rhadamanthys | hxxps://github[.]com/kan1529/Solara-executor/releases/download/Download/LoaderV6[.]zip

Analysis

max time kernel
242s
max time network
242s
platform
windows11-21h2_x64
resource
win11-20240709-en
resource tags

arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
submitted
19/07/2024, 05:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/kan1529/Solara-executor/releases/download/Download/LoaderV6.zip

Score

10^/10

rhadamanthys discovery execution persistence privilege_escalation stealer

Malware Config

Signatures

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 2244 created 2900	2244	BitLockerToGo.exe	49

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3112	powershell.exe
1812	powershell.exe
3112	powershell.exe
1812	powershell.exe

Downloads MZ/PE file

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0"	MicrosoftEdgeUpdate.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 25 IoCs

pid	Process
4936	MicrosoftEdgeWebview2Setup.exe
2824	MicrosoftEdgeUpdate.exe
3828	MicrosoftEdgeUpdate.exe
3408	MicrosoftEdgeUpdate.exe
4160	MicrosoftEdgeUpdateComRegisterShell64.exe
4080	MicrosoftEdgeUpdateComRegisterShell64.exe
3704	MicrosoftEdgeUpdateComRegisterShell64.exe
3908	MicrosoftEdgeUpdate.exe
3528	MicrosoftEdgeUpdate.exe
3476	MicrosoftEdgeUpdate.exe
1196	MicrosoftEdgeUpdate.exe
4156	MicrosoftEdge_X64_126.0.2592.113.exe
1912	setup.exe
3596	setup.exe
1256	MicrosoftEdgeUpdate.exe
4756	msedgewebview2.exe
2360	msedgewebview2.exe
4332	msedgewebview2.exe
1004	msedgewebview2.exe
1224	msedgewebview2.exe
4720	msedgewebview2.exe
2852	driver1.exe
4532	msedgewebview2.exe
3908	msedgewebview2.exe
2012	msedgewebview2.exe

Loads dropped DLL 42 IoCs

pid	Process
2824	MicrosoftEdgeUpdate.exe
3828	MicrosoftEdgeUpdate.exe
3408	MicrosoftEdgeUpdate.exe
4160	MicrosoftEdgeUpdateComRegisterShell64.exe
3408	MicrosoftEdgeUpdate.exe
4080	MicrosoftEdgeUpdateComRegisterShell64.exe
3408	MicrosoftEdgeUpdate.exe
3704	MicrosoftEdgeUpdateComRegisterShell64.exe
3408	MicrosoftEdgeUpdate.exe
3908	MicrosoftEdgeUpdate.exe
3528	MicrosoftEdgeUpdate.exe
3476	MicrosoftEdgeUpdate.exe
3476	MicrosoftEdgeUpdate.exe
3528	MicrosoftEdgeUpdate.exe
1196	MicrosoftEdgeUpdate.exe
1256	MicrosoftEdgeUpdate.exe
1784	loaderV6.exe
4756	msedgewebview2.exe
2360	msedgewebview2.exe
4756	msedgewebview2.exe
4756	msedgewebview2.exe
4756	msedgewebview2.exe
4332	msedgewebview2.exe
1224	msedgewebview2.exe
4332	msedgewebview2.exe
1004	msedgewebview2.exe
1224	msedgewebview2.exe
1004	msedgewebview2.exe
4332	msedgewebview2.exe
4332	msedgewebview2.exe
4332	msedgewebview2.exe
4332	msedgewebview2.exe
4720	msedgewebview2.exe
4720	msedgewebview2.exe
4720	msedgewebview2.exe
4756	msedgewebview2.exe
3324	loaderV6.exe
4532	msedgewebview2.exe
3908	msedgewebview2.exe
2012	msedgewebview2.exe
2012	msedgewebview2.exe
2012	msedgewebview2.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	loaderV6.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	loaderV6.exe

Checks system information in the registry 2 TTPs 12 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2852 set thread context of 2244	2852	driver1.exe	146

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.113\Locales\as.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.113\Locales\gd.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.113\Locales\ur.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU17E8.tmp\msedgeupdateres_mk.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.113\concrt140.dll	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.113\Locales\mi.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.113\msedgewebview2.exe.sig	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.113\PdfPreview\PdfPreviewHandler.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.113\Locales\tt.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.113\identity_proxy\win11\identity_helper.Sparse.Beta.msix	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.113\Trust Protection Lists\Mu\Fingerprinting	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.113\EdgeWebView.dat	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.113\libGLESv2.dll	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.113\Locales\it.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.113\prefs_enclave_x64.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.113\vk_swiftshader_icd.json	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.113\MEIPreload\preloaded_data.pb	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU17E8.tmp\msedgeupdateres_iw.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{804964A7-D9C1-4FE4-BF9B-861F2C928813}\EDGEMITMP_7CF5B.tmp\MSEDGE.PACKED.7Z	MicrosoftEdge_X64_126.0.2592.113.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.113\Locales\ta.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.113\Trust Protection Lists\Sigma\Cryptomining	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.113\Locales\lt.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.113\Locales\qu.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU17E8.tmp\msedgeupdateres_lv.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU17E8.tmp\msedgeupdateres_ta.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.113\Locales\ug.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.113\Locales\af.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.113\Locales\or.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.113\identity_proxy\win10\identity_helper.Sparse.Stable.msix	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.113\vulkan-1.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.113\Locales\bg.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.113\Locales\sl.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.113\edge_feedback\camera_mf_trace.wprp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.113\libGLESv2.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.113\Locales\gd.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.113\Locales\ta.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU17E8.tmp\msedgeupdateres_ja.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU17E8.tmp\msedgeupdateres_bn-IN.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU17E8.tmp\msedgeupdateres_eu.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.113\Locales\zh-TW.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.113\Trust Protection Lists\Mu\Entities	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.113\Locales\kok.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.113\BHO\ie_to_edge_bho.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.113\cookie_exporter.exe	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.113\msvcp140.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.113\Locales\fr.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.113\Trust Protection Lists\Mu\Cryptomining	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.113\Trust Protection Lists\Sigma\Staging	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU17E8.tmp\msedgeupdateres_sv.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.113\Locales\lo.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.113\Locales\nl.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.113\MEIPreload\manifest.json	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.113\VisualElements\SmallLogoBeta.png	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.113\Locales\cy.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.113\Trust Protection Lists\Mu\Analytics	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.113\elevation_service.exe	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.113\msedge_100_percent.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.113\identity_proxy\beta.identity_helper.exe.manifest	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU17E8.tmp\msedgeupdateres_th.dll	MicrosoftEdgeWebview2Setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.113\VisualElements\LogoBeta.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.113\Locales\zh-CN.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.113\identity_proxy\win10\identity_helper.Sparse.Beta.msix	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Temp\EU17E8.tmp\MicrosoftEdgeUpdateSetup.exe	MicrosoftEdgeWebview2Setup.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File created	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File created	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\metadata	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp	msedgewebview2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4392	2244	WerFault.exe	146
1584	2244	WerFault.exe	146

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
2172	wmic.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
1536	tasklist.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

GoLang User-Agent 2 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	56	Go-http-client/1.1
HTTP User-Agent header	57	Go-http-client/1.1

Modifies data under HKEY_USERS 44 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133658392940973465"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CoreMachineClass\CurVer	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E421557C-0628-43FB-BF2B-7C9F8A4D067C}\VersionIndependentProgID\ = "MicrosoftEdgeUpdate.Update3WebMachineFallback"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\NumMethods\ = "12"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}\LocalizedString = "@C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.193.5\\msedgeupdate.dll,-3000"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{513C065E-085A-40C1-B47D-D2F56F9AA0D1}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.193.5\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\ProxyStubClsid32\ = "{513C065E-085A-40C1-B47D-D2F56F9AA0D1}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\NumMethods\ = "4"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\ = "IJobObserver"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}\LocalizedString = "@C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.193.5\\msedgeupdate.dll,-3000"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CredentialDialogMachine	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\ = "ICredentialDialog"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\NumMethods	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B9063E4-3882-485E-8797-F28A0240782F}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassSvc.1.0\ = "Microsoft Edge Update Legacy On Demand"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\NumMethods\ = "10"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\NumMethods\ = "10"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\NumMethods	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8F09CD6C-5964-4573-82E3-EBFF7702865B}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}\ = "IGoogleUpdate3Web"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\ProxyStubClsid32\ = "{513C065E-085A-40C1-B47D-D2F56F9AA0D1}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2E1DD7EF-C12D-4F8E-8AD8-CF8CC265BAD0}\Elevation\Enabled = "1"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebSvc.1.0\CLSID\ = "{EA92A799-267E-4DF5-A6ED-6A7E0684BB8A}"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E421557C-0628-43FB-BF2B-7C9F8A4D067C}\LocalServer32\ = "\"C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.193.5\\MicrosoftEdgeUpdateOnDemand.exe\""	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\NumMethods\ = "24"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\NumMethods\ = "10"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\ = "IAppCommand2"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\ProxyStubClsid32\ = "{513C065E-085A-40C1-B47D-D2F56F9AA0D1}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}\NumMethods\ = "4"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9F3F5F5D-721A-4B19-9B5D-69F664C1A591}\ = "Google Update Policy Status Class"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1B9063E4-3882-485E-8797-F28A0240782F}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\ = "IGoogleUpdateCore"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2E1DD7EF-C12D-4F8E-8AD8-CF8CC265BAD0}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\ProxyStubClsid32\ = "{513C065E-085A-40C1-B47D-D2F56F9AA0D1}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\ = "IAppCommand2"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}\ProxyStubClsid32\ = "{513C065E-085A-40C1-B47D-D2F56F9AA0D1}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebMachineFallback\CurVer\ = "MicrosoftEdgeUpdate.Update3WebMachineFallback.1.0"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E421557C-0628-43FB-BF2B-7C9F8A4D067C}\Elevation	MicrosoftEdgeUpdate.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\LoaderV6.zip:Zone.Identifier	chrome.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
3448	chrome.exe
3448	chrome.exe
1784	loaderV6.exe
2824	MicrosoftEdgeUpdate.exe
2824	MicrosoftEdgeUpdate.exe
2824	MicrosoftEdgeUpdate.exe
2824	MicrosoftEdgeUpdate.exe
2824	MicrosoftEdgeUpdate.exe
2824	MicrosoftEdgeUpdate.exe
3112	powershell.exe
3112	powershell.exe
3112	powershell.exe
1812	powershell.exe
1812	powershell.exe
1812	powershell.exe
3324	loaderV6.exe
2244	BitLockerToGo.exe
2244	BitLockerToGo.exe
1892	openwith.exe
1892	openwith.exe
1892	openwith.exe
1892	openwith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
3448	chrome.exe
3448	chrome.exe
4756	msedgewebview2.exe
4756	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3448	chrome.exe
Token: SeCreatePagefilePrivilege	3448	chrome.exe
Token: SeShutdownPrivilege	3448	chrome.exe
Token: SeCreatePagefilePrivilege	3448	chrome.exe
Token: SeShutdownPrivilege	3448	chrome.exe
Token: SeCreatePagefilePrivilege	3448	chrome.exe
Token: SeShutdownPrivilege	3448	chrome.exe
Token: SeCreatePagefilePrivilege	3448	chrome.exe
Token: SeShutdownPrivilege	3448	chrome.exe
Token: SeCreatePagefilePrivilege	3448	chrome.exe
Token: SeShutdownPrivilege	3448	chrome.exe
Token: SeCreatePagefilePrivilege	3448	chrome.exe
Token: SeShutdownPrivilege	3448	chrome.exe
Token: SeCreatePagefilePrivilege	3448	chrome.exe
Token: SeDebugPrivilege	2824	MicrosoftEdgeUpdate.exe
Token: SeDebugPrivilege	2824	MicrosoftEdgeUpdate.exe
Token: SeIncreaseQuotaPrivilege	2172	wmic.exe
Token: SeSecurityPrivilege	2172	wmic.exe
Token: SeTakeOwnershipPrivilege	2172	wmic.exe
Token: SeLoadDriverPrivilege	2172	wmic.exe
Token: SeSystemProfilePrivilege	2172	wmic.exe
Token: SeSystemtimePrivilege	2172	wmic.exe
Token: SeProfSingleProcessPrivilege	2172	wmic.exe
Token: SeIncBasePriorityPrivilege	2172	wmic.exe
Token: SeCreatePagefilePrivilege	2172	wmic.exe
Token: SeBackupPrivilege	2172	wmic.exe
Token: SeRestorePrivilege	2172	wmic.exe
Token: SeShutdownPrivilege	2172	wmic.exe
Token: SeDebugPrivilege	2172	wmic.exe
Token: SeSystemEnvironmentPrivilege	2172	wmic.exe
Token: SeRemoteShutdownPrivilege	2172	wmic.exe
Token: SeUndockPrivilege	2172	wmic.exe
Token: SeManageVolumePrivilege	2172	wmic.exe
Token: 33	2172	wmic.exe
Token: 34	2172	wmic.exe
Token: 35	2172	wmic.exe
Token: 36	2172	wmic.exe
Token: SeIncreaseQuotaPrivilege	2172	wmic.exe
Token: SeSecurityPrivilege	2172	wmic.exe
Token: SeTakeOwnershipPrivilege	2172	wmic.exe
Token: SeLoadDriverPrivilege	2172	wmic.exe
Token: SeSystemProfilePrivilege	2172	wmic.exe
Token: SeSystemtimePrivilege	2172	wmic.exe
Token: SeProfSingleProcessPrivilege	2172	wmic.exe
Token: SeIncBasePriorityPrivilege	2172	wmic.exe
Token: SeCreatePagefilePrivilege	2172	wmic.exe
Token: SeBackupPrivilege	2172	wmic.exe
Token: SeRestorePrivilege	2172	wmic.exe
Token: SeShutdownPrivilege	2172	wmic.exe
Token: SeDebugPrivilege	2172	wmic.exe
Token: SeSystemEnvironmentPrivilege	2172	wmic.exe
Token: SeRemoteShutdownPrivilege	2172	wmic.exe
Token: SeUndockPrivilege	2172	wmic.exe
Token: SeManageVolumePrivilege	2172	wmic.exe
Token: 33	2172	wmic.exe
Token: 34	2172	wmic.exe
Token: 35	2172	wmic.exe
Token: 36	2172	wmic.exe
Token: SeDebugPrivilege	1536	tasklist.exe
Token: SeDebugPrivilege	3112	powershell.exe
Token: SeDebugPrivilege	1812	powershell.exe
Token: SeIncreaseQuotaPrivilege	396	wmic.exe
Token: SeSecurityPrivilege	396	wmic.exe
Token: SeTakeOwnershipPrivilege	396	wmic.exe

Suspicious use of FindShellTrayWindow 37 IoCs

pid	Process
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3448 wrote to memory of 1444	3448	chrome.exe	82
PID 3448 wrote to memory of 1444	3448	chrome.exe	82
PID 3448 wrote to memory of 2128	3448	chrome.exe	83
PID 3448 wrote to memory of 2128	3448	chrome.exe	83
PID 3448 wrote to memory of 2128	3448	chrome.exe	83
PID 3448 wrote to memory of 2128	3448	chrome.exe	83
PID 3448 wrote to memory of 2128	3448	chrome.exe	83
PID 3448 wrote to memory of 2128	3448	chrome.exe	83
PID 3448 wrote to memory of 2128	3448	chrome.exe	83
PID 3448 wrote to memory of 2128	3448	chrome.exe	83
PID 3448 wrote to memory of 2128	3448	chrome.exe	83
PID 3448 wrote to memory of 2128	3448	chrome.exe	83
PID 3448 wrote to memory of 2128	3448	chrome.exe	83
PID 3448 wrote to memory of 2128	3448	chrome.exe	83
PID 3448 wrote to memory of 2128	3448	chrome.exe	83
PID 3448 wrote to memory of 2128	3448	chrome.exe	83
PID 3448 wrote to memory of 2128	3448	chrome.exe	83
PID 3448 wrote to memory of 2128	3448	chrome.exe	83
PID 3448 wrote to memory of 2128	3448	chrome.exe	83
PID 3448 wrote to memory of 2128	3448	chrome.exe	83
PID 3448 wrote to memory of 2128	3448	chrome.exe	83
PID 3448 wrote to memory of 2128	3448	chrome.exe	83
PID 3448 wrote to memory of 2128	3448	chrome.exe	83
PID 3448 wrote to memory of 2128	3448	chrome.exe	83
PID 3448 wrote to memory of 2128	3448	chrome.exe	83
PID 3448 wrote to memory of 2128	3448	chrome.exe	83
PID 3448 wrote to memory of 2128	3448	chrome.exe	83
PID 3448 wrote to memory of 2128	3448	chrome.exe	83
PID 3448 wrote to memory of 2128	3448	chrome.exe	83
PID 3448 wrote to memory of 2128	3448	chrome.exe	83
PID 3448 wrote to memory of 2128	3448	chrome.exe	83
PID 3448 wrote to memory of 2128	3448	chrome.exe	83
PID 3448 wrote to memory of 1160	3448	chrome.exe	84
PID 3448 wrote to memory of 1160	3448	chrome.exe	84
PID 3448 wrote to memory of 4884	3448	chrome.exe	85
PID 3448 wrote to memory of 4884	3448	chrome.exe	85
PID 3448 wrote to memory of 4884	3448	chrome.exe	85
PID 3448 wrote to memory of 4884	3448	chrome.exe	85
PID 3448 wrote to memory of 4884	3448	chrome.exe	85
PID 3448 wrote to memory of 4884	3448	chrome.exe	85
PID 3448 wrote to memory of 4884	3448	chrome.exe	85
PID 3448 wrote to memory of 4884	3448	chrome.exe	85
PID 3448 wrote to memory of 4884	3448	chrome.exe	85
PID 3448 wrote to memory of 4884	3448	chrome.exe	85
PID 3448 wrote to memory of 4884	3448	chrome.exe	85
PID 3448 wrote to memory of 4884	3448	chrome.exe	85
PID 3448 wrote to memory of 4884	3448	chrome.exe	85
PID 3448 wrote to memory of 4884	3448	chrome.exe	85
PID 3448 wrote to memory of 4884	3448	chrome.exe	85
PID 3448 wrote to memory of 4884	3448	chrome.exe	85
PID 3448 wrote to memory of 4884	3448	chrome.exe	85
PID 3448 wrote to memory of 4884	3448	chrome.exe	85
PID 3448 wrote to memory of 4884	3448	chrome.exe	85
PID 3448 wrote to memory of 4884	3448	chrome.exe	85
PID 3448 wrote to memory of 4884	3448	chrome.exe	85
PID 3448 wrote to memory of 4884	3448	chrome.exe	85
PID 3448 wrote to memory of 4884	3448	chrome.exe	85
PID 3448 wrote to memory of 4884	3448	chrome.exe	85
PID 3448 wrote to memory of 4884	3448	chrome.exe	85
PID 3448 wrote to memory of 4884	3448	chrome.exe	85
PID 3448 wrote to memory of 4884	3448	chrome.exe	85
PID 3448 wrote to memory of 4884	3448	chrome.exe	85
PID 3448 wrote to memory of 4884	3448	chrome.exe	85
PID 3448 wrote to memory of 4884	3448	chrome.exe	85

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection	msedgewebview2.exe

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2900
- C:\Windows\SysWOW64\openwith.exe
  "C:\Windows\system32\openwith.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1892

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/kan1529/Solara-executor/releases/download/Download/LoaderV6.zip
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.106 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9b893cc40,0x7ff9b893cc4c,0x7ff9b893cc58
  2⤵
  PID:1444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1884,i,15323274941894479795,17038652276886349288,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=1880 /prefetch:2
  2⤵
  PID:2128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1732,i,15323274941894479795,17038652276886349288,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=2360 /prefetch:3
  2⤵
  PID:1160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=1684,i,15323274941894479795,17038652276886349288,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=2464 /prefetch:8
  2⤵
  PID:4884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3056,i,15323274941894479795,17038652276886349288,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=3096 /prefetch:1
  2⤵
  PID:1996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3088,i,15323274941894479795,17038652276886349288,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:3144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4664,i,15323274941894479795,17038652276886349288,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=4708 /prefetch:8
  2⤵
  PID:2580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4092,i,15323274941894479795,17038652276886349288,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=4648 /prefetch:8
  2⤵
  - NTFS ADS
  PID:3840

C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"
1⤵
PID:4980

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1520

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2040

C:\Users\Admin\Downloads\LoaderV6\LoaderV6\loaderV6.exe
"C:\Users\Admin\Downloads\LoaderV6\LoaderV6\loaderV6.exe"
1⤵
- Loads dropped DLL
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
PID:1784
- C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe
  C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:4936
- - C:\Program Files (x86)\Microsoft\Temp\EU17E8.tmp\MicrosoftEdgeUpdate.exe
    "C:\Program Files (x86)\Microsoft\Temp\EU17E8.tmp\MicrosoftEdgeUpdate.exe" /installsource taggedmi /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"
    3⤵
    - Event Triggered Execution: Image File Execution Options Injection
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks system information in the registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2824
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Modifies registry class
      PID:3828
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Modifies registry class
      PID:3408
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.193.5\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.193.5\MicrosoftEdgeUpdateComRegisterShell64.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:4160
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.193.5\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.193.5\MicrosoftEdgeUpdateComRegisterShell64.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:4080
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.193.5\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.193.5\MicrosoftEdgeUpdateComRegisterShell64.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:3704
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTMuNSIgc2hlbGxfdmVyc2lvbj0iMS4zLjE5My41IiBpc21hY2hpbmU9IjEiIHNlc3Npb25pZD0ie0EzMUZCMjM1LUZENzUtNDgwRi04QkI0LTMwNUI1RDg4MTQ0N30iIHVzZXJpZD0iezZCRDkwQkM3LThCRUQtNEQzNS1CNzkwLUEzMEREMDA1OUQ4Qn0iIGluc3RhbGxzb3VyY2U9InRhZ2dlZG1pIiByZXF1ZXN0aWQ9Ins5NkQ1Q0U5MC02MkQ1LTQzOEQtOEVGQi05Q0E1RDI0MEE1NEV9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjIyMDAwLjQ5MyIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiIGlzX2luX2xvY2tkb3duX21vZGU9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSIiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE0My41NyIgbmV4dHZlcnNpb249IjEuMy4xOTMuNSIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTEwNzU5MzQ3NiIgaW5zdGFsbF90aW1lX21zPSI2NDEiLz48L2FwcD48L3JlcXVlc3Q-
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Checks system information in the registry
      PID:3908
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource taggedmi /sessionid "{A31FB235-FD75-480F-8BB4-305B5D881447}"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:3528
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.113\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.113\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=loaderV6.exe --user-data-dir="C:\Users\Admin\AppData\Roaming\loaderV6.exe\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --disable-features=msSmartScreenProtection --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=1784.1720.5988569201549987686
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks system information in the registry
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - System policy modification
  PID:4756
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.113\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.113\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\loaderV6.exe\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\loaderV6.exe\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=126.0.6478.183 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.113\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=126.0.2592.113 --initial-client-data=0x17c,0x180,0x184,0x158,0x18c,0x7ff9b7aa0148,0x7ff9b7aa0154,0x7ff9b7aa0160
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2360
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.113\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.113\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\loaderV6.exe\EBWebView" --webview-exe-name=loaderV6.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1804,i,13980741918974469009,8751086374726399786,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=1800 /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4332
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.113\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.113\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\loaderV6.exe\EBWebView" --webview-exe-name=loaderV6.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --field-trial-handle=1968,i,13980741918974469009,8751086374726399786,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=1976 /prefetch:11
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1004
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.113\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.113\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\loaderV6.exe\EBWebView" --webview-exe-name=loaderV6.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --field-trial-handle=2208,i,13980741918974469009,8751086374726399786,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=2200 /prefetch:13
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1224
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.113\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.113\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\loaderV6.exe\EBWebView" --webview-exe-name=loaderV6.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --field-trial-handle=3372,i,13980741918974469009,8751086374726399786,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=3368 /prefetch:1
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4720
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.113\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.113\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\loaderV6.exe\EBWebView" --webview-exe-name=loaderV6.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --field-trial-handle=4712,i,13980741918974469009,8751086374726399786,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=4656 /prefetch:1
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2012
- C:\Windows\System32\Wbem\wmic.exe
  wmic path win32_VideoController get name
  2⤵
  - Detects videocard installed
  - Suspicious use of AdjustPrivilegeToken
  PID:2172
- C:\Windows\system32\tasklist.exe
  tasklist
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:1536
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle hidden -Command "Add-MpPreference -ExclusionPath \"C:\ProgramData\";" powershell -WindowStyle hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\Downloads\LoaderV6\LoaderV6\loaderV6.exe\""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3112
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle hidden -Command Add-MpPreference -ExclusionPath C:\Users\Admin\Downloads\LoaderV6\LoaderV6\loaderV6.exe
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1812
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get uuid
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:396
- C:\ProgramData\driver1.exe
  C:\ProgramData\driver1.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:2852
- - C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
    C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Suspicious behavior: EnumeratesProcesses
    PID:2244
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2244 -s 488
      4⤵
      Program crash
      PID:4392
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2244 -s 484
      4⤵
      Program crash
      PID:1584

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Modifies data under HKEY_USERS
PID:3476
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTMuNSIgc2hlbGxfdmVyc2lvbj0iMS4zLjE5My41IiBpc21hY2hpbmU9IjEiIHNlc3Npb25pZD0ie0EzMUZCMjM1LUZENzUtNDgwRi04QkI0LTMwNUI1RDg4MTQ0N30iIHVzZXJpZD0iezZCRDkwQkM3LThCRUQtNEQzNS1CNzkwLUEzMEREMDA1OUQ4Qn0iIGluc3RhbGxzb3VyY2U9ImxpbWl0ZWQiIHJlcXVlc3RpZD0ie0U4RTlFRjU4LURCNjMtNEFDQS1BRDk4LUZBNTI0OEM0NkVCQ30iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgbG9naWNhbF9jcHVzPSI4IiBwaHlzbWVtb3J5PSI4IiBkaXNrX3R5cGU9IjIiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMjIwMDAuNDkzIiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiIvPjxhcHAgYXBwaWQ9Ins4QTY5RDM0NS1ENTY0LTQ2M2MtQUZGMS1BNjlEOUU1MzBGOTZ9IiB2ZXJzaW9uPSIxMjMuMC42MzEyLjEwNiIgbmV4dHZlcnNpb249IiIgbGFuZz0iZW4iIGJyYW5kPSJHR0xTIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iOSIgaW5zdGFsbGRhdGV0aW1lPSIxNzIwNTQ1MDA3IiBvb2JlX2luc3RhbGxfdGltZT0iMTMzNjUwMTc2Mzk2NDU5Mjg5Ij48ZXZlbnQgZXZlbnR0eXBlPSIzMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMjExNDMyNSIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTExMTk2ODcyOCIvPjwvYXBwPjwvcmVxdWVzdD4
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks system information in the registry
  PID:1196
- C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{804964A7-D9C1-4FE4-BF9B-861F2C928813}\MicrosoftEdge_X64_126.0.2592.113.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{804964A7-D9C1-4FE4-BF9B-861F2C928813}\MicrosoftEdge_X64_126.0.2592.113.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:4156
- - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{804964A7-D9C1-4FE4-BF9B-861F2C928813}\EDGEMITMP_7CF5B.tmp\setup.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{804964A7-D9C1-4FE4-BF9B-861F2C928813}\EDGEMITMP_7CF5B.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{804964A7-D9C1-4FE4-BF9B-861F2C928813}\MicrosoftEdge_X64_126.0.2592.113.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Drops file in Windows directory
    PID:1912
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{804964A7-D9C1-4FE4-BF9B-861F2C928813}\EDGEMITMP_7CF5B.tmp\setup.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{804964A7-D9C1-4FE4-BF9B-861F2C928813}\EDGEMITMP_7CF5B.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=126.0.6478.183 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{804964A7-D9C1-4FE4-BF9B-861F2C928813}\EDGEMITMP_7CF5B.tmp\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=126.0.2592.113 --initial-client-data=0x244,0x248,0x24c,0x220,0x250,0x7ff633a8aa40,0x7ff633a8aa4c,0x7ff633a8aa58
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      PID:3596
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTMuNSIgc2hlbGxfdmVyc2lvbj0iMS4zLjE5My41IiBpc21hY2hpbmU9IjEiIHNlc3Npb25pZD0ie0EzMUZCMjM1LUZENzUtNDgwRi04QkI0LTMwNUI1RDg4MTQ0N30iIHVzZXJpZD0iezZCRDkwQkM3LThCRUQtNEQzNS1CNzkwLUEzMEREMDA1OUQ4Qn0iIGluc3RhbGxzb3VyY2U9InRhZ2dlZG1pIiByZXF1ZXN0aWQ9IntCQzQwNTEwMy1CMDE5LTQ4NTMtODY1Qi1ERTM4RTk3RDYzMjV9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjIyMDAwLjQ5MyIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiIGlzX2luX2xvY2tkb3duX21vZGU9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSImcXVvdDtWUFFvUDFGK2ZxMTV3UnpoMWtQTDRQTXBXaDhPUk1CNWl6dnJPQy9jaGpRPSZxdW90OyIvPjxhcHAgYXBwaWQ9IntGMzAxNzIyNi1GRTJBLTQyOTUtOEJERi0wMEMzQTlBN0U0QzV9IiB2ZXJzaW9uPSIiIG5leHR2ZXJzaW9uPSIxMjYuMC4yNTkyLjExMyIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9ImNvbnNlbnQ9ZmFsc2UiPjx1cGRhdGVjaGVjay8-PGV2ZW50IGV2ZW50dHlwZT0iOSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTEyMDI0OTcxNCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjUxMjAyNDk3MTQiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI2MjU3NjQzNTU1IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiBkb3dubG9hZGVyPSJiaXRzIiB1cmw9Imh0dHA6Ly9tc2VkZ2UuZi50bHUuZGwuZGVsaXZlcnkubXAubWljcm9zb2Z0LmNvbS9maWxlc3RyZWFtaW5nc2VydmljZS9maWxlcy8wMWEwMmQwZS05ZDhkLTQ3YTMtOGMzNi05YmYzOGRhYmUyMWE_UDE9MTcyMTk3MDUzNiZhbXA7UDI9NDA0JmFtcDtQMz0yJmFtcDtQND1LdXRCUjFUaDhtVndVdkh1SzVweGljdjdmaGUyZ0M2bnpCZW5HdHlDdHUwZDlZVThkZ0s5cjJFa2Q1Q0xtMzYlMmJCdDdSeWxhQWNlZDFVODNNZVFZSGZ3JTNkJTNkIiBzZXJ2ZXJfaXBfaGludD0iIiBjZG5fY2lkPSItMSIgY2RuX2NjYz0iIiBjZG5fbXNlZGdlX3JlZj0iIiBjZG5fYXp1cmVfcmVmX29yaWdpbl9zaGllbGQ9IiIgY2RuX2NhY2hlPSIiIGNkbl9wM3A9IiIgZG93bmxvYWRlZD0iMTczMTQ4NjE2IiB0b3RhbD0iMTczMTQ4NjE2IiBkb3dubG9hZF90aW1lX21zPSIxMDc0NzQiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI2MjU3NjQzNTU1IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNjI3MTU1MDE1MSIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjE5Njc1NyIgc3lzdGVtX3VwdGltZV90aWNrcz0iNjcwNzA0MzAyMyIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgdXBkYXRlX2NoZWNrX3RpbWVfbXM9IjQzNyIgZG93bmxvYWRfdGltZV9tcz0iMTEzNzQwIiBkb3dubG9hZGVkPSIxNzMxNDg2MTYiIHRvdGFsPSIxNzMxNDg2MTYiIHBhY2thZ2VfY2FjaGVfcmVzdWx0PSIwIiBpbnN0YWxsX3RpbWVfbXM9IjQzNTUwIi8-PC9hcHA-PC9yZXF1ZXN0Pg
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks system information in the registry
  PID:1256

C:\Users\Admin\Downloads\LoaderV6\LoaderV6\loaderV6.exe
"C:\Users\Admin\Downloads\LoaderV6\LoaderV6\loaderV6.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:3324
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.113\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.113\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=loaderV6.exe --user-data-dir="C:\Users\Admin\AppData\Roaming\loaderV6.exe\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --disable-features=msSmartScreenProtection --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=3324.2264.10846164757803822503
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4532
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.113\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.113\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\loaderV6.exe\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\loaderV6.exe\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=126.0.6478.183 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.113\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=126.0.2592.113 --initial-client-data=0x164,0x168,0x16c,0x140,0x174,0x7ff9b7aa0148,0x7ff9b7aa0154,0x7ff9b7aa0160
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2244 -ip 2244
1⤵
PID:1032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 2244 -ip 2244
1⤵
PID:3920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.113\Installer\setup.exe

Filesize
6.5MB

MD5
4dda37fd043902a07a4d46dd8b5bc4aa

SHA1
aeecafae4cca3b4a1e592d93b045de19d09a328e

SHA256
806500bb5e7a3e4a2a84d4d08e97d1872dc7ee8f8c255e3c6c2d39437c9779ac

SHA512
903280cf47888fcd491b5aa70ffc4de60458fe8fce6e164a02118308cbd36ef0d2e6ecd418d19242d605f9c516598fe723908e28baf702c4c65a284fabc60111

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU17E8.tmp\MicrosoftEdgeUpdate.exe

Filesize
200KB

MD5
090901ebefc233cc46d016af98be6d53

SHA1
3c78e621f9921642dbbd0502b56538d4b037d0cd

SHA256
7864bb95eb14e0ae1c249759cb44ad746e448007563b7430911755cf17ea5a77

SHA512
5e415dc06689f65155a7ea13c013088808a65afff12fef664178b2ea37e48b4736261564d72e02b898ced58bfb5b3a1fcdd2c7136c0d841868ec7f4f1c32e883

Download Submit
C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log

Filesize
15KB

MD5
d905dda0e208d403b089c8a00a30a027

SHA1
51adeaaa41b7f1b6d834e9f495fe4479b6914c89

SHA256
36f2eb5f0288293342356b160d44f5b3e16d8be37b3103fc7d73feff11b11378

SHA512
dc9d61207a2addd886657b86265239518b3412faaae20a76b90166789a54c0bb485979c3c57090500a75aee79ace6cdc6fb70ed71b661b343044a95e5f13aa29

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
bee2566f57b5102b43361bfdb0df12c9

SHA1
e65f1ff5f985bfd57b0548d5c9faefdae4246427

SHA256
96886abb755282a6153173a61c2597aa4d80d25d2876730f0d6f96db07ea616a

SHA512
b0206eb4ece26e2b1e6e39d69b2262e8130bc0ec600d9ea6312b5c0f9eec53564a0e2e82b69db0d9d5b9c038f147cbf3a31fde6c105577d3f1948b6b65adc7ba

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
55ce1a535fd0801d35675205220662e5

SHA1
cabc21992c46597deaf148d831c6fe9043cb9636

SHA256
b992ec54ef7fb56798f9e0364ced49bcd4cface46b356333fcfb4e00c38ed3ef

SHA512
b1be8370d47317129433d0fb200025b93e122a9e8d7af3d717cbdc0b78b3201e4cc030d6bc750c9ac7779c0fc7e2c1e38b78ec9da72de3dca7404b4597f8619d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
523B

MD5
3729509c51b8502daffcf1a5b8469066

SHA1
89f04c2487072a5a477a6bdc06e842af770f0aa9

SHA256
206dba2ae8c5d0c872df26fc8b8277f4a404f99433aea46b7edf0bc03b048b19

SHA512
0bf6d566a8abc40ba5d0069d9a080040d180b11f8d472acbf69fd3e663ae963ba5d0d81f82710d59bbbd15c49df36ebfedbfa31e43bcfb1f8e4e452201a1bab2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
04acf8e6258f9d840722523947967442

SHA1
987be8a69fcad88f2cf7457cb14d0f3f2ed05ee5

SHA256
cbe051cdf4de939d355e40372b8fd86f2642c5b541502117a60081435f02c24e

SHA512
ac62eff3419f6740f2ac7b82100f5c0c2d73b599113e069d21c5dacd80cf9c51b1d128871b4cbfc31dc85eeeb49e7a5b9e56951cf8eb12d37b0a0a8c63086b90

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GraphiteDawnCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
92KB

MD5
3e1fb91edb40c557d7259e2384d7ec10

SHA1
4bfa0bfceab2d203f5c468320d22154252264d11

SHA256
454bdc88278bd4c9afcb210832acd6ae646158f7b4f1941248c4c1ba65076e16

SHA512
94ceb8f9f88964edaaf13390dd8e25cdab7dd732af2ed5796ed74ee39a19ef9af532325efa37d54ccd527161851a8644c913730d0c46b3d3d638afd189ef5040

Download Submit
C:\Users\Admin\AppData\Local\Temp\.ses

Filesize
53B

MD5
331916554455ceb51361541e898dfae1

SHA1
ad0b400ec7079d249d9bbfca7a9f01d00887e4d4

SHA256
91bd03ed52160bc37e1bb7c4f26006f3d4d0ed03356b5383441aadf19b3814fe

SHA512
40f48710d895b3c89e586c22f17e01000d86681b65eadefb8455dfe2631b39a73b7dfaa0bdd2c2025f41a83d1a314af918162ac630bdadd4142ce993e7e0c40a

Download Submit
C:\Users\Admin\AppData\Local\Temp\AdobeSFX.log

Filesize
1KB

MD5
bf3c6e1048131eb7c69dd0f99471f0c5

SHA1
6a1b926c3fe068999a6a441c67179d2c701caafe

SHA256
f9449466fe5d25f50e02a219532a8383c256c93f4bae0d8cbeaa0dcbd7cf66ad

SHA512
f72f5209078259833ab21a52a01a0228725bbf3d955dc64940290787a1c328ad124140c110a71b4a9fe0bd7f38cd34bf9cbf29ef12320308b982bd7c7bf510ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\JavaDeployReg.log

Filesize
13KB

MD5
a1a16ad78aa4e348b8d4694b74758988

SHA1
341b77b942e204c16fc0625f9d6baf0e13862f95

SHA256
a79f4117b2bfb2d1c3b0407705067ae4a7490f554ed0a221dbbb68dba2240c2f

SHA512
72d2e46f028d9ede727ba06f68e30ae010944828391981a22c7763942dbda27d8fdefedbffb608971dc93b35c6addc0594e460ebfd961e78054da6a0540dbb90

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft .NET Framework 4.7.2 Setup_20240709_170130090.html

Filesize
93KB

MD5
3145084c93d6e00213a046ab97da179e

SHA1
a539ee5a14a990813158c64e0303bc2d7378ce51

SHA256
57d238106eb6118f32d5c09d83fbfcb6705162f8cb085b013685417113344b6c

SHA512
d7f4b6f632a9b5ade56d8d5a5fd313a921e8ca27431d3a58a61687d151888d3214112f375a3a4b40085b07218f87fb9c7d544ff34267ba8087143c9b66e75d50

Download Submit
C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe

Filesize
1.6MB

MD5
2aeb55b75f68b4ea3f949cae0ceba066

SHA1
daf6fe3b0cb87b4e0ad28d650fc9a190ad192b1c

SHA256
22484fdf3008a593e7ca188863d423b8b2a345391120ed296ce8b156cfa983ab

SHA512
3b6a6d6c87b8d9ab06fac72fa38067df4c7d4385d37d391d7ad58a623215681fc0366621ce3ce5c08af25e11cc468b18844ea5f7c8ccb71473c956c29d20188c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20240709170156.log

Filesize
15KB

MD5
e653edb599d88ac618f9f15d69067f14

SHA1
8c458138d9b494216df34d777a733aac25fa8088

SHA256
70b69ecc1f0d1fe2c16fbece601cbb0d215e3bef79e06b22f5f901b2381bc906

SHA512
c480891af12b0caed1ad4607316c5dd4bf9938416fcfd067c28add6ea99527397dd2e6265eaeccc8d47f94057746d2604a4fe35f80e6956d4e3ec61dd9880de5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20240709170156_000_dotnet_runtime_6.0.27_win_x64.msi.log

Filesize
551KB

MD5
7cde2e33870baac94f56cd641acddd6c

SHA1
dc43b83f54c3045eefff6c621fef40d6ddbb2bba

SHA256
e5ff9354738c30f22a31af53bd9ead0db1e9e5b359bfb090e46060626ee1e9d8

SHA512
3ce49f9752206f2efc4cdd4c56440c0cc875fdb66698850adae8f7abe2772b1878490ceabcacbb1c08e233bedf5e7aba896f1c41b6a3ad209f3aa155ba808580

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20240709170156_001_dotnet_hostfxr_6.0.27_win_x64.msi.log

Filesize
95KB

MD5
afae5fb07c304d878985f34c509cab20

SHA1
0520de09b14c23cd89c7a269a578904de2816ca5

SHA256
9bfad7989b125d39d7ff52cf286f65f9e33a1bf3d242bb681d73ddee095e380d

SHA512
de36882b760c6523698dce03c1cb57aaf1f18ac48551e689bd329ee000ec549bb04d3dfe9bc139f7be13324f20064564293cb9e59978c85aa31bd1706b3fae7d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20240709170156_002_dotnet_host_6.0.27_win_x64.msi.log

Filesize
105KB

MD5
9aa9a36ae6109210825f0d0a886a6cb0

SHA1
64e6a8aea3075c15b137fae179729f2ef140fb7a

SHA256
a91811288a343d315f298dd359f7e57722d897b60f663a8ceb73df2c59963e1b

SHA512
2a03b4e202c494bf2e5deae7ba49d6641504482dfad9f331b2c78d2e7a845e95309610e869bdebdd65a0fdc14dd8688d132b1881dc0c456a7431d744e8dc101f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20240709170156_003_windowsdesktop_runtime_6.0.27_win_x64.msi.log

Filesize
847KB

MD5
73aafefaf14350d789bce1038e2b7d6c

SHA1
8952216772c5d5618ff4001a6b52b72a5af22966

SHA256
d698d03073b4e46974f9633e1455a18ff7cc3146dfa21a1bec0923828eaafd10

SHA512
aef8f3aaf8c9f53b90ac042f7fb5b21112660b48763eeeb87bc108b251bfef286e61f28832f80e8e7d1f1a372bbb2fe8878088f69da6fb638a502f672ff7615e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20240709170222.log

Filesize
15KB

MD5
61645f4312e40873d0d875aa65a6793d

SHA1
335d987043b90c9e3f7ff469821af11e360cd497

SHA256
9d355b206058aa8964f051d87373aa51d4d65514aaacd4ce3e162860014de879

SHA512
64733d5326bba2a49f0cc91dfb31a4769a59ade1ed08eba3ce39c4edf4e7406f1892fb590b45979ccdf522c24286ccc1721d016420fc370f91b57ca27f1b1e0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20240709170222_000_dotnet_runtime_7.0.16_win_x64.msi.log

Filesize
470KB

MD5
0a1d45d3ae5a6e2c8f4c57c4ac08fbb5

SHA1
98a9eb48c592398cd070a30de9f1c38a3b79d157

SHA256
84fae2eda8ce28e639b92725c4722a6856ec0fa99416fd28a5d2568e3d8da1fe

SHA512
a3d654b6c00fff0f197985b14a0e5059b882ab80e1c108447a914eca0914d2ade090d130e56fe05e92bfc5a2667ed90077206d473cfe54f83c45b547a5746ed0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20240709170222_001_dotnet_hostfxr_7.0.16_win_x64.msi.log

Filesize
95KB

MD5
3ee25fe29f18b44b045ca4d8b9a1151a

SHA1
9f2a207d27a482d419ec6515c440919665160bc0

SHA256
dd6dd77dc3e7d094a8fd62b31ff9ee2b96873a7e081ee1ad85009bd5b8688abf

SHA512
91f04d106da6920ecf7d2c7f8634c0f9cb0359fe3b9ccc3361449c7a65fb09a35cf17b131a052e1e348e6cfe82c7480592a1c0fab0492341368f6952d70004cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20240709170222_002_dotnet_host_7.0.16_win_x64.msi.log

Filesize
109KB

MD5
55e2d287f42e9902d08443dc6dbf5878

SHA1
141b37e851a983c063480cf88e9ef6555a52882f

SHA256
6a7c514931d07ce678e891e2e292b43f9ebf3f9543e84aa8089b9470c06ae7ba

SHA512
2255da8c40723abd547532db0f39b59c270889fc0754726f866ba9ea0af4cdf6ddb3f22785b84db3e7052200a699a0560de602bedbc85f8cb6ea9ff6ea3e04ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20240709170222_003_windowsdesktop_runtime_7.0.16_win_x64.msi.log

Filesize
852KB

MD5
cbfb2dd04d1d928e3481b1038939384d

SHA1
980157b836bb7675ab18a48715c704f15e26ffa7

SHA256
15d4d33bf42cae59595965e82f6f6e9cf323711af9a75bef3022b851a5c8b609

SHA512
383d2fc3f710c7ee1bf78e8c1d0f0fbdb887327dab3b4ceb2b1e1568fd935e4cc7e0c9d0df641dc637090bbe331a0646961bfac43bc78cb915fe9764c75eb110

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.2_(x64)_20240709170247.log

Filesize
15KB

MD5
8f13650530d7662003ade33ce0798078

SHA1
5d5515b37b7ff9e107b75a1e4bbedf724ec92a32

SHA256
213196a895012815a8c5fb5955e933ac6fdbb814b3623a2e27eaf9d3e4a530f6

SHA512
0b3a9cafbcfac4a1e12d1190dae10d3a5a9a0735de93a4a9662da6426549515ae5f0b7a1522e0db3541d06856dc277acc3c3effc66647022a9d85ceb10c6e8ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.2_(x64)_20240709170247_000_dotnet_runtime_8.0.2_win_x64.msi.log

Filesize
469KB

MD5
be4dfefe3485345c768db2c28223f591

SHA1
91d03d9b57423bb6c844e5760d60f85191237853

SHA256
2f4e0da31380cf87c96586888d443bdd9ee4b9d283823b27accc86217c24ef3f

SHA512
fa9d31296d0f593aa35cee4ef08ffa087832870e6b6b20cc3031424067450dfc53289de3d3d8680e8dd4a63750de5e5a98b2fbb09ed2599f1e2d5e0f7425a25e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.2_(x64)_20240709170247_001_dotnet_hostfxr_8.0.2_win_x64.msi.log

Filesize
95KB

MD5
28e3f1cea3845c6b0436f5785d26fa4b

SHA1
e1a41f5c1d5e98136315ede383122fc1f4091ca4

SHA256
d5c90091d5c11f02025409b149b1ef6c28d687ac23da53a3f553a57338c2acc3

SHA512
4b5264f091009cb8c2ab80640dc0b8ed29afad99fef3b5f7c034c0d53dc91dc7a03d1268f14e26b873dcb7474ec1507fac32bf7b2fb8958600cfaac6ec61cc9e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.2_(x64)_20240709170247_002_dotnet_host_8.0.2_win_x64.msi.log

Filesize
109KB

MD5
f6b395626990cfbe333871fd1ce32bb3

SHA1
8612028635d2cb5fe59a123b26a9a1c85ba9eab1

SHA256
d35e258ce71dec028018552c0939d64bf7b7c7e806c5eddba5255eabe74611df

SHA512
ff18c77072e9c2a5024f8fe0513802b15b53470a21bc1ef222a95376478ad3e8fa72c86940657c51bd4aa9a1439aab5db82a9ddc228a6acda116e9d9d29536fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.2_(x64)_20240709170247_003_windowsdesktop_runtime_8.0.2_win_x64.msi.log

Filesize
846KB

MD5
ba56b3a8c4a117c586de421edad2d883

SHA1
7c3d4b13608a1e34f289b38d3f82810060f9426c

SHA256
82a76649d5fbcd14fc6d2fb2dd528c6365ec1edd8ea8b0ba6d02feadb0502a40

SHA512
71060fece12f95d13ce9bdd0f3db19dae31a387adce961f850197421d574feff7e8673504f644cc3af9b64db13e8c93719077c4e35996a891924fdeca4b05753

Download Submit
C:\Users\Admin\AppData\Local\Temp\StructuredQuery.log

Filesize
4KB

MD5
9349f2e6094c5436503386e6506572bd

SHA1
88c2e979f60bf81882699d8e25ccee086ad87618

SHA256
1ea3add183e20aa8ab6806a46838b4ee4565b95d72da9ae8762ed8df38a01da5

SHA512
e7c550ff1510ab87b68cd06ad2d4e61a9315901c9d0fd30255208e216a8be3890e4cf4f108ae1b3ab3a00ec3d587a5433b913300f7f905d5d6088da4585b8cd2

Download Submit
C:\Users\Admin\AppData\Local\Temp\ZNQUQCEF-20240709-1706.log

Filesize
57KB

MD5
d18d20e9ad1015ed5676622a3d681dc9

SHA1
77b01a3643f28dc552f31257590131c1209777f6

SHA256
25009618e9477d9bcf2dddc21ad2648554d1352ef345def41433c601069326cd

SHA512
0953db9763d3a43402d19ff3bce54a10631e20769f89d1b0eda06b14694cea65b4af0d651898a8f82137eaf35ef867bee68625cce6611a5ae596fe78ccfb1fa3

Download Submit
C:\Users\Admin\AppData\Local\Temp\ZNQUQCEF-20240709-1706a.log

Filesize
181KB

MD5
4a46d442a6b291d88867f6a220d23fb5

SHA1
b54c0947dc13e256fb0563d057f5b7769d1d8588

SHA256
74b1b67c6d0d04c5b266bc3d69c71f89ff22a70dd491b2ec0b93d571ce2af228

SHA512
4ca3b12217110ece82634cda0b403b4727778c3da2aa29c6550b4ce82cd58acc124328c3b64b86393decd6e819c7dedfe37316bb3553f130a32afe12edb358bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_p4vylggj.ret.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\aria-debug-4664.log

Filesize
470B

MD5
16f60c5418257a2b9dfb3ec6978248e3

SHA1
4183390b4b799b9ce8a651b2158df90005718c40

SHA256
f6f58063c3d3bc5931bf69d0402697fabe1df4235f5d2378a0aa60eb10b1fe86

SHA512
91b609bfe8066b5c3d4c8ac72185a7810a2ac661f5ea94cb4338c2cae65fec0adc520cb7d1b186b9817a7b3ed2c7ec454d547721c044c13509a2e6ac0bc52220

Download Submit
C:\Users\Admin\AppData\Local\Temp\chrome_installer.log

Filesize
6KB

MD5
a9a5bf601a081cd84eed2bd7067e224c

SHA1
324f878ce39449383eded9003adab47fe6f1e7b6

SHA256
6e344cf300ec0091cfd38047989c7fc21b1a0c3b94f667e2b9cbb99d420bcb54

SHA512
7a00dd02c8eeb67bc31df4115b4b643a5fcb0b72c45585e11483dc5dcc093d75de744809e7678b1a5d52f6a0c8f78034a835c46f3b7ccfe16994ba4720a59078

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_NDP472-KB4054530-x86-x64-AllOS-ENU_decompression_log.txt

Filesize
1KB

MD5
488fe972fd862fd561026ff8b7555ec0

SHA1
f0819303e3b9a1c1f96653efd34ae1c7f412db56

SHA256
cb4d33cba863ebac2fe2665190d1adea3e506f81eb7382ace768b0052f151e7a

SHA512
de105bd8cad9c1cc6d4995a91afa1b9feff49d0314d3152a1f17d9aa54b01f7c24f2fd1d66aae69f637c506fa2ae059194f114ac393503dac18261c0e11502e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI2332.txt

Filesize
425KB

MD5
f6f28248c3f585661da60365c80aacce

SHA1
1451c133a118a5ba0d180588e53594c5fdbd7b47

SHA256
ee9314a15e05c207d568966c080b3d916045bce6998dccd2c046258830d03f90

SHA512
e9e18ad9c3601d93893bdd6c10069fef2c56a733bdadd856d3b54b80baeb636eb3ad1b00223bf46f99c670687919bd6cf6a2d5c27a24a01e77df36ab7dcaae54

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI235C.txt

Filesize
415KB

MD5
bfa54a8445f6417f2cd25245d7f3960b

SHA1
fcfffbf737a11968e0973b1fe4d80aa77c6a924c

SHA256
682723051e5473da86238792fa56406d6925ac7a456b276ec8d480b1bccd7788

SHA512
e93950812beb653f52f6fa984874cc5d153940c1af8fcd7b4581b16a1a2b8c02ac3eb5a41dc928286982c24a6fafb9d4df4ff20b7aee6f1edc3c549fa35bc46a

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI2332.txt

Filesize
11KB

MD5
687b256c879a6e6b2cec2a5499daa83d

SHA1
32e1db0be188014384f79735243e419341297cf2

SHA256
c892a861998890f9218eda818839fe6bf77ee0cef92e0e3cb695e1b05ed8a79f

SHA512
1e71156fbc33e6630b0ba7f78a91bdc940705398929879a5afb7126fe46cd075162e536bbaa6cfa3c77b6042f01b081b29d62a81d055911875d4ac7520d3e033

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI235C.txt

Filesize
11KB

MD5
3fdba93439b940e8cf672eef4916a4b5

SHA1
fc927dbea71f2095549cd6975a09bef2e434d977

SHA256
d1fc90dc0e35b66f13a091c03663526f7a825614285254704fe7c06f51c84d9e

SHA512
6e16ab44c7ff7d0611f604e82974a4febb027dd554f0fbdc7ebb37d425e47b643105efc1d89cf18c1869e0d358a5ab4532c9b994647556946fc4f0e80b502c20

Download Submit
C:\Users\Admin\AppData\Local\Temp\jawshtml.html

Filesize
13B

MD5
b2a4bc176e9f29b0c439ef9a53a62a1a

SHA1
1ae520cbbf7e14af867232784194366b3d1c3f34

SHA256
7b4f72a40bd21934680f085afe8a30bf85acff1a8365af43102025c4ccf52b73

SHA512
e04b85d8d45d43479abbbe34f57265b64d1d325753ec3d2ecadb5f83fa5822b1d999b39571801ca39fa32e4a0a7caab073ccd003007e5b86dac7b1c892a5de3f

Download Submit
C:\Users\Admin\AppData\Local\Temp\jusched.log

Filesize
163KB

MD5
e7a3dfa0bbc4f9759667bfba81b9a71c

SHA1
f4808d11223fde3ddf18bc4226d11914793a0015

SHA256
9ba73e363c2d57009e12c6a4415d610c712730a99b874bc59f08ec804c0b168b

SHA512
ce9eb808e524049b659846d9664929fab470d2ac04e1adbc5b739f2522531aeeff7ad48ea35f153812ee08e7b03975aeeee9444d43a48bb811f8e11be68a4b6d

Download Submit
C:\Users\Admin\AppData\Local\Temp\msedge_installer.log

Filesize
2KB

MD5
87d8d00a2ae7e76013196a29fa2a62e7

SHA1
6df03d51c83aec1618e0269116385bc9889faee8

SHA256
96660d6fd2645579cea6b6ee530769eead6ea301b7561eee826c138b4e022b17

SHA512
73bd469d416886ac1d685f9e675e0a49c038618256e2e76b510b5a173de3cc0843a188d37a95ec57c708be1ea9d0c91c60215526dc0004e6a7b47b2a0d230c91

Download Submit
C:\Users\Admin\AppData\Local\Temp\wct7A9E.tmp

Filesize
63KB

MD5
e516a60bc980095e8d156b1a99ab5eee

SHA1
238e243ffc12d4e012fd020c9822703109b987f6

SHA256
543796a1b343b4ebc0285d89cb8eb70667ac7b513da37495e38003704e9d88d7

SHA512
9b51e99ba20e9da56d1acc24a1cf9f9c9dbdeb742bec034e0ff2bc179a60f4aff249f40344f9ddd43229dcdefa1041940f65afb336d46c175ffeff725c638d58

Download Submit
C:\Users\Admin\AppData\Local\Temp\wct7E68.tmp

Filesize
40.2MB

MD5
fb4aa59c92c9b3263eb07e07b91568b5

SHA1
6071a3e3c4338b90d892a8416b6a92fbfe25bb67

SHA256
e70e80dbbc9baba7ddcee70eda1bb8d0e6612dfb1d93827fe7b594a59f3b48b9

SHA512
60aabbe2fd24c04c33e7892eab64f24f8c335a0dd9822eb01adc5459e850769fc200078c5ccee96c1f2013173bc41f5a2023def3f5fe36e380963db034924ace

Download Submit
C:\Users\Admin\AppData\Local\Temp\wmsetup.log

Filesize
693B

MD5
dd62770ee902e1b5b5767422f1621475

SHA1
aaec3e61e9c1bce1cedbaadff4898fa6f2ee4de1

SHA256
e4763406b9d8b6ed483059fbb1cecc09f8a80f743cf4551b132e6900de5893b6

SHA512
91aa79d3f2a6ca6d0bdf067830ed9fbfe22420d24a16c53da077c79d595d06ea686f2c8669c0781f4a979425fee0ffb64b2dacf4d05da7cafdf43fbc4b93d248

Download Submit
C:\Users\Admin\AppData\Roaming\loaderV6.exe\EBWebView\Crashpad\settings.dat

Filesize
280B

MD5
25dfb5ef6b17be15f398473665582836

SHA1
cfda892358285e3cc9f86b8882b4277937a622b3

SHA256
685eff2bedcb3b2dfd4a67f633cac68e47080df49d4f0c1b55492750b59be86b

SHA512
35b03d99a3b546fd6c86cf9eb6c476efaa3d21ead6acd346dace975bb2ac02bd5fc9293ba9ef1e5753a26f0c9b7d7321a95e5411375195282d6469dcf8cf3a7a

Download Submit
C:\Users\Admin\AppData\Roaming\loaderV6.exe\EBWebView\Default\6f81506a-e56c-499a-a021-dcb668212246.tmp

Filesize
6KB

MD5
f792e0526ea718f7064f05bc8e3336e7

SHA1
c570d988912359dbf1dac31cb4aca0d0f64c5fcc

SHA256
95647c5e0ad0bd6fccaa5184e46ae05c5b75b9375c5890ff1ccd40ac158498d2

SHA512
9feaa2a096ac450e0c4c17e7e2e80ff46bcb9bfa8eefc6f99e27fcadd8c3d4eca4fbe53e0f3005ec0ff9a7ba49a6f693fca3e11da0105bd1266b7fed1c52470d

Download Submit
C:\Users\Admin\AppData\Roaming\loaderV6.exe\EBWebView\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
0319abeb875005b21cc4c14a3f98c84d

SHA1
34417d57b7a8fa87d9029fd6c6857b7ef7de8255

SHA256
842074c3c9caf36879d6c9517d85515dda0177522b5f50babfdc00941b6dbf7d

SHA512
e57c0c785b67cd64ee9cec6e28a280a9d67079cc9c249755612be5d0947f8b5b96a883a408abab4375d1a149c4c8f8bf8f6f68eb52c486c7f74feeace30d1c0f

Download Submit
C:\Users\Admin\AppData\Roaming\loaderV6.exe\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe5ae205.TMP

Filesize
48B

MD5
2f5e8aed98ea7fb86f321e8d4289dd9d

SHA1
c66be3a5b0dab4b703674e98c9e19b64dd5bf8bb

SHA256
1736c7060b67d9afb20de6d33f83ffd5dd32d9f24f5c210785762a1835977b5f

SHA512
3dd77d16b5d952b46c0f1438a93277ecef197df6b5555ee41ec13fcedc4419835fa7b777553d17c121b21bf9ef080134bcd6145f29abfc8fc871dc4bd8a70abf

Download Submit
C:\Users\Admin\AppData\Roaming\loaderV6.exe\EBWebView\Default\Extension Scripts\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Roaming\loaderV6.exe\EBWebView\Default\Preferences~RFe5af510.TMP

Filesize
6KB

MD5
904eb3d3b2e19c8f92c224b77ea1939f

SHA1
7ff3d362751ab8a91f2ac3584d0b8d4c77d9accd

SHA256
24e7deeee72a8719bbcea412d90ae7e3efb8d29ab77ba5b1d511afa70721c8c0

SHA512
082c28d102f055e22a8b274e33aeca17ed4ca4409d03962b9b355ecb645580309519efa8850a2624694107037445802f8faf081d45c50c82e241564fd6c0a213

Download Submit
C:\Users\Admin\AppData\Roaming\loaderV6.exe\EBWebView\Default\Site Characteristics Database\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Roaming\loaderV6.exe\EBWebView\GrShaderCache\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Roaming\loaderV6.exe\EBWebView\GraphiteDawnCache\data_0

Filesize
8KB

MD5
cf89d16bb9107c631daabf0c0ee58efb

SHA1
3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

SHA256
d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

SHA512
8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

Download Submit
C:\Users\Admin\AppData\Roaming\loaderV6.exe\EBWebView\GraphiteDawnCache\data_3

Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\AppData\Roaming\loaderV6.exe\EBWebView\Local State

Filesize
16KB

MD5
3149af2cd5d72721456a959323bcaddf

SHA1
501fa6b9b4d2e9f341b9358bd3ae8ac68d596579

SHA256
409d6c5b86885a16d0c4a0962bc91a082f9cf04f18cb4c345940c17c493cc8df

SHA512
c1bf97b5c9ca889f628dfb00b70a779bf6acdae38125828040693f5412bcbc6a57ecd51384152884fb32955e4aced22510d2b632896df19f8521941dc28f0f33

Download Submit
C:\Users\Admin\AppData\Roaming\loaderV6.exe\EBWebView\Local State

Filesize
1KB

MD5
80d7b7b27554b23c1d5e84fda8bca1d2

SHA1
7fbd7cd7997db95d059522a0d057e7647c599118

SHA256
88148e6ad3d09b01a04b1ffb03a196d676d3598694e16590c1c5ef557238aac7

SHA512
949911e5e71b1ba47054d7b7e24dbc092bf5b5379bcbbe70350300f02898fdf1717af50113137796fbd3fed077844b513509ef49e88fbe406cbac2b953649b06

Download Submit
C:\Users\Admin\AppData\Roaming\loaderV6.exe\EBWebView\Local State

Filesize
2KB

MD5
d60c5d49b9c3e77a378640f1f23d010c

SHA1
2ee3f2414a5974a88e31c1ebee78acdceab4f9f2

SHA256
88b7cf8641836fcd59fd9daa1ddf12b50f0ff5182466c86eb266586f06051b01

SHA512
0745abe163c8eba1eefb904bf8ada99900dc96089c822710e3e53c95a2aefdd03192a7d99a73aff1d95e8b6296e14fda68c35736088b8313e129eab389e84103

Download Submit
C:\Users\Admin\AppData\Roaming\loaderV6.exe\EBWebView\Local State

Filesize
3KB

MD5
1a599d0c6f003e0357c7081ca1d60da9

SHA1
3686ddf47258b4f4c4176876cc195abf2b00a69e

SHA256
ec279fe69aaef25d90e9d7aaaafb4e79baede1e8a4e4ec5156ba949e7845d5eb

SHA512
33e6f98b611e3e46851d4958586bf8727a332778b7af08459ca3fa2ce52b14e7eab8a71c87bc1a32e8261f6192bfffe8b7da0a179e566d5116401f328b64d54b

Download Submit
C:\Users\Admin\AppData\Roaming\loaderV6.exe\EBWebView\Local State

Filesize
16KB

MD5
2677f09b307c514d76314901767fe86d

SHA1
edcd76c85caa5b4ca4e13fe23d7f76c6089c32d2

SHA256
9501e738a3c4d7af1cb93caf3a2eb4476b72424e286e2f7b91985a80b391ddf6

SHA512
536189367b2ab95b366120ac857ba780b076963dbe6754443298659b2b39f5526c7177d66c0c8777b7a8f9e0240f8e916a5acc4510fa8d305f2cbe4a2c0aba36

Download Submit
C:\Users\Admin\AppData\Roaming\loaderV6.exe\EBWebView\Local State~RFe5a9210.TMP

Filesize
1KB

MD5
6d1e200f8c2b2597ecb51096e51cf2af

SHA1
f259dbce8cadfbc4b5929a5f41fb0259cf8f8219

SHA256
cf06d0b4243ac5f8383996fc0d6e4ed699b2c789e4b689f447a9680950715b00

SHA512
950750bf86935092dac07ab595a2295152d11cb2a65f4a1892af1096d1edf6c746a16c876205db35bba5f1b11cfe7b22d2f0a15f8d7f9b3d404c22012dc5ae57

Download Submit
C:\Users\Admin\Downloads\LoaderV6.zip.crdownload

Filesize
15.2MB

MD5
273e74c7c8e4fefcafca7ab2c634fef7

SHA1
9a01e91e93cef5c77de8c70b8ae80da15a540fff

SHA256
18b7e51b0f80744208e78cdbdc707e5b8467991af8bdea3c47f3ee25ad864277

SHA512
d3f788e51d165b72ebf9c46a3463dd594df308bc199a8f70db25945450ab0c5da3cb1aeffeb6cf9f46f323150bd4d5d660fefd054fed956a5b491dd21e228277

Download Submit
C:\Users\Admin\Downloads\LoaderV6.zip:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat

Filesize
280B

MD5
4e64e2c1a9e0c205c814a256543cfb5c

SHA1
45b82a24d32740ece36a5d1a219199566b37df1a

SHA256
87a07d829931452771e250f9a826c028e347785b10f65a56d7da88ecb398acf1

SHA512
13b98508559ebde7476c7dc6812333bdc3b4e5224b01a6197d9172138651f9aee81c91d150441e40c17345f33ea397fc1eb4c3179c5235aaeed925f429015659

Download Submit
memory/1892-607-0x0000000000D70000-0x0000000000D79000-memory.dmp

Filesize
36KB

Download
memory/1892-609-0x0000000002B20000-0x0000000002F20000-memory.dmp

Filesize
4.0MB

Download
memory/1892-610-0x00007FF9D9120000-0x00007FF9D9329000-memory.dmp

Filesize
2.0MB

Download
memory/1892-612-0x0000000075830000-0x0000000075A82000-memory.dmp

Filesize
2.3MB

Download
memory/2244-606-0x0000000075830000-0x0000000075A82000-memory.dmp

Filesize
2.3MB

Download
memory/2244-601-0x0000000001200000-0x000000000127E000-memory.dmp

Filesize
504KB

Download
memory/2244-602-0x0000000003FD0000-0x00000000043D0000-memory.dmp

Filesize
4.0MB

Download
memory/2244-603-0x0000000003FD0000-0x00000000043D0000-memory.dmp

Filesize
4.0MB

Download
memory/2244-604-0x00007FF9D9120000-0x00007FF9D9329000-memory.dmp

Filesize
2.0MB

Download
memory/2244-599-0x0000000001200000-0x000000000127E000-memory.dmp

Filesize
504KB

Download
memory/2824-297-0x0000000074830000-0x0000000074A55000-memory.dmp

Filesize
2.1MB

Download
memory/2824-293-0x0000000074830000-0x0000000074A55000-memory.dmp

Filesize
2.1MB

Download
memory/2824-292-0x0000000000170000-0x00000000001A4000-memory.dmp

Filesize
208KB

Download
memory/2824-357-0x0000000074830000-0x0000000074A55000-memory.dmp

Filesize
2.1MB

Download
memory/2824-363-0x0000000000170000-0x00000000001A4000-memory.dmp

Filesize
208KB

Download
memory/2852-600-0x00007FF63B1F0000-0x00007FF63BD4D000-memory.dmp

Filesize
11.4MB

Download
memory/3112-521-0x0000026EEF820000-0x0000026EEF842000-memory.dmp

Filesize
136KB

Download
memory/4332-393-0x00007FF9D73F0000-0x00007FF9D73F1000-memory.dmp

Filesize
4KB

Download
memory/4720-467-0x00007FF9D73F0000-0x00007FF9D73F1000-memory.dmp

Filesize
4KB

Download