hxxps://www[.]mediafire[.]com/file/go0d2s1phvtbw94/Element3D2[.]2[.]3[.]2192[.]zip/file

Resubmissions

29/09/2024, 15:24

240929-ss6ejssgqe 7

29/09/2024, 15:07

240929-shjg2asdqe 7

29/09/2024, 14:58

240929-scamyasbrh 7

Analysis

max time kernel
968s
max time network
969s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29/09/2024, 15:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.mediafire.com/file/go0d2s1phvtbw94/Element3D2.2.3.2192.zip/file

Score

7^/10

discovery persistence spyware stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	Everything.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	Video Copilot Element 3D v2.2.3.2192.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	Everything.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	Video Copilot Element 3D v2.2.3.2192.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	Video Copilot Element 3D v2.2.3.2192.exe

Executes dropped EXE 12 IoCs

pid	Process
1964	Video Copilot Element 3D v2.2.3.2192.exe
5212	Video Copilot Element 3D v2.2.3.2192.exe
2268	Everything-1.4.1.1026.x86-Setup.exe
3632	Everything.exe
5044	Everything.exe
4656	Everything.exe
5540	Everything.exe
4384	Everything.exe
208	Video Copilot Element 3D v2.2.3.2192.exe
1816	Video Copilot Element 3D v2.2.3.2192.exe
4040	Video Copilot Element 3D v2.2.3.2192.exe
5828	Video Copilot Element 3D v2.2.3.2192.exe

Loads dropped DLL 6 IoCs

pid	Process
2268	Everything-1.4.1.1026.x86-Setup.exe
2268	Everything-1.4.1.1026.x86-Setup.exe
2268	Everything-1.4.1.1026.x86-Setup.exe
2268	Everything-1.4.1.1026.x86-Setup.exe
2268	Everything-1.4.1.1026.x86-Setup.exe
2268	Everything-1.4.1.1026.x86-Setup.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Everything = "\"C:\\Program Files (x86)\\Everything\\Everything.exe\" -startup"	Everything.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	Everything.exe
File opened (read-only)	\??\E:	Everything.exe
File opened (read-only)	\??\I:	Everything.exe
File opened (read-only)	\??\N:	Everything.exe
File opened (read-only)	\??\P:	Everything.exe
File opened (read-only)	\??\Q:	Everything.exe
File opened (read-only)	\??\T:	Everything.exe
File opened (read-only)	\??\K:	Everything.exe
File opened (read-only)	\??\L:	Everything.exe
File opened (read-only)	\??\O:	Everything.exe
File opened (read-only)	\??\B:	Everything.exe
File opened (read-only)	\??\H:	Everything.exe
File opened (read-only)	\??\U:	Everything.exe
File opened (read-only)	\??\V:	Everything.exe
File opened (read-only)	\??\G:	Everything.exe
File opened (read-only)	\??\J:	Everything.exe
File opened (read-only)	\??\M:	Everything.exe
File opened (read-only)	\??\R:	Everything.exe
File opened (read-only)	\??\S:	Everything.exe
File opened (read-only)	\??\W:	Everything.exe
File opened (read-only)	\??\X:	Everything.exe
File opened (read-only)	\??\Y:	Everything.exe
File opened (read-only)	\??\Z:	Everything.exe

Drops file in Program Files directory 7 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Everything\Uninstall.exe	Everything.exe
File created	C:\Program Files (x86)\Everything\Everything.ini.tmp	Everything.exe
File created	C:\Program Files (x86)\Everything\Everything.exe	Everything.exe
File opened for modification	C:\Program Files (x86)\Everything\Everything.exe	Everything.exe
File created	C:\Program Files (x86)\Everything\Changes.txt	Everything.exe
File created	C:\Program Files (x86)\Everything\License.txt	Everything.exe
File created	C:\Program Files (x86)\Everything\Everything.lng	Everything.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Everything-1.4.1.1026.x86-Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Everything.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Everything.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Everything.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Everything.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Everything.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByDirection = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1092616257"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupView = "0"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Everything.FileList\shell	Everything.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Everything.FileList\shell\open	Everything.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0000000001000000ffffffff	Everything.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 3a001f44471a0359723fa74489c55595fe6b30ee260001002600efbe10000000014f5964d7e4da0109d1e91de4e4da01dd45a5b68112db0114000000	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.efu	Everything.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Everything.FileList\DefaultIcon\ = "C:\\Program Files (x86)\\Everything\\Everything.exe, 1"	Everything.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Everything.FileList\shell\open\command	Everything.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\IconSize = "48"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Everything.FileList\shell\edit	Everything.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Everything.FileList\shell\edit\command	Everything.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202	Everything.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.efu\Content Type = "text/plain"	Everything.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Everything.FileList\DefaultIcon	Everything.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Everything.FileList\shell\open\command\ = "\"C:\\Program Files (x86)\\Everything\\Everything.exe\" \"%1\""	Everything.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Everything.FileList	Everything.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Everything.FileList\shell\edit\command\ = "\"C:\\Program Files (x86)\\Everything\\Everything.exe\" -edit \"%1\""	Everything.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Everything.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\LogicalViewMode = "3"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	Everything.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.efu\ = "Everything.FileList"	Everything.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.efu\PerceivedType = "text"	Everything.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Everything.FileList\ = "Everything File List"	Everything.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Mode = "1"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:PID = "0"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings	Everything.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	Everything.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 894721.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
4080	msedge.exe
4080	msedge.exe
1100	msedge.exe
1100	msedge.exe
3156	identity_helper.exe
3156	identity_helper.exe
5316	msedge.exe
5316	msedge.exe
5316	msedge.exe
5316	msedge.exe
1920	msedge.exe
1920	msedge.exe
2424	msedge.exe
2424	msedge.exe
6108	msedge.exe
6108	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1920	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 33 IoCs

pid	Process
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	3412	7zG.exe
Token: 35	3412	7zG.exe
Token: SeSecurityPrivilege	3412	7zG.exe
Token: SeSecurityPrivilege	3412	7zG.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe

Suspicious use of SendNotifyMessage 29 IoCs

pid	Process
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
4384	Everything.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
1920	msedge.exe
5212	Video Copilot Element 3D v2.2.3.2192.exe
5212	Video Copilot Element 3D v2.2.3.2192.exe
4384	Everything.exe
1816	Video Copilot Element 3D v2.2.3.2192.exe
1816	Video Copilot Element 3D v2.2.3.2192.exe
5828	Video Copilot Element 3D v2.2.3.2192.exe
2444	OpenWith.exe
5828	Video Copilot Element 3D v2.2.3.2192.exe
3292	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1100 wrote to memory of 3808	1100	msedge.exe	82
PID 1100 wrote to memory of 3808	1100	msedge.exe	82
PID 1100 wrote to memory of 2708	1100	msedge.exe	83
PID 1100 wrote to memory of 2708	1100	msedge.exe	83
PID 1100 wrote to memory of 2708	1100	msedge.exe	83
PID 1100 wrote to memory of 2708	1100	msedge.exe	83
PID 1100 wrote to memory of 2708	1100	msedge.exe	83
PID 1100 wrote to memory of 2708	1100	msedge.exe	83
PID 1100 wrote to memory of 2708	1100	msedge.exe	83
PID 1100 wrote to memory of 2708	1100	msedge.exe	83
PID 1100 wrote to memory of 2708	1100	msedge.exe	83
PID 1100 wrote to memory of 2708	1100	msedge.exe	83
PID 1100 wrote to memory of 2708	1100	msedge.exe	83
PID 1100 wrote to memory of 2708	1100	msedge.exe	83
PID 1100 wrote to memory of 2708	1100	msedge.exe	83
PID 1100 wrote to memory of 2708	1100	msedge.exe	83
PID 1100 wrote to memory of 2708	1100	msedge.exe	83
PID 1100 wrote to memory of 2708	1100	msedge.exe	83
PID 1100 wrote to memory of 2708	1100	msedge.exe	83
PID 1100 wrote to memory of 2708	1100	msedge.exe	83
PID 1100 wrote to memory of 2708	1100	msedge.exe	83
PID 1100 wrote to memory of 2708	1100	msedge.exe	83
PID 1100 wrote to memory of 2708	1100	msedge.exe	83
PID 1100 wrote to memory of 2708	1100	msedge.exe	83
PID 1100 wrote to memory of 2708	1100	msedge.exe	83
PID 1100 wrote to memory of 2708	1100	msedge.exe	83
PID 1100 wrote to memory of 2708	1100	msedge.exe	83
PID 1100 wrote to memory of 2708	1100	msedge.exe	83
PID 1100 wrote to memory of 2708	1100	msedge.exe	83
PID 1100 wrote to memory of 2708	1100	msedge.exe	83
PID 1100 wrote to memory of 2708	1100	msedge.exe	83
PID 1100 wrote to memory of 2708	1100	msedge.exe	83
PID 1100 wrote to memory of 2708	1100	msedge.exe	83
PID 1100 wrote to memory of 2708	1100	msedge.exe	83
PID 1100 wrote to memory of 2708	1100	msedge.exe	83
PID 1100 wrote to memory of 2708	1100	msedge.exe	83
PID 1100 wrote to memory of 2708	1100	msedge.exe	83
PID 1100 wrote to memory of 2708	1100	msedge.exe	83
PID 1100 wrote to memory of 2708	1100	msedge.exe	83
PID 1100 wrote to memory of 2708	1100	msedge.exe	83
PID 1100 wrote to memory of 2708	1100	msedge.exe	83
PID 1100 wrote to memory of 2708	1100	msedge.exe	83
PID 1100 wrote to memory of 4080	1100	msedge.exe	84
PID 1100 wrote to memory of 4080	1100	msedge.exe	84
PID 1100 wrote to memory of 3812	1100	msedge.exe	85
PID 1100 wrote to memory of 3812	1100	msedge.exe	85
PID 1100 wrote to memory of 3812	1100	msedge.exe	85
PID 1100 wrote to memory of 3812	1100	msedge.exe	85
PID 1100 wrote to memory of 3812	1100	msedge.exe	85
PID 1100 wrote to memory of 3812	1100	msedge.exe	85
PID 1100 wrote to memory of 3812	1100	msedge.exe	85
PID 1100 wrote to memory of 3812	1100	msedge.exe	85
PID 1100 wrote to memory of 3812	1100	msedge.exe	85
PID 1100 wrote to memory of 3812	1100	msedge.exe	85
PID 1100 wrote to memory of 3812	1100	msedge.exe	85
PID 1100 wrote to memory of 3812	1100	msedge.exe	85
PID 1100 wrote to memory of 3812	1100	msedge.exe	85
PID 1100 wrote to memory of 3812	1100	msedge.exe	85
PID 1100 wrote to memory of 3812	1100	msedge.exe	85
PID 1100 wrote to memory of 3812	1100	msedge.exe	85
PID 1100 wrote to memory of 3812	1100	msedge.exe	85
PID 1100 wrote to memory of 3812	1100	msedge.exe	85
PID 1100 wrote to memory of 3812	1100	msedge.exe	85
PID 1100 wrote to memory of 3812	1100	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.mediafire.com/file/go0d2s1phvtbw94/Element3D2.2.3.2192.zip/file
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdef2a46f8,0x7ffdef2a4708,0x7ffdef2a4718
  2⤵
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,1442833508741434668,3328961345914213088,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2208 /prefetch:2
  2⤵
  PID:2708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,1442833508741434668,3328961345914213088,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,1442833508741434668,3328961345914213088,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:8
  2⤵
  PID:3812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,1442833508741434668,3328961345914213088,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:4100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,1442833508741434668,3328961345914213088,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,1442833508741434668,3328961345914213088,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5668 /prefetch:8
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,1442833508741434668,3328961345914213088,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5668 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,1442833508741434668,3328961345914213088,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5380 /prefetch:1
  2⤵
  PID:396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,1442833508741434668,3328961345914213088,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5496 /prefetch:1
  2⤵
  PID:1428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,1442833508741434668,3328961345914213088,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3672 /prefetch:1
  2⤵
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,1442833508741434668,3328961345914213088,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5716 /prefetch:1
  2⤵
  PID:3272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,1442833508741434668,3328961345914213088,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4852 /prefetch:1
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,1442833508741434668,3328961345914213088,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5968 /prefetch:1
  2⤵
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,1442833508741434668,3328961345914213088,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5992 /prefetch:1
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,1442833508741434668,3328961345914213088,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6092 /prefetch:1
  2⤵
  PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,1442833508741434668,3328961345914213088,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6724 /prefetch:1
  2⤵
  PID:5148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2076,1442833508741434668,3328961345914213088,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6280 /prefetch:8
  2⤵
  PID:5380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,1442833508741434668,3328961345914213088,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
  2⤵
  PID:5388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,1442833508741434668,3328961345914213088,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6856 /prefetch:1
  2⤵
  PID:5508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,1442833508741434668,3328961345914213088,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6524 /prefetch:1
  2⤵
  PID:5592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,1442833508741434668,3328961345914213088,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4860 /prefetch:1
  2⤵
  PID:5684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,1442833508741434668,3328961345914213088,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7360 /prefetch:1
  2⤵
  PID:5880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,1442833508741434668,3328961345914213088,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7628 /prefetch:1
  2⤵
  PID:5888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,1442833508741434668,3328961345914213088,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7448 /prefetch:1
  2⤵
  PID:6112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,1442833508741434668,3328961345914213088,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7584 /prefetch:1
  2⤵
  PID:544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,1442833508741434668,3328961345914213088,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7624 /prefetch:1
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,1442833508741434668,3328961345914213088,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4596 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,1442833508741434668,3328961345914213088,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6916 /prefetch:1
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,1442833508741434668,3328961345914213088,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:1
  2⤵
  PID:2208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,1442833508741434668,3328961345914213088,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8052 /prefetch:1
  2⤵
  PID:5900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2076,1442833508741434668,3328961345914213088,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6496 /prefetch:8
  2⤵
  PID:5632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=2076,1442833508741434668,3328961345914213088,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3460 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:1920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,1442833508741434668,3328961345914213088,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6368 /prefetch:1
  2⤵
  PID:1144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2076,1442833508741434668,3328961345914213088,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,1442833508741434668,3328961345914213088,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1068 /prefetch:1
  2⤵
  PID:3156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,1442833508741434668,3328961345914213088,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5180 /prefetch:1
  2⤵
  PID:5796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,1442833508741434668,3328961345914213088,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6332 /prefetch:1
  2⤵
  PID:5288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,1442833508741434668,3328961345914213088,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5840 /prefetch:1
  2⤵
  PID:720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,1442833508741434668,3328961345914213088,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3948 /prefetch:1
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2076,1442833508741434668,3328961345914213088,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6528 /prefetch:8
  2⤵
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2076,1442833508741434668,3328961345914213088,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4772 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6108
- C:\Users\Admin\Downloads\Everything-1.4.1.1026.x86-Setup.exe
  "C:\Users\Admin\Downloads\Everything-1.4.1.1026.x86-Setup.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2268
- - C:\Users\Admin\AppData\Local\Temp\nse19C0.tmp\Everything\Everything.exe
    "C:\Users\Admin\AppData\Local\Temp\nse19C0.tmp\Everything\Everything.exe" -install "C:\Program Files (x86)\Everything" -install-options " -app-data -install-run-on-system-startup -install-service -disable-run-as-admin -uninstall-folder-context-menu -install-start-menu-shortcuts -install-desktop-shortcut -uninstall-url-protocol -install-efu-association -install-language 1033 -save-install-options 0"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    PID:3632
  - - C:\Program Files (x86)\Everything\Everything.exe
      "C:\Program Files (x86)\Everything\Everything.exe" -app-data -install-run-on-system-startup -install-service -disable-run-as-admin -uninstall-folder-context-menu -install-start-menu-shortcuts -install-desktop-shortcut -uninstall-url-protocol -install-efu-association -install-language 1033 -save-install-options 0
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:5044
- - C:\Program Files (x86)\Everything\Everything.exe
    "C:\Program Files (x86)\Everything\Everything.exe" -disable-update-notification -uninstall-quick-launch-shortcut -no-choose-volumes -language 1033
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5540
- - C:\Program Files (x86)\Everything\Everything.exe
    "C:\Program Files (x86)\Everything\Everything.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    PID:4384
  - - C:\Users\Admin\Downloads\Element3D2.2.3.2192\Element 3D 2.2.3.2192\Video Copilot Element 3D v2.2.3.2192.exe
      "C:\Users\Admin\Downloads\Element3D2.2.3.2192\Element 3D 2.2.3.2192\Video Copilot Element 3D v2.2.3.2192.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      PID:4040
    - - C:\Users\Admin\Downloads\Element3D2.2.3.2192\Element 3D 2.2.3.2192\Video Copilot Element 3D v2.2.3.2192.exe
        
        "C:\Users\Admin\Downloads\Element3D2.2.3.2192\Element 3D 2.2.3.2192\Video Copilot Element 3D v2.2.3.2192.exe" /UAC
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,1442833508741434668,3328961345914213088,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4772 /prefetch:1
  2⤵
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,1442833508741434668,3328961345914213088,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1052 /prefetch:1
  2⤵
  PID:1336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,1442833508741434668,3328961345914213088,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5708 /prefetch:1
  2⤵
  PID:5980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,1442833508741434668,3328961345914213088,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7396 /prefetch:1
  2⤵
  PID:3348

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1468

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4920

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:8

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Element3D2.2.3.2192\" -spe -an -ai#7zMap25351:100:7zEvent26870
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3412

C:\Users\Admin\Downloads\Element3D2.2.3.2192\Element 3D 2.2.3.2192\Video Copilot Element 3D v2.2.3.2192.exe
"C:\Users\Admin\Downloads\Element3D2.2.3.2192\Element 3D 2.2.3.2192\Video Copilot Element 3D v2.2.3.2192.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
PID:1964
- C:\Users\Admin\Downloads\Element3D2.2.3.2192\Element 3D 2.2.3.2192\Video Copilot Element 3D v2.2.3.2192.exe
  "C:\Users\Admin\Downloads\Element3D2.2.3.2192\Element 3D 2.2.3.2192\Video Copilot Element 3D v2.2.3.2192.exe" /UAC
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:5212

C:\Program Files (x86)\Everything\Everything.exe
"C:\Program Files (x86)\Everything\Everything.exe" -svc
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4656

C:\Users\Admin\Downloads\Element3D2.2.3.2192\Element 3D 2.2.3.2192\Video Copilot Element 3D v2.2.3.2192.exe
"C:\Users\Admin\Downloads\Element3D2.2.3.2192\Element 3D 2.2.3.2192\Video Copilot Element 3D v2.2.3.2192.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
PID:208
- C:\Users\Admin\Downloads\Element3D2.2.3.2192\Element 3D 2.2.3.2192\Video Copilot Element 3D v2.2.3.2192.exe
  "C:\Users\Admin\Downloads\Element3D2.2.3.2192\Element 3D 2.2.3.2192\Video Copilot Element 3D v2.2.3.2192.exe" /UAC
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1816

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2444

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Everything\Everything.ini

Filesize
215B

MD5
b2b308d8c164f75bc11bccf7baf3df67

SHA1
6f1e5561268b2db5b46bb6f738c0f7a637fd6b6d

SHA256
f0969f438d2869641d8f76d5b9fd2b82c7232134a90972e96abb3783d1e2fbe5

SHA512
5cb56d715d35a33e5bbc7e7deb43e4f143e4193ae59282892fe72b82c66a21a62cec85222a9879d5126479a59b9a5e715568f4bb62040a4c03b706f1ebde9659

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f9664c896e19205022c094d725f820b6

SHA1
f8f1baf648df755ba64b412d512446baf88c0184

SHA256
7121d84202a850791c2320385eb59eda4d697310dc51b1fcd4d51264aba2434e

SHA512
3fa5d2c68a9e70e4a25eaac2095171d87c741eec2624c314c6a56f4fa390d6319633bf4c48b1a4af7e9a0451f346beced9693da88cfc7bcba8dfe209cbd1b3ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
847d47008dbea51cb1732d54861ba9c9

SHA1
f2099242027dccb88d6f05760b57f7c89d926c0d

SHA256
10292fa05d896a2952c1d602a72d761d34bc776b44d6a7df87e49b5b613a8ac1

SHA512
bd1526aa1cc1c016d95dfcc53a78b45b09dde4ce67357fc275ab835dbe1bb5b053ca386239f50cde95ad243a9c1bbb12f7505818577589beecc6084f7b94e83f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000018

Filesize
62KB

MD5
c3c0eb5e044497577bec91b5970f6d30

SHA1
d833f81cf21f68d43ba64a6c28892945adc317a6

SHA256
eb48be34490ec9c4f9402b882166cd82cd317b51b2a49aae75cdf9ee035035eb

SHA512
83d3545a4ed9eed2d25f98c4c9f100ae0ac5e4bc8828dccadee38553b7633bb63222132df8ec09d32eb37d960accb76e7aab5719fc08cc0a4ef07b053f30cf38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000019

Filesize
70KB

MD5
4308671e9d218f479c8810d2c04ea6c6

SHA1
dd3686818bc62f93c6ab0190ed611031f97fdfcf

SHA256
5addbdd4fe74ff8afc4ca92f35eb60778af623e4f8b5911323ab58a9beed6a9a

SHA512
5936b6465140968acb7ad7f7486c50980081482766002c35d493f0bdd1cc648712eebf30225b6b7e29f6f3123458451d71e62d9328f7e0d9889028bff66e2ad2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001a

Filesize
63KB

MD5
710d7637cc7e21b62fd3efe6aba1fd27

SHA1
8645d6b137064c7b38e10c736724e17787db6cf3

SHA256
c0997474b99524325dfedb5c020436e7ea9f9c9a1a759ed6daf7bdd4890bdc2b

SHA512
19aa77bed3c441228789cf8f931ca6194cc8d4bc7bb85d892faf5eaeda67d22c8c3b066f8ceda8169177da95a1fe111bd3436ceeaf4c784bd2bf96617f4d0c44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001b

Filesize
19KB

MD5
76a3f1e9a452564e0f8dce6c0ee111e8

SHA1
11c3d925cbc1a52d53584fd8606f8f713aa59114

SHA256
381396157ed5e8021dd8e660142b35eb71a63aecd33062a1103ce9c709c7632c

SHA512
a1156a907649d6f2c3f7256405d9d5c62a626b8d4cd717fa2f29d2fbe91092a2b3fdd0716f8f31e59708fe12274bc2dea6c9ae6a413ea290e70ddf921fe7f274

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002c

Filesize
213KB

MD5
f942900ff0a10f251d338c612c456948

SHA1
4a283d3c8f3dc491e43c430d97c3489ee7a3d320

SHA256
38b76a54655aff71271a9ad376ac17f20187abd581bf5aced69ccde0fe6e2fd6

SHA512
9b393ce73598ed1997d28ceeddb23491a4d986c337984878ebb0ae06019e30ea77448d375d3d6563c774856d6bc98ee3ca0e0ba88ea5769a451a5e814f6ddb41

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
1KB

MD5
dfe20f96882923b29662241f04ac9913

SHA1
8aff324ecbdf9cc3f3be543c6f848c6c878ba719

SHA256
9cf8d2ba6175b583dc185591a8f2d7c2391c16e8ab2ad9c1d17a4a6e724a02f4

SHA512
fbacf984396f927eece996687a3dbac46c06e5a4cc0ad773d4e89759da808f2d13f97afe5249816584864268c1ac472b106a4dd38dfb9b1b21c9871b529f2c49

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
a685d8239b4a87362ab82333bad31d62

SHA1
3cb057893754cc0ae054ec0fb14c779b8e8e91e7

SHA256
ca79095f3f11fecabe3c6f2476e8d31c5a18bfa48cb83d77df56930836bb7832

SHA512
b4e74d3577d4de7dabf80b11a2fdf30f768af9985c6398cc6c620c5b3b0446dccd946cf5d7070ef9bc4fa97cf14608a840701805681302d0b64e0fe2674731e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
48c3027df52f77f4f5ce7e834dbf202f

SHA1
9ccb343dad16059ee27e021f62cfb0521a18b784

SHA256
c543432d5218e2efbbc10d3ae56263367f3e4774b9a249c66019417fdf2c1068

SHA512
110a5bea5909d6aac38e050a35d87aec56cb2a22892d6c291b5239ef84208ced6c5ff9474ddc8eee1c6bf38d99c3403f81a1b5871419a40fb75c7ef1c22944d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
509fce8a5412d4f4c6f20781aaba91c4

SHA1
892212160e3b8b95b7f4a438ea44c03033845edd

SHA256
970ad5d91e6dd52d9135ab5326ad5ec769fea537aed0ced4dd6799d3dc4857db

SHA512
6cf4b4796cb267b7d4c199fa63df1aa7c21fe15a5b09d3fb0a1e862f7f248ce7ca709ab55b9d9b2731ac3b72f342fa775eda14ccbdc87a7e5072e634e5f17f23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
cc33fafe1a9dfd9d60dfc3bb2ef65039

SHA1
9d902a5cb7c9df0ad39e6d9cf62b9034ad060044

SHA256
9032c0a36c1367091a91fe918a12d8a8414cc0cfe7a3d4e2eafbc49a8ed1be3f

SHA512
417187ac5486401267f825a1e9d9c0dc33d9b86044ed146c6bbfd9b409e597efa5e55d7e7e868c84f4e518607dd85c600054b11db46e3a8c40e11502e6689988

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
8KB

MD5
dd182b8fedb59e806667bdeec0e9d31f

SHA1
e3d7456228d6631a80f614d7c587d2bda06a5736

SHA256
0bfeb8b8836f1d81701942c766e1dfc7b61c9892ae605c1cf3a0d30bc24cd30f

SHA512
2244b4b553bd94ed90054fc833f31c39efd2e601f6e0dcf25734ce6f7789353d7488d4db440d6f8baadc03ed80c1bdf46ddc9735392a74daad79af982317cf44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
8KB

MD5
dfa02e338dcd215a9026493cfbb1005a

SHA1
64f4c22bd2397fba69d813c588c60aef7fa85f86

SHA256
a559ea5518374f282a1417ad9e3b198419cc1145a62259a01d4a3b514ffa5634

SHA512
a416b2d1137596a89f5f9f9affb9c93ba509176982785ae8cdca2f346ae2a997ffb00a1d68eb73afdc850f76b7807645797a1e255997caabdfd392a12a2985b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
9KB

MD5
c5c2ff2930366f304b2c60de82297ede

SHA1
9fc2505b76eaa317153d978c84dc0b9c9ecc523a

SHA256
e8a308e6899feb262b0b4f97ca91cb080f6966121ca83ffc55a8d4c45c2930b4

SHA512
af784dcde6e7f533ad5c41a919d190736c6ce05398a22a8bb88cd3df5d34c1c0e2cfe33e059f2ba4580a577fdb6ad4a4b86c98e55f1a04ea46b694da40ad1269

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
12KB

MD5
300991e2580557dded3119f7e4e5cc1b

SHA1
8451943c7b87452ae4333c92ae08a73232da0276

SHA256
10e06679d5094e923b1ae792b83a3a91b46ef0c2d323173ba0fc92c357bcc638

SHA512
82c4e6b9b65ae4b72b86ffb0cab205130d4494f1eafaa93bad5dcc555c37d6380140af407af337f1b2eccc92bee8d007327a67320284ab3979f62b4fbb0ee0b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
13KB

MD5
2960f07a803f43f672e0d873627ae2ac

SHA1
4c66ba6a3d57482ad93fc8e42d8336980056081d

SHA256
c2b3ccd40aac6095560fed0440f063d4149ee3a0fd0de5d6844600cd6e6ad655

SHA512
0ab1d6010780035ebc43c99e9fc7a9aa2ae4cf63cff2bedb8be914e011aa06d23dca53c541256f9ffa5b67da79fe5f698a5f2831fbc7ce3c597fd8e177692ea8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
13KB

MD5
2d8fa6a7b125818400d10b3ffad137ba

SHA1
e62e3403a2df3493c89281d55a57d2d2ff065147

SHA256
74df3e9e7afecbdd9b3d96e6e28c29201631441564ea485505e7a3f539ff0850

SHA512
889f4d9968859520a8bb5b309c7a33de8d2b0c03c32f293c6edb9827e3fd072ad48a9a1f145d7ebfef9e825e8b5e9b7ad09043fe98a7a8fc9ee63029267f3e02

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
13KB

MD5
333c90dbf3e7090bea5b226ce8d29ad3

SHA1
b3afc20c5c6558d38d7549d042d5e4eddba7d9af

SHA256
d47fbd739f7c1e2c2a47cc875b2ec4c6e09464ad7c29a4378466bd2fdfb2ee64

SHA512
259bc84e0a6396c6a842f20d5c32004d6f2d13ebfbfaa2e3982085c1bb457f4803cd03f98f3b45f158aa9cefb966f11c2f043755184f1044efcc16a47eeb354f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4ab850efd7878deb87689344c99ddc60

SHA1
987f353477df931fb6f0f42dca8fda6047777d1a

SHA256
34b46fd7b2a0b9da3414aaa14562505a2e814fc2645e839d7e6903bfae74f98c

SHA512
f7a17b1f80bcf814d18324a8d31ca259e38ce580fb71edb70de9e7994269506ba557e7da7a71d3468d1a89c0ab0d1ca7f4273ac6bc5eb1f615807555a7cb24e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
11KB

MD5
e26e8c332eacbda5f789fd456befa359

SHA1
877be44cf47b83fd354e54af0813a9dc35453864

SHA256
ec6be154c08b9705d86872b16ba1ede5410fe9cac47cbaee084f9c6c7311c936

SHA512
b85cd36f31bf2deee6a6770bbb9b20ea828ba08c91912a28460b8384e58afe60f7b9ca34738fea8f45c603110cbb3da9c9aacb600a6026618c6347c04afaddce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
13KB

MD5
c561ad0e849e9c36bfb617d0e0f837cb

SHA1
0cb041902f3bfce344b53e4d1f7a21695ba396f9

SHA256
ef0479f3e90df2d291242ca7c4d94536812cee0b5b2ab9c5df64c234e0212e48

SHA512
82e820e1045d659f951d39359e656f23bc2b02f28d6ad0c7500e4dcd85477d7ade7a8b1f98c4775471d8592bd53ff64536ca73c21582badb19eb0c49f736fb6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
7753e5fb1e9457de7186c45d20614d4a

SHA1
96d8e5024208f26d99108dc084d7ea27b8e1c123

SHA256
9e340ca933a874d2402e29dad2f367f342ef4d2db067b019a6adc2bf61770bc6

SHA512
c5cce583cd7dc50b7c59b01a0aa1607eb80c2589f5e893fd406f9b3ed489d233fe8a7f21bac459e3afa0581fb0e9eacd16cab4ebf76281c5b2c712409db59b81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
11KB

MD5
d31ed08bbcf7be59b3567ad361e2decb

SHA1
b9053e7b44b30c32d28b4b59bfa05c48d9b8d591

SHA256
47f334297714b9318714ed46b5a25bf74c013a5a92891bd1df8358ee6b0f692c

SHA512
b1b7c741c406fa3f34008b07b0bc9edd2d16e778901fe133e2c3be87a4bf5ec0470b3ea1021080cc8598472c67d523a7bf6b95f07026d2924cbfba1d85db7b43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
cf60c60dead950ec652e1bb78b9fcecc

SHA1
65bb6165d48f72c06737b14b7b898f12e38e9cc0

SHA256
d0ea429a8eb258143f8c6d7fd5deb4cb10bfa7494142f0288781ed7f818b4c27

SHA512
f47f3055939438671d33cc552b3dc30c8b51f23cff607546f5c0529b5ae53a0e4c85f9d2f3c550481b84389af1496e81d9c34a1482f56c46b63595486e97da48

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5a442e.TMP

Filesize
48B

MD5
74dd988c457b2d5de0dbda87e0eb422c

SHA1
bd2a9f170b7804cf217e399084064994fe0d06ea

SHA256
89825cd90a7e2e25a9b4fb00ebedf1284a2cfb2b9554c32778cc9bfb535149e6

SHA512
6cf9ab3c53f9996a54eeda8f8bde110b8fcc6f1913917760b214231a0940f9cf2f2b6c632eb4b11bb26a6deec880116503ea44d3cf244df8935fe1fe33659964

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
7927053b5633eef7353e59fa5540e194

SHA1
d67343cb5b461cb6237e5df5fd27215bc12e6bce

SHA256
4da320a9f5567c8051ff2103a6ad87c281ba473bdda6d8d82017f7d18ee7f511

SHA512
a51a1b8e5a7c27ca5ee4b4a3a9b046bb5fa6ed909b261f3448427ff0a765d5224c16dbb5a4a4593789b06186e3ce6776e2be0eeac4fdce4c4d1b369b3592d46f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
541d3530a31b17545c014f0fe6245c38

SHA1
05e31acb4127e8a128ac67ffce840aa1b87bc65f

SHA256
5a15e843682ab9dbe643603f1153cab32070fc505d2fb4aca12c563099f03f8a

SHA512
fd778162a8b53ef8ce5dae9d5eec36fb9a7016926495ac236a1313dbed6708ae0f2da33bf39385462a4fb11ed2786554c157730ac7dbf05fe1036e3b1a859dd8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
369d2614ed74d1ed01418000fe6ced9f

SHA1
19f0b4e0c3cfcc77ed8d5d89500dd6c2bff9ae0e

SHA256
73452df5b4df199633f2328f97afe560ca270f028a30476bd30acc668fff5456

SHA512
e82fd2366278fa1f2df1988cef242aaa405ccd8cc2efeebe10283157c831e5ea1ecda0cdcbc29fac15b5814bd3060f2aaec37bf58862e26cc36368512865c564

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
0394251c0e2287b75298c16b265633e3

SHA1
2bc0ee07f04d96fbbf0141e1316fa53993d7ac5c

SHA256
0c47c9fd9ed8de2bec3bffa9202f360ef98c6ef5cbfe476267a8ac9b1c3ad53f

SHA512
a4882aa88157059ca066b1b0fb7c8a5412fca79e10d0b0f8074c919c8ac71f81a3add05b6768d78a23c5f018d4037056d71d72c4fb3b035b0a1eaa21b43586f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe580bb3.TMP

Filesize
538B

MD5
6252ce37212d71bb0242458f905106dc

SHA1
db08127bc4c225df034231f8f0eefee214a2692e

SHA256
01ee405b7156670973a2863f77a321b3409d1bacfde10486c855190880d9f725

SHA512
c862b46f7e867eae00878dec15d6cd15b0482abecfcc555b557ccea28f5333f5ff5105dbfe9bbf46aa01c131898b11fc56543f8f292c583e3615c2717ccf9b4a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3a3e31bacabb786a8fd7cea7c3911b8b

SHA1
4132249d81e381873057fa94d90a23d2c866a078

SHA256
314a62cd3354a795e067fb3f891c58f3e6d9389afbd36452940469f070ab9033

SHA512
8695124a510a6715ec857e5d1ece8d7d6498ec0263c03a40faa78a6ed4596544883e42da598a7de4dc60df89377c3a113349d8b61f1ae916f9c9737a358b3f06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a952667e0c6a798c6b431a0a6592bf9c

SHA1
f71980efdcf49cc8eee818f3cbb327c8d447103d

SHA256
593fcde837935ea74566868598a8ba88711e92aa8eee1d89b355cfeaf3c4e441

SHA512
69fba260bf5a961027cb17dcd9165efe1a53d645f982a68bd204534accc7e7cc97eb7e96de0f089a3f5c879b39dc6cbdd3331b5d90bdcea727eb2ac4c3f711b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6818734ff35363fcccac5384f1019103

SHA1
0c2ab0ed3c1d5abe72d06dd55b6b930d5a49a6fb

SHA256
74934124a6dd5146de91e779f51e8578e49d9b53c62692752d1156462432411e

SHA512
af5536c9cf21d1702b40cf564d40dea48d4d3979f12d0d3251e6f2a50cbf1b0bef49d1dca5ceb45cac93e2e659fb952fab9c3535345aed1c8766f71534df502f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
75ae50d6fb7a10d0c746ae770328d301

SHA1
299ad8389968abe4035f68c1e77138de1c90a4b8

SHA256
88bbbdc5918b93282fff43ddd5258a41669da6c6c8138ba9511c8efa35e1bdbf

SHA512
390078befca2e1c4b911f727c24c01b3f224924a7bfc9f3eab8b593ae5570336bac0e446336991af1c7fcb1ce33a1b776d164687c3820249ca00a7a1c06bd49c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
920f8093ab00f7417a921dad33358bad

SHA1
bd387a37f8899ad2455655cee09d3b52920b003b

SHA256
9a59a8be4f6badc66182b1fd4a22e52e55f3accc269285a41438c7971bff499a

SHA512
f5f50a06121b903113bd0acada300cd1b859d3d85ff90d2c148945878331edf7bc2a3f407292a90c81f9b63c06da707553b0aaa1a813f77b064c13bf57fcc37d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d39152c53cf325a55b0473dcc479204a

SHA1
c56d88f53d91a6818bb62da48d476889a5ab9bb3

SHA256
f73e4eb34e21473772f792fa16f05db8e8be033efca65ae37d5b3c1cc6521f90

SHA512
b0e2a669eb67e4bec12f2402bd27ceb7fb447316875d73ee994ef88d4b6086f84630f0b1ac6d7d03350e688a4c1112531d1e49f78c6e0f2c58bc22f41669a718

Download Submit
C:\Users\Admin\AppData\Local\Temp\nse19C0.tmp\Everything\Changes.txt

Filesize
19KB

MD5
e3cc8979834c21ddcc26bd94599242f6

SHA1
2045335da8e3a5723547e0c728d3323ecff2aa15

SHA256
9871a374b9e6b8660004450f2e735dda01025d4cb51eae0c296fee3fc285d9df

SHA512
f25e89f6cc99c06197889f60e1898af4b1ea309aed9194e42fc5107b0101a195d795690f5ee5f98475a3fe252b839eb6367b154ca8686eb04d033b682002036b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nse19C0.tmp\Everything\Everything.exe

Filesize
1.7MB

MD5
c665fa0aa5afa3fb41c21afe5884b4f1

SHA1
c79bddbea392247a4e88221f53c0e2e30368b614

SHA256
fb653fd840b0399cea31986b49b5ceadd28fb739dd2403a8bb05051eea5e5bbc

SHA512
743328d688e21f1e19605e82f1abe1b451a4812108fba7b3838b63404f9dd53a693839006cc5176dd070ab5f43de94fa9cdec47805a7e36b01042c9f6c9e4b7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nse19C0.tmp\Everything\Everything.lng

Filesize
935KB

MD5
112f64226ee5a339bbe7aefbd9e8deba

SHA1
d9f73eaf2b60531ca155814d217a3b480c940b75

SHA256
d925b044baa9af9375b8918758a4ccf12b48c5dc7b4aaba8791b92e77e9233f1

SHA512
d349d1546b031babb84450e66d2e92570441a07f5ef5d8ce843043e03f9050beb160d6fd343ebf3b730a116070f7ca017cd268ab1bf20e0ab71f876542678a1e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nse19C0.tmp\Everything\License.txt

Filesize
2KB

MD5
3ca499e57472869658d7e877e1ef7aba

SHA1
49d8075d373186f98336c16fcb9b91f1abca4599

SHA256
4f066c930db22da8bf0a940f4f9ecd43a208b4697288adea26ab5eb7daeaaa81

SHA512
8ff7f037479ef7e8fe02e62671646cf44ede84ca1befc718c4960ee579190b588fb0bfa409c20afea117c5a4a7756eef96598c33d56605298e672d4a990bd288

Download Submit
C:\Users\Admin\AppData\Local\Temp\nse19C0.tmp\Everything\Uninstall.exe

Filesize
137KB

MD5
4c5f28025a2603f28f5dc07eb8b802a9

SHA1
b10eefa1319f7a0cd6eccc5b6d6eff52cc3dc78b

SHA256
1316a694538ad8c2333836ce0ab3a748b670cbab394b4683a59219772f1f92ee

SHA512
8f670967cae054c90f420ddf9a94cc6943c86680367f5caf0d49016e01494e77518ccedb31f1a37174b0fffa176bd5e35a88ed87e2e1af1fb75ecc31675d8b46

Download Submit
C:\Users\Admin\AppData\Local\Temp\nse19C0.tmp\InstallOptions.dll

Filesize
15KB

MD5
ece25721125d55aa26cdfe019c871476

SHA1
b87685ae482553823bf95e73e790de48dc0c11ba

SHA256
c7fef6457989d97fecc0616a69947927da9d8c493f7905dc8475c748f044f3cf

SHA512
4e384735d03c943f5eb3396bb3a9cb42c9d8a5479fe2871de5b8bc18db4bbd6e2c5f8fd71b6840512a7249e12a1c63e0e760417e4baa3dc30f51375588410480

Download Submit
C:\Users\Admin\AppData\Local\Temp\nse19C0.tmp\InstallOptions.ini

Filesize
1KB

MD5
e2808f4be298a32ae279ee9ebacd0a0c

SHA1
b7929c346ba7a7aa690a766e4f70bc1d44f75460

SHA256
99b98f333848dacc5df866402181a6e2441fff0f9cdbb2a26f5f2c5d5dd12c52

SHA512
a305986b1eb907caa77616bcf3b9929fcbef8156b9162a942b1720ae32b34e1ba0537c553b54e750a22c3106fdb33870c346dd1f9d72db7d0baa6d318c3752a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\nse19C0.tmp\InstallOptions.ini

Filesize
1KB

MD5
aff2871a30fa6063774989d47390bbfb

SHA1
18fe830d2585c442d4d50047557740b0c138b79c

SHA256
439e84c3b9e61cdcae2dcc48b2752d2cf1e39e6f05fb3f464d13a63b75c03695

SHA512
39014ac45f3979a4612f84ac5f0c52a244ee101fbc138da42558939f247c0a3ad93e8499247b67413cef2bf733fc15d7425efb65cdfaf9054b6b00d551265b59

Download Submit
C:\Users\Admin\AppData\Local\Temp\nse19C0.tmp\InstallOptions.ini

Filesize
1KB

MD5
191a86c6de7b113c05527f850c005d7d

SHA1
b836ee3e890fee9f7c9f4c3a45f0b28e65c8ec9a

SHA256
0d93a5fcf864f7867f7c32748e23316fdf8cc2d4ba0df0d1d599de3d03d69aae

SHA512
bc4289686e6a0a0e498f6a0cd54a041d46a8bb9e67b80816a977577eefc3086f85bef2f4c99c8d0b85dfabe245b45769803a2c3335a492e03f6f06d961a07b7e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nse19C0.tmp\InstallOptions2.ini

Filesize
2KB

MD5
a6634dd375de49a06ff7c8c65f03bb42

SHA1
2834f907bb17d0916cfd1285718695f866e319d6

SHA256
caf045fdf50d8706410dabb4b4db6edab64d09a1c4229854666c5fdcbc70f35d

SHA512
c2d65ed0b99084753447711ea46e2805017b51917851bc7b53a96e58c49b92acf9f3f32fdb9b68beea400050703785ef49f7d7bf77131cb683663375654b71e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nse19C0.tmp\InstallOptions2.ini

Filesize
2KB

MD5
921f65ccaf36045f02dd5c82cf871131

SHA1
48e741bd7be79858521ab1a19197d6e6a5d4a01e

SHA256
6359a9d0d059476f4e0d49ef9975d6292d80f180f5ab16c831a0b5febb898630

SHA512
0455fd95c2a40d5f51c47e522112f1ddf593a9b0e1a18ac969848f38871e6e823d23c5a1dcc02dc4b24b8952d09fe743d649af1d310e2dcdf6699abd324967b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nse19C0.tmp\InstallOptions2.ini

Filesize
2KB

MD5
1b15bd2821f06cb0588347e53432b857

SHA1
7ee07e172df3543e1fe467e3258bc4de343ed1c7

SHA256
694d911f91a0825e1175ea471a2d3c4fdbec9b606366e10d4c1f661a1c6d1cd4

SHA512
81a83ebabf61d8ce191a70ec5fb4c4ea8400cf3e175536765182a5343627877680bbeb9d40711a706913f9a1360e9aa738a2817fa1dfb2e6b8321afc2f2a3f92

Download Submit
C:\Users\Admin\AppData\Local\Temp\nse19C0.tmp\LangDLL.dll

Filesize
5KB

MD5
68b287f4067ba013e34a1339afdb1ea8

SHA1
45ad585b3cc8e5a6af7b68f5d8269c97992130b3

SHA256
18e8b40ba22c7a1687bd16e8d585380bc2773fff5002d7d67e9485fcc0c51026

SHA512
06c38bbb07fb55256f3cdc24e77b3c8f3214f25bfd140b521a39d167113bf307a7e8d24e445d510bc5e4e41d33c9173bb14e3f2a38bc29a0e3d08c1f0dca4bdb

Download Submit
C:\Users\Admin\AppData\Local\Temp\nse19C0.tmp\System.dll

Filesize
12KB

MD5
cff85c549d536f651d4fb8387f1976f2

SHA1
d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e

SHA256
8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8

SHA512
531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88

Download Submit
C:\Users\Admin\AppData\Local\Temp\nse19C0.tmp\ioSpecial.ini

Filesize
1KB

MD5
a444e81862184adebf29d447c7c9440a

SHA1
f0a56b3b77bf07b0b3ff267928ca8c7b70d28188

SHA256
527b0e482f76e53c6fc013de1ca1f7e386fced3bd37e7585f3b8140ae96d8a96

SHA512
94a5cfb310a49f595adaa33ab04b0d4b25b21f274186dbac7f206e742ae40fc11e9ba6a5aabe0a30fc47d4683fc22291ad3b982cec2900d359c380973ab33ec3

Download Submit
C:\Users\Admin\AppData\Local\Temp\nse19C0.tmp\ioSpecial.ini

Filesize
1KB

MD5
1fbf7a11c07f058b9e8a09868574a758

SHA1
7e8e7d6bcb1365c4306872ba450da4711a8e8976

SHA256
2c465de82f962bbfb2b501a11f7a13804b052ddf44ec759a30e9684e3efca00c

SHA512
6cb7f370721174195b0c0c1700b85446b79b34679042aed84401764329fbb0f67d5929df4c1726e69dd8427e0aa6ab3f8b79906c9f323a0f72c8661bdec4f758

Download Submit
C:\Users\Admin\Documents\VideoCopilot\Models\Starter_Pack_Physical\maps\paint_can_diffuse.dds

Filesize
2.7MB

MD5
7831453a351d0b578bdd19d93055a5bc

SHA1
fe3cfb9d94cec592a4e2fdb55077d2b56a0e778d

SHA256
1b043f7d20eb449e98d3ce0aea04f5e921917410386fec00f918e51fb506076c

SHA512
9c656498ac9224d013036b2b434475b101cbfd158c364837f8b91934d6e0ff7b8d68ae9620a5f85cd9e4acc38c2b21fd6a722f633b9a9778a6ab5fe5ab1622a2

Download Submit
C:\Users\Admin\Documents\VideoCopilot\Models\Starter_Pack_Physical\maps\telephone_pole_normal.dds

Filesize
5.3MB

MD5
232124e535c852a11e14f31e98ce2cd2

SHA1
58f2d4a5d1a1d022b7f6451b900cd497576001b7

SHA256
d3f114729a0de26c1c334e5439c8dffbe386b4160df1012644210311dea3a594

SHA512
ec3ad6d3d4573a34bb8748b57a64302bbfa41723a5a5fca472793b7b7aabba50d650cfd5179ba7d65b0bc20d9633d6fe5288254d399829917de15bd47756a864

Download Submit
C:\Users\Admin\Documents\VideoCopilot\Models\Starter_Pack_Physical\maps\truck_tire_diffuse.dds

Filesize
10.7MB

MD5
d02511db630092111895ffe844a60700

SHA1
16e178ac00a20e2a5479d58de67514b17bfadd93

SHA256
5afc14c3bfa3b95e43988a22dc4f5234a3dc308bbc138a035be70ee04ff48e8e

SHA512
75fa9953f315c591817bc69a12c5d649143786af94ea44957f3e188537a7310013e5f279601ecbc4cd04e22556bf7988ae54bb332fff80828c3ddeeab0087b78

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 894721.crdownload

Filesize
1.7MB

MD5
f81112d40609b97330688098222ef1fb

SHA1
092f5b3f4f7b437923e4cbaf2dd12a6d793a32b0

SHA256
bbf249ab7d4ea4b17a56d2effcd0df563bf4d5cd4f6e00ebf5e74a74ca0034e2

SHA512
86d6cc9d402764557c9011cd79f9d9feb3c57a3ec7717156a0dbb1a107f89bc33d7a4f61d7356c0fed8576ab1d44674e25772566b82e0ef219cf69011ebf872c

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 959110.crdownload

Filesize
144KB

MD5
dde6bb2db062927a91e617e382d2c03e

SHA1
f1c2211697549f8552a1c003170c15aefcd01303

SHA256
87398d38e1294be296e724f6744fd6e151a696eeaae05875897870dadf9076c3

SHA512
1dd3551316fbddbc2722bc46b3d144a33863f416df3085b6ae7633d47a892f69913ca154eff1784b8b9a77df949e088de3a3d1ef6f2fd58fa76e91f705b38f73

Download Submit