hxxps://drive[.]google[.]com/file/d/1Z14Es76qIsHHLaUBOfBPTsjRdOwYfXr9/view?pli=1

Analysis

max time kernel
287s
max time network
289s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
12-08-2024 19:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1Z14Es76qIsHHLaUBOfBPTsjRdOwYfXr9/view?pli=1

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	Winword.exe
File created	C:\Windows\System32\drivers\etc\~$hosts	Winword.exe

Executes dropped EXE 2 IoCs

pid	Process
796	Launcher_Setup.exe
4564	Launcher_Setup.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
1	drive.google.com
4	drive.google.com

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 796 set thread context of 908	796	Launcher_Setup.exe	103
PID 4564 set thread context of 3508	4564	Launcher_Setup.exe	109

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BitLockerToGo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BitLockerToGo.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	Taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	Taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	Taskmgr.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	Winword.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Winword.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Winword.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	Winword.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	Winword.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	Winword.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\14\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\Shell\SniffedFolderType = "Generic"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202020202020202020202	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\14\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\14\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\14\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\14\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "48"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "4294967295"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202020202020202020202	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\2\NodeSlot = "14"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\14\Shell\SniffedFolderType = "Generic"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\14\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\14\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\14\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\Shell	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac04000000c8000000354b179bff40d211a27e00c04fc308710300000080000000354b179bff40d211a27e00c04fc308710200000080000000	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\14\Shell	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\14\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\Shell	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "2"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\14\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\Shell\SniffedFolderType = "Generic"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\2 = 8c0031000000000002596e81110050524f4752417e310000740009000400efbec55259610c59e39c2e0000003f0000000000010000000000000000004a00000000008dba3e00500072006f006700720061006d002000460069006c0065007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370038003100000018000000	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\14\ComDlg	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	OpenWith.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Launcher_Version24.zip:Zone.Identifier	msedge.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
788	Winword.exe
788	Winword.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
704	msedge.exe
704	msedge.exe
2424	msedge.exe
2424	msedge.exe
3768	msedge.exe
3768	msedge.exe
4612	identity_helper.exe
4612	identity_helper.exe
3120	msedge.exe
3120	msedge.exe
5044	Taskmgr.exe
5044	Taskmgr.exe
5044	Taskmgr.exe
5044	Taskmgr.exe
5044	Taskmgr.exe
5044	Taskmgr.exe
5044	Taskmgr.exe
5044	Taskmgr.exe
5044	Taskmgr.exe
5044	Taskmgr.exe
5044	Taskmgr.exe
5044	Taskmgr.exe
5044	Taskmgr.exe
5044	Taskmgr.exe
5044	Taskmgr.exe
5044	Taskmgr.exe
5044	Taskmgr.exe
5044	Taskmgr.exe
5044	Taskmgr.exe
5044	Taskmgr.exe
5044	Taskmgr.exe
5044	Taskmgr.exe
5044	Taskmgr.exe
5044	Taskmgr.exe
5044	Taskmgr.exe
5044	Taskmgr.exe
5044	Taskmgr.exe
5044	Taskmgr.exe
5044	Taskmgr.exe
5044	Taskmgr.exe
5044	Taskmgr.exe
5044	Taskmgr.exe
5044	Taskmgr.exe
5044	Taskmgr.exe
5044	Taskmgr.exe
5044	Taskmgr.exe
5044	Taskmgr.exe
5044	Taskmgr.exe
5044	Taskmgr.exe
5044	Taskmgr.exe
5044	Taskmgr.exe
5044	Taskmgr.exe
5044	Taskmgr.exe
5044	Taskmgr.exe
5044	Taskmgr.exe
5044	Taskmgr.exe
5044	Taskmgr.exe
5044	Taskmgr.exe
5044	Taskmgr.exe
5044	Taskmgr.exe
5044	Taskmgr.exe
5044	Taskmgr.exe
5044	Taskmgr.exe
5044	Taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
5044	Taskmgr.exe
2180	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeRestorePrivilege	3192	7zG.exe
Token: 35	3192	7zG.exe
Token: SeSecurityPrivilege	3192	7zG.exe
Token: SeSecurityPrivilege	3192	7zG.exe
Token: SeDebugPrivilege	5044	Taskmgr.exe
Token: SeSystemProfilePrivilege	5044	Taskmgr.exe
Token: SeCreateGlobalPrivilege	5044	Taskmgr.exe
Token: 33	5044	Taskmgr.exe
Token: SeIncBasePriorityPrivilege	5044	Taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
3192	7zG.exe
5044	Taskmgr.exe
5044	Taskmgr.exe
5044	Taskmgr.exe
5044	Taskmgr.exe
5044	Taskmgr.exe
5044	Taskmgr.exe
5044	Taskmgr.exe
5044	Taskmgr.exe
5044	Taskmgr.exe
5044	Taskmgr.exe
5044	Taskmgr.exe
5044	Taskmgr.exe
5044	Taskmgr.exe
5044	Taskmgr.exe
5044	Taskmgr.exe
5044	Taskmgr.exe
5044	Taskmgr.exe
5044	Taskmgr.exe
5044	Taskmgr.exe
5044	Taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
5044	Taskmgr.exe
5044	Taskmgr.exe
5044	Taskmgr.exe
5044	Taskmgr.exe
5044	Taskmgr.exe
5044	Taskmgr.exe
5044	Taskmgr.exe
5044	Taskmgr.exe
5044	Taskmgr.exe
5044	Taskmgr.exe
5044	Taskmgr.exe
5044	Taskmgr.exe
5044	Taskmgr.exe
5044	Taskmgr.exe
5044	Taskmgr.exe
5044	Taskmgr.exe
5044	Taskmgr.exe
5044	Taskmgr.exe
5044	Taskmgr.exe
5044	Taskmgr.exe
5044	Taskmgr.exe
5044	Taskmgr.exe
5044	Taskmgr.exe
5044	Taskmgr.exe
5044	Taskmgr.exe
5044	Taskmgr.exe
5044	Taskmgr.exe
5044	Taskmgr.exe
5044	Taskmgr.exe
5044	Taskmgr.exe
5044	Taskmgr.exe
5044	Taskmgr.exe
5044	Taskmgr.exe
5044	Taskmgr.exe
5044	Taskmgr.exe
5044	Taskmgr.exe
5044	Taskmgr.exe
5044	Taskmgr.exe
5044	Taskmgr.exe
5044	Taskmgr.exe
5044	Taskmgr.exe
5044	Taskmgr.exe
5044	Taskmgr.exe
5044	Taskmgr.exe
5044	Taskmgr.exe
5044	Taskmgr.exe
5044	Taskmgr.exe
5044	Taskmgr.exe
5044	Taskmgr.exe
5044	Taskmgr.exe
5044	Taskmgr.exe
5044	Taskmgr.exe

Suspicious use of SetWindowsHookEx 36 IoCs

pid	Process
2180	OpenWith.exe
2180	OpenWith.exe
2180	OpenWith.exe
2180	OpenWith.exe
2180	OpenWith.exe
2180	OpenWith.exe
2180	OpenWith.exe
2180	OpenWith.exe
2180	OpenWith.exe
2180	OpenWith.exe
2180	OpenWith.exe
2180	OpenWith.exe
2180	OpenWith.exe
2180	OpenWith.exe
2180	OpenWith.exe
2180	OpenWith.exe
4064	OpenWith.exe
4064	OpenWith.exe
4064	OpenWith.exe
4064	OpenWith.exe
4064	OpenWith.exe
4064	OpenWith.exe
4064	OpenWith.exe
4064	OpenWith.exe
4064	OpenWith.exe
4064	OpenWith.exe
4064	OpenWith.exe
4064	OpenWith.exe
4064	OpenWith.exe
788	Winword.exe
788	Winword.exe
788	Winword.exe
788	Winword.exe
788	Winword.exe
788	Winword.exe
788	Winword.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2424 wrote to memory of 716	2424	msedge.exe	78
PID 2424 wrote to memory of 716	2424	msedge.exe	78
PID 2424 wrote to memory of 3340	2424	msedge.exe	79
PID 2424 wrote to memory of 3340	2424	msedge.exe	79
PID 2424 wrote to memory of 3340	2424	msedge.exe	79
PID 2424 wrote to memory of 3340	2424	msedge.exe	79
PID 2424 wrote to memory of 3340	2424	msedge.exe	79
PID 2424 wrote to memory of 3340	2424	msedge.exe	79
PID 2424 wrote to memory of 3340	2424	msedge.exe	79
PID 2424 wrote to memory of 3340	2424	msedge.exe	79
PID 2424 wrote to memory of 3340	2424	msedge.exe	79
PID 2424 wrote to memory of 3340	2424	msedge.exe	79
PID 2424 wrote to memory of 3340	2424	msedge.exe	79
PID 2424 wrote to memory of 3340	2424	msedge.exe	79
PID 2424 wrote to memory of 3340	2424	msedge.exe	79
PID 2424 wrote to memory of 3340	2424	msedge.exe	79
PID 2424 wrote to memory of 3340	2424	msedge.exe	79
PID 2424 wrote to memory of 3340	2424	msedge.exe	79
PID 2424 wrote to memory of 3340	2424	msedge.exe	79
PID 2424 wrote to memory of 3340	2424	msedge.exe	79
PID 2424 wrote to memory of 3340	2424	msedge.exe	79
PID 2424 wrote to memory of 3340	2424	msedge.exe	79
PID 2424 wrote to memory of 3340	2424	msedge.exe	79
PID 2424 wrote to memory of 3340	2424	msedge.exe	79
PID 2424 wrote to memory of 3340	2424	msedge.exe	79
PID 2424 wrote to memory of 3340	2424	msedge.exe	79
PID 2424 wrote to memory of 3340	2424	msedge.exe	79
PID 2424 wrote to memory of 3340	2424	msedge.exe	79
PID 2424 wrote to memory of 3340	2424	msedge.exe	79
PID 2424 wrote to memory of 3340	2424	msedge.exe	79
PID 2424 wrote to memory of 3340	2424	msedge.exe	79
PID 2424 wrote to memory of 3340	2424	msedge.exe	79
PID 2424 wrote to memory of 3340	2424	msedge.exe	79
PID 2424 wrote to memory of 3340	2424	msedge.exe	79
PID 2424 wrote to memory of 3340	2424	msedge.exe	79
PID 2424 wrote to memory of 3340	2424	msedge.exe	79
PID 2424 wrote to memory of 3340	2424	msedge.exe	79
PID 2424 wrote to memory of 3340	2424	msedge.exe	79
PID 2424 wrote to memory of 3340	2424	msedge.exe	79
PID 2424 wrote to memory of 3340	2424	msedge.exe	79
PID 2424 wrote to memory of 3340	2424	msedge.exe	79
PID 2424 wrote to memory of 3340	2424	msedge.exe	79
PID 2424 wrote to memory of 704	2424	msedge.exe	80
PID 2424 wrote to memory of 704	2424	msedge.exe	80
PID 2424 wrote to memory of 4456	2424	msedge.exe	81
PID 2424 wrote to memory of 4456	2424	msedge.exe	81
PID 2424 wrote to memory of 4456	2424	msedge.exe	81
PID 2424 wrote to memory of 4456	2424	msedge.exe	81
PID 2424 wrote to memory of 4456	2424	msedge.exe	81
PID 2424 wrote to memory of 4456	2424	msedge.exe	81
PID 2424 wrote to memory of 4456	2424	msedge.exe	81
PID 2424 wrote to memory of 4456	2424	msedge.exe	81
PID 2424 wrote to memory of 4456	2424	msedge.exe	81
PID 2424 wrote to memory of 4456	2424	msedge.exe	81
PID 2424 wrote to memory of 4456	2424	msedge.exe	81
PID 2424 wrote to memory of 4456	2424	msedge.exe	81
PID 2424 wrote to memory of 4456	2424	msedge.exe	81
PID 2424 wrote to memory of 4456	2424	msedge.exe	81
PID 2424 wrote to memory of 4456	2424	msedge.exe	81
PID 2424 wrote to memory of 4456	2424	msedge.exe	81
PID 2424 wrote to memory of 4456	2424	msedge.exe	81
PID 2424 wrote to memory of 4456	2424	msedge.exe	81
PID 2424 wrote to memory of 4456	2424	msedge.exe	81
PID 2424 wrote to memory of 4456	2424	msedge.exe	81

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/file/d/1Z14Es76qIsHHLaUBOfBPTsjRdOwYfXr9/view?pli=1
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff959eb3cb8,0x7ff959eb3cc8,0x7ff959eb3cd8
  2⤵
  PID:716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1888,1311194971867694016,9240794027826457947,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1920 /prefetch:2
  2⤵
  PID:3340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1888,1311194971867694016,9240794027826457947,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2360 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1888,1311194971867694016,9240794027826457947,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2832 /prefetch:8
  2⤵
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,1311194971867694016,9240794027826457947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:1428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,1311194971867694016,9240794027826457947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:2744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,1311194971867694016,9240794027826457947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4924 /prefetch:1
  2⤵
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,1311194971867694016,9240794027826457947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5576 /prefetch:1
  2⤵
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,1311194971867694016,9240794027826457947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5948 /prefetch:1
  2⤵
  PID:2488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1888,1311194971867694016,9240794027826457947,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6140 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3768
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1888,1311194971867694016,9240794027826457947,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6644 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1888,1311194971867694016,9240794027826457947,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6332 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,1311194971867694016,9240794027826457947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6572 /prefetch:1
  2⤵
  PID:3056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,1311194971867694016,9240794027826457947,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6040 /prefetch:1
  2⤵
  PID:2664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,1311194971867694016,9240794027826457947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5472 /prefetch:1
  2⤵
  PID:1040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,1311194971867694016,9240794027826457947,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5352 /prefetch:1
  2⤵
  PID:4956

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1200

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2020

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:224

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Launcher_Version24\" -spe -an -ai#7zMap11979:98:7zEvent32381
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3192

C:\Users\Admin\Downloads\Launcher_Version24\Launcher_Setup.exe
"C:\Users\Admin\Downloads\Launcher_Version24\Launcher_Setup.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:796
- C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
  C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:908

C:\Windows\System32\Taskmgr.exe
"C:\Windows\System32\Taskmgr.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5044

C:\Users\Admin\Downloads\Launcher_Version24\Launcher_Setup.exe
"C:\Users\Admin\Downloads\Launcher_Version24\Launcher_Setup.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4564
- C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
  C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3508

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2180

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4064
- C:\Program Files\Microsoft Office\root\Office16\Winword.exe
  "C:\Program Files\Microsoft Office\root\Office16\Winword.exe" /n "C:\Windows\System32\drivers\etc\hosts"
  2⤵
  - Drops file in Drivers directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  PID:788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3e2612636cf368bc811fdc8db09e037d

SHA1
d69e34379f97e35083f4c4ea1249e6f1a5f51d56

SHA256
2eecaacf3f2582e202689a16b0ac1715c628d32f54261671cf67ba6abbf6c9f9

SHA512
b3cc3bf967d014f522e6811448c4792eed730e72547f83eb4974e832e958deb7e7f4c3ce8e0ed6f9c110525d0b12f7fe7ab80a914c2fe492e1f2d321ef47f96d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e8115549491cca16e7bfdfec9db7f89a

SHA1
d1eb5c8263cbe146cd88953bb9886c3aeb262742

SHA256
dfa9a8b54936607a5250bec0ed3e2a24f96f4929ca550115a91d0d5d68e4d08e

SHA512
851207c15de3531bd230baf02a8a96550b81649ccbdd44ad74875d97a700271ef96e8be6e1c95b2a0119561aee24729cb55c29eb0b3455473688ef9132ed7f54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
408B

MD5
fc743ee2423b5c375c0e27d53610203e

SHA1
f9184047b6d3cd99656077466b63cc0c3a833a97

SHA256
e41e940ef24f116721309862aa372b0405ea32e8ff62b784ee3f26c9d233cedb

SHA512
c477fabbd1aa5b4a1e4d9eb81102b7b5c38115ad3dcaf3fb5c18eb5c016a5b1613905eb0e6f39a1e08ae3a115ce0aa8ed90ef66a3999085c9687a43466e733d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
c627e88903bc6afcd5445df23a8645bd

SHA1
fba4366e3480667f6f9cd1b6f20404079ef378d2

SHA256
e683506d320e1fb1a2614367d8ecfe144750be7e2db5659feac2490bbd8f8f73

SHA512
706e01d076492a3ba846bf8401dd1fc02e52cf6a19aeb40a949320d16d4cb5189a24346f2d2f1e97e8279cc6b31a877d2126cdbb2963851a80707bf6dddbbb6a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b5c49396ca1d969edfe133cf6046c7b4

SHA1
556e0719c5a79557e881b0a923a4dc0a04329aa0

SHA256
cb3bc6939543f98a3c499fcbd58c37d33e3022113cc21b1b65f748adfb158f33

SHA512
a20bcb1e90589d76f6cbcba58d4f84083d8136e444587e5baa68958814ab8e30f6dcb52e75915aed5d4dc4d39a1bc6814247d8d747ae7c2d610e8327fa9d66db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
71cca1e6a5cab09f19a66b62fd43ecd1

SHA1
c4a301d5dca7741d12aecf595d23b095c6434121

SHA256
a17c56299dc5a3326586f5d3508c9a5a444e8b914bbcdbf024063e15996bb885

SHA512
628566d66858c73ae5a6c2a77eff0252a269c4b3f1eca40afa8e25ef199834890015851afd95a69fc1271545fddf4c51fdd159b81d4bc443e6dc31798927a192

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
1a58f7d0d52ffb78463d9f9ae16f7ae0

SHA1
2a67d1fb8656df14d7e854eb07136f1664740fc7

SHA256
d7fd547c60a519681b2c490e82c8a3f86d3465058dd412ba2bca9f81274095ef

SHA512
16dc6a89b70957f3a02533674373875f2e32acd567ba4505f1cb3ed7741f66fb2b34c8e8c8930716668b56472e67f9f6a85d453a716884bb94457de4926c1fce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
fa8e9cb3ac0ae2d017075e9b373a7f14

SHA1
ee1c719d02b1fdb454371fde1ba12f100fa4cf3b

SHA256
3d3bb742ea692a07ede4fdf6644a106de2d1cd59824b1a1dc41be44e73bd7e6e

SHA512
d3c2393418f0fffddf01f12ea6a81d81f8bbfeafc0245d7e4c13331f43679b2cf8442557c4654e01a6540dd25397ffe8760f68eb0a6e8059f7e45fd24d4dc337

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ad2dc885628ee45686099a86edacb36d

SHA1
ac4e7bd7eefacd47412ed308aecd784642ddac18

SHA256
b5a522627f1ec6779f125e0ad3e08a761c6bb0a023c18cc5bbad06f286a446f1

SHA512
cd5edd614f89a6ec297861fa8dc11d088e3c4573aee57c556b9aaece28adad0a79ff16f2e63b8c5d2005736f1fe3def3e623d8d5698668057bcd93d9fec2f845

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db

Filesize
28KB

MD5
a0241f866b7ac87d05d57e0a03fd3d7d

SHA1
ac4605587b625497e0c3f6ce6a464e62849f73c6

SHA256
187db9e93711d3558e5503fd731ebad74f7aff9639b9bd85b5a75f042e664e1d

SHA512
a25a423cd39efa019f2ec8de009ffce600d3134cb8ce36b17caa3b56f218923e317c3bc46fb7075962a288a3bc852ffd1bf4618a2240ff6bc7164d7b776a7c8d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

Filesize
311B

MD5
d46b9e286aa19c4dba5e3d2d11a4027c

SHA1
d6221181176ff1c4d22b89c57df46650064b6c24

SHA256
48f5c7af29e0ce332eb99981726960199edcebe3c8969b3179e6980d184357bf

SHA512
889171d6fb3a971f032ee1ea3fc831c6d22889d18adbf5e03a146adfc7c390f845835b7ed2737d23ad116a7a9a6023d2036aa4dc5415dacc735bff15493d37a5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\Downloads\Launcher_Version24.zip:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Downloads\Launcher_Version24\Launcher_Setup.exe

Filesize
28.7MB

MD5
6c1f3f90da84d774ee602dd603a5a22e

SHA1
3eb13081736d37460d5af19d75480596eb3a8fa3

SHA256
0ef487a74c9432e7664ac6dec0fe7227cef529f1f853f135551e77eb7ee1beb6

SHA512
17928ea9c3d904e9ad986a87b0daa00e21acad79c814a572aaac0c0e685a894517ca3d3da27348493b07711932d36ef9af63b412008b53bc1f2ca833d97ad8aa

Download Submit
C:\Users\Admin\Downloads\Launcher_Version24\mui_panel\0419\Help\mui\0409\cliconf.chm

Filesize
92KB

MD5
c15c2d987ac0936962cffc215ed54318

SHA1
8022fee5e72f50f88fc1a9ec9d50e60508518bdc

SHA256
fb17f6bd188428ec7e445e493309efd128fa625529a3166b058a5f53331c0a39

SHA512
ddd0fcf90673d5e00db0408d1dad5ed792d19d4139cf29ea73dc65ee02ba847ed56219fbc1e680283c44754917c9527b66298cd5c2d34126aa2088f01c74541c

Download Submit
C:\Users\Admin\Downloads\Launcher_Version24\mui_panel\0419\Help\mui\0409\mmc.CHM

Filesize
26KB

MD5
39e49fa8791f1d7f57fff6ff0bc5a1e7

SHA1
614bbdc3d266847f1b7dcf4840280692e035f5a5

SHA256
1c7e497ce881005248f97542deeff2bcb3ad05f7f8443f4ad37fe62a6f64d85e

SHA512
a03eb05bd79cdc4953beb7aaa6cc07c78c6419c5424ce8d6482c3e7996073474088fad6ff4b121e58a795c193ceef7a60def39e1f2036e5495439836d70cf1d3

Download Submit
C:\Users\Admin\Downloads\Launcher_Version24\mui_panel\0419\Help\mui\0409\msdasc.chm

Filesize
75KB

MD5
86165cf3d62317770fce58f3cb1d4dd4

SHA1
6ec118c5eb9f0da89d25f52215169ecd6e14339a

SHA256
aaaa1d54087d10801231b4bff492beac227c8b713dda39bfbbfd0972adb0129a

SHA512
497f196ecdfd526edf1ad9006a8830ae8a723f2e7ad3f09875fa322f8d8fa5e16833070506145f2035f53f5b315dd533087137db77b87b301bacd12cb57f58ec

Download Submit
C:\Users\Admin\Downloads\Launcher_Version24\mui_panel\0419\Help\mui\0409\msorcl32.chm

Filesize
73KB

MD5
c0aa228d770f3c77458deaf45ce6f226

SHA1
620f64d0c800a8b40d3ad203aecf060e863c5b02

SHA256
482811c38ed17d6fb2fbcc60cd3b8f4a89764219585c0c1148e59cc0e25b8931

SHA512
215a631bb1cee3d41ba800c5a513083a492c0401325fb5c792977ffff3683d89e819459d8044b9ff9b3c335621ea597e941e0ffffaa04d893c3afc7cc671188f

Download Submit
C:\Users\Admin\Downloads\Launcher_Version24\mui_panel\0419\Help\mui\0409\odbcinst.chm

Filesize
76KB

MD5
bf0942377f014c00b6e8520822a6c07c

SHA1
3ecd626dae4ec6f8dbc73e76de63428cc0a46656

SHA256
350f3e7cdc45b99bb3448d10c724d5ba6ac532cc51ef3ec4513f4d218b947d7a

SHA512
3e1b3e5a8df0a3d6f732b8be8681afa9e7660b173288d8ec376697dbb8d3f4ce91f23403b9749b7ea0930c4344b2833fcc680042a5571ba07376ee352e12a75f

Download Submit
C:\Users\Admin\Downloads\Launcher_Version24\mui_panel\0419\Help\mui\0409\odbcjet.chm

Filesize
85KB

MD5
b083c2f7d195411e21538740bf2f05bd

SHA1
49a6371bafa94a566f2f83c87bb523d1dbbc6784

SHA256
1bd31d1c1a7db64f4b32d612d26921c019eb56288e3a28b204de5cc58df63dba

SHA512
0e397911fceb1f3d9b0fc55c513d7636f338d74a43546d25c5fcedf6a9c8ff2029be2c0188c705511e21a1f236e89a1aeffbddb22fcc8c4e130ee80fe1c685bc

Download Submit
C:\Users\Admin\Downloads\Launcher_Version24\mui_panel\0419\Help\mui\0409\sqlsodbc.chm

Filesize
72KB

MD5
ee4c26f9aed9ea6f00895ad68e6fba27

SHA1
4a36763cbd1bf495f75fe9d76ed295a21ed7ad9a

SHA256
6a67d43209abf575634aaae36f4624807ace7926956e4981558cf9852419a0c7

SHA512
f0e41f031936a2ba4edfb958740701e95c6917d523c488ab460ebbd34215e4b7bb73b41d0ab24f89494f1d0dcde115acbcc0c19f88675205880cfc42e59f4c20

Download Submit
C:\Users\Admin\Downloads\Launcher_Version24\mui_panel\0419\Help\mui\0409\sqlsoldb.chm

Filesize
62KB

MD5
3f3d9ab55fb11f31466413aa692d4159

SHA1
8793560bf876df1dc98b38f967fe24167810bccb

SHA256
2f9355f5db80f86272f091b138f8b48a253dad7609ed696e4b7e3379cbf28917

SHA512
669ed441c5d7f650be59398d640a54b8c1c81e8cc8b66d58885054128858fd8a8a763021d67e93ad845ea4951dfb745264ff828fe550d1377a44728309c455bd

Download Submit
C:\Users\Admin\Downloads\Launcher_Version24\mui_panel\0419\Help\mui\0419\cliconf.chm

Filesize
94KB

MD5
eabb7098f222df521e465d3d41cd4c05

SHA1
2caaccb08b52b26ed9f5b12298a32a9e5e4abdce

SHA256
c65af6dd5f55d4b8cf925b776da6f38d3190a5b0bbfd5d0177601efda76827c7

SHA512
71404122eeb7f046893306d7ec8443561cd3b332250c421cc43f8e35cf17325bdf00fb725bd33951fb966795782f305e05b3a8045643afaa5925680eed82d3f3

Download Submit
C:\Users\Admin\Downloads\Launcher_Version24\mui_panel\0419\Help\mui\0419\dsfswdf.chm

Filesize
72KB

MD5
935512b9467c05174d596dacb82d5a59

SHA1
9388d4adc324a425f5460ea3013d888e8898f64a

SHA256
dd09b2bbab35bc2563dbb3e6ecebfa4bce2c049b0e263c2692e76d7f60c4d783

SHA512
0d8ab33f0cda5585ffc21e9f585233a8430a41e6b038aa6569a8a955e11ec62e98e3f1e23b0067d014a99daa1b760b99224d7e1cd776f007d9ace7e560031bec

Download Submit
C:\Users\Admin\Downloads\Launcher_Version24\mui_panel\0419\msdasc.chm

Filesize
75KB

MD5
d6bd530834e65d678888eb0fd224dcbf

SHA1
1b39e594ddb17e83c09c9e58ed664adb29149801

SHA256
4abd31dbfffeba6f88411f120537f483f8b5026d552b58f66426c2e5e6bb5bc3

SHA512
25cdd886cb4b372a7812131866ea1bb80ff040ad31d621992f087d5c9444ddeb87614cf401a09381ca1b67258607fefc090d21092d66fa049f74a6ce74e294ec

Download Submit
C:\Users\Admin\Downloads\Launcher_Version24\mui_panel\0419\msorcl32.chm

Filesize
73KB

MD5
fb79dc5e0d2086f8e77ecd02298e23d9

SHA1
77beb5fd050d127527b087b72cc61a9d9c9a12c2

SHA256
bf3d32385067b09fc942429be65a0f96746101adc929c26ef18a822fa6cbf072

SHA512
8a6df917c7dd8486b94f8e2dd1200f5532611818fe1c516802cfaa0ae10775f468c10cc3686ff9e03cee431015132c72b74737fb099063afe42e6283ee50662f

Download Submit
C:\Users\Admin\Downloads\Launcher_Version24\mui_panel\0419\odbcinst.chm

Filesize
79KB

MD5
764039fc7c1c21a8095be1d912e917b7

SHA1
8443e8934ddf0e65e644b2ddacef92bfc90a2930

SHA256
184cba455e9b234af57c2c50cb7cc2321e59f17ee607b63a7bf2a3e4f3c8de58

SHA512
0e321bc198a14cd31984ae63aa0be5c1a43dd7e959d7b075a058220383de1234c6a8da272167d00034a0e020c7e5ad4fffbdd94a38f3e7b25982dbdedccccff3

Download Submit
C:\Users\Admin\Downloads\Launcher_Version24\mui_panel\0419\odbcjet.chm

Filesize
91KB

MD5
16a12239626d918884bc24b9d63d2a62

SHA1
04e1c661f50a87771e1b9b63d8453d2790419607

SHA256
4ca60a0d9aabbdb62681b00618a3b3257fc3a29354b69c1110df261449b6bebe

SHA512
45a91d4624c2d6a0f85aaed5356d32f05b7335d1ad656c1bbcacdf02c1ff1d032df78073cf0bd7fe83a997b0404019c279b7d6427b63be8b8e124d8d9eefd899

Download Submit
C:\Users\Admin\Downloads\Launcher_Version24\mui_panel\API-MS-Win-core-xstate-l2-1-0.dll

Filesize
12KB

MD5
b685358b3d0f37b68a24a6862f2ab63c

SHA1
b98d6706b7c922a2c93a75280e599361502697d1

SHA256
7cf73e4f69b3dfd89f3b24167f2f421b17537f3a4e707c63c675457b4fbf850b

SHA512
965580bfab334a217625e64dc5ab8622dcd18e5377453252b0c40c8e171040411a8916145f98e1bbe7476ad140562ea52ba148bf584d3389a07c2654d122e9b4

Download Submit
C:\Users\Admin\Downloads\Launcher_Version24\mui_panel\api-ms-win-core-console-l1-1-0.dll

Filesize
12KB

MD5
cd3ab89fadee9d9ab307f55390798102

SHA1
7f5646953d2a90c1033cfee8d2e6d394b05d0a5b

SHA256
915c296fabf88b9e3b43b5a570a6e8e642071678ac443c555f6e95bee7925bc5

SHA512
5b68fbe6456897695fdbc683dd703c286531e831fa3039ba19bc376ac5f363cd0588a815156b18139b82e64ae5c9d87bee025805658005e46d3fce915a9f332e

Download Submit
C:\Users\Admin\Downloads\Launcher_Version24\mui_panel\api-ms-win-core-errorhandling-l1-1-0.dll

Filesize
12KB

MD5
b2eac5c213cc442820167617d568e179

SHA1
9e61baac12e1a536be5e553530db8957ac606d37

SHA256
8b4a9ba2855247adddb4ee1e7f503dad5674ea7bb45015bd69cc83a3332f696b

SHA512
af7a8e6e16b86d4e2aa3141fd41a8c897957486b4d87d8ed14210590e86577e030b4b7c419ed988d22851c5fdf75236c23560fd855ada97a76459c9c93802c83

Download Submit
C:\Users\Admin\Downloads\Launcher_Version24\mui_panel\api-ms-win-core-file-l1-1-0.dll

Filesize
15KB

MD5
4d0399f0050b13586b8b04f62e95b16b

SHA1
407ca079a3bbe2837203beabf41516fdba776a16

SHA256
420395ac9ab87accb00fa478be0b73b583a42d406d1341d98a77f6189b556998

SHA512
8908cbf7cb7b87fc78a2baa1eb2aef52303e733987891361db07098fb70d776fe936d48221a846787d67adcfbaf30ad93b867d5578b7dd566fe8addc480cda18

Download Submit
C:\Users\Admin\Downloads\Launcher_Version24\mui_panel\api-ms-win-core-file-l1-2-0.dll

Filesize
12KB

MD5
918b087149a2571d9db1eb04878c3603

SHA1
aa1d2c7550df6eddd2e99b44ac9de925888281ad

SHA256
b2546e21336714858d2b03d2532b6955dcd7ff46b30435f6d309d8c39d0dc957

SHA512
07c0d13e505c69985d6354c450887260345dc59468eb82b9b0534d1bd13f5f960d2d56932b204b300ac7e5f0ff7234c5e459de06d0e466fbc3f710fb9551793d

Download Submit
C:\Users\Admin\Downloads\Launcher_Version24\mui_panel\api-ms-win-core-interlocked-l1-1-0.dll

Filesize
12KB

MD5
f6f0270f98f5cf857d1e0667819fc9d6

SHA1
959209e5e068aa2564f4f777e1c8616a9d4cb6a0

SHA256
616ac120e3b9abb6f245a09fc17398bef10c5e6aa617849fe68a89efdcddb7fe

SHA512
1ef69bcf037e2ead4b4c3518a8e8e3c2dd3065049649a6973aaed9300ff6fef4bc2bc25f7d0b92dc4ab5f6a576850537ce9d6e00090af86512d080417eda42c1

Download Submit
C:\Users\Admin\Downloads\Launcher_Version24\mui_panel\api-ms-win-core-libraryloader-l1-1-0.dll

Filesize
13KB

MD5
ae1eb2e7a5de49e2950cd2f7892d5513

SHA1
ab7ea36f3c4232f0b3f6036edecffdd4e8603936

SHA256
23fbe7263ca595af627fc37e774fc6fd5f66daecb54e38d48486c9df09e438f4

SHA512
ef919e89dbfe93ea2f45e01913c9b7d1695520f3d0073f2b578ef814e3dd6443bb506e5766d09d41e802f9c2cb4d35778c87f86faa89baf7dce66da787b85418

Download Submit
C:\Users\Admin\Downloads\Launcher_Version24\mui_panel\api-ms-win-core-memory-l1-1-0.dll

Filesize
12KB

MD5
2b3eae5e560be8c87a246d0e8fe3f593

SHA1
8f9563bb72fbea30d37a27c353daceb552279603

SHA256
b858256aa6a926f89714f21790d25e90b7dea5096bd9935454a8b4c7abea736c

SHA512
e33e50380d37f075b8d7fa283d5b4005ccbd7c35af1d11dc6ea4f4529c39571f50114d2c678061daa47f6b36bda9c948ca724acb9aaf9595ed7caaef2b0c0359

Download Submit
C:\Users\Admin\Downloads\Launcher_Version24\mui_panel\api-ms-win-core-namedpipe-l1-1-0.dll

Filesize
12KB

MD5
4ee09ce90a33fc4f885539370d3ab11f

SHA1
023fb903cb6ddd95e25f18fd72e1b57b4a5ccff2

SHA256
4b00d5be82d9eae3445b559f4eb1c62eb192f5554b9edad50b09f98fbc65c126

SHA512
afdd5f50fecb5ada09a4d8217f1db396a2501b4ea14db90267ce51e964536a9e7c32cc55b5a8239c357f9146a7f4fa601181b7b8222670550667fae95d55bcf4

Download Submit
C:\Users\Admin\Downloads\Launcher_Version24\mui_panel\api-ms-win-core-processenvironment-l1-1-0.dll

Filesize
13KB

MD5
9c46e030383d0f85a113a1f3b7477a77

SHA1
7f762360a7cb9881fa9c153f42f3a39be89db946

SHA256
d08d50eff27e71af2e72655edf22dbdea85346cc14be53c48988a3c039fdf17f

SHA512
6ab0490d9eb82f010dc4bdea8e54b9b760a417a44bb88a7bc74ce7d61833e355cef54712f3340b37fbdf07dbcd83e17295ab546d864ac06e84e0bbb7d8dd8649

Download Submit
C:\Users\Admin\Downloads\Launcher_Version24\mui_panel\api-ms-win-core-processthreads-l1-1-0.dll

Filesize
14KB

MD5
fc776a56634728a146211939d14187b5

SHA1
f8372701ba9ee1a51ecf4649c74e27d1e996a45a

SHA256
ca2b5493a6699756b3bf63d9bd807b0204419ec3087d02f4bb5c7b01e8fffd4e

SHA512
dd468a46c62e8a5a2ee64332522d5ca5f8093b13722e13cfd996b32b6efc74cc2a8502b44cada19ec0c30027dab400c8567c84937f08ccd989d8a0b75b470a75

Download Submit
C:\Users\Admin\Downloads\Launcher_Version24\mui_panel\api-ms-win-core-processthreads-l1-1-1.dll

Filesize
12KB

MD5
51b851eb7b58ca2c3280def9722a9602

SHA1
75aa3331eb7da58868f700158df56fb49e3c4507

SHA256
9f0d6efb48c7f8c0f001ec30d45558c5d8675c06573eca7c8125a7d5a1db2634

SHA512
e9b0c683b58ecdba5d5132f6808ea2dd85a3db3b0d9690efb54aeee92c29b8b2b4535437d861d2fa2a8033e623aeb4ee0661dd01e17527a74d6002c9926e8783

Download Submit
C:\Users\Admin\Downloads\Launcher_Version24\mui_panel\api-ms-win-core-synch-l1-2-0.dll

Filesize
12KB

MD5
364d65fe7f976fd00702f5bd63eea9b3

SHA1
e40359ed2e2deb198caefedc27acf8c7715fc80e

SHA256
85fd25863a60e7c627494dcf14b169480023c0b8e4682a0e495f4f7389407149

SHA512
dfbc7b8660a7b96135ce0b35c8f2f576e536e8f8bfb53ee268611fabb4ddc4c53fe06a1a9e81ff26a8e10dafc40eee5d579a2bd1e19d7517bf6f089c605ece6c

Download Submit
C:\Users\Admin\Downloads\Launcher_Version24\mui_panel\api-ms-win-core-sysinfo-l1-1-0.dll

Filesize
13KB

MD5
7ebb75a1000e52570ca55c35dfc7bd6c

SHA1
764dc860173990e451f6aeb6fd9b0164a86e447e

SHA256
2b151cce07a4d9c8507a1c547fdcb6ad904f9ebeeee71439d6151eeee287984f

SHA512
6d9c127cb35c122cb028eb9e8e7cdb466dc7b429ae8a13ec818df96917120f5e1f47902ecb3ecce9ddb1379029c63db3b6504d83dac8b6342484124902672c09

Download Submit
C:\Users\Admin\Downloads\Launcher_Version24\mui_panel\api-ms-win-core-timezone-l1-1-0.dll

Filesize
12KB

MD5
2a21692ef3a54e5f4a016a3a1767a7d9

SHA1
9890261f7cc42d660371c1b9d3a96c09b1e48783

SHA256
01f6b2760031ed0d521e8d972a6e7b4aa05393934a37266c3f9374042cc97b3b

SHA512
7ee03077c29867a717245bbcc1f4c7afc425c5e248c7c70f884e3ad0bc0267f95b94ea2f47e3554b2d189160d56ba4a6924399bc80201fde24cbc943894e60af

Download Submit
C:\Users\Admin\Downloads\Launcher_Version24\mui_panel\api-ms-win-crt-conio-l1-1-0.dll

Filesize
13KB

MD5
410fb7adfc54094b95609747a5376472

SHA1
e2e79f589a2e71009d9947bb02f05b877e208266

SHA256
77f2e7e09fe542ea78f4f6f23440014461074b993e50bf75d02b2c6571f5d696

SHA512
57fc04e4c770766ee9c2cdf7ec166792fb4164d7657fbbb6a6ec74a5073de953860b7c1d5754b28b61a83b7bb1cc0a1417a2f13c246aa06044045687b207bddc

Download Submit
C:\Users\Admin\Downloads\Launcher_Version24\mui_panel\api-ms-win-crt-convert-l1-1-0.dll

Filesize
16KB

MD5
03c2c3d48cba89a77a8c06158056aaa8

SHA1
3cf294991250721c2100288d4dbcb0343cc04bf2

SHA256
43e0c37da7bc6b2786f95765f14177651bea534ca4d1d966c79fc301a55ad5df

SHA512
bd9787ec2cf87f8c790db18724a5cc10d1a6de005fa8cc6a74733521bb11251bd0d026af9468e98b616a6d8212cb41c3da102248e105a4b312d7b068e9c407d0

Download Submit
C:\Users\Admin\Downloads\Launcher_Version24\mui_panel\api-ms-win-crt-environment-l1-1-0.dll

Filesize
12KB

MD5
490c63e6b1aba9a525404067ce3c20b6

SHA1
04997f8a146284f8369c7db6204949658d6d7180

SHA256
c5131d1abd188d009e72b8c6474c74a262b7b8ec504470385f7f69428e7ae0e7

SHA512
245c4e2545e7eb5462e20e12d8092cdaba24d48e6c53d02f3eec586de17eb9cb6c15cea204a18deeea3cc8668c8afbe9f35b0fc1e751d2f515edd18ae149d275

Download Submit
C:\Users\Admin\Downloads\Launcher_Version24\mui_panel\api-ms-win-crt-filesystem-l1-1-0.dll

Filesize
14KB

MD5
d1f28f796bacea3d58eca271fd128758

SHA1
934efde030a54a441c342af18ab5275e5facd0e8

SHA256
b8d3d45141ad57d917b25d2491a07f20c77b1dfd047e203e26dad591c40b225a

SHA512
4b6ada7f10a4a660c3b6ac0fd81a41c680bd6752eb1a70da08510feb10fbf2b7d5ee177a94d5093239914eea79114097329a64067a72068a8baea8a9963e3901

Download Submit
C:\Users\Admin\Downloads\Launcher_Version24\mui_panel\api-ms-win-crt-heap-l1-1-0.dll

Filesize
13KB

MD5
0651bcd9acadac1d50653be35378a82c

SHA1
5d1b2233c7acb3915d33f7b29cc2f0cbf34ea1ad

SHA256
fcf66176b6f7ab86f98f38d5662f61fa61ad3f1e59740d8a1df0e1072248cf6d

SHA512
1ce05989181faa8d291bb0df34bb4e93f2f576187cf2d0c5110988ce17e6a682d815297fcc9fd174bc1791713fb07b616ed952729923abf8c06b8b8f6d71d82e

Download Submit
C:\Users\Admin\Downloads\Launcher_Version24\mui_panel\api-ms-win-crt-math-l1-1-0.dll

Filesize
22KB

MD5
46aaecdb8d337980c82cb2714a985986

SHA1
22104d2272b592a344df5b575fcff83ca0e4b161

SHA256
34457a002e90a590b516bbf58530cdddbb618a46bb3e764e18167c44934917dc

SHA512
33c91058a693b82f1457d49bba2e209a90b825927be89e38523671ac16f4fef208b98efa980a3e11185baa4df6d7639d447bf30e19dc91b76f04ee61b6169bee

Download Submit
C:\Users\Admin\Downloads\Launcher_Version24\mui_panel\api-ms-win-crt-multibyte-l1-1-0.dll

Filesize
20KB

MD5
7442e7059f712705d4b97699bf56de35

SHA1
f924088428eda3b76030091cf59ad38afb590118

SHA256
f822289ea5a9b0ccf9777a72bc8b73ce68b596fcca811e0cff0adc4031056b20

SHA512
dec6228063bbab561ae0c02cbcbab3d08c15f261758405d8a709707a180a09af9c462b0b382b700177f285a1ce3bf7e71e093f9031d15f932120fbfd396aa851

Download Submit
C:\Users\Admin\Downloads\Launcher_Version24\mui_panel\api-ms-win-crt-private-l1-1-0.dll

Filesize
65KB

MD5
3b07abbe272e9b9e2989e2d6a400fa53

SHA1
f925e5e58377dcdc13b6d80ff22c775e2334e372

SHA256
a170d9851a1427066d1fd61c32a9ae4b9545aa926be55da7e7d94275be281dc8

SHA512
14762c984aa6736b1330b1f0b296622fc1ce3ac79108c0bfee793a51131deacd09b494e8c851c6e437a84871a864dd65389657df8b2256f931e3c60a61fade8b

Download Submit
C:\Users\Admin\Downloads\Launcher_Version24\mui_panel\api-ms-win-crt-runtime-l1-1-0.dll

Filesize
17KB

MD5
90340ac74d22b9a67237ea52a4dc1c75

SHA1
75d44b240afd4198b0f3b7256a4a9533ad1ba73f

SHA256
fd48da616f2d17054bcab961239431d99c247586f96bac69aac5b704ea694352

SHA512
6f52ae85b4d9ab8516d72bb1662ac9cf602092fc61ea78bd85af05047c70a0adc5edb67266032f12a86601c983015276f15a457935f5b6143dc80d335351e5ec

Download Submit
C:\Users\Admin\Downloads\Launcher_Version24\mui_panel\api-ms-win-crt-stdio-l1-1-0.dll

Filesize
18KB

MD5
85444893a6553a4dd26150a68fd373d8

SHA1
ad9b46da45366f13a22173b06e22a45a211e99ec

SHA256
65f2a93490c845833541de1376d5bb65e6e864a1a9232f58f86a7a84408508c9

SHA512
ad56f71d0dc6d2dc5dd46eaa00247bd209403014648fb9c8f98937fc8e36fc85c0107365d2f6ba4f6d530f340278e0205d94bafebc78d10201e71dbb5d4c36d6

Download Submit
C:\Users\Admin\Downloads\Launcher_Version24\mui_panel\api-ms-win-crt-string-l1-1-0.dll

Filesize
18KB

MD5
841e4ff9bb531b52218392db1d7cfbe4

SHA1
5607c2a987436195f1e241a0b29e8fb1f734102f

SHA256
4da31e582dc47d46132cc73ad34d5b87dddd2338495ceb2772f7e103a9a32ebc

SHA512
93232073d95870043994c752318f9b319db508fff452e4aa0b8e42e66d13623803be4537e1798dd05177b7427175d989c8e49a379fd932297e161d461bae268b

Download Submit
C:\Users\Admin\Downloads\Launcher_Version24\mui_panel\api-ms-win-crt-utility-l1-1-0.dll

Filesize
12KB

MD5
b52238936bdf50ab985435a176281f68

SHA1
7bd2be0808c538b6f15f20a9a1228cf4a20adbdd

SHA256
3a23171aac49453f931d69cd55f6ec742243f5835386d9e6b18efad96c2be450

SHA512
36999e6cd50e26b1620fe24ba2dc11a40b25d1d77cc7a0337c7a3f65b16383fdb224e179392a215e6dae846e8bda6acb3e027445fd334e26e34278a397452f6e

Download Submit
C:\Users\Admin\Downloads\Launcher_Version24\mui_panel\data_1.dat

Filesize
257KB

MD5
6611b84af3e611a9b875950f0495f32a

SHA1
adfe167d56dfe650c8434c0020217a4a974915c4

SHA256
31d5b8ce1d3e42d069770d6280f7b3819e81a81ae9b0d41ed502077bb287c107

SHA512
458f4f35e422c4a527a717eb4cb6fd75a39e7e1ee77c51fd5827d98478cc0e00d2e8fcd16dbcb9d1e12e5bd4c75044cfc0f8caf3d3f3a5de6b1104b9884cbc7b

Download Submit
C:\Users\Admin\Downloads\Launcher_Version24\mui_panel\data_2.dat

Filesize
229KB

MD5
2c1b255e3a33284e865ccbded10a68e3

SHA1
79e32ad7730c1fda197c57791e599d2a59db72df

SHA256
99ebc64b3e66f1010d39767dd8203489f40de51cf3e5883333f227d432878327

SHA512
efbdf79474fa8e62e2655c2f366170b882ffd2c591524a383a8d61889e4c8fabb83443a03be0b61b252c280eea26bd6ec63d6d1df286868ea2fed8768be4dd03

Download Submit
C:\Users\Admin\Downloads\Launcher_Version24\mui_panel\sp.dll

Filesize
1.4MB

MD5
f71bb7c962274e15a434d128c953bf1c

SHA1
6bf62ea5796b9bc757669e4b413be17c4deb7a22

SHA256
efd2a8b2d95ce3e513a35ccd0e74a14297cdf1f89f69e31b87b1f0ca0d16f37e

SHA512
90aa4f471d16f55204b1ec3ef92d7e444ecbf577dade088ed7605c0941811e006df345cd3b7707427ae7099305b1cc2fe4f18afc97944b2974d9af4cb6501764

Download Submit
memory/788-1068-0x00007FF926990000-0x00007FF9269A0000-memory.dmp

Filesize
64KB

Download
memory/788-1063-0x00007FF928F70000-0x00007FF928F80000-memory.dmp

Filesize
64KB

Download
memory/788-1062-0x00007FF928F70000-0x00007FF928F80000-memory.dmp

Filesize
64KB

Download
memory/788-1115-0x00007FF928F70000-0x00007FF928F80000-memory.dmp

Filesize
64KB

Download
memory/788-1116-0x00007FF928F70000-0x00007FF928F80000-memory.dmp

Filesize
64KB

Download
memory/788-1114-0x00007FF928F70000-0x00007FF928F80000-memory.dmp

Filesize
64KB

Download
memory/788-1064-0x00007FF928F70000-0x00007FF928F80000-memory.dmp

Filesize
64KB

Download
memory/788-1065-0x00007FF928F70000-0x00007FF928F80000-memory.dmp

Filesize
64KB

Download
memory/788-1066-0x00007FF928F70000-0x00007FF928F80000-memory.dmp

Filesize
64KB

Download
memory/788-1067-0x00007FF926990000-0x00007FF9269A0000-memory.dmp

Filesize
64KB

Download
memory/788-1113-0x00007FF928F70000-0x00007FF928F80000-memory.dmp

Filesize
64KB

Download
memory/796-1018-0x00007FF7850B0000-0x00007FF786E03000-memory.dmp

Filesize
29.3MB

Download
memory/796-1019-0x00007FF7850B0000-0x00007FF786E03000-memory.dmp

Filesize
29.3MB

Download
memory/796-1022-0x00007FF7850B0000-0x00007FF786E03000-memory.dmp

Filesize
29.3MB

Download
memory/796-1026-0x00007FF7850B0000-0x00007FF786E03000-memory.dmp

Filesize
29.3MB

Download
memory/908-1025-0x0000000001020000-0x0000000001077000-memory.dmp

Filesize
348KB

Download
memory/908-1027-0x0000000001020000-0x0000000001077000-memory.dmp

Filesize
348KB

Download
memory/3508-1050-0x0000000000FA0000-0x0000000000FF7000-memory.dmp

Filesize
348KB

Download
memory/3508-1052-0x0000000000FA0000-0x0000000000FF7000-memory.dmp

Filesize
348KB

Download
memory/4564-1051-0x00007FF7850B0000-0x00007FF786E03000-memory.dmp

Filesize
29.3MB

Download
memory/4564-1045-0x00007FF7850B0000-0x00007FF786E03000-memory.dmp

Filesize
29.3MB

Download
memory/4564-1044-0x00007FF7850B0000-0x00007FF786E03000-memory.dmp

Filesize
29.3MB

Download
memory/4564-1043-0x00007FF7850B0000-0x00007FF786E03000-memory.dmp

Filesize
29.3MB

Download
memory/5044-1037-0x000001240E820000-0x000001240E821000-memory.dmp

Filesize
4KB

Download
memory/5044-1036-0x000001240E820000-0x000001240E821000-memory.dmp

Filesize
4KB

Download
memory/5044-1038-0x000001240E820000-0x000001240E821000-memory.dmp

Filesize
4KB

Download
memory/5044-1039-0x000001240E820000-0x000001240E821000-memory.dmp

Filesize
4KB

Download
memory/5044-1040-0x000001240E820000-0x000001240E821000-memory.dmp

Filesize
4KB

Download
memory/5044-1034-0x000001240E820000-0x000001240E821000-memory.dmp

Filesize
4KB

Download
memory/5044-1029-0x000001240E820000-0x000001240E821000-memory.dmp

Filesize
4KB

Download
memory/5044-1030-0x000001240E820000-0x000001240E821000-memory.dmp

Filesize
4KB

Download
memory/5044-1028-0x000001240E820000-0x000001240E821000-memory.dmp

Filesize
4KB

Download
memory/5044-1035-0x000001240E820000-0x000001240E821000-memory.dmp

Filesize
4KB

Download