hxxps://drive[.]google[.]com/drive/folders/1Zry70bwVx84a_nS9aYPJ6Otgueom0_KA?usp=drive_link

Analysis

max time kernel
430s
max time network
487s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
03-12-2024 03:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/drive/folders/1Zry70bwVx84a_nS9aYPJ6Otgueom0_KA?usp=drive_link

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 23 IoCs

pid	Process
392	350.exe
1136	7za.exe
3444	7za.exe
208	7za.exe
4084	7za.exe
4000	7za.exe
1384	7za.exe
4356	7za.exe
4612	7za.exe
4156	7za.exe
2520	7za.exe
1524	7za.exe
4304	7za.exe
4324	7za.exe
1944	7za.exe
4532	7za.exe
2612	7za.exe
3788	7za.exe
4636	7za.exe
4292	7za.exe
3140	7za.exe
1084	7za.exe
1460	7za.exe

Loads dropped DLL 1 IoCs

pid	Process
3952	MsiExec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	MSIEXEC.EXE
File opened (read-only)	\??\Q:	MSIEXEC.EXE
File opened (read-only)	\??\X:	MSIEXEC.EXE
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	MSIEXEC.EXE
File opened (read-only)	\??\S:	MSIEXEC.EXE
File opened (read-only)	\??\T:	MSIEXEC.EXE
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\A:	MSIEXEC.EXE
File opened (read-only)	\??\L:	MSIEXEC.EXE
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\J:	MSIEXEC.EXE
File opened (read-only)	\??\Y:	MSIEXEC.EXE
File opened (read-only)	\??\Z:	MSIEXEC.EXE
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\B:	MSIEXEC.EXE
File opened (read-only)	\??\V:	MSIEXEC.EXE
File opened (read-only)	\??\W:	MSIEXEC.EXE
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\E:	MSIEXEC.EXE
File opened (read-only)	\??\N:	MSIEXEC.EXE
File opened (read-only)	\??\O:	MSIEXEC.EXE
File opened (read-only)	\??\P:	MSIEXEC.EXE
File opened (read-only)	\??\U:	MSIEXEC.EXE
File opened (read-only)	\??\H:	MSIEXEC.EXE
File opened (read-only)	\??\K:	MSIEXEC.EXE
File opened (read-only)	\??\R:	MSIEXEC.EXE
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	MSIEXEC.EXE
File opened (read-only)	\??\P:	msiexec.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
9	drive.google.com
12	drive.google.com

Drops file in Windows directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI5AC6.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{6CE7FA83-63AC-4C55-A397-7FC88B3DC2F2}\ARPPRODUCTICON.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\SourceHash{6CE7FA83-63AC-4C55-A397-7FC88B3DC2F2}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5A29.tmp	msiexec.exe
File created	C:\Windows\Installer\{6CE7FA83-63AC-4C55-A397-7FC88B3DC2F2}\ARPPRODUCTICON.exe	msiexec.exe
File created	C:\Windows\Installer\e5d57a8.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5d57a8.msi	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 25 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7za.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7za.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7za.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7za.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7za.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7za.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7za.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7za.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7za.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7za.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7za.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7za.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7za.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7za.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7za.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7za.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7za.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	350.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSIEXEC.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7za.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7za.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7za.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7za.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7za.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 147514.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4316	msedge.exe
4316	msedge.exe
2240	msedge.exe
2240	msedge.exe
3004	identity_helper.exe
3004	identity_helper.exe
2420	msedge.exe
2420	msedge.exe
3996	msiexec.exe
3996	msiexec.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1856	MSIEXEC.EXE

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1856	MSIEXEC.EXE
Token: SeIncreaseQuotaPrivilege	1856	MSIEXEC.EXE
Token: SeSecurityPrivilege	3996	msiexec.exe
Token: SeCreateTokenPrivilege	1856	MSIEXEC.EXE
Token: SeAssignPrimaryTokenPrivilege	1856	MSIEXEC.EXE
Token: SeLockMemoryPrivilege	1856	MSIEXEC.EXE
Token: SeIncreaseQuotaPrivilege	1856	MSIEXEC.EXE
Token: SeMachineAccountPrivilege	1856	MSIEXEC.EXE
Token: SeTcbPrivilege	1856	MSIEXEC.EXE
Token: SeSecurityPrivilege	1856	MSIEXEC.EXE
Token: SeTakeOwnershipPrivilege	1856	MSIEXEC.EXE
Token: SeLoadDriverPrivilege	1856	MSIEXEC.EXE
Token: SeSystemProfilePrivilege	1856	MSIEXEC.EXE
Token: SeSystemtimePrivilege	1856	MSIEXEC.EXE
Token: SeProfSingleProcessPrivilege	1856	MSIEXEC.EXE
Token: SeIncBasePriorityPrivilege	1856	MSIEXEC.EXE
Token: SeCreatePagefilePrivilege	1856	MSIEXEC.EXE
Token: SeCreatePermanentPrivilege	1856	MSIEXEC.EXE
Token: SeBackupPrivilege	1856	MSIEXEC.EXE
Token: SeRestorePrivilege	1856	MSIEXEC.EXE
Token: SeShutdownPrivilege	1856	MSIEXEC.EXE
Token: SeDebugPrivilege	1856	MSIEXEC.EXE
Token: SeAuditPrivilege	1856	MSIEXEC.EXE
Token: SeSystemEnvironmentPrivilege	1856	MSIEXEC.EXE
Token: SeChangeNotifyPrivilege	1856	MSIEXEC.EXE
Token: SeRemoteShutdownPrivilege	1856	MSIEXEC.EXE
Token: SeUndockPrivilege	1856	MSIEXEC.EXE
Token: SeSyncAgentPrivilege	1856	MSIEXEC.EXE
Token: SeEnableDelegationPrivilege	1856	MSIEXEC.EXE
Token: SeManageVolumePrivilege	1856	MSIEXEC.EXE
Token: SeImpersonatePrivilege	1856	MSIEXEC.EXE
Token: SeCreateGlobalPrivilege	1856	MSIEXEC.EXE
Token: SeRestorePrivilege	3996	msiexec.exe
Token: SeTakeOwnershipPrivilege	3996	msiexec.exe
Token: SeRestorePrivilege	3996	msiexec.exe
Token: SeTakeOwnershipPrivilege	3996	msiexec.exe
Token: SeRestorePrivilege	3996	msiexec.exe
Token: SeTakeOwnershipPrivilege	3996	msiexec.exe
Token: SeRestorePrivilege	1136	7za.exe
Token: 35	1136	7za.exe
Token: SeSecurityPrivilege	1136	7za.exe
Token: SeSecurityPrivilege	1136	7za.exe
Token: SeRestorePrivilege	3444	7za.exe
Token: 35	3444	7za.exe
Token: SeSecurityPrivilege	3444	7za.exe
Token: SeRestorePrivilege	208	7za.exe
Token: 35	208	7za.exe
Token: SeSecurityPrivilege	208	7za.exe
Token: SeRestorePrivilege	4084	7za.exe
Token: 35	4084	7za.exe
Token: SeSecurityPrivilege	4084	7za.exe
Token: SeRestorePrivilege	4000	7za.exe
Token: 35	4000	7za.exe
Token: SeSecurityPrivilege	4000	7za.exe
Token: SeRestorePrivilege	1384	7za.exe
Token: 35	1384	7za.exe
Token: SeSecurityPrivilege	1384	7za.exe
Token: SeRestorePrivilege	4356	7za.exe
Token: 35	4356	7za.exe
Token: SeSecurityPrivilege	4356	7za.exe
Token: SeRestorePrivilege	4612	7za.exe
Token: 35	4612	7za.exe
Token: SeSecurityPrivilege	4612	7za.exe
Token: SeRestorePrivilege	4156	7za.exe

Suspicious use of FindShellTrayWindow 54 IoCs

pid	Process
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
1856	MSIEXEC.EXE
2240	msedge.exe
1856	MSIEXEC.EXE

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 2764	2240	msedge.exe	84
PID 2240 wrote to memory of 2764	2240	msedge.exe	84
PID 2240 wrote to memory of 4400	2240	msedge.exe	85
PID 2240 wrote to memory of 4400	2240	msedge.exe	85
PID 2240 wrote to memory of 4400	2240	msedge.exe	85
PID 2240 wrote to memory of 4400	2240	msedge.exe	85
PID 2240 wrote to memory of 4400	2240	msedge.exe	85
PID 2240 wrote to memory of 4400	2240	msedge.exe	85
PID 2240 wrote to memory of 4400	2240	msedge.exe	85
PID 2240 wrote to memory of 4400	2240	msedge.exe	85
PID 2240 wrote to memory of 4400	2240	msedge.exe	85
PID 2240 wrote to memory of 4400	2240	msedge.exe	85
PID 2240 wrote to memory of 4400	2240	msedge.exe	85
PID 2240 wrote to memory of 4400	2240	msedge.exe	85
PID 2240 wrote to memory of 4400	2240	msedge.exe	85
PID 2240 wrote to memory of 4400	2240	msedge.exe	85
PID 2240 wrote to memory of 4400	2240	msedge.exe	85
PID 2240 wrote to memory of 4400	2240	msedge.exe	85
PID 2240 wrote to memory of 4400	2240	msedge.exe	85
PID 2240 wrote to memory of 4400	2240	msedge.exe	85
PID 2240 wrote to memory of 4400	2240	msedge.exe	85
PID 2240 wrote to memory of 4400	2240	msedge.exe	85
PID 2240 wrote to memory of 4400	2240	msedge.exe	85
PID 2240 wrote to memory of 4400	2240	msedge.exe	85
PID 2240 wrote to memory of 4400	2240	msedge.exe	85
PID 2240 wrote to memory of 4400	2240	msedge.exe	85
PID 2240 wrote to memory of 4400	2240	msedge.exe	85
PID 2240 wrote to memory of 4400	2240	msedge.exe	85
PID 2240 wrote to memory of 4400	2240	msedge.exe	85
PID 2240 wrote to memory of 4400	2240	msedge.exe	85
PID 2240 wrote to memory of 4400	2240	msedge.exe	85
PID 2240 wrote to memory of 4400	2240	msedge.exe	85
PID 2240 wrote to memory of 4400	2240	msedge.exe	85
PID 2240 wrote to memory of 4400	2240	msedge.exe	85
PID 2240 wrote to memory of 4400	2240	msedge.exe	85
PID 2240 wrote to memory of 4400	2240	msedge.exe	85
PID 2240 wrote to memory of 4400	2240	msedge.exe	85
PID 2240 wrote to memory of 4400	2240	msedge.exe	85
PID 2240 wrote to memory of 4400	2240	msedge.exe	85
PID 2240 wrote to memory of 4400	2240	msedge.exe	85
PID 2240 wrote to memory of 4400	2240	msedge.exe	85
PID 2240 wrote to memory of 4400	2240	msedge.exe	85
PID 2240 wrote to memory of 4316	2240	msedge.exe	86
PID 2240 wrote to memory of 4316	2240	msedge.exe	86
PID 2240 wrote to memory of 4528	2240	msedge.exe	87
PID 2240 wrote to memory of 4528	2240	msedge.exe	87
PID 2240 wrote to memory of 4528	2240	msedge.exe	87
PID 2240 wrote to memory of 4528	2240	msedge.exe	87
PID 2240 wrote to memory of 4528	2240	msedge.exe	87
PID 2240 wrote to memory of 4528	2240	msedge.exe	87
PID 2240 wrote to memory of 4528	2240	msedge.exe	87
PID 2240 wrote to memory of 4528	2240	msedge.exe	87
PID 2240 wrote to memory of 4528	2240	msedge.exe	87
PID 2240 wrote to memory of 4528	2240	msedge.exe	87
PID 2240 wrote to memory of 4528	2240	msedge.exe	87
PID 2240 wrote to memory of 4528	2240	msedge.exe	87
PID 2240 wrote to memory of 4528	2240	msedge.exe	87
PID 2240 wrote to memory of 4528	2240	msedge.exe	87
PID 2240 wrote to memory of 4528	2240	msedge.exe	87
PID 2240 wrote to memory of 4528	2240	msedge.exe	87
PID 2240 wrote to memory of 4528	2240	msedge.exe	87
PID 2240 wrote to memory of 4528	2240	msedge.exe	87
PID 2240 wrote to memory of 4528	2240	msedge.exe	87
PID 2240 wrote to memory of 4528	2240	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://drive.google.com/drive/folders/1Zry70bwVx84a_nS9aYPJ6Otgueom0_KA?usp=drive_link
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdae9c46f8,0x7ffdae9c4708,0x7ffdae9c4718
  2⤵
  PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2244,6232266430255675263,15214967463680754878,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2328 /prefetch:2
  2⤵
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2244,6232266430255675263,15214967463680754878,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2400 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2244,6232266430255675263,15214967463680754878,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2892 /prefetch:8
  2⤵
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,6232266430255675263,15214967463680754878,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,6232266430255675263,15214967463680754878,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,6232266430255675263,15214967463680754878,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4720 /prefetch:1
  2⤵
  PID:1988
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2244,6232266430255675263,15214967463680754878,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5308 /prefetch:8
  2⤵
  PID:3372
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2244,6232266430255675263,15214967463680754878,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5308 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,6232266430255675263,15214967463680754878,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3648 /prefetch:1
  2⤵
  PID:636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,6232266430255675263,15214967463680754878,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4936 /prefetch:1
  2⤵
  PID:2460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,6232266430255675263,15214967463680754878,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3920 /prefetch:1
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,6232266430255675263,15214967463680754878,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4792 /prefetch:1
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2244,6232266430255675263,15214967463680754878,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3964 /prefetch:8
  2⤵
  PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,6232266430255675263,15214967463680754878,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5784 /prefetch:1
  2⤵
  PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2244,6232266430255675263,15214967463680754878,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6008 /prefetch:8
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2244,6232266430255675263,15214967463680754878,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5988 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2420
- C:\Users\Admin\Downloads\350.exe
  "C:\Users\Admin\Downloads\350.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:392
- - C:\Windows\SysWOW64\MSIEXEC.EXE
    "C:\Windows\system32\MSIEXEC.EXE" /i "C:\Users\Admin\AppData\Local\Temp\{3BA27C59-582E-4E23-AD8B-424D3E37166D}\data.msi" SETUPEXEDIR="C:\Users\Admin\Downloads" SETUPEXENAME="350.exe"
    3⤵
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:1856

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3104

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3044

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3996
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 88AF43F775F872E88CD0AB57C10A89D3
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3952
- C:\Users\Admin\AppData\Local\Temp\7za.exe
  "C:\Users\Admin\AppData\Local\Temp\7za.exe" x "C:\Users\Admin\AppData\Local\Temp\\data.7z" -o"C:\Users\Admin\Desktop\Railworks\" -aoa
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:1136
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\Desktop\Railworks\Assets\InstallMe.bat
  2⤵
  PID:4604
- - C:\Users\Admin\Desktop\Railworks\Assets\7za.exe
    7za.exe e "C:\Users\Admin\Desktop\Railworks\Assets\DTG\PortsmouthDirect\PortsmouthDirectAssets.ap" "RailVehicles\Electric\Class450\Default\Engine\Class450 DMOS.GeoPcDx" -o"C:\Users\Admin\Desktop\Railworks\Assets\DTG\PortsmouthDirect\RailVehicles\Electric\Class450\CT-SL_AP\Engine" -y
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3444
- - C:\Users\Admin\Desktop\Railworks\Assets\7za.exe
    7za.exe e "C:\Users\Admin\Desktop\Railworks\Assets\DTG\PortsmouthDirect\PortsmouthDirectAssets.ap" "RailVehicles\Electric\Class450\Default\Engine\Class450 TCO.GeoPcDx" -o"C:\Users\Admin\Desktop\Railworks\Assets\DTG\PortsmouthDirect\RailVehicles\Electric\Class450\CT-SL_AP\Engine" -y
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:208
- - C:\Users\Admin\Desktop\Railworks\Assets\7za.exe
    7za.exe e "C:\Users\Admin\Desktop\Railworks\Assets\DTG\PortsmouthDirect\PortsmouthDirectAssets.ap" "RailVehicles\Electric\Class450\Default\Engine\Class450 TSO.GeoPcDx" -o"C:\Users\Admin\Desktop\Railworks\Assets\DTG\PortsmouthDirect\RailVehicles\Electric\Class450\CT-SL_AP\Engine" -y
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4084
- - C:\Users\Admin\Desktop\Railworks\Assets\7za.exe
    7za.exe e "C:\Users\Admin\Desktop\Railworks\Assets\DTG\PortsmouthDirect\PortsmouthDirectAssets.ap" "RailVehicles\Electric\Class450\Default\Engine\Class450 DMOS.GeoPcDx" -o"C:\Users\Admin\Desktop\Railworks\Assets\DTG\PortsmouthDirect\RailVehicles\Electric\Class450\FTPE_AP\Engine" -y
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4000
- - C:\Users\Admin\Desktop\Railworks\Assets\7za.exe
    7za.exe e "C:\Users\Admin\Desktop\Railworks\Assets\DTG\PortsmouthDirect\PortsmouthDirectAssets.ap" "RailVehicles\Electric\Class450\Default\Engine\Class450 TCO.GeoPcDx" -o"C:\Users\Admin\Desktop\Railworks\Assets\DTG\PortsmouthDirect\RailVehicles\Electric\Class450\FTPE_AP\EngineTS" -y
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1384
- - C:\Users\Admin\Desktop\Railworks\Assets\7za.exe
    7za.exe e "C:\Users\Admin\Desktop\Railworks\Assets\DTG\PortsmouthDirect\PortsmouthDirectAssets.ap" "RailVehicles\Electric\Class450\Default\Engine\Class450 TSO.GeoPcDx" -o"C:\Users\Admin\Desktop\Railworks\Assets\DTG\PortsmouthDirect\RailVehicles\Electric\Class450\FTPE_AP\EngineTS" -y
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4356
- - C:\Users\Admin\Desktop\Railworks\Assets\7za.exe
    7za.exe e "C:\Users\Admin\Desktop\Railworks\Assets\DTG\PortsmouthDirect\PortsmouthDirectAssets.ap" "RailVehicles\Electric\Class450\Default\Engine\Class450 DMOS.GeoPcDx" -o"C:\Users\Admin\Desktop\Railworks\Assets\DTG\PortsmouthDirect\RailVehicles\Electric\Class450\FTPE_Grey_AP\Engine" -y
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4612
- - C:\Users\Admin\Desktop\Railworks\Assets\7za.exe
    7za.exe e "C:\Users\Admin\Desktop\Railworks\Assets\DTG\PortsmouthDirect\PortsmouthDirectAssets.ap" "RailVehicles\Electric\Class450\Default\Engine\Class450 TCO.GeoPcDx" -o"C:\Users\Admin\Desktop\Railworks\Assets\DTG\PortsmouthDirect\RailVehicles\Electric\Class450\FTPE_Grey_AP\Engine" -y
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4156
- - C:\Users\Admin\Desktop\Railworks\Assets\7za.exe
    7za.exe e "C:\Users\Admin\Desktop\Railworks\Assets\DTG\PortsmouthDirect\PortsmouthDirectAssets.ap" "RailVehicles\Electric\Class450\Default\Engine\Class450 TSO.GeoPcDx" -o"C:\Users\Admin\Desktop\Railworks\Assets\DTG\PortsmouthDirect\RailVehicles\Electric\Class450\FTPE_Grey_AP\Engine" -y
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2520
- - C:\Users\Admin\Desktop\Railworks\Assets\7za.exe
    7za.exe e "C:\Users\Admin\Desktop\Railworks\Assets\DTG\PortsmouthDirect\PortsmouthDirectAssets.ap" "RailVehicles\Electric\Class450\Default\Engine\Class450 DMOS.GeoPcDx" -o"C:\Users\Admin\Desktop\Railworks\Assets\DTG\PortsmouthDirect\RailVehicles\Electric\Class450\LM_AP\Engine" -y
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1524
- - C:\Users\Admin\Desktop\Railworks\Assets\7za.exe
    7za.exe e "C:\Users\Admin\Desktop\Railworks\Assets\DTG\PortsmouthDirect\PortsmouthDirectAssets.ap" "RailVehicles\Electric\Class450\Default\Engine\Class450 TCO.GeoPcDx" -o"C:\Users\Admin\Desktop\Railworks\Assets\DTG\PortsmouthDirect\RailVehicles\Electric\Class450\LM_AP\Engine" -y
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4304
- - C:\Users\Admin\Desktop\Railworks\Assets\7za.exe
    7za.exe e "C:\Users\Admin\Desktop\Railworks\Assets\DTG\PortsmouthDirect\PortsmouthDirectAssets.ap" "RailVehicles\Electric\Class450\Default\Engine\Class450 TSO.GeoPcDx" -o"C:\Users\Admin\Desktop\Railworks\Assets\DTG\PortsmouthDirect\RailVehicles\Electric\Class450\LM_AP\Engine" -y
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4324
- - C:\Users\Admin\Desktop\Railworks\Assets\7za.exe
    7za.exe e "C:\Users\Admin\Desktop\Railworks\Assets\DTG\PortsmouthDirect\PortsmouthDirectAssets.ap" "RailVehicles\Electric\Class450\Default\Engine\Class450 DMOS.GeoPcDx" -o"C:\Users\Admin\Desktop\Railworks\Assets\DTG\PortsmouthDirect\RailVehicles\Electric\Class450\LNWR_AP\Engine" -y
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1944
- - C:\Users\Admin\Desktop\Railworks\Assets\7za.exe
    7za.exe e "C:\Users\Admin\Desktop\Railworks\Assets\DTG\PortsmouthDirect\PortsmouthDirectAssets.ap" "RailVehicles\Electric\Class450\Default\Engine\Class450 TCO.GeoPcDx" -o"C:\Users\Admin\Desktop\Railworks\Assets\DTG\PortsmouthDirect\RailVehicles\Electric\Class450\LNWR_AP\Engine" -y
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4532
- - C:\Users\Admin\Desktop\Railworks\Assets\7za.exe
    7za.exe e "C:\Users\Admin\Desktop\Railworks\Assets\DTG\PortsmouthDirect\PortsmouthDirectAssets.ap" "RailVehicles\Electric\Class450\Default\Engine\Class450 TSO.GeoPcDx" -o"C:\Users\Admin\Desktop\Railworks\Assets\DTG\PortsmouthDirect\RailVehicles\Electric\Class450\LNWR_AP\Engine" -y
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2612
- - C:\Users\Admin\Desktop\Railworks\Assets\7za.exe
    7za.exe e "C:\Users\Admin\Desktop\Railworks\Assets\DTG\PortsmouthDirect\PortsmouthDirectAssets.ap" "RailVehicles\Electric\Class450\Default\Engine\Class450 DMOS.GeoPcDx" -o"C:\Users\Admin\Desktop\Railworks\Assets\DTG\PortsmouthDirect\RailVehicles\Electric\Class450\LNWR2_AP\Engine" -y
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3788
- - C:\Users\Admin\Desktop\Railworks\Assets\7za.exe
    7za.exe e "C:\Users\Admin\Desktop\Railworks\Assets\DTG\PortsmouthDirect\PortsmouthDirectAssets.ap" "RailVehicles\Electric\Class450\Default\Engine\Class450 TCO.GeoPcDx" -o"C:\Users\Admin\Desktop\Railworks\Assets\DTG\PortsmouthDirect\RailVehicles\Electric\Class450\LNWR2_AP\Engine" -y
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4636
- - C:\Users\Admin\Desktop\Railworks\Assets\7za.exe
    7za.exe e "C:\Users\Admin\Desktop\Railworks\Assets\DTG\PortsmouthDirect\PortsmouthDirectAssets.ap" "RailVehicles\Electric\Class450\Default\Engine\Class450 TSO.GeoPcDx" -o"C:\Users\Admin\Desktop\Railworks\Assets\DTG\PortsmouthDirect\RailVehicles\Electric\Class450\LNWR2_AP\Engine" -y
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4292
- - C:\Users\Admin\Desktop\Railworks\Assets\7za.exe
    7za.exe e "C:\Users\Admin\Desktop\Railworks\Assets\DTG\PortsmouthDirect\PortsmouthDirectAssets.ap" "RailVehicles\Electric\Class450\Default\Engine\Class450 DMOS.GeoPcDx" -o"C:\Users\Admin\Desktop\Railworks\Assets\DTG\PortsmouthDirect\RailVehicles\Electric\Class450\TPE_AP\Engine" -y
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3140
- - C:\Users\Admin\Desktop\Railworks\Assets\7za.exe
    7za.exe e "C:\Users\Admin\Desktop\Railworks\Assets\DTG\PortsmouthDirect\PortsmouthDirectAssets.ap" "RailVehicles\Electric\Class450\Default\Engine\Class450 TCO.GeoPcDx" -o"C:\Users\Admin\Desktop\Railworks\Assets\DTG\PortsmouthDirect\RailVehicles\Electric\Class450\TPE_AP\EngineTS" -y
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1084
- - C:\Users\Admin\Desktop\Railworks\Assets\7za.exe
    7za.exe e "C:\Users\Admin\Desktop\Railworks\Assets\DTG\PortsmouthDirect\PortsmouthDirectAssets.ap" "RailVehicles\Electric\Class450\Default\Engine\Class450 TSO.GeoPcDx" -o"C:\Users\Admin\Desktop\Railworks\Assets\DTG\PortsmouthDirect\RailVehicles\Electric\Class450\TPE_AP\EngineTS" -y
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1460

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e5d57a9.rbs

Filesize
1KB

MD5
7e4dd529946992ec8e2d2d1a7ca260ff

SHA1
75b808c320f045ab3900ab708ae148410cd79f99

SHA256
d82d2ee9039a1766d68941daf1106644332407cf5b7669a56c236833c717e7e1

SHA512
31697380a2ee177699c35fdafe490c68cad36bdc7702445d61218423a8e0f3b6c249a72d8f69c90421669bb1d71d514af8adde454a58c46f66ca53979eeb0f06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8749e21d9d0a17dac32d5aa2027f7a75

SHA1
a5d555f8b035c7938a4a864e89218c0402ab7cde

SHA256
915193bd331ee9ea7c750398a37fbb552b8c5a1d90edec6293688296bda6f304

SHA512
c645a41180ed01e854f197868283f9b40620dbbc813a1c122f6870db574ebc1c4917da4d320bdfd1cc67f23303a2c6d74e4f36dd9d3ffcfa92d3dfca3b7ca31a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
34d2c4f40f47672ecdf6f66fea242f4a

SHA1
4bcad62542aeb44cae38a907d8b5a8604115ada2

SHA256
b214e3affb02a2ea4469a8bbdfa8a179e7cc57cababd83b4bafae9cdbe23fa33

SHA512
50fba54ec95d694211a005d0e3e6cf5b5677efa16989cbf854207a1a67e3a139f32b757c6f2ce824a48f621440b93fde60ad1dc790fcec4b76edddd0d92a75d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000018

Filesize
32KB

MD5
1f76396a01f9b997d149642fa19395bd

SHA1
f26dd69ff0c45d7fcd9553f0cc5caeaf5410cffe

SHA256
c519c5d085e60c32c52df7706f00daddd219415a5aa2c45d2d7d9dad1e5ac849

SHA512
0153e322815e320bbb18042488bffc0bd7a7c6c063c9919284086496c58865e4da89b3606c0f58e1b7c0a07380dddb2e2a59f967966868c21c26670c215064c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
490d645f0f5cbc5631ba7a0a88543a44

SHA1
cd0c6eca60555fcfe36ffea54c6f680aebf61ea9

SHA256
85e36925361e5e5502dad49120b729f9f250f29502bb0e7ed11dcd2c851e8e44

SHA512
84bd10374cbda81f5a2df3ce66546104d2b1bdd3443add2ef769546aeb71214e5c65c14eda4460d1fddafda0062c719eb73cc0819c9ac31338a1414396eb69f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
02242c77594084c8af71009ff8adfbd4

SHA1
81a56180d3448720af719d88ac136e8fc28c7288

SHA256
2045491e35a6620baf58de4fd0cd1e32fabb5ec68ddba0cca83cba18c73ca727

SHA512
c1ec75562d931a146337e3fb582a759b86ed6f858886b6da25801d97cc5bf63ad40bd826bb857b58764876510df6a8c9b5473108cfdd68f5f07f83474dbbdb58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
6c1cb9d4b90b6b05cf36cfb052463db0

SHA1
82eec82074008327fcb9adb63f0d585bc0c381f1

SHA256
340222f6887688dbb5ab24ee1f0cf91aa8e6ae13cf24f26408415576e7eaf88d

SHA512
13dea5a7e1528fcd8dc69c3220eef96e1f88ebfb62930e9802a4d1bc5c7af3c6748c2d6d2b7f5710a5bd350b5451a1e6935f81fa7a647e7dcbc9a0f31ed2daef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
6c9e826a21432768a2780e3f4c1a2651

SHA1
f69f4a3e82c9d796a7652036a58b684a68e51a66

SHA256
dde0d4f9d4bc1fe7b480db1677a5764e7f30829fc38da2231abf64cce7030219

SHA512
0137c88d107c22d1616c28173be5b2a77f3151acb4dae8f3d9e2404c0dadcef8fd969717c875389497cf5c44c11fd38987245a0ff5b93926c0433c7af0958f60

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c311a98dfb8603d3692739b4bbc601d8

SHA1
39bbfcb08e300ea5d2a20f2c1ba172f07f5ae855

SHA256
96314d2b5e70b13d150c9f236d233becd08041a2f534aa8da1c5574412df76de

SHA512
a3f102e730e4d14d133a59a7ac4dfec19833361ad42b7fcbef5951bf51153def113cf9b7a33217ac11b004d5ff1d49a75f751d8490cb5cf0723a699768f52a51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3f2e32c5398160a197c0d2dac6e31bf8

SHA1
531661d54ed83614ff652b179cf996e3a4ec9de2

SHA256
2e77f22f99abc28bb174037fa7635ad829ad95cd8951da85d7a37bd5941afd19

SHA512
9339135398a5bbfc98995dda3c6137b59c2266f182cdce6c7937efbf0651b339cd76c9db3875743c4893c5f9eead2c3bcb2b33f1fb8e248833d76c4b61d0b1ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
046a3c1e965385553ac219c1957695c9

SHA1
18cec5430bf6ba9f3a34d82dc6b698d542626cdf

SHA256
0d3fc962efaa90bace37f88715fd1e7670c83ffb02b58aa77b876de2a951fafa

SHA512
4428b8cd5c827475b0c826f991c14f1940e6546ed21bc045ac34ab499a37e3d4821c2986ce71ee20438b8189e4e0849a3bc4f6782320428f7ea1948d94aab306

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
677f2eb7317de4245c772cd189361cbd

SHA1
7781840971475ae8ada2aa1cb8aec4103091f078

SHA256
de4f2f16f1c68e252b3348578193de6721dc38fc5f94c02bed8792bc12dad579

SHA512
bb73c0270accca4d677ea573d128326acd8d1bd34d11a66d268ad83e37d141c5387c16a7e03a8df72d8cedfffb1492230e4cd1422d7ba9531c21427cff45be4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58b37c.TMP

Filesize
1KB

MD5
fc4b99f05c19d41b6c98f7490de80855

SHA1
368ae02124f6a320aa7108d9a7c7dacd27a66f80

SHA256
ecfcb54ff3684adc98c3a08c0686510a2299e74742857fd6d2a3ba7ded47539b

SHA512
e7073061d25b456a8b186ca3aae697b3992f758b3e410afbc251f236a1806e6ac97d762fb7c070c36220b84ae6b1ff4f8dbc87ce8e502bc00a4f270207fdb9ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
95ea4bba8097677e8f2aa009fdead45d

SHA1
0a5000e2ca0c956b4bb8fa6a2b17c5c2b49683c3

SHA256
db0ebff0f3a539d41404597d2192ba900333b7ac4f52ac46a53291eda9a78812

SHA512
6e770f72384f24c4064ebd10aaf93870a8bacfbe53ba60044be80c15faa97cc3f5438eb42187e6b0f9a46ccdf493686fdf92292a69f6acc4f35aef5bdf7d2981

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
198caeffdfee8a1052e8df367fe59b45

SHA1
db12b8eab4aed136370fe25fce11e55193740c86

SHA256
543ce34fa71cad4d96461ec14843a03ad08920ecfa2e70728d41fea8bc803729

SHA512
af13b0f5f261d6f2723d59280455171d5e5483718f05ccf3806e0405ca99c0abbcb08d3f8519cb87baeb0f617fe1dd4a9c12f90982367fdd6d714384047a7903

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
9e261e62a45a4707ff202edf0734f776

SHA1
949f69f9b76daedb46df31afd9946b4bdc2fbe44

SHA256
93eaaf3bd155ad5f0c8a8bf075c6b6d69a8329e6747d3bfb34b7a4d8ac0e4b3f

SHA512
2b4a30b2fa889959089f1a530cfee6a644bf238898fcb225bc3b9cda827cabbc345b4b7e3625404c38d2f43dde8be5e4f2b7b608fcd899a3ea3f83d0bc74fbf3

Download Submit
C:\Users\Admin\AppData\Local\Temp\7za.exe

Filesize
721KB

MD5
2395868a72bfe1fd5e888b679faab621

SHA1
7ab01a1e3b0ae8a0e59ff586a6777b78dbe67750

SHA256
8e679f87ba503f3dfad96266ca79de7bfe3092dc6a58c0fe0438f7d4b19f0bbd

SHA512
369b487da9dae83cdaf98ee45c056fc847a5f50585979638d9d8e8ba8511a31267307d885fd40399bf4c22461f82c60f6298bd7e31402e12bfebd0621b131222

Download Submit
C:\Users\Admin\AppData\Local\Temp\{3BA27C59-582E-4E23-AD8B-424D3E37166D}\0x0409.ini

Filesize
21KB

MD5
a108f0030a2cda00405281014f897241

SHA1
d112325fa45664272b08ef5e8ff8c85382ebb991

SHA256
8b76df0ffc9a226b532b60936765b852b89780c6e475c152f7c320e085e43948

SHA512
d83894b039316c38915a789920758664257680dcb549a9b740cf5361addbee4d4a96a3ff2999b5d8acfb1d9336da055ec20012d29a9f83ee5459f103fbeec298

Download Submit
C:\Users\Admin\AppData\Local\Temp\{3BA27C59-582E-4E23-AD8B-424D3E37166D}\_ISMSIDEL.INI

Filesize
20B

MD5
db9af7503f195df96593ac42d5519075

SHA1
1b487531bad10f77750b8a50aca48593379e5f56

SHA256
0a33c5dffabcf31a1f6802026e9e2eef4b285e57fd79d52fdcd98d6502d14b13

SHA512
6839264e14576fe190260a4b82afc11c88e50593a20113483851bf4abfdb7cca9986bef83f4c6b8f98ef4d426f07024cf869e8ab393df6d2b743b9b8e2544e1b

Download Submit
C:\Users\Admin\AppData\Local\Temp\~7EC0.tmp

Filesize
5KB

MD5
020ff1e03269485eb88a1bee3c499ccf

SHA1
4c129b6f8f134a52812706563495baf025ad3cb8

SHA256
ee008c4f7abff06691a9b9dce2e3b96cb4f1cc298d52a45e5ed97a28dc8b745b

SHA512
22d004ba0a3f0484a22ea6f9e4df3b4e376d4fe04a300b79cc2eae9beff14fa7aca814299407f112a97b34095899208d24d83e7f438f4551a6a9ef142e2493f3

Download Submit
C:\Users\Admin\Desktop\Railworks\Assets\7za.exe

Filesize
660KB

MD5
5e0cfb5f9d4cc24c92c7ebb184d6c9b1

SHA1
3c65a4d8897193cade0e9b67db9b8606bec913d7

SHA256
59df28612ee340037001acf8ec39a624581f37a01c4f231a62b99873d4793482

SHA512
4058b6d970bcd953b56fa53a847e7343203f7dcff9004857531a1a4b6b7beae96bffed0e3e1eac778e0565775fd8e5224e39a6898539685cd005831d50ac0228

Download Submit
C:\Users\Admin\Desktop\Railworks\Assets\AP\C450EP\CabView\DestScreen_TPE\450_destscreen.bin

Filesize
1KB

MD5
0a1e0c0966026df188d6d91062203b86

SHA1
bda3668fd0e99900b73f70ad05819875fa364d96

SHA256
d886960e83e89dcf0f88dd0d50e2ccec15be7163b779301c4f648b26922308b4

SHA512
ed1a8aad83ee48955ea2cd66d204e2f87feb2ca980410335f878f98138d3840bb97ce49ab4b9b6e7835f6bc5cd842fc82b28e3d44f644a0b6e23fd02d685e3cc

Download Submit
C:\Users\Admin\Desktop\Railworks\Assets\DTG\PortsmouthDirect\RailVehicles\Electric\Class450\CT-SL_AP\LocoInformation\pl\Description.html

Filesize
397B

MD5
b0be4fe10fce93d2bfc9e2ee09a18a83

SHA1
ad1cc24fe84287d253cc3de40bbc9c279110c197

SHA256
e1e56455147b18193a725cabdeb1f684a9f4c959436d7ba1a7762e7f34d5aa60

SHA512
5c0b2d209532d6c91ceb781d83a5dddace7f6e69d89e5b6b3e867c0031c7ea162a2fbdb52c5ccf75426b323bd39ad024e2821cc6324501efbf9565584808f3f7

Download Submit
C:\Users\Admin\Desktop\Railworks\Assets\DTG\PortsmouthDirect\RailVehicles\Electric\Class450\FTPE_AP\EngineTS\TexturesSWT\Numbers\Class450 Digits.bin

Filesize
1KB

MD5
6a198bff8642f50370a62988fc8598b9

SHA1
f79718e75148842dd91f5a717b18c37b7193d564

SHA256
8fe6f9622d826b2695786173f8dbd208ff0cb6121d17bde636f7c5070729cdcc

SHA512
10926885e497fed4660931df7fa6203abbe89197172c4bcb13cff6288b1fa183b8ecc515526151c0f70a1e143a025642470b14e187c4647de3bf31358ccbfc1f

Download Submit
C:\Users\Admin\Desktop\Railworks\Assets\DTG\PortsmouthDirect\RailVehicles\Electric\Class450\FTPE_AP\EngineTS\TexturesSWT\Numbers\primarynumber_0.TgPcDx

Filesize
32KB

MD5
a91c1d2ec2bcaf8d394bdbfc0279ac3c

SHA1
994da4ffba979752398754088523a0cc9fe2ef2b

SHA256
efbdc837c174c6fa97d90a7c906a4383995c1c62154d4b9d25b3512e00845eeb

SHA512
b1cd921a1bb14b3ddb3d8352e8f8e19fb9234708697d222400b4905ec273c1b5f9588cd41c664d5f20cc9789139cd18a370cd5c729200506001c9e4bfdb68240

Download Submit
C:\Users\Admin\Desktop\Railworks\Assets\DTG\PortsmouthDirect\RailVehicles\Electric\Class450\FTPE_AP\EngineTS\TexturesSWT\Numbers\primarynumber_1.TgPcDx

Filesize
32KB

MD5
db2f3e40c25dfa6303267cc6fdf852c2

SHA1
2d93a721056e04678a2a1e107c35e3fad35b450b

SHA256
e268379f74020d6348c8c306bfabad81647076109aa33bc734cad3d57a60765a

SHA512
568c42b4d15c44ecbd77250034c2d46641d69f57aedb967cc4f718b8d4793e08733ba3f78b8868cad8afe45544dc22503b0c9c08540b99f34236f30601d81e6c

Download Submit
C:\Users\Admin\Desktop\Railworks\Assets\DTG\PortsmouthDirect\RailVehicles\Electric\Class450\FTPE_AP\EngineTS\TexturesSWT\Numbers\primarynumber_10.TgPcDx

Filesize
32KB

MD5
f978bb2ac11d686b3ee75705a054e838

SHA1
ac9a5955d46c62daf5877fd69770b9ac43414f4f

SHA256
41387cba5b6cfcd87a510a0b5b6efea27dfa031d8d4601936fe19924a5f615ff

SHA512
90d325fde8c6574657fcf2673c61c32343da8a680fad0f7366972480b04c258976e42feab65393202f32bbd6c9e93b22ba2b49d680e9a39d655392099a9097c2

Download Submit
C:\Users\Admin\Desktop\Railworks\Assets\DTG\PortsmouthDirect\RailVehicles\Electric\Class450\FTPE_AP\EngineTS\TexturesSWT\Numbers\primarynumber_11.TgPcDx

Filesize
32KB

MD5
30725a9906ad7c198960bd5217d8b2a4

SHA1
a52da85056f16a5950f11eb89a9950ec4b53096d

SHA256
9dd004e6b8c9e3e70eaa1d6611e952ac938e56417a1b591a3869ef2da7cbb18d

SHA512
5a38f6989e7d8c3de1714fd082e96e54b8dbfcfc9a1bf5b2289470ad40a4d13e148171575d93a42b54ef72bca66612265e4b9ed66a176061b927b7090bc1756a

Download Submit
C:\Users\Admin\Desktop\Railworks\Assets\DTG\PortsmouthDirect\RailVehicles\Electric\Class450\FTPE_AP\EngineTS\TexturesSWT\Numbers\primarynumber_12.TgPcDx

Filesize
32KB

MD5
6b5e32f4354bbf0a8851670851cca99e

SHA1
402658d00ac51f4a37beee72dec0226ac3c5b8cd

SHA256
202860a2dd6a5910c30758ec1cf180b7df6e07096a7c54d8e2a2538c4c9e12ff

SHA512
1a9627a559ec16ee0d64173e09208b9e0abca22f4aafe3dc75ba221c976ec2e5b95c94da09fc0c79f4ce315f32f634b7b8904fa1a60862d742c1ba79485d0786

Download Submit
C:\Users\Admin\Desktop\Railworks\Assets\DTG\PortsmouthDirect\RailVehicles\Electric\Class450\FTPE_AP\EngineTS\TexturesSWT\Numbers\primarynumber_2.TgPcDx

Filesize
32KB

MD5
90dfd6d1043815dd854ccd2bcac77830

SHA1
ed147f6eea5361be7d3790f1e9c4b971ea3c9e7f

SHA256
7621a3329a6a50ffbdc06fba1b1b10c1eb1a60d3b2e7ce0d9fe599aab3db7b5b

SHA512
f0cfc6301696c4040dc99c68a736a1e504649b20d99bb368afb44f76e215528685641494175dda959a381865243b931a8abcfff0d84ca824fde83b25bc1b306a

Download Submit
C:\Users\Admin\Desktop\Railworks\Assets\DTG\PortsmouthDirect\RailVehicles\Electric\Class450\FTPE_AP\EngineTS\TexturesSWT\Numbers\primarynumber_3.TgPcDx

Filesize
32KB

MD5
211c902efc753940de992e47b9cd9cc9

SHA1
a8e0dc4bd1a8dce09dd8b56b929262e50eee0235

SHA256
77173e0842355d64734ea4337bacaa86716cd2d46ca431c589aa26857e01a9c9

SHA512
f77a6ac54a240adfcba764672ef5fb1240c73d5e46cfc8e89035c0e65d075417e453c3db6a6d8783062e26e501e0e3fc515bbf4def2e33d80b1e2eabd0b49177

Download Submit
C:\Users\Admin\Desktop\Railworks\Assets\DTG\PortsmouthDirect\RailVehicles\Electric\Class450\FTPE_AP\EngineTS\TexturesSWT\Numbers\primarynumber_4.TgPcDx

Filesize
32KB

MD5
c88688901cc7f589349712ffad184736

SHA1
8b318ce9ec1135fde2527b8837ea960754f5bdca

SHA256
bd6902e08d0da5ae03cdaa6e5fcef9dd92eb2d029e5850a3e8a8d23cb3c675b6

SHA512
8c3a2b1bd3818d60d34d400fb76dbaad44e9249b73b1f9b26c139cc9f4d5c9cf6c270e41f31aa11f63d081453bf6e2487c04d806644592547c4e8da3090f0373

Download Submit
C:\Users\Admin\Desktop\Railworks\Assets\DTG\PortsmouthDirect\RailVehicles\Electric\Class450\FTPE_AP\EngineTS\TexturesSWT\Numbers\primarynumber_5.TgPcDx

Filesize
32KB

MD5
6f64b0f39ce9c16fafd72403e146d3a6

SHA1
b9dffec87e2105565095f228ebe62b498b3c32ba

SHA256
2c6b99ea4cd73cfc52b7f0b87e099b20ae8dbc580accad6b00c1bb295c8773cd

SHA512
572084654cd5ae366742cb4adc79f2936f4239faf24cfb6b76579559aefae012184fe4013cb2375c197d753ec993ebc1fea4e350c645ce8f50827d38a9476db0

Download Submit
C:\Users\Admin\Desktop\Railworks\Assets\DTG\PortsmouthDirect\RailVehicles\Electric\Class450\FTPE_AP\EngineTS\TexturesSWT\Numbers\primarynumber_6.TgPcDx

Filesize
32KB

MD5
09ea7b71803df6e152ba704a16da8d37

SHA1
7296981dd19f20f897d65651ba0f3686fa2bed7f

SHA256
75937d280832db9093cba5566d40dbfb501436229589ac0241162aa46d310067

SHA512
84f951f050dcd145c6c0d64b2cb4cc2b306150c453e08f2fe739b0eead2e7520674e3e0ce1ab8fd935a1eeb90a9c070929813268035d58c0f980f20cbfa088d3

Download Submit
C:\Users\Admin\Desktop\Railworks\Assets\DTG\PortsmouthDirect\RailVehicles\Electric\Class450\FTPE_AP\EngineTS\TexturesSWT\Numbers\primarynumber_7.TgPcDx

Filesize
32KB

MD5
af73b7842296c37b1273aa1e7437463e

SHA1
e3e0961a25250c65361b83d9262bab4e4b729fec

SHA256
d1d38da264b1b3957fe60607995861e3f9e42c893e6e1c8ec0ea2a3e2f387106

SHA512
3fba2e3727bb5ba83b4b80d3a7c55658a9accd8bfaa3b1fedc97ac8ff472a3a36f83272d5eb77d9fc9dece8f83b699a45d7cd951d266ca53448b6c878e037b6a

Download Submit
C:\Users\Admin\Desktop\Railworks\Assets\DTG\PortsmouthDirect\RailVehicles\Electric\Class450\FTPE_AP\EngineTS\TexturesSWT\Numbers\primarynumber_8.TgPcDx

Filesize
32KB

MD5
8b3e231a5074c0def08aaf57271344b5

SHA1
509fce6a487c1c3acd4e352a46577628a1efb33b

SHA256
fd3e262ce44bb57fa62e19fb9bab0b9d9dcf97e904d288694b41874dbb025c92

SHA512
15208710f8935f7840e6fcfeb2ae983389b93e890080772ac134a04f6f7fd08ccf60d72bd256d3b035a7cea4ea97c20741dbcedaea914547167c9912ba3ce86e

Download Submit
C:\Users\Admin\Desktop\Railworks\Assets\DTG\PortsmouthDirect\RailVehicles\Electric\Class450\FTPE_AP\EngineTS\TexturesSWT\Numbers\primarynumber_9.TgPcDx

Filesize
32KB

MD5
b57ce850ead776e4fbcfa4374c0d9592

SHA1
ffa119c4998e4ada26f1040492f5ea324c0b736d

SHA256
96cc6fee66c850c746bfce1598a18c9663b00f2bc263efc3587809da0e693405

SHA512
3a1ae152630b464c9c8f769320eb1693f59156b2bb2816555f41ff538aef65c614985846edc02ce083230c2ab095058fe0ce57c10a7ed73a9ad8c8dbd2243126

Download Submit
C:\Users\Admin\Desktop\Railworks\Assets\DTG\PortsmouthDirect\RailVehicles\Electric\Class450\FTPE_AP\EngineTS\TexturesSWT\bogie.TgPcDx

Filesize
1.0MB

MD5
b46b0db42a2bfa519b4d20af797e3fbd

SHA1
8be4ab437ae2408929868627f857bab09aba5fbc

SHA256
c4c8037e026f8e3ee01e52811b3a97379aa3ff7dce721c510df56aaf2f147fc0

SHA512
19e5d0af80c60f8b68d22f30b7207ec232799d85da67079f3c649913bdad886f9189e401f729e0d67967b84e20d8cc244d21acc5b72b79aef024a5bb85bda7a5

Download Submit
C:\Users\Admin\Desktop\Railworks\Assets\DTG\PortsmouthDirect\RailVehicles\Electric\Class450\FTPE_AP\EngineTS\TexturesSWT\bogie_noshoe.TgPcDx

Filesize
1.0MB

MD5
d2b51e99eccbc1346c6878cef756bd6d

SHA1
5eb84d5112d7b914643ca6935de6c180668f06b2

SHA256
ef4fe338913241fd7349c77077ff81b946d718c87c897e4f17fefed616bb63cc

SHA512
cdb22cb4ebbf6e3a0fa277a8fd982dbdf9f1438be5f68bda578dd31208eb206f6a863a8264930a391ebc6d3bd3dffb0ad465d5b5c9b5de705827fd9581255f16

Download Submit
C:\Users\Admin\Desktop\Railworks\Assets\DTG\PortsmouthDirect\RailVehicles\Electric\Class450\FTPE_AP\EngineTS\TexturesSWT\mks_bump_nocomp.TgPcDx

Filesize
1.0MB

MD5
eb74bd74fdfbe9e55dd08babd8481059

SHA1
38c64aa9290de24acfa84793c76ce72fbff17d38

SHA256
3eff66ba66c92b644d0b8e1a50e85f3568cb7cdbb69955dabc5e9337e5784f0a

SHA512
75d26e06273dd08e375a2c0d99afb67e6e82b7311e8eb9a5cdd315cdb46cc8ac1b815d46f661753cc5fc16a896c8c5331b53f7512235d880908d30903b17a7b7

Download Submit
C:\Users\Admin\Desktop\Railworks\Assets\DTG\PortsmouthDirect\RailVehicles\Electric\Class450\FTPE_AP\EngineTS\TexturesSWT\softshade_long.TgPcDx

Filesize
5KB

MD5
7755fae5d92dde3e1383d5482abfe34d

SHA1
3ff2faa5820e16c1cbe1790ca4f7a6501087cbd3

SHA256
9f30f242f663ef44e60f955ef4d8d321d502e4276d30297f3f01277389bea397

SHA512
5b425a35f456a334c8e343caf8d5436acb39a52b34fd105c48c3bc9307a4632be1055aba74c23dea603f0e64fbe46fd2cb77ee6e9485f4da884e98ef9352389e

Download Submit
C:\Users\Admin\Desktop\Railworks\Assets\DTG\PortsmouthDirect\RailVehicles\Electric\Class450\FTPE_AP\EngineTS\TexturesSWT\swt_logo.TgPcDx

Filesize
128KB

MD5
0713e6e57575087ba93e2432c3446098

SHA1
ba6f18d3f3af415d0ad63cc1e19f20a308c73235

SHA256
ec71d58effa0152f7218857b6e457968fe9491aa658fa6cb8ca7690909518f72

SHA512
fdb8edd8fd61e5aed43a6f0e3dff3ab583f851235b048a5e15467849ab488827d7861e1fc81165ae6c291a45492b45e3dae6d6dd76fba74ba198df87c94ade3e

Download Submit
C:\Users\Admin\Desktop\Railworks\Assets\DTG\PortsmouthDirect\RailVehicles\Electric\Class450\FTPE_AP\EngineTS\TexturesSWT\underframe.TgPcDx

Filesize
1.0MB

MD5
e5c0598721ca76e2969dbb0214ff7204

SHA1
df3f1fb0cf4f12a29087bf46b68646576e86f21e

SHA256
fedbf5b97c2a5bf0e3c6ead77087ca9dd9a233da26215dc4dd751bd630a625a3

SHA512
11efe772c8cccac214578a4e070026b099784841d5f251a067f691557fcf86fa729bd20544b0e34434bb9c0922b25be7ca0e06a5eb0b0356510d525679814d9d

Download Submit
C:\Users\Admin\Desktop\Railworks\Assets\DTG\PortsmouthDirect\RailVehicles\Electric\Class450\FTPE_AP\EngineTS\TexturesSWT\underframe_tso.TgPcDx

Filesize
1.0MB

MD5
719819e438c71b743fed543162d37776

SHA1
7fc4c453f336bac5f94f50c9ea15d67140d03586

SHA256
5695f956733d85ce1da3a9911545596c8e6fd8c0448b7b98269c250ce20ea8fe

SHA512
2c4bbfffc1fd7f8ddc3894fbd097469dc542ad28c533f0c87d7ee0d6287b9bf4f7ffa0b1e74eaaeb56d6562236da57528281323bd82768817c30725e35f77490

Download Submit
C:\Users\Admin\Desktop\Railworks\Assets\DTG\PortsmouthDirect\RailVehicles\Electric\Class450\FTPE_AP\EngineTS\TexturesSWT\wheel.TgPcDx

Filesize
64KB

MD5
4635211ed49c44c980439bdd38f6423a

SHA1
3b12aefcac21789f889857bc09549e1580a907c6

SHA256
3b42020d8536d98ada8df8b90ecab748054629ce3e604ff00850ccfbdb4df98d

SHA512
00a06db3d4ea5673cdefaf2485c84f434226d37c09131f1de28085499ec6aaad44ef4c191607791fd6e240e31ceb93721e9ef534c97c03822d6584b58c7fc7db

Download Submit
C:\Users\Admin\Desktop\Railworks\Assets\DTG\PortsmouthDirect\RailVehicles\Electric\Class450\FTPE_AP\EngineTS\TexturesSWT\wiper.TgPcDx

Filesize
1.0MB

MD5
9f37d19f492ffccb281c40b3129bf6dc

SHA1
9bfe97513c56e823be16ab41b9acf81f7278c0c7

SHA256
1d368c09af60c8a1b77837e9e57a1ff271db9a295155eabbeae0dccfff64c63b

SHA512
2cefada3295750291270a9a5a9163822f9d61db9fc008288f18c5355e20b5ede8e6f3a5e27f3ab31e4ea4afd9ca658dec176863b4e7a419efdfea07bebaab41b

Download Submit
C:\Users\Admin\Desktop\Railworks\Assets\DTG\PortsmouthDirect\RailVehicles\Electric\Class450\FTPE_AP\Engine\TexturesSWT\Destinations\450_Destinations_4.TgPcDx

Filesize
1KB

MD5
65370e2cfe0dc227170d6e7072f2a914

SHA1
f9f98a37247b03eff35a7ea3c5aada326b13eb8a

SHA256
e10afcca2d82c180e63111c0d5e79889bd3d26e38c2eccec27b3c4e2b4747621

SHA512
dbd7a1bb5be326be5cfeeb7d1e94c681f1eeb32249b0ca73eb33526cbe6eefa88d6fa309498a7ceb0af95360508cdfe27c9cbba6db8016df9052ceadfbd1ea1d

Download Submit
C:\Users\Admin\Desktop\Railworks\Assets\DTG\PortsmouthDirect\RailVehicles\Electric\Class450\FTPE_Grey_AP\CabView\TexturesSWT\Controls_low.TgPcDx

Filesize
64KB

MD5
c2d0440561e65bcdc2bf9f663513fbc0

SHA1
3a411c298f277700d714d9728dacad82723e3cc2

SHA256
41432f33e138e2fe0098d6222baabbac313a304dd867d4b066b66cc38ae9c3e4

SHA512
d57148a865a5ce97dac2090e33279ac854ad2bfe9990584f92605bd17dfa0df0f4d3d2f4a3bab67ed06f03625678b0412cbc18d78bd2ac47e5de4a7d37408fa6

Download Submit
C:\Users\Admin\Desktop\Railworks\Assets\DTG\PortsmouthDirect\RailVehicles\Electric\Class450\FTPE_Grey_AP\CabView\TexturesSWT\Decals_low.TgPcDx

Filesize
64KB

MD5
f6faf538b966380c6b5ba159947378df

SHA1
bdf89156ff045027bea4bb926d44963f659f7b7a

SHA256
ce0cad4361fd04dc5328c4d3f0550dc00684c49a8ab285ff14a745eb69537fcc

SHA512
dadbdd9581e35bd160d3fcd042e0f67d0deba19b07a4f2e9ca8e9b97b9a867da0b98661156156bad688c4d352d250e94ca34274a664f8f0571a211ab8b502361

Download Submit
C:\Users\Admin\Desktop\Railworks\Assets\DTG\PortsmouthDirect\RailVehicles\Electric\Class450\FTPE_Grey_AP\CabView\TexturesSWT\DeskMain_low.TgPcDx

Filesize
64KB

MD5
550b4ef6bdac40f47feb00f674e8e23d

SHA1
b3c2dd344f537679f6cabfebe007f5070e79f236

SHA256
0b46b4a3b7f9f958afc73a5e1ef77f691b89409425826dc0c928d282c0f51f22

SHA512
acb2c51e875c63c397aef43082cfc293c1d2a57bf403ee13bddb992a4aa7d77d1b2957061f1cb03fd6a23c6d8449fa3edbb2666b9150a5c5febd0408b397a83f

Download Submit
C:\Users\Admin\Desktop\Railworks\Assets\DTG\PortsmouthDirect\RailVehicles\Electric\Class450\FTPE_Grey_AP\CabView\TexturesSWT\DoorsWalls_low.TgPcDx

Filesize
64KB

MD5
6ac3cff80051bfa2c9ddb43abf35fd29

SHA1
43a83f44049d4ad0b344a587b33d5146f26f6fac

SHA256
365e039c62773d16c4b5dac8ef6ea9e29e185b5eb0a2aea53335920a37a4dba5

SHA512
e4644da7bfcb0ff0c3f97971b263513e9bb75024c0a1eb60290abbbbdf99fa3c2900fa84f79003519a34b779694e522eb90d62227118677b7f9c0b683c2e56d3

Download Submit
C:\Users\Admin\Desktop\Railworks\Assets\DTG\PortsmouthDirect\RailVehicles\Electric\Class450\FTPE_Grey_AP\CabView\TexturesSWT\FrontSecondmans_low.TgPcDx

Filesize
64KB

MD5
cb3ead64b6ea319b8b7d029128fa51a5

SHA1
0acd0b5a381dff5dba373611aeac172af6db247e

SHA256
ef478f538b7c016c77b440eee2f8a22c1243e413619de8a93ff424180e0b5b88

SHA512
ae437cc2339b5ff7d426db59878faa556c15b5e7562478c0d7c04331084fb92336776833586ea6189bc44344c94bd8dd9580de682346239c190c97725db87fd4

Download Submit
C:\Users\Admin\Desktop\Railworks\Assets\DTG\PortsmouthDirect\RailVehicles\Electric\Class450\FTPE_Grey_AP\CabView\TexturesSWT\GSMR_low.TgPcDx

Filesize
64KB

MD5
326e1e0c66d01a992a7fcd22ef27e865

SHA1
1807fb3411ef2162ae667a551ca9806898ec9661

SHA256
f6c73c561b36bce1832c91467636b496ef02a1f553118a16cd22b480894ad652

SHA512
cac8e9b502ab1d5123073a084bc45ce1e50e85f6dca913d887aac7cfb3eac4854832af3a595f49b3239cd2051f8b362c759e64a8d166385bbb5d04242186f736

Download Submit
C:\Users\Admin\Desktop\Railworks\Assets\DTG\PortsmouthDirect\RailVehicles\Electric\Class450\FTPE_Grey_AP\CabView\TexturesSWT\Gauges_low.TgPcDx

Filesize
16KB

MD5
1270e621ad5bc7657a36d016246fbf27

SHA1
5ff8637922071e5f264a41e40d39b2ce5fe02ba7

SHA256
d490ea9c5bab555d258bd6ddddbd81e8601728239d81d5cd598e711616819b52

SHA512
65e9b46a286cba1746c3456ccdf4d9ffc41cfa282a6122988fbeb89247f2fa62dcc2ca5816a5986fe7077de5ec6f9521fc34470c0778250e8327350bc8070400

Download Submit
C:\Users\Admin\Desktop\Railworks\Assets\DTG\PortsmouthDirect\RailVehicles\Electric\Class450\FTPE_Grey_AP\CabView\TexturesSWT\Phones_low.TgPcDx

Filesize
64KB

MD5
e1906e8d4b7d69e609ad0ff2e8d82e3e

SHA1
6f28422b4bd21985f46a2074fc3172acf7895090

SHA256
33dadee49376814d2daaad817f35dba4fb50d090e1109d6528ea5ab5f7669124

SHA512
aef5d9410d2f23bdb8664d17837d59eebf4d32855c3aa300ebe17f528c046dc98a2e090e9c9cde488d4179a4420dafdccb4e23b60e25e4d258cf5ce839ef25b6

Download Submit
C:\Users\Admin\Desktop\Railworks\Assets\DTG\PortsmouthDirect\RailVehicles\Electric\Class450\FTPE_Grey_AP\CabView\TexturesSWT\SeatMiddle_low.TgPcDx

Filesize
64KB

MD5
3126467ef90f04e06356dc8cc887ada1

SHA1
c6f61b3c89de5076f361c4e5994de2a61bd65445

SHA256
ab67abf6e25b4af04754bf23fc3161e2e7f26f3b208870be34cb45162849e37d

SHA512
f92f5b78b40d2ef3b50cb1caa1ebfcd877a6cbf813e3f260777abddcc9273e6c324c7a13e7e04c85d9d7092a6641929c984746f039a404edfb109e8d7c104bc3

Download Submit
C:\Users\Admin\Desktop\Railworks\Assets\DTG\PortsmouthDirect\RailVehicles\Electric\Class450\FTPE_Grey_AP\CabView\TexturesSWT\SideRears_low.TgPcDx

Filesize
64KB

MD5
d3289863b3ee7dd41a43c5e52f67d226

SHA1
2365ffe563f0bd52224d5fb06bca5297f2c82c76

SHA256
448eb5c449b74eadc49d9b15535fac53fa27c27666293d4717b319c0429161af

SHA512
587f2a3be0499963ca34b3dccdbca0ea0c885837225e135e631471b473dde455bd0502b1a56ba321ccc4485f0e2f8253f09641613a1d0ef59775ff66eb151245

Download Submit
C:\Users\Admin\Desktop\Railworks\Assets\DTG\PortsmouthDirect\RailVehicles\Electric\Class450\FTPE_Grey_AP\Engine\TexturesSWT\Destinations\450_Destinations_6.TgPcDx

Filesize
1KB

MD5
4cdd195f24e9c0c5ecb860a4c16a1ffc

SHA1
fc80c247b3b9f1b523f55d43283dd383d4f6480d

SHA256
24335c49d981dd97a7142298dfdb81f676d180d15b93210a0bc4041502c5e1e7

SHA512
57e1211750ca1df5c3c0d0601cab2bf760d0ae9287edd4f543b55470fa2537ecce4c82d25f5f8da72b7d36a49e89e138be18cead4815bf3a6fa0fafa44d9dc4a

Download Submit
C:\Users\Admin\Desktop\Railworks\Assets\DTG\PortsmouthDirect\RailVehicles\Electric\Class450\FTPE_Grey_AP\Engine\TexturesSWT\Destinations\450_Destinations_7.TgPcDx

Filesize
1KB

MD5
749ec7e7960db939812fe478568bf2e2

SHA1
98c3e78e829328679b698f63c4278eb06105bfb5

SHA256
800c26ebe7762c5a7689bb77276d1a9edbd048304ae779496efc4adef90b16a9

SHA512
b55ddffbe487f7e0d824a8f6d6be0b1bf1002d4fb424b00dfc91f8f58be651194d8821aba0c4b10aaa8c647821d4ec0535f83beb02727fda4856bcfeb4477597

Download Submit
C:\Users\Admin\Desktop\Railworks\Assets\DTG\PortsmouthDirect\RailVehicles\Electric\Class450\FTPE_Grey_AP\LocoInformation\En\Description.html

Filesize
1KB

MD5
0c27c582a535a8aa77565b056f09ffdd

SHA1
0e116d4b8acb9d828d468703f03ab689a1bbc334

SHA256
2eaf099236f415740e8e4482c48998de35810fec49b53055af8ed25f6b9236ba

SHA512
3be4c129cf08782f8b5fd24da28f4b754f9eb0e9afaf6a0ae93293822df13ce5903dac86ebf6ca83fa2ce328f97165fc49dc3892199e78bb1fa762e42977b254

Download Submit
C:\Users\Admin\Desktop\Railworks\Assets\DTG\PortsmouthDirect\RailVehicles\Electric\Class450\FTPE_Grey_AP\LocoInformation\de\Description.html

Filesize
1KB

MD5
6e18a068f297c8f3a93228875f116c20

SHA1
1329cbbf60a7b3259ca68460377f321047fb0392

SHA256
07fea71542ed1c5d602cf27c64fd695b5ae63d4aa64c9efe12ce1c4741beb14b

SHA512
db92b8e655a042756f18fb6ca7180102b44e6a90833dbf4535eafb25f42c1d9c4e683b6b3044a9e3758e6d79451d0f358c81ca0db47ca9f1be30c05b6caf1151

Download Submit
C:\Users\Admin\Desktop\Railworks\Assets\DTG\PortsmouthDirect\RailVehicles\Electric\Class450\FTPE_Grey_AP\LocoInformation\fr\Description.html

Filesize
1KB

MD5
872e4c4f32bfdf754c2524a182e6d7a9

SHA1
381dc97829b37ef18b9b4f5523ed5a7c27d54032

SHA256
cbdd7e5be18e95921141a32315970da76431f4b004090b8df4db19a66c1cbe25

SHA512
6677314da46bdefa62597128b9cad42ab835cab6699f1a832052903a382cc18604df9e244f7eedb3f4708c6f4c4a40de55e97b00e64b265294d47d3cac2d9996

Download Submit
C:\Users\Admin\Desktop\Railworks\Assets\DTG\PortsmouthDirect\RailVehicles\Electric\Class450\LNWR2_AP\Engine\TexturesSWT\Destinations\450_Destinations_1.TgPcDx

Filesize
512KB

MD5
f7904f36c295a3de86b193246ef9721f

SHA1
2dad21f0f3e72b93aad5678604bbd192b8d1b13f

SHA256
ab2e9723851e11c816eb5f3797d28314568496e50f152be810de6fddd7427484

SHA512
88468ccdbc2c60d0cccb34941a8b8a94e68c5f44ab96ee313019a7bef5464658661688be44f41b0f8762cc353ce16eecd48eb58e8965dd7b7dc58fc59cba4bdd

Download Submit
C:\Users\Admin\Desktop\Railworks\Assets\DTG\PortsmouthDirect\RailVehicles\Electric\Class450\LNWR2_AP\Engine\TexturesSWT\Destinations\450_Destinations_2.TgPcDx

Filesize
512KB

MD5
46bf4fafb4dce7a7248528088b7aa5f0

SHA1
2a09fe81f0b0aa8b6db2ff92bab524286b1d08cc

SHA256
806752ae3b282ecf3daf31979f8673a4067256484058ef04259c3c324007963e

SHA512
6a610d8c1fdb55a988eaa9b4e646ae47146876c95f445771c026f46abba65574d74a4ac723ed503a77e70e730a9eb2412d93cb0a7d569e53f26b49caa3a1a8be

Download Submit
C:\Users\Admin\Desktop\Railworks\Assets\DTG\PortsmouthDirect\RailVehicles\Electric\Class450\LNWR2_AP\Engine\TexturesSWT\Destinations\450_Destinations_3.TgPcDx

Filesize
512KB

MD5
f8c023870119b1c76dfe8d4345d39876

SHA1
be19b2430f6aaf7832eb21be7079b33c2dc2aa5a

SHA256
867467233f6b030fa4d09c4adc7cece6583b5a86be91a767541ab6050b8fcdf4

SHA512
632309e2347b5f3441463e78c8d5aefe9d6788c4df8b6586c02c19817f96b4a1d296ad5248e96feab9452b52f64db0eeed9298100335c22f05a34be0e34f8467

Download Submit
C:\Users\Admin\Desktop\Railworks\Assets\DTG\PortsmouthDirect\RailVehicles\Electric\Class450\LNWR2_AP\Engine\TexturesSWT\Destinations\450_Destinations_4.TgPcDx

Filesize
512KB

MD5
87156ac8c3b1306f9a605d580d0047c8

SHA1
d977c107fdc255572b76139ee2f15b5755237352

SHA256
d88261ae286d5063d7a1282d39cc0943ce80a1e721327d276c1b540d2d79aabf

SHA512
1e4eca12a21501e5879b2943a4648c8cdf95bc4bb96cf09582d9e2417b84e299d5663fab0ca4fdfd52088637f61487cfb8f2a508b2da22957941ed68370b3b34

Download Submit
C:\Users\Admin\Desktop\Railworks\Assets\DTG\PortsmouthDirect\RailVehicles\Electric\Class450\LNWR2_AP\Engine\TexturesSWT\InteriorTCO.TgPcDx

Filesize
1.0MB

MD5
03ac08a9d0b2f7f14a56a6cc02292852

SHA1
03ffd2dac300bf9aa63d836502b53242b46c6afb

SHA256
2efbc01ee6e9f00abe11ab9f3535f2bdae9ff88f5ae7d7330c0068717c9c91f8

SHA512
253f58db703b36dbc297dbb21b934e8215d8bd128661ff3f8f4433ab3ec00a40c76b4c0c411a2e765d82224154daa256251f6c5741715ab9d5eb6bc334d39c28

Download Submit
C:\Users\Admin\Desktop\Railworks\Assets\DTG\PortsmouthDirect\RailVehicles\Electric\Class450\TPE_AP\Engine\TexturesSWT\Destinations\450_Destinations_1.TgPcDx

Filesize
512KB

MD5
59ff796076632093f432bac5fe04e86a

SHA1
05eaad8fbd477d9ae6abeb7b5d04ab0344ff15c5

SHA256
65c01fd60ae2b249837acf738b5e8198993bfa210016d1778d0991ccb323a3de

SHA512
7705de9222bb29134899fbdee961f6d563505580e1e880d1f50ef9eaccef2dbc9ff98773424385c120421b24c767fc860314221c7c2fac604487c8b353f3ab46

Download Submit
C:\Users\Admin\Desktop\Railworks\Assets\DTG\PortsmouthDirect\RailVehicles\Electric\Class450\TPE_AP\Engine\TexturesSWT\Destinations\450_Destinations_2.TgPcDx

Filesize
512KB

MD5
9ce493b2c4a0d547d1888df6f7c16fe7

SHA1
cefdc91489a3d8a3c5954ccb024c808aace32830

SHA256
306d4f987457167a8c75af0d40ef7ee744d6a4481db267a19ec046dc4bc3a452

SHA512
3f78135d6ab8f4069e8fa1238c8275510ebedb126a2f9ee106445ef24d2c023f9ec9a5503ac9c6c71bb29b4d4035ef542696999e9fb4de719cf0adf034c88acb

Download Submit
C:\Users\Admin\Desktop\Railworks\Assets\InstallMe.bat

Filesize
4KB

MD5
845672429eb59f67ccba83df5cd39c7f

SHA1
5de82c73ad782f401f2ad3bf224dded9a71e3917

SHA256
557523723cf068cbced7d11ceeb3d6f49c21ba6d740993a5750cf2245e52bcf9

SHA512
5a9e448286905cc51086e364d7e55f644cffae5b5bae038f21ea135d4f85861a8e2f628bab9247f3630be4d6fc3300f2eabb0c690f0453b1666309e9954a2774

Download Submit
C:\Windows\Installer\MSI5A29.tmp

Filesize
105KB

MD5
740ad3d6be4abd39b6a8cfbf792c1d5c

SHA1
88ea395a65a06c3e151159292f0b25f0aeee9eb4

SHA256
e440a6366f7c38f288111273f5ac333e26213b47ffcbd033a15ee84eee0981c9

SHA512
c2953e16aa6a53831d395fd3f647a218735a6668b8275cf60376196bde931a41891c328e39d974e2cff9058fd22f6b0c77ba67a32635110a99ce98fcd9bc0c3e

Download Submit