2d79af8e1ff3465703e1dc73d3ef2182fd269ea2609c8afabdf1b80693405c1d

Analysis

max time kernel
205s
max time network
205s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
14/11/2024, 00:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

HorionInjector.exe
Size

147KB
MD5

6b5b6e625de774e5c285712b7c4a0da7
SHA1

317099aef530afbe3a0c5d6a2743d51e04805267
SHA256

2d79af8e1ff3465703e1dc73d3ef2182fd269ea2609c8afabdf1b80693405c1d
SHA512

104609adf666588af4e152ec7891cedafd89ad8d427063d03fb42a228babefc59428b0c8b1430cb3fc319a5014d2ee1083ff2b74fa585cab2d86cdad346e8b08
SSDEEP

3072:ckgHqUGSCoEslON/q178+oO3BAE4T/DvueX:cNHqUGSCPBh+7VST/Ke

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2360	VC_redist.x64.exe
3048	VC_redist.x64.exe

Loads dropped DLL 2 IoCs

pid	Process
2360	VC_redist.x64.exe
3048	VC_redist.x64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe

Modifies registry class 23 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	BackgroundTransferHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	BackgroundTransferHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\MuiCache	BackgroundTransferHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	BackgroundTransferHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\trojan-1.16.0-win.zip:Zone.Identifier	msedge.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2888	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4836	HorionInjector.exe
4836	HorionInjector.exe
4836	HorionInjector.exe
4836	HorionInjector.exe
4836	HorionInjector.exe
4836	HorionInjector.exe
4836	HorionInjector.exe
4836	HorionInjector.exe
4836	HorionInjector.exe
4836	HorionInjector.exe
4836	HorionInjector.exe
4836	HorionInjector.exe
4836	HorionInjector.exe
4836	HorionInjector.exe
4836	HorionInjector.exe
4836	HorionInjector.exe
4836	HorionInjector.exe
4836	HorionInjector.exe
4836	HorionInjector.exe
4836	HorionInjector.exe
4836	HorionInjector.exe
4836	HorionInjector.exe
4836	HorionInjector.exe
4836	HorionInjector.exe
4836	HorionInjector.exe
4836	HorionInjector.exe
4836	HorionInjector.exe
4836	HorionInjector.exe
4836	HorionInjector.exe
4836	HorionInjector.exe
4836	HorionInjector.exe
4836	HorionInjector.exe
4836	HorionInjector.exe
4836	HorionInjector.exe
4836	HorionInjector.exe
4836	HorionInjector.exe
4836	HorionInjector.exe
4836	HorionInjector.exe
4836	HorionInjector.exe
4836	HorionInjector.exe
4836	HorionInjector.exe
4836	HorionInjector.exe
4836	HorionInjector.exe
4836	HorionInjector.exe
4836	HorionInjector.exe
4836	HorionInjector.exe
4836	HorionInjector.exe
4836	HorionInjector.exe
4836	HorionInjector.exe
4836	HorionInjector.exe
4836	HorionInjector.exe
4836	HorionInjector.exe
4836	HorionInjector.exe
4836	HorionInjector.exe
4836	HorionInjector.exe
4836	HorionInjector.exe
4836	HorionInjector.exe
4836	HorionInjector.exe
4836	HorionInjector.exe
4836	HorionInjector.exe
4836	HorionInjector.exe
4836	HorionInjector.exe
4836	HorionInjector.exe
4836	HorionInjector.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4836	HorionInjector.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2888	explorer.exe
2888	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4836 wrote to memory of 3648	4836	HorionInjector.exe	80
PID 4836 wrote to memory of 3648	4836	HorionInjector.exe	80
PID 388 wrote to memory of 876	388	msedge.exe	89
PID 388 wrote to memory of 876	388	msedge.exe	89
PID 388 wrote to memory of 3432	388	msedge.exe	90
PID 388 wrote to memory of 3432	388	msedge.exe	90
PID 388 wrote to memory of 3432	388	msedge.exe	90
PID 388 wrote to memory of 3432	388	msedge.exe	90
PID 388 wrote to memory of 3432	388	msedge.exe	90
PID 388 wrote to memory of 3432	388	msedge.exe	90
PID 388 wrote to memory of 3432	388	msedge.exe	90
PID 388 wrote to memory of 3432	388	msedge.exe	90
PID 388 wrote to memory of 3432	388	msedge.exe	90
PID 388 wrote to memory of 3432	388	msedge.exe	90
PID 388 wrote to memory of 3432	388	msedge.exe	90
PID 388 wrote to memory of 3432	388	msedge.exe	90
PID 388 wrote to memory of 3432	388	msedge.exe	90
PID 388 wrote to memory of 3432	388	msedge.exe	90
PID 388 wrote to memory of 3432	388	msedge.exe	90
PID 388 wrote to memory of 3432	388	msedge.exe	90
PID 388 wrote to memory of 3432	388	msedge.exe	90
PID 388 wrote to memory of 3432	388	msedge.exe	90
PID 388 wrote to memory of 3432	388	msedge.exe	90
PID 388 wrote to memory of 3432	388	msedge.exe	90
PID 388 wrote to memory of 3432	388	msedge.exe	90
PID 388 wrote to memory of 3432	388	msedge.exe	90
PID 388 wrote to memory of 3432	388	msedge.exe	90
PID 388 wrote to memory of 3432	388	msedge.exe	90
PID 388 wrote to memory of 3432	388	msedge.exe	90
PID 388 wrote to memory of 3432	388	msedge.exe	90
PID 388 wrote to memory of 3432	388	msedge.exe	90
PID 388 wrote to memory of 3432	388	msedge.exe	90
PID 388 wrote to memory of 3432	388	msedge.exe	90
PID 388 wrote to memory of 3432	388	msedge.exe	90
PID 388 wrote to memory of 3432	388	msedge.exe	90
PID 388 wrote to memory of 3432	388	msedge.exe	90
PID 388 wrote to memory of 3432	388	msedge.exe	90
PID 388 wrote to memory of 3432	388	msedge.exe	90
PID 388 wrote to memory of 3432	388	msedge.exe	90
PID 388 wrote to memory of 3432	388	msedge.exe	90
PID 388 wrote to memory of 3432	388	msedge.exe	90
PID 388 wrote to memory of 3432	388	msedge.exe	90
PID 388 wrote to memory of 3432	388	msedge.exe	90
PID 388 wrote to memory of 3432	388	msedge.exe	90
PID 388 wrote to memory of 3224	388	msedge.exe	91
PID 388 wrote to memory of 3224	388	msedge.exe	91
PID 388 wrote to memory of 4712	388	msedge.exe	92
PID 388 wrote to memory of 4712	388	msedge.exe	92
PID 388 wrote to memory of 4712	388	msedge.exe	92
PID 388 wrote to memory of 4712	388	msedge.exe	92
PID 388 wrote to memory of 4712	388	msedge.exe	92
PID 388 wrote to memory of 4712	388	msedge.exe	92
PID 388 wrote to memory of 4712	388	msedge.exe	92
PID 388 wrote to memory of 4712	388	msedge.exe	92
PID 388 wrote to memory of 4712	388	msedge.exe	92
PID 388 wrote to memory of 4712	388	msedge.exe	92
PID 388 wrote to memory of 4712	388	msedge.exe	92
PID 388 wrote to memory of 4712	388	msedge.exe	92
PID 388 wrote to memory of 4712	388	msedge.exe	92
PID 388 wrote to memory of 4712	388	msedge.exe	92
PID 388 wrote to memory of 4712	388	msedge.exe	92
PID 388 wrote to memory of 4712	388	msedge.exe	92
PID 388 wrote to memory of 4712	388	msedge.exe	92
PID 388 wrote to memory of 4712	388	msedge.exe	92

C:\Users\Admin\AppData\Local\Temp\HorionInjector.exe
"C:\Users\Admin\AppData\Local\Temp\HorionInjector.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4836
- C:\Windows\explorer.exe
  explorer.exe shell:appsFolder\Microsoft.MinecraftUWP_8wekyb3d8bbwe!App
  2⤵
  PID:3648

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2888

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\ApproveUse.xht
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffacf6e3cb8,0x7ffacf6e3cc8,0x7ffacf6e3cd8
  2⤵
  PID:876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1804,5628067646813632163,16817640112832369707,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1816 /prefetch:2
  2⤵
  PID:3432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1804,5628067646813632163,16817640112832369707,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2340 /prefetch:3
  2⤵
  PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1804,5628067646813632163,16817640112832369707,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2656 /prefetch:8
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,5628067646813632163,16817640112832369707,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:1532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,5628067646813632163,16817640112832369707,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1804,5628067646813632163,16817640112832369707,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4072 /prefetch:8
  2⤵
  PID:2216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,5628067646813632163,16817640112832369707,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4880 /prefetch:1
  2⤵
  PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,5628067646813632163,16817640112832369707,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4848 /prefetch:1
  2⤵
  PID:2976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,5628067646813632163,16817640112832369707,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3896 /prefetch:1
  2⤵
  PID:3656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,5628067646813632163,16817640112832369707,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5412 /prefetch:1
  2⤵
  PID:1208
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1804,5628067646813632163,16817640112832369707,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5792 /prefetch:8
  2⤵
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,5628067646813632163,16817640112832369707,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
  2⤵
  PID:3252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,5628067646813632163,16817640112832369707,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:1
  2⤵
  PID:72
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,5628067646813632163,16817640112832369707,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3884 /prefetch:1
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,5628067646813632163,16817640112832369707,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:1
  2⤵
  PID:2112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,5628067646813632163,16817640112832369707,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:1
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1804,5628067646813632163,16817640112832369707,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6024 /prefetch:1
  2⤵
  PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1804,5628067646813632163,16817640112832369707,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5064 /prefetch:8
  2⤵
  - NTFS ADS
  PID:2260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1804,5628067646813632163,16817640112832369707,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=3840 /prefetch:2
  2⤵
  PID:1960

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2096

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4768

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13
1⤵
- Modifies registry class
PID:1960

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4092

C:\Users\Admin\Downloads\trojan-1.16.0-win\trojan\trojan.exe
"C:\Users\Admin\Downloads\trojan-1.16.0-win\trojan\trojan.exe"
1⤵
PID:2900

C:\Users\Admin\Downloads\trojan-1.16.0-win\trojan\VC_redist.x64.exe
"C:\Users\Admin\Downloads\trojan-1.16.0-win\trojan\VC_redist.x64.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1068
- C:\Windows\Temp\{55214374-7787-40E9-A1BD-AB5487DEC890}\.cr\VC_redist.x64.exe
  "C:\Windows\Temp\{55214374-7787-40E9-A1BD-AB5487DEC890}\.cr\VC_redist.x64.exe" -burn.clean.room="C:\Users\Admin\Downloads\trojan-1.16.0-win\trojan\VC_redist.x64.exe" -burn.filehandle.attached=592 -burn.filehandle.self=712
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2360

C:\Users\Admin\Downloads\trojan-1.16.0-win\trojan\VC_redist.x64.exe
"C:\Users\Admin\Downloads\trojan-1.16.0-win\trojan\VC_redist.x64.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2876
- C:\Windows\Temp\{439481BA-AEC7-4FB1-A8AC-2FDF27E47D39}\.cr\VC_redist.x64.exe
  "C:\Windows\Temp\{439481BA-AEC7-4FB1-A8AC-2FDF27E47D39}\.cr\VC_redist.x64.exe" -burn.clean.room="C:\Users\Admin\Downloads\trojan-1.16.0-win\trojan\VC_redist.x64.exe" -burn.filehandle.attached=564 -burn.filehandle.self=684
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9314124f4f0ad9f845a0d7906fd8dfd8

SHA1
0d4f67fb1a11453551514f230941bdd7ef95693c

SHA256
cbd58fa358e4b1851c3da2d279023c29eba66fb4d438c6e87e7ce5169ffb910e

SHA512
87b9060ca4942974bd8f95b8998df7b2702a3f4aba88c53b2e3423a532a75407070368f813a5bbc0251864b4eae47e015274a839999514386d23c8a526d05d85

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e1544690d41d950f9c1358068301cfb5

SHA1
ae3ff81363fcbe33c419e49cabef61fb6837bffa

SHA256
53d69c9cc3c8aaf2c8b58ea6a2aa47c49c9ec11167dd9414cd9f4192f9978724

SHA512
1e4f1fe2877f4f947d33490e65898752488e48de34d61e197e4448127d6b1926888de80b62349d5a88b96140eed0a5b952ef4dd7ca318689f76e12630c9029da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
62KB

MD5
c3c0eb5e044497577bec91b5970f6d30

SHA1
d833f81cf21f68d43ba64a6c28892945adc317a6

SHA256
eb48be34490ec9c4f9402b882166cd82cd317b51b2a49aae75cdf9ee035035eb

SHA512
83d3545a4ed9eed2d25f98c4c9f100ae0ac5e4bc8828dccadee38553b7633bb63222132df8ec09d32eb37d960accb76e7aab5719fc08cc0a4ef07b053f30cf38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
19KB

MD5
76a3f1e9a452564e0f8dce6c0ee111e8

SHA1
11c3d925cbc1a52d53584fd8606f8f713aa59114

SHA256
381396157ed5e8021dd8e660142b35eb71a63aecd33062a1103ce9c709c7632c

SHA512
a1156a907649d6f2c3f7256405d9d5c62a626b8d4cd717fa2f29d2fbe91092a2b3fdd0716f8f31e59708fe12274bc2dea6c9ae6a413ea290e70ddf921fe7f274

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
67KB

MD5
fb2f02c107cee2b4f2286d528d23b94e

SHA1
d76d6b684b7cfbe340e61734a7c197cc672b1af3

SHA256
925dd883d5a2eb44cf1f75e8d71346b98f14c4412a0ea0c350672384a0e83e7a

SHA512
be51d371b79f4cc1f860706207d5978d18660bf1dc0ca6706d43ca0375843ec924aa4a8ed44867661a77e3ec85e278c559ab6f6946cba4f43daf3854b838bb82

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
63KB

MD5
710d7637cc7e21b62fd3efe6aba1fd27

SHA1
8645d6b137064c7b38e10c736724e17787db6cf3

SHA256
c0997474b99524325dfedb5c020436e7ea9f9c9a1a759ed6daf7bdd4890bdc2b

SHA512
19aa77bed3c441228789cf8f931ca6194cc8d4bc7bb85d892faf5eaeda67d22c8c3b066f8ceda8169177da95a1fe111bd3436ceeaf4c784bd2bf96617f4d0c44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
c3acd1dc55c4e42a4687f2d6f2a31535

SHA1
0af86a398d06573a2d68e6e58dd23fca768230f0

SHA256
f05a7281564c06c03be0a12fa2faf0205fb792bbadd279c12c7253031e807b15

SHA512
4d50a5c764a6360ca18f5abd94a0855a3e16a3861fc9fd8fe9d224ebdd01133dd195547da17b76639e638608f0cf2eefc77bc1dd3cb6d0c846ba0c3aef886f67

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
788B

MD5
ee91b1c7b58f2ffc99c0c08269f4e6f2

SHA1
70d0a377df7dd7d696508e37153b6e5af9d6ceb8

SHA256
df1d6bbcc4fa552da134d21a6e638a1096b6e3109fff356d2686d89d7edabdd9

SHA512
234de63480b24ac96e215ac1ca99a9a45fe8702f344082be8865383f907a29b53cc45cb330fd178568decf55f330d94289b4bc864d3369c2c3d5bef32996f32d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
84ca8940c55c70579cbdde6ae24d25b0

SHA1
ef874b77467dc6974d4691f35c0fa45ede5442e7

SHA256
f3e92d358a6d067a0a88a1efe270f5ba89f1852c68ee20e0db1fb4d884042486

SHA512
bf110648f117c32cf98e9ddcb3edfa57e34922b7ab2de3610928109a0be3d3aa7306df3b301fb8f7c32167774730c4c2452c407510cef226b667e80265c5008d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b3ad9d47a6b520f873018d351c868e32

SHA1
49a05650840cb9d0be49b07dcd4224b77fd0f0ba

SHA256
a2ecf30a1e29b18a2f2e9b85709b919c048580d7ed158b0a1d11797a891428e0

SHA512
fd762a053f868d41d2bfbd817ce4db6df3657d2e4dab62f1c04df9cbd268ed4bebbe4e17cff82d83511675e1785a9e25b416a81dc25bf3025ba4aa0d19f804ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a396af7d3239e8bc8514f69c7d7f110a

SHA1
fdc8e559588b75568c541b2ea08f697a900bd264

SHA256
1c8f862fa57b96a139fa0dba1029d9ff69a9ba8d997f9f2fe0b143019d11eff5

SHA512
b9ece70811f715e1f6ac222187296e7dd4f6dbf5ba6d49f2e70b3f662785195288d5c4e02e2053c9b1a88a6516d545c30e507446f6a913a462b87e83a05e2583

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f8ffa8912e0fd1f58205318fd71a08a9

SHA1
26b0505337f340e15dc757805122ec17f536627b

SHA256
38fe51c3323a6b6d8f68812f8af422f629aa04db2199f06eea50baf28427601c

SHA512
3eac969b77978c3cf0fbad72b86bb8d17491f05f62863b68924663c20e5f1897aaf5a5c77d78d311b73969cba742b6027cd960861ff8eba7b29fddeb28555ada

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
b62c61c7f4bd1c2868d03801e7725ccd

SHA1
bc6052c6b75ea9dfa47dbe5ad65330e4511b0a58

SHA256
9ac954ca3a1b80de072f979dd2a0924d3e135ad6800f8cb184e99b6330e77db9

SHA512
070655ad2a3033de873df8e9e96402c78031d70073e0bf83ba5f16a8ae5021c74f27f81ed40630b65438c95e07ec63de6b92f58a845a059daeb71baf9e462857

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
053d1a8cf1cc3c84a9d4c7bffe714392

SHA1
c47bf03a8aa335f646ea7b9048589baebfd69416

SHA256
93468c62ce6729c3ebf96d0682cd91eabe62c4b715cb478626f041379d81751a

SHA512
158212340e6216b5dfb1d9012ea9d787c4eb8222f21801a86660092eeb2dca4dc0898e1459827abc3928c7b4b92e60a3ce124bcf016bf818176d286dbff84d0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58a0ee.TMP

Filesize
536B

MD5
1920a0755d6cd84c1d3c888248c3e6f2

SHA1
47e1ceb0f1119ddbe9e1418ca17ed21224d21b33

SHA256
295e90f094c1e1e68b63087714b6ad53044fd1931b36fc7e98cd06e5bb557288

SHA512
e1e594f5a457d55c4c2a1367b6025bab4e1af5a19167b3a15864ef4909c2fe1904005b1d5f9895da03cf0dcefaa05d92138142d4e873734f805f87e536358051

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
fdca0e2a8df1611981b2f1783e1d4d2e

SHA1
0a306b112a3fabeee44e89851de87dfcd556f0a4

SHA256
460e62740c20f2a6a845a84aad87cc204eb6e1fe396f8d003f5578f9d1be7f85

SHA512
f2019373811f61765c719200447571294190e78c393be885e20b7fdbe33c3a61e2caaf5ea5ebaf80bfb4ca93bc073cb62bd65fc89a1452cc5e02fc04f87237c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
61dd182cefbc1ed0773c1265f553c316

SHA1
3a7f71413605ecddc5ff5e85b03da14fcc194dae

SHA256
0baa514f93aad4d3d9350c25a37a832a19679267241112e322284a5d2891d215

SHA512
02d70c7fb6769cfcc217f0257751d449ea3950095dead9e2b0b15f60582524fa9629fb3745bf9553af1ac10a685732310edd54d4fa61bfb1cd0897186749ee5e

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\BackgroundTransferApi\30d9f5d7-8cd1-4c37-9afe-95803dc46a49.down_data

Filesize
555KB

MD5
5683c0028832cae4ef93ca39c8ac5029

SHA1
248755e4e1db552e0b6f8651b04ca6d1b31a86fb

SHA256
855abd360d8a8d6974eba92b70cbd09ce519bc8773439993f9ab37cb6847309e

SHA512
aba434bd29be191c823b02ea9b639beb10647bbe7759bbffdaa790dfb1ec2c58d74c525ef11aacda209e4effe322d1d3a07b115446c8914b07a3bce4d8a0e2c3

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 296879.crdownload

Filesize
15.5MB

MD5
eaaf097adb8b1b67af0286ef86aba1f3

SHA1
4c5ef20dad4fd5e8e2f471a6593474c0fa6cbd33

SHA256
0e6107a73e113b30893d66844ed8d619a125c5f5e54c559727e87a33f1add423

SHA512
1760ef0dd64bd318422ad4af901c9918cb7910bc96e9d7d9d2a1b420ff148a3381714f4275a095d2eb4891ab741991f1a7dbd0e1af19bc756a80e00a3c6fdc9c

Download Submit
C:\Users\Admin\Downloads\trojan-1.16.0-win.zip:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Windows\Temp\{55214374-7787-40E9-A1BD-AB5487DEC890}\.cr\VC_redist.x64.exe

Filesize
632KB

MD5
562711caf0d942d286fd28d34ebf9fdf

SHA1
001b037c732b497e390bd756901e64ce0d84d885

SHA256
3556010aa72b67d16dc6b406aecf493185c92f38ad410924959175fd39192b61

SHA512
447ea79c0fe30b5458d139d903bf738126c8159250a5b732ca9afdb7536be3ef5c81857852034fbdf385d9bbc43e1c77dc9618f7ad0b60ff3d9c526711c30060

Download Submit
C:\Windows\Temp\{E2753C84-3133-486C-8233-9B692DE66960}\.ba\logo.png

Filesize
1KB

MD5
d6bd210f227442b3362493d046cea233

SHA1
ff286ac8370fc655aea0ef35e9cf0bfcb6d698de

SHA256
335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef

SHA512
464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b

Download Submit
C:\Windows\Temp\{E2753C84-3133-486C-8233-9B692DE66960}\.ba\wixstdba.dll

Filesize
191KB

MD5
eab9caf4277829abdf6223ec1efa0edd

SHA1
74862ecf349a9bedd32699f2a7a4e00b4727543d

SHA256
a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041

SHA512
45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2

Download Submit
memory/4836-8-0x0000025D4BC90000-0x0000025D4BC9E000-memory.dmp

Filesize
56KB

Download
memory/4836-1-0x0000025D31380000-0x0000025D313A8000-memory.dmp

Filesize
160KB

Download
memory/4836-6-0x0000025D4BC80000-0x0000025D4BC88000-memory.dmp

Filesize
32KB

Download
memory/4836-5-0x00007FFABD6D0000-0x00007FFABE192000-memory.dmp

Filesize
10.8MB

Download
memory/4836-4-0x00007FFABD6D0000-0x00007FFABE192000-memory.dmp

Filesize
10.8MB

Download
memory/4836-3-0x00007FFABD6D0000-0x00007FFABE192000-memory.dmp

Filesize
10.8MB

Download
memory/4836-2-0x0000025D4BCA0000-0x0000025D4BD5A000-memory.dmp

Filesize
744KB

Download
memory/4836-7-0x0000025D4FC50000-0x0000025D4FC88000-memory.dmp

Filesize
224KB

Download
memory/4836-9-0x00007FFABD6D0000-0x00007FFABE192000-memory.dmp

Filesize
10.8MB

Download
memory/4836-14-0x00007FFABD6D3000-0x00007FFABD6D5000-memory.dmp

Filesize
8KB

Download
memory/4836-15-0x00007FFABD6D0000-0x00007FFABE192000-memory.dmp

Filesize
10.8MB

Download
memory/4836-16-0x00007FFABD6D0000-0x00007FFABE192000-memory.dmp

Filesize
10.8MB

Download
memory/4836-0-0x00007FFABD6D3000-0x00007FFABD6D5000-memory.dmp

Filesize
8KB

Download
memory/4836-17-0x00007FFABD6D0000-0x00007FFABE192000-memory.dmp

Filesize
10.8MB

Download