hxxps://bloxstrap[.]org

Analysis

max time kernel
210s
max time network
218s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
27-07-2024 05:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://bloxstrap.org

Score

8^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Downloads MZ/PE file

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Control Panel\International\Geo\Nation	Bloxstrap-v2.7.0.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 16 IoCs

pid	Process
1784	Bloxstrap-v2.7.0.exe
1360	windowsdesktop-runtime-6.0.32-win-x64.exe
4840	windowsdesktop-runtime-6.0.32-win-x64.exe
1344	windowsdesktop-runtime-6.0.32-win-x64.exe
1344	Bloxstrap-v2.7.0.exe
7108	MicrosoftEdgeWebview2Setup.exe
6028	MicrosoftEdgeUpdate.exe
624	MicrosoftEdgeUpdate.exe
5448	MicrosoftEdgeUpdate.exe
5516	MicrosoftEdgeUpdateComRegisterShell64.exe
5548	MicrosoftEdgeUpdateComRegisterShell64.exe
5712	MicrosoftEdgeUpdateComRegisterShell64.exe
5680	MicrosoftEdgeUpdate.exe
5156	MicrosoftEdgeUpdate.exe
5256	MicrosoftEdgeUpdate.exe
5268	MicrosoftEdgeUpdate.exe

Loads dropped DLL 64 IoCs

pid	Process
4840	windowsdesktop-runtime-6.0.32-win-x64.exe
1936	MsiExec.exe
1936	MsiExec.exe
1844	MsiExec.exe
1844	MsiExec.exe
2076	MsiExec.exe
2076	MsiExec.exe
2660	MsiExec.exe
2660	MsiExec.exe
1344	Bloxstrap-v2.7.0.exe
1344	Bloxstrap-v2.7.0.exe
1344	Bloxstrap-v2.7.0.exe
1344	Bloxstrap-v2.7.0.exe
1344	Bloxstrap-v2.7.0.exe
1344	Bloxstrap-v2.7.0.exe
1344	Bloxstrap-v2.7.0.exe
1344	Bloxstrap-v2.7.0.exe
1344	Bloxstrap-v2.7.0.exe
1344	Bloxstrap-v2.7.0.exe
1344	Bloxstrap-v2.7.0.exe
1344	Bloxstrap-v2.7.0.exe
1344	Bloxstrap-v2.7.0.exe
1344	Bloxstrap-v2.7.0.exe
1344	Bloxstrap-v2.7.0.exe
1344	Bloxstrap-v2.7.0.exe
1344	Bloxstrap-v2.7.0.exe
1344	Bloxstrap-v2.7.0.exe
1344	Bloxstrap-v2.7.0.exe
1344	Bloxstrap-v2.7.0.exe
1344	Bloxstrap-v2.7.0.exe
1344	Bloxstrap-v2.7.0.exe
1344	Bloxstrap-v2.7.0.exe
1344	Bloxstrap-v2.7.0.exe
1344	Bloxstrap-v2.7.0.exe
1344	Bloxstrap-v2.7.0.exe
1344	Bloxstrap-v2.7.0.exe
1344	Bloxstrap-v2.7.0.exe
1344	Bloxstrap-v2.7.0.exe
1344	Bloxstrap-v2.7.0.exe
1344	Bloxstrap-v2.7.0.exe
1344	Bloxstrap-v2.7.0.exe
1344	Bloxstrap-v2.7.0.exe
1344	Bloxstrap-v2.7.0.exe
1344	Bloxstrap-v2.7.0.exe
1344	Bloxstrap-v2.7.0.exe
1344	Bloxstrap-v2.7.0.exe
1344	Bloxstrap-v2.7.0.exe
1344	Bloxstrap-v2.7.0.exe
1344	Bloxstrap-v2.7.0.exe
1344	Bloxstrap-v2.7.0.exe
1344	Bloxstrap-v2.7.0.exe
1344	Bloxstrap-v2.7.0.exe
1344	Bloxstrap-v2.7.0.exe
1344	Bloxstrap-v2.7.0.exe
1344	Bloxstrap-v2.7.0.exe
1344	Bloxstrap-v2.7.0.exe
1344	Bloxstrap-v2.7.0.exe
1344	Bloxstrap-v2.7.0.exe
1344	Bloxstrap-v2.7.0.exe
1344	Bloxstrap-v2.7.0.exe
1344	Bloxstrap-v2.7.0.exe
1344	Bloxstrap-v2.7.0.exe
1344	Bloxstrap-v2.7.0.exe
1344	Bloxstrap-v2.7.0.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{1bb295e8-8251-4404-96f1-c437da87fce0} = "\"C:\\ProgramData\\Package Cache\\{1bb295e8-8251-4404-96f1-c437da87fce0}\\windowsdesktop-runtime-6.0.32-win-x64.exe\" /burn.runonce"	windowsdesktop-runtime-6.0.32-win-x64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
150	discord.com
151	discord.com
152	discord.com

Checks system information in the registry 2 TTPs 8 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe

Drops file in System32 directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187	MicrosoftEdgeUpdate.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.32\api-ms-win-core-console-l1-2-0.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.32\System.Net.Ping.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.32\WindowsBase.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.32\WindowsFormsIntegration.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.32\PresentationFramework.dll	msiexec.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU2ACA.tmp\msedgeupdateres_tt.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.32\System.Resources.ResourceManager.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.32\es\System.Windows.Forms.Primitives.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.32\es\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU2ACA.tmp\msedgeupdateres_pt-BR.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.32\pl\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.32\System.Collections.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.32\System.Xml.XmlDocument.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.32\cs\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.32\System.Reflection.DispatchProxy.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.32\System.IO.Pipes.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.32\System.Formats.Asn1.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.32\pl\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.32\pt-BR\UIAutomationTypes.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.32\it\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU2ACA.tmp\psmachine_arm64.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.32\System.Reflection.TypeExtensions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.32\Microsoft.VisualBasic.Core.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.32\es\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.32\pl\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.32\ko\System.Windows.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.32\zh-Hant\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU2ACA.tmp\msedgeupdateres_bs.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.32\api-ms-win-core-file-l1-2-0.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.32\System.Threading.Tasks.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.32\tr\WindowsFormsIntegration.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.32\pt-BR\UIAutomationClient.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.32\pt-BR\ReachFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.32\System.IO.Compression.ZipFile.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.32\System.Private.Xml.Linq.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.32\api-ms-win-crt-environment-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.32\it\System.Windows.Forms.Primitives.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.32\de\WindowsBase.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.32\ru\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.32\pt-BR\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.32\zh-Hans\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.32\System.Collections.Immutable.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.32\api-ms-win-crt-stdio-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.32\System.Reflection.Emit.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.32\PresentationUI.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.32\it\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.32\UIAutomationTypes.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.32\ko\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU2ACA.tmp\msedgeupdateres_fr-CA.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.32\System.Diagnostics.TraceSource.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.32\tr\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.32\System.Drawing.Primitives.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.32\System.Security.Cryptography.X509Certificates.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.32\cs\WindowsBase.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.32\ru\WindowsBase.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.32\ru\UIAutomationTypes.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU2ACA.tmp\msedgeupdateres_lb.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.32\System.Text.Json.dll	msiexec.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU2ACA.tmp\MicrosoftEdgeComRegisterShellARM64.exe	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU2ACA.tmp\NOTICE.TXT	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU2ACA.tmp\msedgeupdateres_pl.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.32\PresentationFramework.Aero.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.32\System.Dynamic.Runtime.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.32\.version	msiexec.exe

Drops file in Windows directory 35 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e591249.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e591236.msi	msiexec.exe
File created	C:\Windows\Installer\e591240.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{A09F8381-88C3-44C4-9DAB-AC44F4F4DB4B}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3378.tmp	msiexec.exe
File created	C:\Windows\Installer\e591245.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e59123b.msi	msiexec.exe
File created	C:\Windows\Installer\e591236.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI31FE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e591245.msi	msiexec.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1B5F.tmp	msiexec.exe
File created	C:\Windows\Installer\e591244.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI387B.tmp	msiexec.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdge.exe
File opened for modification	C:\Windows\Installer\MSI30C5.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI358C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2CD8.tmp	msiexec.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI291E.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{667CB653-70E1-4E2B-9C8E-6A02A6CF88B9}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2E30.tmp	msiexec.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File opened for modification	C:\Windows\Installer\e591240.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI486D.tmp	msiexec.exe
File created	C:\Windows\Installer\e59123a.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI18ED.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{3FDCF0A2-7C1F-41C7-9749-0D91EC216AED}	msiexec.exe
File created	C:\Windows\Installer\e59123b.msi	msiexec.exe
File created	C:\Windows\Installer\e59123f.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2F0E.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{885F1CFB-4EAC-4C60-97B8-394BD65ED91E}	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeWebview2Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-6.0.32-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-6.0.32-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-6.0.32-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5680	MicrosoftEdgeUpdate.exe
5268	MicrosoftEdgeUpdate.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies data under HKEY_USERS 26 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133665315493043561"	chrome.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1b	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1D	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption"	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1d	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e	msiexec.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1c	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1A\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1C	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1B	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	MicrosoftEdgeUpdate.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_48.128.16743_x64\Dependents	windowsdesktop-runtime-6.0.32-win-x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{A6B716CB-028B-404D-B72C-50E153DD68DA}\LocalService = "edgeupdatem"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\NumMethods\ = "24"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CoreClass.1\CLSID\ = "{8F09CD6C-5964-4573-82E3-EBFF7702865B}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{60355531-5BFD-45AB-942C-7912628752C7}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Cookies	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{60355531-5BFD-45AB-942C-7912628752C7}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.PolicyStatusMachine\ = "Microsoft Edge Update Broker Class Factory"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\NumMethods\ = "13"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}\ = "IProcessLauncher"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B9063E4-3882-485E-8797-F28A0240782F}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BFC1F588CAE406C4798B93B46DE59DE1\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\CTLs	MicrosoftEdge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}\AppID = "{CECDDD22-2E72-4832-9606-A9B0E5E344B2}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}	MicrosoftEdgeUpdate.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$WordPress	MicrosoftEdge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.PolicyStatusMachineFallback.1.0	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-Revision = "0"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}\ProgID	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E421557C-0628-43FB-BF2B-7C9F8A4D067C}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{77857D02-7A25-4B67-9266-3E122A8F39E4}\LocalizedString = "@C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\msedgeupdate.dll,-3000"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore	MicrosoftEdge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1B9063E4-3882-485E-8797-F28A0240782F}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BFC1F588CAE406C4798B93B46DE59DE1\ProductName = "Microsoft Windows Desktop Runtime - 6.0.32 (x64)"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\ = "ICredentialDialog"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\windowsdesktop_runtime_48.128.16742_x64	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B9063E4-3882-485E-8797-F28A0240782F}\ = "IGoogleUpdate3WebSecurity"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}\ = "IAppVersionWeb"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassMachineFallback\CurVer	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\FileVersion = "2016061511"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\ = "IPolicyStatusValue"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\ = "IAppWeb"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B5977F34-9264-4AC3-9B31-1224827FF6E8}	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\dotnet.microsoft.com\ = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings	MicrosoftEdge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}\NumMethods\ = "4"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.PolicyStatusMachine	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}	MicrosoftEdgeUpdateComRegisterShell64.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\windowsdesktop-runtime-6.0.32-win-x64.exe.mxtdt8b.partial:Zone.Identifier	browser_broker.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
1036	msiexec.exe
1036	msiexec.exe
1036	msiexec.exe
1036	msiexec.exe
1036	msiexec.exe
1036	msiexec.exe
1036	msiexec.exe
1036	msiexec.exe
2680	chrome.exe
2680	chrome.exe
1344	Bloxstrap-v2.7.0.exe
1344	Bloxstrap-v2.7.0.exe
6028	MicrosoftEdgeUpdate.exe
6028	MicrosoftEdgeUpdate.exe

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
4668	MicrosoftEdgeCP.exe
4668	MicrosoftEdgeCP.exe
4668	MicrosoftEdgeCP.exe
4668	MicrosoftEdgeCP.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4900	chrome.exe
Token: SeCreatePagefilePrivilege	4900	chrome.exe
Token: SeShutdownPrivilege	4900	chrome.exe
Token: SeCreatePagefilePrivilege	4900	chrome.exe
Token: SeShutdownPrivilege	4900	chrome.exe
Token: SeCreatePagefilePrivilege	4900	chrome.exe
Token: SeShutdownPrivilege	4900	chrome.exe
Token: SeCreatePagefilePrivilege	4900	chrome.exe
Token: SeShutdownPrivilege	4900	chrome.exe
Token: SeCreatePagefilePrivilege	4900	chrome.exe
Token: SeShutdownPrivilege	4900	chrome.exe
Token: SeCreatePagefilePrivilege	4900	chrome.exe
Token: SeShutdownPrivilege	4900	chrome.exe
Token: SeCreatePagefilePrivilege	4900	chrome.exe
Token: SeShutdownPrivilege	4900	chrome.exe
Token: SeCreatePagefilePrivilege	4900	chrome.exe
Token: SeShutdownPrivilege	4900	chrome.exe
Token: SeCreatePagefilePrivilege	4900	chrome.exe
Token: SeShutdownPrivilege	4900	chrome.exe
Token: SeCreatePagefilePrivilege	4900	chrome.exe
Token: SeShutdownPrivilege	4900	chrome.exe
Token: SeCreatePagefilePrivilege	4900	chrome.exe
Token: SeShutdownPrivilege	4900	chrome.exe
Token: SeCreatePagefilePrivilege	4900	chrome.exe
Token: SeShutdownPrivilege	4900	chrome.exe
Token: SeCreatePagefilePrivilege	4900	chrome.exe
Token: SeShutdownPrivilege	4900	chrome.exe
Token: SeCreatePagefilePrivilege	4900	chrome.exe
Token: SeShutdownPrivilege	4900	chrome.exe
Token: SeCreatePagefilePrivilege	4900	chrome.exe
Token: SeShutdownPrivilege	4900	chrome.exe
Token: SeCreatePagefilePrivilege	4900	chrome.exe
Token: SeShutdownPrivilege	4900	chrome.exe
Token: SeCreatePagefilePrivilege	4900	chrome.exe
Token: SeShutdownPrivilege	4900	chrome.exe
Token: SeCreatePagefilePrivilege	4900	chrome.exe
Token: SeShutdownPrivilege	4900	chrome.exe
Token: SeCreatePagefilePrivilege	4900	chrome.exe
Token: SeShutdownPrivilege	4900	chrome.exe
Token: SeCreatePagefilePrivilege	4900	chrome.exe
Token: SeShutdownPrivilege	4900	chrome.exe
Token: SeCreatePagefilePrivilege	4900	chrome.exe
Token: SeShutdownPrivilege	4900	chrome.exe
Token: SeCreatePagefilePrivilege	4900	chrome.exe
Token: SeShutdownPrivilege	4900	chrome.exe
Token: SeCreatePagefilePrivilege	4900	chrome.exe
Token: SeShutdownPrivilege	4900	chrome.exe
Token: SeCreatePagefilePrivilege	4900	chrome.exe
Token: SeShutdownPrivilege	4900	chrome.exe
Token: SeCreatePagefilePrivilege	4900	chrome.exe
Token: SeShutdownPrivilege	4900	chrome.exe
Token: SeCreatePagefilePrivilege	4900	chrome.exe
Token: SeShutdownPrivilege	4900	chrome.exe
Token: SeCreatePagefilePrivilege	4900	chrome.exe
Token: SeShutdownPrivilege	4900	chrome.exe
Token: SeCreatePagefilePrivilege	4900	chrome.exe
Token: SeShutdownPrivilege	4900	chrome.exe
Token: SeCreatePagefilePrivilege	4900	chrome.exe
Token: SeShutdownPrivilege	4900	chrome.exe
Token: SeCreatePagefilePrivilege	4900	chrome.exe
Token: SeShutdownPrivilege	4900	chrome.exe
Token: SeCreatePagefilePrivilege	4900	chrome.exe
Token: SeShutdownPrivilege	4900	chrome.exe
Token: SeCreatePagefilePrivilege	4900	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe

Suspicious use of SendNotifyMessage 25 IoCs

pid	Process
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
4900	chrome.exe
1344	Bloxstrap-v2.7.0.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4576	MicrosoftEdge.exe
4668	MicrosoftEdgeCP.exe
4064	MicrosoftEdgeCP.exe
4668	MicrosoftEdgeCP.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4900 wrote to memory of 1236	4900	chrome.exe	73
PID 4900 wrote to memory of 1236	4900	chrome.exe	73
PID 4900 wrote to memory of 4752	4900	chrome.exe	75
PID 4900 wrote to memory of 4752	4900	chrome.exe	75
PID 4900 wrote to memory of 4752	4900	chrome.exe	75
PID 4900 wrote to memory of 4752	4900	chrome.exe	75
PID 4900 wrote to memory of 4752	4900	chrome.exe	75
PID 4900 wrote to memory of 4752	4900	chrome.exe	75
PID 4900 wrote to memory of 4752	4900	chrome.exe	75
PID 4900 wrote to memory of 4752	4900	chrome.exe	75
PID 4900 wrote to memory of 4752	4900	chrome.exe	75
PID 4900 wrote to memory of 4752	4900	chrome.exe	75
PID 4900 wrote to memory of 4752	4900	chrome.exe	75
PID 4900 wrote to memory of 4752	4900	chrome.exe	75
PID 4900 wrote to memory of 4752	4900	chrome.exe	75
PID 4900 wrote to memory of 4752	4900	chrome.exe	75
PID 4900 wrote to memory of 4752	4900	chrome.exe	75
PID 4900 wrote to memory of 4752	4900	chrome.exe	75
PID 4900 wrote to memory of 4752	4900	chrome.exe	75
PID 4900 wrote to memory of 4752	4900	chrome.exe	75
PID 4900 wrote to memory of 4752	4900	chrome.exe	75
PID 4900 wrote to memory of 4752	4900	chrome.exe	75
PID 4900 wrote to memory of 4752	4900	chrome.exe	75
PID 4900 wrote to memory of 4752	4900	chrome.exe	75
PID 4900 wrote to memory of 4752	4900	chrome.exe	75
PID 4900 wrote to memory of 4752	4900	chrome.exe	75
PID 4900 wrote to memory of 4752	4900	chrome.exe	75
PID 4900 wrote to memory of 4752	4900	chrome.exe	75
PID 4900 wrote to memory of 4752	4900	chrome.exe	75
PID 4900 wrote to memory of 4752	4900	chrome.exe	75
PID 4900 wrote to memory of 4752	4900	chrome.exe	75
PID 4900 wrote to memory of 4752	4900	chrome.exe	75
PID 4900 wrote to memory of 4752	4900	chrome.exe	75
PID 4900 wrote to memory of 4752	4900	chrome.exe	75
PID 4900 wrote to memory of 4752	4900	chrome.exe	75
PID 4900 wrote to memory of 4752	4900	chrome.exe	75
PID 4900 wrote to memory of 4752	4900	chrome.exe	75
PID 4900 wrote to memory of 4752	4900	chrome.exe	75
PID 4900 wrote to memory of 4752	4900	chrome.exe	75
PID 4900 wrote to memory of 4752	4900	chrome.exe	75
PID 4900 wrote to memory of 2944	4900	chrome.exe	76
PID 4900 wrote to memory of 2944	4900	chrome.exe	76
PID 4900 wrote to memory of 1396	4900	chrome.exe	77
PID 4900 wrote to memory of 1396	4900	chrome.exe	77
PID 4900 wrote to memory of 1396	4900	chrome.exe	77
PID 4900 wrote to memory of 1396	4900	chrome.exe	77
PID 4900 wrote to memory of 1396	4900	chrome.exe	77
PID 4900 wrote to memory of 1396	4900	chrome.exe	77
PID 4900 wrote to memory of 1396	4900	chrome.exe	77
PID 4900 wrote to memory of 1396	4900	chrome.exe	77
PID 4900 wrote to memory of 1396	4900	chrome.exe	77
PID 4900 wrote to memory of 1396	4900	chrome.exe	77
PID 4900 wrote to memory of 1396	4900	chrome.exe	77
PID 4900 wrote to memory of 1396	4900	chrome.exe	77
PID 4900 wrote to memory of 1396	4900	chrome.exe	77
PID 4900 wrote to memory of 1396	4900	chrome.exe	77
PID 4900 wrote to memory of 1396	4900	chrome.exe	77
PID 4900 wrote to memory of 1396	4900	chrome.exe	77
PID 4900 wrote to memory of 1396	4900	chrome.exe	77
PID 4900 wrote to memory of 1396	4900	chrome.exe	77
PID 4900 wrote to memory of 1396	4900	chrome.exe	77
PID 4900 wrote to memory of 1396	4900	chrome.exe	77
PID 4900 wrote to memory of 1396	4900	chrome.exe	77
PID 4900 wrote to memory of 1396	4900	chrome.exe	77

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://bloxstrap.org
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffdd7049758,0x7ffdd7049768,0x7ffdd7049778
  2⤵
  PID:1236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1520 --field-trial-handle=1812,i,18418588268706382229,8867616109591347286,131072 /prefetch:2
  2⤵
  PID:4752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1864 --field-trial-handle=1812,i,18418588268706382229,8867616109591347286,131072 /prefetch:8
  2⤵
  PID:2944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2136 --field-trial-handle=1812,i,18418588268706382229,8867616109591347286,131072 /prefetch:8
  2⤵
  PID:1396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2868 --field-trial-handle=1812,i,18418588268706382229,8867616109591347286,131072 /prefetch:1
  2⤵
  PID:2684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2896 --field-trial-handle=1812,i,18418588268706382229,8867616109591347286,131072 /prefetch:1
  2⤵
  PID:1476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4384 --field-trial-handle=1812,i,18418588268706382229,8867616109591347286,131072 /prefetch:1
  2⤵
  PID:4156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5148 --field-trial-handle=1812,i,18418588268706382229,8867616109591347286,131072 /prefetch:8
  2⤵
  PID:2072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4900 --field-trial-handle=1812,i,18418588268706382229,8867616109591347286,131072 /prefetch:8
  2⤵
  PID:948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4760 --field-trial-handle=1812,i,18418588268706382229,8867616109591347286,131072 /prefetch:1
  2⤵
  PID:2284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5392 --field-trial-handle=1812,i,18418588268706382229,8867616109591347286,131072 /prefetch:8
  2⤵
  PID:624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5152 --field-trial-handle=1812,i,18418588268706382229,8867616109591347286,131072 /prefetch:8
  2⤵
  PID:4664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4656 --field-trial-handle=1812,i,18418588268706382229,8867616109591347286,131072 /prefetch:8
  2⤵
  PID:5116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5208 --field-trial-handle=1812,i,18418588268706382229,8867616109591347286,131072 /prefetch:8
  2⤵
  PID:4016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5956 --field-trial-handle=1812,i,18418588268706382229,8867616109591347286,131072 /prefetch:8
  2⤵
  PID:4612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2332 --field-trial-handle=1812,i,18418588268706382229,8867616109591347286,131072 /prefetch:8
  2⤵
  PID:3020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5392 --field-trial-handle=1812,i,18418588268706382229,8867616109591347286,131072 /prefetch:8
  2⤵
  PID:4232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4544 --field-trial-handle=1812,i,18418588268706382229,8867616109591347286,131072 /prefetch:8
  2⤵
  PID:4692
- C:\Users\Admin\Downloads\Bloxstrap-v2.7.0.exe
  "C:\Users\Admin\Downloads\Bloxstrap-v2.7.0.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:1784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4768 --field-trial-handle=1812,i,18418588268706382229,8867616109591347286,131072 /prefetch:8
  2⤵
  PID:4284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4780 --field-trial-handle=1812,i,18418588268706382229,8867616109591347286,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=5104 --field-trial-handle=1812,i,18418588268706382229,8867616109591347286,131072 /prefetch:1
  2⤵
  PID:216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --mojo-platform-channel-handle=5288 --field-trial-handle=1812,i,18418588268706382229,8867616109591347286,131072 /prefetch:1
  2⤵
  PID:4688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=4124 --field-trial-handle=1812,i,18418588268706382229,8867616109591347286,131072 /prefetch:1
  2⤵
  PID:688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5312 --field-trial-handle=1812,i,18418588268706382229,8867616109591347286,131072 /prefetch:8
  2⤵
  PID:5200

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1140

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4576

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
- NTFS ADS
PID:4884
- C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\windowsdesktop-runtime-6.0.32-win-x64.exe
  "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\windowsdesktop-runtime-6.0.32-win-x64.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1360
- - C:\Windows\Temp\{203A72F4-D9B0-4979-816A-1B052DEDAC3A}\.cr\windowsdesktop-runtime-6.0.32-win-x64.exe
    "C:\Windows\Temp\{203A72F4-D9B0-4979-816A-1B052DEDAC3A}\.cr\windowsdesktop-runtime-6.0.32-win-x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\windowsdesktop-runtime-6.0.32-win-x64.exe" -burn.filehandle.attached=548 -burn.filehandle.self=544
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:4840
  - - C:\Windows\Temp\{6B5C7F37-3BEE-4BB4-B669-A057226E97FB}\.be\windowsdesktop-runtime-6.0.32-win-x64.exe
      "C:\Windows\Temp\{6B5C7F37-3BEE-4BB4-B669-A057226E97FB}\.be\windowsdesktop-runtime-6.0.32-win-x64.exe" -q -burn.elevated BurnPipe.{245A6365-FC15-43B7-ABBF-3609D0545D66} {872DE91F-3941-4D33-8946-26FA822C5C4E} 4840
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:1344

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:4668

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4064

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:3624

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1036
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 867752BB5167B6F46631C8F3E66E0EF5
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1936
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 56917EF8928476BE542C716830612719
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1844
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding C2C526BA14DD5EF42666E567ACA7B0DD
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2076
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 46478263E972D8920F2437DF0084D152
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2660

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:920

C:\Users\Admin\Downloads\Bloxstrap-v2.7.0.exe
"C:\Users\Admin\Downloads\Bloxstrap-v2.7.0.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SendNotifyMessage
PID:1344
- C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-2e10d35f26294ab6\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe
  "C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-2e10d35f26294ab6\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe" /silent /install
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:7108
- - C:\Program Files (x86)\Microsoft\Temp\EU2ACA.tmp\MicrosoftEdgeUpdate.exe
    "C:\Program Files (x86)\Microsoft\Temp\EU2ACA.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"
    3⤵
    - Event Triggered Execution: Image File Execution Options Injection
    - Executes dropped EXE
    - Checks system information in the registry
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:6028
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:624
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:5448
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
        5⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5516
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
        5⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5548
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
        5⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5712
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MEREQjdBMjMtQUU1Ny00NjY2LUE3RDItODFEOEUxRDg4NjAyfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins4N0IxQkVBMS1DMDMxLTQ3MjMtODhFNS01RUE5RTVCODFGRUN9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE1MDYzLjAiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iUUVNVSIgcHJvZHVjdF9uYW1lPSJTdGFuZGFyZCBQQyAoUTM1ICsgSUNIOSwgMjAwOSkiLz48ZXhwIGV0YWc9IiIvPjxhcHAgYXBwaWQ9IntGM0M0RkUwMC1FRkQ1LTQwM0ItOTU2OS0zOThBMjBGMUJBNEF9IiB2ZXJzaW9uPSIiIG5leHR2ZXJzaW9uPSIxLjMuMTcxLjM5IiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIj48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI2NDY4NTIzNzU3IiBpbnN0YWxsX3RpbWVfbXM9IjQ5MSIvPjwvYXBwPjwvcmVxdWVzdD4
      4⤵
      Executes dropped EXE
      Checks system information in the registry
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      PID:5680
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{0DDB7A23-AE57-4666-A7D2-81D8E1D88602}" /silent
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5156

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x23c
1⤵
PID:5688

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
1⤵
- Executes dropped EXE
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:5256
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MEREQjdBMjMtQUU1Ny00NjY2LUE3RDItODFEOEUxRDg4NjAyfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9InsxMURFM0M0NC02NTEyLTQ5RUQtOThGMy02REZEODcwRDc0Nzl9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE1MDYzLjAiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iUUVNVSIgcHJvZHVjdF9uYW1lPSJTdGFuZGFyZCBQQyAoUTM1ICsgSUNIOSwgMjAwOSkiLz48ZXhwIGV0YWc9IiIvPjxhcHAgYXBwaWQ9Ins4QTY5RDM0NS1ENTY0LTQ2M2MtQUZGMS1BNjlEOUU1MzBGOTZ9IiB2ZXJzaW9uPSIxMDYuMC41MjQ5LjExOSIgbmV4dHZlcnNpb249IjEwNi4wLjUyNDkuMTE5IiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIj48ZXZlbnQgZXZlbnR0eXBlPSIzMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMyIgc3lzdGVtX3VwdGltZV90aWNrcz0iNjQ3MjQyMzY1NyIvPjwvYXBwPjwvcmVxdWVzdD4
  2⤵
  - Executes dropped EXE
  - Checks system information in the registry
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Modifies data under HKEY_USERS
  PID:5268

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e591239.rbs

Filesize
55KB

MD5
80ec0356b36c5bff72ff54293eb78bfc

SHA1
14695cf4343b2185479c138ef126e01fcad88933

SHA256
11d69f5faebf8fadb9c4dfe0ace0b6b61ad582eb37e0d888a4dd8bfba33affc1

SHA512
42bf62cad8aa28c96258e1908e5865c8ddcbf903578d85b70bd35f1080134fd9ac2c0c63f3342b7228b9d72fe09a04d4f5b85931e4bf2b2c1535e3317fd90baa

Download Submit
C:\Config.Msi\e59123e.rbs

Filesize
8KB

MD5
8905387f592735f311f8ae24a9f76e73

SHA1
45772ac019c3f6ee6fdc1de4ff9e37d3a76f5721

SHA256
266605286b3150c7d1156afd50db0f970b12c5f383ee4d7d330d6ba52690a9a8

SHA512
66ead107fb6fc51b7108cf8fdf1b05d807b885a41eb4ba026dc9cf38dec093d5ed8840dde5dcde81fae959428f31d8d5890518862b2e33d0fe801035b2f501a0

Download Submit
C:\Config.Msi\e591243.rbs

Filesize
9KB

MD5
96d3eddd42bf98190f9254d75c40b1da

SHA1
655888a76f5aadaba7dee61894fe7e044115b2ed

SHA256
0e14e3e330b59ceee31150cdd7cac70d9165453720e8c561a33c438193b2d763

SHA512
fe14e80e14ffe16f14624fd48582533daaa8738863254f23ae8253b58b101e2940441533314b39514be4e22d9abcca4bb2ebdbb8074f0b04f2a15d9bcda80637

Download Submit
C:\Config.Msi\e591248.rbs

Filesize
87KB

MD5
fa093cccd224d8aadcf33fc92a7b9b3d

SHA1
d8cf83ad07b73e92aeb1a2d45fb767829723b302

SHA256
b9e7b709f1487b94155187d5e23e9f3b89d023a8cd5f8eae4a1390f6c1bf44ca

SHA512
199164db6624a3d70f89aff23d6c7cabbeeb2776eb6dfd1d2b59aa88953cfb3e13ee175f63bb761bea4c0d1d515c5237f59512e6eaef9c2069a8d6008fa97085

Download Submit
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe

Filesize
201KB

MD5
4dc57ab56e37cd05e81f0d8aaafc5179

SHA1
494a90728d7680f979b0ad87f09b5b58f16d1cd5

SHA256
87c6f7d9b58f136aeb33c96dbfe3702083ec519aafca39be66778a9c27a68718

SHA512
320eeed88d7facf8c1f45786951ef81708c82cb89c63a3c820ee631c52ea913e64c4e21f0039c1b277cfb710c4d81cd2191878320d00fd006dd777c727d9dc2b

Download Submit
C:\Program Files\dotnet\LICENSE.txt

Filesize
9KB

MD5
31c5a77b3c57c8c2e82b9541b00bcd5a

SHA1
153d4bc14e3a2c1485006f1752e797ca8684d06d

SHA256
7f6839a61ce892b79c6549e2dc5a81fdbd240a0b260f8881216b45b7fda8b45d

SHA512
ad33e3c0c3b060ad44c5b1b712c991b2d7042f6a60dc691c014d977c922a7e3a783ba9bade1a34de853c271fde1fb75bc2c47869acd863a40be3a6c6d754c0a6

Download Submit
C:\Program Files\dotnet\ThirdPartyNotices.txt

Filesize
78KB

MD5
f77a4aecfaf4640d801eb6dcdfddc478

SHA1
7424710f255f6205ef559e4d7e281a3b701183bb

SHA256
d5db0ed54363e40717ae09e746dec99ad5b09223cc1273bb870703176dd226b7

SHA512
1b729dfa561899980ba8b15128ea39bc1e609fe07b30b283001fd9cf9da62885d78c18082d0085edd81f09203f878549b48f7f888a8486a2a526b134c849fd6b

Download Submit
C:\Program Files\dotnet\host\fxr\6.0.32\hostfxr.dll

Filesize
369KB

MD5
9d67514fe36639b7eda307fb46d27178

SHA1
b8ba4ca6bcf2e5740b7e0f7a077fc72b1248bafe

SHA256
ec8f92f2bcc5f6ee94605b7883e663236f2a2f578f4e610eae9934cbd4266fe9

SHA512
4ca3bb0167f7f2512bfb1cc69b72fbdefc4d3ed7679ba7abd4b8c60f42df2b95f6b44550f5a14c5843305b7705634d9b26327d87bb24f2934abb5ff94c54aea8

Download Submit
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.32\Microsoft.NETCore.App.deps.json

Filesize
32KB

MD5
8e0f8427c729e6b4cf95998f846a0887

SHA1
201ad7be0ad49c2c2dbe7c27b86a9295dcf0acb0

SHA256
335a13f00fb336771fbea2bb4a29e99e6e8bcf17b8c484091d256a99ab5dfdaf

SHA512
368d3f644361014808932f21c6324153d2a250b6ff869a8f261f68ccf2c93874f72cde8b474b3a7e4e54a7b10649b50f83e3ae5910d325e8cf7a77ba06dd9ee5

Download Submit
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.32\Microsoft.NETCore.App.runtimeconfig.json

Filesize
159B

MD5
3fbd84a952d4bab02e11fec7b2bbc90e

SHA1
e92de794f3c8d5a5a1a0b75318be9d5fb528d07d

SHA256
1b7aa545d9d3216979a9efe8d72967f6e559a9c6a22288d14444d6c5c4c15738

SHA512
c97c1da7ae94847d4edf11625dc5b5085838c3842a550310cca5c70ba54be907ff454ca1e0080ba451eacfc5954c3f778f8b4e26c0933e55c121c86c9a24400b

Download Submit
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.32\coreclr.dll

Filesize
4.9MB

MD5
3f517cd4d560ff7c81ca4e0acf375a96

SHA1
53375106ad45031329a0fb075c0d3193c4a8fac6

SHA256
64e1c7636e731bb9dd30adf26526ba69a64786f0d4c6979265cb5575ad1abff2

SHA512
c7fba2ece43b3328f5a041407ea4d729bdbccc65869e7540c7ca1ab558facce9e434812c362131cf9d04573d3edd5460747debc175e45bfcef281546c94476a6

Download Submit
C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.32\Microsoft.WindowsDesktop.App.deps.json

Filesize
30KB

MD5
696d67304a93ff0b4080af2a0bd81950

SHA1
3266776fe0620e640eb0b48fc202c5bb4e3b222e

SHA256
af358a8c2577aaf12aee78526fc49681b5ceba4715df7580862ff670ef66abd6

SHA512
c62e07a4410ba6a02e4cbafa92b62b530dcd42f4b4916378f3425e2fcf611fef93ba0c468a289873135c51110016ae11b3220e3b90104e1e1150ec3ee30a4a17

Download Submit
C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.32\Microsoft.WindowsDesktop.App.runtimeconfig.json

Filesize
289B

MD5
c20c59911e87624f8e03f9af82c3e41f

SHA1
13e8c58bd03da2df7bd9f7f6e26ae459ef37622d

SHA256
a4babb59021c679fdc40c86779d0063925fc927b1b3d3b0579d3107589104785

SHA512
c419003260b4f5e6a6b873cf3084b3944dfdc2c319e6d73ce861000472b87fda14c48b0eb52b8669b217b5c2825a26b9e588c3dead63c9f11e8ad055945ce8f3

Download Submit
C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log

Filesize
14KB

MD5
2043809ce11ff939fcc2566be485e2c3

SHA1
072c6f2eaf9df76cdca3a6b7b17cf11a0f75a358

SHA256
f5ffc40f1a018327d32a0594824ef2e0d5fe056f60809204e21038917e6fc1a7

SHA512
a9fab080b7fe9608515398370cd01f4db9314cd1bc150bcbd3d34f2a80a3973e7185e07069013710b6ca239acaf30c35b2b579b9034bce344e0ff087d01acec8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000015

Filesize
20KB

MD5
f50b0303a93c67e65305be05cbe1fa57

SHA1
4de34e70f9a065d38ce665fe473c9d2631446135

SHA256
b6e402069decead39d4fc8b1be4458df3dad2e85d34d0d0b421fc870099e2cda

SHA512
ff933165e202a26decb473ad2f437ec749336a8d5b14afbd9797fe63fbada989de3ff22251e7580f775d7011e428876b37be66a0cd68ba656d38f577ac9e7824

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\7d5ba57e7dc0f2d0_0

Filesize
54KB

MD5
f6e0eb7766fd082ddcac56ed4d048875

SHA1
088775dbccf59d70ea46e23d323f9206715943ec

SHA256
d359a5362ae28628e9195c9c065153abd1084c7b6921dde9cba11ee1759a4d51

SHA512
6ae882bd36b85856a21741e67c1b222123d1494007b91b6c7048606e8edcdd5b927e38430c3554723661d1aa13a2d441dd64d7b311ab2d51b0558ac1905b27d7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\f37d2ed825f8b32c_0

Filesize
303B

MD5
fcfafeab50d2e1ed499fa2fc2744fadc

SHA1
1741c65f636e27fc4f63d54fbd94fe11340a77a0

SHA256
f2a7aa02148d6ba91cb3b548cc00c3386f42bd9e46d15b6dccb1d40f3946fe95

SHA512
3803ed080c6fc33bc605034c58cdf1a9343e1cf93451e4609cda3acb6d11a74e768ea9328aa04c524837249aac5b2d5acdd9b233c3db49dea59187e593bbfb4e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
cbf8f3d91e7da84ab0f2b6b5f36d295e

SHA1
c61168dde0dc0fa59cb27873293cbfe06b788c2e

SHA256
b9e44c5ba5d050c70ad27d67e3bef9c93c66ce2fa35d565677d285a38df7cfda

SHA512
adf11df0741efb09a14379e0cbed04499a201950a10b3519ec02e58178dd46e35d56949a3a0c7cc64327e34afbe175df198a646af9abc47c6d40cc6c8d32175b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
696B

MD5
6a12963f0260156fc9ca5bcf224c3358

SHA1
965cb6a59bbd5ee24bb3d40adc5fd4baac856f0a

SHA256
00015e949522e1d52597d83ca0b0f1e43c82f2ccae092823b4b87ad4613b7b9c

SHA512
42952e1ed287ed5dd7f329c8c7fa941f63346ea7a8816ddcb8b1f5f0caf240967237801d09f996968eeb8c1e1e70e0754e8f0767c4966a012af27b6fa8fe3250

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
de31330e611eb3968ef65a0e7515b890

SHA1
f1ec0f1b0630ec1eb7cde919d848ceed33d13407

SHA256
22e066ffb760f7608a4e96c6b15c500618324ebe765cf40a803417bdaad6f8b0

SHA512
74a00f6e727bf0170fc97bce94ee5695c6283fd6c196d37ceef53ac063fe9dbda107a8b8dc46417ff8ca740b53040708579fc2bbbd3d6c264635f552d929023f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
87f379d7c25d41ad43324fdaab0770ca

SHA1
ed0545f697d422827a8c329a10c36d7df3fba72c

SHA256
c8aaafc6e564bbc92d681dce1dfeedc188a72782da5fe7c21afc365909f5d596

SHA512
8263e2fc5fc5b9a2c4ff9b704cd05c754a240a913b50f5e369bea8212720ed4b498fb38f4865595b61e2fdf8e9fd48db495ca71463a83f16a558062f9a7b47e9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
706B

MD5
72e19f891a3938f9e32114dd016b5c42

SHA1
249e075e164a2a3a25a734cdc6c394a1fc905fca

SHA256
4610e73a917dd1507b1e2d18ef4af63ce859182283e9389b74fb5de532043439

SHA512
b9b6f757b18adaaa2b9248f105f9a0585647d7d6ae5abb369a874c1685d82dab2b94087e5728d72672e1ab78f2146209bf09a6e6610d206fff0454a34e997711

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
f8a5cc133762cb6e1079b860e3118673

SHA1
a9048a10692a84fb53bfb5ca8d8fc6279c8baf04

SHA256
51c3a418463c3b03f0612a891962d0a1210f9b8d1c42b618bc92307e77575cd8

SHA512
d03604bd90fc0a62242aa24c28815ff69e98fb2a1d76c1c936e83fc192c8ec9286a40d8910dfe21a02c83c540685557c01dda6d55f74f688a398d8a1a5200610

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
9a8fb9d22e75098f0782159eec1bb755

SHA1
f338e16b485ab7626ba692bb74d63cdbce42a018

SHA256
47b133564709e77ad72ca2b6d120aac3838686dd54b97178464500343e41e233

SHA512
53619ffb383c997ea8585fcb7e261bfbecf85e3572f6103b8d4cb929383cfbd3a2b83a4ed3b56a93e457f34926d687b8d32ecaf6d532bdb60628a6db5d15b241

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
f6c16299ca2b505bdd1cc4a5277c32f1

SHA1
0be48842185895f3262317fe595ac46ffce80a80

SHA256
598c4364b632aa980e3088ebf429a369d36594b27c9c1596c264b9c74406f7de

SHA512
37d3c1da6db0e4890c58ad37c9887a935d8b780a67a0e53f8c9daa6771995951acf780b4def50205352fa3ce2d33c6f9a433d9b24c2ef2cbca4ae1adc5603d0a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
539B

MD5
fffbe8470c46cfdfd3f7d60ef2871a04

SHA1
8f351a2abc44b25bd2611df497c088968281e0a1

SHA256
b5a9406523432320b410504de5a7d8ada87ed6fb2164066f1e9969bc679add42

SHA512
f25e41fa2616ad2a9247815d1eb43048534802acf14e6fed87dd77ebb2c3c9035fcf8644e5d2afcb99c1dafb5a63c34d06e016e005e62c4aa4df72a1c5eb4918

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
98d40ff8ccf9eb534fdf63ef3edc57ad

SHA1
b70df2c75528b33b634ae63feb8ffb2009f205b4

SHA256
35aa6bf1884699821e4e5b916b29fdb390fb4e7d58a5fe4d1719ede797f20002

SHA512
8a17999632b50d32d7035540cc06f4fc16a2ccd79a8cc8b753ab15028a3eb7f0201799f1dc5256dd8f76934189663665e295f1dd9419d13f5249d40bab8cae86

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
be4bc1b13223f955e69bbd505e88ea06

SHA1
92399a27450176efb0f38d6d9d2dc40d7e40e18d

SHA256
7f8b32fa3b2dd5451737bb3bf036ad5f4d0b80e4d6aaad7efa487e9cee368f27

SHA512
43755f64bfc20fdbd38e04ce7dfa4341a158850f5a709c7cbabed69cde58f2a385e89c97edebdda5d4a19d8380a7126557bd1cea326b1592abb0b47a16c87120

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
3efb70ffbb6e49f5c2b71357805c749d

SHA1
85e2a957c32ab9f6f622856a5638ccfd3d5f1b50

SHA256
9dbfe81005e68712b794b1be92818c01abf14ea7035ac39874f194bcf79ef095

SHA512
57e92457b5a1164222ffc16527664078129078a8ac89076ef03c483e7b12372f7ed20f2abe2d74d982c15b5ae76e630497a1729fcbaba6c3824bc36fc820d4d5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
658cfa8dd966c4ba03735f0e443747f1

SHA1
c929d660930b88eb899f1b15c03663240884536f

SHA256
7bbd862d348a54d82fa40b3d6e98e25e22ade7e8b3064109838dad08d1384a6f

SHA512
41fea60d01ef00131a0b4846c43c9b835f3d4a234189d16a850a5deb9601dd10649f2573c7b715db6e2fadef19c46aa2115024eb2dc46f2df6d877c004c37534

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
138KB

MD5
f515c507607183d60288a52ff254d390

SHA1
cf4353a44939c3f45eb90ce755227c89c2574977

SHA256
360377a85af55d6ecd1a0d14a0ff10ee9ae975df604fb80877ac994a9e8349fc

SHA512
b80e9789c2baa3c3f103622e96ad7fe2b1e615614f7b335d855b34840713c477b22a0a0d1e51891d3e2b7c3d09fb764c18d2408970f1e252ef9abd27d73e3a21

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
138KB

MD5
cd52b2edc67bdde64277d1fda048057c

SHA1
c6c2ff7fb582d78072af426c921da04bb868cb49

SHA256
4e84078fb1ab5159934144d0009cc7a8821e8723f9276602092d18322e7c6363

SHA512
44f9b295a54378b680ac43224679d1910b47306885187c1093dd0fe0e2660f03fb8bce3f9c10dcd9925f90de024d297ce2de98b44c5a216ffc96b3ea0fe3c237

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
138KB

MD5
365ac15de57455ee7dd32bf541742138

SHA1
400c8beb9b36aac77d94968bbcd719e3f727b110

SHA256
09eeb4dcadb1a931d7a379ffdbd34a9a4e99a6bcb26b14b1e3ea804b7c099f05

SHA512
5d5a438f92453e59ada98681ffb25d7788c73247b17b702a09ba6cb6a901764633f66970cc22da3fe209fe5b710cf6a2100f57fa582e880e24c32e902525be23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
137KB

MD5
fdf20095975580b6e8ce8e98b4f79b1d

SHA1
8caeefc2d1715b35fb1055eb6b0d932df80b7a79

SHA256
beec7470751e96f62a5e887309f409f1b86371c41b76fbdf4ab032e4d9720e8d

SHA512
56540a6d310285c98b14b062b83bb6ee75aba6dce695467e18185313c39322cabb1b277297f0deea92e8e17d202c649844d31c768d81666b527d8eac30f15e03

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
188KB

MD5
b9d84714c265d27646f6e76c900efc8f

SHA1
c69ec62e770b7df0f760976abbdcf0f224b7996e

SHA256
0fd7f718dfc0fb18880c674aab3ddd534c88eb7acb8c22d3ae56101ee6ca99cf

SHA512
c37461b4532ffbdb1f7fe1961ca4865279f2fb9d74c9e0ada0146ffe5bf6783b22938ada01b0068c11f88d8438bae5d648c75e065813ee852e142efab29ecf72

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
114KB

MD5
7845d9465588a06d2df678f80c991a07

SHA1
415f45f1637eff0cf564145ea2a6feb206fcd436

SHA256
39a8a80f61acee716dc399d0713703936e49667c69481c8e88bb439b608af85f

SHA512
b0462c157b9f9a45b127a80e9cb529c2274e408b520ad64c212a5f3ecdbe7536caa7dfd754a94b27f84734bf33067b3a6c36d3732a10ccc2f7b75a84d06e100d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
107KB

MD5
c15808ef9a8a65c60082b375feb51611

SHA1
61d820569375bb7f1ea53b8cc4c3999b54e36c61

SHA256
dab360694d5f0e84be71c2ba135144aeb41de76ccff1a734800d9575f3d7d70f

SHA512
295b47d351d6dda76fcd54f2bb75227e2993ccd23f5ec99a500db250986cfb88001d3c08799f43e14787d31538a91f81f4f9c2edf6014c856dde2641510ee74a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe57f5d9.TMP

Filesize
95KB

MD5
4884bd53320dcb9842a669ba111933db

SHA1
088df7129fed40191b04c529cfae957261cbc45a

SHA256
b62d50805e39645d1f78cd74e38f8ec798c78845dcc9882baf60f58c75cb77aa

SHA512
2a9520716cebf3d0774fc2aacdc12d0ca5c0beb873380c151fb17098ad9828add94e95ed6b113a96efa42c52b6029b80e2aa926493d3f8c9627b22398daaf606

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\E49JWOHD\edgecompatviewlist[1].xml

Filesize
74KB

MD5
d4fc49dc14f63895d997fa4940f24378

SHA1
3efb1437a7c5e46034147cbbc8db017c69d02c31

SHA256
853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1

SHA512
cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\AICMNWOG\dotnet.microsoft[1].xml

Filesize
13B

MD5
c1ddea3ef6bbef3e7060a1a9ad89e4c5

SHA1
35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

SHA256
b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

SHA512
6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\AICMNWOG\dotnet.microsoft[1].xml

Filesize
84B

MD5
a6192f8bbddcac11449916e0bb89c04d

SHA1
173c23924f79b67451e70aa629c87ab9e57ce70f

SHA256
a4be5a925ce652b472a16acf345ea931c5267165df3b0c9954a575f7a32eb199

SHA512
a87632c636afb6881870fb13249d8024edf587518098af32354ebc6b736ddbde3e58c0e8c45b9c973ebdbca00aeaa6e4c2516a2958ab998ce1bfbcc82ba44f00

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\VMDT14EN\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\TTSWREZE\windowsdesktop-runtime-6.0.32-win-x64[1].exe

Filesize
32KB

MD5
47755c618a9a9e4c5bda3a442f99485f

SHA1
382cbb19d802d77b52cf8c1cf85ba32eddcbd07e

SHA256
7f743326cbab2e1312dff1614a09ebdb17d1a4963ad5fbd73eaee2b90b966aba

SHA512
9c93583b11f2e8b4fcad6055d6ca05ac853d5314cd15295284ad260b81073af9dbcdcf558420e2a367561e6e98b361842e7a322fb9f04d0238d2b4a9c780f6b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.32_(x64)_20240727052728_000_dotnet_runtime_6.0.32_win_x64.msi.log

Filesize
2KB

MD5
60ca8e15a418d43fb45cdf9da2068303

SHA1
e6c00b620a6f1bf1042dff58ebbc296110cfd422

SHA256
f5c03bb7726bbac2134924c5dd69f738189d8fede9a2baf67d7f6d0a7c22b838

SHA512
3889888e544126c4a8daa34cdc2c7b14c04f2cd1a9d9a6a47d1e51d58be47ba6b2082878f2645e4f41a56cbc5df22e1c41edc25d500c40465a695b2880daaded

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.32_(x64)_20240727052728_001_dotnet_hostfxr_6.0.32_win_x64.msi.log

Filesize
3KB

MD5
153d32f3c891d6b790dd4e264f4387e3

SHA1
f7f66c8b0875e33c5cd6de8f3290444688937fc9

SHA256
6b2b165fd6494fa6a857b1d3c1e0e302106a31e3b362b5b13468443cfb4905cf

SHA512
85642395041c56e00444544f85cd00d98c26c699e66f785dbbf6f49f1dd89cb3a4e97d2f28e28f1fa110368e34142b907322c887b199be0d97402d87bb13ffff

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.32_(x64)_20240727052728_002_dotnet_host_6.0.32_win_x64.msi.log

Filesize
2KB

MD5
9530bfc7293f11349245e759f589262c

SHA1
8a6fb2ada1a7a92977a3fbfa37840bab20251b68

SHA256
d193135ac13bfbc3a631c6c0ef455c1bf6fd15a0154cd312cdccc3815ff2564e

SHA512
69cd8be098bc2721ff9697ac165986b7cd711e671692bc74d25b118ba76b205250f9402d2078bddf5d8c7bc112ea035f0d319b9ce8549b9217f0bf04240453f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.32_(x64)_20240727052728_003_windowsdesktop_runtime_6.0.32_win_x64.msi.log

Filesize
2KB

MD5
985cb4c1182cb2eea80ef56a760e3c7e

SHA1
672be120139a41b4ea3a6c6e1ef10c8197836aef

SHA256
649de557479625c7b12488b4d7001db00d446b307d2323734d73074d88361e16

SHA512
b7e56a7b16b6778dcef882089d188ce01b398c8f432dc068c83d51a6ef6fc47e1fbbd309cbbca02d6754ae4d89b55710c886995d7f993e00b66cbba321f16cfa

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 304683.crdownload

Filesize
10.1MB

MD5
2c752edef5b0aa0962a3e01c4c82a2fa

SHA1
9c3afd1c63f2b0dbdc2dc487709471222d2cb81e

SHA256
891846bf656253ca1cdd28584a28681e9604e2a03d74cd6b99313e3bff11daf8

SHA512
04d25fe7d40c8c320ffc545a038ad6ea458df6a8a552b0e0393b369a03b9bf273c72f30169bd54e8eb10757c04bdddf3859c601c1eb9e1a12fe4d15658906dfe

Download Submit
C:\Windows\Installer\MSI18ED.tmp

Filesize
244KB

MD5
60e8c139e673b9eb49dc83718278bc88

SHA1
00a3a9cd6d3a9f52628ea09c2e645fe56ee7cd56

SHA256
b181b6b4d69a53143a97a306919ba1adbc0b036a48b6d1d41ae7a01e8ef286cb

SHA512
ac7cb86dbf3b86f00da7b8a246a6c7ef65a6f1c8705ea07f9b90e494b6239fb9626b55ee872a9b7f16575a60c82e767af228b8f018d4d7b9f783efaccca2b103

Download Submit
C:\Windows\Temp\{203A72F4-D9B0-4979-816A-1B052DEDAC3A}\.cr\windowsdesktop-runtime-6.0.32-win-x64.exe

Filesize
636KB

MD5
73fa53cc1472a5868b64e379cc781e83

SHA1
5b2bb58b39ed3fd3f6b35b4f957430ba5ac305d3

SHA256
9ee6a2a1c3a8102f2500b7a1159f383aa888164f8af174445473b675a6f7e631

SHA512
9b7e382564f0fefbb35da95c905cf90b6b82be6f1fd78f338e36bf2b2863d91ed8715c79500eec43f941ff20948e08b580d8ab8259a0797ddb6469571a0a7767

Download Submit
C:\Windows\Temp\{6B5C7F37-3BEE-4BB4-B669-A057226E97FB}\.ba\bg.png

Filesize
4KB

MD5
9eb0320dfbf2bd541e6a55c01ddc9f20

SHA1
eb282a66d29594346531b1ff886d455e1dcd6d99

SHA256
9095bf7b6baa0107b40a4a6d727215be077133a190f4ca9bd89a176842141e79

SHA512
9ada3a1757a493fbb004bd767fab8f77430af69d71479f340b8b8ede904cc94cd733700db593a4a2d2e1184c0081fd0648318d867128e1cb461021314990931d

Download Submit
C:\Windows\Temp\{6B5C7F37-3BEE-4BB4-B669-A057226E97FB}\dotnet_host_6.0.32_win_x64.msi

Filesize
792KB

MD5
ac53c5d5e2f1e2ccfd83408856ce81db

SHA1
14f67d98612aad86c092dd05200b21a4fdfb8e1c

SHA256
756c0d73225da2a0da97c879e00f6d5b273a0078d0bab55eb52755b449d1a896

SHA512
0fab821d87fd7daab480db7bf54f0a51a73a16e91440d7ea440a56f6bb3d177105bf1e0741f7d4b94d206f6152104f7b35456ae1f1054b6f679ff0a126588454

Download Submit
C:\Windows\Temp\{6B5C7F37-3BEE-4BB4-B669-A057226E97FB}\dotnet_hostfxr_6.0.32_win_x64.msi

Filesize
856KB

MD5
46db6c104f1b633927dee575b5c38c0b

SHA1
9d5e6cf836e28959181b855102e70f5a37550314

SHA256
2c8dfb556f4a6576205af03f8d5e2f0a939395ca2de6d69f06478b3008d1a2ce

SHA512
007877e08b1958fdc5fec7da9fe8ad1a678c2e59bf0b5f4b4080640c1fab96a34f27af81f5a733580e95b897d0e27e1c1fd45a4ca20a673a20f3331f3d5c2b62

Download Submit
C:\Windows\Temp\{6B5C7F37-3BEE-4BB4-B669-A057226E97FB}\dotnet_runtime_6.0.32_win_x64.msi

Filesize
26.0MB

MD5
4e9eb394f40e78755fa76e67f9190cd0

SHA1
36310c7f007992d911e8402e4aa34a2bb1682063

SHA256
8701e309396c5232a4fe1606c6e3549134fe01dc0d9fe4a74cb9d26531ddd9a4

SHA512
2cb71f44e7bba16143120512718dd128185a5063ba4767146d10c93b81b6caa4226cfc30fa44b1e50ee41c37b55852e32ea63554fd438fb9ed60de2ce93ca8e3

Download Submit
C:\Windows\Temp\{6B5C7F37-3BEE-4BB4-B669-A057226E97FB}\windowsdesktop_runtime_6.0.32_win_x64.msi

Filesize
28.7MB

MD5
6631bf8cc9b765110110130467cdf840

SHA1
ccc090918b2636279c2fd093d8e0d4ba99f5513f

SHA256
afc5aeb00ccfb01f8428597fa7d44bf07d2811f712b998e4683e288404eb2e91

SHA512
cfa6f85ab7c5865245e879e46063e63c53e835e81d8fc0ecde802a6ca3f898e4a94e58c10d99ac53f147dcc630c502c11596901dc4102dd758404730e91b0a3f

Download Submit
\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.32\hostpolicy.dll

Filesize
385KB

MD5
99627be8353e7b34ebdbbbf965470601

SHA1
e60681e3f81b4dcaf304e715878ed9f3984a1baa

SHA256
b54e1acf51c3a876c68e99ff17c5a585af264cfc25f57d6913ea9bd85fcb25b5

SHA512
bc162e11bdf84ecb7c0da3f6ffdab3380958c8b9c86e9dc4cbf03bc8fe3c5b2d958e11fb373d5944418f687f7f559c1dbeca36b37d1ae4472bb8b58420a7ad6c

Download Submit
\Windows\Temp\{6B5C7F37-3BEE-4BB4-B669-A057226E97FB}\.ba\wixstdba.dll

Filesize
215KB

MD5
f68f43f809840328f4e993a54b0d5e62

SHA1
01da48ce6c81df4835b4c2eca7e1d447be893d39

SHA256
e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e

SHA512
a7a799ecf1784fb5e8cd7191bf78b510ff5b07db07363388d7b32ed21f4fddc09e34d1160113395f728c0f4e57d13768a0350dbdb207d9224337d2153dc791e1

Download Submit
memory/3624-815-0x00000260F74C0000-0x00000260F74D0000-memory.dmp

Filesize
64KB

Download
memory/3624-483-0x00000260F9760000-0x00000260F9762000-memory.dmp

Filesize
8KB

Download
memory/3624-816-0x00000260F74C0000-0x00000260F74D0000-memory.dmp

Filesize
64KB

Download
memory/3624-594-0x00000260FED70000-0x00000260FED90000-memory.dmp

Filesize
128KB

Download
memory/3624-817-0x00000260F74C0000-0x00000260F74D0000-memory.dmp

Filesize
64KB

Download
memory/3624-595-0x00000260FED90000-0x00000260FEDB0000-memory.dmp

Filesize
128KB

Download
memory/3624-663-0x00000260F8B80000-0x00000260F8B82000-memory.dmp

Filesize
8KB

Download
memory/3624-811-0x00000260F74C0000-0x00000260F74D0000-memory.dmp

Filesize
64KB

Download
memory/3624-562-0x00000260F8E20000-0x00000260F8F20000-memory.dmp

Filesize
1024KB

Download
memory/3624-525-0x00000260F7E00000-0x00000260F7F00000-memory.dmp

Filesize
1024KB

Download
memory/3624-812-0x00000260F74C0000-0x00000260F74D0000-memory.dmp

Filesize
64KB

Download
memory/3624-1176-0x00000260F74C0000-0x00000260F74D0000-memory.dmp

Filesize
64KB

Download
memory/3624-1174-0x00000260F74C0000-0x00000260F74D0000-memory.dmp

Filesize
64KB

Download
memory/3624-1175-0x00000260F74C0000-0x00000260F74D0000-memory.dmp

Filesize
64KB

Download
memory/3624-813-0x00000260F74C0000-0x00000260F74D0000-memory.dmp

Filesize
64KB

Download
memory/3624-818-0x00000260F74C0000-0x00000260F74D0000-memory.dmp

Filesize
64KB

Download
memory/3624-487-0x00000260FDA00000-0x00000260FDA02000-memory.dmp

Filesize
8KB

Download
memory/3624-688-0x00000260FEAD0000-0x00000260FEAF0000-memory.dmp

Filesize
128KB

Download
memory/3624-490-0x00000260FDA10000-0x00000260FDA12000-memory.dmp

Filesize
8KB

Download
memory/3624-492-0x00000260FDA30000-0x00000260FDA32000-memory.dmp

Filesize
8KB

Download
memory/3624-485-0x00000260FD8E0000-0x00000260FD8E2000-memory.dmp

Filesize
8KB

Download
memory/3624-481-0x00000260F9740000-0x00000260F9742000-memory.dmp

Filesize
8KB

Download
memory/3624-636-0x00000260FEB10000-0x00000260FEB30000-memory.dmp

Filesize
128KB

Download
memory/3624-356-0x00000260F74E0000-0x00000260F74E2000-memory.dmp

Filesize
8KB

Download
memory/3624-358-0x00000260F7810000-0x00000260F7812000-memory.dmp

Filesize
8KB

Download
memory/3624-353-0x00000260F74B0000-0x00000260F74B2000-memory.dmp

Filesize
8KB

Download
memory/3624-640-0x00000260FE400000-0x00000260FE500000-memory.dmp

Filesize
1024KB

Download
memory/4064-322-0x0000020F71500000-0x0000020F71600000-memory.dmp

Filesize
1024KB

Download
memory/4064-323-0x0000020F71500000-0x0000020F71600000-memory.dmp

Filesize
1024KB

Download
memory/4576-314-0x000002E4066C0000-0x000002E4066C2000-memory.dmp

Filesize
8KB

Download
memory/4576-279-0x000002E407520000-0x000002E407530000-memory.dmp

Filesize
64KB

Download
memory/4576-295-0x000002E407620000-0x000002E407630000-memory.dmp

Filesize
64KB

Download