hxxps://drive[.]google[.]com/file/d/11i9tYo5vgIAWLnhbebWXBg5c-sC_HUER/view

Analysis

max time kernel
267s
max time network
267s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
13-09-2024 02:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/11i9tYo5vgIAWLnhbebWXBg5c-sC_HUER/view

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
4676	Set-up.exe
1084	Set-up.exe
4128	autoplay.exe

Drops desktop.ini file(s) 26 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\Adobe Audition 2023 - New Boss -\Redes Sociais e Grupos Exclusivos - New Boss -\Telegram\desktop.ini	7zG.exe
File opened for modification	C:\Users\Admin\Downloads\Adobe Audition 2023 - New Boss -\Redes Sociais e Grupos Exclusivos - New Boss -\Telegram\desktop.ini	7zG.exe
File created	C:\Users\Admin\Downloads\Adobe Audition 2023 - New Boss -\Redes Sociais e Grupos Exclusivos - New Boss -\Youtube\desktop.ini	7zG.exe
File created	C:\Users\Admin\Downloads\Adobe Audition 2023 - New Boss -\Redes Sociais e Grupos Exclusivos - New Boss -\Ajude O Nosso Canal\desktop.ini	7zG.exe
File created	C:\Users\Admin\Downloads\Adobe Audition 2023 - New Boss -\Redes Sociais e Grupos Exclusivos - New Boss -\desktop.ini	7zG.exe
File created	C:\Users\Admin\Downloads\Adobe Audition 2023 - New Boss -\Redes Sociais e Grupos Exclusivos - New Boss -\Grupo Exclusivo de WhatsApp -New Boss-\desktop.ini	7zG.exe
File opened for modification	C:\Users\Admin\Downloads\Adobe Audition 2023 - New Boss -\Redes Sociais e Grupos Exclusivos - New Boss -\Grupo Exclusivo de WhatsApp -New Boss-\desktop.ini	7zG.exe
File opened for modification	C:\Users\Admin\Downloads\Adobe Audition 2023 - New Boss -\Redes Sociais e Grupos Exclusivos - New Boss -\Instagram\desktop.ini	7zG.exe
File created	C:\Users\Admin\Downloads\Adobe Audition 2023 - New Boss -\Redes Sociais e Grupos Exclusivos - New Boss -\WebSite - New Boss -\desktop.ini	7zG.exe
File created	C:\Users\Admin\Downloads\Adobe Audition 2023 - New Boss -\+ DE 2 MILHÕES DE ARTES Editáveis\desktop.ini	7zG.exe
File opened for modification	C:\Users\Admin\Downloads\Adobe Audition 2023 - New Boss -\Redes Sociais e Grupos Exclusivos - New Boss -\WebSite - New Boss -\desktop.ini	7zG.exe
File opened for modification	C:\Users\Admin\Downloads\Adobe Audition 2023 - New Boss -\Redes Sociais e Grupos Exclusivos - New Boss -\Facebook\desktop.ini	7zG.exe
File opened for modification	C:\Users\Admin\Downloads\Adobe Audition 2023 - New Boss -\+ DE 2 MILHÕES DE ARTES Editáveis\desktop.ini	7zG.exe
File created	C:\Users\Admin\Downloads\Adobe Audition 2023 - New Boss -\DG Essential\desktop.ini	7zG.exe
File created	C:\Users\Admin\Downloads\Adobe Audition 2023 - New Boss -\Redes Sociais e Grupos Exclusivos - New Boss -\Facebook\desktop.ini	7zG.exe
File created	C:\Users\Admin\Downloads\Adobe Audition 2023 - New Boss -\Redes Sociais e Grupos Exclusivos - New Boss -\Instagram\desktop.ini	7zG.exe
File opened for modification	C:\Users\Admin\Downloads\Adobe Audition 2023 - New Boss -\Redes Sociais e Grupos Exclusivos - New Boss -\Twitter\desktop.ini	7zG.exe
File opened for modification	C:\Users\Admin\Downloads\Adobe Audition 2023 - New Boss -\Redes Sociais e Grupos Exclusivos - New Boss -\Ajude O Nosso Canal\Envio Via PIX\desktop.ini	7zG.exe
File opened for modification	C:\Users\Admin\Downloads\Adobe Audition 2023 - New Boss -\Redes Sociais e Grupos Exclusivos - New Boss -\desktop.ini	7zG.exe
File created	C:\Users\Admin\Downloads\Adobe Audition 2023 - New Boss -\Redes Sociais e Grupos Exclusivos - New Boss -\Ajude O Nosso Canal\Envio Via PIX\desktop.ini	7zG.exe
File created	C:\Users\Admin\Downloads\Adobe Audition 2023 - New Boss -\Redes Sociais e Grupos Exclusivos - New Boss -\Grupo Exclusivo de Telegram - New Boss -\desktop.ini	7zG.exe
File opened for modification	C:\Users\Admin\Downloads\Adobe Audition 2023 - New Boss -\Redes Sociais e Grupos Exclusivos - New Boss -\Grupo Exclusivo de Telegram - New Boss -\desktop.ini	7zG.exe
File created	C:\Users\Admin\Downloads\Adobe Audition 2023 - New Boss -\Redes Sociais e Grupos Exclusivos - New Boss -\Twitter\desktop.ini	7zG.exe
File opened for modification	C:\Users\Admin\Downloads\Adobe Audition 2023 - New Boss -\Redes Sociais e Grupos Exclusivos - New Boss -\Youtube\desktop.ini	7zG.exe
File opened for modification	C:\Users\Admin\Downloads\Adobe Audition 2023 - New Boss -\DG Essential\desktop.ini	7zG.exe
File opened for modification	C:\Users\Admin\Downloads\Adobe Audition 2023 - New Boss -\Redes Sociais e Grupos Exclusivos - New Boss -\Ajude O Nosso Canal\desktop.ini	7zG.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 11 IoCs

Web Service

T1102

flow	ioc
4	drive.google.com
5	drive.google.com
6	drive.google.com
8	drive.google.com
34	drive.google.com
35	drive.google.com
38	drive.google.com
39	drive.google.com
117	drive.google.com
10	drive.google.com
66	drive.google.com

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File created	C:\Users\Admin\Downloads\Adobe Audition 2023 - New Boss -\AutoPlay\autorun.inf	7zG.exe
File opened for modification	C:\Users\Admin\Downloads\Adobe Audition 2023 - New Boss -\AutoPlay\autorun.inf	7zG.exe

Drops file in System32 directory 11 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.jfm	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jcp	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jtx	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00001.jrs	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.log	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSStmp.log	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00002.jrs	svchost.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
5084	4676	WerFault.exe	154
2544	1084	WerFault.exe	159

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Set-up.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Set-up.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	autoplay.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	Set-up.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Set-up.exe = "11001"	Set-up.exe
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	Set-up.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133706684145428408"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings	mspaint.exe
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings	mspaint.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2170637797-568393320-3232933035-1000\{29BA702A-1B1D-4674-BBDF-97D627B06D1D}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	Set-up.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	Set-up.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 5c000000010000000400000000080000190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc36200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8040000000100000010000000d474de575c39b2d39c8583c5c065498a2000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	Set-up.exe

Suspicious behavior: AddClipboardFormatListener 3 IoCs

pid	Process
1020	WINWORD.EXE
1020	WINWORD.EXE
2372	vlc.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2708	mspaint.exe
2708	mspaint.exe
3832	mspaint.exe
3832	mspaint.exe
3548	msedge.exe
3548	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2372	vlc.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeRestorePrivilege	1608	7zG.exe
Token: 35	1608	7zG.exe
Token: SeSecurityPrivilege	1608	7zG.exe
Token: SeSecurityPrivilege	1608	7zG.exe
Token: SeRestorePrivilege	2632	7zG.exe
Token: 35	2632	7zG.exe
Token: SeSecurityPrivilege	2632	7zG.exe
Token: SeSecurityPrivilege	2632	7zG.exe

Suspicious use of FindShellTrayWindow 18 IoCs

pid	Process
2372	vlc.exe
2372	vlc.exe
2372	vlc.exe
2372	vlc.exe
2372	vlc.exe
2372	vlc.exe
2372	vlc.exe
2372	vlc.exe
2372	vlc.exe
2372	vlc.exe
2372	vlc.exe
2372	vlc.exe
2372	vlc.exe
2372	vlc.exe
2372	vlc.exe
2372	vlc.exe
1608	7zG.exe
2632	7zG.exe

Suspicious use of SendNotifyMessage 15 IoCs

pid	Process
2372	vlc.exe
2372	vlc.exe
2372	vlc.exe
2372	vlc.exe
2372	vlc.exe
2372	vlc.exe
2372	vlc.exe
2372	vlc.exe
2372	vlc.exe
2372	vlc.exe
2372	vlc.exe
2372	vlc.exe
2372	vlc.exe
2372	vlc.exe
2372	vlc.exe

Suspicious use of SetWindowsHookEx 17 IoCs

pid	Process
1020	WINWORD.EXE
1020	WINWORD.EXE
1020	WINWORD.EXE
1020	WINWORD.EXE
1020	WINWORD.EXE
1020	WINWORD.EXE
1020	WINWORD.EXE
2372	vlc.exe
2708	mspaint.exe
3992	OpenWith.exe
3832	mspaint.exe
4748	OpenWith.exe
4676	Set-up.exe
4676	Set-up.exe
1084	Set-up.exe
1084	Set-up.exe
4128	autoplay.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3548 wrote to memory of 3616	3548	msedge.exe	137
PID 3548 wrote to memory of 3616	3548	msedge.exe	137
PID 3548 wrote to memory of 676	3548	msedge.exe	138
PID 3548 wrote to memory of 676	3548	msedge.exe	138
PID 3548 wrote to memory of 676	3548	msedge.exe	138
PID 3548 wrote to memory of 676	3548	msedge.exe	138
PID 3548 wrote to memory of 676	3548	msedge.exe	138
PID 3548 wrote to memory of 676	3548	msedge.exe	138
PID 3548 wrote to memory of 676	3548	msedge.exe	138
PID 3548 wrote to memory of 676	3548	msedge.exe	138
PID 3548 wrote to memory of 676	3548	msedge.exe	138
PID 3548 wrote to memory of 676	3548	msedge.exe	138
PID 3548 wrote to memory of 676	3548	msedge.exe	138
PID 3548 wrote to memory of 676	3548	msedge.exe	138
PID 3548 wrote to memory of 676	3548	msedge.exe	138
PID 3548 wrote to memory of 676	3548	msedge.exe	138
PID 3548 wrote to memory of 676	3548	msedge.exe	138
PID 3548 wrote to memory of 676	3548	msedge.exe	138
PID 3548 wrote to memory of 676	3548	msedge.exe	138
PID 3548 wrote to memory of 676	3548	msedge.exe	138
PID 3548 wrote to memory of 676	3548	msedge.exe	138
PID 3548 wrote to memory of 676	3548	msedge.exe	138
PID 3548 wrote to memory of 676	3548	msedge.exe	138
PID 3548 wrote to memory of 676	3548	msedge.exe	138
PID 3548 wrote to memory of 676	3548	msedge.exe	138
PID 3548 wrote to memory of 676	3548	msedge.exe	138
PID 3548 wrote to memory of 676	3548	msedge.exe	138
PID 3548 wrote to memory of 676	3548	msedge.exe	138
PID 3548 wrote to memory of 676	3548	msedge.exe	138
PID 3548 wrote to memory of 676	3548	msedge.exe	138
PID 3548 wrote to memory of 676	3548	msedge.exe	138
PID 3548 wrote to memory of 676	3548	msedge.exe	138
PID 3548 wrote to memory of 676	3548	msedge.exe	138
PID 3548 wrote to memory of 676	3548	msedge.exe	138
PID 3548 wrote to memory of 676	3548	msedge.exe	138
PID 3548 wrote to memory of 676	3548	msedge.exe	138
PID 3548 wrote to memory of 676	3548	msedge.exe	138
PID 3548 wrote to memory of 676	3548	msedge.exe	138
PID 3548 wrote to memory of 676	3548	msedge.exe	138
PID 3548 wrote to memory of 676	3548	msedge.exe	138
PID 3548 wrote to memory of 676	3548	msedge.exe	138
PID 3548 wrote to memory of 676	3548	msedge.exe	138
PID 3548 wrote to memory of 676	3548	msedge.exe	138
PID 3548 wrote to memory of 676	3548	msedge.exe	138
PID 3548 wrote to memory of 676	3548	msedge.exe	138
PID 3548 wrote to memory of 676	3548	msedge.exe	138
PID 3548 wrote to memory of 676	3548	msedge.exe	138
PID 3548 wrote to memory of 676	3548	msedge.exe	138
PID 3548 wrote to memory of 676	3548	msedge.exe	138
PID 3548 wrote to memory of 676	3548	msedge.exe	138
PID 3548 wrote to memory of 676	3548	msedge.exe	138
PID 3548 wrote to memory of 676	3548	msedge.exe	138
PID 3548 wrote to memory of 676	3548	msedge.exe	138
PID 3548 wrote to memory of 4736	3548	msedge.exe	139
PID 3548 wrote to memory of 4736	3548	msedge.exe	139
PID 3548 wrote to memory of 2352	3548	msedge.exe	140
PID 3548 wrote to memory of 2352	3548	msedge.exe	140
PID 3548 wrote to memory of 2352	3548	msedge.exe	140
PID 3548 wrote to memory of 2352	3548	msedge.exe	140
PID 3548 wrote to memory of 2352	3548	msedge.exe	140
PID 3548 wrote to memory of 2352	3548	msedge.exe	140
PID 3548 wrote to memory of 2352	3548	msedge.exe	140
PID 3548 wrote to memory of 2352	3548	msedge.exe	140
PID 3548 wrote to memory of 2352	3548	msedge.exe	140

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/file/d/11i9tYo5vgIAWLnhbebWXBg5c-sC_HUER/view
1⤵
PID:2616

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --field-trial-handle=3864,i,16316361669272684588,6171287487746154806,262144 --variations-seed-version --mojo-platform-channel-handle=3892 /prefetch:1
1⤵
PID:408

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --field-trial-handle=3512,i,16316361669272684588,6171287487746154806,262144 --variations-seed-version --mojo-platform-channel-handle=4752 /prefetch:1
1⤵
PID:2332

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=5456,i,16316361669272684588,6171287487746154806,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:8
1⤵
PID:1536

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --field-trial-handle=5468,i,16316361669272684588,6171287487746154806,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:8
1⤵
PID:1988

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --field-trial-handle=5928,i,16316361669272684588,6171287487746154806,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:2
1⤵
PID:692

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --field-trial-handle=5872,i,16316361669272684588,6171287487746154806,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:1
1⤵
PID:2692

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --field-trial-handle=6296,i,16316361669272684588,6171287487746154806,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:8
1⤵
PID:4024

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --field-trial-handle=3536,i,16316361669272684588,6171287487746154806,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:1
1⤵
PID:4120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --field-trial-handle=6736,i,16316361669272684588,6171287487746154806,262144 --variations-seed-version --mojo-platform-channel-handle=6760 /prefetch:1
1⤵
PID:3332

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --field-trial-handle=6544,i,16316361669272684588,6171287487746154806,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:8
1⤵
PID:4672

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=25 --field-trial-handle=6412,i,16316361669272684588,6171287487746154806,262144 --variations-seed-version --mojo-platform-channel-handle=6948 /prefetch:1
1⤵
PID:3268

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=26 --field-trial-handle=6776,i,16316361669272684588,6171287487746154806,262144 --variations-seed-version --mojo-platform-channel-handle=7084 /prefetch:1
1⤵
PID:4764

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=27 --field-trial-handle=5964,i,16316361669272684588,6171287487746154806,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:1
1⤵
PID:544

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --field-trial-handle=5736,i,16316361669272684588,6171287487746154806,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:8
1⤵
PID:2116

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Documents\SetProtect.docx" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1020

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3004

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\ApproveSelect.wmv"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2372

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4128,i,16316361669272684588,6171287487746154806,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:8
1⤵
PID:4092

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Downloads\RedoPush.jpg" /ForceBootstrapPaint3D
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2708

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s DsSvc
1⤵
- Drops file in System32 directory
PID:3004

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3992

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Downloads\RedoPush.jpg" /ForceBootstrapPaint3D
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3832

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4748

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=30 --field-trial-handle=6364,i,16316361669272684588,6171287487746154806,262144 --variations-seed-version --mojo-platform-channel-handle=7316 /prefetch:1
1⤵
PID:3212

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --lang=en-US --service-sandbox-type=service --field-trial-handle=6904,i,16316361669272684588,6171287487746154806,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:8
1⤵
PID:3296

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --field-trial-handle=7356,i,16316361669272684588,6171287487746154806,262144 --variations-seed-version --mojo-platform-channel-handle=6860 /prefetch:8
1⤵
PID:4292

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=127.0.6533.89 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=127.0.2651.86 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ffa1f0bd198,0x7ffa1f0bd1a4,0x7ffa1f0bd1b0
  2⤵
  PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2184,i,10025134074808760491,10023277052196466522,262144 --variations-seed-version --mojo-platform-channel-handle=2180 /prefetch:2
  2⤵
  PID:676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --field-trial-handle=1644,i,10025134074808760491,10023277052196466522,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:3
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --field-trial-handle=2516,i,10025134074808760491,10023277052196466522,262144 --variations-seed-version --mojo-platform-channel-handle=2520 /prefetch:8
  2⤵
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --field-trial-handle=4448,i,10025134074808760491,10023277052196466522,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:8
  2⤵
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --field-trial-handle=4448,i,10025134074808760491,10023277052196466522,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:8
  2⤵
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --field-trial-handle=4080,i,10025134074808760491,10023277052196466522,262144 --variations-seed-version --mojo-platform-channel-handle=4772 /prefetch:8
  2⤵
  PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --field-trial-handle=4788,i,10025134074808760491,10023277052196466522,262144 --variations-seed-version --mojo-platform-channel-handle=4768 /prefetch:8
  2⤵
  PID:1956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=2916,i,10025134074808760491,10023277052196466522,262144 --variations-seed-version --mojo-platform-channel-handle=2148 /prefetch:8
  2⤵
  PID:2232

C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\elevation_service.exe"
1⤵
PID:432

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap31901:126:7zEvent22378
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1608

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Adobe Audition 2023 - New Boss -\" -spe -an -ai#7zMap9124:126:7zEvent23451
1⤵
- Drops desktop.ini file(s)
- Drops autorun.inf file
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2632

C:\Users\Admin\Downloads\Adobe Audition 2023 - New Boss -\Setup\Set-up.exe
"C:\Users\Admin\Downloads\Adobe Audition 2023 - New Boss -\Setup\Set-up.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies system certificate store
- Suspicious use of SetWindowsHookEx
PID:4676
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4676 -s 2492
  2⤵
  - Program crash
  PID:5084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4676 -ip 4676
1⤵
PID:1048

C:\Users\Admin\Downloads\Adobe Audition 2023 - New Boss -\Setup\Set-up.exe
"C:\Users\Admin\Downloads\Adobe Audition 2023 - New Boss -\Setup\Set-up.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1084
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1084 -s 2228
  2⤵
  - Program crash
  PID:2544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1084 -ip 1084
1⤵
PID:2920

C:\Users\Admin\Downloads\Adobe Audition 2023 - New Boss -\AutoPlay\autoplay.exe
"C:\Users\Admin\Downloads\Adobe Audition 2023 - New Boss -\AutoPlay\autoplay.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8890A77645B73478F5B1DED18ACBF795_C090A8C88B266C6FF99A97210E92B44D

Filesize
471B

MD5
4cb0b4d9370e03720a2a5d8a3efa3f26

SHA1
6104c2fc8c81a987a26e34a94136bf57cf416fc6

SHA256
28948a696880b87137dd89b8dd2414f6a3910e1465266e310f7d35bafd65c78b

SHA512
b4c709058652dc4ac83290c34a0f03572dce9c537e4bb786abacac4b36938a84b6e9b45bb9a4cf57cbf928a1536a114e4a03ecc7d87e8f257d282a6e58edc284

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DA3B6E45325D5FFF28CF6BAD6065C907_EA01B8AC2C0BE6E5850A0487D704D929

Filesize
471B

MD5
24041e7b123f56252084453bdef160f3

SHA1
f8ba204313c2fd5a0f157bd28cc02358ee260b35

SHA256
5ca520fa38dbb5ce81f4171829f8824756ea55f17184fd1dd0241c939874e092

SHA512
7d405217991260a0f4689be40991d9c74832317b7f6328db10215f0052370031c440a691e09111122b05f50c35e054304407a725578bb7db929a61ceab2ca02e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8890A77645B73478F5B1DED18ACBF795_C090A8C88B266C6FF99A97210E92B44D

Filesize
396B

MD5
1a5dc250c25e67502f7624c5bfc88540

SHA1
34c1ece9cb73d39ffa7a9219155a24cc86111cbc

SHA256
b4af54e897e83140b5d12a3d46ab580b9b5ee9ee0735fc6c6fb970fd2e80cb5b

SHA512
2741b9b03f219b4d7e80a807e6cacdabd89300d6c4b3c524018fe789e07b181ba0f24c2acc332d3cab1cd1a100c34136a25ebe0423b5a5b804e077d3f9d32f85

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DA3B6E45325D5FFF28CF6BAD6065C907_EA01B8AC2C0BE6E5850A0487D704D929

Filesize
408B

MD5
6131d4a2e152f686470dc39a812b9c53

SHA1
56503441df670a9d591684a7ba912bdabb800794

SHA256
1998cea391fd159217049dabd9b8e806e2b2582119e79ab9a897a696f58dc730

SHA512
7ea1bb1b55bffe8685ee181d09498c9c3c839702d787d87f0c98ad98ad7fafd749ada01c9d18c8926e7699eafd82a608de2994081fe3178eb462ab2fdb88eecd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
cdb3602139099215d210dad7ae9c9684

SHA1
eec1050feaf35596745dc994a6c697738eb05003

SHA256
99a1dafe46899fc64b1a8c5364f6b4b93a79de77418c3f895c1d752eb3049869

SHA512
322191ed3f465f78b4c293c5c3c5fe38f9d030e4174764d5e923d1d2cba845dde3dad52d267e1d18b653c666f3324fcf80ca3fa080416e7e6adb8154584fe3e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
12KB

MD5
f5a2b5332651610c16b121ef72d88935

SHA1
e5ff22a4b93e0eb9881be86824545538ebf3a0af

SHA256
26c286d428108288a147137e4656a0ab164ea435cd4b20f3ed50598d17d9e075

SHA512
0b5546594297862412fa954ae833af67ec0ff64f92cf1f2762f6033bb2b69e20d9faa3232a0a6eb006dfcbf41aa37ab0e7038c0e4b4e898709db000e7e3aec27

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
30KB

MD5
9ab903fb68971e475de5cf66c5ca45f6

SHA1
837497931047aa9236088d067d82275cf9c98e67

SHA256
4bb325dbed98d793391fa936341891ae2bca623cfc1e9e41c20f65fb92804dfb

SHA512
262db508653f5611f72fcf402090fdcdf5dcb4bdca7e111cf05253854e3ef2b608e81279e74c48c7e42bf08cb992cbc60bb9779e1b57c32014561a16f771cb7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
69KB

MD5
7eaac3d86cf840db2577094f9e972b04

SHA1
36081353ffe364232ead3bc924ee1d8bbaad2b35

SHA256
5beaedb93d555d76d4445cf1fc737c2cdbf81b141d27fc88523da978cc95b0d8

SHA512
4cd8fb260605eab592d23a59f871929dbd710b9e949ff0dc6e2852bf51dedb1849e5c402451c05b0bb9375bb50c93c411a0c96d1beb2c353189d3002f3fa3f50

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
69KB

MD5
8d72e9e6d851cfb68b934a0c1ff896a1

SHA1
bcdefdbc3ce182902ba150cd370aa2c26ec7198f

SHA256
0af65a6103d1faa39ae27ca95239c69cb82ee5ba4426ae7bbf7c733d8d7db968

SHA512
0dacb1ea4df2836111413e63432db1b31dfd388bc0b28aed1b0d30592a744bdf31112e9fa81b2645d5979602556aee75c8673a3265c2a6fa67d1dc7aabdb82ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
72KB

MD5
43092f4e5b403241f3eb6003d8c8697a

SHA1
7c3a44587ed3503e4f06935ec2df96a12a5220f7

SHA256
09174abc66ebde0686a34620ad23e136e8e333dd7dfdb01c93a4c426c7367486

SHA512
dbadbf83fb06cb550ea1adcbdb28be5898958a7ea498bce3f50fa7ab350e40d666f2cce58d31c5643caf6e00ba072882f2c487bc2f83e8bd4981e135cbab8672

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

Filesize
2KB

MD5
7e2539cecc5ccd39543e9a69c47eee9a

SHA1
d1838f29631006540679624929b2616e954c7f62

SHA256
21ac12ca856dc12fcb767fa1a654b70e411595417981e9b3e47c445df527adfb

SHA512
5d8136e7ad90da488a29c59cc7f50ba5f2ef1ddc08dbaccdbed0a17c360418ff1c45544f0fa7d07141dcafd2bc715f07a9acea59d7f37aa2025a82c19e2664e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\49dbe2955480c7f6ef8cec9c4320c9868d9293fd.tbres

Filesize
2KB

MD5
2e6cd24981aee1d8742b8bed43f26f63

SHA1
549fa6eeac5c6b37088d19d06cfbf4c9f472279c

SHA256
0306ef14b54caf704b7789e7fb5b0fa3c39c4e9d20628061b6a0335a50456b96

SHA512
b62d7c884266c758a63f625c7ed51278c3f1c59b3674a8146ee894b390969fcf77c679cadcab16b87d8fe2cd5755c7b00bd2aa2d6496095f718ded4286098515

Download Submit
C:\Users\Admin\AppData\Local\Temp\CreativeCloud\ACC\AdobeDownload\HDInstaller.log

Filesize
4KB

MD5
5761f2173fd2cda67b5bd263253604c5

SHA1
c6c2fdaff657c11ccff6c051cf066f8a4876e943

SHA256
b60fc18a262b7390022219dd6efd5c65f7ea1c5061deac691728e665e00555c1

SHA512
f85cd5dcf74b047b972a7548ccb68d0ca1e804974de8ab481988d539214380a24d07a0c7ebdf4b5c4f046860f6bad6f6bfba7e515180434977854082e982a74e

Download Submit
C:\Users\Admin\AppData\Local\Temp\{77C1C264-CB73-4E1A-94E0-6DBA536DF56A}\carousel\Dictionary\ja_jp\locale.json

Filesize
435B

MD5
8eefa1bb3912183d9e3438f91c098841

SHA1
d06c23d25afc8672eace3d214798c5122b664ca7

SHA256
919cba4b8a59f6b69ce16011e50f3bafc76efe58b21032501626cac364d48e9d

SHA512
5027e49717b19842438388b57232b8739e8a1cf15642bf9806e7eb5a749ed9c7a102d2c876cc8d9cf2113558509965cd638b128519071ff6cb06e1b4d5ac7af7

Download Submit
C:\Users\Admin\AppData\Local\Temp\{77C1C264-CB73-4E1A-94E0-6DBA536DF56A}\carousel\Dictionary\nl_nl\locale.json

Filesize
386B

MD5
c4d0d42780213ddf399e83c60e8f25ca

SHA1
55c4589f3d9a514dee78fd47e7c3696b3df60c79

SHA256
416b4f94812ac0b6bbeb1a5e4f06e587f4ecad75b8efa02072eb7ae92b622b34

SHA512
74edb2fdbdb07a4fef43f3b61bf08188f4ba24cabd75c50c2e53210ea38e345ac7211dab5e761dccb6e0aadfe901b81cf27ec851b640474ab9979996c8841398

Download Submit
C:\Users\Admin\AppData\Local\Temp\{77C1C264-CB73-4E1A-94E0-6DBA536DF56A}\carousel\Dictionary\pl_pl\locale.json

Filesize
415B

MD5
440e7340c381b936d04d8206e966d44b

SHA1
3f5743e2392c734a546f7b9f75b616ae4a121f40

SHA256
7aa4d5a764e0f0a9649a5faa24f14206d0ae44f3e386ed002df2e6f5d359f0a3

SHA512
3adac1c7c6dffd76f6196414919b051cb9152ea073df1313aaff549b7d8d77b73683a83ce03fd87af6a10a6c9223a07c05130d8e96b9d998dc0104fdadee5b80

Download Submit
C:\Users\Admin\AppData\Local\Temp\{77C1C264-CB73-4E1A-94E0-6DBA536DF56A}\carousel\Dictionary\ru_ru\locale.json

Filesize
626B

MD5
3f1235f9c362e368fe52fd708da455b5

SHA1
88bb2da22e940527b61ceceb4d78c992af78126f

SHA256
454f7fe589e1e08f2cf112eddaa839b60951698a84ba87e7767d4dbbcb3a038b

SHA512
d1dce3df39db2db386545f71a5a67b0725906878983944bc97ddb3c95f706cdc71a7a04d717a28428a7e682adcaf40f2f94561c681f4790989876f5c1bdb2bc5

Download Submit
C:\Users\Admin\AppData\Local\Temp\{77C1C264-CB73-4E1A-94E0-6DBA536DF56A}\common.js

Filesize
2KB

MD5
d98f70ffd105672292755a37f173c2ec

SHA1
c0154add295ac052f234a0282a62b704cdd01998

SHA256
257a42f797f140667c81930001e73943bfc243d50bcc775f75d0334a2d2cf2c3

SHA512
1909cc7e4da0949a469852240be2205209968b18b99f7d967bc0231de33d03c7cbaa9578972e30e95e6d7017aebf9cd70a55ba22cdc9d5774d2a237d3eb0971b

Download Submit
C:\Users\Admin\AppData\Local\Temp\{77C1C264-CB73-4E1A-94E0-6DBA536DF56A}\lib\jquery.custom-scrollbar.min.js

Filesize
14KB

MD5
ab3adf4aff09a1c562a29db05795c8ab

SHA1
f6c3f470aea0678945cb889f518a0e9a5ce44342

SHA256
d05e193674c6fc31de0503cbc0b152600f22689ad7ad72adb35fcc7c25d4b01b

SHA512
44dfc748d0bd84f123f9d3f62d5ea137d9128d5bdbe45da9a8666d09039eb179acf0dbb3030e09896fd61e7aa5ae6dfaffe9258d80949a64d0a7e45037791fb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\{77C1C264-CB73-4E1A-94E0-6DBA536DF56A}\lib\jquery.placeholder.min.js

Filesize
3KB

MD5
e13f16e89fff39422bbb2cb08a015d30

SHA1
e7cacaf84f53997dd096afd1c5f350fd3e7c6ce9

SHA256
24320add10244d1834052c7e75b853aa2d164601c9d09220a9f9ac1f0ae44afe

SHA512
aad811f03f59f799da4b8fc4f859b51c39f132b7ddbffadabe4ec2373bd340617d6fe98761d1fb86d77606791663b387d98a60fba9cee5d99c34f683bcb8d1f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\{77C1C264-CB73-4E1A-94E0-6DBA536DF56A}\main.html

Filesize
8KB

MD5
f4b7942d6563727bd614f10da0f38445

SHA1
84f22240f7a5ed1c23b09e8677ac2ac3cd4e26f9

SHA256
e4bedde22ed405d291c746440a824d5f8527fb232e7a6be2ed9a76465d82f8dc

SHA512
f79b24ac78863a4ed87d41f37b2a5bc27017ebc5317f0a305d676090a16aee8a61384b476e7e9a68a024aa8da4784c1bd4f118766caf4450ec97af430e7074af

Download Submit
C:\Users\Admin\AppData\Local\Temp\{77C1C264-CB73-4E1A-94E0-6DBA536DF56A}\main.js

Filesize
58KB

MD5
a8f9eb478c7512c98ca1ad46dbcc298a

SHA1
454226dc42b911caafc9a1e56d8ad0000bbb7643

SHA256
1df6cbdc80c1df47d93d6e7516a2d7017362413a6b9d93634e143856695c3645

SHA512
ae3198cc6ae739f3009359988f5c090664e5fe8422ad1cf739fe316e66f344c10385d1f841c7b0e3ca9f7997c79d95fa0559386b6dec10641ceb8c290b14f5b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\{A3B887BC-3C62-454C-B395-DCE9D3D6BB31}\Dictionary\en_US.json

Filesize
72KB

MD5
c693e1bd4feda683ae5c71f2bd6b9de8

SHA1
2f3c32dbb95623c52ebf3b608074afdfbcbf050a

SHA256
5dffe13d4c72f59dbc6f8efb439350518acd4e8e07efa124973cfd1a625f60d4

SHA512
a48c520b1432f208f7494759d316cf2411163373ef7ba5bb2b2121b4520beb2932d4ea612e9d2dc8997b6221fa2d44c9312928c79394a5d8c577fa39aa5007d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\{A3B887BC-3C62-454C-B395-DCE9D3D6BB31}\clean.css

Filesize
702KB

MD5
4f3364af3e396f92a8826532bfb1a7e5

SHA1
7f7b613435ece78a358f2066287c2f2c3c6aa168

SHA256
45b9b77499356527e9047256db96a542a720bf075d67e9f6ba55d51fd562339e

SHA512
c022a28656483106095967ec4d57eb743d04f029406c2c553c9d19c103520e274c0eea19f411bdb7ae16f388211c456a413df5a0a6097036deb0010573d49c72

Download Submit
C:\Users\Admin\AppData\Local\Temp\{A3B887BC-3C62-454C-B395-DCE9D3D6BB31}\common.css

Filesize
2KB

MD5
1265d497504870d225452b3309b0e06b

SHA1
29a3b783e6f2f2cd3f6d08833b83c7848f8e3450

SHA256
4273a5d4ef990dead6cabe760c27b25f7fcf8a51177f1b31813ad8866a565330

SHA512
9aa8b24e800a619651699c193a7747b8673a3cd4f8a5d3b16ee35f5ef6161f953a904631b97d118339332a3d2c7292c910802f6e1518db18d48fab5e9eb91681

Download Submit
C:\Users\Admin\AppData\Local\Temp\{A3B887BC-3C62-454C-B395-DCE9D3D6BB31}\main.css

Filesize
16KB

MD5
ee23e36c90c9fccd530504285d371ac3

SHA1
7a4e24d18ec723d38cd922e3845ff290f0299e15

SHA256
32616e0764c80efb4607a0dccfec7cf7862886c4ae80e6405dc3cc5c62cd0f82

SHA512
542937075a96f6afb8170c6f41915efeec5e067803606c2a26d29e6c990d93a255ad8cea18600cd0825a0c91ff935d057870a1724062543a8e2bc09c4041b375

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

Filesize
341B

MD5
3c153746673ec95941e4c35cc90dc186

SHA1
53078d7c68f5d83ad21653726a3e5d719e51690e

SHA256
5abe50721fc9dc8fe6dd11a15722c3ff229810145ee9d0bcb6aba9080d370751

SHA512
0bad47925531981ed314fb2f4c66ad95c211b8402b34acdb7da308458b1612c20667f6c2a55684675971d2cf94b4be94a0bdcc4b7c0a4de1ff4f050f65d04b94

Download Submit
C:\Users\Admin\Downloads\Adobe Audition 2023 - New Boss -\AutoPlay\Autoplay\resdata\autoplay_button_eng_S.bmp

Filesize
11KB

MD5
5528be79f91130629599b65839199df8

SHA1
6705a5ccd7f530aa69c19d78d89bf7c6778411b8

SHA256
1cf0b28df133e55ef6bed6cbb56904a9220d62cfd4b1f5736bc73c497ec08a40

SHA512
76be8e3232892db336911b16fdc84dfee0617298e37e9c119672c8205819ec22e33c30277a0e2e078e231bc74d1e79e850721aa99bc0c222da562e828e71fcf6

Download Submit
C:\Users\Admin\Downloads\Adobe Audition 2023 - New Boss -\AutoPlay\Autoplay\resdata\autoplay_button_rus_S.bmp

Filesize
11KB

MD5
844001417424a2277c8373006ee160ad

SHA1
8d811721efeefb12066ba0b61c0593a257ba2222

SHA256
f24ea77e371aae1801ef0b9d4a458fbd3e92c961462536d39ccc3c79d0e59b9f

SHA512
858fb6ece83a8c18f48551b579485b126e88ae4dcee6e19c8de5fd28f7c256ea3632cbc1284e7055b9f3dab4075680515f85d1a2f134109241ec1d913a3b905d

Download Submit
C:\Users\Admin\Downloads\Adobe Audition 2023 - New Boss -\AutoPlay\Autoplay\resdata\autoplay_disc_S.ico

Filesize
2KB

MD5
443acb0657437d73a84b323ddaaa21e2

SHA1
0b8631acedd1254e8898e0ee205bbeb45adf5ccf

SHA256
222efa8493d003903b8a3a9762a4b109c645b2f411cd91cb265933bc98fa382f

SHA512
cb8288432278a1039df18422712aa1ae1b617fab8e818ee947a7ca569eeb78b6ba64f330ce54fc5b4a5bd9ae316732c62b1ecf5f76baa6260a8c48492c4e4427

Download Submit
C:\Users\Admin\Downloads\Adobe Audition 2023 - New Boss -\AutoPlay\Autoplay\resdata\autoplay_generic_extras_S.ico

Filesize
2KB

MD5
4c3630ef64f46933731cd25c371e047d

SHA1
5aecf8a47812e54e26c3d7cf8f8f32156df3b610

SHA256
35086c894797a92f30823a3f9ca5faca4cf42c22d68f644cd293a39685b54122

SHA512
cb934cbd2531dd2bbd552534b8e0178c9292a1512e2e77751bfd66bb167e0a72d571eeddc46cbff6509a917134156448b62c1b7a9ac672825b60b3d5b1f68dff

Download Submit
C:\Users\Admin\Downloads\Adobe Audition 2023 - New Boss -\AutoPlay\Autoplay\resdata\autoplay_readme_S.ico

Filesize
2KB

MD5
a8c46147d3f9c04fab2d05760703acea

SHA1
16f97a4429262953308938a00a6e54af7c8053f7

SHA256
719254e975b2664c7b14ddc5028b48a7b130751eafc8e0d359fc92a92b8f3c7e

SHA512
eb05e8b5d9a2b5ce8861d8d1934fd9ec3663daaebd013c4d4d5244ca19d9664a9211ed8c9927ad21244e1136c826ca71f571670415d055e8c1501629cddc321b

Download Submit
C:\Users\Admin\Downloads\Adobe Audition 2023 - New Boss -\AutoPlay\Autoplay\resdata\autoplay_secondary-content_S.ico

Filesize
2KB

MD5
0cdf03cf447c75c6a5d6d037110e0887

SHA1
b8ab9f23dd92f91e33951a9397aef8bdf5ba256f

SHA256
d98c93173af10e0c3b2d06d37d8489f33f0256694a4199c52e9e8bc7a5f3ca61

SHA512
cb0fa53ed7c8e5554a09839e9c1cc2ce73b6cca892929e287f78d106495805fb0f40f99bd3bf632161d729160b6c7f63c6ee7dee4e3fa732c74c6c3bc5742c58

Download Submit
C:\Users\Admin\Downloads\Adobe Audition 2023 - New Boss -\AutoPlay\Autoplay\resdata\autoplay_secondarylink_S.bmp

Filesize
58B

MD5
2fa2eefcb7f06da7adebb1b95a2aca41

SHA1
c8b57ec9c078aa9462456bcd866a0b6f112d534d

SHA256
84117d69b6852a784fd7f63af38b923541c1de32a6e62a4547f1af83379d8eec

SHA512
c389527f960a60f42e26c2f639ec76054221aba66ec30df245ef08ec7fff3631a29cb1787580078b7811f036052ab025ced7e069d923d476c3fcc08b981c74d5

Download Submit
C:\Users\Admin\Downloads\Adobe Audition 2023 - New Boss -\Setup\Set-up.exe

Filesize
7.3MB

MD5
0d9e0caef3acad368792e4484b345eba

SHA1
f5024d10c036f6ae575c9ea21e567b57498a0df6

SHA256
79eec3e5bb9282f7ebab09a8566558e8a52934df174f129677a4771d5383a3db

SHA512
0a5fa7f74f4c9984f9b1a9e36d2adfe9bb06a7b9128878766a85e462ea370fd864285a902b68297922ecfd7cf5d0bd6955f51f1abc1db980768ae7bf1a8b1e00

Download Submit
C:\Users\Admin\Downloads\Adobe Audition 2023 - New Boss -\Setup\packages\ACC64\3DI\3DI.pima

Filesize
190B

MD5
bfa2825492d0d648a227b6d8a0662e83

SHA1
0c3f1c5fba466792398104812e944a6cd3a9b78d

SHA256
95514c3e12a559ee471e63b22b1b00aff1afe2e0fc60415d022be23df676bc1d

SHA512
68159d2ebc5b4416e448f0fc6960703e826bd01137d18a7a4616619a2090a903ccad1059e29941b08d9c2c881dbb9051ef2d91fa58472dfae1c28ab6da4a62f2

Download Submit
C:\Users\Admin\Downloads\Adobe Audition 2023 - New Boss -\Setup\products\AUDT\Application.json

Filesize
21KB

MD5
f3450e9005e610ec60fe28fe9327fec2

SHA1
1148e7bf193bd3a19ff47038eafa0cf21e5b4176

SHA256
868e1dd92ad82960739cb5e114cc4d73cc653a79c3325359a32f8d822208849d

SHA512
f8613b841424679cb98d2f32a9610d4f72cb98badd6cfc2d8b31f5ddf14f75e113c8c51a02f7b11f8859d29731c14be3ca4d3edaeb02c02c9c6f1f3803b45358

Download Submit
C:\Users\Admin\Downloads\Adobe Audition 2023 - New Boss -\Setup\products\driver.xml

Filesize
233B

MD5
50e21338523e55021b36abe2102d8845

SHA1
56e48ad78e2cb86900883208b3b8e60ea736e250

SHA256
d33f95ceb62488d9ec7fa24051f0a4599d9b75431c402496769b56ccf3178fea

SHA512
09e5d9d04153565f8eb4312c9f50fd49a1fc65b06b01f211133532db5001a250ba3cbc2f3ce0b6e615b1c0c27772a4de0062005f135bfb23bffd06c23a57a83d

Download Submit
C:\Users\Admin\Downloads\Adobe Audition 2023 - New Boss -\Setup\resources\carousel\Dictionary\cs_cz\locale.json

Filesize
405B

MD5
0e66bd0983b2c3516613cc751d69971b

SHA1
551c857dad708f8e0ddc6b618de7966c254abe0e

SHA256
7d3aecdf9b1ea5128ef87a1e6e74dc3e283fb28dd6af8113b4e99040b15747d4

SHA512
44779ee6d29d2747774726b2c3f76a41e6775548d57705f16d59ad3a4ca1be44fb6cd12d1ef0f6f8f228911fc317f6451c403d04f6f1fefb097c8763d5801087

Download Submit
C:\Users\Admin\Downloads\Adobe Audition 2023 - New Boss -\Setup\resources\carousel\Dictionary\de_de\locale.json

Filesize
386B

MD5
d3f198446f78d6e17d85882563ea6b36

SHA1
3bc7c9cc9182935e4ea000ff951ce9493b99fd70

SHA256
e683843b5ecbe6bafd03c26c3762e9e4fe37cb5dc1d9a7188c9158553f3ccdca

SHA512
d3516f25c4f62a5f0787a173f73e001a149e9fbead9ca85964b94f1786635b246ddf182cbf6a46607938c24928939f41c1812db6b9260a81b70cc20b8722d046

Download Submit
C:\Users\Admin\Downloads\Adobe Audition 2023 - New Boss -\Setup\resources\carousel\Dictionary\en_US\locale.json

Filesize
353B

MD5
031aa6225b953a69e223fc71566058b7

SHA1
45a89a91cc432bdb698be076c8cc1db027b3d50c

SHA256
b754524e0f798d8db77bc777a0fed09978fd3fc9d4494f227b7fe07185efd9ce

SHA512
e61497f74508016c8ad755701c907d2d5e053f6e2d7b1228feb0b9276b8ad202975d81ab2806d5c3593adf6ca1bd320d6bbd6a59e565ed300060e851867b52d3

Download Submit
C:\Users\Admin\Downloads\Adobe Audition 2023 - New Boss -\Setup\resources\carousel\Dictionary\es_es\locale.json

Filesize
390B

MD5
592ebf7fadf7792f05ddae25d75a9d59

SHA1
2853af5a44ee3163261bb471cb7a33f0a0bb2ed6

SHA256
1f10dc92034244bbe5435c8d0029773025b929a36f3d30a4a5a3a4526d8a874e

SHA512
59ebddad4576a121b43181547cf0f806e7fc1192428e782233f3e20c4b75e0e7a2febfa809efe7f9296eed38ccc63f9d4f6850c8cdbaabf06ae99d80c93f2f9b

Download Submit
C:\Users\Admin\Downloads\Adobe Audition 2023 - New Boss -\Setup\resources\carousel\Dictionary\fr_fr\locale.json

Filesize
383B

MD5
47c7066b8c2d86ae7047ba355e57230a

SHA1
5702d5eae9b69896db0e2c9ebe8d6f7b83abc6c1

SHA256
e9c432fa590566d463502adcd51a129f789ebc01c59f6409c5734a0109f05156

SHA512
58a0da179b19c507f1ffe8fe4ca1312f2f0c8799c8f4f53a279b1bdfde311105c76bac187ea179598dc7d13fd32fd002fe0f06f5aa1b1a67cf147e7a02dd9f9f

Download Submit
C:\Users\Admin\Downloads\Adobe Audition 2023 - New Boss -\Setup\resources\carousel\Dictionary\it_it\locale.json

Filesize
495B

MD5
78d8a38ab29f2c70fc0552038763561c

SHA1
51ef11689a9e8fd6cf629e2c0238e12d59341e72

SHA256
2c5ffe288391affe2accc1988900d02c3517b652881fba852994d459434239ac

SHA512
969cabda8324cdf3a9cbe0b0b8fdd2a611ef3b813c012a749a89d792c9a9c6ef3ee513c53b76065efd6d1e93ddfa5c31510bf3e25be2fcb86592988cb4abe591

Download Submit
C:\Users\Admin\Downloads\Adobe Audition 2023 - New Boss -\Setup\resources\carousel\Dictionary\ko_kr\locale.json

Filesize
406B

MD5
3a504ea81ba343fab1ebe2a10efaa1a2

SHA1
eddd814cf6ba568a80553a5516bd588b18ce5a52

SHA256
9b4e351eb416e95f6843224227857c528dce2d7a8bd64876204879138208951e

SHA512
57a52b016801fef387c8d33b483dce4d5bd518bd9989ffaf775df4b4dd1bc83e614bf3ace69f779c5047b0bde6b7b4db861530700523acf25110d8846b7e13e4

Download Submit
C:\Users\Admin\Downloads\Adobe Audition 2023 - New Boss -\Setup\resources\carousel\Dictionary\sv_se\locale.json

Filesize
378B

MD5
690dbabeee5810ae5b68027eeb148f1a

SHA1
f1624c92497acdfbc53ffb5a891c545b293d01c7

SHA256
270157002492ad80fff2d47f9cdc0257b72bafed053556ddd5b14c910c6a9a8e

SHA512
01f685608ffe85b4beb4bdf20b701944f7b83ab0fbb90b39f379053285e058610fa9f4c6671f4055586674a9a3a849a2784ddede476e4677be9667f3faad8b14

Download Submit
C:\Users\Admin\Downloads\Adobe Audition 2023 - New Boss -\Setup\resources\carousel\Dictionary\zh_cn\locale.json

Filesize
360B

MD5
9fcab8f3d4f4840c927531f5975109c9

SHA1
d433d4dfc1fdac136057f8fd551db01727a749bb

SHA256
b103e04a7ddbeefb389641dd93fafee6119f3316f4133702bb3af38bae92fb4f

SHA512
05a947de06e5594ff031fa4b9aeea39725db4648308ebe7bf12d4db875abadfa4f3982b77c5435de9d498da905ae8c8c69b96bc1dda954288b7f9d7a66701496

Download Submit
C:\Users\Admin\Downloads\Adobe Audition 2023 - New Boss -\Setup\resources\carousel\Dictionary\zh_tw\locale.json

Filesize
361B

MD5
bebb9ba86d130666f1dcaf88abac5d9a

SHA1
e07ea165fdfcaa1b073f77f891c248b1669235cb

SHA256
efc69bc38f34fccaaa7fa985dfbd75c0196da23971fba3df349cb8953657e7b0

SHA512
aedd79f53b6f2a923714965320db4e648f8560b6a6d3e53d39b36d16a55d1f9f19bc898b9aad4efe441392dc424936d0b7e04d0a15f1423dd5dec81a7a55d90a

Download Submit
C:\Users\Admin\Downloads\Adobe Audition 2023 - New Boss -\Setup\resources\carousel\carousel.js

Filesize
2KB

MD5
3e54a5379ead1dd34c10928c0106994a

SHA1
b99842348ac21372912bb738374f00692665d9d3

SHA256
6bcd1176e14251165e312f615cbe4d5a4c735b72ef2f1f717b57dc2da10dfc19

SHA512
13fe2aada28d1aeec373c51debf7bd6e5ec2234856b0b5d2c850cf27cea794eec43d294b817a9037716dc797eb445a88c2c90e606f300c68b3c47f75d454c649

Download Submit
C:\Users\Admin\Downloads\Adobe Audition 2023 - New Boss -\Setup\resources\carousel\css\fonts\adobeclean\adobeclean-regular-webfont.woff

Filesize
30KB

MD5
6af297e58edc414ee90c76c2d3ea8678

SHA1
7497d181cd6fe3a4b01a4f8b6ba6a47d3fa54333

SHA256
3e8f59db6dfae287af8dccc0fdf5e15a8aa2a954c2c232bc6c64536e1a27eaa5

SHA512
61e14f8e605c4d2b52c9a874f40e73fde43625bc468ba3c7316e7672cffd05b7c1766c875fc1b48218bd2b6856226645ee9bcb45810eb7121c5dbd0c184b7d0a

Download Submit
C:\Users\Admin\Downloads\Adobe Audition 2023 - New Boss -\Setup\resources\carousel\css\styles.css

Filesize
189B

MD5
3a0ec2d2c5020a3cf45c13a87434b285

SHA1
12275d4d51de801ce28c88a0c246de22c6d08120

SHA256
406288e48ced388744e5165a1ec4266f419cc409e4a70036e4b15a93af5c42ab

SHA512
a7c6d55f64d91e5d71661e040f4d06d2c873e0b2d2a3b2e52ff60d230a7c7c0924cd0ddc4dc124d53736c934023a27d6ed77c1266732f0b5de5dc75b02715c8b

Download Submit
C:\Users\Admin\Downloads\Adobe Audition 2023 - New Boss -\Setup\resources\carousel\images\01_creativity_for_all_445x239.jpg

Filesize
17KB

MD5
60067c40df2b5d318765d7a107bcc262

SHA1
fc61153486b78f5348c5690008074b6611b4d41c

SHA256
ba6a85f10434fdb6d6a0a91e616b20cc3880c7e6f7a7e5a7117299944f1aefc3

SHA512
16da228e28ca6e968b819cc3cf93b5117b0c52b1c9205b07d9629871548b340ec5ca86004f72e4855ca8d879485c4dd7592b8ab87a4dc8b722c01c98c21c98a4

Download Submit
C:\Users\Admin\Downloads\Adobe Audition 2023 - New Boss -\Setup\resources\carousel\index.html

Filesize
1KB

MD5
6d0669d77f4221658398f716ba2d8533

SHA1
0a0b6a3657985da9b5a8a9fe0a75362cbbe903d8

SHA256
14531d5b7d2ed079bc32c40e23b497481ae205e32cfb067df6a07b784fe32a48

SHA512
290471cbbb167087c2ccb1cc9c106a49daf9fb1cb2161015df5be0881c80396c847e5187f59dccc213fe694b1a1a501f2da39adadf026686324406c2c94bef10

Download Submit
C:\Users\Admin\Downloads\Adobe Audition 2023 - New Boss -\Setup\resources\carousel\lib\jquery.min.js

Filesize
91KB

MD5
e1288116312e4728f98923c79b034b67

SHA1
8b6babff47b8a9793f37036fd1b1a3ad41d38423

SHA256
ba6eda7945ab8d7e57b34cc5a3dd292fa2e4c60a5ced79236ecf1a9e0f0c2d32

SHA512
bf28a9a446e50639a9592d7651f89511fc4e583e213f20a0dff3a44e1a7d73ceefdb6597db121c7742bde92410a27d83d92e2e86466858a19803e72a168e5656

Download Submit
C:\Users\Admin\Downloads\Adobe Audition 2023 - New Boss -\Setup\resources\config.xml

Filesize
269B

MD5
fc6656e65cbdbc92cc24b60eec7a3d72

SHA1
db7e3089c668bbbbad152acb66e9cf488708d70a

SHA256
2f917740b60e016b74a1388f71bccc5437d65b3a7feb3f89868a827ea04ab530

SHA512
ed7931a25b58fa3118770e3b585760275c0f07b9191396fc5ce5aba7366f0a4f47f84fc687393b600d2837969f8c77194b37cf6ab6c2691461c689a5b1e0e87c

Download Submit
C:\Users\Admin\Downloads\Adobe Audition 2023 - New Boss -\Setup\resources\content\images\appIcon.png

Filesize
1KB

MD5
f83ec03a85bab129e453fb51242c4794

SHA1
360c5cb8a2c26216cfc00b7ba2d08cd41f6b175d

SHA256
2f11a8f30a81a1d6421f268ca3f0b315a1f27f6b6dc74ee087daea619924e26b

SHA512
2182c2d5d43fe92ba055e766c0cf84d15acfefbee05322592a7180cd34d45d1c4433cf9ad6ddcf3f15813be21396f2e382914fbd55a693ff17f80be66e8c0469

Download Submit
C:\Users\Admin\Downloads\Adobe Audition 2023 - New Boss -\Setup\resources\content\images\appIcon2x.png

Filesize
2KB

MD5
08ce28e50ef7a2d6962b8c4ec5250736

SHA1
a2aaf9af7cb1130b33753e6f4995ba875844b94f

SHA256
7127f52724784a23d07b913e68f270928b5bb183c6f360f888df35600ea4dd3a

SHA512
6e47c3a130c86617bc761a341dbc9bd8859efd6ff228cf8c9053128951a3605b49854b77b09561f78ac576cc31262dc92706c9a0f2ce3ab85ad5d266c56a4f03

Download Submit
memory/1020-19-0x00007FFA01F80000-0x00007FFA01F90000-memory.dmp

Filesize
64KB

Download
memory/1020-8-0x00007FFA440B0000-0x00007FFA442A5000-memory.dmp

Filesize
2.0MB

Download
memory/1020-0-0x00007FFA4414D000-0x00007FFA4414E000-memory.dmp

Filesize
4KB

Download
memory/1020-44-0x00007FFA4414D000-0x00007FFA4414E000-memory.dmp

Filesize
4KB

Download
memory/1020-45-0x00007FFA440B0000-0x00007FFA442A5000-memory.dmp

Filesize
2.0MB

Download
memory/1020-56-0x00007FFA440B0000-0x00007FFA442A5000-memory.dmp

Filesize
2.0MB

Download
memory/1020-18-0x00007FFA440B0000-0x00007FFA442A5000-memory.dmp

Filesize
2.0MB

Download
memory/1020-65-0x00007FFA04130000-0x00007FFA04140000-memory.dmp

Filesize
64KB

Download
memory/1020-5-0x00007FFA04130000-0x00007FFA04140000-memory.dmp

Filesize
64KB

Download
memory/1020-7-0x00007FFA440B0000-0x00007FFA442A5000-memory.dmp

Filesize
2.0MB

Download
memory/1020-12-0x00007FFA440B0000-0x00007FFA442A5000-memory.dmp

Filesize
2.0MB

Download
memory/1020-15-0x00007FFA440B0000-0x00007FFA442A5000-memory.dmp

Filesize
2.0MB

Download
memory/1020-16-0x00007FFA01F80000-0x00007FFA01F90000-memory.dmp

Filesize
64KB

Download
memory/1020-14-0x00007FFA440B0000-0x00007FFA442A5000-memory.dmp

Filesize
2.0MB

Download
memory/1020-13-0x00007FFA440B0000-0x00007FFA442A5000-memory.dmp

Filesize
2.0MB

Download
memory/1020-1-0x00007FFA04130000-0x00007FFA04140000-memory.dmp

Filesize
64KB

Download
memory/1020-3-0x00007FFA04130000-0x00007FFA04140000-memory.dmp

Filesize
64KB

Download
memory/1020-9-0x00007FFA440B0000-0x00007FFA442A5000-memory.dmp

Filesize
2.0MB

Download
memory/1020-10-0x00007FFA440B0000-0x00007FFA442A5000-memory.dmp

Filesize
2.0MB

Download
memory/1020-2-0x00007FFA04130000-0x00007FFA04140000-memory.dmp

Filesize
64KB

Download
memory/1020-4-0x00007FFA04130000-0x00007FFA04140000-memory.dmp

Filesize
64KB

Download
memory/1020-6-0x00007FFA440B0000-0x00007FFA442A5000-memory.dmp

Filesize
2.0MB

Download
memory/1020-67-0x00007FFA04130000-0x00007FFA04140000-memory.dmp

Filesize
64KB

Download
memory/1020-66-0x00007FFA04130000-0x00007FFA04140000-memory.dmp

Filesize
64KB

Download
memory/1020-11-0x00007FFA440B0000-0x00007FFA442A5000-memory.dmp

Filesize
2.0MB

Download
memory/1020-17-0x00007FFA440B0000-0x00007FFA442A5000-memory.dmp

Filesize
2.0MB

Download
memory/1020-64-0x00007FFA04130000-0x00007FFA04140000-memory.dmp

Filesize
64KB

Download
memory/1020-68-0x00007FFA440B0000-0x00007FFA442A5000-memory.dmp

Filesize
2.0MB

Download
memory/2372-89-0x00007FFA221E0000-0x00007FFA23290000-memory.dmp

Filesize
16.7MB

Download
memory/2372-86-0x00007FF7B8690000-0x00007FF7B8788000-memory.dmp

Filesize
992KB

Download
memory/2372-88-0x00007FFA250E0000-0x00007FFA25396000-memory.dmp

Filesize
2.7MB

Download
memory/2372-87-0x00007FFA3D290000-0x00007FFA3D2C4000-memory.dmp

Filesize
208KB

Download
memory/3004-90-0x0000025028160000-0x0000025028170000-memory.dmp

Filesize
64KB

Download
memory/3004-94-0x00000250281A0000-0x00000250281B0000-memory.dmp

Filesize
64KB

Download
memory/3004-105-0x0000025030D60000-0x0000025030D61000-memory.dmp

Filesize
4KB

Download
memory/3004-101-0x0000025030CE0000-0x0000025030CE1000-memory.dmp

Filesize
4KB

Download
memory/3004-109-0x0000025030E00000-0x0000025030E01000-memory.dmp

Filesize
4KB

Download
memory/3004-108-0x0000025030E00000-0x0000025030E01000-memory.dmp

Filesize
4KB

Download
memory/3004-107-0x0000025030DF0000-0x0000025030DF1000-memory.dmp

Filesize
4KB

Download
memory/3004-106-0x0000025030DF0000-0x0000025030DF1000-memory.dmp

Filesize
4KB

Download
memory/3004-103-0x0000025030D60000-0x0000025030D61000-memory.dmp

Filesize
4KB

Download