hxxps://drive[.]google[.]com/file/d/1Oe61JwdOh2wyD_RQd4rZDppbjHj4ECRp/view

Analysis

max time kernel
171s
max time network
173s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14/08/2024, 19:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1Oe61JwdOh2wyD_RQd4rZDppbjHj4ECRp/view

Score

8^/10

discovery evasion execution persistence privilege_escalation trojan

Malware Config

Signatures

Blocklisted process makes network request 2 IoCs

flow	pid	Process
116	5324	powershell.exe
118	5324	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
5324	powershell.exe
5324	powershell.exe

Downloads MZ/PE file

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0"	MicrosoftEdgeUpdate.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation	msedgewebview2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation	msedgewebview2.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 22 IoCs

pid	Process
5756	MicrosoftEdgeWebview2Setup.exe
5220	MicrosoftEdgeUpdate.exe
4032	MicrosoftEdgeUpdate.exe
5632	MicrosoftEdgeUpdate.exe
1516	MicrosoftEdgeUpdateComRegisterShell64.exe
5744	MicrosoftEdgeUpdateComRegisterShell64.exe
2036	MicrosoftEdgeUpdateComRegisterShell64.exe
5832	MicrosoftEdgeUpdate.exe
5912	MicrosoftEdgeUpdate.exe
5948	MicrosoftEdgeUpdate.exe
5988	MicrosoftEdgeUpdate.exe
2040	MicrosoftEdge_X64_127.0.2651.98.exe
5572	setup.exe
228	setup.exe
6076	MicrosoftEdgeUpdate.exe
884	H2M Launcher.exe
3588	msedgewebview2.exe
6036	msedgewebview2.exe
5040	msedgewebview2.exe
5248	msedgewebview2.exe
3012	msedgewebview2.exe
3516	msedgewebview2.exe

Loads dropped DLL 38 IoCs

pid	Process
3460	MsiExec.exe
5220	MicrosoftEdgeUpdate.exe
4032	MicrosoftEdgeUpdate.exe
5632	MicrosoftEdgeUpdate.exe
1516	MicrosoftEdgeUpdateComRegisterShell64.exe
5632	MicrosoftEdgeUpdate.exe
5744	MicrosoftEdgeUpdateComRegisterShell64.exe
5632	MicrosoftEdgeUpdate.exe
2036	MicrosoftEdgeUpdateComRegisterShell64.exe
5632	MicrosoftEdgeUpdate.exe
5832	MicrosoftEdgeUpdate.exe
5912	MicrosoftEdgeUpdate.exe
5948	MicrosoftEdgeUpdate.exe
5948	MicrosoftEdgeUpdate.exe
5912	MicrosoftEdgeUpdate.exe
5988	MicrosoftEdgeUpdate.exe
6076	MicrosoftEdgeUpdate.exe
3460	MsiExec.exe
884	H2M Launcher.exe
3588	msedgewebview2.exe
6036	msedgewebview2.exe
3588	msedgewebview2.exe
3588	msedgewebview2.exe
3588	msedgewebview2.exe
5040	msedgewebview2.exe
5248	msedgewebview2.exe
3012	msedgewebview2.exe
5248	msedgewebview2.exe
3012	msedgewebview2.exe
5040	msedgewebview2.exe
5040	msedgewebview2.exe
5040	msedgewebview2.exe
5040	msedgewebview2.exe
5040	msedgewebview2.exe
3516	msedgewebview2.exe
3516	msedgewebview2.exe
3516	msedgewebview2.exe
3588	msedgewebview2.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	H2M Launcher.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
4	drive.google.com
8	drive.google.com
9	drive.google.com

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Checks system information in the registry 2 TTPs 12 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	\??\c:\windows\system32\driverstore\filerepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF	chrome.exe
File created	C:\Windows\System32\DriverStore\FileRepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF	chrome.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\webview2_integration.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\Trust Protection Lists\Sigma\Other	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\Locales\hr.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU3FF2.tmp\msedgeupdate.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU3FF2.tmp\msedgeupdateres_de.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\onnxruntime.dll	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Temp\source5572_1926962446\MSEDGE.7z	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\dxil.dll	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\Trust Protection Lists\Mu\Content	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\Trust Protection Lists\Sigma\Social	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\eventlog_provider.dll	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU3FF2.tmp\msedgeupdateres_bg.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU3FF2.tmp\msedgeupdateres_te.dll	MicrosoftEdgeWebview2Setup.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\libGLESv2.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\copilot_provider_msix\copilot_provider_neutral.msix	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\Locales\cy.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\Locales\zh-TW.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\Locales\lt.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU3FF2.tmp\msedgeupdateres_fi.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU3FF2.tmp\msedgeupdateres_nl.dll	MicrosoftEdgeWebview2Setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\VisualElements\SmallLogoCanary.png	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\msedge_200_percent.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\Locales\en-US.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\Locales\sr-Latn-RS.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\Locales\mi.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\copilot_provider_msix\package_metadata	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\identity_proxy\canary.identity_helper.exe.manifest	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\Locales\pa.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\Trust Protection Lists\manifest.json	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU3FF2.tmp\msedgeupdateres_zh-CN.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\msedgewebview2.exe.sig	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU3FF2.tmp\msedgeupdateres_ar.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{160FBF2D-6FA1-4730-A6AD-316F4C6554BE}\EDGEMITMP_54C86.tmp\SETUP.EX_	MicrosoftEdge_X64_127.0.2651.98.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\WidevineCdm\manifest.json	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\identity_proxy\canary.identity_helper.exe.manifest	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\Locales\hi.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU3FF2.tmp\msedgeupdateres_lv.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\Locales\sv.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\Trust Protection Lists\Mu\TransparentAdvertisers	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\Trust Protection Lists\Mu\Fingerprinting	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\Locales\kk.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\identity_proxy\internal.identity_helper.exe.manifest	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\Locales\hr.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\Locales\th.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\Locales\ar.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\Locales\mk.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\Locales\nn.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\Locales\az.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\Locales\ca-Es-VALENCIA.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU3FF2.tmp\msedgeupdateres_zh-TW.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\Locales\sk.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\cookie_exporter.exe	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\telclient.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\Locales\mt.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\Locales\mr.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\Locales\he.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\vulkan-1.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\Trust Protection Lists\Mu\Other	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\identity_proxy\win11\identity_helper.Sparse.Internal.msix	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\Locales\bs.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\Locales\gd.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\VisualElements\Logo.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\MEIPreload\preloaded_data.pb	setup.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\Installer\SourceHash{9E4D2DE9-2006-4A7E-B70E-3EDD52929379}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2E3F.tmp	msiexec.exe
File created	C:\Windows\Installer\e582d16.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e582d16.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\{9E4D2DE9-2006-4A7E-B70E-3EDD52929379}\ProductIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\{9E4D2DE9-2006-4A7E-B70E-3EDD52929379}\ProductIcon	msiexec.exe
File created	C:\Windows\Installer\e582d18.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeWebview2Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5832	MicrosoftEdgeUpdate.exe
5988	MicrosoftEdgeUpdate.exe
6076	MicrosoftEdgeUpdate.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000b58935fac5ebb7730000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000b58935fa0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900b58935fa000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1db58935fa000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000b58935fa00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 50 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133681364382442531"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3805CA06-AC83-4F00-8A02-271DCD89BDEB}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0E8770A1-043A-4818-BB5C-41862B93EEFF}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.195.15\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\ProxyStubClsid32\ = "{0E8770A1-043A-4818-BB5C-41862B93EEFF}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{08D832B9-D2FD-481F-98CF-904D00DF63CC}\ProgID\ = "MicrosoftEdgeUpdate.ProcessLauncher.1.0"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9ED2D4E96002E7A47BE0E3DD25293997\SourceList\PackageName = "H2M Launcher_0.12.0_x64_en-US (1).msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\ = "IPolicyStatusValue"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.PolicyStatusMachine.1.0\CLSID\ = "{B5977F34-9264-4AC3-9B31-1224827FF6E8}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0E8770A1-043A-4818-BB5C-41862B93EEFF}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\ProxyStubClsid32\ = "{0E8770A1-043A-4818-BB5C-41862B93EEFF}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\ProxyStubClsid32\ = "{0E8770A1-043A-4818-BB5C-41862B93EEFF}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3805CA06-AC83-4F00-8A02-271DCD89BDEB}\ = "IPolicyStatus5"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9F3F5F5D-721A-4B19-9B5D-69F664C1A591}\VersionIndependentProgID	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\NumMethods\ = "26"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\NumMethods\ = "10"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{77857D02-7A25-4B67-9266-3E122A8F39E4}	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9ED2D4E96002E7A47BE0E3DD25293997\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.PolicyStatusSvc.1.0\CLSID\ = "{9F3F5F5D-721A-4B19-9B5D-69F664C1A591}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\ProxyStubClsid32\ = "{0E8770A1-043A-4818-BB5C-41862B93EEFF}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0E8770A1-043A-4818-BB5C-41862B93EEFF}\InProcServer32	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}\ = "IBrowserHttpRequest2"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\ProxyStubClsid32\ = "{0E8770A1-043A-4818-BB5C-41862B93EEFF}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9ED2D4E96002E7A47BE0E3DD25293997\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9F3F5F5D-721A-4B19-9B5D-69F664C1A591}\ProgID\ = "MicrosoftEdgeUpdate.PolicyStatusSvc.1.0"	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{08D832B9-D2FD-481F-98CF-904D00DF63CC}\VersionIndependentProgID\ = "MicrosoftEdgeUpdate.ProcessLauncher"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{77857D02-7A25-4B67-9266-3E122A8F39E4}\LocalServer32	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	H2M Launcher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3805CA06-AC83-4F00-8A02-271DCD89BDEB}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\NumMethods\ = "11"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{08D832B9-D2FD-481F-98CF-904D00DF63CC}\ProgID	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\ProxyStubClsid32\ = "{0E8770A1-043A-4818-BB5C-41862B93EEFF}"	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{375D3B39-152A-41E1-BF1B-B648933F26D0}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}\VersionIndependentProgID	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\ = "IPolicyStatus"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\ProxyStubClsid32\ = "{0E8770A1-043A-4818-BB5C-41862B93EEFF}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\ = "IPolicyStatusValue"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B9063E4-3882-485E-8797-F28A0240782F}\NumMethods\ = "4"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebSvc.1.0\CLSID\ = "{EA92A799-267E-4DF5-A6ED-6A7E0684BB8A}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}\NumMethods\ = "4"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}\ProxyStubClsid32\ = "{0E8770A1-043A-4818-BB5C-41862B93EEFF}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}\ProgID\ = "MicrosoftEdgeUpdate.Update3WebMachine.1.0"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\ = "IGoogleUpdate"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\ = "IApp2"	MicrosoftEdgeUpdateComRegisterShell64.exe

Suspicious behavior: EnumeratesProcesses 53 IoCs

pid	Process
2604	chrome.exe
2604	chrome.exe
4876	msiexec.exe
4876	msiexec.exe
5324	powershell.exe
5324	powershell.exe
5324	powershell.exe
5220	MicrosoftEdgeUpdate.exe
5220	MicrosoftEdgeUpdate.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
2576	chrome.exe
5220	MicrosoftEdgeUpdate.exe
5220	MicrosoftEdgeUpdate.exe
5220	MicrosoftEdgeUpdate.exe
5220	MicrosoftEdgeUpdate.exe
884	H2M Launcher.exe
884	H2M Launcher.exe
884	H2M Launcher.exe
884	H2M Launcher.exe
884	H2M Launcher.exe
884	H2M Launcher.exe
884	H2M Launcher.exe
884	H2M Launcher.exe
884	H2M Launcher.exe
884	H2M Launcher.exe
884	H2M Launcher.exe
884	H2M Launcher.exe
884	H2M Launcher.exe
884	H2M Launcher.exe
884	H2M Launcher.exe
884	H2M Launcher.exe
884	H2M Launcher.exe
884	H2M Launcher.exe
884	H2M Launcher.exe
884	H2M Launcher.exe
884	H2M Launcher.exe
884	H2M Launcher.exe
884	H2M Launcher.exe
884	H2M Launcher.exe
884	H2M Launcher.exe
884	H2M Launcher.exe
884	H2M Launcher.exe
884	H2M Launcher.exe
884	H2M Launcher.exe
884	H2M Launcher.exe
884	H2M Launcher.exe
884	H2M Launcher.exe
884	H2M Launcher.exe
884	H2M Launcher.exe
884	H2M Launcher.exe
884	H2M Launcher.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
884	H2M Launcher.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
3588	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2604	chrome.exe
Token: SeCreatePagefilePrivilege	2604	chrome.exe
Token: SeShutdownPrivilege	2604	chrome.exe
Token: SeCreatePagefilePrivilege	2604	chrome.exe
Token: SeShutdownPrivilege	2604	chrome.exe
Token: SeCreatePagefilePrivilege	2604	chrome.exe
Token: SeShutdownPrivilege	2604	chrome.exe
Token: SeCreatePagefilePrivilege	2604	chrome.exe
Token: SeShutdownPrivilege	2604	chrome.exe
Token: SeCreatePagefilePrivilege	2604	chrome.exe
Token: SeShutdownPrivilege	2604	chrome.exe
Token: SeCreatePagefilePrivilege	2604	chrome.exe
Token: SeShutdownPrivilege	2604	chrome.exe
Token: SeCreatePagefilePrivilege	2604	chrome.exe
Token: SeShutdownPrivilege	2604	chrome.exe
Token: SeCreatePagefilePrivilege	2604	chrome.exe
Token: SeShutdownPrivilege	2604	chrome.exe
Token: SeCreatePagefilePrivilege	2604	chrome.exe
Token: SeShutdownPrivilege	2604	chrome.exe
Token: SeCreatePagefilePrivilege	2604	chrome.exe
Token: SeShutdownPrivilege	2604	chrome.exe
Token: SeCreatePagefilePrivilege	2604	chrome.exe
Token: SeShutdownPrivilege	2604	chrome.exe
Token: SeCreatePagefilePrivilege	2604	chrome.exe
Token: SeShutdownPrivilege	2604	chrome.exe
Token: SeCreatePagefilePrivilege	2604	chrome.exe
Token: SeShutdownPrivilege	2604	chrome.exe
Token: SeCreatePagefilePrivilege	2604	chrome.exe
Token: SeShutdownPrivilege	2604	chrome.exe
Token: SeCreatePagefilePrivilege	2604	chrome.exe
Token: SeShutdownPrivilege	2604	chrome.exe
Token: SeCreatePagefilePrivilege	2604	chrome.exe
Token: SeShutdownPrivilege	2604	chrome.exe
Token: SeCreatePagefilePrivilege	2604	chrome.exe
Token: SeShutdownPrivilege	2604	chrome.exe
Token: SeCreatePagefilePrivilege	2604	chrome.exe
Token: SeShutdownPrivilege	2604	chrome.exe
Token: SeCreatePagefilePrivilege	2604	chrome.exe
Token: SeShutdownPrivilege	4228	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4228	msiexec.exe
Token: SeShutdownPrivilege	2604	chrome.exe
Token: SeCreatePagefilePrivilege	2604	chrome.exe
Token: SeSecurityPrivilege	4876	msiexec.exe
Token: SeCreateTokenPrivilege	4228	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4228	msiexec.exe
Token: SeLockMemoryPrivilege	4228	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4228	msiexec.exe
Token: SeMachineAccountPrivilege	4228	msiexec.exe
Token: SeTcbPrivilege	4228	msiexec.exe
Token: SeSecurityPrivilege	4228	msiexec.exe
Token: SeTakeOwnershipPrivilege	4228	msiexec.exe
Token: SeLoadDriverPrivilege	4228	msiexec.exe
Token: SeSystemProfilePrivilege	4228	msiexec.exe
Token: SeSystemtimePrivilege	4228	msiexec.exe
Token: SeProfSingleProcessPrivilege	4228	msiexec.exe
Token: SeIncBasePriorityPrivilege	4228	msiexec.exe
Token: SeCreatePagefilePrivilege	4228	msiexec.exe
Token: SeCreatePermanentPrivilege	4228	msiexec.exe
Token: SeBackupPrivilege	4228	msiexec.exe
Token: SeRestorePrivilege	4228	msiexec.exe
Token: SeShutdownPrivilege	4228	msiexec.exe
Token: SeDebugPrivilege	4228	msiexec.exe
Token: SeAuditPrivilege	4228	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4228	msiexec.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
4228	msiexec.exe
4228	msiexec.exe
4228	msiexec.exe
884	H2M Launcher.exe
884	H2M Launcher.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe
2604	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
884	H2M Launcher.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2604 wrote to memory of 2924	2604	chrome.exe	84
PID 2604 wrote to memory of 2924	2604	chrome.exe	84
PID 2604 wrote to memory of 1244	2604	chrome.exe	85
PID 2604 wrote to memory of 1244	2604	chrome.exe	85
PID 2604 wrote to memory of 1244	2604	chrome.exe	85
PID 2604 wrote to memory of 1244	2604	chrome.exe	85
PID 2604 wrote to memory of 1244	2604	chrome.exe	85
PID 2604 wrote to memory of 1244	2604	chrome.exe	85
PID 2604 wrote to memory of 1244	2604	chrome.exe	85
PID 2604 wrote to memory of 1244	2604	chrome.exe	85
PID 2604 wrote to memory of 1244	2604	chrome.exe	85
PID 2604 wrote to memory of 1244	2604	chrome.exe	85
PID 2604 wrote to memory of 1244	2604	chrome.exe	85
PID 2604 wrote to memory of 1244	2604	chrome.exe	85
PID 2604 wrote to memory of 1244	2604	chrome.exe	85
PID 2604 wrote to memory of 1244	2604	chrome.exe	85
PID 2604 wrote to memory of 1244	2604	chrome.exe	85
PID 2604 wrote to memory of 1244	2604	chrome.exe	85
PID 2604 wrote to memory of 1244	2604	chrome.exe	85
PID 2604 wrote to memory of 1244	2604	chrome.exe	85
PID 2604 wrote to memory of 1244	2604	chrome.exe	85
PID 2604 wrote to memory of 1244	2604	chrome.exe	85
PID 2604 wrote to memory of 1244	2604	chrome.exe	85
PID 2604 wrote to memory of 1244	2604	chrome.exe	85
PID 2604 wrote to memory of 1244	2604	chrome.exe	85
PID 2604 wrote to memory of 1244	2604	chrome.exe	85
PID 2604 wrote to memory of 1244	2604	chrome.exe	85
PID 2604 wrote to memory of 1244	2604	chrome.exe	85
PID 2604 wrote to memory of 1244	2604	chrome.exe	85
PID 2604 wrote to memory of 1244	2604	chrome.exe	85
PID 2604 wrote to memory of 1244	2604	chrome.exe	85
PID 2604 wrote to memory of 1244	2604	chrome.exe	85
PID 2604 wrote to memory of 1844	2604	chrome.exe	86
PID 2604 wrote to memory of 1844	2604	chrome.exe	86
PID 2604 wrote to memory of 1448	2604	chrome.exe	87
PID 2604 wrote to memory of 1448	2604	chrome.exe	87
PID 2604 wrote to memory of 1448	2604	chrome.exe	87
PID 2604 wrote to memory of 1448	2604	chrome.exe	87
PID 2604 wrote to memory of 1448	2604	chrome.exe	87
PID 2604 wrote to memory of 1448	2604	chrome.exe	87
PID 2604 wrote to memory of 1448	2604	chrome.exe	87
PID 2604 wrote to memory of 1448	2604	chrome.exe	87
PID 2604 wrote to memory of 1448	2604	chrome.exe	87
PID 2604 wrote to memory of 1448	2604	chrome.exe	87
PID 2604 wrote to memory of 1448	2604	chrome.exe	87
PID 2604 wrote to memory of 1448	2604	chrome.exe	87
PID 2604 wrote to memory of 1448	2604	chrome.exe	87
PID 2604 wrote to memory of 1448	2604	chrome.exe	87
PID 2604 wrote to memory of 1448	2604	chrome.exe	87
PID 2604 wrote to memory of 1448	2604	chrome.exe	87
PID 2604 wrote to memory of 1448	2604	chrome.exe	87
PID 2604 wrote to memory of 1448	2604	chrome.exe	87
PID 2604 wrote to memory of 1448	2604	chrome.exe	87
PID 2604 wrote to memory of 1448	2604	chrome.exe	87
PID 2604 wrote to memory of 1448	2604	chrome.exe	87
PID 2604 wrote to memory of 1448	2604	chrome.exe	87
PID 2604 wrote to memory of 1448	2604	chrome.exe	87
PID 2604 wrote to memory of 1448	2604	chrome.exe	87
PID 2604 wrote to memory of 1448	2604	chrome.exe	87
PID 2604 wrote to memory of 1448	2604	chrome.exe	87
PID 2604 wrote to memory of 1448	2604	chrome.exe	87
PID 2604 wrote to memory of 1448	2604	chrome.exe	87
PID 2604 wrote to memory of 1448	2604	chrome.exe	87
PID 2604 wrote to memory of 1448	2604	chrome.exe	87

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection	msedgewebview2.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://drive.google.com/file/d/1Oe61JwdOh2wyD_RQd4rZDppbjHj4ECRp/view
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fffeb26cc40,0x7fffeb26cc4c,0x7fffeb26cc58
  2⤵
  PID:2924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1224,i,13784678289157538211,16265457427198656047,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1736 /prefetch:2
  2⤵
  PID:1244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1832,i,13784678289157538211,16265457427198656047,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2116 /prefetch:3
  2⤵
  PID:1844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=1708,i,13784678289157538211,16265457427198656047,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2260 /prefetch:8
  2⤵
  PID:1448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3100,i,13784678289157538211,16265457427198656047,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3136 /prefetch:1
  2⤵
  PID:112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3124,i,13784678289157538211,16265457427198656047,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3176 /prefetch:1
  2⤵
  PID:2144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4324,i,13784678289157538211,16265457427198656047,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4420 /prefetch:1
  2⤵
  PID:2500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4804,i,13784678289157538211,16265457427198656047,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4832 /prefetch:1
  2⤵
  PID:1568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5228,i,13784678289157538211,16265457427198656047,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5240 /prefetch:8
  2⤵
  PID:800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5716,i,13784678289157538211,16265457427198656047,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4728 /prefetch:8
  2⤵
  PID:3892
- C:\Windows\System32\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\H2M Launcher_0.12.0_x64_en-US (1).msi"
  2⤵
  - Enumerates connected drives
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:4228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=5332,i,13784678289157538211,16265457427198656047,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5236 /prefetch:8
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:2576

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:2620

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3052

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4876
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding F720A57E1778069B4ADF06168C784860 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3460
- - C:\Program Files\H2M Launcher\H2M Launcher.exe
    "C:\Program Files\H2M Launcher\H2M Launcher.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks whether UAC is enabled
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:884
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name="H2M Launcher.exe" --webview-exe-version=0.12.0 --user-data-dir="C:\Users\Admin\AppData\Local\app.h2m.lierrmm\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --mojo-named-platform-channel-pipe=884.5852.1059185034118020243
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      Checks system information in the registry
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      System policy modification
      PID:3588
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\app.h2m.lierrmm\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\app.h2m.lierrmm\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=127.0.6533.100 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=127.0.2651.98 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7fffd57ad198,0x7fffd57ad1a4,0x7fffd57ad1b0
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:6036
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\app.h2m.lierrmm\EBWebView" --webview-exe-name="H2M Launcher.exe" --webview-exe-version=0.12.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1804,i,3640607833738737828,4490406511658412331,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1800 /prefetch:2
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5040
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\app.h2m.lierrmm\EBWebView" --webview-exe-name="H2M Launcher.exe" --webview-exe-version=0.12.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --field-trial-handle=1992,i,3640607833738737828,4490406511658412331,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1996 /prefetch:3
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5248
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\app.h2m.lierrmm\EBWebView" --webview-exe-name="H2M Launcher.exe" --webview-exe-version=0.12.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --field-trial-handle=2032,i,3640607833738737828,4490406511658412331,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2204 /prefetch:8
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3012
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\app.h2m.lierrmm\EBWebView" --webview-exe-name="H2M Launcher.exe" --webview-exe-version=0.12.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --field-trial-handle=3344,i,3640607833738737828,4490406511658412331,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3392 /prefetch:1
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3516
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:3512
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -windowstyle hidden try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 } catch {}; Invoke-WebRequest -Uri "https://go.microsoft.com/fwlink/p/?LinkId=2124703" -OutFile "$env:TEMP\MicrosoftEdgeWebview2Setup.exe" ; Start-Process -FilePath "$env:TEMP\MicrosoftEdgeWebview2Setup.exe" -ArgumentList ('/silent', '/install') -Wait
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5324
- - C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe" /silent /install
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    PID:5756
  - - C:\Program Files (x86)\Microsoft\Temp\EU3FF2.tmp\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\Temp\EU3FF2.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"
      4⤵
      Event Triggered Execution: Image File Execution Options Injection
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      Checks system information in the registry
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:5220
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4032
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5632
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:1516
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:5744
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.15\MicrosoftEdgeUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:2036
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuMTUiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuMTUiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QjVCMDlFQTktMkRDMi00OTdFLTkwOTQtMjYxMjdFNzFFNEFDfSIgdXNlcmlkPSJ7QkY0NzY5QzgtNjMwNC00MTdFLTlFRkEtRDU4QzQ0OUMyNjU0fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins2QTMwNTE3QS03QjVBLTQ5NDctQTBCRS1EN0MwNzAxNDJCNTZ9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7cjQ1MnQxK2syVGdxL0hYemp2Rk5CUmhvcEJXUjlzYmpYeHFlVURIOXVYMD0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE0Ny4zNyIgbmV4dHZlcnNpb249IjEuMy4xOTUuMTUiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjUyMTA5NDY1ODUiIGluc3RhbGxfdGltZV9tcz0iNDY5Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks system information in the registry
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:5832
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{B5B09EA9-2DC2-497E-9094-26127E71E4AC}" /silent
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:5912

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:4488

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:5948
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuMTUiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuMTUiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QjVCMDlFQTktMkRDMi00OTdFLTkwOTQtMjYxMjdFNzFFNEFDfSIgdXNlcmlkPSJ7QkY0NzY5QzgtNjMwNC00MTdFLTlFRkEtRDU4QzQ0OUMyNjU0fSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7QUI0REY3NTItRDM0OC00RkI4LThBMTMtREIyQzU0RDJBRkUwfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O3I0NTJ0MStrMlRncS9IWHpqdkZOQlJob3BCV1I5c2JqWHhxZVVESDl1WDA9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIxMiIgaW5zdGFsbGRhdGV0aW1lPSIxNzIyNjAyNzMzIiBvb2JlX2luc3RhbGxfdGltZT0iMTMzNjcwNzUyNzY2Nzc2NzYwIj48ZXZlbnQgZXZlbnR0eXBlPSIzMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMjExNDMyNSIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTIxNTc5MDQwNSIvPjwvYXBwPjwvcmVxdWVzdD4
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks system information in the registry
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5988
- C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{160FBF2D-6FA1-4730-A6AD-316F4C6554BE}\MicrosoftEdge_X64_127.0.2651.98.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{160FBF2D-6FA1-4730-A6AD-316F4C6554BE}\MicrosoftEdge_X64_127.0.2651.98.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:2040
- - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{160FBF2D-6FA1-4730-A6AD-316F4C6554BE}\EDGEMITMP_54C86.tmp\setup.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{160FBF2D-6FA1-4730-A6AD-316F4C6554BE}\EDGEMITMP_54C86.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{160FBF2D-6FA1-4730-A6AD-316F4C6554BE}\MicrosoftEdge_X64_127.0.2651.98.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    PID:5572
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{160FBF2D-6FA1-4730-A6AD-316F4C6554BE}\EDGEMITMP_54C86.tmp\setup.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{160FBF2D-6FA1-4730-A6AD-316F4C6554BE}\EDGEMITMP_54C86.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=127.0.6533.100 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{160FBF2D-6FA1-4730-A6AD-316F4C6554BE}\EDGEMITMP_54C86.tmp\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=127.0.2651.98 --initial-client-data=0x22c,0x230,0x234,0x208,0x238,0x7ff7cc37b7d0,0x7ff7cc37b7dc,0x7ff7cc37b7e8
      4⤵
      Executes dropped EXE
      PID:228
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuMTUiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuMTUiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QjVCMDlFQTktMkRDMi00OTdFLTkwOTQtMjYxMjdFNzFFNEFDfSIgdXNlcmlkPSJ7QkY0NzY5QzgtNjMwNC00MTdFLTlFRkEtRDU4QzQ0OUMyNjU0fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins0RDQyQTY5NS1EQzY0LTRBNDQtOTM4RS04MURGRkYzMTM0NUF9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7aFZmRGpNZEZHNkZnS3MwTno2ZW1yWUNTZzZUUXZEUG9tb2xSYXlRWEJLND0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjMwMTcyMjYtRkUyQS00Mjk1LThCREYtMDBDM0E5QTdFNEM1fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMTI3LjAuMjY1MS45OCIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9ImNvbnNlbnQ9ZmFsc2UiIGluc3RhbGxhZ2U9Ii0xIiBpbnN0YWxsZGF0ZT0iLTEiPjx1cGRhdGVjaGVjay8-PGV2ZW50IGV2ZW50dHlwZT0iOSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTIzNzM0OTAwMyIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjUyMzczNDkwMDMiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1Njk0MjMzODQxIiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiBkb3dubG9hZGVyPSJiaXRzIiB1cmw9Imh0dHA6Ly9tc2VkZ2UuZi50bHUuZGwuZGVsaXZlcnkubXAubWljcm9zb2Z0LmNvbS9maWxlc3RyZWFtaW5nc2VydmljZS9maWxlcy81MjlhNDFjZC01YzBjLTRjZDAtODA2MS1iNzFmZWFhOGEzMzY_UDE9MTcyNDI2NzY3NiZhbXA7UDI9NDA0JmFtcDtQMz0yJmFtcDtQND1HUW9DMCUyYjl4a2xlQzg1ME9IaEg4RDBrSTFJZXk1WVlpVEFGRVcyUGtNYlJ6ZGklMmZrNXFjRG5ZRkNLMXpTdWREemZOS29zUXByWTNDMGZEbUxwUDR0JTJmUSUzZCUzZCIgc2VydmVyX2lwX2hpbnQ9IiIgY2RuX2NpZD0iLTEiIGNkbl9jY2M9IiIgY2RuX21zZWRnZV9yZWY9IiIgY2RuX2F6dXJlX3JlZl9vcmlnaW5fc2hpZWxkPSIiIGNkbl9jYWNoZT0iIiBjZG5fcDNwPSIiIGRvd25sb2FkZWQ9IjE3MjYwNjQwOCIgdG90YWw9IjE3MjYwNjQwOCIgZG93bmxvYWRfdGltZV9tcz0iMzkwMTciLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1Njk0NTQ2Mjk0IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTcwODI5NjU5MiIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjE5Njc1NyIgc3lzdGVtX3VwdGltZV90aWNrcz0iNjE0NTE1NjQ2OSIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgdXBkYXRlX2NoZWNrX3RpbWVfbXM9IjE2MDkiIGRvd25sb2FkX3RpbWVfbXM9IjQ1NzIwIiBkb3dubG9hZGVkPSIxNzI2MDY0MDgiIHRvdGFsPSIxNzI2MDY0MDgiIHBhY2thZ2VfY2FjaGVfcmVzdWx0PSIwIiBpbnN0YWxsX3RpbWVfbXM9IjQzNjcxIi8-PC9hcHA-PC9yZXF1ZXN0Pg
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks system information in the registry
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Modifies data under HKEY_USERS
  PID:6076

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e582d17.rbs

Filesize
9KB

MD5
5480d6b66694b5deb895e9a205ce3434

SHA1
571cfe9571ced7c5f8c6cefc46e83dab8eec3c59

SHA256
cb771eabdab8a2da1f849f13d2de26824d06527596eb6d49d072e6e17ffb01b3

SHA512
4b7164b14518a91526cb0ffe7eb392f3c46a3ef112c5073e3b7e59636d49918e6031aba3d8001e77d7f613626ac64db75ee3acf20bc45514e1c56a0bd0d645f8

Download Submit
C:\Program Files (x86)\Microsoft\EdgeCore\127.0.2651.98\Installer\setup.exe

Filesize
6.6MB

MD5
527503f430c5fd4a542f8c0f163fde47

SHA1
6b4db644895df6c71b547d8b147ef3e327418f9d

SHA256
d1d9b6fa51141f58b95191c8a62cc5a4c9568ba4b70e3deba4e1929df9a97628

SHA512
ece940340ba2216966b6d4b28a950826b55f8987998c101c534331674376b148dfbfacaf5c78695944bf940dea07ed4887f9572e09c118e307752036679850b8

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU3FF2.tmp\EdgeUpdate.dat

Filesize
12KB

MD5
369bbc37cff290adb8963dc5e518b9b8

SHA1
de0ef569f7ef55032e4b18d3a03542cc2bbac191

SHA256
3d7ec761bef1b1af418b909f1c81ce577c769722957713fdafbc8131b0a0c7d3

SHA512
4f8ec1fd4de8d373a4973513aa95e646dfc5b1069549fafe0d125614116c902bfc04b0e6afd12554cc13ca6c53e1f258a3b14e54ac811f6b06ed50c9ac9890b1

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU3FF2.tmp\MicrosoftEdgeComRegisterShellARM64.exe

Filesize
182KB

MD5
b69894fc1c3f26c77b1826ef8b5a9fc5

SHA1
cff7b4299253beda53fb015408dd840db59901a1

SHA256
b91bad4c618eb6049b19364f62827470095e30519d07f4e0f2ccc387ddd5f1bf

SHA512
8361e97d84082f8e888262d0657bac47c152bd72f972628f446f58cbeacf37c05f484dce3fb0d38c4f0da2a2dcbb0813639d201d127ec7f072b942d43b216755

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU3FF2.tmp\MicrosoftEdgeUpdate.exe

Filesize
201KB

MD5
136e8226d68856da40a4f60e70581b72

SHA1
6c1a09e12e3e07740feef7b209f673b06542ab62

SHA256
b4b8a2f87ee9c5f731189fe9f622cb9cd18fa3d55b0e8e0ae3c3a44a0833709f

SHA512
9a0215830e3f3a97e8b2cdcf1b98053ce266f0c6cb537942aec1f40e22627b60cb5bb499faece768481c41f7d851fcd5e10baa9534df25c419664407c6e5a399

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU3FF2.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe

Filesize
215KB

MD5
205590d4fb4b1914d2853ab7a9839ccf

SHA1
d9bbf8941df5993f72ffcf46beefcfcd88694ebd

SHA256
5f82471d58b6e700248d9602ce4a0a5cda4d2e2863ef1eb9fee4effcc07f3767

SHA512
bce1447d5d3210c22d52dec3b846db091b65ed03fd9d7cd11c6c4dbd2aa5a943d881360bc033c29abd61011581ff9354b35cbe421719d92568ed99997bfbbae8

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU3FF2.tmp\MicrosoftEdgeUpdateCore.exe

Filesize
261KB

MD5
b07ab49ee8453853021c7dac2b2131db

SHA1
e1d87d6a6e7503d0d2b288ea5f034fe2f346196a

SHA256
f8535d5d73ebebed15adc6ae2ced6bb4889aa23e6ffe55faeabd961bf77b05e4

SHA512
5eaae533fbe71430ae2a717f7668fd0a26ec37624e198a32f09bfdbee7e3b6e93d64e4fbb78cbdb05c4fe390a864490ea997d11849ecd371f5153bc8bfafccc3

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU3FF2.tmp\NOTICE.TXT

Filesize
4KB

MD5
6dd5bf0743f2366a0bdd37e302783bcd

SHA1
e5ff6e044c40c02b1fc78304804fe1f993fed2e6

SHA256
91d3fc490565ded7621ff5198960e501b6db857d5dd45af2fe7c3ecd141145f5

SHA512
f546c1dff8902a3353c0b7c10ca9f69bb77ebd276e4d5217da9e0823a0d8d506a5267773f789343d8c56b41a0ee6a97d4470a44bbd81ceaa8529e5e818f4951e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU3FF2.tmp\msedgeupdate.dll

Filesize
2.1MB

MD5
5d89123f9b96098d8fad74108bdd5f7e

SHA1
6309551b9656527563d2b2f3c335fd6805da0501

SHA256
03c3c918886e58f096aa8e919b1e9f8dcd5a9f2a4765971049bf8da305476f44

SHA512
9d8190e5374cd1b4adbbfb87c27fa40d4de529d7c0a20654e0ce189a4cb9a53d3708c4ce657a7a5469b015df7efbbff495fc844579d9cd363b329b7e007e85c8

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU3FF2.tmp\msedgeupdateres_af.dll

Filesize
29KB

MD5
4f860d5995ab77e6efa8f589a758c6d2

SHA1
07536839ccfd3c654ec5dc2161020f729973196d

SHA256
9841d787142dd54fea6b033bd897f05f3e617b48b051de0ee3cf5865b3393150

SHA512
0b9a661b76360f1fb2eb3ee25c6bf2cbab7ec74e2363e0af321dc4d0afb3cad301dddd16ea367d588451a40a2c2ed41f21d7afae48307e1e4a4ec5b24165b378

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU3FF2.tmp\msedgeupdateres_am.dll

Filesize
24KB

MD5
f624de37750fd191eb29d4de36818f8b

SHA1
b647dae9b9a3c673980afa651d73ce0a4985aae6

SHA256
e284453cd512e446fcbf9440013f8cb2348ffd6b1acec5366f2511cdf88b1794

SHA512
d1d65e29ed59e34d4ff66df11a2368f1a724730e32eb245022d4f3d1fadf16d445ba8532460afb0e6e91f8be60a7240d13577403193042d1e912a67e4bf23b1a

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU3FF2.tmp\msedgeupdateres_ar.dll

Filesize
26KB

MD5
5de3f4dabb5f033f24e29033142e7349

SHA1
5c446985de443501b545d75f6886a143c748b033

SHA256
2533d443b68c5288468b0b20cc3a70dc05f0498369d5321368a97dd5bf3268c8

SHA512
c96296e6f67edeff2be5dc03014a8eb65fc287fb899357d4608c36c07b4610827aa18cbec6ccd47b66230a12341af488aca8bd02632fa768f84ca7b1d9c9d065

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU3FF2.tmp\msedgeupdateres_as.dll

Filesize
29KB

MD5
1fb14c6c4fee7bfabe41badb7c5acff8

SHA1
953d94cd73951943db14c08cce37b2d3ac821b02

SHA256
cd32339fd7e4a5959e93eb5bfd6e009e4137e15c5e6c2e861d7891487216da49

SHA512
a93b081935fbe48fafa8071a9cd593ae7b19205c70eaf48c724397019a04161460c66d6d8c6ffd872f4d52a4a7aa25ba1cba04181b9ebaca04b76d111ea588d2

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU3FF2.tmp\msedgeupdateres_az.dll

Filesize
29KB

MD5
d3345579310f3bd080b406de47b2305f

SHA1
16aefb27ea6d81c684f041aa50ebb49fdd403d83

SHA256
b4ea3c63fa0104093a2b2034f950428e66d2cf3d55f0fc5bd688483392d60d69

SHA512
65e4aa8587bc579b5109d91e02745f6de96a23b6ac2962cdeb6d9d536b51abab12b2bbaeca72572c3ae1971dac5bd24430eb2ae5ccf44a7068427594e4afdd7a

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU3FF2.tmp\msedgeupdateres_bg.dll

Filesize
29KB

MD5
ecf3405e9e712d685ef1e8a5377296ea

SHA1
9872cdf450adf4257d77282a39b75822ce1c8375

SHA256
e400415638a7b7dcc28b14a257a28e93e423c396e89a02cba51623fdfbdc6b0b

SHA512
37e5f1b3bdd97a4370718dc2a46d78ab5b66865d3cdb66a20a7dc20a9d423ccde954c08f97e574fbab24e8dfa905351cbfb94bd3e6692a9b6526097ea3dc911d

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU3FF2.tmp\msedgeupdateres_bn-IN.dll

Filesize
29KB

MD5
051c429fa2beec9c2842c403a86c0e7b

SHA1
0a06a45200a1f5c81c48fbd2d03549fc9fac3a58

SHA256
1a8465922bbb05a97a24f6c2200fcc7afd8bd0ace245c2eda9d9d335d4fb9353

SHA512
bb59b41804328f27ba8861af32824266ca69ddcfdaaa11551b1edd4e129dbba630da8070abedb28e180045f8d0ddc1209cd901919f6b9aa421c457188af795c6

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU3FF2.tmp\msedgeupdateres_bn.dll

Filesize
29KB

MD5
82711e45d2b0764997abc1e0678a73bb

SHA1
47908e8885c86477a6f52eea5fddb005ec5b3fa3

SHA256
2bb7455999b8f53a2a0834588ca4da4703f4da362a127d01cc6bd60ca0303799

SHA512
4b517796edc954ab7f5a26a5d6605925dc7e84b611bcf59352b3b95f719cedc72c77a465fb1e7bc2d2f422d596c97968dac5b57292c82967d5cfaff980128fc2

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU3FF2.tmp\msedgeupdateres_bs.dll

Filesize
28KB

MD5
a0a1f791984f1de2f03a36171232d18d

SHA1
71f69d8fe47640ba9705725d7d627a05519c8016

SHA256
d2c7da8f4745b81874a9666c7d10a779a9956b4de0ebdaa1647bf78d4e17d85a

SHA512
a4267911846cd55eb91227b0117ccbfdf8ef6c4ed0b8935b08e5d41a91aeabd9259988c71da8606cfb2876c4d69df6ca5a246687440283f1625105624305eb33

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU3FF2.tmp\msedgeupdateres_ca-Es-VALENCIA.dll

Filesize
30KB

MD5
897712b508931dab76d39b209611740c

SHA1
9d80e07c2dc744e2efce3b67aa9876949fb9edfe

SHA256
ee64fdefdb3381ce61fc445190cc44b015e7b65a3a16d28f3477f68de6079f1b

SHA512
3329e37318dd9b11f282301e453af106168d3d10beff1ed62ffdcda60c6b4edb6b9c69ac6b9bb8abce3c9a9686a0152404524012dbff025e571de2cfcb3b5d56

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU3FF2.tmp\msedgeupdateres_ca.dll

Filesize
30KB

MD5
e90155442b28008992a7d899ca730222

SHA1
1d448e9709de0d301ded6d75caaeba4348a4793d

SHA256
6ae98b5e2eda22a0236434b7e952d732e3cd5d9cae2e51cd70222f1fd5278563

SHA512
a91d8357ca976db2eb5a081077304a50edc1b55b2775c00cfde05e03831f98bd04e43f0dba5b3efd5a6370afcb10b23bbf307412467502e9ef57e0beae636013

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU3FF2.tmp\msedgeupdateres_cs.dll

Filesize
28KB

MD5
1de961b662a374c3af918c18225f4364

SHA1
e8f1c438e57b322f43b4b851698bf38c129eb6ae

SHA256
bb1365c5770dacbb918af27b47b02f269504f4d2396cf3f82bf5ecb2551c5021

SHA512
c6bf62b684039f62744f1aab07f4751948e0c175f7fb7fe126f20903ce23fcdd2e284f1b794922621dae7eaa15c6dae0177ad102289a18f967721486f21073a1

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU3FF2.tmp\msedgeupdateres_cy.dll

Filesize
28KB

MD5
29f027d2d5fd486bdc20386ace925603

SHA1
66b8605f23871b4a8302bef0aaccb36ee1e72755

SHA256
03c8566f749e8fa349d97101849bc3b2cc0b7561b565a2b0928bf8fe901da813

SHA512
3348bdf10b2d964b34b791a774e28c97d3caf28d7f90e36b948cc2cb6c21e84cda933b7ddbd51c8fc604a450361cb834322c15ddbe0f4851154d05e5a2a2ea42

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU3FF2.tmp\msedgeupdateres_da.dll

Filesize
28KB

MD5
b0ae9aa0d5c17ee7abfc57d21cdcbae6

SHA1
01019eb6ba9c123be528136e12192b0bb33df407

SHA256
d10938919e3d28d71e8e3ba2d8e02e0f9dc2faf148cdedc21c166fd994c603e2

SHA512
4cba25c8159df865231b08fe650eedfb92d54c3037d28b2b9af010c8a59fa23669041a6c393622fe69b0194c2532f71f02b740f7e26e0bbf7ef34a421d6747b8

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU3FF2.tmp\msedgeupdateres_de.dll

Filesize
30KB

MD5
ad5b530eabff0540078c5d17f27b9610

SHA1
7e53dbbf64e70e561d37669e69f50eb0da8e37d1

SHA256
49f512316a51e51027b4e70de4ffe8c8ecb188e126439a90a5d12d52a0393966

SHA512
e1cc853d96589220676d39d91d4108633ce56304640f770e7d22b97a9b3be9452d5fb94e4e7fcd1400b62f0c398da8255c53a31853194a9e7b7784982b5ff40f

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU3FF2.tmp\msedgeupdateres_el.dll

Filesize
30KB

MD5
a7e64339a5314e3576c0d170171fa52a

SHA1
6c12aab6c97c30aff3245b78f7a3afeea604215e

SHA256
4e9ccecb8e4383395f2134347fbad00521345ec9c857d8fa102d5257c7bea9bf

SHA512
a4ca3fb60a7f4bda50847544dd1289d750f0d4b3565929290a8392b92822ef1856cec15a1f63f2c6fe1ef2e7cc0936a35bdb38ee5d904eb08cd32f05addc6ee4

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU3FF2.tmp\msedgeupdateres_en-GB.dll

Filesize
27KB

MD5
74d4cf3b8efb6cc3d0acc3eac38bd5b7

SHA1
9337803aadad9042c895b6f418b4c733b81221e0

SHA256
b83c8981d8835e4c78250bf265faa6d64693204b77764c8e349abc4365ae9871

SHA512
e6112ef60d56101aa16327042162d6ef43519bc56668ca8eaa7fd3e1aaadc75c7df75c1e41583a292ff1a9bdc7d9ad9f5c0d97fa84964532dca2d5f3df604c23

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU3FF2.tmp\msedgeupdateres_en.dll

Filesize
27KB

MD5
19dc1f6d1f309eb7abf1e0c8257f41f8

SHA1
e2d3e86fe22c6af6b8ee5b359315dfa6ac4d52ec

SHA256
046f6c532fcabd969c6e63bb7ee0d7a83d806fa659006508e1c3a9485190d6ef

SHA512
478d6a84452cfadc48547930e336ad459eec188dd3d9e4c778cded4ec3d34e00b2b8c0538366aa644ee67f878b29c5c73444c1406c66e8394761bb0979c6483c

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU3FF2.tmp\msedgeupdateres_es-419.dll

Filesize
29KB

MD5
8f7f515d78d2df371993fd70f863ab8d

SHA1
dfae1b47e80f91abf2d9c2aac009c0a1767bc59d

SHA256
ba57fbb9d3a32b84d6a76054b9ad180b6510e53206b9804bb9ea18ff73c2ae3e

SHA512
308a62af00a4410551eac967bb9f2cea7adf7c13b471dd28b276bda40b1e4c0b4ebb60aec29b6165069d40180bc45b4f5da5baddc374ce7bc5a5bb223afb4e96

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU3FF2.tmp\msedgeupdateres_es.dll

Filesize
29KB

MD5
6af05d448c842027f876e93f8ac58b65

SHA1
f34c988e3875a1d1b267b082476fcfb8d7505a73

SHA256
36876b14a214cf98dda5100a7e7134d7ebb78e895535d6bd7562099574607867

SHA512
412031db59de0367a102a026f73072244b33d726adc5bb9fd079db3dd37b5d6a24d7420a9811576d0a356933b5ba15cc9e2a92046d2d6e6d6fef37e9d840aec6

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU3FF2.tmp\msedgeupdateres_et.dll

Filesize
28KB

MD5
ae9bdf6416c3630c4b0b5b119308a135

SHA1
d7218c677b098d2a93cc91ead39c83d3a2c653b6

SHA256
62da90c9417a70632aa190fecc17c31ecf433c1f84f82b08d7d7290669cabf32

SHA512
4333ac6cd3737f25e6e1d429b195da781ced4340b89808cbd5d5d2aae2e79bcc700419d613123d632252e31ac44d95b7718f23da5b82ab5054407e80106a64a7

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU3FF2.tmp\msedgeupdateres_eu.dll

Filesize
28KB

MD5
fe73dbc305da6223d1e94e1cf548c000

SHA1
b16f2c40d68cd9718eaaa9b6db9c8e5c4b6acb9e

SHA256
1ef64088a613a4e10b4cf4206f95f5414ee27872798747234a6574b7e5c70a7d

SHA512
d9900720d89defffa52198dbe63515995095c94aa0cbbe4f32a1c09d26809cec480e92926d2240702604b8c13fcdc0032cc46910ade8e4c1d2fc9a4bd1b63858

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU3FF2.tmp\msedgeupdateres_fa.dll

Filesize
28KB

MD5
367ea715e942c81dd3cb734274969a0b

SHA1
f92f1ec2a5be9b775e67c4252a07c37ed0ca508b

SHA256
082da1c09782c026c9cd73456dc12539a226f0bf5d113e59bc93b29c1e98b37c

SHA512
c94e787ba3bdb56d1827a0477461cbba6b7cc68986722275e0d04ea7dc70db83b5d03887eec810bf9b67f70b18bd3c7b7d28f0e554938b81d3501bc11f97830a

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU3FF2.tmp\msedgeupdateres_fi.dll

Filesize
28KB

MD5
5a30bc4216af48a493eeb0f3a9f02607

SHA1
2fdf65a4002d91818d56a23fb8bfd08ab715002f

SHA256
5131c23915ad6b5b469bcbff31d0ae31ef34ded28ca0ffff9f1eb998bba98aa1

SHA512
34b3a4865f31ebdb8665780011b384ada768a0f71bff77f91706b140eb8cc07fff8787f710cdb1ee14a449cae8f22ee5fddadcc501cf1c921eea078e97dc2f89

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU3FF2.tmp\msedgeupdateres_fil.dll

Filesize
29KB

MD5
84c4736cf301b93998028ed7678caec1

SHA1
3b6f1f6b9eb3dd7d9a13c11dfd3ac56c93f1b10f

SHA256
3c8dcb7e982dac3159298009a86909b1e1000ccf6f4d333341f16d4d6fbd84ad

SHA512
5a1b77ef9450c32802e94e473a5b4e43e892c923ef368ee9bbbbb5b0090429320263cc79a4da0b281930c1a60861519211abd0bd67a9d9ee370bdda2230d2e81

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU3FF2.tmp\msedgeupdateres_fr-CA.dll

Filesize
30KB

MD5
8993c0784111fc7cd6a90a82303e5f44

SHA1
8d1ff2fed98ebc608604c555ceb46ca628afb285

SHA256
3d0ba88267018f592141ea86592757cf1ecaac1a3a18f99203e0fc5c5eacbd62

SHA512
124d16d848dc8ea0a93b292b10ce1fbad23b56b13771d904cf14c19d54478614d214441b05f6cd9e1999b8310fdd26d1c6ecae784be00aecee7e80c96ba4ac88

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU3FF2.tmp\msedgeupdateres_fr.dll

Filesize
30KB

MD5
a640aa4ff33662e06a474765df0b2a8d

SHA1
c6265225532e389e48c6057bd717b69de2125b61

SHA256
078b1943bf7f7955b90abc40f691b27e04376f8c43dd3abc4791614286cd4f23

SHA512
59791eef021f94efd9c18737d6c46fbc45add582eec92d5b997cfd66993abc7da872720a037766c3c70862f0654ccf30d122d4a5a6b305151bf8bf1c053a466d

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU3FF2.tmp\msedgeupdateres_ga.dll

Filesize
29KB

MD5
5bcc643a969559317d09a9c87f53d04e

SHA1
3602d51cde97de16d8c018225a39d505c803e0fc

SHA256
b48f57e90ea9db6d6a296c01e87f8db71e47ab05ab6c2a664cfa9f52cf1d2c18

SHA512
4c65772f77e61e64d572df5b1f62733aceb02a5c967c296b303ff17c5d49831e5b7fc3d662724ae3ae1e88cd0fdcb704e838af5d4ae20f2d82b9577f57159159

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU3FF2.tmp\msedgeupdateres_gd.dll

Filesize
30KB

MD5
aea23f526ef0c5bb3d2f8fdf192a49ea

SHA1
4d7695e33ed43c3efb95f304e29675ea885b2939

SHA256
3cfe866c151a7e8a208af725c0c6f2a47fc3ada35f9ad3509b16b8d5229318b9

SHA512
412e4742ebd46ce38010b4f6a46d8d524025f929ab4658040e271d768e79115d90903403b2f1e51ab910bbdf9677b49439eb3c8afc5959477af198efb0c7c3c9

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU3FF2.tmp\msedgeupdateres_gl.dll

Filesize
29KB

MD5
295cd30c00f43d9131621baf4859578f

SHA1
cab79a6263b7b0a799461f3e6df41f815029cded

SHA256
b851c5a60cb6d1e8dd9aa161106cba99ccea047d0b39d007beaa7b9ef4a83397

SHA512
5f5c1e62e6c0e11a63fad68928765e3f504f33cdbb1d9a05cd53cbc3ed145bf3528960a10e3d57e8c83b07c030c72257f403b9a57d12975d3ef8bc255418ad6c

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU3FF2.tmp\msedgeupdateres_gu.dll

Filesize
28KB

MD5
c43c1ab37cd93e54068443bc330fb3d2

SHA1
ab51a2cbc51b3c17cf184c6d99ac480c02eb63af

SHA256
0c26a367355e766402c31fbab102dd1c35300d4a1301417c75be5fc4b3d54680

SHA512
ff0193189fb846eb3c4188bb599dad8e6f415ec9612da567d95c9c513defb148b6013208371798d174569b46f443a744e4e8b83aaf139d68c31f7de0f94e63f9

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU3FF2.tmp\msedgeupdateres_hi.dll

Filesize
29KB

MD5
a5544f517f7c1bfd1ec6a2e355d5a84c

SHA1
34a2a4a576300ad55b6757171bcba0fab005daa5

SHA256
8274c64bb778b55d912929625cd849adfe733b2dd674d94895d53af8dfaabeca

SHA512
9069bcfb736e13499250844dddef40e2cf64937e33ee1f81fc4968f024f7d7b89c6a778866bf1bff98d770686569e4752a473c0adfad4d4099cceda84da3cac3

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU3FF2.tmp\msedgeupdateres_hr.dll

Filesize
29KB

MD5
c09876a180731c172fa2532f8be90a3d

SHA1
4359c7840ddb23142a40aff85129b9920360e954

SHA256
50fd548ea12e2b72fc563bc082b870a89a523e8b3a4a0e9b65fe673384da2b58

SHA512
91cee1b10fc12a01a2a285e67dba583d6f1bee0716cc89103fee0c7d0f52fadc0f9ac5b13e833834e7279963726950d3897847e7acac61857257fc031692033e

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU3FF2.tmp\msedgeupdateres_hu.dll

Filesize
29KB

MD5
ee19156c12d2d7cce9b12e515f9ac6c5

SHA1
19ad46e40b3c1cb6195231bfcf45bb68ee1b43bf

SHA256
c290883b4b99758792284755efa52c12eb09039f0f8027d8ba3b1d4bb2f3846f

SHA512
631364472a450519ad8959971d6c319610570ca37b4486ea12d6af5b46aaecbf336aadddd1f3fefba841534ff82adf905b1e1a008638ed784bf08870a3b86ee1

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU3FF2.tmp\msedgeupdateres_id.dll

Filesize
28KB

MD5
eacd4638369bf96ccc7c23af37e15b5d

SHA1
15c4878b78c06095981abcc589c4a6f265ef96a3

SHA256
a53c0fd74995090dbf48bbba4a00560e3cc344ce8120b8b2bfa1f9b953b536ef

SHA512
19cc8d25bd8fd84481f77d301f79636208df5807647ddc6cb6beff3882d94672db49daa4ddfff0c334b584742f9d2fea3af73977032d7dfccd0cfd1314af4ae6

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU3FF2.tmp\msedgeupdateres_is.dll

Filesize
28KB

MD5
19d44de8f930e07f41f9343478ed5c1d

SHA1
83ee0c5a86997dd491bd8312d221dde2b2e7d44a

SHA256
69d3a21b7723e4df8b7b97e39493081e41231e2d3a3f5a4de462db41339987ec

SHA512
4edb82aedfeca743a03815a889eca766fec8083afd0defa098593297a52edaf1780dbd5ad1d3325c614d815d34d8c57ec2283a0db215f94f42819f1890089c4a

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU3FF2.tmp\msedgeupdateres_it.dll

Filesize
30KB

MD5
26cbb965c6976f59ac385ef9408bf81a

SHA1
16bb0530338e600fdfd13a7b03523a715e633bcb

SHA256
bed996b25f77c7d4328d96147ed388f1b457abfc0510eb8956be4339d103821a

SHA512
1efb1bdf0276de17f8516cde4d435e0be8fd066f52fb5d4c9e2fe2e17a135296ab6b34f523284941beae438e97d7e65de26f0541b7c437bceff229b60da4bb0d

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU3FF2.tmp\msedgeupdateres_iw.dll

Filesize
25KB

MD5
98f79d77ab05304bba8d60e50914418f

SHA1
957590adc0f8a7274e765e2a804c1de7c76e3040

SHA256
3764941b873ed59d5bc1097f6b9382ba59c06d443a96ff71ba6b693f161da522

SHA512
9ca6af5c14193dce7b50251f1b9205870435e60b5495ab1a9f0d42ca14b98b78fef51bf3cd4165394ca5ba28d0e98bea7642ec67039c0f146383136145c7de59

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU3FF2.tmp\msedgeupdateres_ja.dll

Filesize
24KB

MD5
b89ba9ecc6d4c77abff61b1c75fff16c

SHA1
f381408f26be2c77c7b59681ad6280a701ccb472

SHA256
bbd2c970f747a6ee8e4735939225f607ae630ddc6e2e39954e0300ca9a7a88b2

SHA512
53a3db82f4cf5a300a5eab7692f4084451b987ad72ae24d9118d80f18692ac3604981c0e871c7a7625c5153803aea0e093d91822d33af0c10a07bcb6e766a5b6

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU3FF2.tmp\msedgeupdateres_ka.dll

Filesize
29KB

MD5
d464fd223ba898e6fef4e485a3118394

SHA1
59c78983ce859485fea5458ba4e7803c38012b9d

SHA256
066c5c4b4c87ffd201d0dbfc43cb7566cfb03a6ed2fbf8698220fb919637294d

SHA512
6ac1d5fc59e6b7a10532902b059ac25a2bf58b0a63ab586e89b293e2de732c1d5d580c75ff28e4a2660a6ee3f0389f49e388567bcc07dd6e1cfd5d019db3ea52

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU3FF2.tmp\msedgeupdateres_kk.dll

Filesize
28KB

MD5
1b1202fc3e46d7b46ce3cb46cdc5ab21

SHA1
e76d1065035d86eef011feb3cad3ac38eecd0b7d

SHA256
b660a0e1d5161765881e0a7fd9d714abce341403b21f63667ffdedf7d5a254d0

SHA512
7f11d5d6995f27bb4f8705ac7310273f070a71adc73cdb70d74766c89437b3e7a10453fc55588ac223fe3b449564758a49380168d779fdb6a4fac3b5cde767ea

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU3FF2.tmp\msedgeupdateres_km.dll

Filesize
27KB

MD5
126036b98853a9d31937f874484dcb83

SHA1
27ffb8f3f6e966c3b79824357e79eac4ec8ce0a7

SHA256
90908e9108adcb0b4df84e4fbd9724e5e7a2d2eb54720fe49f37bdce977be635

SHA512
b384657e0ca90270b96cb724aa55c52f5c8b569fdb1a7ee7085c18d6822c39fc81a490128bd42d0aec1c0ddac1853e30718710968f5921a5331211bd33e89316

Download Submit
C:\Program Files\H2M Launcher\H2M Launcher.exe

Filesize
19.6MB

MD5
de148ba4e3c67336dbee582c1b68dd70

SHA1
a5e501224175765fcf1ba441b3512ebfc61589ec

SHA256
16504570dcda898c8aa2e01cde8f3f262a189b9b2c5594ef260c54786afc3cdb

SHA512
b1055a829119bc84b400fdc13b158115f93d2acee1b5bdd653ee867f51097326021b85cdad0e311e89125edc3dbd82cc066d08e6f7c3fc33c30b5ab511f5da83

Download Submit
C:\Program Files\MsEdgeCrashpad\settings.dat

Filesize
280B

MD5
f895244aee856c3b88c4253669d352ab

SHA1
7a8dd788ba1e13e7fe9bacd6c7a554ec63bbf26b

SHA256
0c380962b5a60bb4f1caf07a4c40dc420818386b3b57cd43a246fd7cf55a97c4

SHA512
94fac64e6652a24d941b7d23911e916e8e993810203b062159d58a65b6d6401dafe7f1da1fbdefd68ece3fbbc6e7b9840e142ef30b131c1cd4e6bea2ab4315b3

Download Submit
C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log

Filesize
67KB

MD5
1c95c2e13c545b46f86713d2bf6666fc

SHA1
cd6e2245c75c87e84484e0b7e1891edaf954b762

SHA256
85f06c239d6139e26b56a34b367407ab44be052c16e1d0b7992bc5146eb3af2f

SHA512
b44b1f3ce4fed74d18ecc0c9025181fbeebe1e9e6fd53228435e1830d20912ea9b8f5bfe5f8f0e0fd8a489ee15dde1948501502718779d088437d12e89e69c99

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\H2M Launcher\H2M Launcher.lnk

Filesize
2KB

MD5
ce120b4f0447bbd8c8613e4299c9b185

SHA1
82fdbd4590b9340bc3ecbeff876870cfc4c0da95

SHA256
6ec271e0907baf5ee968602b5d94834f4ad3a98f9a08e818b762fc5342859c3a

SHA512
354dfc3c6e9bebba69e5098cf758aad0f206f2128305ff6b71f67615e8acf1d2b8cb82953669b5a02b9f9a705cd6c5d2db0bfc426b7deb8d3721bfeace541e31

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\H2M Launcher\H2M Launcher.lnk~RFe582f48.TMP

Filesize
1KB

MD5
5391402e7e4c0df710464b2ffe352780

SHA1
a0731e5d30bd12dc79d185fb9a98e970131788ec

SHA256
101c36f19929191e34b3abcb671894939947fac0327bf5555c2c5aa7cf4e0dce

SHA512
0e08b2b709d3e3f137730456f1c05f1d98b868661ab60c015b2e8077d52d5e9df944afdd4d8f4587aef5b6e905737d66778bed265a717a96bb2df60e03c326a7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
8d52f1048b661724539f395539fd7e3d

SHA1
a5fbe9d992bd21b675a279476bcb42a8ed053d05

SHA256
7ba0ad348383e2434965638ee4188c251511c9f7b91bed38e789ef4514adbde9

SHA512
3296ebdf6d4c43f2659f663b9d447b675bb90b39ef9df7d4a9beefa1f7234788676bfb20aaa8c3dfa047ffb7170a4a8aab6af7d4a4ac952654f9efc377e9b52b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
8bbd71fafce54bc7eb66f38206628024

SHA1
25c134048c8eee6390af1ca446ee00f5de6994ef

SHA256
46f9b25603bf7628e45546625d53f2197af17006f206f139241cacccd721c796

SHA512
527f758cdeef6f81f2f643b7fa9405df78caefe2df0d16d262e12d5a07340396bc1c341aebf1ef50e82e2429e8548db438ebd24a023684b652cca3214773964c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
5KB

MD5
18c88a92f697d009d1ce8606262808ac

SHA1
1098d7c8b3298a582a08cef0f9aba7f10745294e

SHA256
7ee15248f71e6293de8df08abbd36bfa6f2a96470f19c69413744bd430ed64ba

SHA512
13c2b76b3a31b684a64ee367e69eef2838deb854d358a9ab7ba6d9aa98638e0ce35aca09392b0486c7e7b81327f72cbd1e88461dfe3bdbcfcad4ae1bfcaa8ad7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
6KB

MD5
6b08eee70a538905383f5b9e556e20a8

SHA1
6cba03b294bbea7e004c15837d81ad0a73154f96

SHA256
c87c5093e22914be56ff813f2bd03378faecbc2ba430723978139c915bd21f82

SHA512
0c1426175873c42ace1a50d3d4d0626f3d126453dd7da44544eb9fcd5a6ba3255c8b163139fade9d2799cd28e4afcbdf09c06441b1c2ed001340a36e49900af9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
859B

MD5
c7c1e69aab32ac3f55b9a2d681285fbb

SHA1
5a096c8453bc2113220b0b429326b07596968895

SHA256
f4c3026a035a95e7210980fbcad20a2c8444e408e77c9a094ef860b828472f35

SHA512
3b1f6ebb3659414ab17ae07210f891e676889932061313c2e72229099acf378a3380bc33699009161219ede04b45ed60025df8de83a65a7bcc3325dba72d7142

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
63951a1954c669021c1d691083aabe8d

SHA1
8f7c4f6c199497060a03f97b2dc1253d3052d3da

SHA256
4cfe45cb0f3a2e9338ef594f7211bcfc417a4dfb184bc9d69df72845efaa3393

SHA512
b5788861bd930e6aafb4a22c00fc58d97af6b6a4e6b6a0d1075c4dc5ea8126d62077b7fd749b901fcf2b1008482d6c85716e1637fa9be5a2bf7c4abc19d5e268

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
d2818beb92dc29fae26abe5f8438c641

SHA1
e2c96c0bd2b72593e05a7fdd77a91e4af72d1ac0

SHA256
95d5e5840510c664416d74886765e9fb3a36809b8c5e588cab50b8b9c114d848

SHA512
ee960634a08d4b48bfcf10292903ca3628ded2fa1f4d68c5ac2e2d6136b852b81cd63d7a3744529a66cabf1c0688a1597e18e81a21e83ac2a54f5d9e619dae7e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
72ab7faadc6cdf40eed42c8f60fc05cb

SHA1
6f1e44acd5d0d501d5ddd4bfe6342246a7b6e696

SHA256
a47384d41f24c14d2af94efa93285c231c2bf557d932088eb5eb7d542af5954d

SHA512
628a5400ac7dee8278962d3245384e8006fce90f915fc406f03abce7940ccee28474ada0fccd5999c4bf7b1527da5e712f77bd063e5c4c9ee93ad94e6a5f608c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
32758dbd87d7bb155d67357a9ca0784a

SHA1
b2503eb4a171b19555e9e403c512569724b84633

SHA256
786100026b7c55f573a1ca8b7923003b3ad58eac39d7496e0901a1bb83489014

SHA512
cfae1e688ae971a6cce0942027453464ab4bc9efd57deffa6cd357a351cb05dd0132f12a1a1145fe5c169d448539139214639fba083175c8be9f83bb4c72a95b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
cbfd031d14e10efcf92d808ce213c61a

SHA1
ec8c4a856430ae829b2cec70a15ef83fc040c7c6

SHA256
4e8a00e843135505480928f32195019915b45d8cf813fa1f80c3e56712792702

SHA512
d3943b805a3509d56cd2995fc31985a08c56a59032f878b12e71734aca4b7e95d7126353e0244837c2e4d147d1a146c7131b32f7baeef9af31a992dbc9fb81ab

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
9a9c0fc5d47623720ce8ccdb9b7dd5c5

SHA1
40a7048c8befc50a9b63a1d1c437f5d4559f0df6

SHA256
98a3ee588c1a2f285258341d64c89a72e50925c8fce0d167a8924979e5d452a5

SHA512
a87e1a6dd132f7d6de53802c17305a4211de2af3ded839bded8cd2096a60a71f0ee65a211e7e0b40984ef17982d50079b3541b9af940b2e04c765822b42abf55

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
51a85fe712564bb782877e698be29a8c

SHA1
43021aa8e9221957a8cfb7c9ad79b4e045f5cafb

SHA256
33552db57098eb36ed844ab76b158af89db9518130e80dc4e905b9b2853d542a

SHA512
0b85eede134b5de12008387ad67e58bedda39ef7e41cc6c3910dd16501308460b2165c223d2fbe81cc33d8d00c562d4e4c9a884aa70968fb14a96293ecc8d874

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
a261bb905559d7205c2ad14a7b3c69e5

SHA1
1ba0340f3d548b21a942bcac165a51187e36941f

SHA256
19ea64f70f47c7929020f2f4197d493183a3e366c7877068a59feeb37835152f

SHA512
8bce3d69aaaf72957dc801b072112183cffbd3ccf17c0cf700edf4d4a7381aba681c1a1be7bb4a223b3c261b57a77b88edbdac3a177b02acf5e0acbec7c55a56

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
63796f7ce51150cf269164f31fb5bc5d

SHA1
cba93f4c1df6169ec17bbcb74e5a186841daf745

SHA256
474fd52d99661a04b46804d66550522cdf8ccd4fbf1f0a7567c15e7245b450ae

SHA512
d37acd87244f4e672908410859286c55b4c6775ef8f9551cd32454b0581f858a00f3fb43d5599d36a142bbc4d3ccae78aa3840268ae38b4e94eb30e58f0feda0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
1085a1550d6acd886a301a3e156bc46a

SHA1
43490cffb0b53518c62eedf4e5e3b9e904e0a889

SHA256
0088e35f7f9bc5e9003a23a2cd2e7a0e8fcb90768d85c0fbfbc2744bb9ef17e2

SHA512
737d19ab8770e48b1c58fa0e69557d0002aea4bafbbab9b304c745e8cd95126336170e344267c878672e90bbbda5bf9cbb52d4297a7d4383e17c34c43d263ea7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
99KB

MD5
b6a40cdd06cbdcca4375ebc5fabf7902

SHA1
835a4e810f92346bde62bcf127a39f9f3ee80606

SHA256
7d6f19c3818298b558a7d1736f7f02af27daf5a3b1f09f34e8725e0d9b4797b8

SHA512
b39c25e6688ede17802ad963cc6aac1e5c5eee8dd7b630e3cb8a034d6a70b81267983e34c63a0bfb3c689a07c6c181bb7f7c5256c4c831059ad757866d092190

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
99KB

MD5
2b48c310b6f1c950d63be78fd4be6b45

SHA1
c94745326729fa570e7f660b92c56c22f4ac2109

SHA256
f83861188f733092e96251f98588a086da5af560a075cb0941a1e31d1b822df5

SHA512
3cd54eeac158fa700899001a66c39dbe579b0c5931b79c7b55ac0432d82ca53f23f57f58b5db7a62dbf7ae506dd23f2d20c6066dc5e5016d22855b342c5c851e

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIFA7D.tmp

Filesize
113KB

MD5
4fdd16752561cf585fed1506914d73e0

SHA1
f00023b9ae3c8ce5b7bb92f25011eaebe6f9d424

SHA256
aecd2d2fe766f6d439acc2bbf1346930ecc535012cf5ad7b3273d2875237b7e7

SHA512
3695e7eb1e35ec959243a91ab5b4454eb59aeef0f2699aa5de8e03de8fbb89f756a89130526da5c08815408cb700284a17936522ad2cad594c3e6e9d18a3f600

Download Submit
C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe

Filesize
1.6MB

MD5
45e5ca74b9ae3c3fc6f6a63c609783b6

SHA1
f36715bea96d69bb18075fac30b90502c6d2464b

SHA256
b4afd37b9087df7e041ae749fd0fa342926d9cce533bde9cdc4283132c3820a9

SHA512
014fd398d456fcb118dfd6b038b6f96008ca209d44d9707e175e85e7f14cfb3f2886deaed0d8ed25971813035e8dd7f88142c06972f3e2c9b4a534d84bec661a

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1cubcjfa.plm.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\app.h2m.lierrmm\EBWebView\Crashpad\settings.dat

Filesize
280B

MD5
eaf47e5ac5b48537dd735085260dbf8b

SHA1
4fbcc08c9b05edc514dd42af4f573e440577deac

SHA256
d25cb7e0edd2ece0a51ccec1891c11e9f7cca6eeeb73a4c3f0fc0dd4ab69ea8a

SHA512
dc78ac201e4f790e95d6f9a9943bd235c179fbb287bf2478b38c5d52266b1b4e8809954a43f65442ad6f0ae2a35f5ffe25a45d02738bd295a57d40b094806ad6

Download Submit
C:\Users\Admin\AppData\Local\app.h2m.lierrmm\EBWebView\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
7a639ba6e80b686ea14c8a091269e850

SHA1
867aa9f5cf3f660a5493ea9ccb9fade47f7c6d81

SHA256
ca02c976f125784288c2694887a317fc64521a58c7dd46c0193446950aa3f2a6

SHA512
b94775f7f21ed9bdc9b470bc659f8def614154772f63d645c2f7cbbf096b7bedb1720f50537e946afab0601cb60caec56eb4c7dcc654828d642b56b348659cef

Download Submit
C:\Users\Admin\AppData\Local\app.h2m.lierrmm\EBWebView\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
242259f2102a0ddd110aa692209fb383

SHA1
33ee99e3e036a68649e8a8a7bf99de63d99f56d6

SHA256
58d34563c8ae3473ba2d279cd94bad8530605dca993d3e7bfab6828c21e628d2

SHA512
8c6246ef0d00b9cc6c3d2797b110ce3fd69f58ffbcdce3eca4128d67a06a53b21db22106e8d935bf549bedf37aa5a7f940ab202d36b71cf19691aaf5a5be8b4c

Download Submit
C:\Users\Admin\AppData\Local\app.h2m.lierrmm\EBWebView\Default\Network\Network Persistent State

Filesize
593B

MD5
bc6a9024eb7e9cf9f648b951e6142b84

SHA1
df5d9cb9b664b935e24fd477cdc159d08461c62c

SHA256
c8e808924c6b5868b19e1f7243a52ca9f56f951bac5268c9e02c61b51fb64798

SHA512
b7fb75cdf6260265c56db3482abe66bb874907c2664864621c144ab2eb30c2ffbdff091664674f05551cf7a18b52a0f89da447e0376c0b000b4cde0b90b1dd12

Download Submit
C:\Users\Admin\AppData\Local\app.h2m.lierrmm\EBWebView\Default\Network\Network Persistent State~RFe5a2ada.TMP

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Users\Admin\AppData\Local\app.h2m.lierrmm\EBWebView\Default\Network\TransportSecurity

Filesize
355B

MD5
ea261919d17219835adacedb25b09519

SHA1
60830fd243b84091701ff851b62b9fcbb6289645

SHA256
f7548d5b4f4160ff400d23f0ba5981b1a60a40fd3cd61792bfb57111cad3bb80

SHA512
eb9e782a00bcfafe7bcd6c1cf84dadd3761e82e58ca6ab44be0f185b13a74fcc766f2538f1e50db025fc62cd96a204c69c4b50cba477ed7fe796576a21c76ba1

Download Submit
C:\Users\Admin\AppData\Local\app.h2m.lierrmm\EBWebView\Default\Network\TransportSecurity~RFe5a2ada.TMP

Filesize
355B

MD5
61e6d119d3fd966150c8a9256edfc9a1

SHA1
8735d76d70a169cfe5ff7eeabf29b33a50f98550

SHA256
3ad0bc74b49d6c3ba1fcd8b667d73605edaac32463a70b0c0d5a3425a39e8cde

SHA512
5c7cc3480d59fa6fb16c40afd4b85b96f07c13f8147562d3e775d1cc21eca6b0c189048f78980ab8599922d1766890292dceccf16692d50ad51bcc84f9dda6c2

Download Submit
C:\Users\Admin\AppData\Local\app.h2m.lierrmm\EBWebView\Default\Preferences

Filesize
6KB

MD5
37fd8699f4a2649963b44b718b986918

SHA1
d3256b6c98c0f99cb7822b974acf761c1b083b7a

SHA256
bc41961d6ff081a272ace7c2d0985a8f3ab7182869fb1e6f5cbbee1fdbdf3dbe

SHA512
5ebb490a22729d84b31e39584797bf38f9a65d5c3c95daa9ececa4bb85a46c1096b8884671c40d16ae6971a0f956a342fc98ac766c3856c46d2e34ae6d5bae3d

Download Submit
C:\Users\Admin\AppData\Local\app.h2m.lierrmm\EBWebView\Default\Preferences~RFe5a2aab.TMP

Filesize
6KB

MD5
deb41e7ad2768533b0fc9364e7df1db9

SHA1
6cdecaebd2e2c045bd90845f2fd034daa7d31fb3

SHA256
a542f78b1abf01feefee170866ad5d594105511604d5ea70e420c03c322ee1b9

SHA512
b538cd72e10b58d9f40c300c4c12ac8f26cb94cc3b40b294ca9c0be349521ddf53f1bfc21f9a5a19c67ece5dc188f33c5a7f3e2110a240279b22620cfe865012

Download Submit
C:\Users\Admin\AppData\Local\app.h2m.lierrmm\EBWebView\Default\Sync Data\LevelDB\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\app.h2m.lierrmm\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\app.h2m.lierrmm\EBWebView\GrShaderCache\data_0

Filesize
8KB

MD5
cf89d16bb9107c631daabf0c0ee58efb

SHA1
3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

SHA256
d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

SHA512
8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

Download Submit
C:\Users\Admin\AppData\Local\app.h2m.lierrmm\EBWebView\GrShaderCache\data_1

Filesize
264KB

MD5
d0d388f3865d0523e451d6ba0be34cc4

SHA1
8571c6a52aacc2747c048e3419e5657b74612995

SHA256
902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b

SHA512
376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17

Download Submit
C:\Users\Admin\AppData\Local\app.h2m.lierrmm\EBWebView\GrShaderCache\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Local\app.h2m.lierrmm\EBWebView\GrShaderCache\data_3

Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\AppData\Local\app.h2m.lierrmm\EBWebView\Local State

Filesize
2KB

MD5
2d1b1876758f3d73eecbba501c900701

SHA1
8c79a961422c3d49e9567dcbd149eaf4b3c248e6

SHA256
519a6998e79e1787a8245b54a98cd7f75bf27cb917f13962cbc39ce6ea56ecd5

SHA512
42e73266764cad932086009449b606a43c6e5b01889c94bdd817a81626d03de23512880100b58192e74ea227b3a16886cfc93dd9e7f9f7ecb8359785859ddb48

Download Submit
C:\Users\Admin\AppData\Local\app.h2m.lierrmm\EBWebView\Local State

Filesize
3KB

MD5
5523b51ad97328e0e6f42497a7ffe479

SHA1
82c55c01227b7f83863e1be78152e931c9241759

SHA256
b0a7391afa66288a2adf8d76402ea72bd919431ccdc568699053ab5af85e2248

SHA512
da8c6637fc85ea6693a1ae86debae1ed6f8f8f10697bf5fcab3409deb1ef84bd354c29e7b738a4bdfc212124ed47b64c313b52d004c3e7143d8b3ce9b82756a4

Download Submit
C:\Users\Admin\AppData\Local\app.h2m.lierrmm\EBWebView\Local State

Filesize
16KB

MD5
8cfc20bb7c71f93ebad103f624c0313a

SHA1
fdee573eeca70e16d64eae5b0b7e58676f733e60

SHA256
83ea6b57f06070e357fb354fee89b912edf697a7090e44655cd0c489b1bdb744

SHA512
afdf9ba8de1a86ad2e62e95ae0573eddb3b786daaba92a7a41b1be7c22ab408c6426ea8dbc5fc72539263611409dad9922ec937345d88d0b3ea29a01e6a89643

Download Submit
C:\Users\Admin\AppData\Local\app.h2m.lierrmm\EBWebView\Local State

Filesize
16KB

MD5
e918f6867bd1b5b07dd788ea7af0faf5

SHA1
11f4117a53e58341e0ba6bab171b53f2252050f9

SHA256
206b0e3f0eec7fd6b3b7800b64aaa525d1d4dca61565d129759e51bbd44161e0

SHA512
30d6737b8cd9d42426c841a742db2abfb60021e8cdc540100a6f46027795fd4dc9ff7fe32eb121a5667e15ad9bb4e4e105508be06c5004ff5ce8d35019527e26

Download Submit
C:\Users\Admin\AppData\Local\app.h2m.lierrmm\EBWebView\Local State

Filesize
1KB

MD5
374c478b153251a454cf5e83ad06fa04

SHA1
5f4ef0aacb817d0c52d53fd8ec03480705cbfe28

SHA256
987bc049a0f3e381738937fac03e63f7f6a96261b78d25fdcc25508d88a93884

SHA512
92a5359ddaa367980bd48f19d24100ed85959a04d4286dcc2ca8b0ddc7b0921fe3a8ca0069c3cff5fdf014a710498a73fafd42c46b2715bddbed8dc58a66b442

Download Submit
C:\Users\Admin\AppData\Local\app.h2m.lierrmm\EBWebView\Local State~RFe59c848.TMP

Filesize
1KB

MD5
3681e1708ed68ed0f934eb11c04817f2

SHA1
2f53574ba8bf1431f26c6f1e067ade9aa2aa79a7

SHA256
e27fccb4192d7dd6d914eb7f8af278a15c159bfa5bc0e37d1265b17a36a329e3

SHA512
341b8e16440ffb47b938b89b0525cd07bc68f0172765dcbce468dedf2097d6be32d13714f45a5a155cb9fd70a80cfa02754eb999df39d2063215e51352b93cb4

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 314859.crdownload

Filesize
9.7MB

MD5
8d970001c7e13b7e3cc4fd3a025a1770

SHA1
38c1252823985eb212e2a8bfdaed2df2d555b67d

SHA256
6659e4a6a0327dfa5d2580ca37b3e628fb4adf9031c107e3209cad1d9b29e711

SHA512
cfcf12f9454cdca50ad9fa6f151f125cb4b74afff19d603429b7e773c1046d6fd72992fcaa01ff20c4d6088b5a19c7e44680a7354fb8205dec556471f2d4c486

Download Submit
memory/3012-541-0x00007FFFF8E00000-0x00007FFFF8E01000-memory.dmp

Filesize
4KB

Download
memory/3012-542-0x00007FFFFA120000-0x00007FFFFA121000-memory.dmp

Filesize
4KB

Download
memory/3516-582-0x00007FFFF8BD0000-0x00007FFFF8BD1000-memory.dmp

Filesize
4KB

Download
memory/5040-521-0x00007FFFF8BD0000-0x00007FFFF8BD1000-memory.dmp

Filesize
4KB

Download
memory/5220-389-0x0000000073F80000-0x00000000741A5000-memory.dmp

Filesize
2.1MB

Download
memory/5220-492-0x0000000000380000-0x00000000003B5000-memory.dmp

Filesize
212KB

Download
memory/5220-358-0x0000000000380000-0x00000000003B5000-memory.dmp

Filesize
212KB

Download
memory/5220-359-0x0000000073F80000-0x00000000741A5000-memory.dmp

Filesize
2.1MB

Download
memory/5324-158-0x00000226F63E0000-0x00000226F6402000-memory.dmp

Filesize
136KB

Download