e1b3ae8fc890c6588e5656f77ef2747ae7ddfc90b6530b240c0c5b9d0ab3ce8c

Analysis

max time kernel
654s
max time network
661s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
18-11-2024 19:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dolphin-x64-5.0.exe
Size

18.4MB
MD5

eca48982effad82616f206f52336fe4b
SHA1

4d88af3572de650b0b7dccd92dc8de5854edfae6
SHA256

e1b3ae8fc890c6588e5656f77ef2747ae7ddfc90b6530b240c0c5b9d0ab3ce8c
SHA512

778755b2d12c703a2954882a4d333b7cb61ee7ed0482b5cb14c1cbc4b90c8b65f308944a2f9369a89fc54d163c613efc65adf70316c08d447183f65637fcb557
SSDEEP

393216:Y1qyjt4rPX8zs3XxdbHNemtqa7JhnurHTl0WcS4ENyQ4p9Jmm+:Y1qyZePX8khdbtecqa7JhnurHirhENys

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 5 IoCs

pid	Process
4776	DXSETUP.exe
4936	infinst.exe
3548	vc_redist.x64.exe
3204	vc_redist.x64.exe
6068	Dolphin.exe

Loads dropped DLL 64 IoCs

pid	Process
1976	dolphin-x64-5.0.exe
4776	DXSETUP.exe
4776	DXSETUP.exe
4776	DXSETUP.exe
4776	DXSETUP.exe
3204	vc_redist.x64.exe
1976	dolphin-x64-5.0.exe
1976	dolphin-x64-5.0.exe
1976	dolphin-x64-5.0.exe
1976	dolphin-x64-5.0.exe
1976	dolphin-x64-5.0.exe
1976	dolphin-x64-5.0.exe
1976	dolphin-x64-5.0.exe
1976	dolphin-x64-5.0.exe
1976	dolphin-x64-5.0.exe
1976	dolphin-x64-5.0.exe
1976	dolphin-x64-5.0.exe
1976	dolphin-x64-5.0.exe
1976	dolphin-x64-5.0.exe
1976	dolphin-x64-5.0.exe
1976	dolphin-x64-5.0.exe
1976	dolphin-x64-5.0.exe
1976	dolphin-x64-5.0.exe
1976	dolphin-x64-5.0.exe
1976	dolphin-x64-5.0.exe
1976	dolphin-x64-5.0.exe
1976	dolphin-x64-5.0.exe
1976	dolphin-x64-5.0.exe
1976	dolphin-x64-5.0.exe
1976	dolphin-x64-5.0.exe
1976	dolphin-x64-5.0.exe
1976	dolphin-x64-5.0.exe
1976	dolphin-x64-5.0.exe
1976	dolphin-x64-5.0.exe
1976	dolphin-x64-5.0.exe
1976	dolphin-x64-5.0.exe
1976	dolphin-x64-5.0.exe
1976	dolphin-x64-5.0.exe
1976	dolphin-x64-5.0.exe
1976	dolphin-x64-5.0.exe
1976	dolphin-x64-5.0.exe
1976	dolphin-x64-5.0.exe
1976	dolphin-x64-5.0.exe
1976	dolphin-x64-5.0.exe
1976	dolphin-x64-5.0.exe
1976	dolphin-x64-5.0.exe
1976	dolphin-x64-5.0.exe
1976	dolphin-x64-5.0.exe
1976	dolphin-x64-5.0.exe
1976	dolphin-x64-5.0.exe
1976	dolphin-x64-5.0.exe
1976	dolphin-x64-5.0.exe
1976	dolphin-x64-5.0.exe
1976	dolphin-x64-5.0.exe
1976	dolphin-x64-5.0.exe
1976	dolphin-x64-5.0.exe
1976	dolphin-x64-5.0.exe
1976	dolphin-x64-5.0.exe
1976	dolphin-x64-5.0.exe
1976	dolphin-x64-5.0.exe
1976	dolphin-x64-5.0.exe
1976	dolphin-x64-5.0.exe
1976	dolphin-x64-5.0.exe
1976	dolphin-x64-5.0.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Videos\Captures\desktop.ini	svchost.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\system32\SET6210.tmp	infinst.exe
File opened for modification	C:\Windows\SysWOW64\SET61A3.tmp	DXSETUP.exe
File created	C:\Windows\SysWOW64\SET61A3.tmp	DXSETUP.exe
File opened for modification	C:\Windows\SysWOW64\xinput1_3.dll	DXSETUP.exe
File opened for modification	C:\Windows\system32\xinput1_3.dll	infinst.exe
File opened for modification	C:\Windows\system32\SET6210.tmp	infinst.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Dolphin\Sys\GameSettings\EBC.ini	dolphin-x64-5.0.exe
File created	C:\Program Files\Dolphin\Sys\GameSettings\FAAE01.ini	dolphin-x64-5.0.exe
File created	C:\Program Files\Dolphin\Sys\GameSettings\GN4.ini	dolphin-x64-5.0.exe
File created	C:\Program Files\Dolphin\Sys\GameSettings\HAA.ini	dolphin-x64-5.0.exe
File created	C:\Program Files\Dolphin\Sys\GameSettings\RNE.ini	dolphin-x64-5.0.exe
File created	C:\Program Files\Dolphin\Sys\Shaders\sketchy.glsl	dolphin-x64-5.0.exe
File created	C:\Program Files\Dolphin\Sys\GameSettings\EAP.ini	dolphin-x64-5.0.exe
File created	C:\Program Files\Dolphin\Sys\GameSettings\GRU.ini	dolphin-x64-5.0.exe
File created	C:\Program Files\Dolphin\Sys\GameSettings\GZLE01.ini	dolphin-x64-5.0.exe
File created	C:\Program Files\Dolphin\Sys\GameSettings\RON.ini	dolphin-x64-5.0.exe
File created	C:\Program Files\Dolphin\Sys\GameSettings\SVZ.ini	dolphin-x64-5.0.exe
File created	C:\Program Files\Dolphin\Sys\Resources\[email protected]	dolphin-x64-5.0.exe
File created	C:\Program Files\Dolphin\Sys\Shaders\grayscale.glsl	dolphin-x64-5.0.exe
File created	C:\Program Files\Dolphin\Sys\GameSettings\GH2.ini	dolphin-x64-5.0.exe
File created	C:\Program Files\Dolphin\Sys\GameSettings\GHC.ini	dolphin-x64-5.0.exe
File created	C:\Program Files\Dolphin\Sys\GameSettings\GWK.ini	dolphin-x64-5.0.exe
File created	C:\Program Files\Dolphin\Sys\GameSettings\GXL.ini	dolphin-x64-5.0.exe
File created	C:\Program Files\Dolphin\Sys\GameSettings\R2U.ini	dolphin-x64-5.0.exe
File created	C:\Program Files\Dolphin\Sys\GameSettings\RYX.ini	dolphin-x64-5.0.exe
File created	C:\Program Files\Dolphin\Sys\GameSettings\RZP.ini	dolphin-x64-5.0.exe
File created	C:\Program Files\Dolphin\Sys\Themes\Clean Pink\gcpad.png	dolphin-x64-5.0.exe
File created	C:\Program Files\Dolphin\Sys\GameSettings\GGA.ini	dolphin-x64-5.0.exe
File created	C:\Program Files\Dolphin\Sys\GameSettings\GQN.ini	dolphin-x64-5.0.exe
File created	C:\Program Files\Dolphin\Sys\GameSettings\GWB.ini	dolphin-x64-5.0.exe
File created	C:\Program Files\Dolphin\Sys\GameSettings\RJC.ini	dolphin-x64-5.0.exe
File created	C:\Program Files\Dolphin\Sys\GameSettings\W3G.ini	dolphin-x64-5.0.exe
File created	C:\Program Files\Dolphin\Sys\GameSettings\WGO.ini	dolphin-x64-5.0.exe
File created	C:\Program Files\Dolphin\Sys\GameSettings\GLMP01.ini	dolphin-x64-5.0.exe
File created	C:\Program Files\Dolphin\Sys\GameSettings\E55.ini	dolphin-x64-5.0.exe
File created	C:\Program Files\Dolphin\Sys\GameSettings\GLM.ini	dolphin-x64-5.0.exe
File created	C:\Program Files\Dolphin\Sys\GameSettings\R2T.ini	dolphin-x64-5.0.exe
File created	C:\Program Files\Dolphin\Sys\GameSettings\WPY.ini	dolphin-x64-5.0.exe
File created	C:\Program Files\Dolphin\Languages\ro_RO\dolphin-emu.mo	dolphin-x64-5.0.exe
File created	C:\Program Files\Dolphin\Sys\GameSettings\GKB.ini	dolphin-x64-5.0.exe
File created	C:\Program Files\Dolphin\Sys\GameSettings\RMHJ08.ini	dolphin-x64-5.0.exe
File created	C:\Program Files\Dolphin\Sys\GameSettings\RWU.ini	dolphin-x64-5.0.exe
File created	C:\Program Files\Dolphin\Sys\Themes\Clean Pink\[email protected]	dolphin-x64-5.0.exe
File created	C:\Program Files\Dolphin\Sys\GameSettings\GAZ.ini	dolphin-x64-5.0.exe
File created	C:\Program Files\Dolphin\Sys\GameSettings\GJCE8P.ini	dolphin-x64-5.0.exe
File created	C:\Program Files\Dolphin\Sys\GameSettings\GJX.ini	dolphin-x64-5.0.exe
File created	C:\Program Files\Dolphin\Sys\GameSettings\RGV.ini	dolphin-x64-5.0.exe
File created	C:\Program Files\Dolphin\Sys\GameSettings\RRY.ini	dolphin-x64-5.0.exe
File created	C:\Program Files\Dolphin\Sys\Resources\[email protected]	dolphin-x64-5.0.exe
File created	C:\Program Files\Dolphin\Sys\GameSettings\GIP.ini	dolphin-x64-5.0.exe
File created	C:\Program Files\Dolphin\Sys\GameSettings\GO7.ini	dolphin-x64-5.0.exe
File created	C:\Program Files\Dolphin\Sys\GameSettings\W3M.ini	dolphin-x64-5.0.exe
File created	C:\Program Files\Dolphin\Sys\Themes\Clean Pink\refresh.png	dolphin-x64-5.0.exe
File created	C:\Program Files\Dolphin\Sys\GameSettings\FAOE01.ini	dolphin-x64-5.0.exe
File created	C:\Program Files\Dolphin\Sys\GameSettings\GFF.ini	dolphin-x64-5.0.exe
File created	C:\Program Files\Dolphin\Sys\GameSettings\GJW.ini	dolphin-x64-5.0.exe
File created	C:\Program Files\Dolphin\Sys\GameSettings\GKU.ini	dolphin-x64-5.0.exe
File created	C:\Program Files\Dolphin\Sys\GameSettings\GOP.ini	dolphin-x64-5.0.exe
File created	C:\Program Files\Dolphin\Sys\GameSettings\GPIE01.ini	dolphin-x64-5.0.exe
File created	C:\Program Files\Dolphin\Sys\GameSettings\GWS.ini	dolphin-x64-5.0.exe
File created	C:\Program Files\Dolphin\Sys\GameSettings\R7E.ini	dolphin-x64-5.0.exe
File created	C:\Program Files\Dolphin\Sys\GameSettings\GCP.ini	dolphin-x64-5.0.exe
File created	C:\Program Files\Dolphin\Sys\Themes\Clean\[email protected]	dolphin-x64-5.0.exe
File created	C:\Program Files\Dolphin\Sys\GameSettings\RVZ.ini	dolphin-x64-5.0.exe
File created	C:\Program Files\Dolphin\Sys\GameSettings\G8F.ini	dolphin-x64-5.0.exe
File created	C:\Program Files\Dolphin\Sys\GameSettings\GST.ini	dolphin-x64-5.0.exe
File created	C:\Program Files\Dolphin\Sys\GameSettings\RT3.ini	dolphin-x64-5.0.exe
File created	C:\Program Files\Dolphin\Sys\GameSettings\WTU.ini	dolphin-x64-5.0.exe
File created	C:\Program Files\Dolphin\Sys\GC\font_sjis.bin	dolphin-x64-5.0.exe
File created	C:\Program Files\Dolphin\Sys\GameSettings\GCD.ini	dolphin-x64-5.0.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\DirectX.log	DXSETUP.exe
File opened for modification	C:\Windows\DirectX.log	infinst.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dolphin-x64-5.0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DXSETUP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vc_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vc_redist.x64.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000007daebf27fdc62d460000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800007daebf270000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809007daebf27000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d7daebf27000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000007daebf2700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3973800497-2716210218-310192997-1000\{113961D6-67B9-4352-AF19-201D417DA49F}	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	BackgroundTransferHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	BackgroundTransferHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	BackgroundTransferHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\Local Settings\MuiCache	BackgroundTransferHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3973800497-2716210218-310192997-1000\{317397D3-2057-4B85-A5F8-3D783537B15A}	svchost.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\MEMZ.4.0.Clean.zip:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1520	msedge.exe
1520	msedge.exe
244	msedge.exe
244	msedge.exe
5340	msedge.exe
5340	msedge.exe
6532	identity_helper.exe
6532	identity_helper.exe
2404	msedge.exe
2404	msedge.exe
5980	msedge.exe
5980	msedge.exe
5980	msedge.exe
5980	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
244	msedge.exe
244	msedge.exe
244	msedge.exe
244	msedge.exe
244	msedge.exe
244	msedge.exe
244	msedge.exe
244	msedge.exe
244	msedge.exe
244	msedge.exe
244	msedge.exe
244	msedge.exe
244	msedge.exe
244	msedge.exe
244	msedge.exe
244	msedge.exe
244	msedge.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeBackupPrivilege	4392	vssvc.exe
Token: SeRestorePrivilege	4392	vssvc.exe
Token: SeAuditPrivilege	4392	vssvc.exe
Token: SeBackupPrivilege	1844	srtasks.exe
Token: SeRestorePrivilege	1844	srtasks.exe
Token: SeSecurityPrivilege	1844	srtasks.exe
Token: SeTakeOwnershipPrivilege	1844	srtasks.exe
Token: SeBackupPrivilege	1844	srtasks.exe
Token: SeRestorePrivilege	1844	srtasks.exe
Token: SeSecurityPrivilege	1844	srtasks.exe
Token: SeTakeOwnershipPrivilege	1844	srtasks.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
244	msedge.exe
244	msedge.exe
244	msedge.exe
244	msedge.exe
244	msedge.exe
244	msedge.exe
244	msedge.exe
244	msedge.exe
244	msedge.exe
244	msedge.exe
244	msedge.exe
244	msedge.exe
244	msedge.exe
244	msedge.exe
244	msedge.exe
244	msedge.exe
244	msedge.exe
244	msedge.exe
244	msedge.exe
244	msedge.exe
244	msedge.exe
244	msedge.exe
244	msedge.exe
244	msedge.exe
244	msedge.exe
244	msedge.exe
244	msedge.exe
244	msedge.exe
244	msedge.exe
244	msedge.exe
244	msedge.exe
244	msedge.exe
244	msedge.exe
244	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
244	msedge.exe
244	msedge.exe
244	msedge.exe
244	msedge.exe
244	msedge.exe
244	msedge.exe
244	msedge.exe
244	msedge.exe
244	msedge.exe
244	msedge.exe
244	msedge.exe
244	msedge.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
6068	Dolphin.exe
6068	Dolphin.exe
6068	Dolphin.exe
6068	Dolphin.exe
4812	OpenWith.exe
1792	MiniSearchHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 4776	1976	dolphin-x64-5.0.exe	81
PID 1976 wrote to memory of 4776	1976	dolphin-x64-5.0.exe	81
PID 1976 wrote to memory of 4776	1976	dolphin-x64-5.0.exe	81
PID 4776 wrote to memory of 4936	4776	DXSETUP.exe	88
PID 4776 wrote to memory of 4936	4776	DXSETUP.exe	88
PID 1976 wrote to memory of 3548	1976	dolphin-x64-5.0.exe	89
PID 1976 wrote to memory of 3548	1976	dolphin-x64-5.0.exe	89
PID 1976 wrote to memory of 3548	1976	dolphin-x64-5.0.exe	89
PID 3548 wrote to memory of 3204	3548	vc_redist.x64.exe	90
PID 3548 wrote to memory of 3204	3548	vc_redist.x64.exe	90
PID 3548 wrote to memory of 3204	3548	vc_redist.x64.exe	90
PID 244 wrote to memory of 6396	244	msedge.exe	100
PID 244 wrote to memory of 6396	244	msedge.exe	100
PID 244 wrote to memory of 2132	244	msedge.exe	101
PID 244 wrote to memory of 2132	244	msedge.exe	101
PID 244 wrote to memory of 2132	244	msedge.exe	101
PID 244 wrote to memory of 2132	244	msedge.exe	101
PID 244 wrote to memory of 2132	244	msedge.exe	101
PID 244 wrote to memory of 2132	244	msedge.exe	101
PID 244 wrote to memory of 2132	244	msedge.exe	101
PID 244 wrote to memory of 2132	244	msedge.exe	101
PID 244 wrote to memory of 2132	244	msedge.exe	101
PID 244 wrote to memory of 2132	244	msedge.exe	101
PID 244 wrote to memory of 2132	244	msedge.exe	101
PID 244 wrote to memory of 2132	244	msedge.exe	101
PID 244 wrote to memory of 2132	244	msedge.exe	101
PID 244 wrote to memory of 2132	244	msedge.exe	101
PID 244 wrote to memory of 2132	244	msedge.exe	101
PID 244 wrote to memory of 2132	244	msedge.exe	101
PID 244 wrote to memory of 2132	244	msedge.exe	101
PID 244 wrote to memory of 2132	244	msedge.exe	101
PID 244 wrote to memory of 2132	244	msedge.exe	101
PID 244 wrote to memory of 2132	244	msedge.exe	101
PID 244 wrote to memory of 2132	244	msedge.exe	101
PID 244 wrote to memory of 2132	244	msedge.exe	101
PID 244 wrote to memory of 2132	244	msedge.exe	101
PID 244 wrote to memory of 2132	244	msedge.exe	101
PID 244 wrote to memory of 2132	244	msedge.exe	101
PID 244 wrote to memory of 2132	244	msedge.exe	101
PID 244 wrote to memory of 2132	244	msedge.exe	101
PID 244 wrote to memory of 2132	244	msedge.exe	101
PID 244 wrote to memory of 2132	244	msedge.exe	101
PID 244 wrote to memory of 2132	244	msedge.exe	101
PID 244 wrote to memory of 2132	244	msedge.exe	101
PID 244 wrote to memory of 2132	244	msedge.exe	101
PID 244 wrote to memory of 2132	244	msedge.exe	101
PID 244 wrote to memory of 2132	244	msedge.exe	101
PID 244 wrote to memory of 2132	244	msedge.exe	101
PID 244 wrote to memory of 2132	244	msedge.exe	101
PID 244 wrote to memory of 2132	244	msedge.exe	101
PID 244 wrote to memory of 2132	244	msedge.exe	101
PID 244 wrote to memory of 2132	244	msedge.exe	101
PID 244 wrote to memory of 2132	244	msedge.exe	101
PID 244 wrote to memory of 1520	244	msedge.exe	102
PID 244 wrote to memory of 1520	244	msedge.exe	102
PID 244 wrote to memory of 4748	244	msedge.exe	104
PID 244 wrote to memory of 4748	244	msedge.exe	104
PID 244 wrote to memory of 4748	244	msedge.exe	104
PID 244 wrote to memory of 4748	244	msedge.exe	104
PID 244 wrote to memory of 4748	244	msedge.exe	104
PID 244 wrote to memory of 4748	244	msedge.exe	104
PID 244 wrote to memory of 4748	244	msedge.exe	104
PID 244 wrote to memory of 4748	244	msedge.exe	104
PID 244 wrote to memory of 4748	244	msedge.exe	104

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\dolphin-x64-5.0.exe
"C:\Users\Admin\AppData\Local\Temp\dolphin-x64-5.0.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Users\Admin\AppData\Local\Temp\dxredist\DXSETUP.exe
  "C:\Users\Admin\AppData\Local\Temp\dxredist\DXSETUP.exe" /silent
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4776
- - C:\Users\Admin\AppData\Local\Temp\DX5EF4.tmp\infinst.exe
    C:\Users\Admin\AppData\Local\Temp\DX5EF4.tmp\infinst.exe xinput1_3_x64.inf, Install_Driver
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    PID:4936
- C:\Users\Admin\AppData\Local\Temp\vcredist\vc_redist.x64.exe
  "C:\Users\Admin\AppData\Local\Temp\vcredist\vc_redist.x64.exe" /install /quiet /norestart
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3548
- - C:\Users\Admin\AppData\Local\Temp\vcredist\vc_redist.x64.exe
    "C:\Users\Admin\AppData\Local\Temp\vcredist\vc_redist.x64.exe" /install /quiet /norestart -burn.unelevated BurnPipe.{E6143073-4A49-45B0-B4F5-E8C7285D0C90} {18A9DC32-15C3-4129-A4C2-8372102026FA} 3548
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:3204

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4392

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1844

C:\Program Files\Dolphin\Dolphin.exe
"C:\Program Files\Dolphin\Dolphin.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:6068

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4812

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
PID:4124

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Checks processor information in registry
- Modifies registry class
PID:1408

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff19163cb8,0x7fff19163cc8,0x7fff19163cd8
  2⤵
  PID:6396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1912,2476814963230389476,13799105309620360208,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1940 /prefetch:2
  2⤵
  PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1912,2476814963230389476,13799105309620360208,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1912,2476814963230389476,13799105309620360208,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2528 /prefetch:8
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2476814963230389476,13799105309620360208,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2476814963230389476,13799105309620360208,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:2588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2476814963230389476,13799105309620360208,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4904 /prefetch:1
  2⤵
  PID:5348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2476814963230389476,13799105309620360208,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4936 /prefetch:1
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1912,2476814963230389476,13799105309620360208,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5232 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2476814963230389476,13799105309620360208,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4700 /prefetch:1
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2476814963230389476,13799105309620360208,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4744 /prefetch:1
  2⤵
  PID:5304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2476814963230389476,13799105309620360208,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3996 /prefetch:1
  2⤵
  PID:6232
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1912,2476814963230389476,13799105309620360208,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5428 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2476814963230389476,13799105309620360208,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4604 /prefetch:1
  2⤵
  PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2476814963230389476,13799105309620360208,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2476814963230389476,13799105309620360208,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4604 /prefetch:1
  2⤵
  PID:5344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2476814963230389476,13799105309620360208,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2904 /prefetch:1
  2⤵
  PID:5240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2476814963230389476,13799105309620360208,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5496 /prefetch:1
  2⤵
  PID:6440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2476814963230389476,13799105309620360208,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1912,2476814963230389476,13799105309620360208,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5948 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:2404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1912,2476814963230389476,13799105309620360208,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1704 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1912,2476814963230389476,13799105309620360208,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3896 /prefetch:8
  2⤵
  PID:5892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2476814963230389476,13799105309620360208,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
  2⤵
  PID:6976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2476814963230389476,13799105309620360208,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6580 /prefetch:1
  2⤵
  PID:6992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1912,2476814963230389476,13799105309620360208,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=7140 /prefetch:8
  2⤵
  PID:2936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2476814963230389476,13799105309620360208,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4812 /prefetch:1
  2⤵
  PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,2476814963230389476,13799105309620360208,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3928 /prefetch:1
  2⤵
  PID:6020

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6724

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:412

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1572

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x0000000000000478 0x00000000000004E8
1⤵
PID:6832

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1792

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13
1⤵
- Modifies registry class
PID:4924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Dolphin\Dolphin.exe

Filesize
14.9MB

MD5
9660ec7cddf093a1807cb25fe0946b8e

SHA1
5986661c62d689380476db238d7c18fa37d1b616

SHA256
19d5c382204d7e40a764e116967aec610f502b9be60b9d3b095073827aa93c66

SHA512
5213c828d4f0742c3cde59ceea7b111a1402779602f09fa5e898083b07f2860bb33119f97741bc049fefc0cd745879d22a12dc37ece8e0dd8b308dcc84079755

Download Submit
C:\Program Files\Dolphin\Languages\it\dolphin-emu.mo

Filesize
121KB

MD5
f00a5461ba0b2c95f801923fef70c266

SHA1
f7717e3f341e1b56c46407df643d4ac6dcc09885

SHA256
19c8af2231c12fe7969e63595f818baf9421542d1e4f3ea64ac2ff79352a6f12

SHA512
a9977db27df94510bc75ee961924804c59c0005b9bc9b8961d63b01359c72920a6a6f0f3b014c715f3b0c4208038deb65f114f83dee157422dc035b84a267315

Download Submit
C:\Program Files\Dolphin\Sys\Resources\toolbar_debugger_step_over.png

Filesize
988B

MD5
926a446e9de7d51c34ae548673386417

SHA1
5a0a2666b270eca354f1632de8f98fc966864d08

SHA256
85f27cf7d073c5931530c102d4c39ff731a3eb30c67d506c6626b0ad72f26539

SHA512
d5117a0a76c22b06aa91f7586f866387ad74b4962e569cab64d6abeb83d701c8b66331dc6193478f36faef616a95f404cb15a7a0b0b86f863c93ab09f908ea53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e11c77d0fa99af6b1b282a22dcb1cf4a

SHA1
2593a41a6a63143d837700d01aa27b1817d17a4d

SHA256
d96f9bfcc81ba66db49a3385266a631899a919ed802835e6fb6b9f7759476ea0

SHA512
c8f69f503ab070a758e8e3ae57945c0172ead1894fdbfa2d853e5bb976ed3817ecc8f188eefd5092481effd4ef650788c8ff9a8d9a5ee4526f090952d7c859f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c0a1774f8079fe496e694f35dfdcf8bc

SHA1
da3b4b9fca9a3f81b6be5b0cd6dd700603d448d3

SHA256
c041da0b90a5343ede7364ccf0428852103832c4efa8065a0cd1e8ce1ff181cb

SHA512
60d9e87f8383fe3afa2c8935f0e5a842624bb24b03b2d8057e0da342b08df18cf70bf55e41fa3ae54f73bc40a274cf6393d79ae01f6a1784273a25fa2761728b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000017

Filesize
67KB

MD5
958e72d173944595320c1377b3015e44

SHA1
ba650126f7d4e739dd399fe8e2ab9939df2e359d

SHA256
0f26af205e088a2d95b5bf8a01905d6beca0acaedca901c6dfab31dfa114ac0b

SHA512
684a460c6f17bfc866d5d3ddd8486f068bb48ddebcc08c99a8117658a9a562fa4e982cd3ea64dcaca2336cd670d058d4be49de477cfe56b7db02014bdef00acb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
781f115f50a9f9c838d3b47d5636d446

SHA1
7626c3168e9eea9a6baced144faec8ffa4408f3a

SHA256
b984dee3c15fd912461b5803c03cc820a021d309f7e3446a013fa785cb8cf19a

SHA512
fe8e854398c242c6f1035c67ee824c76f7ea1dce87621fffa6a7f94cd55095973330b5dceb5616cc4e358e8680a366499963bbd51695d15050fb98f1ec6f5e59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
230f00a451c5934dd435ad48165b9ac9

SHA1
4aef608e659f12b5dbe3779dc8daacde444c1195

SHA256
191f0a20c3f580ace48da172fb0f852d7d6c5aeee2b109fa834a6a0086a6f397

SHA512
aacb110505956e4874f5b8012833946332b3c0afc024aca6e094cd6d8bb14a00759bcbd5fe76edfcf349b45e03115ee6ceef3f762a91adca1ecadd447c25dea4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
825dea5b6cd07b2a1611120667223875

SHA1
af3f6adc14b86ad1783340c14cda652ab124b916

SHA256
2d52749d55e9cdafe7795ed9d7794175183e0f81fd2b1393e23cf5119e0f0c65

SHA512
133639a64355d2be2ae183caec8e073ade8ae2c339ba7cb6bd93efcdbce3d5398c136dfb334b00202c5574a9f31c77cd49c3510e9a0858984b733cb804719e44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
a7ad1fc12eacc970644c61a8ba90dcf3

SHA1
adf817f8d70f6206225ec2769b07a8eb97fe6b98

SHA256
d8b2f53c70c33dc514adccd1f2c27039266c5b78588f055e2dccbc8550edf394

SHA512
262cd29d701fa0ca05f59f41ea5d80528a8f321fe0820d2327c27601c364514239fdc77e48fb69c282beb6b51ec0cc2f4525f4a2cd45740dd44b439f5f696e08

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
257216d34fa76b2de64980772163a110

SHA1
2fcbb983590066cc6a22a9c8f000f1cda0bd5e99

SHA256
2f31b003dce24941de13c557af9539b9e294b90d3a97855adb14c0718e87f95d

SHA512
5701d557d7bc81d9b011f070715b7103200944918461a7dd24f36c3b4002c556ea6f12f0dcd3546358e5bdffd5f12ecd0ad4fa62bd8a24e685ef2ca917212f69

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
d786e8f3f1fc74c9bafca9e21085e7b0

SHA1
6c81cdcd3b4441986514e8c6c97b95f376116794

SHA256
3bb592f5d83b37090f4411f2bcf3005b3b174b7282dcd18fc4413db254b832df

SHA512
1eefb1020380652978a172d65c1b1166d6bc810f9fc5e45af544cc0109b3536a06d95924ea4c00464b5ec7acf3e8357c019042284d84bbc0730749b358c76c33

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
4046ccceb06049e9450c9e3ca8c7f772

SHA1
6b9e32a853a7da9b181df02b52c5018e6c0cc109

SHA256
eae9f782c357d9ebecf25e91c2452331f073af53f981996d101eca2e3e6827d3

SHA512
c1d01a92e1e9b7021ea5c9196ada797c0ae3d0a88c2da973b131cfe43d1e004058c0cf9e7d98bb3b31411b58ab727697cb76a547f5eb9a3369c7be2d55210756

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
e37b9bd9976deacbaecb131e00af7a13

SHA1
ebeea29297c76603e8e0872b95b64be347bd6f47

SHA256
ce4948e84f5aafc59d502738bfcb12f337926c92ca7d66c62c809665ddee63df

SHA512
ef71c8a675c3def76d32417fb417ec1ba48238748973ca5cc7b10d7f58b430ec287339fd30599acada532b1a62edd6b8cce0506fc603f16536dbf6ba5930deaf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
857B

MD5
51062079f10221db5f0518bfb25580a9

SHA1
dcb116b7d949428302b2fd0b851aca7d10c94460

SHA256
2b1eaa88a1a11c8bd2c721315d7db224e8000a838c9ea5e9dc9938e7a84bcd0e

SHA512
b2b175e3a2f569ee36cdaae03b198ba7f1bb7b306423a8a6a5209a344dcbdfe32005926e2eb9ac7b62db77af5921031a394f3cb49179dcbf7d532fc129dd10e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
ab33078cb510c0a597848cf2b6672f32

SHA1
8b209a94f2d9c32f177e57e90faea4b957d04a1b

SHA256
828ebed3ca0163c39dccae831aaef522e9f46c72086de70151b55d4a4e7bfed2

SHA512
688cd14e38ee7e2471420e522b2dc24481b74d61c0dce383606204045320b4c383fbf689b1c0d0802dc367a197732421f92706c926162f53575e277966c1febd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
931B

MD5
a4e2fa388357e997d6ea6991e474a10d

SHA1
c4149b73e303a4a08d9136ee2c7e03a13f71256d

SHA256
d826f9dfe1fadcd7b2930005447dddab2683dfba9f69602cf40a46c7f2a93214

SHA512
cc05c91a5afdd28eb11c51e4d3df7ea9540ea3401c52ba3bd1a5778cb8dbc879d57f4c730549453a7c32273123bba3d39035662b1827298e4b3bbc39875a3383

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
71ee8473c3c55c4e57cb950b1e431683

SHA1
2a79149c0695470cd76a6a7bdaa862d5b8a371d5

SHA256
945c1107f130f90117627584f7fdbc0a6240fa116999bb3176de2f075dd878a4

SHA512
47c4f97ede5230dd5d56ec90a5f5200d61bc6732f9f91414c49cbff6c9855007a7e606a9743b9f4678c65d58ee08fb24c357df5d0cca0a559736332ab8b4d008

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
cf13ed89f6660bc8bc647989a3e52059

SHA1
ea408a574819dbc10bbe3562340e1f2b3700ee5a

SHA256
5a308f9fa50bcf02128b3622749b0fa587d1f0d6b93799c961411bdd16a80c1a

SHA512
4d9b60a4593b159a1c77a99cca691aee2816870a030d09e1baddd66d7199a24f0c4e2ee152910bb08e9f105605567537b1411871c796179224d727ccfd8756bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
d83f1c1ddcc3809beacfc7c59cce5359

SHA1
e7d79c67676be310616bc0411a31314ef6c85f0c

SHA256
7eff3efb1c38479aba27dadbe679ffa2df0fd27927dbfa2bf92f695b8ff4ad9d

SHA512
edbd7a59c65e823c52270374e2c1f8d02b2c4fe3f1ecb962227d73ffe9cd64a7ef4abe4687bc0b0e27ec16b2b1756efefe3f2b9950a6441b229907011fbb576f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
032a0bbecbedbabb6b1d04c1ce14f4ed

SHA1
e63779fb55ddc3665d8ade3e5c6e20eb2e5f42fc

SHA256
49bb1e5a9072731a569197315d579678499361fb8e2280f7bcfffbdc113db246

SHA512
821b1ac90c656a7b1b896f1d5ba86331f7cbb607e9c13ce09de889e2f66bf0d5efc89db494894601d3213bdb349706dafddc283572082a74cf432c8165713ba1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
773829f7460bc4def6ef4bd3230f33d5

SHA1
6f3394ab4f8012bc0c4c51bbdd0ab202f966cfc8

SHA256
f6e020afda847d44a0fd2a96a0b84120141a4d6183accb2761ff8fe482cc47c7

SHA512
a4d0f31479ee609302bc723e19db6d120322b38314b9c1dd1a5e28a20c45c086f34a8441617b09e1d9f678f10fffa0ed5018f26eaeb54d07477f6cd83e7c95e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ddaa12be2fff5eb2dc82abb29aedd7b0

SHA1
c0d8db69f52693ed7aa5c8eb3f8add4619aaa25a

SHA256
8ad4339544d085aabb64026e0d6dd5ee847ada96bd0ec4a9792f10e712f051fd

SHA512
961e49fdc47f94aa705737dcb20907d322fbb83d095d45c0499300b943b782a7eb486b0be606a383f956734afbf0460d5fd4a609f5161a3fbae0d813a9f9f2c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
256400d6229d5a783980846ae2c03a6a

SHA1
31909ecfdc3a953f8b7e71a582103168ce6d1522

SHA256
0b6f781649631ad7038e121a6b4442bb9a425dd38b090b3bb2a7db9ac0301965

SHA512
18d57363f493c42a348fe16267a38eaa6941d4a12666b9e908db7848b06847bf5fbc8e26c2584ad1f800784a7be3581b1b285c75841a2921b92a8f57670e77f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
119084a1c8caf20074e6c11127a213ed

SHA1
28e353796b92019ac245f5522f0f77d9be37928c

SHA256
2e51043a9ff66b6cab5aa2554f69e4af7c9d487031d40ab75804f8d105ee0b4e

SHA512
a1bcf5f7904f026a069afa33bfaafc0b38b0605fed226891560195025a5786e9d6a115f3b01ec6076a041307ac9434bdd904070509baed7a26887ec96e135ace

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
7511cb5e5c587b4df0143a7cde7bb021

SHA1
8b8cdddbcf2935e71b8b448de7df8e889995f713

SHA256
f6c715d48284f602ff05e0179ddd863d20e63b6b110f2b474d568fc586e8d842

SHA512
8d94fb7170b25daf42189dc9e4a65017e9d200b91e747fac71087e0da6bb23d68d7d970d4f71c0a5261b45dda48bc4dc7bb853742934d3daa310a4de5cca6031

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
f53281a51f21ea9b01b6e18e02769c88

SHA1
998b3af88535bfccbe500c5d4e33c9d299b36827

SHA256
9a48ea15e65029b515f6d0e584a269241272074446b81269fcda9ad83f58b2fa

SHA512
03a98a0e707db2d01a89ae3ee1f02838f547d9dbfd8a22c760766205dc66bddf09956d7ed789132cf82a8a92138406619f9debad296e8724c40f8328c9ac20e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
c62a0fcaaf76d9425864564ec16b02b5

SHA1
df33572d308a4aa5300397ab4bbfe732511cd722

SHA256
2de3e3a1ad419b3ed62c33599fb45e14581189c72e9cd914c1630102ccf2fa28

SHA512
203b293379c2e5d77009995c7b05920f93debd21655707695ae52491059bc5c91861d3a127b75e3b16e3dabff6f4aee17fa5f9c90afb7ed57c40fdec55064ad8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
58c4ad48df4a80fd06105a9bf5892923

SHA1
b38d87c407d528aeae0af46c49692b912998f6cd

SHA256
7b3b711569032df8f8326621f64d1ad0e23e657180ece88ff390d7c11893deb9

SHA512
88b23ec3fba1dc989404c61d79e316c03f3efd57114d5256f909cb764e4cc4f6bfa05dcb3fdd0b70efebbcc9d321bbbb8c3e737a0fdae45e71e8f2278314d429

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
fed33d6b6233198145e9fa65e835af23

SHA1
5d57591518405bd7c5711d3877015b15b97fa977

SHA256
a7a018977270bb904d61342ccd8bcb36689928e55c56ef63c89469167bab8676

SHA512
2a648dbde8cf4afe6e36035b2a8e08e0fbef98b8964216973acd58bc09d0dfdfc95cea5a1cf0a3099ddbd43ae54477bad8d7a4dc4efb51e81d3479912a49bcb3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
707475488d44d3a889913cd2aa332d64

SHA1
0cd98809901c107dbfbf7f96d183be94e977f134

SHA256
378d21ea00af1f6d4bac81091ae7e131bdf35b9f1141ad270042d98baf259cc0

SHA512
96190863ab644c248680c53f305a5f82e70697b632796011b74a206ea634c2fa403ea372585abad6d744f2910ee9d2637652d965bd7c3d8cf77b45b6832d4129

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
7aa2e1c9c18a440e8786117f9d4343d7

SHA1
82825573684a955129acd656603c29dd14c00359

SHA256
b7b56facafdb34bd83fada6c1a416f00521951a734168ac0051be1d3fa883c37

SHA512
13fe9b087f7def07d640ad6566d6557b6b8b1e65c826e5de8cb1c57b29d80816e30067c5fd2b33f33a69a631d6d85ca308b08590afe41b155657ffe20b45c3c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
c81c75b2dfc78d5be86a7c4fd806bf56

SHA1
3808db430deb1de9b79f231691bea5b06e161371

SHA256
8e139864077907ce01a333ffe0eb8af4d66a670d72252ba9da002db6e4ceeb75

SHA512
8589b2ba3b7abf07be4870e488fd75270d8e8a3d2e32ba6477ca89d3de11b0b9b18ef5322c3f43059af2183fd65bc295d7c4b18d52828601965b9afc57993b83

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
0fe9d5d4ca3bda4964b383f898bc38a6

SHA1
81a9279a002b2b90f2667a7ac45105ab737c8625

SHA256
6ecd513568f00c06d13565a90b086079e4180065caae5b0f10b5fdb19c9dc034

SHA512
63431711b0a99e2a81c6c5f95c14baf06b202ab9ee77de4be221425e36d1e0b1f40c83c67744741937c60c35e373b6d62ecf51777bdf05840a36b1d5c25d1089

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
7114a12205f77860714b5f0016934504

SHA1
103a7a9c66c3c912f12764133892f4b77a42865b

SHA256
a4fea1f41385cd799e9294212049d2c27efad2941c8bd2816953833ce2d1c593

SHA512
623427377e6591e9dba5373e66276226832ab0e754adf099fab34865ea33fc7b169828616eb4668970d5dd6dfbdfaceb08dcc5928a438edc80335698d8ef65d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5a282a.TMP

Filesize
538B

MD5
533369f6e3be0aae3acba36d0e6fd481

SHA1
24a095f06b0f67b23eea10b690e137eac4484a85

SHA256
7535cda37d4558085b639238be89587e9e242ebdc66861c4620dcf42dd6ce38a

SHA512
1f06b69ffd2c374a848af4932d7c6982d4a1d79b0d9a75a755a535842e9b453af423ba39870a965d252bfe5970723e9e31835184f9d4a65a83edcdd57583fe95

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
9be0193a8e9ecf41bf3ed4842459d7a0

SHA1
738c53dac1693d109288f9e67de580a70102b4ff

SHA256
9a078f828deeec144d659680ad11f31f607b42b8b3ed455a5df687c9c04fa536

SHA512
88ba1d70d1123df68a89961d4fa24dd41031363c71ed7d4e920cbe90edca98defc60b1f5a384e76d9c24bfd19845b0af56b5f12d53d423bd45a872409fd87057

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
751d13b7bd1a644c3fc5c6ded1b8f208

SHA1
827061bb3f28b6380fe94267d7767152faeaf8d7

SHA256
92a180946264ae3c6f0e3bd2fa304c844d2ac0912bbdafab6c8d7bd5dcb51d86

SHA512
2025394a6189dd9866fa84d7f17fdbee47a7e25ee2a668bf7c8a0777a2c3b6344111686f40d17622cd2acaa4966ac9f9831d525d5472dca20d32de5b339b57e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1dcb5dbf7038fe8d759afd70c4138e8e

SHA1
f633a776af08173681f20e6088913a83975de69d

SHA256
f656241b77832bbf5b681a4c9b1032432db3db44b21f96a157805f86e26f556b

SHA512
8f764b95064283b78735883ce2d2793588f36b5183679d4fec4038a9786986d218ce5d0395114ce9f65f0fd4fcff11d2fd94ebba781b1f4bc6585c0d7d7bf3bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
b373b6b453544bf9885f146226fcabc3

SHA1
4af14990d116513936ba396e953ecf83ac1bb9bc

SHA256
fd54922b74fa99d66223eb8ecd0192d7032d297ccc29663f8b4833044d6ba3f5

SHA512
d049e90ab89736887cf07dc56159bf1e6fc112ca29b1ee83713fbd7073228776bdf7f32959aaad9dace9b5f3d432f60692e37ec446da6a2cec1eb0a0e66bab20

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7b30724b14f708237f874f30f1ed7a44

SHA1
7004be013c3795f56e021325fdd18d64d9a96434

SHA256
7bb4ebc7868104a10dfb7f0e36ca2bb2f29c7a3bf8d8ce3ce0d8757397b3c457

SHA512
93e63f6760318e01cb905e2d3b0c19b816c512cb09ecada31a56f5f259f233aeb49aa6fbbb8e8fc0273879e1788a2b816eb312c292ba059d48d003e87044350e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
34cb04650519895583d83e91a287383e

SHA1
2c1823efef68194067b11b55244033d1d72f69f1

SHA256
aec2d91e7cc1755cb50ff8d44c6dd818e746c61047323187fa1c2c0ccb098127

SHA512
76553f662bf1531e6ea1c1170dcf5d91bf105b79e2a941b593171abd5da66b9851c54c8cb9e3e687fc2454410460eaf1ed4a168257d5b6689a7d7ff41d577b2d

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\BackgroundTransferApi\a5d01dec-5756-4890-bd3e-3b886038a789.down_data

Filesize
555KB

MD5
5683c0028832cae4ef93ca39c8ac5029

SHA1
248755e4e1db552e0b6f8651b04ca6d1b31a86fb

SHA256
855abd360d8a8d6974eba92b70cbd09ce519bc8773439993f9ab37cb6847309e

SHA512
aba434bd29be191c823b02ea9b639beb10647bbe7759bbffdaa790dfb1ec2c58d74c525ef11aacda209e4effe322d1d3a07b115446c8914b07a3bce4d8a0e2c3

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
10KB

MD5
525a18e0eb1b19143920709eaed904b9

SHA1
1ed74cf799f6ee039d807ac5fff449959e00e5fd

SHA256
0ed3c392a3c79c2b2fb353993233f5a8f161431ec67716611f00cb1476607d32

SHA512
b55ff0a5632fe42d1d6829d8afd939008dd8210771d4840eac5f57bf45188746cdd039a7929d7bd4877132c5a39362d0dae48a1f1f39df9dcf1dd54f695be0e5

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
10KB

MD5
804267a5252a7abf17af04d19dba6707

SHA1
19d8d55768639e68eaccc47e75ef8b2487fa040e

SHA256
c11394f4ec76b3dcdeac433a836e570a6388e470d36189c60f3aaa19dc0cbfde

SHA512
c896f520cbafb8b4e29fe3c600042851ed175fa15464023448e416036e394e1c9da284a05d8c283b440b2c51bcb9db54d5496f48d15addf0f574597106a27b59

Download Submit
C:\Users\Admin\AppData\Local\Temp\DX5EF4.tmp\apr2007_xinput_x64.inf

Filesize
860B

MD5
94563a3b9affb41d2bfd41a94b81e08d

SHA1
17cad981ef428e132aa1d571e0c77091e750e0dd

SHA256
0d6e1c0e961d878b319ac30d3439056883448dcf26774003b73920f3377ecac8

SHA512
53cac179d7e11c74772e7b9bd7dd94ffbc810cfc25e28326e4d0844f3f59fd10d9089b44a88358ac6dbd09fb8b456a0937778f78ecc442645764f693ccd620b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\DX5EF4.tmp\apr2007_xinput_x86.inf

Filesize
1KB

MD5
e188f534500688cec2e894d3533997b4

SHA1
f073f8515b94cb23b703ab5cdb3a5cfcc10b3333

SHA256
1c798cb80e9e46ce03356ea7316e1eff5d3a88ccdd7cbfbfcdce73cded23b4e5

SHA512
332ccb25c5ed92ae48c5805a330534d985d6b41f9220af0844d407b2019396fcefea7076b409439f5ab8a9ca6819b65c07ada7bd3aa1222429966dc5a440d4f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\DX5EF4.tmp\dxupdate.dll

Filesize
173KB

MD5
7ed554b08e5b69578f9de012822c39c9

SHA1
036d04513e134786b4758def5aff83d19bf50c6e

SHA256
fb4f297e295c802b1377c6684734b7249d55743dfb7c14807bef59a1b5db63a2

SHA512
7af5f9c4a3ad5c120bcdd681b958808ada4d885d21aeb4a009a36a674ad3ece9b51837212a982db6142a6b5580e5b68d46971b802456701391ce40785ae6ebd9

Download Submit
C:\Users\Admin\AppData\Local\Temp\DX5EF4.tmp\dxupdate.inf

Filesize
12KB

MD5
e6a74342f328afa559d5b0544e113571

SHA1
a08b053dfd061391942d359c70f9dd406a968b7d

SHA256
93f5589499ee4ee2812d73c0d8feacbbcfe8c47b6d98572486bc0eff3c5906ca

SHA512
1e35e5bdff1d551da6c1220a1a228c657a56a70dedf5be2d9273fc540f9c9f0bb73469595309ea1ff561be7480ee92d16f7acbbd597136f4fc5f9b8b65ecdfad

Download Submit
C:\Users\Admin\AppData\Local\Temp\DX5EF4.tmp\infinst.exe

Filesize
68KB

MD5
45d4dac07aa361bcd77aa815d1724a16

SHA1
3bbdf7da5d51211ae269572961b5ebf508ada28d

SHA256
34ab99536ea59ad60ba6efda3ea6d18291ef096a0bab3664248d6045805da0ec

SHA512
d940002a8e0112a3b56a909008403b447e9cbb80e38b9bbd508f40aa68224f7e5d9681e1039e747ae939e0829a25be2319b9f9d0862cebb042e4c525ccbc20be

Download Submit
C:\Users\Admin\AppData\Local\Temp\DX5EF4.tmp\xinput1_3.dll

Filesize
79KB

MD5
77f595dee5ffacea72b135b1fce1312e

SHA1
d2a710b332de3ef7a576e0aed27b0ae66892b7e9

SHA256
8d540d484ea41e374fd0107d55d253f87ded4ce780d515d8fd59bbe8c98970a7

SHA512
a8683050d7758c248052c11ac6a46c9a0b3b3773902cca478c1961b6d9d2d57c75a8c925ba5af4499989c0f44b34eaf57abafafa26506c31e5e4769fb3439746

Download Submit
C:\Users\Admin\AppData\Local\Temp\DX5EF4.tmp\xinput1_3.dll

Filesize
104KB

MD5
bfb3091b167550ec6e6454813d3db244

SHA1
87e86a7c783f607697a4880e7e063ab87bf63034

SHA256
756cad002e1553cfa1a91ebe8c1b9380ffabe0b4b1916c4a4db802396ddfbef8

SHA512
ce2ead2480a3942081af4df4baee32de18862b5f0288169b9e8135cc710eb128f9a2b8a36bda87212c53fd4317359349c94d38b5da082638230dcb5669efede9

Download Submit
C:\Users\Admin\AppData\Local\Temp\DX5EF4.tmp\xinput1_3_x64.inf

Filesize
669B

MD5
c9635b7617d68d95f9113282472218c9

SHA1
e3da3f2600a0f5cd0e28722ee313e04fc29dfc60

SHA256
0d411d9424128f19fed2daa95a2983b4b29197f022a754f59d0c7740ad654cca

SHA512
0481e008619d3b3a45d0a90825b576e4c03f27668b0792762cb9165b15955645667392f23eac5e5c4eb8a7fe6fa47cae4c319323b02225289af0cffaf1ca8c83

Download Submit
C:\Users\Admin\AppData\Local\Temp\dxredist\Apr2007_xinput_x64.cab

Filesize
94KB

MD5
743b333c2db3d4cf190fb39c29f3c346

SHA1
26b3616d7321978bd45656391a75ee231196a4a2

SHA256
e7a09f8235cc587cc63f583e39fbc75008d9677c8bb4dcc11cb8d0178a5153ac

SHA512
77fbdb86c79d7228bca2982a3285a417a365af980488a5ac2d470b532fa59fcc15e0e8dbee6eb1a3a5256fc29e0e3391529cd2ac13e0f72987ee0da136000957

Download Submit
C:\Users\Admin\AppData\Local\Temp\dxredist\Apr2007_xinput_x86.cab

Filesize
52KB

MD5
c234df417c9b12e2d31c7fd1e17e4786

SHA1
92f32e74944e5166db72d3bfe8e6401d9f7521dd

SHA256
2acea6c8b9f6f7f89ec51365a1e49fbd0d8c42c53418bd0783dbf3f74a744e6d

SHA512
6cbae19794533ad9401f92b10bd9549638ba20ce38375de4f9d0e20af20d78819e46856151cc6818325af9ac774b8128e18fbebd2da5da4efbd417fc2af51dab

Download Submit
C:\Users\Admin\AppData\Local\Temp\dxredist\DSETUP32.DLL

Filesize
1.5MB

MD5
d8fa7bb4fe10251a239ed75055dd6f73

SHA1
76c4bd2d8f359f7689415efc15e3743d35673ae8

SHA256
fb0e534f9b0926e518f1c2980640dfd29f14217cdfa37cf3a0c13349127ed9a8

SHA512
73f633179b1340c1c14d0002b72e44cab1919d0ef174f307e4bfe6de240b0b6ef233e67a8b0a0cd677556865ee7b88c6de152045a580ab9fbf1a50d2db0673b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\dxredist\DXSETUP.exe

Filesize
505KB

MD5
bf3f290275c21bdd3951955c9c3cf32c

SHA1
9fd00f3bb8a870112dae464f555fcd5e7f9200c0

SHA256
8f47d7121ef6532ad9ad9901e44e237f5c30448b752028c58a9d19521414e40d

SHA512
d2c354ee8b6977d01f23c6d2bb4977812bf653eae25e7a75a7d0a36b588c89fcdbdc2a8087c24d6ff687afebd086d4b7d0c92203ce39691b21dab71eafd1d249

Download Submit
C:\Users\Admin\AppData\Local\Temp\dxredist\dsetup.dll

Filesize
93KB

MD5
eb701def7d0809e8da765a752ab42be5

SHA1
7897418f0fae737a3ebe4f7954118d71c6c8b426

SHA256
2a61679eeedabf7d0d0ac14e5447486575622d6b7cfa56f136c1576ff96da21f

SHA512
6ff8433c0dadc0e87d18f04289ab6f48624c908acbda506708f5e0f3c9522e9316e587e71f568938067ba9f37f96640b793fdfaa580caedc3bf9873dc221271f

Download Submit
C:\Users\Admin\AppData\Local\Temp\dxredist\dxupdate.cab

Filesize
94KB

MD5
d495680aba28caafc4c071a6d0fe55ac

SHA1
5885ece90970eb10b6b95d6c52d934674835929e

SHA256
e18a5404b612e88fa8b403c9b33f064c0a89528db7ef9a79aa116908d0e6afed

SHA512
a25c647678661473b99462d7433c1d05af54823d404476e35315c11c93b3f5ece92c912560af0d9efe8f07e36ae68594362d73abf5d5de409a3f0a146fe31a10

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsbAF4D.tmp\InstallOptions.dll

Filesize
14KB

MD5
d753362649aecd60ff434adf171a4e7f

SHA1
3b752ad064e06e21822c8958ae22e9a6bb8cf3d0

SHA256
8f24c6cf0b06d18f3c07e7bfca4e92afce71834663746cfaa9ddf52a25d5c586

SHA512
41bf41add275867553fa3bd8835cd7e2a2a362a2d5670ccbfad23700448bad9fe0f577fb6ee9d4eb81dfc10d463b325b8a873fe5912eb580936d4ad96587aa6d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsbAF4D.tmp\LangDLL.dll

Filesize
5KB

MD5
e447e49175c0db1f27888aede301084f

SHA1
f5946c743265cd8e81f3e7b6376dada57f99877f

SHA256
fd26ef21d72797fedecd3d15f2001cea793383aceb3cee19a5ae2a3d30e197b6

SHA512
e6543bf81bedce94a58f48cd6f9daaec891775e01ff76b771c22d459a778490f9bba0bebbf111b1ca3091b3ca69bca806a9b5e68ce12df03abbaa6ce5c4b7cec

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsbAF4D.tmp\System.dll

Filesize
10KB

MD5
56a321bd011112ec5d8a32b2f6fd3231

SHA1
df20e3a35a1636de64df5290ae5e4e7572447f78

SHA256
bb6df93369b498eaa638b0bcdc4bb89f45e9b02ca12d28bcedf4629ea7f5e0f1

SHA512
5354890cbc53ce51081a78c64ba9c4c8c4dc9e01141798c1e916e19c5776dac7c82989fad0f08c73e81aaba332dad81205f90d0663119af45550b97b338b9cc3

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsbAF4D.tmp\ioSpecial.ini

Filesize
519B

MD5
cf2cf6801c4083286e6658cc34ab2105

SHA1
3b9c42a4c63ab3da00254caa1ae15be7fb1f3f7a

SHA256
4fe6c3e9d9277eade29ba95674cb1d8cbae4aa3f992f9bcd33975a6346f8a7ae

SHA512
c99555666c0646eb3ec0d75b3dc4c99f02db908324ee598c636d82e619374dff982d3cf69c12b66c568ef17c04db28c2aff63b6bae139dbba557f957ab2cc44e

Download Submit
C:\Users\Admin\AppData\Local\Temp\vcredist\vc_redist.x64.exe

Filesize
14.1MB

MD5
883c499d04c145a69622f7658e353265

SHA1
bb64084762abd4a06b2fddd16f0092860bc3043f

SHA256
df58f4aa566a10776c864c1007e0ac0987835fa1e9f7445bed8ba21a9101d414

SHA512
ce840c9420e928c9da6c30c3cd97eeb047d34ee7046b8cfcd20b512fbddfe885329ab4db3ca53f7094bf1caeb600c834cb2db10797ceade859c21786144206c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\{dab68466-3a7d-41a8-a5cf-415e3ff8ef71}\.ba1\logo.png

Filesize
1KB

MD5
d6bd210f227442b3362493d046cea233

SHA1
ff286ac8370fc655aea0ef35e9cf0bfcb6d698de

SHA256
335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef

SHA512
464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\{dab68466-3a7d-41a8-a5cf-415e3ff8ef71}\.ba1\wixstdba.dll

Filesize
118KB

MD5
4d20a950a3571d11236482754b4a8e76

SHA1
e68bd784ac143e206d52ecaf54a7e3b8d4d75c9c

SHA256
a9295ad4e909f979e2b6cb2b2495c3d35c8517e689cd64a918c690e17b49078b

SHA512
8b9243d1f9edbcbd6bdaf6874dc69c806bb29e909bd733781fde8ac80ca3fff574d786ca903871d1e856e73fd58403bebb58c9f23083ea7cd749ba3e890af3d2

Download Submit
C:\Users\Admin\Documents\Dolphin Emulator\Config\Dolphin.ini

Filesize
2KB

MD5
de5a7da3b5e1232d178940f5c77cd4fd

SHA1
6197d0ec044741aea67f0057d920e8465e760f97

SHA256
0f0c6ed93705ea4d6b09d8b5ed610d8b8a4228256677c829ed23ab709df9a5a8

SHA512
7ba4ce016efff9399b4b99855b32e8038bf12016f503cc94b4d411ffb505f4b7075317ab7c3bdc094ad874fb5d884d083f4ac5ca40b2ef0df039aa95c5bee968

Download Submit
C:\Users\Admin\Documents\Dolphin Emulator\Config\Dolphin.ini

Filesize
2KB

MD5
3d651a1464f2dd29c4bd8446a037703b

SHA1
4d7bb2be6cc234275f1e8efa04472b9532298bda

SHA256
03ad1f94f2ccb6392e24619fdb4341a92a0ed84bae0d31c9639a22b544930189

SHA512
2c521b4a72a011956c528738e3799bcc8906b709bf2e0096e205395341f26152fab738b427519d0197c96185c26b7c58999ecd55b881d645cbc1d317966b7a8a

Download Submit
C:\Users\Admin\Documents\Dolphin Emulator\Wii\shared2\ec\shopsetu.log

Filesize
32B

MD5
70bc8f4b72a86921468bf8e8441dce51

SHA1
de8a847bff8c343d69b853a215e6ee775ef2ef96

SHA256
66687aadf862bd776c8fc18b8e9f8e20089714856ee233b3902a591d0d5f2925

SHA512
5046adc1dba838867b2bbbfdd0c3423e58b57970b5267a90f57960924a87f1960a6a85eaa642dac835424b5d7c8d637c00408c7a73da672b7f498521420b6dd3

Download Submit
C:\Users\Admin\Documents\Dolphin Emulator\Wii\shared2\sys\SYSCONF

Filesize
16KB

MD5
9473c879a5e51040e7a202b4538773a7

SHA1
3256c026284a24fb99d2ec1558d95db3b5dcc2e9

SHA256
a8ec1ec377ee3a3c93a27f74dadf9edf95112ce167fc23d1abdbeb4fa15eb179

SHA512
139dbb6648a1c8b7e5224e52ca8f8093f069b7d5f83e2b84099688b927eb77cb8445bc46f9da98ce56d3b883bfe8e38905b5e252c87a5295a334fc8b6890bff3

Download Submit
C:\Users\Admin\Documents\Dolphin Emulator\Wii\shared2\wc24\nwc24msg.cbk

Filesize
1024B

MD5
0c425c24e91335f18a3246b1d611a8ca

SHA1
caf8a96a36573d7e67f086f73fec675a5d1c4245

SHA256
7afebf33eeb0035397cc74e15e892e700cd2903641d26562f5d46cfbb6171109

SHA512
001e0d8dd5e5b2e2d8b8357bba7d8c20ac33dca3a6b7897f11a1f01f391118da4f457d5a5c6531eedabebd6883dcde0bb3526b97ed7b3357a7e6d768d9c322af

Download Submit
C:\Users\Admin\Videos\Captures\desktop.ini

Filesize
190B

MD5
b0d27eaec71f1cd73b015f5ceeb15f9d

SHA1
62264f8b5c2f5034a1e4143df6e8c787165fbc2f

SHA256
86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2

SHA512
7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c

Download Submit
C:\Windows\Logs\DirectX.log

Filesize
474B

MD5
56d6eae6d88db571ee8b94370cd5d772

SHA1
f30969c725d431694231d2e72e83d6968f628d06

SHA256
d38a5b4baba7b8fcba7b23c34849f8ce64a07060f194d6ee3eabbbdd574c3029

SHA512
593ed20e5bcaeeacbe85142b221c13bf7c84afad40512eace29b83c3fbae48e488c282cecac5aab32b5b8b0f2e8c14d793720aa5cf523cd32092602c831ed18b

Download Submit
C:\Windows\Logs\DirectX.log

Filesize
25KB

MD5
41fc52a294e0cedafe77cc0a9ac9fade

SHA1
eae8d4efd3763df4b0aa1d7bb7fa9be4c0034655

SHA256
10c2abb69de5c3c4e7e425cb342830caae3a8beccb750bc15f3678c65f7f2eaf

SHA512
86e67769f0dd956f04231f43948455fe3f47664ada95921334b082be570ad62f028b0dece4b5d3fc6fb343cc8dbfe94cfef6ed45d86ebc2faa0153b6a397d2a3

Download Submit
memory/6068-9391-0x000000006B600000-0x000000006B69F000-memory.dmp

Filesize
636KB

Download
memory/6068-9363-0x000000006B600000-0x000000006B69F000-memory.dmp

Filesize
636KB

Download