hxxps://drive[.]google[.]com/file/d/1izFwLy36KaJbhGLUUDZmcBIjsUn27oY1/view

Resubmissions

30-08-2024 22:51

240830-2sz27s1enp 7

30-08-2024 22:51

240830-2swpsa1aqa 1

Analysis

max time kernel
696s
max time network
408s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
30-08-2024 22:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1izFwLy36KaJbhGLUUDZmcBIjsUn27oY1/view

Score

7^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation	Install Resolve 19.0b.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 6 IoCs

pid	Process
3816	Install Resolve 19.0b.exe
628	SetupResolve.exe
3252	vcredist_x64_vc12.exe
2256	vcredist_x64_vc12.exe
5900	vcredist_x86_vc12.exe
5352	vcredist_x86_vc12.exe

Loads dropped DLL 15 IoCs

pid	Process
2256	vcredist_x64_vc12.exe
3752	vcredist_x64.exe
5352	vcredist_x86_vc12.exe
6128	vcredist_x86.exe
3828	MsiExec.exe
5544	MsiExec.exe
3168	MsiExec.exe
3168	MsiExec.exe
3168	MsiExec.exe
4052	MsiExec.exe
2804	MsiExec.exe
5544	MsiExec.exe
3128	regsvr32.exe
6140	regsvr32.exe
5776	MsiExec.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7} = "\"C:\\ProgramData\\Package Cache\\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\\vcredist_x64.exe\" /burn.runonce"	vcredist_x64_vc12.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{9dff3540-fc85-4ed5-ac84-9e3c7fd8bece} = "\"C:\\ProgramData\\Package Cache\\{9dff3540-fc85-4ed5-ac84-9e3c7fd8bece}\\vcredist_x86.exe\" /burn.runonce"	vcredist_x86_vc12.exe

Blocklisted process makes network request 3 IoCs

flow	pid	Process
286	5704	msiexec.exe
287	5704	msiexec.exe
288	3640	msiexec.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs

Web Service

T1102

flow	ioc
4	drive.google.com
7	drive.google.com
157	discord.com
158	discord.com
159	discord.com

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\mfc120enu.dll	msiexec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{ab55316a-a7b5-184b-b11e-a35fcac72d60}\DaVinciPanels.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{ab55316a-a7b5-184b-b11e-a35fcac72d60}\SETE1B.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\fairlightpanels.inf_amd64_9224ba1890805180\FairlightPanels.cat	DrvInst.exe
File opened for modification	C:\Windows\system32\concrt140.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_2.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_codecvt_ids.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc120deu.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc120chs.dll	msiexec.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\davincipanels.inf_amd64_66a4cb7e2ba2bb0c\DaVinciPanels.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{82c015f6-385b-2549-833a-9e7ce5eaee93}\DaVinciKeyboards.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{b5271e53-9d7c-2b49-b653-6c25394ba434}\SET1175.tmp	DrvInst.exe
File created	C:\Windows\system32\mfc140u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc120ita.dll	msiexec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\davincipanels.inf_amd64_66a4cb7e2ba2bb0c\DaVinciPanels.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\Temp\{82c015f6-385b-2549-833a-9e7ce5eaee93}\SET104B.tmp	DrvInst.exe
File opened for modification	C:\Windows\SysWOW64\mfc120fra.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc120deu.dll	msiexec.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File created	C:\Windows\system32\vcomp120.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vcomp120.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc120cht.dll	msiexec.exe
File created	C:\Windows\System32\DriverStore\Temp\{82c015f6-385b-2549-833a-9e7ce5eaee93}\SET104C.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{82c015f6-385b-2549-833a-9e7ce5eaee93}\DaVinciKeyboards.inf	DrvInst.exe
File opened for modification	C:\Windows\system32\vcruntime140_1.dll	msiexec.exe
File created	C:\Windows\system32\vccorlib140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc120kor.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc120.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc120esn.dll	msiexec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{ab55316a-a7b5-184b-b11e-a35fcac72d60}\SETE09.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{b5271e53-9d7c-2b49-b653-6c25394ba434}\SET1176.tmp	DrvInst.exe
File created	C:\Windows\system32\mfc120.dll	msiexec.exe
File created	C:\Windows\system32\msvcp120.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfcm120.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc120enu.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfcm120.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcamp120.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc120.dll	msiexec.exe
File created	C:\Windows\system32\mfc120kor.dll	msiexec.exe
File created	C:\Windows\system32\msvcr120.dll	msiexec.exe
File created	C:\Windows\system32\mfc120esn.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc120esn.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc120u.dll	msiexec.exe
File created	C:\Windows\System32\DriverStore\Temp\{b5271e53-9d7c-2b49-b653-6c25394ba434}\SET1164.tmp	DrvInst.exe
File opened for modification	C:\Windows\system32\mfc140.dll	msiexec.exe
File created	C:\Windows\system32\vcamp120.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc120kor.dll	msiexec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{82c015f6-385b-2549-833a-9e7ce5eaee93}\SET104B.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{82c015f6-385b-2549-833a-9e7ce5eaee93}	DrvInst.exe
File created	C:\Windows\SysWOW64\mfc120jpn.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vccorlib120.dll	msiexec.exe
File created	C:\Windows\system32\vccorlib120.dll	msiexec.exe
File created	C:\Windows\system32\mfc120chs.dll	msiexec.exe
File created	C:\Windows\system32\mfc120ita.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc120kor.dll	msiexec.exe
File created	C:\Windows\System32\DriverStore\Temp\{b5271e53-9d7c-2b49-b653-6c25394ba434}\SET1175.tmp	DrvInst.exe
File opened for modification	C:\Windows\system32\msvcr120.dll	msiexec.exe
File created	C:\Windows\system32\concrt140.dll	msiexec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{b5271e53-9d7c-2b49-b653-6c25394ba434}\SET1176.tmp	DrvInst.exe
File opened for modification	C:\Windows\SysWOW64\mfc120u.dll	msiexec.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\davincikeyboards.inf_amd64_f35b77cd5821e0e8\DaVinciKeyboards.cat	DrvInst.exe
File created	C:\Windows\system32\mfc120enu.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc120chs.dll	msiexec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{b5271e53-9d7c-2b49-b653-6c25394ba434}\FairlightPanels.sys	DrvInst.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\Fairlight Studio Utility\styles\qwindowsvistastyle.dll	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\Fairlight Studio Utility\qml\QtQuick\Controls\Material\ScrollBar.qml	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\Fairlight Studio Utility\qml\QtQuick\Controls\Windows\Slider.qml	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\Fairlight Studio Utility\qml\QtQuick\Particles\particlesplugin.dll	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\Fairlight Studio Utility\qml\QtQuick\Controls\Fusion\SelectionRectangle.qml	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\Fairlight Studio Utility\qml\QtQuick\Dialogs\quickimpl\qml\+Fusion\FolderDialog.qml	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\Fairlight Studio Utility\qml\QtQuick\Controls\Fusion\ScrollView.qml	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\Fairlight Studio Utility\qml\QtQuick\Controls\Material\TreeViewDelegate.qml	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\Fairlight Studio Utility\qml\QtQuick\Controls\Basic\CalendarModel.qml	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\Fairlight Studio Utility\networkinformation\qnetworklistmanager.dll	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\Fairlight Studio Utility\qml\QtQuick\Timeline\plugins.qmltypes	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\Fairlight Studio Utility\qml\QtQuick\Controls\Imagine\ScrollIndicator.qml	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\DriverUsb\DaVinciKeyboards\DaVinciKeyboards.cat	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\Fairlight Studio Utility\qml\QtQuick\Controls\Universal\Pane.qml	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\Fairlight Studio Utility\qml\QtQuick\Controls\Universal\VerticalHeaderView.qml	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\Fairlight Studio Utility\qml\QtQuick\Particles\plugins.qmltypes	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\Fairlight Studio Utility\qml\QtQuick\Controls\Universal\Page.qml	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\Fairlight Studio Utility\qml\QtQuick\Dialogs\quickimpl\qml\+Fusion\ColorDialog.qml	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\Fairlight Studio Utility\Qt6QuickControls2.dll	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\Blackmagic RAW\Blackmagic RAW Speed Test\PlugIns\iconengines\qsvgicon.dll	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\Setup Utility\Qt6WebEngineWidgets.dll	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\Setup Utility\AdminUtility\PlugIns\Fairlight Panels\Resources\data-be19.bin	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\Fairlight Studio Utility\qml\QtQuick\Dialogs\quickimpl\qml\+Universal\FileDialog.qml	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\Fairlight Studio Utility\qml\QtQuick\Controls\Material\Menu.qml	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\Fairlight Studio Utility\qml\QtQuick\Controls\Basic\StackView.qml	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\Fairlight Studio Utility\qml\QtQml\XmlListModel\qmlxmllistmodelplugin.dll	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\Fairlight Studio Utility\qml\QtQuick\Controls\Basic\CheckBox.qml	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\Fairlight Studio Utility\qml\QtQuick\tooling\Module.qml	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\Fairlight Studio Utility\qml\QtQuick\Controls\Universal\BusyIndicator.qml	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\Fairlight Studio Utility\qml\QtQuick\Dialogs\quickimpl\plugins.qmltypes	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\Fairlight Studio Utility\qml\QtQuick\Controls\Material\impl\RectangularGlow.qml	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\Fairlight Studio Utility\tls\qcertonlybackend.dll	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\Fairlight Studio Utility\qml\QtQuick\Pdf\+Universal\PdfStyle.qml	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\Fairlight Studio Utility\Qt6OpenGL.dll	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\Fairlight Studio Utility\qml\QtQuick\Controls\Fusion\MenuBarItem.qml	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\Setup Utility\PlugIns\imageformats\qjpeg.dll	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\Fairlight Studio Utility\qml\QtQuick\Controls\Material\ComboBox.qml	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\Fairlight Studio Utility\qml\QtQuick\Controls\Universal\DelayButton.qml	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\Fairlight Studio Utility\qml\QtQuick\Controls\Universal\impl\SwitchIndicator.qml	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\Fairlight Studio Utility\qml\QtQml\Models\qmldir	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\Fairlight Studio Utility\qml\QtQuick\Controls\Windows\ProgressBar.qml	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\Fairlight Studio Utility\qml\QtQuick\Controls\Imagine\ToolTip.qml	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\Fairlight Studio Utility\qml\QtQuick\Dialogs\quickimpl\qml\+Imagine\FolderBreadcrumbBar.qml	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\Setup Utility\AdminUtility\PlugIns\Fairlight Panels\Resources\data-be0b.bin	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\Fairlight Studio Utility\qml\QtQuick\Dialogs\quickimpl\qml\+Material\MessageDialog.qml	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\Fairlight Studio Utility\qml\QtQuick\Controls\Imagine\SwitchDelegate.qml	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\Fairlight Studio Utility\qml\QtQuick\Controls\Imagine\PageIndicator.qml	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\Fairlight Studio Utility\qml\QtQuick\Controls\Universal\Drawer.qml	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\Blackmagic RAW\Blackmagic RAW Player\PlugIns\imageformats\qtiff.dll	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\Fairlight Studio Utility\qml\QtQuick\Controls\Universal\ScrollBar.qml	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\Fairlight Studio Utility\qml\QtQuick\Controls\Basic\TextField.qml	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\Setup Utility\AdminUtility\PlugIns\DaVinci Resolve Panels\DaVinciPanelsPlugin.dll	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\Setup Utility\AdminUtility\PlugIns\DaVinci Resolve Keyboards\DaVinciKeyboards.dll	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\Fairlight Studio Utility\qml\QtQuick\Controls\Universal\TextArea.qml	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\Fairlight Studio Utility\imageformats\qwebp.dll	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\Fairlight Studio Utility\qml\QtQuick\tooling\qmldir	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\Fairlight Studio Utility\qml\QtQuick\Controls\Material\Popup.qml	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\Fairlight Studio Utility\qml\QtQuick\Dialogs\quickimpl\qml\+Material\ColorDialog.qml	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\Fairlight Studio Utility\qml\QtQuick\Pdf\PdfScrollablePageView.qml	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\Fairlight Studio Utility\qml\QtQuick\Dialogs\quickimpl\qml\+Fusion\FolderDialogDelegate.qml	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\Fairlight Studio Utility\qml\QtQuick\Controls\Windows\SelectionRectangle.qml	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\Setup Utility\Resources\About_Icon.png	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\Fairlight Studio Utility\Qt6Pdf.dll	msiexec.exe
File created	C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\Fairlight Studio Utility\qml\QtQuick\Controls\Material\RadioDelegate.qml	msiexec.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\44DB0475D85BA123FA0CD6D35465DDC6\12.0.40660\F_CENTRAL_mfc120deu_x64	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\8520DAD7C5154DD39846DB1714990E7F\12.0.40660\F_CENTRAL_mfc120chs_x86	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\8520DAD7C5154DD39846DB1714990E7F\12.0.40660\F_CENTRAL_mfc120ita_x86	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\8520DAD7C5154DD39846DB1714990E7F\12.0.40660\F_CENTRAL_mfc120jpn_x86	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\FA027358EB1840B479003FA25093716B\4.2.0\concrt140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\94AC9373F297F1F4B96724FDBBEB2DE7\2.3.0\msvcp140.dll.F1670FCA_6780_3657_9C04_AF8005AC8143	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\FA027358EB1840B479003FA25093716B\4.2.0\vcruntime140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File created	C:\Windows\Installer\e60a669.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\8520DAD7C5154DD39846DB1714990E7F\12.0.40660\F_CENTRAL_mfc120kor_x86	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\94AC9373F297F1F4B96724FDBBEB2DE7\2.3.0\mfc140u.dll.F1670FCA_6780_3657_9C04_AF8005AC8143	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\94AC9373F297F1F4B96724FDBBEB2DE7\2.3.0\mfcm140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\94AC9373F297F1F4B96724FDBBEB2DE7\2.3.0\msvcp140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\CE6380BC270BD863282B3D74B09F7570\12.0.40660\F_CENTRAL_msvcr120_x64	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\44DB0475D85BA123FA0CD6D35465DDC6\12.0.40660\F_CENTRAL_mfcm120_x64	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\FA027358EB1840B479003FA25093716B\4.2.0\msvcp140_1.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\8520DAD7C5154DD39846DB1714990E7F\12.0.40660\F_CENTRAL_mfcm120u_x86	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\94AC9373F297F1F4B96724FDBBEB2DE7\2.3.0\mfcm140u.dll.F1670FCA_6780_3657_9C04_AF8005AC8143	msiexec.exe
File created	C:\Windows\Installer\e60a6cb.msi	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\FA027358EB1840B479003FA25093716B\4.2.0\msvcp140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\44DB0475D85BA123FA0CD6D35465DDC6\12.0.40660\F_CENTRAL_mfc120ita_x64	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\8520DAD7C5154DD39846DB1714990E7F\12.0.40660\F_CENTRAL_mfc120esn_x86	msiexec.exe
File created	C:\Windows\Installer\e60a6b3.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\94AC9373F297F1F4B96724FDBBEB2DE7\2.3.0\vcruntime140_1.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\44DB0475D85BA123FA0CD6D35465DDC6\12.0.40660\F_CENTRAL_mfc120fra_x64	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\12B8D03ED28D112328CCF0A0D541598E\12.0.40660\F_CENTRAL_vcamp120_x86	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\8520DAD7C5154DD39846DB1714990E7F\12.0.40660\F_CENTRAL_mfc120enu_x86	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\8520DAD7C5154DD39846DB1714990E7F\12.0.40660\F_CENTRAL_mfcm120_x86	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\94AC9373F297F1F4B96724FDBBEB2DE7\2.3.0\mfc140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\12B8D03ED28D112328CCF0A0D541598E\12.0.40660\F_CENTRAL_vcamp120_x86	msiexec.exe
File created	C:\Windows\Installer\e60a6c6.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\94AC9373F297F1F4B96724FDBBEB2DE7\2.3.0\msvcp140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File opened for modification	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\44DB0475D85BA123FA0CD6D35465DDC6\12.0.40660\F_CENTRAL_mfc120rus_x64	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\FA027358EB1840B479003FA25093716B\4.2.0\msvcp140_1.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\CE6380BC270BD863282B3D74B09F7570\12.0.40660\F_CENTRAL_vcomp120_x64	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\44DB0475D85BA123FA0CD6D35465DDC6\12.0.40660\F_CENTRAL_mfc120jpn_x64	msiexec.exe
File created	C:\Windows\Installer\e60a6a1.msi	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\8520DAD7C5154DD39846DB1714990E7F\12.0.40660\F_CENTRAL_mfc120cht_x86	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\FA027358EB1840B479003FA25093716B\4.2.0	msiexec.exe
File created	C:\Windows\Installer\SourceHash{53CF6934-A98D-3D84-9146-FC4EDF3D5641}	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\12B8D03ED28D112328CCF0A0D541598E\CacheSize.txt	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\8520DAD7C5154DD39846DB1714990E7F\12.0.40660\F_CENTRAL_mfc120deu_x86	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\FA027358EB1840B479003FA25093716B\4.2.0\msvcp140_2.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\94AC9373F297F1F4B96724FDBBEB2DE7\2.3.0\msvcp140_codecvt_ids.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\CE6380BC270BD863282B3D74B09F7570\12.0.40660\F_CENTRAL_msvcp120_x64	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\44DB0475D85BA123FA0CD6D35465DDC6	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\44DB0475D85BA123FA0CD6D35465DDC6\12.0.40660\F_CENTRAL_mfc120cht_x64	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC694.tmp	msiexec.exe
File created	C:\Windows\inf\oem4.inf	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSICA6E.tmp	msiexec.exe
File created	C:\Windows\Installer\e60a6dc.msi	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\8520DAD7C5154DD39846DB1714990E7F\12.0.40660\F_CENTRAL_mfc120u_x86	msiexec.exe
File created	C:\Windows\Installer\SourceHash{3739CA49-792F-4F1F-9B76-42DFBBBED27E}	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\94AC9373F297F1F4B96724FDBBEB2DE7\2.3.0\msvcp140_2.dll.F1670FCA_6780_3657_9C04_AF8005AC8143	msiexec.exe
File created	C:\Windows\Installer\e60a656.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\44DB0475D85BA123FA0CD6D35465DDC6\12.0.40660\F_CENTRAL_mfc120deu_x64	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\8520DAD7C5154DD39846DB1714990E7F\12.0.40660\F_CENTRAL_mfc120cht_x86	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\94AC9373F297F1F4B96724FDBBEB2DE7\2.3.0\mfcm140.dll.F1670FCA_6780_3657_9C04_AF8005AC8143	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI23E2.tmp	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\FA027358EB1840B479003FA25093716B\4.2.0\msvcp140_atomic_wait.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\12B8D03ED28D112328CCF0A0D541598E\12.0.40660\F_CENTRAL_vccorlib120_x86	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEC31.tmp	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x86_vc12.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x86_vc12.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SetupResolve.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x64_vc12.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x64_vc12.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	MsiExec.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000a2808484d8f468e90000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000a28084840000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900a2808484000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1da2808484000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000a280848400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2e\52C64B7E\@%SystemRoot%\System32\wuaueng.dll,-400 = "Windows Update"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2e\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2C	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2B	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2e\52C64B7E\@%SystemRoot%\system32\NgcRecovery.dll,-100 = "Windows Hello Recovery Key Encryption"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2e\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2f	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2e\52C64B7E	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2e\52C64B7E\@%SystemRoot%\System32\ci.dll,-100 = "Isolated User Mode (IUM)"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8520DAD7C5154DD39846DB1714990E7F\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_x86,v12\Dependents\{9dff3540-fc85-4ed5-ac84-9e3c7fd8bece}	vcredist_x86_vc12.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{61087a79-ac85-455c-934d-1fa22cc64f36}\Dependents	vcredist_x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sidecar\DefaultIcon\ = "C:\\Program Files (x86)\\Blackmagic Design\\Blackmagic RAW\\Blackmagic RAW Player\\BlackmagicRawAPI\\braw.ico"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AB297010A1550CA37AFEF0BA14653C28\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{010792BA-551A-3AC0-A7EF-0FAB4156C382}v12.0.40664\\packages\\vcRuntimeAdditional_amd64\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E0A6CCD2-5FC9-4574-84E3-733E3C6D8DA6}\InprocServer32\ThreadingModel = "Both"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E3CD0795-AC3B-49E2-A84B-C657653E907A}	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\94AC9373F297F1F4B96724FDBBEB2DE7\VCRedist	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FA027358EB1840B479003FA25093716B	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v12	vcredist_x64_vc12.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\44DB0475D85BA123FA0CD6D35465DDC6	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A12E3F89-76D7-4D2B-BEA0-DBC584030821}\ = "Fairlight Panel Information API, Blackmagic Design"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E3CD0795-AC3B-49E2-A84B-C657653E907A}\1.0\HELPDIR	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\94AC9373F297F1F4B96724FDBBEB2DE7\ProductIcon = "C:\\Windows\\Installer\\{3739CA49-792F-4F1F-9B76-42DFBBBED27E}\\Icon.ico"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.braw	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FA027358EB1840B479003FA25093716B\Version = "67239936"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4396FC35D89A48D31964CFE4FDD36514\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{53CF6934-A98D-3D84-9146-FC4EDF3D5641}v12.0.40664\\packages\\vcRuntimeMinimum_amd64\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4396FC35D89A48D31964CFE4FDD36514\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{53CF6934-A98D-3D84-9146-FC4EDF3D5641}v12.0.40664\\packages\\vcRuntimeMinimum_amd64\\"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}	vcredist_x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8520DAD7C5154DD39846DB1714990E7F\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7972974E-8597-4386-9CEC-017AA8474AF2}\1.0\0	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E3CD0795-AC3B-49E2-A84B-C657653E907A}\1.0\FLAGS\ = "0"	MsiExec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4396FC35D89A48D31964CFE4FDD36514\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{9dff3540-fc85-4ed5-ac84-9e3c7fd8bece}\Dependents	vcredist_x86_vc12.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D169104D02A37CA349B316935DDB94A0\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{D401961D-3A20-3AC7-943B-6139D5BD490A}v12.0.40664\\packages\\vcRuntimeAdditional_x86\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\94AC9373F297F1F4B96724FDBBEB2DE7\SourceList\Media\1 = ";"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AB297010A1550CA37AFEF0BA14653C28\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1BAD2218D4DE6763BBA0AC63186945E3\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v12\ = "{53CF6934-A98D-3D84-9146-FC4EDF3D5641}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4396FC35D89A48D31964CFE4FDD36514\Provider	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AB297010A1550CA37AFEF0BA14653C28\ProductName = "Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.40664"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AB297010A1550CA37AFEF0BA14653C28\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AB297010A1550CA37AFEF0BA14653C28\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FA027358EB1840B479003FA25093716B\ProductName = "Blackmagic RAW Common Components"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FA027358EB1840B479003FA25093716B\AdvertiseFlags = "388"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\44DB0475D85BA123FA0CD6D35465DDC6\SourceList	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\{EF6B00EC-13E1-4C25-9064-B2F383CB8412}\DEPENDENTS\{EF6B00EC-13E1-4C25-9064-B2F383CB8412}	vcredist_x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\Dependents	vcredist_x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1BAD2218D4DE6763BBA0AC63186945E3\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\94AC9373F297F1F4B96724FDBBEB2DE7\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\94AC9373F297F1F4B96724FDBBEB2DE7\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D169104D02A37CA349B316935DDB94A0\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D169104D02A37CA349B316935DDB94A0\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{D401961D-3A20-3AC7-943B-6139D5BD490A}v12.0.40664\\packages\\vcRuntimeAdditional_x86\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.braw	regsvr32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-656926755-4116854191-210765258-1000\{BE407659-C1C9-4950-8192-2F23AAC0D1FA}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4396FC35D89A48D31964CFE4FDD36514	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4396FC35D89A48D31964CFE4FDD36514\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AB297010A1550CA37AFEF0BA14653C28\PackageCode = "74D5311A10E26ED4BA915276E95C3DFC"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D169104D02A37CA349B316935DDB94A0\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AEFBE8A0-A809-460D-9230-1BBCBFDA8CCC}\InprocServer32\ = "C:\\Program Files (x86)\\Blackmagic Design\\DaVinci Control Panels\\API\\DaVinciPanelAPI64.dll"	MsiExec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}	vcredist_x64_vc12.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\Dependents	vcredist_x64_vc12.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4396FC35D89A48D31964CFE4FDD36514\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4396FC35D89A48D31964CFE4FDD36514\SourceList	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AB297010A1550CA37AFEF0BA14653C28\Clients = 3a0000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D169104D02A37CA349B316935DDB94A0\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7972974E-8597-4386-9CEC-017AA8474AF2}\1.0\ = "Blackmagic DaVinci Panel API Library"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E3CD0795-AC3B-49E2-A84B-C657653E907A}\1.0\0	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FA027358EB1840B479003FA25093716B\SourceList\PackageName = "Blackmagic RAW Player v4.2.0.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\ = "{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}"	vcredist_x64_vc12.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_x86,v12\Version = "12.0.40664"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\{61087A79-AC85-455C-934D-1FA22CC64F36}\DEPENDENTS\{61087A79-AC85-455C-934D-1FA22CC64F36}	vcredist_x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E3CD0795-AC3B-49E2-A84B-C657653E907A}\1.0\0\win64\ = "C:\\Program Files (x86)\\Blackmagic Design\\DaVinci Control Panels\\API\\FairlightPanelAPI.dll"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AEFBE8A0-A809-460D-9230-1BBCBFDA8CCC}\InprocServer32\ThreadingModel = "Both"	MsiExec.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
1500	msedge.exe
1500	msedge.exe
3656	msedge.exe
3656	msedge.exe
2352	identity_helper.exe
2352	identity_helper.exe
5580	msedge.exe
5580	msedge.exe
5580	msedge.exe
5580	msedge.exe
5864	msedge.exe
5864	msedge.exe
3260	msedge.exe
3260	msedge.exe
5704	msiexec.exe
5704	msiexec.exe
5704	msiexec.exe
5704	msiexec.exe
5704	msiexec.exe
5704	msiexec.exe
5704	msiexec.exe
5704	msiexec.exe
5704	msiexec.exe
5704	msiexec.exe
5704	msiexec.exe
5704	msiexec.exe
5704	msiexec.exe
5704	msiexec.exe
5704	msiexec.exe
5704	msiexec.exe
5704	msiexec.exe
5704	msiexec.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3640	msiexec.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 29 IoCs

pid	Process
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: 33	5732	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5732	AUDIODG.EXE
Token: SeRestorePrivilege	1156	7zG.exe
Token: 35	1156	7zG.exe
Token: SeSecurityPrivilege	1156	7zG.exe
Token: SeSecurityPrivilege	1156	7zG.exe
Token: SeBackupPrivilege	5284	vssvc.exe
Token: SeRestorePrivilege	5284	vssvc.exe
Token: SeAuditPrivilege	5284	vssvc.exe
Token: SeShutdownPrivilege	3252	vcredist_x64_vc12.exe
Token: SeIncreaseQuotaPrivilege	3252	vcredist_x64_vc12.exe
Token: SeSecurityPrivilege	5704	msiexec.exe
Token: SeCreateTokenPrivilege	3252	vcredist_x64_vc12.exe
Token: SeAssignPrimaryTokenPrivilege	3252	vcredist_x64_vc12.exe
Token: SeLockMemoryPrivilege	3252	vcredist_x64_vc12.exe
Token: SeIncreaseQuotaPrivilege	3252	vcredist_x64_vc12.exe
Token: SeMachineAccountPrivilege	3252	vcredist_x64_vc12.exe
Token: SeTcbPrivilege	3252	vcredist_x64_vc12.exe
Token: SeSecurityPrivilege	3252	vcredist_x64_vc12.exe
Token: SeTakeOwnershipPrivilege	3252	vcredist_x64_vc12.exe
Token: SeLoadDriverPrivilege	3252	vcredist_x64_vc12.exe
Token: SeSystemProfilePrivilege	3252	vcredist_x64_vc12.exe
Token: SeSystemtimePrivilege	3252	vcredist_x64_vc12.exe
Token: SeProfSingleProcessPrivilege	3252	vcredist_x64_vc12.exe
Token: SeIncBasePriorityPrivilege	3252	vcredist_x64_vc12.exe
Token: SeCreatePagefilePrivilege	3252	vcredist_x64_vc12.exe
Token: SeCreatePermanentPrivilege	3252	vcredist_x64_vc12.exe
Token: SeBackupPrivilege	3252	vcredist_x64_vc12.exe
Token: SeRestorePrivilege	3252	vcredist_x64_vc12.exe
Token: SeShutdownPrivilege	3252	vcredist_x64_vc12.exe
Token: SeDebugPrivilege	3252	vcredist_x64_vc12.exe
Token: SeAuditPrivilege	3252	vcredist_x64_vc12.exe
Token: SeSystemEnvironmentPrivilege	3252	vcredist_x64_vc12.exe
Token: SeChangeNotifyPrivilege	3252	vcredist_x64_vc12.exe
Token: SeRemoteShutdownPrivilege	3252	vcredist_x64_vc12.exe
Token: SeUndockPrivilege	3252	vcredist_x64_vc12.exe
Token: SeSyncAgentPrivilege	3252	vcredist_x64_vc12.exe
Token: SeEnableDelegationPrivilege	3252	vcredist_x64_vc12.exe
Token: SeManageVolumePrivilege	3252	vcredist_x64_vc12.exe
Token: SeImpersonatePrivilege	3252	vcredist_x64_vc12.exe
Token: SeCreateGlobalPrivilege	3252	vcredist_x64_vc12.exe
Token: SeRestorePrivilege	5704	msiexec.exe
Token: SeTakeOwnershipPrivilege	5704	msiexec.exe
Token: SeRestorePrivilege	5704	msiexec.exe
Token: SeTakeOwnershipPrivilege	5704	msiexec.exe
Token: SeRestorePrivilege	5704	msiexec.exe
Token: SeTakeOwnershipPrivilege	5704	msiexec.exe
Token: SeRestorePrivilege	5704	msiexec.exe
Token: SeTakeOwnershipPrivilege	5704	msiexec.exe
Token: SeRestorePrivilege	5704	msiexec.exe
Token: SeTakeOwnershipPrivilege	5704	msiexec.exe
Token: SeRestorePrivilege	5704	msiexec.exe
Token: SeTakeOwnershipPrivilege	5704	msiexec.exe
Token: SeRestorePrivilege	5704	msiexec.exe
Token: SeTakeOwnershipPrivilege	5704	msiexec.exe
Token: SeRestorePrivilege	5704	msiexec.exe
Token: SeTakeOwnershipPrivilege	5704	msiexec.exe
Token: SeRestorePrivilege	5704	msiexec.exe
Token: SeTakeOwnershipPrivilege	5704	msiexec.exe
Token: SeRestorePrivilege	5704	msiexec.exe
Token: SeTakeOwnershipPrivilege	5704	msiexec.exe
Token: SeRestorePrivilege	5704	msiexec.exe
Token: SeTakeOwnershipPrivilege	5704	msiexec.exe
Token: SeRestorePrivilege	5704	msiexec.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe

Suspicious use of SetWindowsHookEx 15 IoCs

pid	Process
628	SetupResolve.exe
628	SetupResolve.exe
628	SetupResolve.exe
628	SetupResolve.exe
628	SetupResolve.exe
628	SetupResolve.exe
628	SetupResolve.exe
628	SetupResolve.exe
628	SetupResolve.exe
628	SetupResolve.exe
628	SetupResolve.exe
628	SetupResolve.exe
628	SetupResolve.exe
628	SetupResolve.exe
628	SetupResolve.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3656 wrote to memory of 2448	3656	msedge.exe	85
PID 3656 wrote to memory of 2448	3656	msedge.exe	85
PID 3656 wrote to memory of 2668	3656	msedge.exe	86
PID 3656 wrote to memory of 2668	3656	msedge.exe	86
PID 3656 wrote to memory of 2668	3656	msedge.exe	86
PID 3656 wrote to memory of 2668	3656	msedge.exe	86
PID 3656 wrote to memory of 2668	3656	msedge.exe	86
PID 3656 wrote to memory of 2668	3656	msedge.exe	86
PID 3656 wrote to memory of 2668	3656	msedge.exe	86
PID 3656 wrote to memory of 2668	3656	msedge.exe	86
PID 3656 wrote to memory of 2668	3656	msedge.exe	86
PID 3656 wrote to memory of 2668	3656	msedge.exe	86
PID 3656 wrote to memory of 2668	3656	msedge.exe	86
PID 3656 wrote to memory of 2668	3656	msedge.exe	86
PID 3656 wrote to memory of 2668	3656	msedge.exe	86
PID 3656 wrote to memory of 2668	3656	msedge.exe	86
PID 3656 wrote to memory of 2668	3656	msedge.exe	86
PID 3656 wrote to memory of 2668	3656	msedge.exe	86
PID 3656 wrote to memory of 2668	3656	msedge.exe	86
PID 3656 wrote to memory of 2668	3656	msedge.exe	86
PID 3656 wrote to memory of 2668	3656	msedge.exe	86
PID 3656 wrote to memory of 2668	3656	msedge.exe	86
PID 3656 wrote to memory of 2668	3656	msedge.exe	86
PID 3656 wrote to memory of 2668	3656	msedge.exe	86
PID 3656 wrote to memory of 2668	3656	msedge.exe	86
PID 3656 wrote to memory of 2668	3656	msedge.exe	86
PID 3656 wrote to memory of 2668	3656	msedge.exe	86
PID 3656 wrote to memory of 2668	3656	msedge.exe	86
PID 3656 wrote to memory of 2668	3656	msedge.exe	86
PID 3656 wrote to memory of 2668	3656	msedge.exe	86
PID 3656 wrote to memory of 2668	3656	msedge.exe	86
PID 3656 wrote to memory of 2668	3656	msedge.exe	86
PID 3656 wrote to memory of 2668	3656	msedge.exe	86
PID 3656 wrote to memory of 2668	3656	msedge.exe	86
PID 3656 wrote to memory of 2668	3656	msedge.exe	86
PID 3656 wrote to memory of 2668	3656	msedge.exe	86
PID 3656 wrote to memory of 2668	3656	msedge.exe	86
PID 3656 wrote to memory of 2668	3656	msedge.exe	86
PID 3656 wrote to memory of 2668	3656	msedge.exe	86
PID 3656 wrote to memory of 2668	3656	msedge.exe	86
PID 3656 wrote to memory of 2668	3656	msedge.exe	86
PID 3656 wrote to memory of 2668	3656	msedge.exe	86
PID 3656 wrote to memory of 1500	3656	msedge.exe	87
PID 3656 wrote to memory of 1500	3656	msedge.exe	87
PID 3656 wrote to memory of 620	3656	msedge.exe	88
PID 3656 wrote to memory of 620	3656	msedge.exe	88
PID 3656 wrote to memory of 620	3656	msedge.exe	88
PID 3656 wrote to memory of 620	3656	msedge.exe	88
PID 3656 wrote to memory of 620	3656	msedge.exe	88
PID 3656 wrote to memory of 620	3656	msedge.exe	88
PID 3656 wrote to memory of 620	3656	msedge.exe	88
PID 3656 wrote to memory of 620	3656	msedge.exe	88
PID 3656 wrote to memory of 620	3656	msedge.exe	88
PID 3656 wrote to memory of 620	3656	msedge.exe	88
PID 3656 wrote to memory of 620	3656	msedge.exe	88
PID 3656 wrote to memory of 620	3656	msedge.exe	88
PID 3656 wrote to memory of 620	3656	msedge.exe	88
PID 3656 wrote to memory of 620	3656	msedge.exe	88
PID 3656 wrote to memory of 620	3656	msedge.exe	88
PID 3656 wrote to memory of 620	3656	msedge.exe	88
PID 3656 wrote to memory of 620	3656	msedge.exe	88
PID 3656 wrote to memory of 620	3656	msedge.exe	88
PID 3656 wrote to memory of 620	3656	msedge.exe	88
PID 3656 wrote to memory of 620	3656	msedge.exe	88

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/file/d/1izFwLy36KaJbhGLUUDZmcBIjsUn27oY1/view
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa198346f8,0x7ffa19834708,0x7ffa19834718
  2⤵
  PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,6548238192332770388,11040727860239175924,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
  2⤵
  PID:2668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,6548238192332770388,11040727860239175924,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,6548238192332770388,11040727860239175924,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:8
  2⤵
  PID:620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6548238192332770388,11040727860239175924,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
  2⤵
  PID:1940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6548238192332770388,11040727860239175924,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6548238192332770388,11040727860239175924,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:1
  2⤵
  PID:1216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6548238192332770388,11040727860239175924,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4704 /prefetch:1
  2⤵
  PID:3420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6548238192332770388,11040727860239175924,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6056 /prefetch:1
  2⤵
  PID:2100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2132,6548238192332770388,11040727860239175924,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6092 /prefetch:8
  2⤵
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,6548238192332770388,11040727860239175924,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6452 /prefetch:8
  2⤵
  PID:3096
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,6548238192332770388,11040727860239175924,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6452 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6548238192332770388,11040727860239175924,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5172 /prefetch:1
  2⤵
  PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6548238192332770388,11040727860239175924,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:1
  2⤵
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6548238192332770388,11040727860239175924,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5524 /prefetch:1
  2⤵
  PID:5416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6548238192332770388,11040727860239175924,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4716 /prefetch:1
  2⤵
  PID:5424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6548238192332770388,11040727860239175924,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6244 /prefetch:1
  2⤵
  PID:6088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6548238192332770388,11040727860239175924,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1
  2⤵
  PID:6096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6548238192332770388,11040727860239175924,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1
  2⤵
  PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6548238192332770388,11040727860239175924,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6952 /prefetch:1
  2⤵
  PID:216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,6548238192332770388,11040727860239175924,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4772 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6548238192332770388,11040727860239175924,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3040 /prefetch:1
  2⤵
  PID:5756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6548238192332770388,11040727860239175924,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6912 /prefetch:1
  2⤵
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6548238192332770388,11040727860239175924,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7136 /prefetch:1
  2⤵
  PID:5136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6548238192332770388,11040727860239175924,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7112 /prefetch:1
  2⤵
  PID:5264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6548238192332770388,11040727860239175924,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7124 /prefetch:1
  2⤵
  PID:5620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2132,6548238192332770388,11040727860239175924,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6804 /prefetch:8
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6548238192332770388,11040727860239175924,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3708 /prefetch:1
  2⤵
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6548238192332770388,11040727860239175924,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2344 /prefetch:1
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2132,6548238192332770388,11040727860239175924,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=2264 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:5864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6548238192332770388,11040727860239175924,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7156 /prefetch:1
  2⤵
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6548238192332770388,11040727860239175924,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7136 /prefetch:1
  2⤵
  PID:1192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6548238192332770388,11040727860239175924,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1696 /prefetch:1
  2⤵
  PID:5624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6548238192332770388,11040727860239175924,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1936 /prefetch:1
  2⤵
  PID:6072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6548238192332770388,11040727860239175924,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5472 /prefetch:1
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2132,6548238192332770388,11040727860239175924,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6684 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6548238192332770388,11040727860239175924,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7068 /prefetch:1
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6548238192332770388,11040727860239175924,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8032 /prefetch:1
  2⤵
  PID:5756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2132,6548238192332770388,11040727860239175924,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=7652 /prefetch:8
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6548238192332770388,11040727860239175924,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:1
  2⤵
  PID:2600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6548238192332770388,11040727860239175924,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7912 /prefetch:1
  2⤵
  PID:2148

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4416

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3460

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x464 0x300
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5732

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3728

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap22441:154:7zEvent25397
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1156

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://download93.com/more.html
1⤵
PID:1028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffa198346f8,0x7ffa19834708,0x7ffa19834718
  2⤵
  PID:4820

C:\Users\Admin\Downloads\DaVinci Resolve Studio 19.0.0.59 PUBLIC BETA 6\Install Resolve 19.0b.exe
"C:\Users\Admin\Downloads\DaVinci Resolve Studio 19.0.0.59 PUBLIC BETA 6\Install Resolve 19.0b.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
PID:3816
- C:\Users\Admin\AppData\Local\Temp\7zS8EEFCBCF\SetupResolve.exe
  "C:\Users\Admin\AppData\Local\Temp\7zS8EEFCBCF\SetupResolve.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:628
- - C:\Users\Admin\AppData\Local\Temp\{15F58FAC-2ACA-454B-8B1D-D5F40948AFBF}\vcredist_x64_vc12.exe
    C:\Users\Admin\AppData\Local\Temp\{15F58FAC-2ACA-454B-8B1D-D5F40948AFBF}\vcredist_x64_vc12.exe /passive /norestart
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    PID:3252
  - - C:\Users\Admin\AppData\Local\Temp\{15F58FAC-2ACA-454B-8B1D-D5F40948AFBF}\vcredist_x64_vc12.exe
      "C:\Users\Admin\AppData\Local\Temp\{15F58FAC-2ACA-454B-8B1D-D5F40948AFBF}\vcredist_x64_vc12.exe" /passive /norestart -burn.unelevated BurnPipe.{39661B01-2408-48AD-9B9E-CC8000EB2A06} {661B7666-083A-4FB3-A2C9-7A2562854926} 3252
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:2256
  - - C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe
      "C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={042d26ef-3dbe-4c25-95d3-4c1b11b235a7} -burn.embedded BurnPipe.{A1A858D1-5652-4818-AD64-168776687C18} {5CCDC572-0F94-4400-B02B-F94757F5F9EE} 3252
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:3604
    - - C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe
        
        "C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={042d26ef-3dbe-4c25-95d3-4c1b11b235a7} -burn.embedded BurnPipe.{A1A858D1-5652-4818-AD64-168776687C18} {5CCDC572-0F94-4400-B02B-F94757F5F9EE} 3252 -burn.unelevated BurnPipe.{7F03FB7B-7F10-4088-A7AB-FDBB11EEA7B5} {8F712EA1-52FE-44A9-8F91-2ABCAE6F8E28} 3604
        5⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:3752
- - C:\Users\Admin\AppData\Local\Temp\{15F58FAC-2ACA-454B-8B1D-D5F40948AFBF}\vcredist_x86_vc12.exe
    C:\Users\Admin\AppData\Local\Temp\{15F58FAC-2ACA-454B-8B1D-D5F40948AFBF}\vcredist_x86_vc12.exe /passive /norestart
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:5900
  - - C:\Users\Admin\AppData\Local\Temp\{15F58FAC-2ACA-454B-8B1D-D5F40948AFBF}\vcredist_x86_vc12.exe
      "C:\Users\Admin\AppData\Local\Temp\{15F58FAC-2ACA-454B-8B1D-D5F40948AFBF}\vcredist_x86_vc12.exe" /passive /norestart -burn.unelevated BurnPipe.{90A3C2EE-4A7A-4E6C-A9E3-B18C85A69CCA} {660B6065-21AF-48CC-8E8F-65A9BCDFBEA8} 5900
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:5352
  - - C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
      "C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={9dff3540-fc85-4ed5-ac84-9e3c7fd8bece} -burn.embedded BurnPipe.{071FF7B1-0E4C-43EE-B5ED-11992C3B17D9} {74929993-F493-48DE-AEC1-B55C10E1CACA} 5900
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:3204
    - - C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
        
        "C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={9dff3540-fc85-4ed5-ac84-9e3c7fd8bece} -burn.embedded BurnPipe.{071FF7B1-0E4C-43EE-B5ED-11992C3B17D9} {74929993-F493-48DE-AEC1-B55C10E1CACA} 5900 -burn.unelevated BurnPipe.{B79EA46C-D757-4216-A915-F80731005D48} {2EED99DC-F705-4B2C-B512-7DAA5F7B0925} 3204
        5⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:6128
- - C:\Windows\SysWOW64\msiexec.exe
    msiexec /i "C:\Users\Admin\AppData\Local\Temp\{15F58FAC-2ACA-454B-8B1D-D5F40948AFBF}\DaVinci Resolve Panels Installer v2.3.0.msi" /quiet /qn /norestart
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2368
- - C:\Windows\SysWOW64\msiexec.exe
    msiexec /i "C:\Users\Admin\AppData\Local\Temp\{15F58FAC-2ACA-454B-8B1D-D5F40948AFBF}\Blackmagic RAW Player v4.2.0.msi" /quiet /qn /norestart
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6112
- - C:\Windows\SysWOW64\msiexec.exe
    msiexec /i "C:\Users\Admin\AppData\Local\Temp\7zS8EEFCBCF\ResolveInstaller.msi" /log "C:\Users\Admin\AppData\Local\Temp\ResolvePackage.log"
    3⤵
    - Blocklisted process makes network request
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    PID:3640

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:5284

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
PID:2444

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5704
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding B6DF468559736E23F9269E04C3E9045F
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3828
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 9C5CBC6AF32964E78E9D76D0C3A90EDE
  2⤵
  - Loads dropped DLL
  PID:5544
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding C6F1A14EE58EDA9AF61B4125B99C56EF E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  - Checks SCSI registry key(s)
  PID:3168
- C:\Windows\System32\MsiExec.exe
  "C:\Windows\System32\MsiExec.exe" /Y "C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\API\DaVinciPanelAPI64.dll"
  2⤵
  - Loads dropped DLL
  - Modifies registry class
  PID:4052
- C:\Windows\System32\MsiExec.exe
  "C:\Windows\System32\MsiExec.exe" /Y "C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\API\FairlightPanelAPI.dll"
  2⤵
  - Loads dropped DLL
  - Modifies registry class
  PID:2804
- C:\Windows\system32\regsvr32.exe
  regsvr32 /s /u BlackmagicRawAPI.dll
  2⤵
  - Loads dropped DLL
  PID:3128
- C:\Windows\system32\regsvr32.exe
  regsvr32 /s BlackmagicRawShellExtension.dll
  2⤵
  - Loads dropped DLL
  - Modifies registry class
  PID:6140
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 87037C0FF794824B86FBC8426937CA20 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5776

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
- Checks SCSI registry key(s)
PID:5060
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "1" "C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\DriverUsb\DaVinciPanels\DaVinciPanels.inf" "9" "4c6adc413" "000000000000014C" "WinSta0\Default" "000000000000015C" "208" "C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\DriverUsb\DaVinciPanels"
  2⤵
  - Drops file in System32 directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:1016
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "1" "C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\DriverUsb\DaVinciKeyboards\DaVinciKeyboards.inf" "9" "4e024879f" "000000000000015C" "WinSta0\Default" "0000000000000100" "208" "C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\DriverUsb\DaVinciKeyboards"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:832
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "1" "C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\DriverUsb\FairlightPanels\FairlightPanels.inf" "9" "4e10e6fd7" "0000000000000100" "WinSta0\Default" "0000000000000158" "208" "C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\DriverUsb\FairlightPanels"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e60a659.rbs

Filesize
18KB

MD5
42cb345b21831e5f6919b5dda0d587f6

SHA1
26705354b6baf2cf1454655ceb815cedba34dfb2

SHA256
5c69c95eee86aa22e4f3885b3eeeb64ac2faf73eb5e0fc73156e9f77e8ecac91

SHA512
836433778450edac2fc695e85afb6480d8f6cbacb170e217bb799c832b78662db54ecd40be6a6c6957680e0b969b0cc540e1c840a4a2571576aeaf120ae23560

Download Submit
C:\Config.Msi\e60a662.rbs

Filesize
14KB

MD5
8cb529e704d525d3a4f759fe1b2e8061

SHA1
4d4f41beddc83e23e4ba5d1b0f823a71682c2aff

SHA256
0983f2974d8faca119439f2b42605e24572e5f96bf44b942fd7a983f6a4dd359

SHA512
3e517639b747d4dec8b821f59282018a6c20799987081f4c5f60987df341d4b5c150317b0b1cd3de4dd568251d480ac22790ac3809a2da424293913567d3ed7e

Download Submit
C:\Config.Msi\e60a663.rbf

Filesize
644KB

MD5
edef53778eaafe476ee523be5c2ab67f

SHA1
58c416508913045f99cdf559f31e71f88626f6de

SHA256
92faedd18a29e1bd2dd27a1d805ea5aa3e73b954a625af45a74f49d49506d20f

SHA512
7fc931c69aca6a09924c84f57a4a2bcf506859ab02f622d858e9e13d5917c5d3bdd475ba88f7a7e537bdae84ca3df9c3a7c56b2b0ca3c2d463bd7e9b905e2ef8

Download Submit
C:\Config.Msi\e60a664.rbf

Filesize
940KB

MD5
aeb29ccc27e16c4fd223a00189b44524

SHA1
45a6671c64f353c79c0060bdafea0ceb5ad889be

SHA256
d28c7ab34842b6149609bd4e6b566ddab8b891f0d5062480a253ef20a6a2caaa

SHA512
2ec4d768a07cfa19d7a30cbd1a94d97ba4f296194b9c725cef8e50a2078e9e593a460e4296e033a05b191dc863acf6879d50c2242e82fe00054ca1952628e006

Download Submit
C:\Config.Msi\e60a665.rbf

Filesize
470KB

MD5
f0ec8a3ddf8e0534983a05a52bce8924

SHA1
5f6d0265273f00ffe8e30cf507f0d05d330ff296

SHA256
88a5ed51a7be4ff7ebded0c107fafda6ace3801877216c0bb6cbb458ae054a7b

SHA512
d7b084d7f20de29ff16341df2756861bb7ac22eab0711869b3e77a84d841fb76a898d7459ca1be62eed522caa1f022c891a7d30c94bf0fff1bb4d016be8aa9bb

Download Submit
C:\Config.Msi\e60a666.rbf

Filesize
348KB

MD5
ea1e99dec990691d41f938085f68bcc7

SHA1
5fdcbcd777e10e765d593994dc66f930c1377b0e

SHA256
1b296bd172332d3b2253bdcb6ecac46afef883f75c13c361632ff40fec743fcc

SHA512
e90a40bd8e20bbca3c6188a78ad75578e51d88aa638e0bbfed4f6f6efdd0917e92b08ef4b0ccc2dee08774f08658b189e25234270e8ce1ca60a7e0ec8e3fbcf8

Download Submit
C:\Config.Msi\e60a667.rbf

Filesize
134KB

MD5
d7dbc7c92177837431ae2fd7fb569e2c

SHA1
c26140204a6db421842ad36599326a5369fd1b5d

SHA256
22d14e004ba4b78a9143257399dc40ef4d0e8f2cdb9127e1ba2638f54cce5c70

SHA512
4f2b197ea912b5ea1a82ac84e1c15ca8e3787460cd79a32733ea920dcf3b1db5cf0507ad7c94f4e4ccab9dfc6773a9d05a8eeaa7bd7c61b63d780b69ed7ae0d8

Download Submit
C:\Config.Msi\e60a668.rbf

Filesize
3B

MD5
21438ef4b9ad4fc266b6129a2f60de29

SHA1
5eb8e2242eeb4f5432beeec8b873f1ab0a6b71fd

SHA256
13bf7b3039c63bf5a50491fa3cfd8eb4e699d1ba1436315aef9cbe5711530354

SHA512
37436ced85e5cd638973e716d6713257d692f9dd2e1975d5511ae3856a7b3b9f0d9e497315a058b516ab31d652ea9950938c77c1ad435ea8d4b49d73427d1237

Download Submit
C:\Config.Msi\e60a66c.rbs

Filesize
27KB

MD5
c4638438c2e89ae5e52da151db1161c6

SHA1
11d1af8e966de94270e45a4cbccdc99f156dfb02

SHA256
356b15c15d6f07921222297e366861a098b6ec2036ab3b45eb8d864f063e38c7

SHA512
52ac321ef451f5c8995b6ebaf6833dfb08b8e2e89199185cd1591e0b1627d7822e6ba48edb160db07a8b1006934e770973807cd803d8f2ac4b3838a8722229cc

Download Submit
C:\Config.Msi\e60a67e.rbs

Filesize
22KB

MD5
24c2c1e5024d1959bdb5480fc461602c

SHA1
1891c26615ba6494092a43b6f461b70a8d0bbf6b

SHA256
3b6543833821b788cfd8ba140b0ca1737fbd9b96126e6031f5c0339d8e6d7509

SHA512
b8887d2406a553083b6592689d7fc7d19a203198fb5d304ad614f3c0e83523992042cd3c3c55864c2805a88fbdf02cc799de6a420bbfd561dd74bb202e6c879b

Download Submit
C:\Config.Msi\e60a67f.rbf

Filesize
45KB

MD5
f96a9a88487a27de7b3e15c733cf1fe1

SHA1
0a4157f064349b0370b8ee3f244f44debd04b4c0

SHA256
cb531679be2881677a93d11067c71274ec30b30aadf1cdcf1543dddd6b1d7b61

SHA512
df5390b235157e65efa3a9385a7ffd6d5f4f2471306625f01370ed463c65b81c4274370f93b5b0d04d44175c57322d2f2fb1cdd2bcbc123997f4ae4ae9557f0b

Download Submit
C:\Config.Msi\e60a680.rbf

Filesize
45KB

MD5
6a5e17d5a4b24e5c2b947a343a182949

SHA1
ddf5ed505953e073f09b17e8e2bdecf2766c6a4b

SHA256
0301c5dc6e762788891356987e9c8cd0d40b262df06e8384bf5796b1f20f083e

SHA512
8a383192f9f6e6c4fab24645cf7c30fa927881451f0e65175b724717151cca6fcc49ed3394cc689407f19a7b1afd6b462688bccb898912762b804eeeb7cd8d97

Download Submit
C:\Config.Msi\e60a681.rbf

Filesize
73KB

MD5
bfc853c578252e29698ff6b770794e6a

SHA1
1091dced7b18bdd7eda2be4d095ac43cfd342b7d

SHA256
80e0f29ff6b7ada892f23927f17021783575ad80f9f6c8a268a6c2a7ce35e5d6

SHA512
306445384614b48d3182a91c8adf8d8206c36efd88abf23753800566f9650518af382164ca1a17ed000888e6a99c175478ad621d0a0d46c9bc7d5359113e05fb

Download Submit
C:\Config.Msi\e60a682.rbf

Filesize
63KB

MD5
19b7b852ac2dec695e6a52801e59c421

SHA1
cd72265e1a6a64c761984980895d92cb93bc61b7

SHA256
e463f38fa6b6157398ad224a462538bd8e36b75031fa711e567c5505a9092df6

SHA512
d0fd9f75820d3dbdc4001ed6262a940f062655ebb5f31f3d45d984e38b1bae2e5a958665b79b5b4aeb899e39348ba987c82148bfd85477e69249d3a59a076017

Download Submit
C:\Config.Msi\e60a683.rbf

Filesize
72KB

MD5
9ef2dc352d20b615a556be53b449b17c

SHA1
933b2a39f3d730c6b5d437558d0db68c5d2c22b7

SHA256
db4fc3652d24224d5375d1a5696144ac8881332cc20f5992ed1488236e64c120

SHA512
8031a4d0e44beb290c48292a0987108ed6d6f56950dfb17ee4671e692407fcbb8dc652d82907d8f98db2f841689f9480aee6fbce60cf2bfa1d0d6294c3f6da91

Download Submit
C:\Config.Msi\e60a684.rbf

Filesize
73KB

MD5
06473191b67c8b3d1a26b76474c5daeb

SHA1
94c72bb597c365cb77f621e6e2cf3920954df2d7

SHA256
e7cb6c2818ca27c864bda635d5b5d9f7bdb308f4b5d4bbc206ee1e135b7dbbf7

SHA512
237c144cd3cd78c4a4eeb5c6a22043a8e604bdbd7182b89bacb81135b1e3de08780061dfa3664508cfbdc01e918fa2610e317f9441b10c4df8def1ca444de4eb

Download Submit
C:\Config.Msi\e60a685.rbf

Filesize
71KB

MD5
713e30e13c1998e035cf4ace66b03230

SHA1
2d244e01c2bd9f3f17dfa0b74c19ce6bc512e1b5

SHA256
9cfc5985440df4e70b57869b32c8ee69eb6fc570a98cc94a53141a0dc7535e10

SHA512
8a2581aaa125eb45543e679e58be7040d151cfcfe0625f6e62dccc3fcf87872d3504b30082036d5219dc4c8493600838d31b2ddfde3ba0bc1b2b6ef97078e29a

Download Submit
C:\Config.Msi\e60a686.rbf

Filesize
52KB

MD5
689b5f0061a67ac95f59a64744702186

SHA1
52227dd2c8a66c0528bff28475846faf7036340f

SHA256
83fb72fd2142d54bff6280e7c4d4ff22d43c3a81fa4ff8881003abbe5e21ec3b

SHA512
30b4e01d20c6c3ac1b799dd4d23fda3ca988eadb59356f84aff0a0760572b5c4119ef21467494e47a7d74dd6b136633a6ae40f45ec051d5cacbe44b5d6255d42

Download Submit
C:\Config.Msi\e60a687.rbf

Filesize
52KB

MD5
7d03ffc6a8fb686abd660efdc3aaf223

SHA1
3d04c53971a525cc3255ff1eab05ff0cbad75bb7

SHA256
b2c7fc2c95b13bac36316d298c94d842dd2574f78e9c22e4d4e4af1c3fcc0fd9

SHA512
b5d41294630e342f2242a91c9dcf9085cddbd2389860e14c741147cb695425971cf79339b523d28fd3189589e5f948115359b89f59a03186e3c6a103f854f4e1

Download Submit
C:\Config.Msi\e60a688.rbf

Filesize
69KB

MD5
a99ad214ccd1e7bc1f609b972467b0ca

SHA1
9ee79954fdb2338026c3c81da00ab6e7e6c2e1ff

SHA256
3238676035d9c1595248ef65ef5b044384b473ab9bdfe8d1077e10e4fe7bc983

SHA512
da1f8a4dd82559635ea53dfeac1817a9ced1d247a170a8153a54c05c371fc80aa2fa958bc5c515c026815c505f70fb374178f8ccf94836b66c4a7e23dab1c083

Download Submit
C:\Config.Msi\e60a689.rbf

Filesize
5.4MB

MD5
ee4af4ceb4b7fded7cdda37faef69704

SHA1
5ab8f2ace2f4a1892ea4a2a26df5ee7e9cd497b2

SHA256
75497de4aec4b5f0f258164672db2eb55eef5138c028317860e05f11030f7b7c

SHA512
4f807157e6bd57ac37bd1d8a52ffdc38e330e517101a1ea603096d8728b04c9c2ae96e510b961c87536e957587ce169fdece6bc3ed5e5025aa87c0f276da0ece

Download Submit
C:\Config.Msi\e60a68a.rbf

Filesize
5.3MB

MD5
a6d08e8e290c80822842015cd877d405

SHA1
2ee9d28e20a73facff20be87092e482b562dad41

SHA256
950ff7746d747de51cc09c1aaaf88fbc2fc97c59865f574cc3fb10243ae7b906

SHA512
b6dfc3d0ef4f57c116d44b201fae187c9427d4fe7cad969f50f9408af40071d811e88698134491f479923b259a47d0b528e7ea23790248314e902ee24d0b93a2

Download Submit
C:\Config.Msi\e60a68b.rbf

Filesize
89KB

MD5
43aae7bfb0c911e7e98003e2b45667e6

SHA1
0c6c7d96cd0eca734e425b1ddef178c3ab6c31ce

SHA256
a78e7988c9f99bcbe02d29441b0dcbdebafa616d2a4652aad867b81f554a0476

SHA512
33d1293a7905ee9ec58b9a7744981006d6dadafb75ef64769723de02ba273f344a20e20d206d64d2453746549fe471328a035e2b5cc8e485e7cfd2c2fbc7c6a9

Download Submit
C:\Config.Msi\e60a68c.rbf

Filesize
89KB

MD5
0d5451a0050f7acc970ca02459c63d9a

SHA1
2de9febca0b1d48014081907e835237c832c65b0

SHA256
864958960b8dd2890d47f2774ba836954f2c4f5ad6e4d529b13138caefcce73e

SHA512
4d0b3d3d494c1774ae4575eb945f3c0742b723d6583d98dd36cc51a1d099b8f1a090d4b18c54897d1d58a67381b800604724cb609447860105bc2e0e8d5094a8

Download Submit
C:\Config.Msi\e60a691.rbs

Filesize
17KB

MD5
caa77043f2471107e652347d380c74d7

SHA1
c7e246b2722ab5652ad2877544fb812479f9e43e

SHA256
944da2886c573a009d87cdc0b189e3ac23f1f52d617a1a24426b321add38af7d

SHA512
19c3140b55ca1c9c5f3e0852d714389fd71f5cc4fd09a34e041cb523413f2119d6f712c914e2aed35b20911c7e16447f707ebf851c9d60908e82780e8aa4c3a1

Download Submit
C:\Config.Msi\e60a69a.rbs

Filesize
13KB

MD5
8063a16c7cf8d0e55f50abef7f4e6c92

SHA1
ee6e63bfbb99fbb356e4f5b0c1ee08a134f05d91

SHA256
e3f9bdfdeeceb689e289454651e08fb02be256b8090780f3a66968229f6d9547

SHA512
6552f125144c6c0434ddd08904b46b225c8301b6f32ebec610f25d63d4ba4e0cde5158fb41d64af7b2b8d86d000ada1c320fe6c02ad98875a178cb2211955385

Download Submit
C:\Config.Msi\e60a69b.rbf

Filesize
444KB

MD5
a883c95684eff25e71c3b644912c73a5

SHA1
3f541023690680d002a22f64153ea4e000e5561b

SHA256
d672fb07a05fb53cc821da0fde823fdfd46071854fe8c6c5ea83d7450b978ecb

SHA512
5a47c138d50690828303b1a01b28e6ef67cfe48215d16ed8a70f2bc8dbb4a73a42c37d02ccae416dc5bd12b7ed14ff692369bc294259b46dbf02dc1073f0cb52

Download Submit
C:\Config.Msi\e60a69c.rbf

Filesize
948KB

MD5
2fb20c782c237f8b23df112326048479

SHA1
b2d5a8b5c0fd735038267914b5080aab57b78243

SHA256
e0305aa54823e6f39d847f8b651b7bd08c085f1dbbcb5c3c1ce1942c0fa1e9fa

SHA512
4c1a67da2a56bc910436f9e339203d939f0bf854b589e26d3f4086277f2bec3dfce8b1f60193418c2544ef0c55713c90f6997df2bfb43f1429f3d00ba46b39b0

Download Submit
C:\Config.Msi\e60a69d.rbf

Filesize
331KB

MD5
69004e08c1eb19fcf709908103c002fd

SHA1
d59459f9a18b2e9a06e5af2b88f4fecb0ce690d5

SHA256
c1b61dd24dc2dd5efd5cd548c0cd74fac112358e9e580df4d780d2c125474dad

SHA512
3fc67a5fccb252a67285e19d62057fb4e3c63e702f4be91e552f93d9827cc746b8fb43b4a3b24b7fd5c48832d18a1dae26c1bd237f40b7b88618d402fdac1a76

Download Submit
C:\Config.Msi\e60a69e.rbf

Filesize
242KB

MD5
c7739dd4212d084d299df68f0a0debc3

SHA1
cba81d847d91bfea5c03279c0ca03fb1aacd4ae9

SHA256
1d67a8464991a03fc190d87b43591764f231d7a7a71a72ffc51d982b26691153

SHA512
5b8e98e6764460f9afbfa6dd34c12ad59284003eea99997c9e1db9b4a85ba30ac8b6a699b2888388dc424c547918137d42984bf040ac3d292e612bc433368fb3

Download Submit
C:\Config.Msi\e60a69f.rbf

Filesize
117KB

MD5
90419039c035404fb1dc38c3fb406f65

SHA1
67884b612d143aa08a307110cee7069bddb989a0

SHA256
62287589fc0b577398005f7ac07256d9fe671cdd3e5369faf74b9f64cb572317

SHA512
e632c78c941861e61fbec68e333e6549cd4bec683593db92c2522e162176bd64160dba37d4226c1599cfe1d77b36d5d4c452dd2f453c291a15310dfb607f3414

Download Submit
C:\Config.Msi\e60a6a4.rbs

Filesize
26KB

MD5
b3748ce32295a770a72ba6ef9774b390

SHA1
e898ebc268f9b2781879ce415d0878eda7b9138d

SHA256
f5b62c073fe5f9c9d89d22e30a3f0a92e109be3e4a5266929307386ea24fd2f3

SHA512
c1f56be2e69a36ce9eb9fcd4059c8d8723271a5c9ad20dbf8881e78d50c712f00fd433c7c959ceb9b59f0ae134a2e9137dea077377ee43eec835ebdb63b9bae1

Download Submit
C:\Config.Msi\e60a6b6.rbs

Filesize
22KB

MD5
7128e5cd33f7b3185b9fde399e404031

SHA1
82c304567892cb73b55eb838d8c70a54e7ebe72a

SHA256
90bd8b02b7d45e3b76f50154bc34c09b238a596389d867c931f31a5de394224b

SHA512
e66d0d51e066bba6a042e3c3d145bd387a872560d796be64a3812b254ace7caea778bbac4f604524c8a22fc74bbd020224ce10e757e1f24b159b52c77795ff7c

Download Submit
C:\Config.Msi\e60a6b7.rbf

Filesize
45KB

MD5
2f7c88c43a8966882ca89ce4981e3cde

SHA1
588bdeae6eab1f447771bd6963b5b3329196e686

SHA256
5e7331a6adeb9d4252531ade800d47b8ddf020b97cfedc58de85386b3ae64e76

SHA512
3f2eca126fc821e36aaf4430a0f41af1a060396f52cfb2efd1c3be2ab9d69cfac870121c646776c8b15e8561938ac30367bc5687bb9a79f0c19156c3b56249a7

Download Submit
C:\Config.Msi\e60a6b8.rbf

Filesize
45KB

MD5
70bbafa7c8b0aeba0e25e27c440a6038

SHA1
44a5e06229ae4f6ce6d3b2b57cb3b6050667def2

SHA256
9eec79bd4af04bba1e11fc24c64d94f30c22985c8ebbce3e0b411a61a1edbabe

SHA512
2e9b8696c1b4ab8e721fa07b6c81fe30613f0d188250991c573af95263688b7db6e25ebc4c030825724248c9713d9c5b772f199369785ac615ad2d2fdf527f8a

Download Submit
C:\Config.Msi\e60a6b9.rbf

Filesize
73KB

MD5
09936f1f2ad5ae9d0663b6e8709527c7

SHA1
f0e5945663e65405d94c394db83880f713295104

SHA256
550f6c9f16fe85a8338b04f1bec43de3babeac60ff257197625f2802907007b8

SHA512
3e95e1e3f2043e1f0a4baf1267e82f912bcd5830ae6c5abc750a38a0666b1a6b9e1169dadb58bc2eafae00a2e11bcf574ea805f3a1f07f77d5450d1265e8e7f6

Download Submit
C:\Config.Msi\e60a6ba.rbf

Filesize
63KB

MD5
9becefa155c8c9f5ef5bf9d537c0a258

SHA1
4f33f6d08685d50ce799df6369cb5efc51673e12

SHA256
d1dbc7677010f9af7b680ea2efa28c964154997bddbf6c8d9d65ea225a5ec613

SHA512
5e9972cfe26c0fc6a0ea38643c644b5ac33e4ddfc1cff5b25017c81f3121ec7732565554f43c1916e9f8e2b1d84226aacd2cc4d6805425c2f1f1e7683e506ff4

Download Submit
C:\Config.Msi\e60a6bb.rbf

Filesize
72KB

MD5
30281f2891b6deae8c0deb122b5906c7

SHA1
43ed0c7bf45839ba07501c1013ba74c97b4d0beb

SHA256
87e5c496e038c337ca1acee52c145d8f4bdb3e74261b13e1feb740c4e2124e0a

SHA512
cb0e3f3cf89af55e4b849b3f4f883d8348fc8f806690db4fff238ee54bc5f80a34e53c7e8a22dd9d1dc57c1a60c69d3e25ad9cc52ac66628613cdf358e7aa537

Download Submit
C:\Config.Msi\e60a6bc.rbf

Filesize
73KB

MD5
b41aa9a167ac3d6c11b5c2e1e183c11b

SHA1
ac8efa5f7b8211e4dc0d0d0e6bc7717f88d2c0ac

SHA256
b098ed9a5f44052b9ab5ceee82ab4cea5c6d9a14a61816882ef996a0599838b2

SHA512
de667f1fe0bcb0ddf8f59054a2d5c516ec47ab59f7e78e29ec8a2cc756c72aae65bb73ea03701c67c978166649d69278fb0269e9588d968f630165bcfa6f40f8

Download Submit
C:\Config.Msi\e60a6bd.rbf

Filesize
71KB

MD5
2bcf9a28e5fe7a3fefd16a9c03d35dbb

SHA1
7c1446d8ca4d2c6890d62c02308daccb8be5475f

SHA256
271abe43d14cbd8c80b85ec804787272522bc06c45b7f93244b718ab0c08a289

SHA512
445ef027eeecda4361834334706079053ce9a735cbeeadaec37f28c4f9a485b07ba156178c2cdb1f012d1760d0495d041deceb6372921eb94d18241eb304eafa

Download Submit
C:\Config.Msi\e60a6be.rbf

Filesize
52KB

MD5
34b5ae129703de4a4bb5f52f4306fdf6

SHA1
601ba6cc73cbbe6d7014519a885fde2c9e9c2fba

SHA256
43cd9fdf714b7dfca4b2a8f54bc25ceeddc7a6212ba59233d89a03c650053407

SHA512
016dae93356e42a19f4fb4d34efa04e93f802e5de3157c29ce940d9637d697d2b7a4f61b705b5b5df271b97d942cb81265d0fe7c9561c0ef3c46c249b8b7fb9c

Download Submit
C:\Config.Msi\e60a6bf.rbf

Filesize
52KB

MD5
f89147c034de186e3ab79326523888b8

SHA1
d3e6c00363a429eae066953f7c187e33c687ec6b

SHA256
32dfe0f26b5024ec900a31f0dde736ca62769dc5de48238b485f4322cd367e7d

SHA512
d7842681f67b46f67233ad0f7c57c7155f152dc25ef546a08fb91914ee54984b87f9ccbd8da3e40d012b251fffade838f2d779681afa84c383ea7982f0ad1cfe

Download Submit
C:\Config.Msi\e60a6c0.rbf

Filesize
69KB

MD5
d7f2e87512d19d01328840187fc7cb04

SHA1
7a312b677b76d7303e01da6064f1a5e0fb26c604

SHA256
1154c537bd700ebbda599a5c2923e73d098c3eaa930fd0f4d415583ff90eea67

SHA512
8a00cae2dc0d59e530cd43bf84f33301f53ccdd96477787805b487ffdf6869223621414cf180a1aafb6b8910ba19684c02c60226a651d051eacc4cac1fbd8c2b

Download Submit
C:\Config.Msi\e60a6c1.rbf

Filesize
4.2MB

MD5
293002e4332f01c74c2a843b5c638a90

SHA1
2e412f945ac4353b4908c87e31b847415b3ec19b

SHA256
6130ad7d21a492cd3f3924bed43d954f80b6b6920374934b9eed057f27130e15

SHA512
49eaf5633debad535ffc6584c8383e21c99f7a3a81a0b3496943af0e79853399649706ceda9da9990c259d605ab163c22c08f641b91e80c8a14d519837a595ce

Download Submit
C:\Config.Msi\e60a6c2.rbf

Filesize
4.2MB

MD5
e1629a36f15824346bb54a9ebe9b622f

SHA1
ee5d55315ffb351e24b7c918c82e6ce4ec17a645

SHA256
68df186e26151313a0df2adb0ef5f3a45ebba3cb02229bd8723a29dee60e278d

SHA512
0301ed7ad473015478f32afd3e41dafd045eab26ad42080bad6030324564a7ed09a7516b8d362b5cb2201d087eb25f2bb7ac5fc809a387f49f893ac3df8814bb

Download Submit
C:\Config.Msi\e60a6c3.rbf

Filesize
81KB

MD5
36ca9bc41425660ad80f23933e6e9f1f

SHA1
3206186f932cd5948062a837b5fc2094ddb1c8b7

SHA256
8c82f149507c3415250e52bf4c7fe937946a60d51f07492a1e36ab3e14482187

SHA512
a58eee2824bad90ea0790bdf55c5b58a6eec5f3e87bebf5a941a6dbcb8106c6d96b7eee0a022c4a16f35d80e38501fed54d88127f30de0e9fdd22e4df8fa2ea5

Download Submit
C:\Config.Msi\e60a6c4.rbf

Filesize
81KB

MD5
9b73043d5646be7b544e3ac3d49b7744

SHA1
a3eecb1a85c244d5428a012041eee947462e7a09

SHA256
d6d2ba4ac1606e825216a25ab401d26d77c4300299e957cfadab3b0b945d065a

SHA512
8f339c23f8d1e8eed1bd055a31c027e5da03d916769468394ba1befe7b4f2586e67e8dcf29326ff40abb0d879a45f886398d5d733c988c507860d1ece16ed83a

Download Submit
C:\Config.Msi\e60a6c9.rbs

Filesize
2.2MB

MD5
dbaf5aaf7febc98e614913d0d8755e28

SHA1
5be0c39ea80f94c4ed80a2e16e4c2bffe192ebfd

SHA256
ac9f9f57973d70dcad53597a8ac20246840026a930c99c6a83d9caa74064035c

SHA512
f7c8b14460abfbb28922856ce1f0860f2aa82b29539338f80180a11e5c5fb45e6a3d0ddded946646d846efe9a9f2a6d9b3a53a7365030ecea5c709229646e12b

Download Submit
C:\Config.Msi\e60a6ce.rbs

Filesize
35KB

MD5
2965ef65e6426aa7a35f9bbee76c361d

SHA1
eeddd368ef605288e21e7a8ce14c452ff892f46e

SHA256
2ec0a118eb3860dd881386634aaf1324537763f35e15abfcbac1e4ead46e86f1

SHA512
02d01f15d713f5bb65c343843acf76476d74055b47be02026ee90911db5daa556632969b7c672120e9ad0b0ec685922737d39f655165282afcdc22cccef62db1

Download Submit
C:\Program Files (x86)\Blackmagic Design\DaVinci Control Panels\Fairlight Studio Utility\qml\QtQuick\Controls\Imagine\impl\qtquickcontrols2imaginestyleimplplugin.qmltypes

Filesize
215B

MD5
2006d4b7d0da455aa4c7414653c0018a

SHA1
6685b8360b97799aa4d6b18789bf84a343e9e891

SHA256
a96c7bf5832767bdc9d91e2290a3920aec3abfbf2e3814bce38b49483f16f84a

SHA512
703804e6fab0cf44317b7292c547a1348e2e7395e4b71367c32c3b097bcfb3344d3296179bf4ba33a4c752ae58a3873af57d8cdef35a34564205356bb4e6fd84

Download Submit
C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\state.rsm

Filesize
792B

MD5
f1583bce93df8c882d24e176e5963593

SHA1
101c811aff48d12e5fc346f0c6e2c50fe8267420

SHA256
801cf43b1147a726285c577859418ff6ec9e77c955a7fa198791128c8414209f

SHA512
0a51af3237612f4540ccd85bda3ba5eef42652e1cf3d0084ca25273168202dc3e5055dea6e2b402d2180bd22a0eca51448a8eacae65b045f2fec8eccd449d6f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9e3fc58a8fb86c93d19e1500b873ef6f

SHA1
c6aae5f4e26f5570db5e14bba8d5061867a33b56

SHA256
828f4eacac1c40b790fd70dbb6fa6ba03dcc681171d9b2a6579626d27837b1c4

SHA512
e5e245b56fa82075e060f468a3224cf2ef43f1b6d87f0351a2102d85c7c897e559be4caeaecfdc4059af29fdc674681b61229319dda95cb2ee649b2eb98d313e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
27304926d60324abe74d7a4b571c35ea

SHA1
78b8f92fcaf4a09eaa786bbe33fd1b0222ef29c1

SHA256
7039ad5c2b40f4d97c8c2269f4942be13436d739b2e1f8feb7a0c9f9fdb931de

SHA512
f5b6181d3f432238c7365f64fc8a373299e23ba8178bcc419471916ef8b23e909787c7c0617ab22e4eb90909c02bd7b84f1386fbc61e2bdb5a0eb474175da4bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4e3936ea-61b5-47dd-b124-55149e04090c.tmp

Filesize
5KB

MD5
0fc2f015f27993f8ace6d2c1f6512107

SHA1
0b6eb801779e2fa47d8efc227c29b72c683fb40b

SHA256
d5571b07a00651627d758f3e1f3f4b50f79011d37be007c5eb7745d7f11f5277

SHA512
e2b3c9a17a06f0f34ceebcf52d7c640806b18433bb23e631e99c6959483684914ed2231db1ddec60ac153a9cab4538a11b0d9e0594438bd9a1ddc6a93d7ece02

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00004c

Filesize
99KB

MD5
7cc7cfb86458741166a235ad5007c2fe

SHA1
3ac754c82210b62adb68eb18bc0049720b8c9c60

SHA256
56c00c1b361bd539ddc09fbc97e608dbd0ec6c29722cbd705c3ce70c6bc2cfe6

SHA512
341cc3b26f80a0433080d392ef2afddbdd12627e83029d6ff6533dc3c0655722a08a4d1353f4754a10f5f4e35bac67df4b67159435e9c6d8f63a77b23cbbdf76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00004d

Filesize
413KB

MD5
2cf2b2e988dfd2c9e811914e9937ee69

SHA1
f7cb728b0ccf5b10f24147c9c990265cfaa3ee91

SHA256
0d5e47410297a78ff19c4c8946904cee255068df6567675810c0328d5d9eed0e

SHA512
cd6525d24e14ec7a03d85bfbe18b2b5233373c92dab80c2cd9c272df22beebdf973aeb6b03df3a4161aca51c92af24ca4d5f9ec4d315c08f3f693420db4bc4f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000069

Filesize
156KB

MD5
3b0d96ed8113994f3d139088726cfecd

SHA1
1311abcea5f1922c31ea021c4b681b94aee18b23

SHA256
313818d6b177a70fbe715a5142d6221ac1a1851eff5a9f6df505670ddcd73074

SHA512
3d78c250029069e1850b1e302a6d8a5154f6e7bc5cd58f449b8824ccf418e80dba2d5569a9cff72f51ccc9de140dc91148f93ec4717f4a880e2ba94898fbdb24

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
384B

MD5
3998e3f2b8e172aa73f37416cdb88ec8

SHA1
06b4329938caf459a12615016ae5c5226a3e18cc

SHA256
78a9b9b8aadec985f7e4f3f89b037722e983cef30f7096c1e4c798a07c31038c

SHA512
44672d70a231a5ba8ab50a3ddc0a17acd925400355135cc08bd60ffaed851715abc65eb0b0c874eff21ec508701120742758d539bb787b9e8fd8ab0f6ebc938d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
5a15cb4a3b8ade9f9ed134e284c208d2

SHA1
296421ca176d4ce43e0ba3687e905ac68cda70fb

SHA256
587711bb4832a0c281b8633c661b71a4fb6bc8462b75ff89918068532b851add

SHA512
f18711a4bb860c0c13afb39edf7a1dc8bef0faf27e24c1dca9dc1bc9b5035123816cc171333e5c64828aa5b2a78c2c35bfdd9d459bb2d3e4907ad5b4530b8c05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
e8c5724ece29971c8502161362934006

SHA1
1838927417cc4245fd3b45a14a9651bd049ecb1d

SHA256
56e6d42bba1d9015d8cc20f7c67eadb4ee4202379691b3a16d0d0a4642136ce7

SHA512
3dd3c3c9f0b7d17a76b2f21fe89f1bb751698337dd3bae680b5328572a96bca6aa7e7dc39dda2a8c84434566df6eb3209bf1c68218323edd47bec031b94e9292

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
cd504362e2eb46827b10f61ea9522ff5

SHA1
242585c5eae2814a2c5a36641f5d9b9406342b4a

SHA256
a648b549831eb93523fbe2b7d32b8b50e2d48108aaf1b9a53e44fbccbc80c896

SHA512
b4d0c2214820fe16e01943349b5a2ae8a282c40bf80e2e670ef36e78e24254485984511fb61cb0212feeab4039aa20ccad88729e0aec19e0b814ff70ce46532a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
1b1d76e4de0d74a0a5f32dd4003d6fff

SHA1
484c5cd37ccf5c0a804f52734a9a1813737d1152

SHA256
e569f0062072f4f5255a61f2c800906e9e3b68a9aea2cd3d4b9926d31501ff6d

SHA512
01a05e76281af814225a25bed00e3b4b8c9f6311b9043b9e87e6a97d622fc4d56fc9e81a1b2d49bfa05ebb5b4bf9b9dfc866dabb7db85a492034b52a2c827dcf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
3c317efc90eb880134f0bfba2e7f2b5d

SHA1
27a1417d61b14814738cd4a8c9d229eb1798205f

SHA256
7995e8c451d3270f43f8cabf4e0eb457a2af0ba3e43348c991eef2816b440481

SHA512
085b329830d7f86bbe1a68a66c16cf1fc692ec639bf25b197e14805c0c1ad4c68923a162af0d9514d02062e4d65fcc37961a3609285f2c8fc8aa87abf7141579

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
a087db902e5844cf7046d921a971c027

SHA1
7c5228aafb1d8e357c969784b4c582abafa84a41

SHA256
57efe77fd4e24b83bd0651d77cbdd06ed78af5411a86794c09ae59924fcf32eb

SHA512
65a2a5af824240dfe6f07d7fab1acb5285e963fb1947507a1745f73833dfb9d9f3176a98e2b9b3e0d29a9a81e1d9c6d4eea5d5eb0b58dc1c14a68b894e6f15c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
f914843967ccdac50e0f1457149d9021

SHA1
e8adeef71205e927f6bc5fdef64238bd9e452b68

SHA256
2b01a8f0fb3b1d9d8c8df4c0b9555a0d8e6903dcce563be27797f63ee463edcd

SHA512
f2f48f6e9b882fd51152adcf38a22ddba8f3c9d937e9d88a0524b598c56397220f6c1133161b141e6175d0bd5191b68052e555ca653c80e435ebd1ac8ceefeda

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
10973a66a24308c28a9371c5ccfbfe1a

SHA1
6794bf41e9c6d8fbfd67260b3cbdf06d095b59e2

SHA256
71cb95fb27d33eebc8f3927afcc5fef003617fb0577fef775b008a17a6b3b132

SHA512
c7411b29e28643e7e55082476618d7c7228836ce5a3029bffa9d3bad1378b4a96ef15bd0296fb31d2f50636ed692f98d0cb2da28c9ca89a953d3afa0a3f67b19

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
e87dd40b4e3ac006bc79071fc6c4372b

SHA1
58d8eedf152013a7c24c9eb7290cd99902a54e1d

SHA256
de6a03b012aab8ad224d9b637f7cf2d7ce46a0d25c9ab00af92ab572747a2281

SHA512
3bc1871dd47bf8a340869c44396a371206f50eb50b1e0022b7ef963afde4a614b7ec0d563cb7358671cae27a609676fb7d67c3a3f7462909688b10c1315b1b00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
6KB

MD5
8519a705d3f13fad58394abf4ad99bbe

SHA1
197daa2d1d7c7d20327c44abe35d8c867a22fe66

SHA256
ed9d3a660dbe69a3767ae4af23399c821bbf0f97a712e474d9ba0b1a5eb4610a

SHA512
58a499fb577ce8d46cc50ee05c32a991d6de0f970df6192fbcd8eca5e5f1a739fdc63564ce0c787ff7343b60265649b70397064185e4c4fdcca82d83c3f8241d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
15c4f1a2b84522d90b2bcd61e2ed2c25

SHA1
17c4893a18d1c80dee9b41d26cd9af8be635e92c

SHA256
e969a38148efaf431abb8a15ee3a92175d23c4ab8c59e01e2ce98fcceb1195c3

SHA512
b18665e9885ca6b8095b9e923739b6da8fbf66ba956e0b46279f5883e196338a8affacd47595da666a0355cd88350e9fd555d1a6dd39d2f521abdb48342aa436

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
0bd898f48c219d0ded1e2a67c640ffcd

SHA1
3aa3fdac09f6ca779330dadafd9ff644b0a3fab1

SHA256
844999627de5195764ef4b93fb792c4d47e322c5943cfb6b3d4863f09382ca12

SHA512
51c5b63e5fd761323e1398377107910c4060c3d8d0edfeeae496e87d4732d822250cfdbefe7abdfde2fa90c3f1168bc5bffa984af385f8d4242114275b543fc3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
a3216c57e07c41445358a0980a69ac40

SHA1
457872f2f056670aa5cd83040deba2c61a2b2fb7

SHA256
03ac19fc75e7b4268c1f9742560cb836748f7a6b4d47d8bc87d611608e9ec613

SHA512
e013eeb2db8616f9fb9acc84675cf75388543f2c119dd1cd71141d1df1303f59ee5e8bd0eb06781d5a7d514c00a60c007b60277dba4980018630bd423ae00e51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
87974a7b22d7bf0e33d8fc30016974d5

SHA1
b2b89f19510be3ae47dbf9b0d2018a073c6e94c3

SHA256
b397b15f5fdba965253644ad89a6e1fab145f214a0c6c555c9ef4ca37a314f62

SHA512
3a3da7f0d1a7e911201d27683088757f239b5e5c66b6588db754adadaf14172d22d1cd8546a0f8549560d5945a6e6b8eb40098132535a20566a04cd5d7d9017e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
e28a2672ee1fb5ff521f646d7dc1e178

SHA1
0de673a4e84b9807d2ff3eea368eee523b22bc51

SHA256
9e9c85611931b9c2390b1de2db6a4b4dc453d41f97c3539c5c629c7c49332095

SHA512
8b68b94093f084ba65accd50a61a041d638d77b2f5584cb84a0ee4fb643cb49232e3e96334005b83421ed7eb84f1fc1967b9c887070cc45c4a4d4f442aaac36f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
8f569e73ff4c3a4d46bfb1691ad630a8

SHA1
dac01a6464a65a426ccb2453b53a925255f14809

SHA256
c70960659f3d6a10627b4a679468a4748108646a86c1ec1640137d9af0f66c67

SHA512
b2c59813fba8de5ae781bbbebc0dc833b10553f9a261b3a0f3d0118500a2a2db56c2d2472536ef883fcc1f06cfa1fc8cf878bd37a9401cac3324a3a5ca6c48a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
dafa033c24dc00c30a2f6547d55b4be0

SHA1
46b85260c1d10e7083a5d27294120919d51f2380

SHA256
6572d290dbc3cb00a12f57defe6ff498228468b71389a6d189b8f7e9618b992d

SHA512
e4be50a1af62ddcbd088877af9b1b8a508b0d3489497a9bcea949266b8ed3baa54e6bbd07e0f57b29bea2c7dfc0171d5f996d267f100d2f267ecc03663c32aa1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
9546d22eb9565c3490dc6a6887e799ae

SHA1
5e15bee20a944b1fa86ff685c45b9a23847a6a98

SHA256
84cbf6567125d689c390f1050862cf4b4642ac496141d54673e57ddb310e3f45

SHA512
6071aa6c4457f32e53899ae992fbb62609830664c03066f6b2db9172b265cd2ae48b128f3b226df27d46560aa183471ac28dd9954168a5239cef1ffbc32de3f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
ba3bb3e524eb78b7993214424783e5e7

SHA1
131dccd4b103df51902adf1e1f13c7b9697a0ccf

SHA256
5c63031e49a0333c09632abb43c0e92e77ded258a683d6633e3ca53d3f04b227

SHA512
53c62ca35d4c472373eb5e1fde3fba82906a13b7eff3e31fc561ee16f6249ba6abd039971c764ecef64fbbd5833722f337eca2a2dacbb4b0ea0c32282144e62b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
bfe37dff133f48e0282ace6f6860bdc9

SHA1
d72aa1e1c33bda75aee6467edbe168d1adba0b85

SHA256
bfe183651966cd28528374294995a3a8da8f5e6ca4ed395f09851d85ed6e6009

SHA512
f236eb484a7d360c06f11bd92d6bf5a1e283b64a9f9c57380e6172e1dfe1338e7ed823c5bebaa7dde2f470f85237e474246c078950fab4ba139ad0a28216da2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
f745cc6dcc78cd6e8217e255f4b91af1

SHA1
fe62e7f7e8279d5783ddaa85c79859b3359dcb8f

SHA256
763fc643a4fd7d0d32f8f113c32cdb41ec4ee9207610d90464b7839ffdc28410

SHA512
e6023d634da347f21fcac1ead15598d422ee4b76d9a887f67e3545dc2c519658eb1be2536760bb7e8b43171c6f3854c1783024cacbb3a0938cfbd8c1c3b0ee3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
575043dd13c1eb3d61f9881c39f82b36

SHA1
fdb7cf5e4ca119a55186a205395008b8150af76a

SHA256
6108e145ce957b4f9cf156e0644dabf45dd41d7daa3277b6b5cfae87b60d26c8

SHA512
0eea5a7d6d0275b5c3ff414efd446849937444f65474ce2b65824472d70e4e1bae83e63e072b8553de9f0a30f89df09eef6c292f08d287f1d1a3d362ee90a08f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
dc96b5ceca1d8f4b759033835b6959ae

SHA1
91c45f8197dc885ba47e06dd69893517791e4b60

SHA256
122542f973bba5c76be5d54df26068004e798ebe339d3399bfda74f906c6d69a

SHA512
c6ca6f8e7de5a093b9b8679a8a8f1a98dad4e0d3af5cd1b83b1ee9d11405a3369bed5603ab92968aef852f1199f289bcdb0a819652787d461d981ec1860d736b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
4738610904a66622c939ecb96ed05681

SHA1
7656e6d565c5d035a5813d600134768e2c26740d

SHA256
478eaefbce14ab4ec90898c47952d7756338ab3ab19f459452419392b45a3dfd

SHA512
73a2cca9473b1d4ab57ebee1b0ce996882d1e28a96a53884a32af173eec24956998f4cd218afb4c8a3e382889a73728e843098c059e1027d72111ea626dd0813

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
651ab864f5cace9c73e29915be5132a5

SHA1
490507ef2d77a6c10fa0dbd744ea0b4f363b4841

SHA256
ce3083a438051ce3a91d4e316ef2845a12c815f79e2938a4e5ee0351a97348a1

SHA512
be6e9ab127bdf0a6be5e920a15416b337fb0aa5a8cbbbaab71441845f088ec6bd117254aacfe3e9431a338fd75a5a6456e10b6dd657b63977b1d1c7c1079013d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
68ccc2330155a36590663ef7ca94e976

SHA1
b7912ef9a83254a94a748feb656e75f6603b82de

SHA256
2afddeb2f811bf8f33e2ed25d5cbb0b528042a11577d9114613b169eca4a37e6

SHA512
c7fb31e8d40c18b8e7a228ddaa1291999faef7aedaeed04af8dfca3f94891f68bd26738f7c3351922d7ced435d48c52f42d08606ebd83a414ff73127bc35bda8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
c90d97dbe430f0ac7fafe2040254a420

SHA1
7aa8302a93c8fb007264295bd1eb231630dce5f6

SHA256
0aa5ec7bb9692b790372a7530b49309922fa4965d268b40a692acafedfc6d190

SHA512
7b66b6fac7695591a620e9cfbe566975ef2a8cef8210fce60b2c64b8bbe12d59e7a956d736fd76c83b5a12aba469683d5d408b0a11f5116be4ce98f6fa9075ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
c89477cf41d1a3ebea208e3fdbe4b6d7

SHA1
45d0742b533f940f65fcb62880dc58f8b7a631b0

SHA256
752f4281a505fe21df026586e27496ae007f649f67a6c8788012e58070188af4

SHA512
d6cd12ede59c2761547ad8f677d8d85c8eff6d997429d81fbf020bf1447eefc31be1660c7ff64c8e8c5ee0072ad0ed441dd3deab1147f2e97e5f49e2ea7a6de3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
f2ddea366e19bcd35bc2431dd5e3d145

SHA1
add22f1b9ea11b78f799e59a733f535eae27a4d4

SHA256
5013e3d4302cca39ac073fd111dfd5404660a68e6911ebc6fe278d38302b6ed8

SHA512
4b7853fa6eb27a530531ca109c230c8a303e2fd7873d3476cf6e713801bf4bc48d9e2ed67ee6c8ea38faf552f9279a36925df827b9a40a76fd2287676d3bf702

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
74f2ce0612e3e0939653bd21bebbd891

SHA1
c963b7bf90631e026c608edd7c311960debfde47

SHA256
e45d34e6f31e48310f89ad410fda37cb4202dc3bbd67fff55748876e43c70003

SHA512
8ceae7ffba0aea397da4b7cf4597b44487c942ee30b58fae4763cb795ff602b305179ff8600f882c4a8883d88dc792667c666b2d5f833114eb290fbaf71b5010

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
9f96ba6996adb80d8f5503dd8e4a1e65

SHA1
b0df980abbadf7fa4e4f25c6e99d6197d2bf7610

SHA256
620294be772af09b6122932e8357a3d1373bd2e618fd3358c8d8faee5071d574

SHA512
827402d50dee820ce379de005dc1a68c62aa0c003534eab0af5c0474ff516524e2dc9a2e7ee0aaf3f9c75ba7ae2ca530afb64db1aa53cc70dff711bead7f8b7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
5af68ee57cfb487c627b17198df9c1ad

SHA1
d336f147953c26e31aa6a68201436684186c5d55

SHA256
831b45a70453b5e7b1db45f83dd1eb3f45ac1fa3258d2b455c8d70cb2ee03f24

SHA512
fe79118ab35e24f54d8546da2be23b4973a895edc192b4e3d8d9e9ff374fd1458e3c3269d28a5aa2688a218bc65ec380e0fef1e86745e077b0c45541f2a330b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
90920cf58dcf8ed4e71c450875e9953d

SHA1
8040dc7ade924414605631d8e20de63c70d42293

SHA256
9d5e04d639bbc307d462c44e8f878360cff0b42ed4b5f77d1f78476ccd6254ef

SHA512
a8a1fb08605738949eb76881a7b3bfa77c95028ebb1f2381d35b5a2cc9634ae149b5321efe60ba377b6f221e32c29ad0f571cf1df21ef3fc23569036b7e13a32

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
431bdb12f9ba79b4b741caa1c4edc69c

SHA1
132aeac038a2e971c0560a974489c99a9ac4fcb3

SHA256
d8e6fd0d13b19d9d57f0b8b727267edc296285fd73ae667a609f1a82404f605a

SHA512
52e8c7b36d0742b8a18c79fc3ea38e39f7b0bfa2c6f4b4f44fc634e3942491e03f30fc8ce4493af542af2db0b89ee8f6fd8a2a32f57f9c196977cdbd4a7c8d57

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
429ed6765cb56cc10fd633b07cc1d59b

SHA1
27f231809aef48e5d8d564b8c321057b7e774222

SHA256
3ac28c724a9a2469d9d73eceacf1fe9008238232bf9ebd535ab0e2456187119d

SHA512
800cf1798faca04677bd5bd6839b6efd3f5d98ecf29a90ec5dd7c3b16c8c141266272b1d114ba62a935d4cb54b18394cab94e4b2ec5505a0f470406d06bb4d23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
bf76a267503ea1bf9217afaa033653bd

SHA1
19ec488a87792b97006a55c77b4c83aa7ef0a0f1

SHA256
579b62d11c1d7b8a7b2c78343687b2d3e11c11b9838685a7eca8e2f71a67c660

SHA512
31c44a4b4d63bff44dea85491cca18d230c91420e4c300296bafccfb47caabca316c226225bed758a779c108c223d0497bbe551bc78eb3efbe38fefbcca793bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
2f2713750715e1ce11cfb740d48b1de0

SHA1
8274dfb142b2c0e17d53db50429ff55f1fbbe399

SHA256
387d421f7cc4f013b2f6e3792129a26882234df231cffe1247787763b941a4e0

SHA512
1d450a761a263c3ce19303ec99cde1784b42e409c4f4a512b905029119e5b0fcfc8719c320ceb8ce28a2c126539197b64f63652b3fa4e62726888dbf839115e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
d10c0d05c5ce6aa0efeeed9883a5d65f

SHA1
81d997a55ee95559dae5f50b1088e4996cb0974f

SHA256
ce65ebe6b75c54f681bd71c00ad157674757869a16d9fad42dad436a877ac64d

SHA512
c5d5490c0696bb28b1ff940459762a7b1839492f5c305d409364afff49832de5ce2d9ef26a8fca6eab9fddc97cdf2edca90cab6ad7b522e5cc0a8bd8458473fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
7284e08ced781a55bc43f6abe221eaef

SHA1
20de7c9749366cca2794c76063aede365925bdcd

SHA256
ffa6fe04c8f5d09db61f672c96ac36d6231ddfa25659d35751e0e7109d850b17

SHA512
180e3d64a5d06db714a1b29511e0ae16a67b7df9ddf03da8c3928fe5c22524b1e83653e719048fddd118136a6de4962b6b3d6cd7baf5c8bd5f7acb2e3cf36054

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
36f9ca57a9a76ae651fa3f46fa834af8

SHA1
b01e311dca1293b5b34abaed79e2d317ba9f4caa

SHA256
2665e67e757633792249c198d400d1a2ab5b713da6881021c8d3deb1a0ec01c8

SHA512
f7967d47aee87a0a4735920e891f4783a7c18bd633bc4e7b1263c031b14833bd8bca73da4499cb3d81f971e2f5133f00d40a54ae7ba1d16fb2ac2e6c1828710f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
d6edeaadcfdc53bc99e2aadbbc6cdc6c

SHA1
881e0b205a9431570cae602e96c18f3e8e7dbd87

SHA256
6dbb0c8e545c02522e0eb3d47b2cb65a7d789d7f59397ffd606433805b010611

SHA512
1972e5906330e9170a95a19c3aaa125efba761850c438214d8ec91d12183fb38efee74fb21675fd509aa0f3e247509b162076c12603a38297f2607daf474042a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
d239e0cb5476dcc6112764da3e06b039

SHA1
96aa9c4364c2ba21e2da77eafed20f7def17d87d

SHA256
52fa29ad52965b45b5ac986d1e3df46684cebc25b1e4b01afa047e3524d37840

SHA512
b92779d11db1fcd6c53633e411028d01917e2f284a5bf5d4231c78a06ffcc8a9d321f10af0f83e87c0b34ddc60a9451e5e4687609d6ac024837a4803a70e0cac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
c070a9a046ea5f97a3f65cf7ecbcfb55

SHA1
1d81807cd048609da255fe534c8357797a422f74

SHA256
0fc77e410e473dc48572ec067c6dd252af812967fd73c915a3f9ec7200a048a3

SHA512
394bb6a8f0988ab03f8a210158e985291cbb03945009c3e9d60d3eb52f774c1b08b97eaec5a78ec3517c83d84eec51674867efad8bf85267a638e8cc55600918

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
b32bf075167a0c973b14b25fc10f8e6a

SHA1
6569b7c8458b931bf74b4ba740803032e4e0203f

SHA256
c334e136b7e7ea1c09631a50ee4f38a2ede831798ab1f784304a74ec9e56c84e

SHA512
0ac46e63530df3bd03c63a44a8e0a4aaac5050eb076c2d052f8296f810abf332da207ade2d5d5ee5b48dd1c1542e68ffe74b182e0c7e19772d2fea4016ce6b7a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
03d717fc4d974bdd965185d54780f129

SHA1
d33483da77515cdd15a3d6af8473468b8af10e9d

SHA256
39f3cbf0dad50286cb08b41edd3cc8dd1349688c48f4e2784d11cd55ee5116f9

SHA512
a330dc66444ddf54619b79e30094acd2f190446464a24480c6f89c78fb1b42d0fe8b00e0fd598a0cad91bee77e1622724364cc09c1ed4775362797191e8ad58a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
25a02e4532e188be2998617e82a35c6e

SHA1
7b7a3a48447bc46d1b1a8bd97ae1db981f90f845

SHA256
1922758e7ed13f61f9d5c4bcefb7847ebf9e1399c5631a85be953fd8ae8627b6

SHA512
7abdcc68dc8f53c2a4c00955c0a11456f3d75be5aa5462c2f20f58d06e48ff9b15b3949dbe2ebcb709539b42409215053ad2891d539126804eb43fa0be92077f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
6c14d0a51b87bad21887178bba57b3ba

SHA1
cbc0c6da8057484f68de2708827797c16e2ee45e

SHA256
d1b6c9b87c91dfaf0d4cfcb89736d3b861f9e7f4f82f7d8f8d3b9ae5376161dd

SHA512
16d2dcac8cd50bdee5b78f9109c6e62bf9b73b7bdcf06fbcf2c983fe1c5bc10d47d809cb1f3929f2ee72e76a8de6e2896635b48cb1da07a2d1ab0dac05ef7d60

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5a2be4.TMP

Filesize
872B

MD5
37922a65448b76a1846cddbf8515de83

SHA1
74faf94c68c614b2084b984c6c934abacbe94dcc

SHA256
bd888a4df44854e2b4cb6c4a6b5bd8c5c4bcf65cd2cf55490c136edaa59e1ef3

SHA512
db322ae212ebc34c0cb4b162e9ea17ba48c279c6dc4661df2920cda0a2d602ca92fe11a731fbd1dc9430fa36b27268bebc3e72444085e9d8c26eab176e595ca5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
77df09785fb5052f1a83ce5b3a62c423

SHA1
d6307cd6d25824b8f985a8947d5360a6163b6717

SHA256
eb7a5c46807ce399118f53f1362d5625d764150aaea29abb97a6a7492042906f

SHA512
77df723bff4c04674b320755a132bde476a7db681fc947943548c4a8ba436ab3e547af72f074b3b46758b9da31ed33f998456b95eff0ea57ffd2e6c347300304

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6a61a0a6a7b0d140261403e6ec994a7d

SHA1
41d613528d02ce4cc05b984fc4988dfd2455e563

SHA256
593fd84afa8afc51404ee1e942848604025a4b8bdcbe146276f965bb5aed2b05

SHA512
b466646188fe74ee3a87fc082bfbbea3581582388f569f41f5f85e3fc700e27192d7aa621403f963f8ba8a3855966d2f8616d4f79170cab295e696d4c5aea117

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
e98e693e41ff874cc5c88360c91dcd68

SHA1
8797855cab53656a02429541dfba32885834730d

SHA256
d335d6f706bf0d17101ed08877f4b24b72e337d7cf1463d7fda76f08cc9e1e43

SHA512
76b70a79ac4c19365c4ff0bfe59398260f580d5b3f0cfeac2b440667aff670bffb832b85d8b8b5bae3ffd9d69c2a8b14dfaea3e915b964076539af9903f7e5a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
a6b5979047ace9b4299a76dfbf531ce4

SHA1
688adf2c5a0a8386afbe81a977f2e7228b803296

SHA256
28594acd97f5ffd79be82aa40eb2a274b455a3d49dbee97ddc38acef6836c8a9

SHA512
2694d6843f19fd41a73ef24f6b517ce17ece8f78c585ea647f92fe8b8ec45b17a707fa0b64b1e0f7c2e5b6ce29a4dd7a19a87eb4d79813ef099188d91400b421

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
303c6a7dc05e503d96338b5bd89ad28e

SHA1
f91b746fef3be6eb10103e42f521de517861edc1

SHA256
4048f032178f896126173e1c6430ac8476a99028eb1f889812529e4c65a91097

SHA512
2d251be0a0637f23755807651a936ddcb87c117f58022682c419e1bd0bb09237463569303d51071dbd27a283d98055054ee411144f6bb590679a1d947090dc05

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20240830230119_000_vcRuntimeMinimum_x64.log

Filesize
2KB

MD5
89cb3ac86d976c149ee2ef8876034510

SHA1
2cb6decb163978ffce73a33e923a7b533d7ad4c8

SHA256
ea9dfefb5129204c107dcc838a8334206d00c335034b56445e86d38f0c584db3

SHA512
70326c1436b3b8472ef1d4bdc5c9f11c0d45b5ecc97dae5fb00e8b1e01f014c7b7ba14127e43d7abb2a10143fcbacec4703ebfb86c5486aefd027fb6ca870e50

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20240830230119_001_vcRuntimeAdditional_x64.log

Filesize
2KB

MD5
d1cb08c69cf8a6828c07c8cd91b404e0

SHA1
5124a49811e205fc048f68c40fc7ba786e8dc359

SHA256
97bd73cccc5d205570258232c473b43c66875b0bcaf1e69b67d9a361a0b63918

SHA512
5e74129d9196e99e883e692a37d424050713f31e31d91704f0b18313596b0c26585d3f8eda725dfa5f3b7b1454aeb46d486c034bd50c22d337e4afdbdc721f6d

Download Submit
C:\Users\Admin\AppData\Local\Temp\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\.ba1\logo.png

Filesize
1KB

MD5
d6bd210f227442b3362493d046cea233

SHA1
ff286ac8370fc655aea0ef35e9cf0bfcb6d698de

SHA256
335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef

SHA512
464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\.ba1\wixstdba.dll

Filesize
117KB

MD5
a52e5220efb60813b31a82d101a97dcb

SHA1
56e16e4df0944cb07e73a01301886644f062d79b

SHA256
e7c8e7edd9112137895820e789baaaeca41626b01fb99fede82968ddb66d02cf

SHA512
d6565ba18b5b9795d6bde3ef94d8f7cd77bf8bb69ba3fe7adefb80fc7c5d888cdfdc79238d86a0839846aea4a1e51fc0caed3d62f7054885e8b15fad9f6c654e

Download Submit
C:\Users\Admin\AppData\Local\Temp\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\.be\vcredist_x64.exe

Filesize
455KB

MD5
3284088a2d414d65e865004fdb641936

SHA1
7f3e9180d9025fc14c8a7868b763b0c3e7a900b4

SHA256
102f69b5a98352a6a1a6b26bc2c86ee7611c1f45f5a9ca04f5a8841961f191c6

SHA512
6786fb431addf05df256d0e1383501f96356aa78f66482db9772c58334aead59838abb7db0ea793d4a17627a357598266681c28328485489a21bc2985e751b62

Download Submit
C:\Users\Admin\AppData\Local\Temp\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\cab2C04DDC374BD96EB5C8EB8208F2C7C92

Filesize
5.3MB

MD5
f5879f5f3ffa839a280ab853338de872

SHA1
3b4366abb2da245416531925ebd8c76adc3e90ef

SHA256
1f2f8f5d60dadbc6e4d3d36c88cc54f22af0a615b609609e748782dc26231174

SHA512
96a88601cedf859c9fcd388d9e8d2fd6139f6e69ab6b05b0e044d1a598cd1a066d27a0f7a7c71bd77576dcdd083dec7a55f2cd9de52ff95aac23171c9f9670de

Download Submit
C:\Users\Admin\AppData\Local\Temp\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\cab5046A8AB272BF37297BB7928664C9503

Filesize
1010KB

MD5
361903c5ff86511786d7b450301dd640

SHA1
c9fc04a718a388294658590f1240d8c7e9ee4f82

SHA256
e95d29cbb06bb323d9d43fc2ce61d4565b0866622a83d93df76430a0c252b433

SHA512
78ceaaaa7f3e1a40ac2528e2f169416d6ebfaba54301754035f2a62f845421c8cddaed84770182e51794c9fb32720aec998d453de2bef621de7a7e2b3b35af20

Download Submit
C:\Users\Admin\AppData\Local\Temp\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcRuntimeAdditional_x64

Filesize
140KB

MD5
4f782799f84cd006f7f1c750afb04d8c

SHA1
0cd219d326fd40665d2f1b22569e2517792edfd9

SHA256
8909e5c1d917064983595a4e4717f758c2a8df8f59d7b31a5b79b2f95bd8f7cc

SHA512
cfddad551aa5a35b032b7006b167fd322aff46ec8a2934632c087882b24404ee48083ee38b9110add9846880b1ae0bed136bb21ae751e1d3cde9dc27eaed5915

Download Submit
C:\Users\Admin\AppData\Local\Temp\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcRuntimeMinimum_x64

Filesize
140KB

MD5
87b74c694f295830ffe516ba20de0b93

SHA1
e6996d47bb76ad25954b793f73211524490f55a9

SHA256
e88d0915814e622cd1deca849efa23a0d58d5d756be44ebbb4d460d3dac9e816

SHA512
d0fd7f8c8964a99ce7a9d187640acdbff4ca3d16f02e44696706d6107b58890e763a18857bec2b94f92ca559510fea0ae5515ce3de20aa4371aebb38006c05eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\{15F58FAC-2ACA-454B-8B1D-D5F40948AFBF}\vcredist_x64_vc12.exe

Filesize
6.9MB

MD5
49b1164f8e95ec6409ea83cdb352d8da

SHA1
1194e6bf4153fa88f20b2a70ac15bc359ada4ee2

SHA256
a4bba7701e355ae29c403431f871a537897c363e215cafe706615e270984f17c

SHA512
29b65e45ce5233f5ad480673752529026f59a760466a1026bb92fc78d1ccc82396ecb8f07b0e49c9b2315dbef976cb417273c77f4209475036775fe687dd2d60

Download Submit
C:\Users\Admin\AppData\Local\Temp\{15F58FAC-2ACA-454B-8B1D-D5F40948AFBF}\vcredist_x86_vc12.exe

Filesize
6.2MB

MD5
38a1b890ce847167d16567cf7b7a5642

SHA1
0f5d66bcaf120f2d3f340e448a268fe4bbf7709d

SHA256
53b605d1100ab0a88b867447bbf9274b5938125024ba01f5105a9e178a3dcdbd

SHA512
907a9aac75f4f241a85ecb94690f74f5818eea0b2241d9ef6d4bf171f17da0f4bc702e2bb90c04f194592fcc61df5c250508d16b886ed837a74b9f45da9627cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\{9dff3540-fc85-4ed5-ac84-9e3c7fd8bece}\.ba1\license.rtf

Filesize
6KB

MD5
1e47ee7b71b22488068343df4ce30534

SHA1
deaee13f21ab70b57f44f0aa3128ec7ad9e3816a

SHA256
8518f0420972c1dbe8a323ffc6f57863af0b80c6a3b27fd0c6fc9bdabb7e2d13

SHA512
c4c653bfd1fc493b0efd8f9c75495287818179dc35969d1fb1927faac3ff9189fde1131c5abbcc3963f707412a7f8ad05a9e6855b7d47d6df1f80d25d67be9ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\{9dff3540-fc85-4ed5-ac84-9e3c7fd8bece}\.ba1\thm.wxl

Filesize
2KB

MD5
fbfcbc4dacc566a3c426f43ce10907b6

SHA1
63c45f9a771161740e100faf710f30eed017d723

SHA256
70400f181d00e1769774ff36bcd8b1ab5fbc431418067d31b876d18cc04ef4ce

SHA512
063fb6685ee8d2fa57863a74d66a83c819fe848ba3072b6e7d1b4fe397a9b24a1037183bb2fda776033c0936be83888a6456aae947e240521e2ab75d984ee35e

Download Submit
C:\Users\Admin\AppData\Local\Temp\{9dff3540-fc85-4ed5-ac84-9e3c7fd8bece}\.ba1\thm.xml

Filesize
5KB

MD5
0056f10a42638ea8b4befc614741ddd6

SHA1
61d488cfbea063e028a947cb1610ee372d873c9f

SHA256
6b1ba0dea830e556a58c883290faa5d49c064e546cbfcd0451596a10cc693f87

SHA512
5764ec92f65acc4ebe4de1e2b58b8817e81e0a6bc2f6e451317347e28d66e1e6a3773d7f18be067bbb2cb52ef1fa267754ad2bf2529286cf53730a03409d398e

Download Submit
C:\Users\Admin\AppData\Local\Temp\{9dff3540-fc85-4ed5-ac84-9e3c7fd8bece}\.be\vcredist_x86.exe

Filesize
455KB

MD5
0ce624d3a5a586c2bdda26b748da78d7

SHA1
b9ed0a86eae645ba19ed08327888a4474c95e34a

SHA256
fd597b58a578cfa46e1818b3b4b795ca6d25225dc11ee86cd491f3d55d7b235d

SHA512
e5bc577bd319eb3ac70c527acfb313fac817e63f5184e6581f6d813491ca0f1a0f80583c14c2b9f2b8fa1df5938c2ae3318a91bda41171c63cd1670c55a85b7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\{9dff3540-fc85-4ed5-ac84-9e3c7fd8bece}\vcRuntimeMinimum_x86

Filesize
140KB

MD5
89d36fccb34b319b60d1850863e0560b

SHA1
f356410e3946063b85750f54998582510b9672c8

SHA256
60714fcdac0a7cbfc45e6ed9bc6d4b7f8536947f630016e5faca5cce1745adcf

SHA512
24e167d0305811409e433c8d78716e9b3af4bce4b3f372276f4730ae7c802b8be8f193a70ac0d44ad6e083a35f03fcfdb2faaae4a9975c9e2ef1254285b0309f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\Downloads\DaVinci Resolve Studio 19.0.0.59 PUBLIC BETA 6\Install Resolve 19.0b.exe

Filesize
2.2MB

MD5
2bcaa33e4d9123ebc9c5bb80b19754ed

SHA1
07d261fe90ae440625f0c2c86b01a7c4109c5f7b

SHA256
a37baa2ab6b8fde0bb291864e738c67f4f8aa799fc35ce9ffadb346a841c590f

SHA512
c4240be23e2d5cc0609637abc7e6ad490c2ae1e59b490c8b7ad50fe80647a8121acbe2313c327d22f1a9dcc0357b02b7b0d7c8829947e5eb8efda73e60da3931

Download Submit
C:\Windows\Installer\$PatchCache$\Managed\FA027358EB1840B479003FA25093716B\4.2.0\concrt140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3

Filesize
308KB

MD5
c4fe3f03efd3188252caa101f954ffeb

SHA1
98b613aee45c71aed9d2be0d61d7ace323929e9c

SHA256
95bb425be3d515a6a58f7399d44dd9e032baea11667dfdba29517c460171880a

SHA512
80018e0bddf079367d3568433a5f89f0144aa0a75286b0105fe32aeeb5d80876c9b2e1ecaafb70fb041271e27a234a2cb88a2d3d160a4aa3768ccfcfc574704a

Download Submit
C:\Windows\Installer\$PatchCache$\Managed\FA027358EB1840B479003FA25093716B\4.2.0\mfc140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3

Filesize
5.4MB

MD5
e540e32dc0f1de104489ebb8d121c557

SHA1
4fa413bef6062f4c3dcd43d54c48120ad61fcfa7

SHA256
c918ce99e262420c2a7414bc019f38ce8c991622bebc0c0b2b5e582e3b26cfcc

SHA512
ff4e68ba7f702ed5453abd735584f02a876f744f16723d94c110db411d9f648fe1f18efd8a17b3f95277e73c7f2668b12cfaba71897041533be092669a4c2c09

Download Submit
C:\Windows\Installer\$PatchCache$\Managed\FA027358EB1840B479003FA25093716B\4.2.0\mfc140u.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3

Filesize
5.4MB

MD5
bda662edbcc09f3b816ff2d1563500cf

SHA1
7c240310894e18558427c49b7e1bf13c397f9be3

SHA256
4720008617433038006b89031fafe459b4e1f7246c537ebd6df72ea386704f7a

SHA512
1b91d015e3fbd703e8bc8568b8cb5173b4120e5bd56e1843dda8353d1744253e468e467fe8a8d14634028ea87df856d062af2594865f255d1f83f160622e10ca

Download Submit
C:\Windows\Installer\$PatchCache$\Managed\FA027358EB1840B479003FA25093716B\4.2.0\mfcm140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3

Filesize
82KB

MD5
9ab741143a580e76755dbcef800563d3

SHA1
541bba78a3b01252fdecb60ddd0a7d5fc5da4301

SHA256
f15b4252eb211a1082d33498502bc69f2243a3d09cda5136dc798067b7ba752f

SHA512
aeeb37beb264cc870ee48abef80afe48dcf4fc9999e08009e52760a29949fb941dbc2039af217f06a60e09a83581b633095728499df275b4bd9bc811561a9352

Download Submit
C:\Windows\Installer\$PatchCache$\Managed\FA027358EB1840B479003FA25093716B\4.2.0\mfcm140u.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3

Filesize
82KB

MD5
648732592bc02cfc7d6482e0629f365c

SHA1
f9e9e40fa494ea6502e6137db4f9ffcf3040c1d3

SHA256
12dcbd0b01544354c95a6ec78c87ef2873d4d8a5743a73dc085cc6a65ddae160

SHA512
7b26ab4db00f408d790a7616ee0d4ee8d9175f13ca811deeb5be83f1633538df0fd9a4883ae2da676102856fb7e78c81de76d382bedc8a89b354e4a6b15c8d4b

Download Submit
C:\Windows\Installer\$PatchCache$\Managed\FA027358EB1840B479003FA25093716B\4.2.0\msvcp140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3

Filesize
552KB

MD5
cd0c37f1875b704f8eb08e397381ac16

SHA1
249d33c43e105a1c36ec6a24e5ef8dbc5f56b31b

SHA256
d86ac158123a245b927592c80cc020fea29c8c4addc144466c4625a00ca9c77a

SHA512
d60c56716399b417e1d9d7d739af13674c8572974f220a44e5e4e9ab0b0a23b8937bd0929eee9f03f20b7f74db008f70f9559a7eb66948b3afab5b96bdd1a6d5

Download Submit
C:\Windows\Installer\$PatchCache$\Managed\FA027358EB1840B479003FA25093716B\4.2.0\msvcp140_1.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3

Filesize
23KB

MD5
8ad9c7cffbb2413f4d5ff9f3aaa1a69b

SHA1
2b5116e49ac5913ef8a512a7299e9a459dab4778

SHA256
18aef42187072c35b537be80e3b2da7ce4919b2c9574add19409d98e3026d916

SHA512
d489b82ce896a06cd37905bc5b2fe9620f4e7feb2a9b77fc93f94e0270b67e7a2f3879afba6b546ad44f2ee96f050e83bfc93830010a707126667857be79028a

Download Submit
C:\Windows\Installer\$PatchCache$\Managed\FA027358EB1840B479003FA25093716B\4.2.0\msvcp140_2.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3

Filesize
181KB

MD5
84269806dce633e56e492ef060fa8f88

SHA1
a1e71cb750d25e7a63e0c9d0b01063df421f1938

SHA256
5fca695ed2cefec010d546310699226eef4b305df38cbe3dea2fdf9494abc163

SHA512
b25d25a35e6e431bacaf4d5fea0e40f3fe49cca14895c64ddbd78c212a2ef0b09b56616154a3d26813e9faaf3db1f6bb24a300b5f39b8ce286a41a12f6920ef1

Download Submit
C:\Windows\Installer\$PatchCache$\Managed\FA027358EB1840B479003FA25093716B\4.2.0\msvcp140_atomic_wait.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3

Filesize
54KB

MD5
1d2a0d23e35b93464bb5b09e5e4c02b2

SHA1
04d1a1eed3868433c5b7652ecae0fdcd29e1ef39

SHA256
a577b5fc4e3a14ae141657c30a38d11ff8593135e51e55485b252eb821d47e75

SHA512
18a0db760e4c4d9c4e014cff5ee0f433b298b65fdeca95b8f5f172b9bc534a1c7f64a1b2751b90e89cf76f41ee1ab468415466d2a657905eca9835e41cae264e

Download Submit
C:\Windows\Installer\$PatchCache$\Managed\FA027358EB1840B479003FA25093716B\4.2.0\msvcp140_codecvt_ids.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3

Filesize
19KB

MD5
4266e7bb9bfce998083d2f4f938b11c9

SHA1
23fc9c4c9de9fd3e71941df86e26c4dd44f2a95b

SHA256
e1ee6d29e30708ad5812035626bbc1058ea12fd5503d5a79d28c9cb67fab4a14

SHA512
5dc1e769f973aec3f0f766ad7c2364a184b9f71c1266f5e5a874c3e63ca7082e9a2c38346d387aa516e2f23acaaf62979434819697b2695644883ce07bbfd867

Download Submit
C:\Windows\Installer\$PatchCache$\Managed\FA027358EB1840B479003FA25093716B\4.2.0\vccorlib140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3

Filesize
326KB

MD5
7ef7eab654df53e087ac4703c9ea0b16

SHA1
743dc76d168326b60f09347945fe1342a6effc4c

SHA256
13e568fdcde1b7b7f2d1c97a474bdb8858f5ab761157f0fea7201ccecf84b9b8

SHA512
0b860f10c03acb3866e82fd6044c29d63a2c6a1d5f6628f3d31f1cd1e44d7144e3660df3446b7a0b76b7811b261675e5aa39fb27efeec060d287fde3e630edd2

Download Submit
C:\Windows\Installer\$PatchCache$\Managed\FA027358EB1840B479003FA25093716B\4.2.0\vcruntime140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3

Filesize
94KB

MD5
11d9ac94e8cb17bd23dea89f8e757f18

SHA1
d4fb80a512486821ad320c4fd67abcae63005158

SHA256
e1d6f78a72836ea120bd27a33ae89cbdc3f3ca7d9d0231aaa3aac91996d2fa4e

SHA512
aa6afd6bea27f554e3646152d8c4f96f7bcaaa4933f8b7c04346e410f93f23cfa6d29362fd5d51ccbb8b6223e094cd89e351f072ad0517553703f5bf9de28778

Download Submit
C:\Windows\Installer\$PatchCache$\Managed\FA027358EB1840B479003FA25093716B\4.2.0\vcruntime140_1.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3

Filesize
36KB

MD5
7667b0883de4667ec87c3b75bed84d84

SHA1
e6f6df83e813ed8252614a46a5892c4856df1f58

SHA256
04e7ccbdcad7cbaf0ed28692fb08eab832c38aad9071749037ee7a58f45e9d7d

SHA512
968cbaafe416a9e398c5bfd8c5825fa813462ae207d17072c035f916742517edc42349a72ab6795199d34ccece259d5f2f63587cfaeb0026c0667632b05c5c74

Download Submit
C:\Windows\Installer\MSI1123.tmp

Filesize
690KB

MD5
8deb7d2f91c7392925718b3ba0aade22

SHA1
fc8e9b10c83e16eb0af1b6f10128f5c37b389682

SHA256
cb42fac1aebb6e1ac4907a38035b218b5f992d1bcd4dece11b1664a588e876e4

SHA512
37f2c132b632c8e5a336bdc773d953c7f39872b1bae2ba34fbaf7794a477fd0dcb9ff60a3ddb447fe76abd98e557bd5ee544876584adea152b0841b3e313054c

Download Submit
C:\Windows\Installer\e60a6cb.msi

Filesize
30.4MB

MD5
178947d0985da76f86f47457e8b665b4

SHA1
5b7bed37cbae69033f14687ce5bfc736ffd42053

SHA256
fffdbcfa7b513c0de0bda5fa2fdcfa9e84f9af4213fc275916275b54df1f981c

SHA512
df255776faa2fcc534f8a126c44bfc5da236758296e755f4f1d6fc806a1c7a436e93847df3460d09c3afd6de0cd2f006c668340e1fac4216662265eb76ed8ef2

Download Submit
C:\Windows\System32\DriverStore\Temp\{82c015f6-385b-2549-833a-9e7ce5eaee93}\DaVinciKeyboards.cat

Filesize
11KB

MD5
b902fd25f64157c7f9bd844d19e1e495

SHA1
7a42275995a5cd2937694a1525dccefd9f2af1cd

SHA256
a5deb1647ebee14f8df7ff16c72b8787af9d6a6eb4649d30048b2cfc718dcd0c

SHA512
759a944910c4c011b9e02acc4cf97095212db7e0101636d9b273cfbda35d49513332413333ef8b15701ff47319086162082be8228e032107d04b9757a8bbd218

Download Submit
C:\Windows\System32\DriverStore\Temp\{82c015f6-385b-2549-833a-9e7ce5eaee93}\DaVinciKeyboards.inf

Filesize
1KB

MD5
78c694624641443a8a1dd8aef72a356f

SHA1
97e4f69e1ae0e9109f67231e5452e1bfa5302000

SHA256
1a16f18d9c0512f60ef0bbaa99e2ca72f0970333093673783f1ee1c14a79bd2a

SHA512
d40c13f03ea7eb51f7763b10b4fa9a48688c675f79cd4470e1b64fed52120059c081b34777d280906bcbc94a63a1e4fe6b3f85ca477da8f70a28c08ad4d9c8a4

Download Submit
C:\Windows\System32\DriverStore\Temp\{82c015f6-385b-2549-833a-9e7ce5eaee93}\DaVinciKeyboards.sys

Filesize
27KB

MD5
3d2d254e23aba6fe3349953f3d7bec3d

SHA1
4d31565cbb013cbca3a2a89be7f06e03a6433e0e

SHA256
416d6c6ace773ca544d0fd997a898d91224c66f65778e9add1f30a493b4d76ce

SHA512
4ccee6ddefc3c3d59881d601f463c1d00cb714e27303fba391cae247950040a31901398acdb5c0531e6395220ec27ecc0d3069c90c55d28e7c8b972760737a1d

Download Submit
C:\Windows\System32\DriverStore\Temp\{ab55316a-a7b5-184b-b11e-a35fcac72d60}\DaVinciPanels.cat

Filesize
12KB

MD5
93352995bbe1f4349e1077a791d38044

SHA1
6e9ecb554e4bec96a5f498ff05b5502bc3780343

SHA256
24eb024f4cf56562017115db454972b21e1295f763e081499b8cec51d40d7366

SHA512
7d0d26d9cdbab0a74662a3d8062b5758bc4dc8463cf4c47322b5d7aef5d1d02bbad5013c97e38a24dced97a1cc0f3546a1ca5b35ea5d0dee8496a54ccbc1f9dd

Download Submit
C:\Windows\System32\DriverStore\Temp\{ab55316a-a7b5-184b-b11e-a35fcac72d60}\DaVinciPanels.inf

Filesize
2KB

MD5
f025f7d6bb5364a543e90f00bca73902

SHA1
5815aa7e5aa6c84c0f35cffb2a3002de6d37cea6

SHA256
df6521d4335614cc289aa27777dbae8b4ef45a4950b9ebdbccab7fddd38f867a

SHA512
979622cc906e0e03b32925eb0358f262ec454e44bf37d584728e1178ea7ab9c51f9389f194d8c23005e160fdb8e3836323b8125bbe0917a955c98797383fc7ad

Download Submit
C:\Windows\System32\DriverStore\Temp\{ab55316a-a7b5-184b-b11e-a35fcac72d60}\DaVinciPanels.sys

Filesize
27KB

MD5
894704d5727b53a30c96e35d17c46618

SHA1
2ffa87a39688a214bf472c497a63c226c079dc5b

SHA256
4b41bca637fbc269a9191dbcbc6c8981684fdf0532168606b614ae1281f2db0b

SHA512
eab1af572ebdc8ea02f42fd97e1ad2d054b55feb7afc10e75075e951b8e581e4e4a631df5161a0ff0d23db4c3441f96510ea6474d1e6671a6b4f2fe5b8f61a38

Download Submit
C:\Windows\System32\DriverStore\Temp\{b5271e53-9d7c-2b49-b653-6c25394ba434}\FairlightPanels.cat

Filesize
12KB

MD5
95dc4bb3186e8482b8616ea6cee69f62

SHA1
726695e911382ddad3552f4521dc04ff550cae53

SHA256
1a34bb0f8f48f470e3b9e07b432b46b2d8b1d5842786ee7ed8f9bc18c5a743db

SHA512
f02d94a6e5cadb80a0e0c106f91444d32e50a879ba5ee391cf94e33672fb388551a3d58ddaafe63ca8b6db47538946ff4d90d13f544f584ace01258875d0b822

Download Submit
C:\Windows\System32\DriverStore\Temp\{b5271e53-9d7c-2b49-b653-6c25394ba434}\FairlightPanels.inf

Filesize
2KB

MD5
181cb91bc4770186e9f50311067a2a50

SHA1
d767704478d3253b57dd224f239e418825668291

SHA256
49df39f50f382b8054dd54474801a2a334d00d655fe35b0b2127b685ec176bdc

SHA512
d2028055e23611c2f70abaaad7cb2798612ed1096bb337336da828423730da13ee04bf4d866e96085579a846ea6afe3e033931d64fa559b8cdd803a8247712f0

Download Submit
C:\Windows\System32\DriverStore\Temp\{b5271e53-9d7c-2b49-b653-6c25394ba434}\FairlightPanels.sys

Filesize
27KB

MD5
1de9bd0c69af971178c089a325502110

SHA1
3032fdb4f702d87fac872c1b24eee2b09f4290b9

SHA256
01dbc5e4c32773ddab6447dc54651fc2bbeb0b03586d061ad43b239d19cbc5f6

SHA512
eeefaee8157ccbc9f47416c0d827b409f9069787ebde7762330102d4cf58a5ebf2a7d8da3f842f91629b112f5245f6489168575128fc3a2e666975aaa5f72155

Download Submit
C:\Windows\System32\catroot2\dberr.txt

Filesize
19KB

MD5
31c9b1a2d3e16e3f4a5fadf8543b9f2d

SHA1
a1666a3785079db403742b5eda7cb4e5ab7fffcc

SHA256
f6a7088c7c3428f4251ab5bd50dda73bf647950131f421e99d608c0e5bc56baf

SHA512
e9830eac7ce830004d42bd3e09de18276d587dc92af578dee042bfdfb2f767b0a9ef4b3ef5759149313d4f92e8d8d0865b57401f01d521a6d517ac1d09b7a02f

Download Submit
memory/3204-2206-0x00000000007C0000-0x0000000000825000-memory.dmp

Filesize
404KB

Download
memory/3604-1826-0x0000000000070000-0x00000000000D5000-memory.dmp

Filesize
404KB

Download
memory/3752-1825-0x0000000000070000-0x00000000000D5000-memory.dmp

Filesize
404KB

Download
memory/5704-2025-0x000001BCB9600000-0x000001BCBA0C1000-memory.dmp

Filesize
10.8MB

Download
memory/5704-3201-0x000001BCB9600000-0x000001BCBA0C1000-memory.dmp

Filesize
10.8MB

Download
memory/5704-2236-0x000001BCB9600000-0x000001BCBA0C1000-memory.dmp

Filesize
10.8MB

Download
memory/6128-2205-0x00000000007C0000-0x0000000000825000-memory.dmp

Filesize
404KB

Download