Windows\Installer\e5ee34d.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFB75084A263CC27ED.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e5ee349.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI945B.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{9F51D16B-42E8-4A4A-8228-75045541A2AE}	msiexec.exe
File created	C:\Windows\SystemTemp\~DF5BF2B607C895E7AB.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB84.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e5ee359.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF7132D813FDCDA9C2.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{1B690A4C-381A-40D4-BA4A-3F8ACD5CE797}	msiexec.exe
File created	C:\Windows\Installer\e5ee349.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFA7DB7F54D41C01AA.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF4ED8325EDC1A0877.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFDC90760A57199BAF.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\B61D15F98E24A4A42882574055142AEA	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\e5ee352.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF2C2CA8AB52A6C3D9.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFED801F7B1846EC23.TMP	msiexec.exe
File created	C:\Windows\Installer\e5ee35d.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC3E.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFACC69A162CFA1208.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{01B2627D-8443-41C0-97F0-9F72AC2FD6A0}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9113.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID7D1.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI248C.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\SourceHash{CE4D7AE0-FCBA-486F-A58F-DBA3626FBE4B}	msiexec.exe
File created	C:\Windows\SystemTemp\~DF097CA6146B68745F.TMP	msiexec.exe
File created	C:\Windows\Installer\e5ee358.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF1AF7AD08A4FF4212.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFA7C27053337EDFAD.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID139.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFEFDDD40EEDDE0CDB.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIED3D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\B61D15F98E24A4A42882574055142AEA\56.64.8781\fileCoreHostExe	msiexec.exe
File created	C:\Windows\Installer\e5ee353.msi	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\B61D15F98E24A4A42882574055142AEA\56.64.8781\fileCoreHostExe	msiexec.exe
File created	C:\Windows\SystemTemp\~DF30B76B08C8EB1D1B.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI58E8.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e5ee34e.msi	msiexec.exe
File created	C:\Windows\Installer\e5ee359.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI33DF.tmp	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\22\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\24	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\24	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\25	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\23	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\23	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0EA7D4ECABCFF6845AF8BD3A26F6EBB4\SourceList	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4A096B1A1834D04ABA4F3A8DCC57E79\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_56.64.8781_x64\Dependents	windowsdesktop-runtime-7.0.16-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B61D15F98E24A4A42882574055142AEA\SourceList\Media	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D7262B1034480C14790FF927CAF26D0A\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\170B71A1C66553D5E351152A6AFB2626	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\0EA7D4ECABCFF6845AF8BD3A26F6EBB4	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{ef5af41f-d68c-48f7-bfb0-5055718601fc}\Dependents\{ef5af41f-d68c-48f7-bfb0-5055718601fc}	windowsdesktop-runtime-7.0.16-win-x64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\dotnet_runtime_56.64.8781_x64	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0EA7D4ECABCFF6845AF8BD3A26F6EBB4\Version = "943727181"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0EA7D4ECABCFF6845AF8BD3A26F6EBB4\SourceList\PackageName = "dotnet-runtime-7.0.16-win-x64.msi"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B61D15F98E24A4A42882574055142AEA\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\4E3F426DBD05F2A509C6867B91443826	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_56.64.8804_x64\Dependents	windowsdesktop-runtime-7.0.16-win-x64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\{ef5af41f-d68c-48f7-bfb0-5055718601fc}	windowsdesktop-runtime-7.0.16-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4A096B1A1834D04ABA4F3A8DCC57E79\SourceList\PackageName = "dotnet-hostfxr-7.0.16-win-x64.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B61D15F98E24A4A42882574055142AEA\MainFeature	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B61D15F98E24A4A42882574055142AEA\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_56.64.8804_x64\Dependents\{ef5af41f-d68c-48f7-bfb0-5055718601fc}	windowsdesktop-runtime-7.0.16-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\04147B1B3295B4161C8ED46FA6E46912\0EA7D4ECABCFF6845AF8BD3A26F6EBB4	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4A096B1A1834D04ABA4F3A8DCC57E79\ProductName = "Microsoft .NET Host FX Resolver - 7.0.16 (x64)"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_56.64.8781_x64	windowsdesktop-runtime-7.0.16-win-x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0EA7D4ECABCFF6845AF8BD3A26F6EBB4\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4A096B1A1834D04ABA4F3A8DCC57E79	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4A096B1A1834D04ABA4F3A8DCC57E79\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{1B690A4C-381A-40D4-BA4A-3F8ACD5CE797}v56.64.8781\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_56.64.8804_x64\DisplayName = "Microsoft Windows Desktop Runtime - 7.0.16 (x64)"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\windowsdesktop_runtime_56.64.8804_x64	windowsdesktop-runtime-7.0.16-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_56.64.8781_x64\Version = "56.64.8781"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0EA7D4ECABCFF6845AF8BD3A26F6EBB4\Clients = 3a0000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4A096B1A1834D04ABA4F3A8DCC57E79\Version = "943727181"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B61D15F98E24A4A42882574055142AEA	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{ef5af41f-d68c-48f7-bfb0-5055718601fc}\Dependents	windowsdesktop-runtime-7.0.16-win-x64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_56.64.8781_x64	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_56.64.8781_x64\ = "{1B690A4C-381A-40D4-BA4A-3F8ACD5CE797}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D7262B1034480C14790FF927CAF26D0A\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_7.0_x64\DisplayName = "Microsoft .NET Host - 7.0.16 (x64)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D7262B1034480C14790FF927CAF26D0A\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{01B2627D-8443-41C0-97F0-9F72AC2FD6A0}v56.64.8804\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\0EA7D4ECABCFF6845AF8BD3A26F6EBB4\Provider	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_56.64.8781_x64\Dependents	windowsdesktop-runtime-7.0.16-win-x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D7262B1034480C14790FF927CAF26D0A\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0EA7D4ECABCFF6845AF8BD3A26F6EBB4\ProductName = "Microsoft .NET Runtime - 7.0.16 (x64)"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4A096B1A1834D04ABA4F3A8DCC57E79\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4A096B1A1834D04ABA4F3A8DCC57E79\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4A096B1A1834D04ABA4F3A8DCC57E79\SourceList\Media\1 = ";"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B61D15F98E24A4A42882574055142AEA\Version = "943727181"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D7262B1034480C14790FF927CAF26D0A\Version = "943727204"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D7262B1034480C14790FF927CAF26D0A\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D7262B1034480C14790FF927CAF26D0A\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D7262B1034480C14790FF927CAF26D0A\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D7262B1034480C14790FF927CAF26D0A\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{01B2627D-8443-41C0-97F0-9F72AC2FD6A0}v56.64.8804\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\04147B1B3295B4161C8ED46FA6E46912	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4A096B1A1834D04ABA4F3A8DCC57E79\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{1B690A4C-381A-40D4-BA4A-3F8ACD5CE797}v56.64.8781\\"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4A096B1A1834D04ABA4F3A8DCC57E79\Clients = 3a0000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0EA7D4ECABCFF6845AF8BD3A26F6EBB4\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C4A096B1A1834D04ABA4F3A8DCC57E79\MainFeature	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\4943F0DE11D5B484BA6E10C561374AAC	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B61D15F98E24A4A42882574055142AEA\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D7262B1034480C14790FF927CAF26D0A\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4A096B1A1834D04ABA4F3A8DCC57E79\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B61D15F98E24A4A42882574055142AEA\Provider	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B61D15F98E24A4A42882574055142AEA\SourceList\Media\1 = ";"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D7262B1034480C14790FF927CAF26D0A\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0EA7D4ECABCFF6845AF8BD3A26F6EBB4\PackageCode = "74EEF11D81DB3C6458F196B0238079C8"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4A096B1A1834D04ABA4F3A8DCC57E79\PackageCode = "4D303290B805CF34A86C47A4FB5AF5B0"	msiexec.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Vulkan.zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\windowsdesktop-runtime-7.0.16-win-x64.exe:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
4712	msedge.exe
4712	msedge.exe
4212	msedge.exe
4212	msedge.exe
5052	msedge.exe
5052	msedge.exe
896	identity_helper.exe
896	identity_helper.exe
2292	msedge.exe
2292	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2740	msedge.exe
2740	msedge.exe
3560	msiexec.exe
3560	msiexec.exe
3560	msiexec.exe
3560	msiexec.exe
3560	msiexec.exe
3560	msiexec.exe
3560	msiexec.exe
3560	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	488	Bootstrapper.exe
Token: SeShutdownPrivilege	2620	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeIncreaseQuotaPrivilege	2620	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeSecurityPrivilege	3560	msiexec.exe
Token: SeCreateTokenPrivilege	2620	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeAssignPrimaryTokenPrivilege	2620	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeLockMemoryPrivilege	2620	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeIncreaseQuotaPrivilege	2620	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeMachineAccountPrivilege	2620	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeTcbPrivilege	2620	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeSecurityPrivilege	2620	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeTakeOwnershipPrivilege	2620	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeLoadDriverPrivilege	2620	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeSystemProfilePrivilege	2620	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeSystemtimePrivilege	2620	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeProfSingleProcessPrivilege	2620	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeIncBasePriorityPrivilege	2620	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeCreatePagefilePrivilege	2620	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeCreatePermanentPrivilege	2620	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeBackupPrivilege	2620	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeRestorePrivilege	2620	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeShutdownPrivilege	2620	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeDebugPrivilege	2620	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeAuditPrivilege	2620	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeSystemEnvironmentPrivilege	2620	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeChangeNotifyPrivilege	2620	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeRemoteShutdownPrivilege	2620	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeUndockPrivilege	2620	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeSyncAgentPrivilege	2620	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeEnableDelegationPrivilege	2620	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeManageVolumePrivilege	2620	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeImpersonatePrivilege	2620	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeCreateGlobalPrivilege	2620	windowsdesktop-runtime-7.0.16-win-x64.exe
Token: SeRestorePrivilege	3560	msiexec.exe
Token: SeTakeOwnershipPrivilege	3560	msiexec.exe
Token: SeRestorePrivilege	3560	msiexec.exe
Token: SeTakeOwnershipPrivilege	3560	msiexec.exe
Token: SeRestorePrivilege	3560	msiexec.exe
Token: SeTakeOwnershipPrivilege	3560	msiexec.exe
Token: SeRestorePrivilege	3560	msiexec.exe
Token: SeTakeOwnershipPrivilege	3560	msiexec.exe
Token: SeRestorePrivilege	3560	msiexec.exe
Token: SeTakeOwnershipPrivilege	3560	msiexec.exe
Token: SeRestorePrivilege	3560	msiexec.exe
Token: SeTakeOwnershipPrivilege	3560	msiexec.exe
Token: SeRestorePrivilege	3560	msiexec.exe
Token: SeTakeOwnershipPrivilege	3560	msiexec.exe
Token: SeRestorePrivilege	3560	msiexec.exe
Token: SeTakeOwnershipPrivilege	3560	msiexec.exe
Token: SeRestorePrivilege	3560	msiexec.exe
Token: SeTakeOwnershipPrivilege	3560	msiexec.exe
Token: SeRestorePrivilege	3560	msiexec.exe
Token: SeTakeOwnershipPrivilege	3560	msiexec.exe
Token: SeRestorePrivilege	3560	msiexec.exe
Token: SeTakeOwnershipPrivilege	3560	msiexec.exe
Token: SeRestorePrivilege	3560	msiexec.exe
Token: SeTakeOwnershipPrivilege	3560	msiexec.exe
Token: SeRestorePrivilege	3560	msiexec.exe
Token: SeTakeOwnershipPrivilege	3560	msiexec.exe
Token: SeRestorePrivilege	3560	msiexec.exe
Token: SeTakeOwnershipPrivilege	3560	msiexec.exe
Token: SeRestorePrivilege	3560	msiexec.exe
Token: SeTakeOwnershipPrivilege	3560	msiexec.exe
Token: SeRestorePrivilege	3560	msiexec.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5056	windowsdesktop-runtime-7.0.16-win-x64.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2812 wrote to memory of 236	2812	msedge.exe	83
PID 2812 wrote to memory of 236	2812	msedge.exe	83
PID 2812 wrote to memory of 4872	2812	msedge.exe	88
PID 2812 wrote to memory of 4872	2812	msedge.exe	88
PID 2812 wrote to memory of 4872	2812	msedge.exe	88
PID 2812 wrote to memory of 4872	2812	msedge.exe	88
PID 2812 wrote to memory of 4872	2812	msedge.exe	88
PID 2812 wrote to memory of 4872	2812	msedge.exe	88
PID 2812 wrote to memory of 4872	2812	msedge.exe	88
PID 2812 wrote to memory of 4872	2812	msedge.exe	88
PID 2812 wrote to memory of 4872	2812	msedge.exe	88
PID 2812 wrote to memory of 4872	2812	msedge.exe	88
PID 2812 wrote to memory of 4872	2812	msedge.exe	88
PID 2812 wrote to memory of 4872	2812	msedge.exe	88
PID 2812 wrote to memory of 4872	2812	msedge.exe	88
PID 2812 wrote to memory of 4872	2812	msedge.exe	88
PID 2812 wrote to memory of 4872	2812	msedge.exe	88
PID 2812 wrote to memory of 4872	2812	msedge.exe	88
PID 2812 wrote to memory of 4872	2812	msedge.exe	88
PID 2812 wrote to memory of 4872	2812	msedge.exe	88
PID 2812 wrote to memory of 4872	2812	msedge.exe	88
PID 2812 wrote to memory of 4872	2812	msedge.exe	88
PID 2812 wrote to memory of 4872	2812	msedge.exe	88
PID 2812 wrote to memory of 4872	2812	msedge.exe	88
PID 2812 wrote to memory of 4872	2812	msedge.exe	88
PID 2812 wrote to memory of 4872	2812	msedge.exe	88
PID 2812 wrote to memory of 4872	2812	msedge.exe	88
PID 2812 wrote to memory of 4872	2812	msedge.exe	88
PID 2812 wrote to memory of 4872	2812	msedge.exe	88
PID 2812 wrote to memory of 4872	2812	msedge.exe	88
PID 2812 wrote to memory of 4872	2812	msedge.exe	88
PID 2812 wrote to memory of 4872	2812	msedge.exe	88
PID 2812 wrote to memory of 4872	2812	msedge.exe	88
PID 2812 wrote to memory of 4872	2812	msedge.exe	88
PID 2812 wrote to memory of 4872	2812	msedge.exe	88
PID 2812 wrote to memory of 4872	2812	msedge.exe	88
PID 2812 wrote to memory of 4872	2812	msedge.exe	88
PID 2812 wrote to memory of 4872	2812	msedge.exe	88
PID 2812 wrote to memory of 4872	2812	msedge.exe	88
PID 2812 wrote to memory of 4872	2812	msedge.exe	88
PID 2812 wrote to memory of 4872	2812	msedge.exe	88
PID 2812 wrote to memory of 4872	2812	msedge.exe	88
PID 2812 wrote to memory of 4212	2812	msedge.exe	89
PID 2812 wrote to memory of 4212	2812	msedge.exe	89
PID 488 wrote to memory of 3256	488	Bootstrapper.exe	115
PID 488 wrote to memory of 3256	488	Bootstrapper.exe	115
PID 3256 wrote to memory of 4740	3256	vulkan.exe	116
PID 3256 wrote to memory of 4740	3256	vulkan.exe	116
PID 4740 wrote to memory of 1520	4740	msedge.exe	117
PID 4740 wrote to memory of 1520	4740	msedge.exe	117
PID 4336 wrote to memory of 5056	4336	windowsdesktop-runtime-7.0.16-win-x64.exe	134
PID 4336 wrote to memory of 5056	4336	windowsdesktop-runtime-7.0.16-win-x64.exe	134
PID 4336 wrote to memory of 5056	4336	windowsdesktop-runtime-7.0.16-win-x64.exe	134
PID 5056 wrote to memory of 2620	5056	windowsdesktop-runtime-7.0.16-win-x64.exe	135
PID 5056 wrote to memory of 2620	5056	windowsdesktop-runtime-7.0.16-win-x64.exe	135
PID 5056 wrote to memory of 2620	5056	windowsdesktop-runtime-7.0.16-win-x64.exe	135
PID 3560 wrote to memory of 3692	3560	msiexec.exe	138
PID 3560 wrote to memory of 3692	3560	msiexec.exe	138
PID 3560 wrote to memory of 3692	3560	msiexec.exe	138
PID 3560 wrote to memory of 3472	3560	msiexec.exe	141
PID 3560 wrote to memory of 3472	3560	msiexec.exe	141
PID 3560 wrote to memory of 3472	3560	msiexec.exe	141
PID 3560 wrote to memory of 1904	3560	msiexec.exe	142
PID 3560 wrote to memory of 1904	3560	msiexec.exe	142

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://a.directfiledl.com/getfile?id=66958171&s=4F60071B
1⤵
- Suspicious use of WriteProcessMemory
PID:2812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff8879f3cb8,0x7ff8879f3cc8,0x7ff8879f3cd8
  2⤵
  PID:236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1812,14395063531372995736,15315401260452466614,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2008 /prefetch:2
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1812,14395063531372995736,15315401260452466614,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2052 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4212

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1848,4139247228300528235,10226619312927818324,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1896 /prefetch:2
1⤵
PID:2360

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1848,4139247228300528235,10226619312927818324,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4712

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1848,4139247228300528235,10226619312927818324,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2492 /prefetch:8
1⤵
PID:3252

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,4139247228300528235,10226619312927818324,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3180 /prefetch:1
1⤵
PID:4192

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,4139247228300528235,10226619312927818324,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
1⤵
PID:3604

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4804

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,4139247228300528235,10226619312927818324,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3704 /prefetch:1
1⤵
PID:2536

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2968

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,4139247228300528235,10226619312927818324,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4688 /prefetch:1
1⤵
PID:416

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,4139247228300528235,10226619312927818324,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4524 /prefetch:1
1⤵
PID:1184

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,4139247228300528235,10226619312927818324,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3876 /prefetch:1
1⤵
PID:3776

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1848,4139247228300528235,10226619312927818324,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4924 /prefetch:8
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:5052

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,4139247228300528235,10226619312927818324,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6384 /prefetch:1
1⤵
PID:2816

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,4139247228300528235,10226619312927818324,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6404 /prefetch:1
1⤵
PID:1836

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,4139247228300528235,10226619312927818324,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6596 /prefetch:1
1⤵
PID:4904

C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1848,4139247228300528235,10226619312927818324,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3300 /prefetch:8
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:896

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1848,4139247228300528235,10226619312927818324,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5708 /prefetch:8
1⤵
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:2292

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3076

C:\Users\Admin\Desktop\Vulkan\Assets\Bootstrapper.exe
"C:\Users\Admin\Desktop\Vulkan\Assets\Bootstrapper.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:488
- C:\Users\Admin\Desktop\Vulkan\Assets\Application\vulkan.exe
  "C:\Users\Admin\Desktop\Vulkan\Assets\Application\vulkan.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?framework=Microsoft.NETCore.App&framework_version=7.0.0&arch=x64&rid=win-x64&os=win10&gui=true
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4740
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x120,0x124,0x128,0x48,0x12c,0x7ff8879f3cb8,0x7ff8879f3cc8,0x7ff8879f3cd8
      4⤵
      PID:1520

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1848,4139247228300528235,10226619312927818324,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5264 /prefetch:2
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2732

C:\Windows\SysWOW64\werfault.exe
werfault.exe /h /shared Global\5870efb6317a470d9ec20a8f82f07295 /t 768 /p 488
1⤵
PID:960

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,4139247228300528235,10226619312927818324,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4964 /prefetch:1
1⤵
PID:4808

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,4139247228300528235,10226619312927818324,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6412 /prefetch:1
1⤵
PID:3284

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,4139247228300528235,10226619312927818324,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
1⤵
PID:2164

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1848,4139247228300528235,10226619312927818324,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6880 /prefetch:8
1⤵
PID:1932

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,4139247228300528235,10226619312927818324,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6928 /prefetch:1
1⤵
PID:2428

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,4139247228300528235,10226619312927818324,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6760 /prefetch:1
1⤵
PID:1992

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1848,4139247228300528235,10226619312927818324,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6868 /prefetch:8
1⤵
PID:2736

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,4139247228300528235,10226619312927818324,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:1
1⤵
PID:4108

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1848,4139247228300528235,10226619312927818324,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6768 /prefetch:8
1⤵
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:2740

C:\Users\Admin\Downloads\windowsdesktop-runtime-7.0.16-win-x64.exe
"C:\Users\Admin\Downloads\windowsdesktop-runtime-7.0.16-win-x64.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4336
- C:\Windows\Temp\{2DB770C5-7997-46DC-8005-1DBD37B529C0}\.cr\windowsdesktop-runtime-7.0.16-win-x64.exe
  "C:\Windows\Temp\{2DB770C5-7997-46DC-8005-1DBD37B529C0}\.cr\windowsdesktop-runtime-7.0.16-win-x64.exe" -burn.clean.room="C:\Users\Admin\Downloads\windowsdesktop-runtime-7.0.16-win-x64.exe" -burn.filehandle.attached=592 -burn.filehandle.self=600
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5056
- - C:\Windows\Temp\{8D4C9C80-BBF6-4D20-AF72-9FEBDB4B9BE1}\.be\windowsdesktop-runtime-7.0.16-win-x64.exe
    "C:\Windows\Temp\{8D4C9C80-BBF6-4D20-AF72-9FEBDB4B9BE1}\.be\windowsdesktop-runtime-7.0.16-win-x64.exe" -q -burn.elevated BurnPipe.{D6E8D7F9-5053-4C90-8803-4DF7D7038ECB} {1CB1F91E-5528-4F88-A95E-6C71BB3FEB15} 5056
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    PID:2620

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,4139247228300528235,10226619312927818324,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:1
1⤵
PID:3148

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3560
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 61A67775E95D1BA64C020C5A1DC19BF8
  2⤵
  - Loads dropped DLL
  PID:3692
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 21E1EC99A40ACE2B592FB4E59EEB0166
  2⤵
  - Loads dropped DLL
  PID:3472
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 0881EB1D874A54D0E650B0165790BD7D
  2⤵
  - Loads dropped DLL
  PID:1904
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 48C29C48ECEF493D72B1FAEFA1265657
  2⤵
  - Loads dropped DLL
  PID:4536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e5ee34c.rbs

Filesize
48KB

MD5
b0eeab4a4f478d52157e50c12681d55a

SHA1
d26e477adf0df1babfa246aff6da5281df88dcc2

SHA256
9913209ab021e854382923fdc61832a1e656afbf0635171f040a67ecf4f9bbcd

SHA512
001033f8fc96877830049cf225f9d493fb7617caea700718a3132f7d1a7b06b314c5c52cecceefb1a5d379b0c5d9847ce00b18db6c9ebb201b23fbe1868a4723

Download Submit
C:\Config.Msi\e5ee351.rbs

Filesize
9KB

MD5
1dcf794759a3224de4ce30c29a899ac4

SHA1
b26d50f794dad2ba1a7414c624360bda69d8b71f

SHA256
9ea55aed35914ac752437d448012c4a1e82b1327c182253389318ab05cd34e3b

SHA512
fd5a0c59b8ddaa603a39b1b8e011e70d705edd13e9beb150f79e79bedc373654e3487f9d4632dfd3dc352a8cdbe30ec589be8e084fbccb593badb57cc500513b

Download Submit
C:\Config.Msi\e5ee356.rbs

Filesize
10KB

MD5
bd88a4199f582136fbd221ea9c21790e

SHA1
13a39866af79b4a18d0a72866ac6b01a8fad3c97

SHA256
a8a4bf3b3e628739e3bab1479fe4ec06f81fed0e0596585bfd904a4ae7560f23

SHA512
6960cdc1c837c4c733c1254a790d5300ba16e8453aa4f17cda3e0fde743fe494855139ca604bc4e3347be73af40f37ab2d9da32eb0743b21e5587556c80da55a

Download Submit
C:\Config.Msi\e5ee35c.rbs

Filesize
88KB

MD5
f170281e0a4424350028d5b917d7953c

SHA1
fcf01d2057d78cec52bae65a71bb92237902d391

SHA256
c59e4fa18806265b04e1f1564e9be23e486b085dd7024001296fb804788aa5ab

SHA512
9d6367cbc3f2721ccdc87d78d637d19b255238e8543a9ba80068ea1b9fd5398509874dc1cff5514cf453694135681fa3369d4d4ca2e4f3b27a670912f590a1c6

Download Submit
C:\Program Files\dotnet\ThirdPartyNotices.txt

Filesize
85KB

MD5
5c13a5ea8c8cc3474240981d0ffa88ff

SHA1
1d8d3ce27d9dc3d9fb4fa4b06c20137d25879d80

SHA256
4f9bb3901879bafae3a17c6c4009ee5c15384a06fc234bed78937969079c77da

SHA512
32ea79ff5194d8a18e75f277aed5610b4955db15b0abbcc2664cf07f372bebfc57eb665ad078dc3da3ce5ee0d8856140c2a1bc7032b578dd103d43998d682d88

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
88e9aaca62aa2aed293699f139d7e7e1

SHA1
09d9ccfbdff9680366291d5d1bc311b0b56a05e9

SHA256
27dcdb1cddab5d56ac53cff93489038de93f61b5504f8595b1eb2d3124bbc12c

SHA512
d90dabe34504dde422f5f6dec87851af8f4849f521759a768dfa0a38f50827b099dfde256d8f8467460c289bdb168358b2678772b8b49418c23b882ba21d4793

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
341f6b71eb8fcb1e52a749a673b2819c

SHA1
6c81b6acb3ce5f64180cb58a6aae927b882f4109

SHA256
57934852f04cef38bb4acbe4407f707f137fada0c36bab71b2cdfd58cc030a29

SHA512
57ecaa087bc5626752f89501c635a2da8404dbda89260895910a9cc31203e15095eba2e1ce9eee1481f02a43d0df77b75cb9b0d77a3bc3b894fdd1cf0f6ce6f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
811B

MD5
265dc5b3e51c10a47f4fc63d13ef1454

SHA1
a9e0f45c3d68c9cde6ab65bed705430ac5a794b9

SHA256
5873af144fb4760a4f5b561068ac47c49425215f1786a713b386ee001b805dac

SHA512
ebe57b179953a65430823bf3918deb58d1e813d441dfd9c7b5e5539b34ed80af832b9a7f26952409a1afd406a3f0d26ea3580f24fa4dc230a46b96e4ef5f3f74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
fe493b7f096fbadb478bfbb7dec46d55

SHA1
7d943250686b660dc0a4a715e04056cda60647d4

SHA256
d880d47db72e367fb07379ef6b21636928d2305bb78fdc2893d4b0008f69d459

SHA512
99c9947dcd0176710c46e3d38ac8e7fd25bdd67bd98c5085809d4c6efc00d49fb5ad1084f411284eeb793009bd233df93608ef90681e620c4da3bbcc02b7eba0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5ac39f.TMP

Filesize
371B

MD5
8c344c8efc3d33aa8c1c44945954f4e9

SHA1
8e6c03d0dfe8d9dc43424033031f0655d0b8d421

SHA256
6b22ffa9bed07467e2ec70ca7206d89c7e027c0f7814fc2c11a50be53e7ac000

SHA512
90189e43ee902c6c35b2c2e5d17a833f7fcc61654e4d3225c2fee5fcdd33be7f6c35da0eb28dca3e8dbd09360faae7684ab898fb8510717e79c3853e50ec50f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
ec976cba48d663b0309ebf84c724299b

SHA1
b2706b68bd7c4cda798c225fecc6b276f073f57c

SHA256
2bb145403a8252bdf4a18f4692087d3626c2b63e426c5e3965aff244beb183ff

SHA512
236bd7d939030168b5729253d41b0ef4db2b950d3c4ea8afa752a36c4a8d80f9b8e8d80f7f97de5c183ac9ae5e89f1cdad0a8eee5345655d5fbabf8463bfd43d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20240305202523_000_dotnet_runtime_7.0.16_win_x64.msi.log

Filesize
2KB

MD5
e131b72b9d617965ec6eee8e12d34d72

SHA1
0a443b46cfafd411c0e6a7664e62c7fff521d2c9

SHA256
1ffe5bdfb561fee1ccf8415a93601b88c1af7026b1ba2e5954e441cb31c63595

SHA512
3d93089dc875cf5d5bac12192bfd461a563f4bf10264c6f7bdbeccde1a0dae3529a628ae304e133ee0f09f13e9729889a378e4ea6a80461ff7096dd6bc7d1310

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20240305202523_001_dotnet_hostfxr_7.0.16_win_x64.msi.log

Filesize
2KB

MD5
18e5cb0b0ae1caee65554eec0962f76e

SHA1
706bab2a2e81c38f4cc3275b41a108ebff593130

SHA256
a4ce689e87ff9621f6d9e812ddc2682781f468e81983b95016c4451c766c3a6a

SHA512
f89b01b7f3d9ad6b9f2b7c69eee215aaa7ce1d67dfa38555d9fc96d9c8579998985630ad2be0b2c6779c64a7ebc1d7cbb323b044c58e89884dbc794cd9007240

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20240305202523_002_dotnet_host_7.0.16_win_x64.msi.log

Filesize
2KB

MD5
6e81fe4866bcd3a734426b6279c0ec0d

SHA1
6edce240eada41e8e98ceade54da97b200af0d19

SHA256
95b94cf71badf9ba4ed38a65b293ef5efcdd8f08eed926c7aab6d2ba4d98b758

SHA512
04596822565c591a2feb4430657e9936cc4be0874d96b50d6ba2f2d87e818527f3a88a1df9d18b61350e158c1e1bb8a1eb977a15236998e306e914d3e576d600

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20240305202523_003_windowsdesktop_runtime_7.0.16_win_x64.msi.log

Filesize
2KB

MD5
6498f6dbede3bbffccc041469c554068

SHA1
5e825fd936933a5a905aa60d967bde80ab615cf7

SHA256
4c34186aaf4287814d0af6e105a328d85199841979e397be4007a324f94fa56a

SHA512
b697f3559bcbbe201e15d790c12225ef488dfca4bd7e0dbe64739bff6f7915b1f5c8b34dd18319a52c11d66a4e625f3e28f241423e22f0a56244a21a0d37a3a5

Download Submit
C:\Users\Admin\Desktop\Vulkan\Assets\Application\Vulkan Beta.runtimeconfig.json

Filesize
266B

MD5
d8ae75ee64991f91ddf5fa2c72adcc7c

SHA1
c8318862e3f8051daed02b9d764e7468cbe4bf86

SHA256
6a9ae797b520e700bcb418aa36e945f22d27c86b3aebb393cb7c4462d52e76da

SHA512
8907e87ce5c582ada4d391009b015ea9878c3f788a15f327dc7bf147e8a4ac80258e0541f1f35f3e00cb29dfbd55839908595a6941920d68bf7cb8bfdffb4998

Download Submit
C:\Users\Admin\Desktop\Vulkan\Assets\Application\vulkan.exe

Filesize
151KB

MD5
9b5b0038451fe15de9b7caca8938cf8e

SHA1
ddf094b90dbe5e1bf407d99b50c9362a46bc3f36

SHA256
63febda7441e0f49c07e504f462bd48f261bf4f16b7772dde41ddeb7b02ca9d8

SHA512
b42e43db823add4f057debf71ffb928fa8f06dea42ec8acda5281993502591d126aad711cd10f88a074850389ce0fef204a08e7c5d05f68951a612657f956902

Download Submit
C:\Users\Admin\Downloads\windowsdesktop-runtime-7.0.16-win-x64.exe

Filesize
13.8MB

MD5
13efc0acd31995be86a969f7d0fa6d20

SHA1
7f348bac2004febbf61e20aa61cc0467b68a5fda

SHA256
b729207c8a567c3d7205fb9eb5eacf4c798f971c940c6a9fcc3224c574f9d568

SHA512
efdd12e022a4dc9078e0a909c35ed9524fa048f049274a82c4e767f342ee6e78f76874ffeca590f55283dd815c60b663b5d3449d138f859732109b4d1190cdbe

Download Submit
C:\Users\Admin\Downloads\windowsdesktop-runtime-7.0.16-win-x64.exe

Filesize
15.4MB

MD5
208abaf13223933bf013558f09a5e50f

SHA1
54982b60f50970d8f41e038ec53bd3111094413e

SHA256
f1df5fb65b288c8233e806f3c32d2efbbd981d1b0905e0afc81d45413a7cde1e

SHA512
057254e78bdfc4211c202f7d5f3ee790062594ce5287e484804df88affef41836ba1ec2b37b20129b40ba56574f1230f2045d63f6fb89600f76dacf17d99bd95

Download Submit
C:\Windows\Installer\MSIC3E.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\e5ee34d.msi

Filesize
22.4MB

MD5
7347ee30bcbdfe0f5111d6083d2f3eb6

SHA1
2367b76aa82e393399d90bd791511d46dc54b9be

SHA256
671b188be27961f2aabcecd1c9fb2054640280d87e79a1fd02dd9786ac7b5a1f

SHA512
cca2e97b0b290acab1b28ddd30b9f1a46e99eb6791ad5787949f894f70e226b8dfc29d9ebe9e608ffcb4d15697c9dfd4569138cdf40ef1bf9ddf6abc5cd33c54

Download Submit
C:\Windows\Installer\e5ee35d.msi

Filesize
7.0MB

MD5
91ed969f2dcbf2c8f1e7b54e010b5bb1

SHA1
5b4aeda7e17135a8902d89c80f7f707830b5f7b4

SHA256
d0803cb45a7ee61987e629e5ac772047f73f7d6d088fd003744e81128832b7b6

SHA512
2b45742a290f05ba7ac511a99b5d4b64f8fbf8886d16b0cb036da9c71e352a9cc8cad4fd0e99ef509e532b0a946a04213e7fb92d6bfaa6e779962c781b2a4894

Download Submit
C:\Windows\Temp\{2DB770C5-7997-46DC-8005-1DBD37B529C0}\.cr\windowsdesktop-runtime-7.0.16-win-x64.exe

Filesize
610KB

MD5
9656c3086081a41540338b94df6ae084

SHA1
dc87b2d0dde3604437d13d2f89fe9ecb7c7b0373

SHA256
6a7a85e1b9e899ce83ca29eca2e0b34126acf97675991b431b279278a03c41f2

SHA512
7bdfc5943968403b787700f5c4e12d88f34bdca4569fbff21e178c17eba40f8db68135aaf426b990617316c10b86687a08375c611c4a9e5a8db8eb2c2be3e9cc

Download Submit
C:\Windows\Temp\{8D4C9C80-BBF6-4D20-AF72-9FEBDB4B9BE1}\.ba\bg.png

Filesize
4KB

MD5
9eb0320dfbf2bd541e6a55c01ddc9f20

SHA1
eb282a66d29594346531b1ff886d455e1dcd6d99

SHA256
9095bf7b6baa0107b40a4a6d727215be077133a190f4ca9bd89a176842141e79

SHA512
9ada3a1757a493fbb004bd767fab8f77430af69d71479f340b8b8ede904cc94cd733700db593a4a2d2e1184c0081fd0648318d867128e1cb461021314990931d

Download Submit
C:\Windows\Temp\{8D4C9C80-BBF6-4D20-AF72-9FEBDB4B9BE1}\.ba\wixstdba.dll

Filesize
197KB

MD5
4356ee50f0b1a878e270614780ddf095

SHA1
b5c0915f023b2e4ed3e122322abc40c4437909af

SHA256
41a8787fdc9467f563438daba4131191aa1eb588a81beb9a89fe8bd886c16104

SHA512
b9e482efe9189683dabfc9feff8b386d7eba4ecf070f42a1eebee6052cfb181a19497f831f1ea6429cfcce1d4865a5d279b24bd738d702902e9887bb9f0c4691

Download Submit
C:\Windows\Temp\{8D4C9C80-BBF6-4D20-AF72-9FEBDB4B9BE1}\dotnet_host_7.0.16_win_x64.msi

Filesize
744KB

MD5
a1f68b5ec6da37ffc65f12f106d70f3d

SHA1
1bef05fa3f179a9ad079326a5a38b7728a81967c

SHA256
7c01b2af6cd178d88dc11b2c12840beb0b08f8dc4e8958ba8d7166759e0c64b8

SHA512
0dc65ee5f8a4720012e678dbeaaa44df10e12ad7941f4835c37a0d178abb7f282d0ee13e7b45fc56141489826c3c980020179ffb5973989a463f4aeacd188a93

Download Submit
C:\Windows\Temp\{8D4C9C80-BBF6-4D20-AF72-9FEBDB4B9BE1}\dotnet_hostfxr_7.0.16_win_x64.msi

Filesize
804KB

MD5
3db1b0ad874499a5bd80b9ad2ed2103f

SHA1
77f02d58918daa3cb25364960a1196ce2f711d0f

SHA256
7b32cfc57dae7fe08f7ed00d54771107aeb4b80305a7269f6b9ac2cb19710c35

SHA512
e2214799e8febb31e2dadeef8904e5692fb94f916500960642b780a4b68f9bd2d8d7e62d579418bcced9a7b0f7ff958e672783fc019617d17499e8c5e1b777e1

Download Submit
C:\Windows\Temp\{8D4C9C80-BBF6-4D20-AF72-9FEBDB4B9BE1}\dotnet_runtime_7.0.16_win_x64.msi

Filesize
1.8MB

MD5
9c96e7febe1da82e8ef9aff8089a0cf8

SHA1
bca22fa940d8124152dadc9e16c342a7c26f0396

SHA256
598ece5621ed60e65354c5d08bb12d713d46a1f8271062ddad484665f8a807d0

SHA512
475694bfa484cd15d80834b53172f11f2d5154353659e8c015d05614612228b0fa3dadf22c5cba9766c4bca976896c03d11d512517010f3bf78b9d8cf5ceba0c

Download Submit
memory/488-41-0x000000000A620000-0x000000000A62A000-memory.dmp

Filesize
40KB

Download
memory/488-37-0x0000000005360000-0x0000000005370000-memory.dmp

Filesize
64KB

Download
memory/488-38-0x0000000005270000-0x000000000527A000-memory.dmp

Filesize
40KB

Download
memory/488-39-0x0000000005360000-0x0000000005370000-memory.dmp

Filesize
64KB

Download
memory/488-36-0x00000000051B0000-0x0000000005242000-memory.dmp

Filesize
584KB

Download
memory/488-53-0x00000000747C0000-0x0000000074F71000-memory.dmp

Filesize
7.7MB

Download
memory/488-35-0x0000000005820000-0x0000000005DC6000-memory.dmp

Filesize
5.6MB

Download
memory/488-42-0x000000000A470000-0x000000000A482000-memory.dmp

Filesize
72KB

Download
memory/488-34-0x00000000747C0000-0x0000000074F71000-memory.dmp

Filesize
7.7MB

Download
memory/488-33-0x00000000006E0000-0x0000000000716000-memory.dmp

Filesize
216KB

Download
memory/488-69-0x00000000747C0000-0x0000000074F71000-memory.dmp

Filesize
7.7MB

Download
memory/488-55-0x0000000005360000-0x0000000005370000-memory.dmp

Filesize
64KB

Download
memory/488-54-0x0000000005360000-0x0000000005370000-memory.dmp

Filesize
64KB

Download