hxxps://www[.]nexushub[.]live/_files/archives/5ff4f1_c3352fb5f439479a84e403ac88396ef6[.]zip?dn=Enforcer_Setup[.]zip

Analysis

max time kernel
123s
max time network
125s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241211-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241211-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
07-01-2025 22:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.nexushub.live/_files/archives/5ff4f1_c3352fb5f439479a84e403ac88396ef6.zip?dn=Enforcer_Setup.zip

Score

8^/10

paypal discovery persistence phishing

Malware Config

Signatures

Downloads MZ/PE file

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2934520114-3201407646-466687995-1000\Control Panel\International\Geo\Nation	vc_redist.x86.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2934520114-3201407646-466687995-1000\Control Panel\International\Geo\Nation	windowsdesktop-runtime-8.0.11-win-x64.exe

Executes dropped EXE 6 IoCs

pid	Process
3928	vc_redist.x86.exe
4768	vc_redist.x86.exe
3340	VC_redist.x86.exe
3316	windowsdesktop-runtime-8.0.11-win-x64.exe
4764	windowsdesktop-runtime-8.0.11-win-x64.exe
408	windowsdesktop-runtime-8.0.11-win-x64.exe

Loads dropped DLL 23 IoCs

pid	Process
4768	vc_redist.x86.exe
2584	VC_redist.x86.exe
4764	windowsdesktop-runtime-8.0.11-win-x64.exe
2744	MsiExec.exe
2744	MsiExec.exe
4412	MsiExec.exe
4412	MsiExec.exe
2380	MsiExec.exe
2380	MsiExec.exe
2380	MsiExec.exe
2380	MsiExec.exe
1128	MsiExec.exe
1128	MsiExec.exe
4456	windowsdesktop-runtime-8.0.2-win-x64.exe
4564	MsiExec.exe
4564	MsiExec.exe
4664	MsiExec.exe
4664	MsiExec.exe
4404	MsiExec.exe
4404	MsiExec.exe
540	Enforcer_Setup.exe
540	Enforcer_Setup.exe
540	Enforcer_Setup.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{e7802eac-3305-4da0-9378-e55d1ed05518} = "\"C:\\ProgramData\\Package Cache\\{e7802eac-3305-4da0-9378-e55d1ed05518}\\VC_redist.x86.exe\" /burn.runonce"	VC_redist.x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{bd40e761-3e88-4202-9b53-26c6bed3d467} = "\"C:\\ProgramData\\Package Cache\\{bd40e761-3e88-4202-9b53-26c6bed3d467}\\windowsdesktop-runtime-8.0.11-win-x64.exe\" /burn.runonce"	windowsdesktop-runtime-8.0.11-win-x64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe

Detected potential entity reuse from brand PAYPAL.
phishing paypal

Drops file in System32 directory 49 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\msvcp140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140_2.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcp140_atomic_wait.dll	msiexec.exe
File created	C:\Windows\SysWOW64\vccorlib140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfcm140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140_codecvt_ids.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vcamp140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcp140_codecvt_ids.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140chs.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140chs.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140cht.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vcruntime140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcp140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcp140_2.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfcm140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140esn.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140jpn.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140ita.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140u.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140enu.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140ita.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140esn.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vcomp140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcp140_1.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140u.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140rus.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140kor.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140fra.dll	msiexec.exe
File created	C:\Windows\SysWOW64\concrt140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\vcruntime140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfcm140u.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140cht.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140deu.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140fra.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140kor.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140rus.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfcm140u.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140enu.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140jpn.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140_1.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140_atomic_wait.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vccorlib140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\vcamp140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\vcruntime140_threads.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\concrt140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\vcomp140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140deu.dll	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework-SystemDrawing.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Data.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.11\msquic.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.11\System.Windows.Forms.Primitives.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.11\System.Security.Permissions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.11\es\UIAutomationClient.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.11\de\ReachFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.11\System.Xml.XDocument.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.11\es\UIAutomationProvider.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Formats.Tar.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.11\de\UIAutomationTypes.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.11\ru\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.11\cs\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.11\de\PresentationUI.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\wpfgfx_cor3.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\mscordaccore_amd64_amd64_8.0.224.6711.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.11\System.IO.UnmanagedMemoryStream.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.11\es\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.11\es\UIAutomationTypes.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.11\de\System.Windows.Forms.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.Aero2.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\ThirdPartyNotices.txt	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.11\zh-Hans\WindowsBase.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.11\Microsoft.WindowsDesktop.App.deps.json	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.11\Accessibility.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.11\de\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.11\it\PresentationFramework.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\PresentationCore.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\createdump.exe	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.11\ru\WindowsFormsIntegration.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.WebHeaderCollection.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.X509Certificates.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.11\System.IO.FileSystem.Primitives.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.11\ko\WindowsBase.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.11\tr\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Diagnostics.PerformanceCounter.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\System.Windows.Forms.Design.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.11\System.Text.Encoding.Extensions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.11\System.Xaml.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.11\es\WindowsBase.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.11\wpfgfx_cor3.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Diagnostics.EventLog.Messages.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\PresentationFramework.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Collections.Specialized.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Data.Common.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Web.HttpUtility.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.11\System.Runtime.Serialization.Primitives.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.11\System.ComponentModel.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.DiaSymReader.Native.amd64.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.UnmanagedMemoryStream.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Text.Encoding.Extensions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.11\System.Numerics.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.11\ko\PresentationUI.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\PresentationFramework.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\System.Xaml.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\PresentationUI.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Microsoft.VisualBasic.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Presentation.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Windows.Forms.Primitives.resources.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Microsoft.VisualBasic.Forms.dll	msiexec.exe

Drops file in Windows directory 61 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e5809b7.msi	msiexec.exe
File created	C:\Windows\Installer\e5809c1.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4D4C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI73FB.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB17.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{84E3E712-6343-484B-8B6C-9F145F019A70}	msiexec.exe
File created	C:\Windows\Installer\SourceHash{362B4D0D-8438-44DA-86B2-FEC44E000FCA}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI500E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7F49.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI11C0.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5495.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI71E6.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{9C80213E-9079-4561-8D57-1FDD0D62251F}	msiexec.exe
File opened for modification	C:\Windows\Installer\e5809bd.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5CC3.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4808.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4961.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\63337BB296F4141479799EDBF63E89A0	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4886.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI70EB.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI72C1.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{C2BB95AA-90F3-4891-81C1-A7E565BB836C}	msiexec.exe
File created	C:\Windows\Installer\e5809b8.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4AAA.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\63337BB296F4141479799EDBF63E89A0\64.8.8795	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4E96.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e5809cd.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4B86.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6129.tmp	msiexec.exe
File created	C:\Windows\Installer\e5809bc.msi	msiexec.exe
File created	C:\Windows\Installer\e5809c7.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI64A5.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3C2D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI44CA.tmp	msiexec.exe
File created	C:\Windows\Installer\e5809bd.msi	msiexec.exe
File created	C:\Windows\Installer\e5809c2.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5809c2.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\63337BB296F4141479799EDBF63E89A0\CacheSize.txt	msiexec.exe
File created	C:\Windows\Installer\e5809a2.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1376.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4DAB.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e580990.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5271.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{C0790AA0-0F40-4836-85B2-677B87625E63}	msiexec.exe
File created	C:\Windows\Installer\e5809d1.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3E51.tmp	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\63337BB296F4141479799EDBF63E89A0\CacheSize.txt	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI74D7.tmp	msiexec.exe
File created	C:\Windows\Installer\e5809cd.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7823.tmp	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\63337BB296F4141479799EDBF63E89A0\64.8.8795\fileCoreHostExe	msiexec.exe
File created	C:\Windows\Installer\e580990.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICCD.tmp	msiexec.exe
File created	C:\Windows\Installer\e5809a1.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5809a2.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5809b8.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{F59C11F0-D73F-452B-8D1D-8C33B82D8507}	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\63337BB296F4141479799EDBF63E89A0\64.8.8795\fileCoreHostExe	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 20 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-8.0.11-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-8.0.2-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vc_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-8.0.11-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-8.0.2-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-8.0.2-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Enforcer_Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vc_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-8.0.11-win-x64.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000001e80b80f5cf5345e0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800001e80b80f0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809001e80b80f000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d1e80b80f000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000001e80b80f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Checks processor information in registry 2 TTPs 12 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 25 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2d	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\30	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\31	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2B	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2F	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\30	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2e	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2f	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\31	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2D	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\32	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2C	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D0D4B2638348AD44682BEF4CE400F0AC\Clients = 3a0000000000	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_64.8.8795_x64\Dependents	windowsdesktop-runtime-8.0.2-win-x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0F11C95FF37DB254D8D1C8338BD25870\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E31208C997091654D875F1DDD02652F1\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\D881F2EC0135A4B72CA89D27FD72F577	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D0D4B2638348AD44682BEF4CE400F0AC\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{362B4D0D-8438-44DA-86B2-FEC44E000FCA}v64.44.23191\\"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_64.8.8806_x64	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\70BF2CCB0FC824541BC016CBFE40FA2F	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{bd40e761-3e88-4202-9b53-26c6bed3d467}\Version = "8.0.11.34221"	windowsdesktop-runtime-8.0.11-win-x64.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AA59BB2C3F091984181C7A5E56BB38C6\Clients = 3a0000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\217E3E483436B484B8C6F941F510A907\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E31208C997091654D875F1DDD02652F1\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\AA59BB2C3F091984181C7A5E56BB38C6\Servicing_Key	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\windowsdesktop_runtime_64.44.23253_x64	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\VC,redist.x86,x86,14.42,bundle	VC_redist.x86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_8.0_x64\Dependents\{bd40e761-3e88-4202-9b53-26c6bed3d467}	windowsdesktop-runtime-8.0.11-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_64.44.23191_x64\Dependents\{bd40e761-3e88-4202-9b53-26c6bed3d467}	windowsdesktop-runtime-8.0.11-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D0D4B2638348AD44682BEF4CE400F0AC\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{362B4D0D-8438-44DA-86B2-FEC44E000FCA}v64.44.23191\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0AA0970C04F06384582B76B77826E536	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9DF1F64D8EF250D42BCA10C1326BB942\SourceList\Net	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\217E3E483436B484B8C6F941F510A907\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_x86,v14	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_x86,v14\ = "{84E3E712-6343-484B-8B6C-9F145F019A70}"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0F11C95FF37DB254D8D1C8338BD25870\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D0D4B2638348AD44682BEF4CE400F0AC\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x86,x86,14.42,bundle\DisplayName = "Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.42.34433"	VC_redist.x86.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E31208C997091654D875F1DDD02652F1\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_64.44.23191_x64\Dependents\{bd40e761-3e88-4202-9b53-26c6bed3d467}	windowsdesktop-runtime-8.0.11-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_64.44.23253_x64\DisplayName = "Microsoft Windows Desktop Runtime - 8.0.11 (x64)"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0AA0970C04F06384582B76B77826E536\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E31208C997091654D875F1DDD02652F1\PackageCode = "3558879DFFDC297478AF98DA2AA0BD7A"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\windowsdesktop_runtime_64.44.23253_x64	windowsdesktop-runtime-8.0.11-win-x64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_x86,v14	VC_redist.x86.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\679E80FBE29B63345BF612177149674C\SourceList	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x86,x86,14.30,bundle	VC_redist.x86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_64.44.23191_x64\Dependents	windowsdesktop-runtime-8.0.11-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0AA0970C04F06384582B76B77826E536\PackageCode = "F40D0C15A7A9CAC47B09E6C88478AF33"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\F5968DD9DAA5B3567CFF6E791844C78F	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\70BF2CCB0FC824541BC016CBFE40FA2F\SourceList	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5040806F8AF9AAC49928419ED5A1D3CA	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D0D4B2638348AD44682BEF4CE400F0AC\SourceList	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\{63880B41-04FC-4F9B-92C4-4455C255EB8C}\DEPENDENTS\{63880B41-04FC-4F9B-92C4-4455C255EB8C}	windowsdesktop-runtime-8.0.2-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E31208C997091654D875F1DDD02652F1\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{9C80213E-9079-4561-8D57-1FDD0D62251F}v64.44.23191\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_x86,v14	VC_redist.x86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E31208C997091654D875F1DDD02652F1\SourceList\Net	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0F11C95FF37DB254D8D1C8338BD25870\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0F11C95FF37DB254D8D1C8338BD25870\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{F59C11F0-D73F-452B-8D1D-8C33B82D8507}v64.44.23191\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D0D4B2638348AD44682BEF4CE400F0AC\Provider	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D0D4B2638348AD44682BEF4CE400F0AC\InstanceType = "0"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{63880b41-04fc-4f9b-92c4-4455c255eb8c}	windowsdesktop-runtime-8.0.2-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AA59BB2C3F091984181C7A5E56BB38C6\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_8.0_x64\ = "{362B4D0D-8438-44DA-86B2-FEC44E000FCA}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\6F05B006EF15FED56A7079F7AB6FD21F	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9DF1F64D8EF250D42BCA10C1326BB942	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\DOTNET_CLI_HOSTFXR_64.8.8795_X64\DEPENDENTS\{63880B41-04FC-4F9B-92C4-4455C255EB8C}	windowsdesktop-runtime-8.0.2-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E31208C997091654D875F1DDD02652F1\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{9C80213E-9079-4561-8D57-1FDD0D62251F}v64.44.23191\\"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0AA0970C04F06384582B76B77826E536\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\217E3E483436B484B8C6F941F510A907\VC_Runtime_Additional	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\18237B7CA0BADAD40AF9C5034D6097CA\SourceList\Media	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\217E3E483436B484B8C6F941F510A907\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E31208C997091654D875F1DDD02652F1\Provider	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D0D4B2638348AD44682BEF4CE400F0AC\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\D881F2EC0135A4B72CA89D27FD72F577\D0D4B2638348AD44682BEF4CE400F0AC	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_x86,v14\Version = "14.42.34433"	msiexec.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\Enforcer_Setup.zip:Zone.Identifier	firefox.exe

Opens file in notepad (likely ransom note) 2 IoCs

ransomware

pid	Process
4368	NOTEPAD.EXE
2916	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
4452	msiexec.exe
4452	msiexec.exe
4452	msiexec.exe
4452	msiexec.exe
4452	msiexec.exe
4452	msiexec.exe
4452	msiexec.exe
4452	msiexec.exe
4452	msiexec.exe
4452	msiexec.exe
4452	msiexec.exe
4452	msiexec.exe
4452	msiexec.exe
4452	msiexec.exe
4452	msiexec.exe
4452	msiexec.exe
4452	msiexec.exe
4452	msiexec.exe
4452	msiexec.exe
4452	msiexec.exe
4452	msiexec.exe
4452	msiexec.exe
4452	msiexec.exe
4452	msiexec.exe
1980	msedge.exe
1980	msedge.exe
4108	msedge.exe
4108	msedge.exe
2708	identity_helper.exe
2708	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4500	firefox.exe
Token: SeDebugPrivilege	4500	firefox.exe
Token: SeDebugPrivilege	4500	firefox.exe
Token: SeDebugPrivilege	540	Enforcer_Setup.exe
Token: SeBackupPrivilege	3508	vssvc.exe
Token: SeRestorePrivilege	3508	vssvc.exe
Token: SeAuditPrivilege	3508	vssvc.exe
Token: SeShutdownPrivilege	3340	VC_redist.x86.exe
Token: SeIncreaseQuotaPrivilege	3340	VC_redist.x86.exe
Token: SeSecurityPrivilege	4452	msiexec.exe
Token: SeCreateTokenPrivilege	3340	VC_redist.x86.exe
Token: SeAssignPrimaryTokenPrivilege	3340	VC_redist.x86.exe
Token: SeLockMemoryPrivilege	3340	VC_redist.x86.exe
Token: SeIncreaseQuotaPrivilege	3340	VC_redist.x86.exe
Token: SeMachineAccountPrivilege	3340	VC_redist.x86.exe
Token: SeTcbPrivilege	3340	VC_redist.x86.exe
Token: SeSecurityPrivilege	3340	VC_redist.x86.exe
Token: SeTakeOwnershipPrivilege	3340	VC_redist.x86.exe
Token: SeLoadDriverPrivilege	3340	VC_redist.x86.exe
Token: SeSystemProfilePrivilege	3340	VC_redist.x86.exe
Token: SeSystemtimePrivilege	3340	VC_redist.x86.exe
Token: SeProfSingleProcessPrivilege	3340	VC_redist.x86.exe
Token: SeIncBasePriorityPrivilege	3340	VC_redist.x86.exe
Token: SeCreatePagefilePrivilege	3340	VC_redist.x86.exe
Token: SeCreatePermanentPrivilege	3340	VC_redist.x86.exe
Token: SeBackupPrivilege	3340	VC_redist.x86.exe
Token: SeRestorePrivilege	3340	VC_redist.x86.exe
Token: SeShutdownPrivilege	3340	VC_redist.x86.exe
Token: SeDebugPrivilege	3340	VC_redist.x86.exe
Token: SeAuditPrivilege	3340	VC_redist.x86.exe
Token: SeSystemEnvironmentPrivilege	3340	VC_redist.x86.exe
Token: SeChangeNotifyPrivilege	3340	VC_redist.x86.exe
Token: SeRemoteShutdownPrivilege	3340	VC_redist.x86.exe
Token: SeUndockPrivilege	3340	VC_redist.x86.exe
Token: SeSyncAgentPrivilege	3340	VC_redist.x86.exe
Token: SeEnableDelegationPrivilege	3340	VC_redist.x86.exe
Token: SeManageVolumePrivilege	3340	VC_redist.x86.exe
Token: SeImpersonatePrivilege	3340	VC_redist.x86.exe
Token: SeCreateGlobalPrivilege	3340	VC_redist.x86.exe
Token: SeRestorePrivilege	4452	msiexec.exe
Token: SeTakeOwnershipPrivilege	4452	msiexec.exe
Token: SeRestorePrivilege	4452	msiexec.exe
Token: SeTakeOwnershipPrivilege	4452	msiexec.exe
Token: SeRestorePrivilege	4452	msiexec.exe
Token: SeTakeOwnershipPrivilege	4452	msiexec.exe
Token: SeRestorePrivilege	4452	msiexec.exe
Token: SeTakeOwnershipPrivilege	4452	msiexec.exe
Token: SeRestorePrivilege	4452	msiexec.exe
Token: SeTakeOwnershipPrivilege	4452	msiexec.exe
Token: SeRestorePrivilege	4452	msiexec.exe
Token: SeTakeOwnershipPrivilege	4452	msiexec.exe
Token: SeRestorePrivilege	4452	msiexec.exe
Token: SeTakeOwnershipPrivilege	4452	msiexec.exe
Token: SeRestorePrivilege	4452	msiexec.exe
Token: SeTakeOwnershipPrivilege	4452	msiexec.exe
Token: SeRestorePrivilege	4452	msiexec.exe
Token: SeTakeOwnershipPrivilege	4452	msiexec.exe
Token: SeRestorePrivilege	4452	msiexec.exe
Token: SeTakeOwnershipPrivilege	4452	msiexec.exe
Token: SeRestorePrivilege	4452	msiexec.exe
Token: SeTakeOwnershipPrivilege	4452	msiexec.exe
Token: SeRestorePrivilege	4452	msiexec.exe
Token: SeTakeOwnershipPrivilege	4452	msiexec.exe
Token: SeRestorePrivilege	4452	msiexec.exe

Suspicious use of FindShellTrayWindow 24 IoCs

pid	Process
4500	firefox.exe
4500	firefox.exe
4500	firefox.exe
4500	firefox.exe
4500	firefox.exe
4500	firefox.exe
4500	firefox.exe
4500	firefox.exe
4500	firefox.exe
4500	firefox.exe
4500	firefox.exe
4500	firefox.exe
4500	firefox.exe
4500	firefox.exe
4500	firefox.exe
4500	firefox.exe
4500	firefox.exe
4500	firefox.exe
4500	firefox.exe
4500	firefox.exe
4500	firefox.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe

Suspicious use of SendNotifyMessage 20 IoCs

pid	Process
4500	firefox.exe
4500	firefox.exe
4500	firefox.exe
4500	firefox.exe
4500	firefox.exe
4500	firefox.exe
4500	firefox.exe
4500	firefox.exe
4500	firefox.exe
4500	firefox.exe
4500	firefox.exe
4500	firefox.exe
4500	firefox.exe
4500	firefox.exe
4500	firefox.exe
4500	firefox.exe
4500	firefox.exe
4500	firefox.exe
4500	firefox.exe
4500	firefox.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4500	firefox.exe
4500	firefox.exe
4500	firefox.exe
4500	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 236 wrote to memory of 4500	236	firefox.exe	81
PID 236 wrote to memory of 4500	236	firefox.exe	81
PID 236 wrote to memory of 4500	236	firefox.exe	81
PID 236 wrote to memory of 4500	236	firefox.exe	81
PID 236 wrote to memory of 4500	236	firefox.exe	81
PID 236 wrote to memory of 4500	236	firefox.exe	81
PID 236 wrote to memory of 4500	236	firefox.exe	81
PID 236 wrote to memory of 4500	236	firefox.exe	81
PID 236 wrote to memory of 4500	236	firefox.exe	81
PID 236 wrote to memory of 4500	236	firefox.exe	81
PID 236 wrote to memory of 4500	236	firefox.exe	81
PID 4500 wrote to memory of 1712	4500	firefox.exe	82
PID 4500 wrote to memory of 1712	4500	firefox.exe	82
PID 4500 wrote to memory of 1712	4500	firefox.exe	82
PID 4500 wrote to memory of 1712	4500	firefox.exe	82
PID 4500 wrote to memory of 1712	4500	firefox.exe	82
PID 4500 wrote to memory of 1712	4500	firefox.exe	82
PID 4500 wrote to memory of 1712	4500	firefox.exe	82
PID 4500 wrote to memory of 1712	4500	firefox.exe	82
PID 4500 wrote to memory of 1712	4500	firefox.exe	82
PID 4500 wrote to memory of 1712	4500	firefox.exe	82
PID 4500 wrote to memory of 1712	4500	firefox.exe	82
PID 4500 wrote to memory of 1712	4500	firefox.exe	82
PID 4500 wrote to memory of 1712	4500	firefox.exe	82
PID 4500 wrote to memory of 1712	4500	firefox.exe	82
PID 4500 wrote to memory of 1712	4500	firefox.exe	82
PID 4500 wrote to memory of 1712	4500	firefox.exe	82
PID 4500 wrote to memory of 1712	4500	firefox.exe	82
PID 4500 wrote to memory of 1712	4500	firefox.exe	82
PID 4500 wrote to memory of 1712	4500	firefox.exe	82
PID 4500 wrote to memory of 1712	4500	firefox.exe	82
PID 4500 wrote to memory of 1712	4500	firefox.exe	82
PID 4500 wrote to memory of 1712	4500	firefox.exe	82
PID 4500 wrote to memory of 1712	4500	firefox.exe	82
PID 4500 wrote to memory of 1712	4500	firefox.exe	82
PID 4500 wrote to memory of 1712	4500	firefox.exe	82
PID 4500 wrote to memory of 1712	4500	firefox.exe	82
PID 4500 wrote to memory of 1712	4500	firefox.exe	82
PID 4500 wrote to memory of 1712	4500	firefox.exe	82
PID 4500 wrote to memory of 1712	4500	firefox.exe	82
PID 4500 wrote to memory of 1712	4500	firefox.exe	82
PID 4500 wrote to memory of 1712	4500	firefox.exe	82
PID 4500 wrote to memory of 1712	4500	firefox.exe	82
PID 4500 wrote to memory of 1712	4500	firefox.exe	82
PID 4500 wrote to memory of 1712	4500	firefox.exe	82
PID 4500 wrote to memory of 1712	4500	firefox.exe	82
PID 4500 wrote to memory of 1712	4500	firefox.exe	82
PID 4500 wrote to memory of 1712	4500	firefox.exe	82
PID 4500 wrote to memory of 1712	4500	firefox.exe	82
PID 4500 wrote to memory of 1712	4500	firefox.exe	82
PID 4500 wrote to memory of 1712	4500	firefox.exe	82
PID 4500 wrote to memory of 1712	4500	firefox.exe	82
PID 4500 wrote to memory of 1712	4500	firefox.exe	82
PID 4500 wrote to memory of 1712	4500	firefox.exe	82
PID 4500 wrote to memory of 1712	4500	firefox.exe	82
PID 4500 wrote to memory of 1712	4500	firefox.exe	82
PID 4500 wrote to memory of 2120	4500	firefox.exe	83
PID 4500 wrote to memory of 2120	4500	firefox.exe	83
PID 4500 wrote to memory of 2120	4500	firefox.exe	83
PID 4500 wrote to memory of 2120	4500	firefox.exe	83
PID 4500 wrote to memory of 2120	4500	firefox.exe	83
PID 4500 wrote to memory of 2120	4500	firefox.exe	83
PID 4500 wrote to memory of 2120	4500	firefox.exe	83
PID 4500 wrote to memory of 2120	4500	firefox.exe	83

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://www.nexushub.live/_files/archives/5ff4f1_c3352fb5f439479a84e403ac88396ef6.zip?dn=Enforcer_Setup.zip"
1⤵
- Suspicious use of WriteProcessMemory
PID:236
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://www.nexushub.live/_files/archives/5ff4f1_c3352fb5f439479a84e403ac88396ef6.zip?dn=Enforcer_Setup.zip
  2⤵
  - Checks processor information in registry
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4500
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1976 -parentBuildID 20240401114208 -prefsHandle 1916 -prefMapHandle 1908 -prefsLen 23839 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {704aae81-8375-40e3-960a-7edbd9153fff} 4500 "\\.\pipe\gecko-crash-server-pipe.4500" gpu
    3⤵
    PID:1712
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2440 -parentBuildID 20240401114208 -prefsHandle 2416 -prefMapHandle 2412 -prefsLen 24759 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {57befe6b-8d5c-4ad4-89e7-9439fa756769} 4500 "\\.\pipe\gecko-crash-server-pipe.4500" socket
    3⤵
    - Checks processor information in registry
    PID:2120
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2988 -childID 1 -isForBrowser -prefsHandle 2980 -prefMapHandle 3124 -prefsLen 22700 -prefMapSize 244658 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1dbf43e5-cb6e-4283-a3f9-e82fb174bb33} 4500 "\\.\pipe\gecko-crash-server-pipe.4500" tab
    3⤵
    PID:2292
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3984 -childID 2 -isForBrowser -prefsHandle 4000 -prefMapHandle 3996 -prefsLen 29249 -prefMapSize 244658 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {117e49af-2879-438b-81f2-7ab7451aa835} 4500 "\\.\pipe\gecko-crash-server-pipe.4500" tab
    3⤵
    PID:4372
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4700 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4808 -prefMapHandle 4804 -prefsLen 29249 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {73a909b4-1c36-454c-8ed3-cb72de6602aa} 4500 "\\.\pipe\gecko-crash-server-pipe.4500" utility
    3⤵
    - Checks processor information in registry
    PID:3932
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5488 -childID 3 -isForBrowser -prefsHandle 5460 -prefMapHandle 5480 -prefsLen 27139 -prefMapSize 244658 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5dee81bc-85d5-4f02-bf67-0e7849545ef7} 4500 "\\.\pipe\gecko-crash-server-pipe.4500" tab
    3⤵
    PID:1132
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5632 -childID 4 -isForBrowser -prefsHandle 5712 -prefMapHandle 5708 -prefsLen 27139 -prefMapSize 244658 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7bb16ac7-49e2-4369-83c5-7fa6a64f1489} 4500 "\\.\pipe\gecko-crash-server-pipe.4500" tab
    3⤵
    PID:4540
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5908 -childID 5 -isForBrowser -prefsHandle 5828 -prefMapHandle 5836 -prefsLen 27139 -prefMapSize 244658 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5b59028d-07e6-4608-b7ba-38f34bc540d9} 4500 "\\.\pipe\gecko-crash-server-pipe.4500" tab
    3⤵
    PID:436

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:692

C:\Users\Admin\Desktop\Enforcer_Setup.exe
"C:\Users\Admin\Desktop\Enforcer_Setup.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:540
- C:\Users\Admin\Desktop\vc_redist.x86.exe
  "C:\Users\Admin\Desktop\vc_redist.x86.exe" /quiet /norestart
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3928
- - C:\Windows\Temp\{387FC0ED-440F-4713-A401-D31DCCDE1D8A}\.cr\vc_redist.x86.exe
    "C:\Windows\Temp\{387FC0ED-440F-4713-A401-D31DCCDE1D8A}\.cr\vc_redist.x86.exe" -burn.clean.room="C:\Users\Admin\Desktop\vc_redist.x86.exe" -burn.filehandle.attached=724 -burn.filehandle.self=728 /quiet /norestart
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:4768
  - - C:\Windows\Temp\{FA2940A2-C652-4D60-9582-6B94B51396B8}\.be\VC_redist.x86.exe
      "C:\Windows\Temp\{FA2940A2-C652-4D60-9582-6B94B51396B8}\.be\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{21982CE1-7AA3-4DE4-A265-FFF2EA04F7BB} {47388E60-A6B5-469A-BCA9-F73D2396389D} 4768
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      PID:3340
    - - C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
        
        "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={e7802eac-3305-4da0-9378-e55d1ed05518} -burn.filehandle.self=1044 -burn.embedded BurnPipe.{628E31B6-19E3-44EF-952A-C3F304A8D973} {3A7AC1C0-6C8F-4FAB-A216-067E78021DF0} 3340
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:524
      - C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
        
        "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.filehandle.attached=544 -burn.filehandle.self=564 -uninstall -quiet -burn.related.upgrade -burn.ancestors={e7802eac-3305-4da0-9378-e55d1ed05518} -burn.filehandle.self=1044 -burn.embedded BurnPipe.{628E31B6-19E3-44EF-952A-C3F304A8D973} {3A7AC1C0-6C8F-4FAB-A216-067E78021DF0} 3340
        6⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:2584
        
        C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
        
        "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{98B002BF-BF1D-427E-87D6-396B9023051E} {0D33DE79-E9F2-4C7B-9C28-977724E46455} 2584
        7⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2456
- C:\Users\Admin\Desktop\windowsdesktop-runtime-8.0.11-win-x64.exe
  "windowsdesktop-runtime-8.0.11-win-x64.exe" /quiet /norestart
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3316
- - C:\Windows\Temp\{5F5BB540-D651-40B2-8D30-C1D3781A56AF}\.cr\windowsdesktop-runtime-8.0.11-win-x64.exe
    "C:\Windows\Temp\{5F5BB540-D651-40B2-8D30-C1D3781A56AF}\.cr\windowsdesktop-runtime-8.0.11-win-x64.exe" -burn.clean.room="C:\Users\Admin\Desktop\windowsdesktop-runtime-8.0.11-win-x64.exe" -burn.filehandle.attached=592 -burn.filehandle.self=728 /quiet /norestart
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:4764
  - - C:\Windows\Temp\{B66430CE-7950-4E8A-BEF4-F0451689C543}\.be\windowsdesktop-runtime-8.0.11-win-x64.exe
      "C:\Windows\Temp\{B66430CE-7950-4E8A-BEF4-F0451689C543}\.be\windowsdesktop-runtime-8.0.11-win-x64.exe" -q -burn.elevated BurnPipe.{B466F71D-B45A-46F2-B6A1-8E0FAB6D793D} {73135E4F-0471-4594-8D6D-DA42785C2307} 4764
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:408
    - - C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
        
        "C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={bd40e761-3e88-4202-9b53-26c6bed3d467} -burn.filehandle.self=956 -burn.embedded BurnPipe.{29A2E701-1A86-403D-84F9-2F0CDFD28F91} {71DFE8E7-F07E-4676-801C-45E735EE1346} 408
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1748
      - C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
        
        "C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe" -burn.filehandle.attached=552 -burn.filehandle.self=572 -uninstall -quiet -burn.related.upgrade -burn.ancestors={bd40e761-3e88-4202-9b53-26c6bed3d467} -burn.filehandle.self=956 -burn.embedded BurnPipe.{29A2E701-1A86-403D-84F9-2F0CDFD28F91} {71DFE8E7-F07E-4676-801C-45E735EE1346} 408
        6⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:4456
        
        C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
        
        "C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe" -q -burn.elevated BurnPipe.{29BC372E-AD90-42DF-B622-807A10E1E991} {64250654-1BC9-4219-9832-B0D4B44E3E3B} 4456
        7⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.nexushub.live/store
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  PID:4108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x140,0x144,0x148,0x11c,0x14c,0x7ffb245646f8,0x7ffb24564708,0x7ffb24564718
    3⤵
    PID:448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,7640017595675876556,4370290239908273116,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
    3⤵
    PID:4420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,7640017595675876556,4370290239908273116,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,7640017595675876556,4370290239908273116,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3008 /prefetch:8
    3⤵
    PID:4384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,7640017595675876556,4370290239908273116,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3772 /prefetch:1
    3⤵
    PID:1904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,7640017595675876556,4370290239908273116,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3792 /prefetch:1
    3⤵
    PID:2484
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,7640017595675876556,4370290239908273116,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6104 /prefetch:8
    3⤵
    PID:4132
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
    3⤵
    PID:2196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x264,0x268,0x26c,0x240,0x270,0x7ff689435460,0x7ff689435470,0x7ff689435480
      4⤵
      PID:232
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,7640017595675876556,4370290239908273116,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6104 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,7640017595675876556,4370290239908273116,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5496 /prefetch:1
    3⤵
    PID:976

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3508

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:4
1⤵
PID:4788

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4452
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 421B83D9C04DB45CC254F13409CAA733
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2744
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 38E6E830A1DF3E7EB0197892F6BED1C7
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4412
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 6E8E7DA5C762B62B2A60DE67637CF6A0
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2380
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 6CC65AB19EBCA4994FC5B91AE71C0EE4
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1128
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding FBAA625C779315DA27EA3BF9C4E9584C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4564
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 3B07830AD5791982A5C651A03575630A
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4664
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 7E42E88AFB16630B5866FC5F327C880D
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4404

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1460

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4528

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Serialnumber.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:4368

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\output.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:2916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e580995.rbs

Filesize
16KB

MD5
6e43cf5e86357a0db6d3c9568666ab86

SHA1
50c26fb9436164474c69971489d9b958880625cd

SHA256
fb0a0904d7cf6c4349743e53342bd0502049f8143f5464c152991225ea8a3525

SHA512
c383e17510e0960ab473716f7c29420cfc2a4dd052fec6d9ed094c0fdc985bdcb9f4abb9bfd9265651db3fe8832c2a960fc8fb289698d73d8a9a9b8924ce4788

Download Submit
C:\Config.Msi\e58099a.rbs

Filesize
18KB

MD5
9dbf051a341c18797c75c663706b2a11

SHA1
6c9efc9b0ee2305520d15ae2dca2eb54cfdc2add

SHA256
fb3b7d77c7b295a5cfa272b807bfabb7e1f440fb10dcae12d5d8940daa3b0d11

SHA512
0ec3089766add1748cfd41709a80aea59a0d64a525e26f2d77657837332522c3c5d601007a34a0f90efa0b4e6c2cac87b456844c830d9398e704350b98a1919b

Download Submit
C:\Config.Msi\e5809a7.rbs

Filesize
20KB

MD5
08e313616739a6f3f1f6f005ad6b097f

SHA1
357e78f8cff9938c4552ff5d3ac0a39f63293f30

SHA256
28ef21b9dade10eb2d21d06b51dac499da2747175e9eba8f60d3580fd02df29f

SHA512
e5b0897ea687076b545181a7b9e5a64e6d4fc25b3e699616e7927ace3650d23af1ec886055e402b33bcb887ba3d406f45effd39ff0ed169e0e88bfc5f931591d

Download Submit
C:\Config.Msi\e5809b6.rbs

Filesize
19KB

MD5
d10a3f39f7f5ac7e611bcaae1a68eae8

SHA1
9056024c4582af3015bed8fb7fe8f0ae60998c1a

SHA256
1f6cd627abebd44df05cb2447653b00f341ca0fcc3b66d25d49977ce66747842

SHA512
6f15061139ece7672637ff6157f00963f1425aa4c3ebb7395a0ab9ce5dda399c9333b6f1e2aed373e97e39064337516af1b95de83861ddf5507702a77f89a1bd

Download Submit
C:\Config.Msi\e5809bb.rbs

Filesize
48KB

MD5
b1989da378d9169e8d6fc41b18f9ad46

SHA1
46617374f0ddbf9e4809c16a03f7903550615348

SHA256
4c69ecc605ea6d44802a49fe5b5ed25880c42a9ea5d2bd79c787d8eb3a307163

SHA512
88438f1616de9225510c72ddc5a888fa9c39022715bffe133ffd953b7c0be24ba0b10940df0a659b40f10ac74ef390c4ac0b3ad1e85399309761cdfa6d823452

Download Submit
C:\Config.Msi\e5809c0.rbs

Filesize
9KB

MD5
09eef256583bc4e0f299acb5e379ee2b

SHA1
0db9ab6a28d6abd76a52dddf805dd645619f5355

SHA256
5ec32c55eb79e8c8d4ec50ec904de9bd8af0314da1fb05ce738253fce520fa6d

SHA512
ab9666a945e28d333a8aedd95936e1335a7870948bd360ea7410558be500dc2d8d73ce3976c80cfa60b4136cdccc14a2bfd9c346c04e614385f0140aca69c1fd

Download Submit
C:\Config.Msi\e5809c5.rbs

Filesize
11KB

MD5
8225cffb7b3b198b06ed1c410b9643c7

SHA1
d82597764ee8103e9c933eab25fbab4788cdd628

SHA256
8095186799a9269c5ca64f94d5203a8955557d28c3cb8a793e05e15621c81046

SHA512
93850f0402a469ef43912489f5f42f1b576777f1d87d2ba87c34004a8802979bf555e9755846054b022457e6de13a8175315520c47c71c9659151af8aec1e3d2

Download Submit
C:\Config.Msi\e5809ca.rbs

Filesize
8KB

MD5
63fedb133cd591f2847100b47d8ef161

SHA1
331d4f10ab43e605d648de5c17beb446bf5af8bb

SHA256
7661c8584ca7946d63b090e0c87653435b2fbd5971a988c834372e2c83201640

SHA512
dc2f4f3375c365131e25248b793ea014030f310a0e92de45c1273129cd953434caaad0341ee0da278f00dc8dc7c605de1e21e2ab4b87f84799dfe17eb3f4ddc8

Download Submit
C:\Config.Msi\e5809cb.rbf

Filesize
143KB

MD5
33b4c87f18b4c49114d7a8980241657a

SHA1
254c67b915e45ad8584434a4af5e06ca730baa3b

SHA256
587296f3ff624295079471e529104385e5c30ddc46462096d343c76515e1d662

SHA512
42b48b4dcd76a8b2200cfafddc064c053a9d1a4b91b81dee9153322c0b2269e4d75f340c1bf7e7750351fb656445efaf1e1fe0f7e543497b247dd3f83f0c86f9

Download Submit
C:\Config.Msi\e5809cc.rbf

Filesize
3B

MD5
21438ef4b9ad4fc266b6129a2f60de29

SHA1
5eb8e2242eeb4f5432beeec8b873f1ab0a6b71fd

SHA256
13bf7b3039c63bf5a50491fa3cfd8eb4e699d1ba1436315aef9cbe5711530354

SHA512
37436ced85e5cd638973e716d6713257d692f9dd2e1975d5511ae3856a7b3b9f0d9e497315a058b516ab31d652ea9950938c77c1ad435ea8d4b49d73427d1237

Download Submit
C:\Config.Msi\e5809d0.rbs

Filesize
87KB

MD5
615f9fd181cb27e5f99b28ce11936eaf

SHA1
c98333a4ab7a1e375f0a0aea8379a3750de9d371

SHA256
456f0d96c6917130af828d591478274f8f23bdb33b3c41581b242448e975edc0

SHA512
817ba3e0afa0ad1ff2b0393773d320c3db43ab3419067be67d37aab53fb6d6516c8ed6dc9391d687aa79a5de8ea8a7b88bf0e3f33fdaff46d21b920573a3a3a1

Download Submit
C:\Config.Msi\e5809d4.rbs

Filesize
131KB

MD5
f659f8d67bf87c75d9f955fe7ca94a15

SHA1
c8dae5230db72d113756bafcea94c91cbf38a475

SHA256
9c65584cd278452a3d8c8a5b3d6298c8a4c2ede7fd2dc64e402974221e17bb96

SHA512
60e247ca6f3e34a429a9c5eff0ce73bed5d066df831ddd9674cb708be2a92129d1b1972b24fa84aff7dd61bbd56907aba536fecf442168f71703e3a2044d7696

Download Submit
C:\Config.Msi\e580af1.rbs

Filesize
8KB

MD5
31fa24f8d7b32e2b78153e74b17deb71

SHA1
af51f785702e40cee6c64e711035e7dafccb4c57

SHA256
34baf35ad16f7c1a9109fa44f8744937a076dd0ed70594c9a00314f2a5664ac4

SHA512
d3a224883476f0bd5e35ee2478fefa40226919648f9c1a035d983a5261fd874bcb9a9a3b0dc433c96d65bcda95e8ff19fd5f984f7840db223284a846667c6953

Download Submit
C:\Config.Msi\e580af5.rbs

Filesize
85KB

MD5
d415ee184ebcc897c2eeaf2f407869fc

SHA1
f9522858e1e7fc2237e4f106e6ea9f7654a554b4

SHA256
501717be6e4f3fb7bb625975ff3af3bc723d4c9d84612938ef84f1984ad908e5

SHA512
98df414f9bd86999c9601c4f696240e74adba371e827b997d59440aa491cfe70c041586cef64f649cb93b2b05c279eb980fd9a61800d7d1b8fb77e2ac6d07e67

Download Submit
C:\ProgramData\Package Cache\{e7802eac-3305-4da0-9378-e55d1ed05518}\state.rsm

Filesize
880B

MD5
599622b0df2233d4222a2657663c2cd9

SHA1
794c57d0b218e0489987e1056d10bc8988f71ed9

SHA256
c4fd9c43a1ec749b06c7f9a2fcea386e222a2d2b8bd2ad110f272cf29ab3c179

SHA512
845595a855fa7394afd004ea75a37aaec7ea0538ab66dc113adc59e3c94d09de570029917a6bd2a1edd31c73ea314014827c2d563f0e2a39162448b682883e65

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0526f2b37744871ef85ad98e2a03cd78

SHA1
7e8475de7f5614e30b67793a41d35ff492aff7cc

SHA256
68ce145d21b89f38464ed7486c74dd55a7e28e5ba25bb640cf4059b1bafdafd9

SHA512
12ae36f493802621601887cdc25e3d7191bfa94f0e784f11f18bff4bdf407efee195aceca19fe151718e9e7498a4faf0ff885e38cbc8e1e7a5d5d81f400b1ef0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6547c6e6bdac94ad11ab8e5311c7e265

SHA1
cc3401985b79ed678f8b94b0500766691044ee7f

SHA256
685aee2efe60adca559de33807715ef5306c5ccb8857070155eae3d7ab397e3a

SHA512
d685ddcb513af37ea57e0255d9f5387266f882015b9cfca8f100931dc1629e54d1150679e4562717180447887ef7094539df668707dfbdbd3ef9b4920de7dcb6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
6020dccd5372ba764a266a9e475e6ff7

SHA1
43732b9368d244859d133ed2fbe5aee1d49ad123

SHA256
4f021711155cc05257a67c14007308f51dd9656580d9ee181dcdc7dee3b6b166

SHA512
055edacc0a8e4b467ad8b415a7db499ec29d681bee635d50e3fc8d44bf2773cdc499560122033980b63e2bd4a6dd76d98fa3d3cf9c768d59eba0b5b2af9095e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
ae2cbad97b0f3134649c87a74aea4908

SHA1
25fe4990c37fed2337843c25cd0927729bd30044

SHA256
cbe0257c49b174c15141308f443765155c54584a466e7725cb5232b71daf63ac

SHA512
10fb2597dcb7bfc73ed97f00030fa5353201a55d7c176f062d11d8f68979a04341f34688757f6818f1601671cf632345c4630aabf3b1a272c55318308abe315f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
3cd67d2ae60f4507b73c1db9e8dcc23f

SHA1
e8a7956bb25bb32ff1f41dc7ec035008e747f8bf

SHA256
6d18a9ad060252b4a57131333f827203ec2404ad007b14cf0937d98fbca69cb7

SHA512
c92f6fe576b3d140c5d16ab9bd3a22589e23b377faf2a8cb7c0cfabbc5f9f1278f7b7eeae2b6cdd32f590fab919efab5d8dbd3e05e7c1204caf2ee969384da20

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State~RFe593483.TMP

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b6aa4b2eb727f208302ea56f42eb4cfa

SHA1
7415e3d1fe580d495ccbdc81e4f79af90b2a3ea9

SHA256
11d7d83df3985904ca408be1a551e779603d95d95e7f9450dec99b9703fa118b

SHA512
292e54680ee42c7a44cd3b9a0d48d69db3387fb68d8fbff52a9db1c1a1fb745cbff5f42b72593b47074e1a9c7510f026f587f885858a183a20ab1b491688c71b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9a9d158dac96b061e888ef6e17e9ad5d

SHA1
393983e6cf3724601012744d211f9c4868bbd881

SHA256
fcf1c4567e7232d79364db4a15d16c12913850283a6a52493b163e6c5f483d3a

SHA512
7d23b1dd7c7df2e769b83a93edc6469165dff8abbb8360da2206a245b7a5e58b77e7115d31eda55debe7d7a05f54dc90dfa3718ca5640d2ae181eafdc519c34a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
c44ece212ab785d6bd423a200ca1c93f

SHA1
c824fd6f1f9e5d37f56c9837bfb0f55cd1fbcbcd

SHA256
2fe6fbdaee494e62727fef7a6ea4044b5d307d4b70916a205613d6cff5ccf4db

SHA512
d62771aa6e99759e27717433a82edbe92cbd580e828035af36b45f9c72b885ee31eea1bf53099d41bf025c3eb3190fc906be1965b499f7544cf090eb6456bb89

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
54d8d5d412f3513b3c0f5d4f86a4874c

SHA1
bd77a00fb917760fc161fe3a4d87d67182225c77

SHA256
ed80fc26e71dc195ccf0e92873cd3f2d559c83a0acf763829e39d0b2921028a0

SHA512
8bff2beee1faaa562c6b332a0cbbd633ac52c6d60fda2e6ea81a888d3c6a85cb7e6f8ca5a111e61a6abbe20e5673ced2eb0295166bbc222b7cc29458515dbeff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
53aa92384f8dd229643647a024db8d61

SHA1
4c1434d5ad4cb0ae4b8bad2ee31f82ba67581992

SHA256
88831be300e64e2d65654f5667385f50a7c05925655a06ccb8252a161455e28f

SHA512
cf23d5eeade7ea6d240cb1b8e30adc2b4f0e1cf0359c802715caecc9855251b2a8affcc7cd0c7d57339164fd8af5dde4447f244a4be3c14d5d4f95990bf879fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
872B

MD5
bf59285092223e73684489d4247403fc

SHA1
67fc11a5f2912ca8cbf20ff3a601d334ce20dae3

SHA256
d337224a1e89e5f67efbd8fff3bab0898b6e7daef50537f16449bb938d2f2d42

SHA512
21797e7d00fb1ec5363e03630d590dcd38d08dd7843ca41c10b883c259d713756774c3d16358da6720db91d04e5fce879261011bdcf39a8247640496d62738fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe593483.TMP

Filesize
872B

MD5
de3ea0d1dcc4a4a0dbaa794fc86f2d1e

SHA1
1c713154e5f8c209171dbb8243700e3ee18958d3

SHA256
f32eaea335a550e247660d3dd62d36c1e3137179b80eb175a37bff13fdf4304e

SHA512
609dbc8ef95065f823a82866c9c1821f30d33fc45e83cce1d8e170afe0603ad5d3b78314bfa1bbed84000527e10ce73e823c8851b20604bb01d253fa4c9bc8e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
24365b1de59b9b10318d4d179e80d472

SHA1
259a43f677af5eec4b9c5f89bb8ae0b753b050ce

SHA256
5d8ae1a3297b6d2e62081d64a783135f3226ddde4bad528c8fd6e3789d479185

SHA512
8cb0f8e8831c4c7bcf7d5924fe7a60b41de4f8842ec5d82517d19e5d880be32f4e78c4b5692d45009297e25f3a44e1409ebf9bce0cdd8014f8cd35c2255ea2a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
e5271cd1ab09e0809bfb9e411c509281

SHA1
05b260a9df9e678be8dbf2d78f8a9a8a9bd35437

SHA256
0f9ed227e66f0568c6212a62a8e52e920337e91f2bd73994e0483570ab63a88b

SHA512
dcdded368a133c6a5305d70375b83a639aa1deffa49c3909a55e3fd0035fe41d3c9324d373aa4e4f1df5422b51a07f09cda9427cd9349cdcddf8233500f1772d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\mg4xad17.default-release\activity-stream.discovery_stream.json

Filesize
24KB

MD5
5d256ff1c60f86a583f5ec31a2d26c26

SHA1
240d9b0aacee7c884db061f8f4bee54bc864a38d

SHA256
1f2cf5521702385b942ef2949386f9898b0776317419c5722eb1eeedfe724e10

SHA512
d34c7daab1de1684edb2bf07ef16a094e7d6d9150d14bb616d0b5d74d1d488078c55db0baa47f774da0736d255eb4df70b3ad599cd54ee663c329def5828f294

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.11_(x64)_20250107225544_000_dotnet_runtime_8.0.11_win_x64.msi.log

Filesize
2KB

MD5
ad97495a3c3514bf84618271c709d852

SHA1
5297037a41be67d8d806ff4c5177a4c5067115d3

SHA256
ecd509d4bfa2672eb6d650b9c6f1986e2c19b420afe904c996fb57caff47b855

SHA512
d9660a3bbf779477731e6334db620fdd2edb1acf16921e063fa7532c527f56ac842643b744ca542b354ffe21d899f91ab95b24c53980d6de97ed320563a6267d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.11_(x64)_20250107225544_001_dotnet_hostfxr_8.0.11_win_x64.msi.log

Filesize
2KB

MD5
ed1eb5da7448c47a334c08fba22192ac

SHA1
901e7de95cafda431d61267926325939c756c2ef

SHA256
01213ffa474f869957bf2ed979bfb24b37134ea47ccf5dd47fd2ceed1e067f29

SHA512
af191942fee0fe22be474c9e8103fd0e5a9648817d8bb35b039c0712760eca971d9c3fbc790b53bdff9797d5351cf88496cd3149b13c3fd5c09949308f8cffd1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.11_(x64)_20250107225544_002_dotnet_host_8.0.11_win_x64.msi.log

Filesize
2KB

MD5
30ab537961b3fe47b38512a544a437b8

SHA1
9fb7797a323569edae9db069ca98570fa7324dd5

SHA256
4924378a3cf332b127c31b97c5cee1c2ae4865601c8db6d78bb7f8ffedc3b51e

SHA512
bd42c0d27dbc1a6f29d07c67c214453b7febbe988c69d85ff96a0753b6273989bda034fe97bd644426b9385d9bf69f1e170bf193dacbcf51eee405db4ec5c3b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.11_(x64)_20250107225544_003_windowsdesktop_runtime_8.0.11_win_x64.msi.log

Filesize
2KB

MD5
082e6fb59a21750429838c01577e4e90

SHA1
fa00da6f0828761d673fc90a3e9b0121e9dff597

SHA256
7fcc00d3725bb38d8848413a7e2d9d49ccc1dec38fed1f8880d04d3f8b7a5ccc

SHA512
ce437106eb521d426a42e894daeb9f8212e0034538103ff07520e7d7822a517f9b20ed27f274933953389c1cc5e69f551c6d89b7c6d00e39b99b000bc0d08460

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.2_(x64)_20250107225556_000_windowsdesktop_runtime_8.0.2_win_x64.msi.log

Filesize
1KB

MD5
c2257efcdcd85aadd34b7d569b27636c

SHA1
c05b480fd9dd48c16ad6e841a7a7b909406433fc

SHA256
4bbe07d81e0c047ea8efbe0f68aef8b2770d87c0eeb2d0e8465df2f566225c81

SHA512
62424c27a40d380e1ba50db11b8d1eb6e2d6cd3b4ca39634b3a9f2333d5198e975108572b489feec5956cde5426b4cee3e4cc818ce2fbb3695eae4c47b6291c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.2_(x64)_20250107225556_001_dotnet_hostfxr_8.0.2_win_x64.msi.log

Filesize
1KB

MD5
9708cdfcb23b5ea466d270c9a7be8a4b

SHA1
7b763bef3428f11829144fae8e99d8b660f0f1b4

SHA256
4ee0eb76c1025750a6078a7131fcecb0abe3a8a22f2f261d1ba7e764cb5be232

SHA512
836bd4e49f0def60f6990bafb554033cce41c926f1dccd7f51a3f9167f7a81d81249b4d1714a877d41d311c5662e3fdc7c6eca692cefa0fb9942ee6b63c66a9a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.2_(x64)_20250107225556_002_dotnet_runtime_8.0.2_win_x64.msi.log

Filesize
1KB

MD5
21e7bafd71da89a3a3f3ca41b2b62c0e

SHA1
475b7bd3bb9cb4380e8401754c7b9604e93446bf

SHA256
bdcca22541958256e10da74f8dc138e3f209c8569bd46099a08e996d61335dac

SHA512
66540cebdb73069f498c817602b5fc88d2a96a4cd67d5a5b17c110e8aa4f388ec02c24ec75823ed1dd1897d7999e9e1e46b95427edd249da06e2cd53ca93ca76

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20250107225523_000_vcRuntimeMinimum_x86.log

Filesize
2KB

MD5
e909718e4dbf5fd550e65568bdac5d09

SHA1
2398fab669e3d5a2fa8539c8217498fdb3a46118

SHA256
cf16c57123485d316b0e81925a0c0e6132ed1b470f08406cb4d2a258b1908c90

SHA512
909de1b7a496915a1591f3685c4ba64939ae64f9e8f253f6d3c5059e684d7c1be8fadccd4d808c6709f4cfd9a81bf91e318c3d321a5b7c7c32231143fb1631be

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20250107225523_001_vcRuntimeAdditional_x86.log

Filesize
2KB

MD5
362a4afe53dba2bfd819514fdbfb7a01

SHA1
8b449955b67aa9bd239967a72148c4eab3386071

SHA256
cb7a1fb7cb678f796787fb3739e1c0ff6eff33cb987976ec00ac1682813b2e26

SHA512
ed9bdbac85d5816794d7b2c436ca9024697238c092ab57d7d8e70894a08b4425716ed81134f07042f14a49373bee3ec8d3a5f794d30a5ddeb30168f5644995d4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
0ab2ab590ea92018c62831206c26ddce

SHA1
45e944919919db94c6338867fd1b56d26dc60a12

SHA256
38e58ef0d19a393b5ccdd06142fd8d7153d627e219e7874cad2f92956ba94257

SHA512
b63aabc5d2c7ccadc69e61c8ee6450dfe42cf3329cd868a10ca98dff0f6f6b6fe1956ac2165655b01579f2b290c797c17c3cdb33d06c7dd5baac0fe12be5c36c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
52daf4f8b2c6905e2e978039a8ac1b04

SHA1
42d02dc54e5c216be0863c4288ab68401dc14eaa

SHA256
ecefec2ec0c4196f1be3bfa828591d2de6396296007f9d3d97cef05da308565e

SHA512
326a0d0e32a783bdedbd371b913803cbbd6c93ab646ce6e148aa739a65fc101c8cc76179b9ba4a861215a187c5743f5ed5e7b1125ffd6ef981fb74ae7857d7e3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mg4xad17.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
3e890e2c2512a9ebb112c9d5324a01e6

SHA1
0ab4d0d84afb9b2bf2cdaf68475b492a4e0a1227

SHA256
858da65489ea5a6b70b5777333347fe99e9d8251d23f03c2dd95dd28cbd1b4e2

SHA512
eda0ddce4d19a0737f9cce992ef1c0bf44d53508420208f5e4d0ddcc284d020d73e728150b421954137ac4899ecd61ff92251c911d5f9a2cbd0e0ee42ffd18dd

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mg4xad17.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
1d3ba052c620d44eff401e49d396a84e

SHA1
92e86f8c1a2994ab5c3eb2d45a09520775dfeee8

SHA256
d4eabf9c846c43c457a967c7366c2de6dc084ead1ef7dfbc7c23a449415fd40f

SHA512
b8378015b465607f59a8a83293f8d2fbda23ec4fc213d814b0ac6220f8ed40792b15c3dfc77a55f57cdd03932de6e940d95bdd940905bc4c61bcf06c298c6758

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mg4xad17.default-release\datareporting\glean\pending_pings\358273c5-23a9-4206-a589-9af33d4431e3

Filesize
25KB

MD5
f6ce9920626c638aa5b7410dcc6e7dcd

SHA1
d9588ab87a82df5d5c05d4fcdc029e534937cfd6

SHA256
f008d72e548abb6acc67262ba13a3b550d749e683cdb21463adf9db1b7b578b9

SHA512
4e37166b3190c6fcc703dd4ea4f49cd8c01d9deb58e40f5b7484d1b71540448e718008184b58c53fc7d5874f69fbcb5ba3bd10fcefb6bf04a82faba15fa8cd14

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mg4xad17.default-release\datareporting\glean\pending_pings\abeae3c4-9621-4379-9e0e-43874d686c0e

Filesize
982B

MD5
d70fbb8935af722d6f35da6eacb65c71

SHA1
ce2329047bfc29a956706a6885b38bc7b7aeeca6

SHA256
c7dc44fa56802a59835a290d9a009defd4bf7f16343cae24e0262773fe35157f

SHA512
f83d6cd0abbe34849031efe771d6d0464e9ec32269bc7d404a46ee74e644fb1c957e5043f49bdc4d5cfcff84e899c32fb3ccb9d8e87cf60e7a3eaa4fa1dbae06

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mg4xad17.default-release\datareporting\glean\pending_pings\c95003c7-1926-4afe-af33-6dcf0ecf385a

Filesize
671B

MD5
f7f5926af6bbdffe11f9bb063589fbbe

SHA1
906f0c3fec905f88546b43821a77988ef7b128cc

SHA256
8e34f6e33748cefcecc9174f79c74b954b6f4f56d2d91671aaf68ceab0b7edf4

SHA512
2e44bbcf486a8ac80199c587cd37c796ded949d198e5f15b3bb53523fcad3e8882d54a1a8fe188b7359b55eb653acb1eaa6f9ce40a848ccc692c037e8940f993

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mg4xad17.default-release\prefs-1.js

Filesize
10KB

MD5
f67f4c72a5e0e9e97f7aaf7368a59c55

SHA1
f6f790ed58b071dbc6f017c5fed94a17f5c7cdd1

SHA256
f8a2d12f92bacaeb7228272088b6d3ebad10979559640ae14fd9f00715add683

SHA512
a440706718db0fb16ac9c1b5c2c0ce59e5fc05576ead6318e7ad0beae97ee3758b548f7b1a2cd9783735fbd662e45c5755f932f39e0489f500614c2dc2e2edbb

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mg4xad17.default-release\prefs.js

Filesize
10KB

MD5
83a8c65923429e867e40d96cf974de8c

SHA1
7788d7f3f2cbe4fbd0242b3c385e8ff89e114f3c

SHA256
4d5ce009a4caae1d9e2d52d4f17c779e2c08549bb712ff4399f7d2cabf1800b1

SHA512
b815112b298d229c5a4476713f1ac88d87b841ece91163773bd39e1973d0ca32c5f19ca7062e963930c9fa33282da11882341511044185a98a385b5d16482de0

Download Submit
C:\Users\Admin\Desktop\vc_redist.x86.exe

Filesize
13.3MB

MD5
8a6f4f3282236325360a9ac4413b7bc3

SHA1
cb617803813e969be73f2e0e175a67620e53aa59

SHA256
dd1a8be03398367745a87a5e35bebdab00fdad080cf42af0c3f20802d08c25d4

SHA512
2c1facb8567a052b4fa65d173b0bda64fa5fded2cddb9073b7c28507ed95414c17d2839d06d5e961617c754cda54d6134964b1aff5c9e9cdfbace71f1de2ac3a

Download Submit
C:\Users\Admin\Downloads\Enforcer_Setup.JqyvEb35.zip.part

Filesize
307KB

MD5
4ee57f069410be1476a091fc731dd9e2

SHA1
f8eacf0cb370cfbd0fe934bbcdf4ac8c175f96e4

SHA256
567db12722678f9b79646d6ca35781dfad5879c9753ed220174b5a5c4de5a51f

SHA512
3047a7f2ad1c5af11b09f4f6ab31bd18c4cd16bc2e5e9151e839b03da4a693efb04c277e039525a12022c42bcd27078d464a37ff0814e62c87de1a7fe47c1610

Download Submit
C:\Windows\Installer\MSI3C2D.tmp

Filesize
219KB

MD5
928f4b0fc68501395f93ad524a36148c

SHA1
084590b18957ca45b4a0d4576d1cc72966c3ea10

SHA256
2bf33a9b9980e44d21d48f04cc6ac4eed4c68f207bd5990b7d3254a310b944ae

SHA512
7f2163f651693f9b73a67e90b5c820af060a23502667a5c32c3beb2d6b043f5459f22d61072a744089d622c05502d80f7485e0f86eb6d565ff711d5680512372

Download Submit
C:\Windows\Installer\MSI4D4C.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Temp\{280F1346-1EAA-47AF-A6F3-75129BECEA62}\.ba\wixstdba.dll

Filesize
191KB

MD5
eab9caf4277829abdf6223ec1efa0edd

SHA1
74862ecf349a9bedd32699f2a7a4e00b4727543d

SHA256
a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041

SHA512
45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2

Download Submit
C:\Windows\Temp\{387FC0ED-440F-4713-A401-D31DCCDE1D8A}\.cr\vc_redist.x86.exe

Filesize
669KB

MD5
f7aca1ef43beaa02107214482e6b51d6

SHA1
fb5cec36519b148119dec501cec92d894eb3b60a

SHA256
169b8f7025b301ffce5402c98c07f9e01bbadce52a2961175b777279f92624a7

SHA512
82cf5ebaa0a16e229b82e2dd550d7ab76409c89b4cfb7f163d1cce6d156db737ec5a09a3aa832b4076039665a6044aaeca3a6d311f8264492707ae281bbe7443

Download Submit
C:\Windows\Temp\{5F5BB540-D651-40B2-8D30-C1D3781A56AF}\.cr\windowsdesktop-runtime-8.0.11-win-x64.exe

Filesize
608KB

MD5
fba0b1010e82ee3896e104749f505f54

SHA1
e7e43e8da6af9cd6a6b740b8f70caeb5fbfda730

SHA256
4aae588970b5de7e67c0c46b19d7e671e8186d5fd7082c1f602f57f1ced0e516

SHA512
91bd3515bde8cee82529636025f70b3ca9447338417b6b4f37074e57d5fb810be030f92b0a42fea0d4692979250c01462a41c2477dcf972f1f7554248af16543

Download Submit
C:\Windows\Temp\{B66430CE-7950-4E8A-BEF4-F0451689C543}\.ba\bg.png

Filesize
4KB

MD5
9eb0320dfbf2bd541e6a55c01ddc9f20

SHA1
eb282a66d29594346531b1ff886d455e1dcd6d99

SHA256
9095bf7b6baa0107b40a4a6d727215be077133a190f4ca9bd89a176842141e79

SHA512
9ada3a1757a493fbb004bd767fab8f77430af69d71479f340b8b8ede904cc94cd733700db593a4a2d2e1184c0081fd0648318d867128e1cb461021314990931d

Download Submit
C:\Windows\Temp\{B66430CE-7950-4E8A-BEF4-F0451689C543}\.ba\wixstdba.dll

Filesize
190KB

MD5
f1919c6bd85d7a78a70c228a5b227fbe

SHA1
71647ebf4e7bed3bc1663d520419ac550fe630ff

SHA256
dcea15f3710822ffc262e62ec04cc7bbbf0f33f5d1a853609fbfb65cb6a45640

SHA512
c7ff9b19c9bf320454a240c6abbc382950176a6befce05ea73150eeb0085d0b6ed5b65b2dcb4b04621ef9cca1d5c4e59c6682b9c85d1d5845e5ce3e5eedfd2eb

Download Submit
C:\Windows\Temp\{B66430CE-7950-4E8A-BEF4-F0451689C543}\dotnet_host_8.0.11_win_x64.msi

Filesize
704KB

MD5
aef2d4d02b45fa95d8abcac57e60d21b

SHA1
11c91e25dcf7f1357ab0fb0a6307a71b45dab754

SHA256
ebe13e660c208681e2f1c10fa59d8b37540f2e6187751703fa5bbb5f4b300eb1

SHA512
c78e41d5b2c845c106b088881cf72dddf64be09f72d7ac6078e944e7c9f6afb428e0bad7fec45bb539ad04694467fc302e0a915522123fe02f80bfe1762c2ef1

Download Submit
C:\Windows\Temp\{B66430CE-7950-4E8A-BEF4-F0451689C543}\dotnet_hostfxr_8.0.11_win_x64.msi

Filesize
772KB

MD5
d73de5788ab129f16afdd990d8e6bfa9

SHA1
88cb87af50ea4999e2079d9269ce64c8eb1a584e

SHA256
4f9ac5a094e9b1b4f0285e6e69c2e914e42dcc184dfe6fe93894f8e03ca6c193

SHA512
bfc32f9a20e30045f5207446c6ab6e8ef49a3fd7a5a41491c2242e10fee8efd2f82f81c3ff3bf7681e5e660fde065a315a89d87e9f488c863421fe1d6381ba3b

Download Submit
C:\Windows\Temp\{B66430CE-7950-4E8A-BEF4-F0451689C543}\dotnet_runtime_8.0.11_win_x64.msi

Filesize
26.3MB

MD5
b9c6d23462adef092b8a5b7880531b03

SHA1
9e8c4f7f48d38fb54a93789a583852869c074f2d

SHA256
2e23da54aa1ff64de09021ab089c1be6d4a323bdf0d8f46f78b5c6a33df83109

SHA512
18623991c5690e516541eaf867f22b3a1a02317392178943143bedc7f7eda5e02e69665c3c4a5fa50ade516a191bbbf16fd71e60f3225f660fb10ebc25cd01a5

Download Submit
C:\Windows\Temp\{B66430CE-7950-4E8A-BEF4-F0451689C543}\windowsdesktop_runtime_8.0.11_win_x64.msi

Filesize
29.1MB

MD5
230fed97d6f8eab7800e2316fef53c00

SHA1
7a97f51462584f6a8cc9eb08da654dea4d2b7fba

SHA256
c9aaa2ab9905abbbecff1ad3c3ecbae1f4d7fe8a063f3bfd2fcfe5176fcb169d

SHA512
e0af63d92aecc632b1273e63b5327d2ca9ea3d7a086807205043e4bc76050a22de786e419c1d95a8a8521f39af8c4dc6cf9563dd88e3174e5e87a2d30a6f2352

Download Submit
C:\Windows\Temp\{BC1EDF13-402E-4944-AC37-2F3E35D190A7}\.ba\1033\thm.wxl

Filesize
5KB

MD5
d5070cb3387a0a22b7046ae5ab53f371

SHA1
bc9da146a42bbf9496de059ac576869004702a97

SHA256
81a68046b06e09385be8449373e7ceb9e79f7724c3cf11f0b18a4489a8d4926a

SHA512
8fcf621fb9ce74725c3712e06e5b37b619145078491e828c6069e153359de3bd5486663b1fa6f3bcf1c994d5c556b9964ea1a1355100a634a6c700ef37d381e3

Download Submit
C:\Windows\Temp\{BC1EDF13-402E-4944-AC37-2F3E35D190A7}\.ba\wixstdba.dll

Filesize
197KB

MD5
4356ee50f0b1a878e270614780ddf095

SHA1
b5c0915f023b2e4ed3e122322abc40c4437909af

SHA256
41a8787fdc9467f563438daba4131191aa1eb588a81beb9a89fe8bd886c16104

SHA512
b9e482efe9189683dabfc9feff8b386d7eba4ecf070f42a1eebee6052cfb181a19497f831f1ea6429cfcce1d4865a5d279b24bd738d702902e9887bb9f0c4691

Download Submit
C:\Windows\Temp\{FA2940A2-C652-4D60-9582-6B94B51396B8}\.ba\logo.png

Filesize
1KB

MD5
d6bd210f227442b3362493d046cea233

SHA1
ff286ac8370fc655aea0ef35e9cf0bfcb6d698de

SHA256
335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef

SHA512
464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b

Download Submit
C:\Windows\Temp\{FA2940A2-C652-4D60-9582-6B94B51396B8}\.ba\wixstdba.dll

Filesize
215KB

MD5
f68f43f809840328f4e993a54b0d5e62

SHA1
01da48ce6c81df4835b4c2eca7e1d447be893d39

SHA256
e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e

SHA512
a7a799ecf1784fb5e8cd7191bf78b510ff5b07db07363388d7b32ed21f4fddc09e34d1160113395f728c0f4e57d13768a0350dbdb207d9224337d2153dc791e1

Download Submit
C:\Windows\Temp\{FA2940A2-C652-4D60-9582-6B94B51396B8}\cab54A5CABBE7274D8A22EB58060AAB7623

Filesize
842KB

MD5
a04f3e3bd8684cf660619e0f6af4d751

SHA1
2b5b1a39de1faa20d9a5774ec7b27dee5f6fc065

SHA256
b31b87a09f3aa2df573050949e87a68eeda01cb80dc974714d0603cea2c0708b

SHA512
fb3c081ad9f23661ed6f167ca878469d702f5cb60c15bb6d04c21331b43f8b88d98a680ad74ff5855e4c286260452be9e25b49b5b245d14fa30297cc8add5828

Download Submit
C:\Windows\Temp\{FA2940A2-C652-4D60-9582-6B94B51396B8}\cabB3E1576D1FEFBB979E13B1A5379E0B16

Filesize
4.9MB

MD5
654f67c3c99d57a0008427141bd1cfc6

SHA1
60887d57c8910a5034379ddc7a0ad5e2c2bfcde6

SHA256
d87d9b997b91f9e375bf3cf994b67882ce21c0fbd4d0c4611dd6f593d4a8f3be

SHA512
0f3182a9c923a51f9ffed2e8639f9bcb72ace859c6253aa860a95c2c67c6b9d80d7945042460a7f73e357614b149c9d906c101f800724825279f07902571a064

Download Submit
C:\Windows\Temp\{FA2940A2-C652-4D60-9582-6B94B51396B8}\vcRuntimeAdditional_x86

Filesize
200KB

MD5
95715c58dd2864b361dbd9e651b2f5ad

SHA1
c8b19282b7950e7b8e106b5bbccad4fc7b3aa661

SHA256
a6447de0d0d5b56b50988ae350432d68e9d83fbb566e2fcaa3f758a2b2574fea

SHA512
10eb258d1c1ab690e03fd782316133305530a7a50769263176765862a754dcf5ec258ca5805d2be447a53b29b3557b519a6cec812208d88982201c86ea8d5fb3

Download Submit
C:\Windows\Temp\{FA2940A2-C652-4D60-9582-6B94B51396B8}\vcRuntimeMinimum_x86

Filesize
200KB

MD5
975e07089d93c2540f0e91da7e1e0142

SHA1
e65a155b9f88cabf6fc34111751051f8872f1dc2

SHA256
16547c99e9dc8602603beda79bb9099d06b2f0e06273660aaffd3193d82e8bf5

SHA512
047ca9eaf996b5b89cedf0f9e9d7544cb8700bba02e10aa90fbd283fdebb2e1ec98295569f145e0dc9bbf3dbd44f64e4d02429cbcdff7e149f2804c135ee2595

Download Submit
memory/524-623-0x0000000000320000-0x0000000000397000-memory.dmp

Filesize
476KB

Download
memory/540-378-0x0000000005040000-0x00000000050D2000-memory.dmp

Filesize
584KB

Download
memory/540-1551-0x0000000006370000-0x000000000637A000-memory.dmp

Filesize
40KB

Download
memory/540-375-0x000000007509E000-0x000000007509F000-memory.dmp

Filesize
4KB

Download
memory/540-376-0x00000000005F0000-0x000000000064C000-memory.dmp

Filesize
368KB

Download
memory/540-377-0x00000000056B0000-0x0000000005C56000-memory.dmp

Filesize
5.6MB

Download
memory/540-447-0x0000000075090000-0x0000000075841000-memory.dmp

Filesize
7.7MB

Download
memory/540-446-0x000000007509E000-0x000000007509F000-memory.dmp

Filesize
4KB

Download
memory/540-379-0x0000000075090000-0x0000000075841000-memory.dmp

Filesize
7.7MB

Download
memory/1060-1496-0x0000000000C00000-0x0000000000C76000-memory.dmp

Filesize
472KB

Download
memory/1748-1522-0x0000000000C00000-0x0000000000C76000-memory.dmp

Filesize
472KB

Download
memory/2456-585-0x0000000000320000-0x0000000000397000-memory.dmp

Filesize
476KB

Download
memory/2584-622-0x0000000000320000-0x0000000000397000-memory.dmp

Filesize
476KB

Download
memory/4456-1521-0x0000000000C00000-0x0000000000C76000-memory.dmp

Filesize
472KB

Download