hxxps://mega[.]nz/file/b7I0EaJJ#u55Ebo6aZKUup9GupKHs7PkS249E0cf4ildHDJzHrQo

Analysis

max time kernel
251s
max time network
251s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
07/08/2024, 09:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://mega.nz/file/b7I0EaJJ#u55Ebo6aZKUup9GupKHs7PkS249E0cf4ildHDJzHrQo

Score

8^/10

discovery persistence

Malware Config

Signatures

Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\International\Geo\Nation	Kiwi X External.exe

Executes dropped EXE 6 IoCs

pid	Process
4784	Kiwi X External.exe
5412	windowsdesktop-runtime-7.0.20-win-x64.exe
5448	windowsdesktop-runtime-7.0.20-win-x64.exe
5772	windowsdesktop-runtime-7.0.20-win-x64.exe
5532	Kiwi X External.exe
5984	Kiwi X External.exe

Loads dropped DLL 64 IoCs

pid	Process
5448	windowsdesktop-runtime-7.0.20-win-x64.exe
6000	MsiExec.exe
6000	MsiExec.exe
5168	MsiExec.exe
5168	MsiExec.exe
5440	MsiExec.exe
5440	MsiExec.exe
5820	MsiExec.exe
5820	MsiExec.exe
5532	Kiwi X External.exe
5532	Kiwi X External.exe
5532	Kiwi X External.exe
5532	Kiwi X External.exe
5532	Kiwi X External.exe
5532	Kiwi X External.exe
5532	Kiwi X External.exe
5532	Kiwi X External.exe
5532	Kiwi X External.exe
5532	Kiwi X External.exe
5532	Kiwi X External.exe
5532	Kiwi X External.exe
5532	Kiwi X External.exe
5532	Kiwi X External.exe
5532	Kiwi X External.exe
5532	Kiwi X External.exe
5532	Kiwi X External.exe
5532	Kiwi X External.exe
5532	Kiwi X External.exe
5532	Kiwi X External.exe
5532	Kiwi X External.exe
5532	Kiwi X External.exe
5532	Kiwi X External.exe
5532	Kiwi X External.exe
5532	Kiwi X External.exe
5532	Kiwi X External.exe
5532	Kiwi X External.exe
5532	Kiwi X External.exe
5532	Kiwi X External.exe
5532	Kiwi X External.exe
5532	Kiwi X External.exe
5532	Kiwi X External.exe
5532	Kiwi X External.exe
5532	Kiwi X External.exe
5532	Kiwi X External.exe
5532	Kiwi X External.exe
5532	Kiwi X External.exe
5532	Kiwi X External.exe
5532	Kiwi X External.exe
5532	Kiwi X External.exe
5532	Kiwi X External.exe
5532	Kiwi X External.exe
5532	Kiwi X External.exe
5532	Kiwi X External.exe
5532	Kiwi X External.exe
5532	Kiwi X External.exe
5532	Kiwi X External.exe
5532	Kiwi X External.exe
5532	Kiwi X External.exe
5532	Kiwi X External.exe
5532	Kiwi X External.exe
5532	Kiwi X External.exe
5532	Kiwi X External.exe
5532	Kiwi X External.exe
5532	Kiwi X External.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{362ea044-f96f-45c7-b59f-0dbe5ca98ff4} = "\"C:\\ProgramData\\Package Cache\\{362ea044-f96f-45c7-b59f-0dbe5ca98ff4}\\windowsdesktop-runtime-7.0.20-win-x64.exe\" /burn.runonce"	windowsdesktop-runtime-7.0.20-win-x64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.20\System.Net.NetworkInformation.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.20\PresentationFramework.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.20\System.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.20\System.IO.Compression.FileSystem.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.20\System.Runtime.InteropServices.RuntimeInformation.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.20\System.Runtime.Serialization.Formatters.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.20\pt-BR\System.Windows.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.20\pl\System.Windows.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.20\System.Security.Cryptography.Csp.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.20\System.Security.Cryptography.Encoding.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.20\System.Xml.XmlDocument.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.20\System.CodeDom.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.20\zh-Hant\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\swidtag\Microsoft Windows Desktop Runtime - 7.0.20 (x64).swidtag	windowsdesktop-runtime-7.0.20-win-x64.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.20\System.Runtime.CompilerServices.Unsafe.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.20\mscorlib.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.20\it\System.Windows.Forms.Primitives.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.20\System.IO.Pipes.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.20\pt-BR\System.Windows.Forms.Design.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.20\es\System.Windows.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\ThirdPartyNotices.txt	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.20\System.Drawing.Common.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.20\ja\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.20\System.Net.NameResolution.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.20\System.Windows.Forms.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.20\System.Diagnostics.Contracts.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.20\System.Transactions.Local.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.20\cs\WindowsBase.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.20\System.Linq.Expressions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.20\ko\System.Windows.Forms.Primitives.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.20\zh-Hans\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.20\System.Net.Primitives.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.20\de\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.20\tr\WindowsBase.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.20\System.Diagnostics.EventLog.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.20\es\UIAutomationClient.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.20\System.Net.WebSockets.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.20\System.Reflection.Emit.ILGeneration.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.20\System.Diagnostics.Tools.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.20\System.Collections.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.20\ru\System.Windows.Forms.Primitives.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.20\clrgc.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.20\ko\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.20\System.Net.Mail.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.20\es\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.20\System.Runtime.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.20\pt-BR\UIAutomationClient.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.20\de\UIAutomationClient.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.20\es\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.20\WindowsBase.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.20\System.Security.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.20\System.Runtime.Numerics.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.20\Microsoft.Win32.Registry.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.20\pl\ReachFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.20\de\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.20\de\WindowsBase.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.20\System.Runtime.InteropServices.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.20\System.ObjectModel.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.20\cs\ReachFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.20\zh-Hans\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.20\cs\System.Windows.Forms.Primitives.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.20\ru\ReachFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.20\es\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.20\System.Windows.dll	msiexec.exe

Drops file in Windows directory 36 IoCs

description	ioc	Process
File created	C:\Windows\Installer\SourceHash{B0FC828F-678C-4868-9B5B-99639758E6F3}	msiexec.exe
File created	C:\Windows\Installer\e5acb49.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5acb4a.msi	msiexec.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File opened for modification	C:\Windows\Installer\e5acb40.msi	msiexec.exe
File created	C:\Windows\Installer\e5acb45.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDE8F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEC27.tmp	msiexec.exe
File created	C:\Windows\Installer\e5acb44.msi	msiexec.exe
File created	C:\Windows\Installer\e5acb40.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{221BB52A-B763-4C9D-AA62-4B0B6C9AAD62}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE928.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{72C29BED-666F-4E5E-BC49-DF44C890742E}	msiexec.exe
File created	C:\Windows\INF\netrasa.PNF	svchost.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\e5acb45.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDF9A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE077.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE377.tmp	msiexec.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdge.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDAE4.tmp	msiexec.exe
File created	C:\Windows\Installer\e5acb53.msi	msiexec.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File opened for modification	C:\Windows\Installer\MSID0AF.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e5acb4f.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE26C.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{EE5EB03B-D65C-4991-848E-2C6E024326DB}	msiexec.exe
File created	C:\Windows\Installer\e5acb4e.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE59D.tmp	msiexec.exe
File created	C:\Windows\Installer\e5acb4f.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID275.tmp	msiexec.exe
File created	C:\Windows\Installer\e5acb4a.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF496.tmp	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-7.0.20-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-7.0.20-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-7.0.20-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies data under HKEY_USERS 11 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1D	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1B	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1c	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1b	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1C	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1d	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133674968224668933"	chrome.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1A\52C64B7E	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VendorId = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\dotnet.microsoft.com\ = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_56.80.15184_x64\Dependents	windowsdesktop-runtime-7.0.20-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_56.80.15245_x64\ = "{72C29BED-666F-4E5E-BC49-DF44C890742E}"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "0"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\LastCleanup = 0000000000000000	MicrosoftEdge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F828CF0BC8768684B9B5993679856E3F\SourceList\PackageName = "dotnet-hostfxr-7.0.20-win-x64.msi"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\OneTimeCleanup = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B30BE5EEC56D199448E8C2E6203462BD	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F828CF0BC8768684B9B5993679856E3F\PackageCode = "4BA04D03DB0E58A458A8B36E0866CBC5"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_56.80.15184_x64	windowsdesktop-runtime-7.0.20-win-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x1414\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\""	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\trust	MicrosoftEdge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A25BB122367BD9C4AA26B4B0C6A9DA26\PackageCode = "F7E5F75BB2065BD4F809B41EAF7EE914"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_56.80.15184_x64\Dependents\{362ea044-f96f-45c7-b59f-0dbe5ca98ff4}	windowsdesktop-runtime-7.0.20-win-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\MrtCache	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\microsoft.com\Total = "10"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F828CF0BC8768684B9B5993679856E3F\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_56.80.15245_x64\Version = "56.80.15245"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B30BE5EEC56D199448E8C2E6203462BD\SourceList\PackageName = "dotnet-host-7.0.20-win-x64.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{362ea044-f96f-45c7-b59f-0dbe5ca98ff4}\Dependents	windowsdesktop-runtime-7.0.20-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\A25BB122367BD9C4AA26B4B0C6A9DA26	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IETld\LowMic	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\TrustedPublisher	MicrosoftEdge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A25BB122367BD9C4AA26B4B0C6A9DA26\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "268435456"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\Total	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\JumpListFirstRun = "3"	MicrosoftEdge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\dotnet_runtime_56.80.15184_x64	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_7.0_x64\Version = "56.80.15184"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\microsoft.com\ = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{362ea044-f96f-45c7-b59f-0dbe5ca98ff4}\ = "{362ea044-f96f-45c7-b59f-0dbe5ca98ff4}"	windowsdesktop-runtime-7.0.20-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\DEB92C27F666E5E4CB94FD448C0947E2\Provider	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DEB92C27F666E5E4CB94FD448C0947E2\SourceList	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListDOSTime = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage	MicrosoftEdgeCP.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\8325763EE7A55665A6A1073E4E27AE21	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = f06a3757ade8da01	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Content\CacheLimit = "256000"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\dotnet.microsoft.com\ = "124"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A25BB122367BD9C4AA26B4B0C6A9DA26\ProductName = "Microsoft .NET Runtime - 7.0.20 (x64)"	msiexec.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\windowsdesktop-runtime-7.0.20-win-x64.exe.4upwg7a.partial:Zone.Identifier	browser_broker.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3796	chrome.exe
3796	chrome.exe
3628	chrome.exe
3628	chrome.exe
5892	msiexec.exe
5892	msiexec.exe
5892	msiexec.exe
5892	msiexec.exe
5892	msiexec.exe
5892	msiexec.exe
5892	msiexec.exe
5892	msiexec.exe
5532	Kiwi X External.exe
5984	Kiwi X External.exe

Suspicious behavior: LoadsDriver 10 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
640	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
1488	MicrosoftEdgeCP.exe
1488	MicrosoftEdgeCP.exe
1488	MicrosoftEdgeCP.exe
1488	MicrosoftEdgeCP.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
3796	chrome.exe
3796	chrome.exe
3796	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3796	chrome.exe
Token: SeCreatePagefilePrivilege	3796	chrome.exe
Token: SeShutdownPrivilege	3796	chrome.exe
Token: SeCreatePagefilePrivilege	3796	chrome.exe
Token: SeShutdownPrivilege	3796	chrome.exe
Token: SeCreatePagefilePrivilege	3796	chrome.exe
Token: SeShutdownPrivilege	3796	chrome.exe
Token: SeCreatePagefilePrivilege	3796	chrome.exe
Token: SeShutdownPrivilege	3796	chrome.exe
Token: SeCreatePagefilePrivilege	3796	chrome.exe
Token: SeShutdownPrivilege	3796	chrome.exe
Token: SeCreatePagefilePrivilege	3796	chrome.exe
Token: SeShutdownPrivilege	3796	chrome.exe
Token: SeCreatePagefilePrivilege	3796	chrome.exe
Token: SeShutdownPrivilege	3796	chrome.exe
Token: SeCreatePagefilePrivilege	3796	chrome.exe
Token: SeShutdownPrivilege	3796	chrome.exe
Token: SeCreatePagefilePrivilege	3796	chrome.exe
Token: SeShutdownPrivilege	3796	chrome.exe
Token: SeCreatePagefilePrivilege	3796	chrome.exe
Token: SeShutdownPrivilege	3796	chrome.exe
Token: SeCreatePagefilePrivilege	3796	chrome.exe
Token: SeShutdownPrivilege	3796	chrome.exe
Token: SeCreatePagefilePrivilege	3796	chrome.exe
Token: SeShutdownPrivilege	3796	chrome.exe
Token: SeCreatePagefilePrivilege	3796	chrome.exe
Token: SeShutdownPrivilege	3796	chrome.exe
Token: SeCreatePagefilePrivilege	3796	chrome.exe
Token: SeShutdownPrivilege	3796	chrome.exe
Token: SeCreatePagefilePrivilege	3796	chrome.exe
Token: SeShutdownPrivilege	3796	chrome.exe
Token: SeCreatePagefilePrivilege	3796	chrome.exe
Token: SeShutdownPrivilege	3796	chrome.exe
Token: SeCreatePagefilePrivilege	3796	chrome.exe
Token: SeShutdownPrivilege	3796	chrome.exe
Token: SeCreatePagefilePrivilege	3796	chrome.exe
Token: SeShutdownPrivilege	3796	chrome.exe
Token: SeCreatePagefilePrivilege	3796	chrome.exe
Token: SeShutdownPrivilege	3796	chrome.exe
Token: SeCreatePagefilePrivilege	3796	chrome.exe
Token: SeShutdownPrivilege	3796	chrome.exe
Token: SeCreatePagefilePrivilege	3796	chrome.exe
Token: SeShutdownPrivilege	3796	chrome.exe
Token: SeCreatePagefilePrivilege	3796	chrome.exe
Token: SeShutdownPrivilege	3796	chrome.exe
Token: SeCreatePagefilePrivilege	3796	chrome.exe
Token: SeShutdownPrivilege	3796	chrome.exe
Token: SeCreatePagefilePrivilege	3796	chrome.exe
Token: SeShutdownPrivilege	3796	chrome.exe
Token: SeCreatePagefilePrivilege	3796	chrome.exe
Token: SeShutdownPrivilege	3796	chrome.exe
Token: SeCreatePagefilePrivilege	3796	chrome.exe
Token: SeShutdownPrivilege	3796	chrome.exe
Token: SeCreatePagefilePrivilege	3796	chrome.exe
Token: SeShutdownPrivilege	700	svchost.exe
Token: SeCreatePagefilePrivilege	700	svchost.exe
Token: SeLoadDriverPrivilege	700	svchost.exe
Token: SeLoadDriverPrivilege	700	svchost.exe
Token: SeShutdownPrivilege	3796	chrome.exe
Token: SeCreatePagefilePrivilege	3796	chrome.exe
Token: SeLoadDriverPrivilege	700	svchost.exe
Token: SeLoadDriverPrivilege	700	svchost.exe
Token: SeLoadDriverPrivilege	700	svchost.exe
Token: SeLoadDriverPrivilege	700	svchost.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
3796	chrome.exe
3796	chrome.exe
3796	chrome.exe
3796	chrome.exe
3796	chrome.exe
3796	chrome.exe
3796	chrome.exe
3796	chrome.exe
3796	chrome.exe
3796	chrome.exe
3796	chrome.exe
3796	chrome.exe
3796	chrome.exe
3796	chrome.exe
3796	chrome.exe
3796	chrome.exe
3796	chrome.exe
3796	chrome.exe
3796	chrome.exe
3796	chrome.exe
3796	chrome.exe
3796	chrome.exe
3796	chrome.exe
3796	chrome.exe
3796	chrome.exe
3796	chrome.exe
3796	chrome.exe
3796	chrome.exe
3796	chrome.exe
3796	chrome.exe
3796	chrome.exe
3796	chrome.exe
3796	chrome.exe
716	7zG.exe
5448	windowsdesktop-runtime-7.0.20-win-x64.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3796	chrome.exe
3796	chrome.exe
3796	chrome.exe
3796	chrome.exe
3796	chrome.exe
3796	chrome.exe
3796	chrome.exe
3796	chrome.exe
3796	chrome.exe
3796	chrome.exe
3796	chrome.exe
3796	chrome.exe
3796	chrome.exe
3796	chrome.exe
3796	chrome.exe
3796	chrome.exe
3796	chrome.exe
3796	chrome.exe
3796	chrome.exe
3796	chrome.exe
3796	chrome.exe
3796	chrome.exe
3796	chrome.exe
3796	chrome.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4888	OpenWith.exe
3148	MicrosoftEdge.exe
1488	MicrosoftEdgeCP.exe
3664	MicrosoftEdgeCP.exe
1488	MicrosoftEdgeCP.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3796 wrote to memory of 3756	3796	chrome.exe	73
PID 3796 wrote to memory of 3756	3796	chrome.exe	73
PID 3796 wrote to memory of 4184	3796	chrome.exe	75
PID 3796 wrote to memory of 4184	3796	chrome.exe	75
PID 3796 wrote to memory of 4184	3796	chrome.exe	75
PID 3796 wrote to memory of 4184	3796	chrome.exe	75
PID 3796 wrote to memory of 4184	3796	chrome.exe	75
PID 3796 wrote to memory of 4184	3796	chrome.exe	75
PID 3796 wrote to memory of 4184	3796	chrome.exe	75
PID 3796 wrote to memory of 4184	3796	chrome.exe	75
PID 3796 wrote to memory of 4184	3796	chrome.exe	75
PID 3796 wrote to memory of 4184	3796	chrome.exe	75
PID 3796 wrote to memory of 4184	3796	chrome.exe	75
PID 3796 wrote to memory of 4184	3796	chrome.exe	75
PID 3796 wrote to memory of 4184	3796	chrome.exe	75
PID 3796 wrote to memory of 4184	3796	chrome.exe	75
PID 3796 wrote to memory of 4184	3796	chrome.exe	75
PID 3796 wrote to memory of 4184	3796	chrome.exe	75
PID 3796 wrote to memory of 4184	3796	chrome.exe	75
PID 3796 wrote to memory of 4184	3796	chrome.exe	75
PID 3796 wrote to memory of 4184	3796	chrome.exe	75
PID 3796 wrote to memory of 4184	3796	chrome.exe	75
PID 3796 wrote to memory of 4184	3796	chrome.exe	75
PID 3796 wrote to memory of 4184	3796	chrome.exe	75
PID 3796 wrote to memory of 4184	3796	chrome.exe	75
PID 3796 wrote to memory of 4184	3796	chrome.exe	75
PID 3796 wrote to memory of 4184	3796	chrome.exe	75
PID 3796 wrote to memory of 4184	3796	chrome.exe	75
PID 3796 wrote to memory of 4184	3796	chrome.exe	75
PID 3796 wrote to memory of 4184	3796	chrome.exe	75
PID 3796 wrote to memory of 4184	3796	chrome.exe	75
PID 3796 wrote to memory of 4184	3796	chrome.exe	75
PID 3796 wrote to memory of 4184	3796	chrome.exe	75
PID 3796 wrote to memory of 4184	3796	chrome.exe	75
PID 3796 wrote to memory of 4184	3796	chrome.exe	75
PID 3796 wrote to memory of 4184	3796	chrome.exe	75
PID 3796 wrote to memory of 4184	3796	chrome.exe	75
PID 3796 wrote to memory of 4184	3796	chrome.exe	75
PID 3796 wrote to memory of 4184	3796	chrome.exe	75
PID 3796 wrote to memory of 4184	3796	chrome.exe	75
PID 3796 wrote to memory of 164	3796	chrome.exe	76
PID 3796 wrote to memory of 164	3796	chrome.exe	76
PID 3796 wrote to memory of 4820	3796	chrome.exe	77
PID 3796 wrote to memory of 4820	3796	chrome.exe	77
PID 3796 wrote to memory of 4820	3796	chrome.exe	77
PID 3796 wrote to memory of 4820	3796	chrome.exe	77
PID 3796 wrote to memory of 4820	3796	chrome.exe	77
PID 3796 wrote to memory of 4820	3796	chrome.exe	77
PID 3796 wrote to memory of 4820	3796	chrome.exe	77
PID 3796 wrote to memory of 4820	3796	chrome.exe	77
PID 3796 wrote to memory of 4820	3796	chrome.exe	77
PID 3796 wrote to memory of 4820	3796	chrome.exe	77
PID 3796 wrote to memory of 4820	3796	chrome.exe	77
PID 3796 wrote to memory of 4820	3796	chrome.exe	77
PID 3796 wrote to memory of 4820	3796	chrome.exe	77
PID 3796 wrote to memory of 4820	3796	chrome.exe	77
PID 3796 wrote to memory of 4820	3796	chrome.exe	77
PID 3796 wrote to memory of 4820	3796	chrome.exe	77
PID 3796 wrote to memory of 4820	3796	chrome.exe	77
PID 3796 wrote to memory of 4820	3796	chrome.exe	77
PID 3796 wrote to memory of 4820	3796	chrome.exe	77
PID 3796 wrote to memory of 4820	3796	chrome.exe	77
PID 3796 wrote to memory of 4820	3796	chrome.exe	77
PID 3796 wrote to memory of 4820	3796	chrome.exe	77

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://mega.nz/file/b7I0EaJJ#u55Ebo6aZKUup9GupKHs7PkS249E0cf4ildHDJzHrQo
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7fff3e309758,0x7fff3e309768,0x7fff3e309778
  2⤵
  PID:3756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1520 --field-trial-handle=1720,i,3347371648534921184,10030614382885850973,131072 /prefetch:2
  2⤵
  PID:4184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2012 --field-trial-handle=1720,i,3347371648534921184,10030614382885850973,131072 /prefetch:8
  2⤵
  PID:164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2032 --field-trial-handle=1720,i,3347371648534921184,10030614382885850973,131072 /prefetch:8
  2⤵
  PID:4820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2848 --field-trial-handle=1720,i,3347371648534921184,10030614382885850973,131072 /prefetch:1
  2⤵
  PID:804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2856 --field-trial-handle=1720,i,3347371648534921184,10030614382885850973,131072 /prefetch:1
  2⤵
  PID:4852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4956 --field-trial-handle=1720,i,3347371648534921184,10030614382885850973,131072 /prefetch:8
  2⤵
  PID:4884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4984 --field-trial-handle=1720,i,3347371648534921184,10030614382885850973,131072 /prefetch:8
  2⤵
  PID:4340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5168 --field-trial-handle=1720,i,3347371648534921184,10030614382885850973,131072 /prefetch:8
  2⤵
  PID:3124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4596 --field-trial-handle=1720,i,3347371648534921184,10030614382885850973,131072 /prefetch:8
  2⤵
  PID:2560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5260 --field-trial-handle=1720,i,3347371648534921184,10030614382885850973,131072 /prefetch:8
  2⤵
  PID:4324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4572 --field-trial-handle=1720,i,3347371648534921184,10030614382885850973,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5544 --field-trial-handle=1720,i,3347371648534921184,10030614382885850973,131072 /prefetch:8
  2⤵
  PID:3200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=2112 --field-trial-handle=1720,i,3347371648534921184,10030614382885850973,131072 /prefetch:1
  2⤵
  PID:4148

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:3164

C:\Windows\System32\SystemSettingsBroker.exe
C:\Windows\System32\SystemSettingsBroker.exe -Embedding
1⤵
PID:4744

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s RmSvc
1⤵
PID:4708

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s SstpSvc
1⤵
PID:4180

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s NetSetupSvc
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:700

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s RasMan
1⤵
PID:4132

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3f0
1⤵
PID:2180

C:\Windows\System32\SystemSettingsBroker.exe
C:\Windows\System32\SystemSettingsBroker.exe -Embedding
1⤵
PID:4208

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s RasMan
1⤵
PID:2900

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4888

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4368

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Kiwi X External\" -ad -an -ai#7zMap1244:92:7zEvent25687
1⤵
- Suspicious use of FindShellTrayWindow
PID:716

C:\Users\Admin\Desktop\Kiwi X External\Kiwi X External\Kiwi X External.exe
"C:\Users\Admin\Desktop\Kiwi X External\Kiwi X External\Kiwi X External.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
PID:4784

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3148

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
- NTFS ADS
PID:2908
- C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\windowsdesktop-runtime-7.0.20-win-x64.exe
  "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\windowsdesktop-runtime-7.0.20-win-x64.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5412
- - C:\Windows\Temp\{96E06BD3-1051-4AA8-AA98-3DE8967BFB68}\.cr\windowsdesktop-runtime-7.0.20-win-x64.exe
    "C:\Windows\Temp\{96E06BD3-1051-4AA8-AA98-3DE8967BFB68}\.cr\windowsdesktop-runtime-7.0.20-win-x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\windowsdesktop-runtime-7.0.20-win-x64.exe" -burn.filehandle.attached=544 -burn.filehandle.self=540
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:5448
  - - C:\Windows\Temp\{EB39EFDD-6DC9-4546-B8A7-7FBDBFB6A51D}\.be\windowsdesktop-runtime-7.0.20-win-x64.exe
      "C:\Windows\Temp\{EB39EFDD-6DC9-4546-B8A7-7FBDBFB6A51D}\.be\windowsdesktop-runtime-7.0.20-win-x64.exe" -q -burn.elevated BurnPipe.{96B266AE-E301-403E-B692-139EE412A205} {556EEFBA-4C2B-452C-8597-9EDD8A60C8B1} 5448
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:5772

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:1488

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3664

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:4988

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:432

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:5892
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 76CAD67B40A659E69D674C5B836EA6E0
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:6000
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 09D7CD7ACE381AF87DBB021AC8527CDB
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5168
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding A03D11E5A2177C4CE3E702492CD191AB
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5440
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 0F2104FC24F6DD3497CF4FF727593ADF
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5820

C:\Users\Admin\Desktop\Kiwi X External\Kiwi X External\Kiwi X External.exe
"C:\Users\Admin\Desktop\Kiwi X External\Kiwi X External\Kiwi X External.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:5532

C:\Users\Admin\Desktop\Kiwi X External\Kiwi X External\Kiwi X External.exe
"C:\Users\Admin\Desktop\Kiwi X External\Kiwi X External\Kiwi X External.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:5984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e5acb43.rbs

Filesize
47KB

MD5
006d341961d6c301a55ac31079fd9c17

SHA1
18eb037443156d04465b82b5b9584f1cdc814e2b

SHA256
879c840d65a258b9ddee51cd8283320a4f1be4e57b28cace5d8b2c2432cbf1a8

SHA512
b0cc4593c4594edeab6501a8b328f6bf32a8ab5b2eea891ad2e94ab739a894916aaf90cb8c4c008ba5d5e3a3cec8c83d19ac180a56a73b635432b7ba75f4e2e3

Download Submit
C:\Config.Msi\e5acb48.rbs

Filesize
8KB

MD5
00a75c943aa9fbb550ed20cc61a71281

SHA1
0e7c68bc635361dd935ae1dfc81cb7afcf25c782

SHA256
f9cb9f267051494eae988f1079c6c8ef9136e078ce2e24e664cd083223af4921

SHA512
6cbc1c004fde792958fa06ac7987722934a38601637da1738ba90da9b4aa4922b94432bbaea36386e2aeffa762eaaa9b2acce9707025f759c072fad03a1eea13

Download Submit
C:\Config.Msi\e5acb4d.rbs

Filesize
9KB

MD5
05bbdc698feacfe050d3949c16aac513

SHA1
b521ebc312f760420e0a9f5cca19674e07a2cd27

SHA256
d62ea7ef3ee2a377f807855b27b87ecaa9c91b8d35d5f898811388c3791cdad4

SHA512
c49ca08f533384c9d04551093711504bfb27d69a717c746a3b6afa46d44b8c084998d2fe00d062f682dc00942a46a50eb8451cd701c43517aaf31c8619cdc0ce

Download Submit
C:\Config.Msi\e5acb52.rbs

Filesize
87KB

MD5
5726feec02437490eae58f3f9ebe581b

SHA1
2b79e557712e325fd5ab340c03f1259381387593

SHA256
e2cf21c200584cbde3bad025517c2a0cac350de46f083162aa8f34fdd1e52d90

SHA512
64824c695df87c07b9719980e91c4e2ee570b26ea40f3ac6a04f3d573572cba2b895872a10b774b68eeb3630d2b2200505a09c9146eff4b3da2d3d0aa79bb1ce

Download Submit
C:\Program Files\dotnet\LICENSE.txt

Filesize
9KB

MD5
31c5a77b3c57c8c2e82b9541b00bcd5a

SHA1
153d4bc14e3a2c1485006f1752e797ca8684d06d

SHA256
7f6839a61ce892b79c6549e2dc5a81fdbd240a0b260f8881216b45b7fda8b45d

SHA512
ad33e3c0c3b060ad44c5b1b712c991b2d7042f6a60dc691c014d977c922a7e3a783ba9bade1a34de853c271fde1fb75bc2c47869acd863a40be3a6c6d754c0a6

Download Submit
C:\Program Files\dotnet\ThirdPartyNotices.txt

Filesize
85KB

MD5
5c13a5ea8c8cc3474240981d0ffa88ff

SHA1
1d8d3ce27d9dc3d9fb4fa4b06c20137d25879d80

SHA256
4f9bb3901879bafae3a17c6c4009ee5c15384a06fc234bed78937969079c77da

SHA512
32ea79ff5194d8a18e75f277aed5610b4955db15b0abbcc2664cf07f372bebfc57eb665ad078dc3da3ce5ee0d8856140c2a1bc7032b578dd103d43998d682d88

Download Submit
C:\Program Files\dotnet\host\fxr\7.0.20\hostfxr.dll

Filesize
378KB

MD5
658c4d6d2a9fdfcfd9da21a1f532c711

SHA1
29869d4c8282c18c745fdfd3f2e14804d2018bb8

SHA256
5cd7807feecd903f525342d4a21ee2749c4519f17d5293a9e5fc8cffb32347b5

SHA512
6430e74cf8a9324df9321974584f63d66c8e24187885bc221041378a5b5ea8fbfd59277fac7aa99fb8b5bba8f7d975b71803ef57ea8e358cbbc825798cfddf31

Download Submit
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.20\Microsoft.NETCore.App.deps.json

Filesize
28KB

MD5
98893a0056aee4a857c1b0eead2475c8

SHA1
10234f2fa61f8231cdde01101f5e1754810181cb

SHA256
0447fe5028c28cfdd15d4aecca0849dcac2a2d6c44c6c20795cba1ac887a09fa

SHA512
d87b93e91acdc078bd98c2968a1f924a4b749b2e1cb92a1e35443da90b15b2044ac8c6630b33254ec789255c37d3325a95ca2a62a7c128c36913fc254ac1b56a

Download Submit
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.20\Microsoft.NETCore.App.runtimeconfig.json

Filesize
159B

MD5
01da0d56ab33c0ed0e7ac85e5244190f

SHA1
9e1e4b59e590038f769e5fa01fb326109a7f38e5

SHA256
7133274dc5efab688a6efe2f43ca33e78a2498ef39efcad231b0e07ad2c26d17

SHA512
e11967ba33c719da1681a7f98056d40f450788d9b7c8b2f580d8bc7998fc35a78c53fc970301b097c527fab79fd477adad4eafcd75b4bb376d33c3fece9e8926

Download Submit
C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.20\Microsoft.WindowsDesktop.App.deps.json

Filesize
30KB

MD5
1da5f32803350026bee1fd7abaa8b2f2

SHA1
eafb21bb5024f023b8946c1a97dcfe4712a48a86

SHA256
8b75798380c9b7b577d0ebb961af1cd4369477a583e53d8086ce52c8b08a9135

SHA512
317990ea324b6df4a45f9fb1d3ea1f5e104c751de96945df6550977e3c4970cbae4fa3eecc26cec2936c44474a929e7269fd917780c75fb7aff21755799ffa97

Download Submit
C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.20\Microsoft.WindowsDesktop.App.runtimeconfig.json

Filesize
289B

MD5
485ab30a279fa350bb02a1ac38128d88

SHA1
7a04ab154e9793779106d8ead0789dc66f9a6dc2

SHA256
1624dfc43a3694a49c3293184fa9a989a7f709c16ffbefd38ca7cfb85178b8f3

SHA512
f6366b059136b50610a550e6c9a586cc1421c84ac3a2465a83fc46d16fc166b5e96d46fc3f17473aaa95023bd597676f2aafe4aeac2199e65467cbbc3801971a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
5515e450f4c7d29aca6d38c5b9fde9bc

SHA1
c524b298df8b1c16d8e0e38d381ad6f828025dc4

SHA256
94e0f136402d3a8eafa75b723e977a1b960bfb98fe9340141895c270bdf87ee8

SHA512
69827d72a134efeb9e3a41acdb964aa35cdf31bad23a741dcafb40fbddc28c364afb4f559e37ccf9bdb063d15f98c9dc678c4af29af7df919ad55f450242e581

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\File System\000\t\Paths\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
769B

MD5
7503e00c86ce172192a0957d217a363c

SHA1
0a5011cfccad967a00f2031c5c0b86da98399b84

SHA256
1e60b1724831d521778d2b50082ceb288601f9a4bef4b35f81a594306edb3dc7

SHA512
86f407aab2589cfc6737d7d3f2cd7205de979392f73cda790ad07f34c02de6b1b97b0dc52da63b46a170dfd22c95ddc0d16a3465b0f0a47a69798b48a8615207

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
538B

MD5
97bb79413e8277683da8fa1ec60e8577

SHA1
3d6c54ac3386715174c2648f0fc9fb4dcdd6617a

SHA256
69ffaf89e966f5db2b029e67048d58fe5b0f7a9932e5fcaf1da217488e340aa9

SHA512
6f9dd26d89306aae5b5b8695ed4230be649bd79f2e74bb1a1108ea2331267caaf924782d37a38d03221065d0e35d4b1b04c326e69955fcc0cabfdb690eaa64a0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
7fabb3c2acc8ea7f3ecf2aa30c2e9474

SHA1
696adcde89c2f32c746e4c02fdbee4c602618214

SHA256
9863e4c03af68b1ed0bdb484bf54513648738bebe8c000dd837e7bb9c451f9d9

SHA512
e0ca3eb5a67bb5199f5b1c0245daafc3a466aeee9fe8d4c57ffd16f11be7fd9b2b704d8694878e9bca3e753caa2bb77512ce32ef5b6d3b53da79268750bd645a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
39e0c9dfc35acde3f2a514f487b034b1

SHA1
84c9cca97dbc404e863824c86df474eacd1ccca3

SHA256
2fe38649fc0b2e8f42562be74f05ed8880011999e6291155c3a2eb6f98aa9f5b

SHA512
0d5a37ba1b917e582900c1b31a4bdc648fcab74ed2fbec7f17020ddcf7ef62da099287aa72a5606075699816d87f3abb9459d704f81a64a228451ad78ed81be3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
fa2fd08de4c01856266e7826b86c57d2

SHA1
be2d8ba59c6d50affc846f6962a3d4d0cfaea15a

SHA256
afe0fa49861d6ff9e06546bb33a423989c8620b212a1b1bddcdca3c070b07fcb

SHA512
7cb9c1b86834d83846a5b53ba5092a7556daaf6efb8b69cd08464022ba6044b2c049e7725557513d04ffcab99638f5aaa338740f05eff2a38e52a1a978f1459c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
c6e99e52d8a488cc2c57aeb9b959b8e5

SHA1
8b2295fbc27f0afc1e5772f4dd5ad6601310b580

SHA256
8e94c3224355be9dacbbec206657a6f0d4fbd97d4d09ec50b95fa27f671b7921

SHA512
eb665dbabe02cc32bd2c39b5943ed379a79be8943fe965a63dad5fcdd278e048c591815f99344174ef0b26c5f0d836193bae4eb67fc20451ac426304ea930224

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
1e21e54505367de68429b6191630b4ed

SHA1
9cf8886c4b6928b5abf7f529636d0576c76930bd

SHA256
d0b5296ff60dcca04bbd07c6624cc4993557d844112e867642d0bc94bf08fabb

SHA512
4f4e69c8340c03d1a128fa436cef581fdd7889a63d8de31754a0577102abf9bf3e386fafef7b19270eedbbe9b1b699c023072b8d5b77de162ecd0c8407f57be4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
a9769787841892a9284d5f1f37669d45

SHA1
3d5c134701ea0f23c74e5da4fd4baa849bf03de3

SHA256
8fe282e777e6d11199d60cb7c08033f918a12cef8e6fedd2872b3e78a70dd94b

SHA512
32f44e91543982b0947338eadb5802c6330698d7c2e27349b3175722251e2004f5f0aa7fe591dc85a7768235eefe2b3be96afa5f891a207c5362a87656b9ae0f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
898cfac530ba805d291c253cc0db2e0b

SHA1
d5c5fc86e5a31acbba068a1fd51094641dc2bff2

SHA256
684b33bba2529f676d0a7c4bbf4b47ebe5629d9e42d4023998d956b36bc9611f

SHA512
25b7c5db79ecfe1e569b1e5a665fdeb3ea76439091bde813b2252342606b1acf65d8e003e84b0bbe44ac0a5b64f1cc84e0ce67158c1b9c4828f16149a8366c6a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
571746e829b5b5ae2f902e4a7d9cde7c

SHA1
55ff4dd469c2aaf1c09d9638f04081cd59a441ac

SHA256
70718a3966da2b1d4880a794426d52637e4ab952dbea1b74075b94375765f4ce

SHA512
5001a26a81059046a7c1b83e51067f3c443bad82da93f749bc9d3ed6169d5908143cedd7cfc5d0a21dbf7303f9268d1ec4d2bc90a1c1401af152e3248517f52a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
7d26ad52161b7a43b4ed3e6c4e2bca9d

SHA1
862be8306fab695667a852a2dfb3959751ddd892

SHA256
22840dd685362cf2165fead72a687d40c6f8044db1c72a0e6b1191ba4a6a655d

SHA512
85e2264e76ffb3279d652f31d559c1cf9cd28974e5866a81b5a10ed0af301d49cd3b2b4988a1d0dcb698eda5569d9337f8b8949213e76a8a03d630e9fd97f5fb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe582a38.TMP

Filesize
48B

MD5
21d6cdb1721b60e854f334ff6a9f28f6

SHA1
34926d4f41ef98001e2e7399164f55e4ef5f4378

SHA256
b2ccc6f59b0a90967cda4550f72b0aff076f702bde6a3ff5b5643e439991ed7a

SHA512
3c185fbd79c894e7a459279648d81cf59dff96ed885f81a5ddf7e683899beb611ed19acd57b6b86178be08d6860a6307c9f10a8566872f2c8fc3f280635a4876

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
136KB

MD5
8fd387f470b77f2377f57d797bec2861

SHA1
a0987bc5edbeb8dfef38075b503229c566a03975

SHA256
7ca2c019d608c11fddac9aded90e986707d1e82fb19f9bb301908e8444d6d73f

SHA512
19fea4fa81c5b03ddcdb131a3b64891dc626cbedca97900eeb8e1ba471eb25ea9a2b87c42bc8c7015eba704d5e818ec530fd185a2ac24cddcfed6a83b5101f48

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
136KB

MD5
bc45cd8fa5f40deee7d78774b8eb587d

SHA1
04be4a5ef3eb8863d1b21e10c1f7f84187235f53

SHA256
c5cf9d1cddde282add9d688aa5eb9237acf53796c1db58a5660cea362a2c8a67

SHA512
b8267b489a634319ef66112e855e3b3e8f71b6341efd9ffeb57d86c5e87a3fd5715acd12dce39aab575093ca7ca22e8818b743fb14895be97f50994e7c1813db

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
105KB

MD5
aed9d8c4a8c5798e65c5446af0fd76f6

SHA1
fec9ec2146e7df354da9e6498e9b1e8c84560d6d

SHA256
1bd02b8448f370058b8b272d09f68f853502edbc9297f0d2c57257ea6b2db537

SHA512
da73389b5382279e29c00c8ec9b15e2b330406108d1fc45cab1b3575b502c323542f78e9fd26837e6a5f3e59d0907e426cc7762f5b0b4dcb3fdfc0b0e2b1fcab

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
109KB

MD5
df8da03723812c33efd41ba586dbb245

SHA1
568c6c69b9bf9e0bccad0e3416d8ba9c3833164f

SHA256
6a6e781b9a8e341bf53327eba62ad2029db13c86f18586228c7c91f616a09ca0

SHA512
afc823ef1a6db1764b61255224bb82fcbe25b90daaca88cf3b187b51576e2de582275e41f22822eb05584b90cc868273760a5a7f48c19a231e4e60162817e812

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe592b6b.TMP

Filesize
97KB

MD5
14a60b3c80e1da555dce1b0cb1c4c948

SHA1
85af749542245c941e32e8bbfe81667f55b23930

SHA256
017f359cd00ec156d3c1d1690205d8a1cbbf5739645d05b63cdb475ef5fb0a33

SHA512
2ebb15a74370d4d04c0c4c3cef2e270e3aa3887e91f43d6b2b139493cb265bcfbab2c18aebeddb9a906c8376c90e5437d33d1e831a603d20b851bb5ff869d2ef

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\L5P12AEX\edgecompatviewlist[1].xml

Filesize
74KB

MD5
d4fc49dc14f63895d997fa4940f24378

SHA1
3efb1437a7c5e46034147cbbc8db017c69d02c31

SHA256
853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1

SHA512
cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\2KP844GJ\dotnet.microsoft[1].xml

Filesize
13B

MD5
c1ddea3ef6bbef3e7060a1a9ad89e4c5

SHA1
35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

SHA256
b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

SHA512
6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\2KP844GJ\dotnet.microsoft[1].xml

Filesize
84B

MD5
8cef5b7b5aa87dd8c69f797fa75b25d6

SHA1
9568403f39aaf184215cde0404b09a827d33868b

SHA256
9f4d81e3173b4c4dbceaeb9b4103ead9d9035c54453bbec3737dbb02f323a586

SHA512
fc64b65401039c9952919044808220619f176a82e75222c7eea205a8f8d4d946aa32befc2e03617d5e5362b9a420917567d83de3a96509fe7ce5314f8f55e160

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\9BG24Q1V\windowsdesktop-runtime-7.0.20-win-x64[1].exe

Filesize
32KB

MD5
f95b07e77624be09213c3402f0912792

SHA1
ff040484be69ee1742deca0a1b127024025213df

SHA256
6fc91217f9396ccb9fbad9feb6328a6f12e305705775a528a4f011d17bb5cb62

SHA512
4e829a689c8bef50a3173cc04cedc327f9f6a7304b6e384147f5c1ca438e8e1747586fd7ab0ba248bbc347b6223bc9aab01e58795fc5cdb15bbbb8fa92b85876

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_7.0.20_(x64)_20240807093714_000_dotnet_runtime_7.0.20_win_x64.msi.log

Filesize
2KB

MD5
26da36b14de4ddf505ebde2b9dd91257

SHA1
a595fc1950aaedf35e0612c707f21b27c7d34989

SHA256
5592895d5ea102df43683dd19e9787158bdfba56ee2f9f25abf110089f41c253

SHA512
ca5661c550a3816f87b138893084c90930ab72a1043a7cfa9f089ce4d9e4043243ad18becc50fcfd32bf732322231a28e9e6823f639498e4a6efc96733e9b3d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_7.0.20_(x64)_20240807093714_001_dotnet_hostfxr_7.0.20_win_x64.msi.log

Filesize
2KB

MD5
d25932c649778466b7d84e22f76b294e

SHA1
9be8f1e532cac1cde30a00568b7a7ec9566a8acf

SHA256
967cfec1ded24e2d7982169940915f6bdc0fe813a3810d898296438abce8562d

SHA512
d5f8059d2b967cd5342e55bd523cf89b7911f19818ca09438f06f1850f63ef9037bc2982a6d00617a8e223489f3679c4ae17c09d14e6e978e50ed0117eef2529

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_7.0.20_(x64)_20240807093714_002_dotnet_host_7.0.20_win_x64.msi.log

Filesize
2KB

MD5
6de98ffd3c4f4493284beb059eb8b2ec

SHA1
7f8550f791162e1b3f8acc0be1d745a90123cf23

SHA256
59edc71e5ad5cd8271c3e2a84802063a302de392c2562ab366208199c6130f3c

SHA512
7389f6f4cff4ce8335f37caa5d857da18d7aa0764c26fba5851440b69f6d22259481b00362c27d7a6556e9488eb93b9738f37454165b49f42c4b979a71c72e7b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_7.0.20_(x64)_20240807093714_003_windowsdesktop_runtime_7.0.20_win_x64.msi.log

Filesize
2KB

MD5
e6cd598f9f3c7560962263d656cb1a2f

SHA1
523a3a61533bd640494cb8b94f546ed9cc0aed69

SHA256
4b1c27b5bf4d0cea570fb3eb78921c775ecf2b959467fa0cec20c456e3134196

SHA512
b283626f3f31bef5305008f6af2f0512789479fff58bc76057abfa049aa70e7373621bf3a5135228079acb8bd319028667c4e0186429691abf708cd8854ab95c

Download Submit
C:\Users\Admin\Desktop\Kiwi X External\Kiwi X External\Kiwi X External.deps.json

Filesize
66KB

MD5
aa0cdeb226722173e5fa3ea4cccc78f3

SHA1
6a5ad8a3f7a465889ec63bfa8fced4cca5b909a7

SHA256
b6ebddb855d50861a1ae0b7c5c2981a610328743da28c876f8da1268a711432c

SHA512
1f49fb6f37eee008d2adadaada2bc854b3f1a0985f8db345b08b9f7e88a2a469b9d09dd8ce31c2098850fad28fa109f7866232564548f0c99a67b8e8b835a97e

Download Submit
C:\Users\Admin\Desktop\Kiwi X External\Kiwi X External\Kiwi X External.exe

Filesize
321KB

MD5
9fef2a301edbcd80a74670f54a88e41b

SHA1
eb7a5845b2998217f8ebd4ecec4ba554d3edb757

SHA256
02ad64a9b7a3e99337b59f54563082fbc48b26cb796fbe1cd834ce185fd63381

SHA512
afb5badae34091bf88b5e97a1742385cb7ff4839f514ada697da00ea186ee0a9e35c53edcddcabda2a7f4d0cec4e2e53ec897033ec1856c05238efda07fc05c9

Download Submit
C:\Users\Admin\Desktop\Kiwi X External\Kiwi X External\Kiwi X External.runtimeconfig.json

Filesize
266B

MD5
d8ae75ee64991f91ddf5fa2c72adcc7c

SHA1
c8318862e3f8051daed02b9d764e7468cbe4bf86

SHA256
6a9ae797b520e700bcb418aa36e945f22d27c86b3aebb393cb7c4462d52e76da

SHA512
8907e87ce5c582ada4d391009b015ea9878c3f788a15f327dc7bf147e8a4ac80258e0541f1f35f3e00cb29dfbd55839908595a6941920d68bf7cb8bfdffb4998

Download Submit
C:\Users\Admin\Downloads\Kiwi X External.rar

Filesize
29.0MB

MD5
ba68550acc0bf384b9609aa9a91cb7dd

SHA1
01975c0c95617d3e6d64ff33292752e3c4b88c1a

SHA256
8c5a3980b7ef503abc0c99d57a01d346cfcd4af36ecccb68fbd0019ace26bc00

SHA512
425b6bb611183a6da1a92cc89217cc541db6db7028f2a1ac0ee31dd3b9f78f55139576437fb80e511d5359ab1d43cd604dc9efa7a48f73bfad2b0c7f10e52b20

Download Submit
C:\Windows\INF\netrasa.PNF

Filesize
22KB

MD5
80648b43d233468718d717d10187b68d

SHA1
a1736e8f0e408ce705722ce097d1adb24ebffc45

SHA256
8ab9a39457507e405ade5ef9d723e0f89bc46d8d8b33d354b00d95847f098380

SHA512
eec0ac7e7abcf87b3f0f4522b0dd95c658327afb866ceecff3c9ff0812a521201d729dd71d43f3ac46536f8435d4a49ac157b6282077c7c1940a6668f3b3aea9

Download Submit
C:\Windows\Installer\MSID0AF.tmp

Filesize
244KB

MD5
60e8c139e673b9eb49dc83718278bc88

SHA1
00a3a9cd6d3a9f52628ea09c2e645fe56ee7cd56

SHA256
b181b6b4d69a53143a97a306919ba1adbc0b036a48b6d1d41ae7a01e8ef286cb

SHA512
ac7cb86dbf3b86f00da7b8a246a6c7ef65a6f1c8705ea07f9b90e494b6239fb9626b55ee872a9b7f16575a60c82e767af228b8f018d4d7b9f783efaccca2b103

Download Submit
C:\Windows\Temp\{96E06BD3-1051-4AA8-AA98-3DE8967BFB68}\.cr\windowsdesktop-runtime-7.0.20-win-x64.exe

Filesize
635KB

MD5
3655d3156717ba40cfb9e1496d5b20db

SHA1
ae23b6b7b047cecc69d8b097326a11ad3f4fd716

SHA256
eb4b8a3b8d088dbbe0169f5a2598fee4589486474d902c504965e2126900c189

SHA512
0211f9fe9672f56bcd20f242f9450d4c51bd4d7ddcafbfd502106751d83fa958780c0037737f103554844ae81af3ecb43f489bf1c09d65077e93fbec7ef5ad1d

Download Submit
C:\Windows\Temp\{EB39EFDD-6DC9-4546-B8A7-7FBDBFB6A51D}\.ba\bg.png

Filesize
4KB

MD5
9eb0320dfbf2bd541e6a55c01ddc9f20

SHA1
eb282a66d29594346531b1ff886d455e1dcd6d99

SHA256
9095bf7b6baa0107b40a4a6d727215be077133a190f4ca9bd89a176842141e79

SHA512
9ada3a1757a493fbb004bd767fab8f77430af69d71479f340b8b8ede904cc94cd733700db593a4a2d2e1184c0081fd0648318d867128e1cb461021314990931d

Download Submit
C:\Windows\Temp\{EB39EFDD-6DC9-4546-B8A7-7FBDBFB6A51D}\dotnet_host_7.0.20_win_x64.msi

Filesize
796KB

MD5
9f40e8a9da0e56bd2472d6f376c9c3c3

SHA1
4b9e5385563cca4ed9af1701565745ec4e0fb13e

SHA256
223c31101de61725874708d0f33a67c05b24335f50f577ceeb970c14074be9ce

SHA512
f4cb80af5f4deb184217dce977d1960e67ea5cc54e4e2c4024ad542b19d66afa6dc2b584e07c30b3a2242d201e563260dc1a2bfde155e96d9ef52fc0e3be3bac

Download Submit
C:\Windows\Temp\{EB39EFDD-6DC9-4546-B8A7-7FBDBFB6A51D}\dotnet_hostfxr_7.0.20_win_x64.msi

Filesize
856KB

MD5
d13eaa78c61f3e42dc2f074c0a1030a3

SHA1
fe1f8e2f4cc7180cfbd6be5cc4d1fcef8be3436d

SHA256
235e877472b2418e67862a9701a2f4f7060d039f4dc3680b42b7392608a4593f

SHA512
1261715d375c497cde320979bead6261d3f88e8b0737793febdfc051044a8a5276638e58c24657adcacf2f2a2f9741fd4e901c8b98a8d7afdabb080298ecfad8

Download Submit
C:\Windows\Temp\{EB39EFDD-6DC9-4546-B8A7-7FBDBFB6A51D}\dotnet_runtime_7.0.20_win_x64.msi

Filesize
26.0MB

MD5
dbb5cb3d7ddfd75d4f9df01aff0dbd2a

SHA1
3439b45e02ea5a682672df8e90bbb82595830173

SHA256
5749e12a7e95b038ff65d3c7da439b8c8e2ab2e6cc0183a1cca91f7c74ffbf52

SHA512
0404f0425ebee045f1990be11f21cfe6ad0a01f9f8467b8aff02b2253b015f914b62894879e295f2cc23d4a2213d549df54436b462ad4ea24402041b9598e3c6

Download Submit
C:\Windows\Temp\{EB39EFDD-6DC9-4546-B8A7-7FBDBFB6A51D}\windowsdesktop_runtime_7.0.20_win_x64.msi

Filesize
28.8MB

MD5
61f2d7fb63eeaffcf8f73825c8c6cf41

SHA1
3d7481dc7d1c6e803ac9825a753c8bf6b18a4923

SHA256
7168a15851151d448addbc9625ae40521867bd7418a43b00a9a881ac1a549331

SHA512
2fa7f974c767f7103ab9288c71eba6793f9d515bdded62d49d7007e396b03869444b920d523589c337659e75c2c123ba1cc62dc97bef4da250b15f2cee1ea398

Download Submit
\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.20\coreclr.dll

Filesize
4.9MB

MD5
aa7365b63e008601ffcdc05fd8306627

SHA1
fe282e0689459874e53b19c5fbf5205d1259c7cb

SHA256
10f7dd4adbd081b5968a3e0ad82b331fb780db07f41915cd2d6ca589753eb15e

SHA512
7191aaf5357d431bd49c28b263c6984ee894f6eb96e3bbedac7fcbf3a16d823d7076731d3b9fe5fb0d55961783667db074d95a570713a03d378590ba8f990571

Download Submit
\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.20\hostpolicy.dll

Filesize
387KB

MD5
e18c23073f0a61c6ffe6892e0ae52411

SHA1
5ca2688e1f3bb5ca17a8dcb81b20f6256f83bc75

SHA256
e3b27cc06af208db594a9c9d6bdc2f913cb543cd4d49c8e0aa14e3c6aeb345d4

SHA512
af814680dfeaa49bedef2158b7bf4f8c009e7d0be526f65a27b7a6ab27284ad5c8e30a6a536f8efc4d5088b1b288e4de482492204c9fd49d6763f6df97e7d981

Download Submit
\Windows\Temp\{EB39EFDD-6DC9-4546-B8A7-7FBDBFB6A51D}\.ba\wixstdba.dll

Filesize
215KB

MD5
f68f43f809840328f4e993a54b0d5e62

SHA1
01da48ce6c81df4835b4c2eca7e1d447be893d39

SHA256
e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e

SHA512
a7a799ecf1784fb5e8cd7191bf78b510ff5b07db07363388d7b32ed21f4fddc09e34d1160113395f728c0f4e57d13768a0350dbdb207d9224337d2153dc791e1

Download Submit
memory/3148-368-0x0000015DB8B30000-0x0000015DB8B40000-memory.dmp

Filesize
64KB

Download
memory/3148-351-0x0000015DB8A20000-0x0000015DB8A30000-memory.dmp

Filesize
64KB

Download
memory/3148-386-0x0000015DBCCD0000-0x0000015DBCCD2000-memory.dmp

Filesize
8KB

Download
memory/3664-405-0x000001A00F120000-0x000001A00F220000-memory.dmp

Filesize
1024KB

Download
memory/4988-650-0x00000216579C0000-0x00000216579E0000-memory.dmp

Filesize
128KB

Download
memory/4988-670-0x0000021651330000-0x0000021651332000-memory.dmp

Filesize
8KB

Download
memory/4988-422-0x000002163FD90000-0x000002163FD92000-memory.dmp

Filesize
8KB

Download
memory/4988-420-0x000002163FD60000-0x000002163FD62000-memory.dmp

Filesize
8KB

Download
memory/4988-535-0x0000021656390000-0x0000021656392000-memory.dmp

Filesize
8KB

Download
memory/4988-539-0x00000216563C0000-0x00000216563C2000-memory.dmp

Filesize
8KB

Download
memory/4988-424-0x0000021640500000-0x0000021640600000-memory.dmp

Filesize
1024KB

Download
memory/4988-417-0x000002163FD10000-0x000002163FD12000-memory.dmp

Filesize
8KB

Download
memory/4988-537-0x00000216563A0000-0x00000216563A2000-memory.dmp

Filesize
8KB

Download
memory/4988-652-0x00000216579C0000-0x00000216579E0000-memory.dmp

Filesize
128KB

Download
memory/4988-531-0x0000021656350000-0x0000021656352000-memory.dmp

Filesize
8KB

Download
memory/4988-688-0x0000021655FE0000-0x0000021655FE2000-memory.dmp

Filesize
8KB

Download
memory/4988-533-0x0000021656370000-0x0000021656372000-memory.dmp

Filesize
8KB

Download
memory/4988-608-0x00000216515D0000-0x00000216516D0000-memory.dmp

Filesize
1024KB

Download
memory/4988-573-0x0000021640500000-0x0000021640600000-memory.dmp

Filesize
1024KB

Download
memory/4988-529-0x0000021656330000-0x0000021656332000-memory.dmp

Filesize
8KB

Download