4dbb9d2f9bc24768db489de3bc13fad58cafd938e4b0c7664187c3dbbce7bcc7

Analysis

max time kernel
185s
max time network
184s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20250113-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250113-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
15/01/2025, 01:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Downloads.rar
Size

1.4MB
MD5

409440a4b2af03da8fd3f9e9e283fe78
SHA1

e5a5e98b5ce96092788e6e104beb70a5bfaa8570
SHA256

4dbb9d2f9bc24768db489de3bc13fad58cafd938e4b0c7664187c3dbbce7bcc7
SHA512

ebad1722fa8dca2016f597664b0705134ea7592cb79f840f5b1c169f70a9a759199f8797624c3183b0c8c01af98585a4f439985ae5039dc80259d222b16a420f
SSDEEP

24576:/cMlNPyEPPYT3nKMd9GOWh2XQ5pU185vkO0auLj/13yqWV74SBcjbxufdKs1juwV:NUEH46YsRh2A5pE8J4jlih+xu9k4S8fz

Score

8^/10

discovery persistence

Malware Config

Signatures

Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2826969134-2088669430-2680400721-1000\Control Panel\International\Geo\Nation	dotnet-runtime-3.1.32-win-x64.exe

Executes dropped EXE 9 IoCs

pid	Process
4464	de4dot.exe
3964	de4dot.exe
4616	de4dot.exe
3656	de4dot.exe
2876	de4dot.exe
5368	dotnet-runtime-3.1.32-win-x64.exe
5392	dotnet-runtime-3.1.32-win-x64.exe
5540	dotnet-runtime-3.1.32-win-x64.exe
2280	de4dot.exe

Loads dropped DLL 30 IoCs

pid	Process
5392	dotnet-runtime-3.1.32-win-x64.exe
5960	MsiExec.exe
5960	MsiExec.exe
5696	MsiExec.exe
5696	MsiExec.exe
3196	MsiExec.exe
3196	MsiExec.exe
2280	de4dot.exe
2280	de4dot.exe
2280	de4dot.exe
2280	de4dot.exe
2280	de4dot.exe
2280	de4dot.exe
2280	de4dot.exe
2280	de4dot.exe
2280	de4dot.exe
2280	de4dot.exe
2280	de4dot.exe
2280	de4dot.exe
2280	de4dot.exe
2280	de4dot.exe
2280	de4dot.exe
2280	de4dot.exe
2280	de4dot.exe
2280	de4dot.exe
2280	de4dot.exe
2280	de4dot.exe
2280	de4dot.exe
2280	de4dot.exe
2280	de4dot.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{784973c8-d618-4ac8-97ed-1fd52c5bdf2f} = "\"C:\\ProgramData\\Package Cache\\{784973c8-d618-4ac8-97ed-1fd52c5bdf2f}\\dotnet-runtime-3.1.32-win-x64.exe\" /burn.runonce"	dotnet-runtime-3.1.32-win-x64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
141	camo.githubusercontent.com
140	camo.githubusercontent.com

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\3.1.32\System.Net.Http.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\3.1.32\System.ComponentModel.TypeConverter.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\3.1.32\System.Reflection.Emit.ILGeneration.dll	msiexec.exe
File created	C:\Program Files\dotnet\ThirdPartyNotices.txt	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\3.1.32\api-ms-win-core-libraryloader-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\3.1.32\System.Linq.Parallel.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\3.1.32\System.Net.Requests.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\3.1.32\api-ms-win-core-processthreads-l1-1-1.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\3.1.32\System.Security.AccessControl.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\3.1.32\System.Runtime.WindowsRuntime.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\3.1.32\mscordbi.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\3.1.32\System.Web.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\3.1.32\ucrtbase.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\3.1.32\api-ms-win-crt-runtime-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\3.1.32\System.Collections.Immutable.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\3.1.32\api-ms-win-crt-convert-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\3.1.32\System.ComponentModel.EventBasedAsync.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\3.1.32\api-ms-win-core-heap-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\3.1.32\System.Threading.Tasks.Parallel.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\3.1.32\System.Security.Cryptography.X509Certificates.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\3.1.32\System.Net.Security.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\3.1.32\api-ms-win-crt-math-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\3.1.32\System.Net.Sockets.dll	msiexec.exe
File created	C:\Program Files\dotnet\host\fxr\3.1.32\hostfxr.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\3.1.32\api-ms-win-core-processthreads-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\3.1.32\System.Security.Cryptography.Algorithms.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\3.1.32\System.Security.Claims.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\3.1.32\System.Security.Principal.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\3.1.32\System.IO.Compression.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20250115010644.pma	setup.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\3.1.32\System.Globalization.Extensions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\3.1.32\System.Linq.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\3.1.32\api-ms-win-core-timezone-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\3.1.32\Microsoft.VisualBasic.Core.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\3.1.32\System.Data.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\3.1.32\clretwrc.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\3.1.32\api-ms-win-core-synch-l1-2-0.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\3.1.32\System.Text.Encoding.Extensions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\3.1.32\mscordaccore_amd64_amd64_4.700.22.55902.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\3.1.32\System.Net.WebSockets.Client.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\3.1.32\System.Drawing.Primitives.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\3.1.32\System.Xml.XmlDocument.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\3.1.32\System.IO.Compression.Brotli.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\3.1.32\Microsoft.Win32.Primitives.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\3.1.32\System.Reflection.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\3.1.32\System.Xml.XPath.XDocument.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\3.1.32\System.Net.WebHeaderCollection.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\3.1.32\System.Security.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\3.1.32\System.IO.Pipes.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\3.1.32\System.Xml.Serialization.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\3.1.32\System.Xml.XDocument.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\3.1.32\api-ms-win-core-processenvironment-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\3.1.32\mscorlib.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\3.1.32\System.Numerics.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\3.1.32\System.Linq.Expressions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\3.1.32\System.Console.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\3.1.32\System.IO.Compression.ZipFile.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\3.1.32\System.Private.Xml.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\3.1.32\WindowsBase.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\3.1.32\api-ms-win-core-sysinfo-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\3.1.32\System.Diagnostics.FileVersionInfo.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\3.1.32\System.IO.Pipes.AccessControl.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\3.1.32\System.Windows.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\3.1.32\System.IO.dll	msiexec.exe

Drops file in Windows directory 28 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e5885e4.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5885d5.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\40A3E8A8CB38EDC4299598B366C6A11B\24.192.31915\fileCoreHostExe	msiexec.exe
File created	C:\Windows\Installer\SourceHash{ABC6B3C2-1A8D-4C5E-AC16-C2AE44F02743}	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\40A3E8A8CB38EDC4299598B366C6A11B\24.192.31915	msiexec.exe
File created	C:\Windows\Installer\e5885de.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI88A4.tmp	msiexec.exe
File created	C:\Windows\Installer\e5885d9.msi	msiexec.exe
File created	C:\Windows\Installer\e5885df.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI95E9.tmp	msiexec.exe
File created	C:\Windows\Installer\e5885d5.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{A741B803-3F0E-4684-81EF-FC128D15A92C}	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\40A3E8A8CB38EDC4299598B366C6A11B	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI957B.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{8A8E3A04-83BC-4CDE-9259-893B666C1AB1}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9355.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI870D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e5885da.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9460.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9723.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\e5885da.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5885df.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\40A3E8A8CB38EDC4299598B366C6A11B\24.192.31915\fileCoreHostExe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI921B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI93E2.tmp	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dotnet-runtime-3.1.32-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dotnet-runtime-3.1.32-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dotnet-runtime-3.1.32-win-x64.exe

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5368	dotnet-runtime-3.1.32-win-x64.exe
5392	dotnet-runtime-3.1.32-win-x64.exe
5540	dotnet-runtime-3.1.32-win-x64.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\308B147AE0F3486418FECF21D8519AC2\MainFeature	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\308B147AE0F3486418FECF21D8519AC2\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\308B147AE0F3486418FECF21D8519AC2\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\308B147AE0F3486418FECF21D8519AC2\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\16B7B89C08B5A5E6745C150FE5E16EC8	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\308B147AE0F3486418FECF21D8519AC2\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{A741B803-3F0E-4684-81EF-FC128D15A92C}v24.192.31915\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\FEC2DE04A2D5C557450AB031C4BC0265\2C3B6CBAD8A1E5C4CA612CEA440F7234	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\40A3E8A8CB38EDC4299598B366C6A11B\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{8A8E3A04-83BC-4CDE-9259-893B666C1AB1}v24.192.31915\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\308B147AE0F3486418FECF21D8519AC2\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2C3B6CBAD8A1E5C4CA612CEA440F7234\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_24.84.30622_x64\Dependents\{784973c8-d618-4ac8-97ed-1fd52c5bdf2f}	dotnet-runtime-3.1.32-win-x64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\dotnet_runtime_24.192.31915_x64	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\dotnet_runtime_24.192.31915_x64	dotnet-runtime-3.1.32-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2C3B6CBAD8A1E5C4CA612CEA440F7234\ProductName = "Microsoft .NET Core Host FX Resolver - 3.1.32 (x64)"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_24.192.31915_x64	dotnet-runtime-3.1.32-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\40A3E8A8CB38EDC4299598B366C6A11B\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{8A8E3A04-83BC-4CDE-9259-893B666C1AB1}v24.192.31915\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\308B147AE0F3486418FECF21D8519AC2\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\16B7B89C08B5A5E6745C150FE5E16EC8\308B147AE0F3486418FECF21D8519AC2	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_24.84.30622_x64\ = "{8A8E3A04-83BC-4CDE-9259-893B666C1AB1}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\40A3E8A8CB38EDC4299598B366C6A11B	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\40A3E8A8CB38EDC4299598B366C6A11B\Provider	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\40A3E8A8CB38EDC4299598B366C6A11B\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\40A3E8A8CB38EDC4299598B366C6A11B\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_24.192.31915_x64\Dependents\{784973c8-d618-4ac8-97ed-1fd52c5bdf2f}	dotnet-runtime-3.1.32-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\40A3E8A8CB38EDC4299598B366C6A11B\MainFeature	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\40A3E8A8CB38EDC4299598B366C6A11B\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\40A3E8A8CB38EDC4299598B366C6A11B\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\308B147AE0F3486418FECF21D8519AC2\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2C3B6CBAD8A1E5C4CA612CEA440F7234\MainFeature	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\40A3E8A8CB38EDC4299598B366C6A11B\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\40A3E8A8CB38EDC4299598B366C6A11B\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{784973c8-d618-4ac8-97ed-1fd52c5bdf2f}\Dependents	dotnet-runtime-3.1.32-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_24.192.31915_x64\ = "{A741B803-3F0E-4684-81EF-FC128D15A92C}"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\308B147AE0F3486418FECF21D8519AC2\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_24.192.31915_x64\ = "{ABC6B3C2-1A8D-4C5E-AC16-C2AE44F02743}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2C3B6CBAD8A1E5C4CA612CEA440F7234\SourceList\PackageName = "dotnet-hostfxr-3.1.32-win-x64.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2C3B6CBAD8A1E5C4CA612CEA440F7234\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_24.84.30622_x64\Version = "24.192.31915"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\40A3E8A8CB38EDC4299598B366C6A11B\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\2D3244907645F7D5315E68CCF159655F	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\2D3244907645F7D5315E68CCF159655F\40A3E8A8CB38EDC4299598B366C6A11B	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\40A3E8A8CB38EDC4299598B366C6A11B\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_24.192.31915_x64\DisplayName = "Microsoft .NET Core Runtime - 3.1.32 (x64)"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\308B147AE0F3486418FECF21D8519AC2\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_24.192.31915_x64	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2C3B6CBAD8A1E5C4CA612CEA440F7234	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2C3B6CBAD8A1E5C4CA612CEA440F7234\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\FEC2DE04A2D5C557450AB031C4BC0265	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2C3B6CBAD8A1E5C4CA612CEA440F7234\SourceList\Media\1 = ";"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\40A3E8A8CB38EDC4299598B366C6A11B\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{784973c8-d618-4ac8-97ed-1fd52c5bdf2f}\ = "{784973c8-d618-4ac8-97ed-1fd52c5bdf2f}"	dotnet-runtime-3.1.32-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{784973c8-d618-4ac8-97ed-1fd52c5bdf2f}\Dependents\{784973c8-d618-4ac8-97ed-1fd52c5bdf2f}	dotnet-runtime-3.1.32-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\308B147AE0F3486418FECF21D8519AC2\PackageCode = "D50B189F1FB67CE4399EC2926032B041"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\308B147AE0F3486418FECF21D8519AC2\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_24.192.31915_x64\Dependents	dotnet-runtime-3.1.32-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_24.84.30622_x64\DisplayName = "Microsoft .NET Core Host - 3.1.32 (x64)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\40A3E8A8CB38EDC4299598B366C6A11B\PackageCode = "60A4CB163946AFE45A2A019A25D0FD50"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_24.84.30622_x64	dotnet-runtime-3.1.32-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{784973c8-d618-4ac8-97ed-1fd52c5bdf2f}\DisplayName = "Microsoft .NET Core Runtime - 3.1.32 (x64)"	dotnet-runtime-3.1.32-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\308B147AE0F3486418FECF21D8519AC2\SourceList\PackageName = "dotnet-runtime-3.1.32-win-x64.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_24.192.31915_x64\Version = "24.192.31915"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2C3B6CBAD8A1E5C4CA612CEA440F7234\Version = "415268011"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_24.84.30622_x64	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\40A3E8A8CB38EDC4299598B366C6A11B	msiexec.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 719409.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
2140	msedge.exe
2140	msedge.exe
3152	msedge.exe
3152	msedge.exe
2788	identity_helper.exe
2788	identity_helper.exe
4636	msedge.exe
4636	msedge.exe
5656	msiexec.exe
5656	msiexec.exe
5656	msiexec.exe
5656	msiexec.exe
5656	msiexec.exe
5656	msiexec.exe
2584	msedge.exe
2584	msedge.exe
5560	msedge.exe
5560	msedge.exe
5292	identity_helper.exe
5292	identity_helper.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3152	7zFM.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 35 IoCs

pid	Process
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
5560	msedge.exe
5560	msedge.exe
5560	msedge.exe
5560	msedge.exe
5560	msedge.exe
5560	msedge.exe
5560	msedge.exe
5560	msedge.exe
5560	msedge.exe
5560	msedge.exe
5560	msedge.exe
5560	msedge.exe
5560	msedge.exe
5560	msedge.exe
5560	msedge.exe
5560	msedge.exe
5560	msedge.exe
5560	msedge.exe
5560	msedge.exe
5560	msedge.exe
5560	msedge.exe
5560	msedge.exe
5560	msedge.exe
5560	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	3152	7zFM.exe
Token: 35	3152	7zFM.exe
Token: SeSecurityPrivilege	3152	7zFM.exe
Token: SeRestorePrivilege	1920	7zG.exe
Token: 35	1920	7zG.exe
Token: SeSecurityPrivilege	1920	7zG.exe
Token: SeSecurityPrivilege	1920	7zG.exe
Token: SeShutdownPrivilege	5540	dotnet-runtime-3.1.32-win-x64.exe
Token: SeIncreaseQuotaPrivilege	5540	dotnet-runtime-3.1.32-win-x64.exe
Token: SeSecurityPrivilege	5656	msiexec.exe
Token: SeCreateTokenPrivilege	5540	dotnet-runtime-3.1.32-win-x64.exe
Token: SeAssignPrimaryTokenPrivilege	5540	dotnet-runtime-3.1.32-win-x64.exe
Token: SeLockMemoryPrivilege	5540	dotnet-runtime-3.1.32-win-x64.exe
Token: SeIncreaseQuotaPrivilege	5540	dotnet-runtime-3.1.32-win-x64.exe
Token: SeMachineAccountPrivilege	5540	dotnet-runtime-3.1.32-win-x64.exe
Token: SeTcbPrivilege	5540	dotnet-runtime-3.1.32-win-x64.exe
Token: SeSecurityPrivilege	5540	dotnet-runtime-3.1.32-win-x64.exe
Token: SeTakeOwnershipPrivilege	5540	dotnet-runtime-3.1.32-win-x64.exe
Token: SeLoadDriverPrivilege	5540	dotnet-runtime-3.1.32-win-x64.exe
Token: SeSystemProfilePrivilege	5540	dotnet-runtime-3.1.32-win-x64.exe
Token: SeSystemtimePrivilege	5540	dotnet-runtime-3.1.32-win-x64.exe
Token: SeProfSingleProcessPrivilege	5540	dotnet-runtime-3.1.32-win-x64.exe
Token: SeIncBasePriorityPrivilege	5540	dotnet-runtime-3.1.32-win-x64.exe
Token: SeCreatePagefilePrivilege	5540	dotnet-runtime-3.1.32-win-x64.exe
Token: SeCreatePermanentPrivilege	5540	dotnet-runtime-3.1.32-win-x64.exe
Token: SeBackupPrivilege	5540	dotnet-runtime-3.1.32-win-x64.exe
Token: SeRestorePrivilege	5540	dotnet-runtime-3.1.32-win-x64.exe
Token: SeShutdownPrivilege	5540	dotnet-runtime-3.1.32-win-x64.exe
Token: SeDebugPrivilege	5540	dotnet-runtime-3.1.32-win-x64.exe
Token: SeAuditPrivilege	5540	dotnet-runtime-3.1.32-win-x64.exe
Token: SeSystemEnvironmentPrivilege	5540	dotnet-runtime-3.1.32-win-x64.exe
Token: SeChangeNotifyPrivilege	5540	dotnet-runtime-3.1.32-win-x64.exe
Token: SeRemoteShutdownPrivilege	5540	dotnet-runtime-3.1.32-win-x64.exe
Token: SeUndockPrivilege	5540	dotnet-runtime-3.1.32-win-x64.exe
Token: SeSyncAgentPrivilege	5540	dotnet-runtime-3.1.32-win-x64.exe
Token: SeEnableDelegationPrivilege	5540	dotnet-runtime-3.1.32-win-x64.exe
Token: SeManageVolumePrivilege	5540	dotnet-runtime-3.1.32-win-x64.exe
Token: SeImpersonatePrivilege	5540	dotnet-runtime-3.1.32-win-x64.exe
Token: SeCreateGlobalPrivilege	5540	dotnet-runtime-3.1.32-win-x64.exe
Token: SeRestorePrivilege	5656	msiexec.exe
Token: SeTakeOwnershipPrivilege	5656	msiexec.exe
Token: SeRestorePrivilege	5656	msiexec.exe
Token: SeTakeOwnershipPrivilege	5656	msiexec.exe
Token: SeRestorePrivilege	5656	msiexec.exe
Token: SeTakeOwnershipPrivilege	5656	msiexec.exe
Token: SeRestorePrivilege	5656	msiexec.exe
Token: SeTakeOwnershipPrivilege	5656	msiexec.exe
Token: SeRestorePrivilege	5656	msiexec.exe
Token: SeTakeOwnershipPrivilege	5656	msiexec.exe
Token: SeRestorePrivilege	5656	msiexec.exe
Token: SeTakeOwnershipPrivilege	5656	msiexec.exe
Token: SeRestorePrivilege	5656	msiexec.exe
Token: SeTakeOwnershipPrivilege	5656	msiexec.exe
Token: SeRestorePrivilege	5656	msiexec.exe
Token: SeTakeOwnershipPrivilege	5656	msiexec.exe
Token: SeRestorePrivilege	5656	msiexec.exe
Token: SeTakeOwnershipPrivilege	5656	msiexec.exe
Token: SeRestorePrivilege	5656	msiexec.exe
Token: SeTakeOwnershipPrivilege	5656	msiexec.exe
Token: SeRestorePrivilege	5656	msiexec.exe
Token: SeTakeOwnershipPrivilege	5656	msiexec.exe
Token: SeRestorePrivilege	5656	msiexec.exe
Token: SeTakeOwnershipPrivilege	5656	msiexec.exe
Token: SeRestorePrivilege	5656	msiexec.exe

Suspicious use of FindShellTrayWindow 23 IoCs

pid	Process
3152	7zFM.exe
3152	7zFM.exe
1920	7zG.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
5392	dotnet-runtime-3.1.32-win-x64.exe
3152	msedge.exe
5560	msedge.exe
5560	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4820 wrote to memory of 2876	4820	cmd.exe	99
PID 4820 wrote to memory of 2876	4820	cmd.exe	99
PID 3152 wrote to memory of 4228	3152	msedge.exe	107
PID 3152 wrote to memory of 4228	3152	msedge.exe	107
PID 3152 wrote to memory of 3140	3152	msedge.exe	108
PID 3152 wrote to memory of 3140	3152	msedge.exe	108
PID 3152 wrote to memory of 3140	3152	msedge.exe	108
PID 3152 wrote to memory of 3140	3152	msedge.exe	108
PID 3152 wrote to memory of 3140	3152	msedge.exe	108
PID 3152 wrote to memory of 3140	3152	msedge.exe	108
PID 3152 wrote to memory of 3140	3152	msedge.exe	108
PID 3152 wrote to memory of 3140	3152	msedge.exe	108
PID 3152 wrote to memory of 3140	3152	msedge.exe	108
PID 3152 wrote to memory of 3140	3152	msedge.exe	108
PID 3152 wrote to memory of 3140	3152	msedge.exe	108
PID 3152 wrote to memory of 3140	3152	msedge.exe	108
PID 3152 wrote to memory of 3140	3152	msedge.exe	108
PID 3152 wrote to memory of 3140	3152	msedge.exe	108
PID 3152 wrote to memory of 3140	3152	msedge.exe	108
PID 3152 wrote to memory of 3140	3152	msedge.exe	108
PID 3152 wrote to memory of 3140	3152	msedge.exe	108
PID 3152 wrote to memory of 3140	3152	msedge.exe	108
PID 3152 wrote to memory of 3140	3152	msedge.exe	108
PID 3152 wrote to memory of 3140	3152	msedge.exe	108
PID 3152 wrote to memory of 3140	3152	msedge.exe	108
PID 3152 wrote to memory of 3140	3152	msedge.exe	108
PID 3152 wrote to memory of 3140	3152	msedge.exe	108
PID 3152 wrote to memory of 3140	3152	msedge.exe	108
PID 3152 wrote to memory of 3140	3152	msedge.exe	108
PID 3152 wrote to memory of 3140	3152	msedge.exe	108
PID 3152 wrote to memory of 3140	3152	msedge.exe	108
PID 3152 wrote to memory of 3140	3152	msedge.exe	108
PID 3152 wrote to memory of 3140	3152	msedge.exe	108
PID 3152 wrote to memory of 3140	3152	msedge.exe	108
PID 3152 wrote to memory of 3140	3152	msedge.exe	108
PID 3152 wrote to memory of 3140	3152	msedge.exe	108
PID 3152 wrote to memory of 3140	3152	msedge.exe	108
PID 3152 wrote to memory of 3140	3152	msedge.exe	108
PID 3152 wrote to memory of 3140	3152	msedge.exe	108
PID 3152 wrote to memory of 3140	3152	msedge.exe	108
PID 3152 wrote to memory of 3140	3152	msedge.exe	108
PID 3152 wrote to memory of 3140	3152	msedge.exe	108
PID 3152 wrote to memory of 3140	3152	msedge.exe	108
PID 3152 wrote to memory of 3140	3152	msedge.exe	108
PID 3152 wrote to memory of 2140	3152	msedge.exe	109
PID 3152 wrote to memory of 2140	3152	msedge.exe	109
PID 3152 wrote to memory of 4100	3152	msedge.exe	110
PID 3152 wrote to memory of 4100	3152	msedge.exe	110
PID 3152 wrote to memory of 4100	3152	msedge.exe	110
PID 3152 wrote to memory of 4100	3152	msedge.exe	110
PID 3152 wrote to memory of 4100	3152	msedge.exe	110
PID 3152 wrote to memory of 4100	3152	msedge.exe	110
PID 3152 wrote to memory of 4100	3152	msedge.exe	110
PID 3152 wrote to memory of 4100	3152	msedge.exe	110
PID 3152 wrote to memory of 4100	3152	msedge.exe	110
PID 3152 wrote to memory of 4100	3152	msedge.exe	110
PID 3152 wrote to memory of 4100	3152	msedge.exe	110
PID 3152 wrote to memory of 4100	3152	msedge.exe	110
PID 3152 wrote to memory of 4100	3152	msedge.exe	110
PID 3152 wrote to memory of 4100	3152	msedge.exe	110
PID 3152 wrote to memory of 4100	3152	msedge.exe	110
PID 3152 wrote to memory of 4100	3152	msedge.exe	110
PID 3152 wrote to memory of 4100	3152	msedge.exe	110
PID 3152 wrote to memory of 4100	3152	msedge.exe	110

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Downloads.rar"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3152

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\" -an -ai#7zMap4174:116:7zEvent27733
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1920

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2972

C:\Users\Admin\Desktop\de4dot-netcoreapp3.1\de4dot.exe
"C:\Users\Admin\Desktop\de4dot-netcoreapp3.1\de4dot.exe" "C:\Users\Admin\Desktop\Zoldyck Aim Panel.exe"
1⤵
- Executes dropped EXE
PID:4464

C:\Users\Admin\Desktop\de4dot-netcoreapp3.1\de4dot.exe
"C:\Users\Admin\Desktop\de4dot-netcoreapp3.1\de4dot.exe" "C:\Users\Admin\Desktop\Zoldyck Aim Panel.exe"
1⤵
- Executes dropped EXE
PID:3964

C:\Users\Admin\Desktop\de4dot-netcoreapp3.1\de4dot.exe
"C:\Users\Admin\Desktop\de4dot-netcoreapp3.1\de4dot.exe"
1⤵
- Executes dropped EXE
PID:4616

C:\Users\Admin\Desktop\de4dot-netcoreapp3.1\de4dot.exe
"C:\Users\Admin\Desktop\de4dot-netcoreapp3.1\de4dot.exe"
1⤵
- Executes dropped EXE
PID:3656

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4820
- C:\Users\Admin\Desktop\de4dot-netcoreapp3.1\de4dot.exe
  De4dot.exe
  2⤵
  - Executes dropped EXE
  PID:2876

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x140,0x144,0x148,0x11c,0x14c,0x7ff811db46f8,0x7ff811db4708,0x7ff811db4718
  2⤵
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,13262064393674085628,4552574251537753306,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2212 /prefetch:2
  2⤵
  PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,13262064393674085628,4552574251537753306,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,13262064393674085628,4552574251537753306,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2776 /prefetch:8
  2⤵
  PID:4100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,13262064393674085628,4552574251537753306,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3680 /prefetch:1
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,13262064393674085628,4552574251537753306,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3700 /prefetch:1
  2⤵
  PID:1484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,13262064393674085628,4552574251537753306,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:3728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,13262064393674085628,4552574251537753306,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3180 /prefetch:1
  2⤵
  PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,13262064393674085628,4552574251537753306,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5620 /prefetch:8
  2⤵
  PID:1464
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
  2⤵
  - Drops file in Program Files directory
  PID:5032
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x264,0x268,0x26c,0x240,0x270,0x7ff7cfdf5460,0x7ff7cfdf5470,0x7ff7cfdf5480
    3⤵
    PID:2524
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,13262064393674085628,4552574251537753306,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5620 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,13262064393674085628,4552574251537753306,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:1
  2⤵
  PID:236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,13262064393674085628,4552574251537753306,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:1
  2⤵
  PID:5208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,13262064393674085628,4552574251537753306,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6204 /prefetch:1
  2⤵
  PID:5460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,13262064393674085628,4552574251537753306,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5532 /prefetch:1
  2⤵
  PID:5468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,13262064393674085628,4552574251537753306,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6428 /prefetch:1
  2⤵
  PID:5772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,13262064393674085628,4552574251537753306,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6296 /prefetch:1
  2⤵
  PID:5780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2156,13262064393674085628,4552574251537753306,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6112 /prefetch:8
  2⤵
  PID:6084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,13262064393674085628,4552574251537753306,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:1
  2⤵
  PID:6092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2156,13262064393674085628,4552574251537753306,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6968 /prefetch:8
  2⤵
  PID:6140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2156,13262064393674085628,4552574251537753306,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6728 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4636
- C:\Users\Admin\Downloads\dotnet-runtime-3.1.32-win-x64.exe
  "C:\Users\Admin\Downloads\dotnet-runtime-3.1.32-win-x64.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Time Discovery
  PID:5368
- - C:\Windows\Temp\{953D0C29-B7C2-4E36-A454-540AA7163851}\.cr\dotnet-runtime-3.1.32-win-x64.exe
    "C:\Windows\Temp\{953D0C29-B7C2-4E36-A454-540AA7163851}\.cr\dotnet-runtime-3.1.32-win-x64.exe" -burn.clean.room="C:\Users\Admin\Downloads\dotnet-runtime-3.1.32-win-x64.exe" -burn.filehandle.attached=568 -burn.filehandle.self=676
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - System Time Discovery
    - Suspicious use of FindShellTrayWindow
    PID:5392
  - - C:\Windows\Temp\{D2715D87-202F-4CDF-8EF1-4507ABB52AC6}\.be\dotnet-runtime-3.1.32-win-x64.exe
      "C:\Windows\Temp\{D2715D87-202F-4CDF-8EF1-4507ABB52AC6}\.be\dotnet-runtime-3.1.32-win-x64.exe" -q -burn.elevated BurnPipe.{30A9AE74-8E16-484F-A509-B8B6CDF09225} {4144EA29-3845-4C82-8A5E-00BF7954B967} 5392
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      System Time Discovery
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      PID:5540

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:236

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3728

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5656
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding E791A57AAE90C225C53145547D241F54
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5960
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 26B62BCA35870EE0887D70589994AD74
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5696
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 2FB642A2996A7A795F217181A2C08A6B
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3196

C:\Users\Admin\Desktop\de4dot-netcoreapp3.1\de4dot.exe
"C:\Users\Admin\Desktop\de4dot-netcoreapp3.1\de4dot.exe" "C:\Users\Admin\Desktop\Zoldyck Aim Panel.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2280

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
PID:5560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x128,0x12c,0x130,0x118,0x134,0x7ff811db46f8,0x7ff811db4708,0x7ff811db4718
  2⤵
  PID:5544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,7491345928552012920,10379633117377506353,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,7491345928552012920,10379633117377506353,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,7491345928552012920,10379633117377506353,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3000 /prefetch:8
  2⤵
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7491345928552012920,10379633117377506353,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
  2⤵
  PID:3892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7491345928552012920,10379633117377506353,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:3836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7491345928552012920,10379633117377506353,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:1
  2⤵
  PID:5236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7491345928552012920,10379633117377506353,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4148 /prefetch:1
  2⤵
  PID:5424
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,7491345928552012920,10379633117377506353,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5508 /prefetch:8
  2⤵
  PID:5248
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,7491345928552012920,10379633117377506353,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5508 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7491345928552012920,10379633117377506353,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:5888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7491345928552012920,10379633117377506353,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3576 /prefetch:1
  2⤵
  PID:732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7491345928552012920,10379633117377506353,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5328 /prefetch:1
  2⤵
  PID:5436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7491345928552012920,10379633117377506353,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7491345928552012920,10379633117377506353,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:1612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7491345928552012920,10379633117377506353,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3952 /prefetch:1
  2⤵
  PID:5360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7491345928552012920,10379633117377506353,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5948 /prefetch:1
  2⤵
  PID:6140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7491345928552012920,10379633117377506353,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5740 /prefetch:1
  2⤵
  PID:5948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7491345928552012920,10379633117377506353,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6080 /prefetch:1
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7491345928552012920,10379633117377506353,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6292 /prefetch:1
  2⤵
  PID:5288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7491345928552012920,10379633117377506353,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5720 /prefetch:1
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7491345928552012920,10379633117377506353,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6336 /prefetch:1
  2⤵
  PID:3324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7491345928552012920,10379633117377506353,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6524 /prefetch:1
  2⤵
  PID:5156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7491345928552012920,10379633117377506353,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6508 /prefetch:1
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7491345928552012920,10379633117377506353,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6780 /prefetch:1
  2⤵
  PID:2332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7491345928552012920,10379633117377506353,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 /prefetch:1
  2⤵
  PID:1292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7491345928552012920,10379633117377506353,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:1
  2⤵
  PID:2088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7491345928552012920,10379633117377506353,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6776 /prefetch:1
  2⤵
  PID:5688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2112,7491345928552012920,10379633117377506353,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4080 /prefetch:8
  2⤵
  PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7491345928552012920,10379633117377506353,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5832 /prefetch:1
  2⤵
  PID:2940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7491345928552012920,10379633117377506353,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6780 /prefetch:1
  2⤵
  PID:5888

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5632

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e5885d8.rbs

Filesize
55KB

MD5
2407e9801250961f0e76b3e7fa4b5f26

SHA1
0fec59808bca5596f748ae537e6a3679bf8b9a11

SHA256
30bc8a2e782a9138eb5c81e74b00efef7ad19cba5a46d81613a04de0da3c392f

SHA512
4001f05c75778e7b9c41b64288d3dff390e3b6a0e7470cb69bf97c211bb04e22fad793465ee9bada7feeda72df728b26b2f766f3bac36c13c8c378904336f1f3

Download Submit
C:\Config.Msi\e5885dd.rbs

Filesize
9KB

MD5
49e41b707f1d9a07d2d323e23fe61e02

SHA1
5b441b2cd6b4668b685145fafc98d39070384316

SHA256
594710be91307d04694c241a2dca42c0da17f38d2c7a9532059fc25311af6edb

SHA512
36eb4baeae8f8b0d0e0b68e8628badee2ace4b27161492267a29af6c14aad4faf14421ddf86540df62723cba8403d74c0a7f3ef80e99a5ade9a8b62f6b013657

Download Submit
C:\Config.Msi\e5885e2.rbs

Filesize
10KB

MD5
ea1553d2a952998f68762eadb5b3577e

SHA1
13a10a1472683a2bafe43fccef6d399a66118be8

SHA256
238cb2b5fd869797cf09b5b0dc470c0e61ca04a0f9e65a6ae1797c1eea74ac82

SHA512
3841600a6d2c3b98885e69262c3efa85275d0caab1b1b1fda8ced037955dc114004ed7f1cff3936b14e99222f27781bac798b0962156cdd3186a0ac1f6ba3231

Download Submit
C:\Program Files\dotnet\ThirdPartyNotices.txt

Filesize
31KB

MD5
3782925318a682b12aecc11fe37cb4d1

SHA1
97adc7d7e8f0fde6fea76e1420c008a8b1b87c7c

SHA256
2e3b2cb5cb57ff44310801dd46e51dab1d35d9cfe196a9709ee8cb9c6f8e4d4a

SHA512
cc99f07fd1971fe732de4bfff4a83be6e10464708e8b37c8b5c2cf840d6ef36e4b29d6f80bcc6ad498859cc92d5ba2265b6e7f408ffdab08cacaea69fcab3929

Download Submit
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\3.1.32\Microsoft.NETCore.App.deps.json

Filesize
52KB

MD5
2738af1f250227741b3c18819dfcf2db

SHA1
26633b524b5132292b7e2bdd2017a1f9e42d653b

SHA256
fb38433c12b88e061fd26213baf55cd416a71e0d2704735bfd3ec08ffeef24e4

SHA512
078af1ba42010f9fe515e11ce62c102c0be2698f0428103f202111d30343f2ea0016ca7603117489f6230c37f8f82f966188c887ed0a6b54a2231b9db29b3b9b

Download Submit
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\3.1.32\System.Private.CoreLib.dll

Filesize
9.1MB

MD5
3bef1d84ef1785381eff399adec681df

SHA1
6a933f1c9f8f5cecb0ffa9aa0d6b382854ed99ae

SHA256
43ccf83cf6dd08e2ba9159990a0b099493667c423de51b1db1191f05a748fe51

SHA512
9f436e7eb201927663b93e691d781b44d2d34011215a2b4dbf7584e5d788528f7601a7e9e4bbf422734ab9792984a44eed2bf5d9298940eb37420bfdef2066c2

Download Submit
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\3.1.32\clrjit.dll

Filesize
1.2MB

MD5
8e636859f42c166c13eb041311299b8a

SHA1
d5b0d5104c5cfe1b7b2c95d7680c2e84d4f0d70b

SHA256
d713a5bafa2ef2fa7c1594d9c22d03357f62f8cb359208bf9e3616639dc351f9

SHA512
a5fbee9f04f5ef53c6ab2c666cb1f9e620ceacb25fc2eeb8a079887e2f3f3a3bbee88c6036d39125138f93c599986697444707db90e5ac30515e59d54246e094

Download Submit
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\3.1.32\coreclr.dll

Filesize
5.3MB

MD5
a2820e527c4b99c4c649df4e54d4f38d

SHA1
a2bca67626d532a3b1a96c5d913958470faa4727

SHA256
100a032cbeb299c8d7cfe02fb39ca59c8d17fbbe276ed1da577c0eb6444b1a51

SHA512
a0942fbe93394d0978cf5f9747fdff4db90faa88b264dc56ae79d50fc0fc17b2701a211a46fff86d579465273156fb278f49a89e5abd6c63fa7acccdd03a6627

Download Submit
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\3.1.32\hostpolicy.dll

Filesize
382KB

MD5
314f06e61af6221c9b4b0af77e1af522

SHA1
73b811d6488ab3dbb7edf9cf7d3daa0ce2343585

SHA256
ee653d530f0ba5bf0e7f691825dcbd2dc6995374820d7e4aef0604cc47c3b3ab

SHA512
b05785222438da0f1b0a30ed77d3977c8a96fda00cfe8475816cbcc9b05176253d8a150d713ca99f58145d36ecce7ab643cfc15def39e1169a122dcc2cbd863b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c58ccb4da696442ae40d3db9e4b41c3f

SHA1
e27933a94d57f04c75b8bff25ad7012171917f87

SHA256
d0d75be801bf0c5f715665c73214bfa38fd714dd9ee846de410855d96dd75931

SHA512
82a7cd39758d67f1d177ce7f46a5ee560eb60207ca7ca1e39b9a08a269ed140532bf1ec85899a033a54d20a0d59592d1cd5f5d35f71da98f6b6e35cd904e1872

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ef0e81b130f8dcf42e80097a75e5d04d

SHA1
d8694b7c5fba1ee2e73e69dd7790ca5b1cb882db

SHA256
fc53158d948d1742e3f960124f9fdb138eaa4aa711d0f43833fa893247de4918

SHA512
c85df1696537dfce601de46183b1b22d7f0007b0f695f1904bbd1a6e429d7787c3d6199bcecdb21936d811b35eeca57a9800bcd3a3b585569aabeb0b5b497efd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
60b4c78e9eb27ebcdb2fe29982c1d37e

SHA1
14f89b9642766a02945586205a79e9a2798f465f

SHA256
9ea7d5b79708bfeb3058f8a6a1e0463f22480f793c95ff4f88ec135fb38f1c6e

SHA512
caed905cff1db31fa95a30d9bbf43da085d7f4dc8273b7168faa92fd1bcf1fff39c1998c188443ee8e95a08476c70506156be891c29a84f179890a60cc27ce58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1579f51260473fd0571c4002fa48148b

SHA1
661a5657a49aa2dc018248f4aa277d5ee616b333

SHA256
ce1a8177f4564166602d67b2fdc5a0bb7cafed87576bed67fd1b57081bf309c1

SHA512
3c475bc3f180ac29cfab605f50dedda4c3f5e7a90cca8b902091c40b6f55259b2f521bfd0da1dd7b527aeafd203c094988ef236edfde7f94edab65cae47051e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7893f38710a33af62811eddd7e68f0fa

SHA1
cf8948f836ebd7dc1348dce3a4dd64a29e6d5528

SHA256
2ac38c1d7da21ff909f788ad78b2d4aca6e90038a3c6fc47a3706215b1f02b33

SHA512
3549ab0b1b41eedbfec198ca3137ada125c91cf832c8218c37309a2f5cf0f83a049cf9ad5f372ed3ca0438967a2b8ab0f13b777648dc31b133b9fc7170110e86

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

Filesize
42KB

MD5
5aaa8c37cd59979b920cd21c4a50a38d

SHA1
0ee61e3b2d58513b92cf4c6b5114c1beb55539e7

SHA256
db6c6f42e1d56092fb2c3d317968077cb29435139274faefbf4ab7681955bec6

SHA512
0fb4c45db9f29963fce195e79b4e9963e57a50ef0fcab74466d6034834e0099f1f344a8569973d4c1ece05d9b70b5938b42ead4fabaa08de7d24c911df28c235

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000014

Filesize
62KB

MD5
c813a1b87f1651d642cdcad5fca7a7d8

SHA1
0e6628997674a7dfbeb321b59a6e829d0c2f4478

SHA256
df670e09f278fea1d0684afdcd0392a83d7041585ba5996f7b527974d7d98ec3

SHA512
af0d024ba1faafbd6f950c67977ed126827180a47cea9758ee51a95d13436f753eb5a7aa12a9090048a70328f6e779634c612aebde89b06740ffd770751e1c5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015

Filesize
67KB

MD5
69df804d05f8b29a88278b7d582dd279

SHA1
d9560905612cf656d5dd0e741172fb4cd9c60688

SHA256
b885987a52236f56ce7a5ca18b18533e64f62ab64eb14050ede93c93b5bd5608

SHA512
0ef49eeeeb463da832f7d5b11f6418baa65963de62c00e71d847183e0035be03e63c097103d30329582fe806d246e3c0e3ecab8b2498799abbb21d8b7febdc0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000016

Filesize
65KB

MD5
56d57bc655526551f217536f19195495

SHA1
28b430886d1220855a805d78dc5d6414aeee6995

SHA256
f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4

SHA512
7814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000017

Filesize
19KB

MD5
2e86a72f4e82614cd4842950d2e0a716

SHA1
d7b4ee0c9af735d098bff474632fc2c0113e0b9c

SHA256
c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f

SHA512
7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001b

Filesize
38KB

MD5
76f7354c17aa63b11ddcea80b80e91ae

SHA1
ae880c27eb279f42ed434ff1fc3dc88195c582a1

SHA256
540c2ef79b0220f373414885fcd094ad16d8a8db189f82d87d259cece5ea3c12

SHA512
9b4c4446578d22204ebdc3aa205aaf9351024b2dc5415372fdcac237fcf922ce98be33e4db08f506965f94feb0f054cfdd81396fa677903ccd2b4e9065d0a899

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001c

Filesize
37KB

MD5
9f394757279a4ff3ad2a3b668e96c107

SHA1
131eaef19e2953762922d0403a79c663474aa48f

SHA256
5144936a5db002ac68fcedc9c3336a0e0fb038c8dafbcf025f1641986d4193d4

SHA512
aa8b10b03b5986ce59c83b8de223b68cc21fd3163acd1834d288b54382ae5410125f45ab62cf52c12eb20e9d9b630b34fd08686426b2764680d9447d8b69684a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001d

Filesize
20KB

MD5
8e7ebded7f0ce6fa732cdddb907fb249

SHA1
b21ad396a0d0a73e0f839d21a50664a1034253f1

SHA256
8213a00e8a037b13d0e30e936cf94ee04f1ad72c29a0e26cbc180bfbd3791a2b

SHA512
25092676fd31505bc1d81ef448a2fd6cb7124bc7ca2909486eb6b9f330a57aa1f2e9f279cab3ce3ad45327d175944a9c7ea4b843784d0139604e630d9c4c0141

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001e

Filesize
20KB

MD5
0b17fd0bdcec9ca5b4ed99ccf5747f50

SHA1
003930a2232e9e12d2ca83e83570e0ffd3b7c94e

SHA256
c6e08c99de09f0e65e8dc2fae28b8a1709dd30276579e3bf39be70813f912f1d

SHA512
49c093af7533b8c64ad6a20f82b42ad373d0c788d55fa114a77cea92a80a4ce6f0efcad1b4bf66cb2631f1517de2920e94b8fc8cc5b30d45414d5286a1545c28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001f

Filesize
26KB

MD5
73fc3bb55f1d713d2ee7dcbe4286c9e2

SHA1
b0042453afe2410b9439a5e7be24a64e09cf2efa

SHA256
60b367b229f550b08fabc0c9bbe89d8f09acd04a146f01514d48e0d03884523f

SHA512
d2dc495291fd3529189457ab482532026c0134b23ff50aa4417c9c7ca11c588421b655602a448515f206fa4f1e52ee67538559062263b4470abd1eccf2a1e86b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000020

Filesize
18KB

MD5
8bd66dfc42a1353c5e996cd88dc1501f

SHA1
dc779a25ab37913f3198eb6f8c4d89e2a05635a6

SHA256
ef8772f5b2cf54057e1cfb7cb2e61f09cbd20db5ee307133caf517831a5df839

SHA512
203a46b2d09da788614b86480d81769011c7d42e833fa33a19e99c86a987a3bd8755b89906b9fd0497a80a5cf27f1c5e795a66fe3d1c4a921667ec745ccf22f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000021

Filesize
18KB

MD5
f1dceb6be9699ca70cc78d9f43796141

SHA1
6b80d6b7d9b342d7921eae12478fc90a611b9372

SHA256
5898782f74bbdeaa5b06f660874870e1d4216bb98a7f6d9eddfbc4f7ae97d66f

SHA512
b02b9eba24a42caea7d408e6e4ae7ad35c2d7f163fd754b7507fc39bea5d5649e54d44b002075a6a32fca4395619286e9fb36b61736c535a91fe2d9be79048de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000022

Filesize
58KB

MD5
7f78b5c2a13cb0e1957c2ed4f96e061d

SHA1
15a2c25f28c9eeca3ff99c40c484322085f97a43

SHA256
c8396a3769b2ba25e7ba13c72fbbddad432c434dd97e3e3302d139820407a047

SHA512
c404b33ae1bb881761dd1b2f16b231ccef58c4e8d798d4d70ee06b11ec8f54b79d3c65d8d22c1d7b29a60c1166b743469fb16b3d886d7d7999f8d844078db45f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000023

Filesize
40KB

MD5
3281e04c2649cc5abf9df120a9c3f6f2

SHA1
c25a35c2500796ea6dd51f23833fe6c52d4a2ad6

SHA256
81cbd41e91f2a234a41595bfb05beb47ce1672819ea58de4176080fa7a985d25

SHA512
a3bf12e837353de934a13af36d94a755d541c144b9b374513050d39a9c71172137c038540d6c8e7b6ae79a4736f3d9e40c17db38293a3ff4f56a0da5591ca042

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000024

Filesize
53KB

MD5
2ee3f4b4a3c22470b572f727aa087b7e

SHA1
6fe80bf7c2178bd2d17154d9ae117a556956c170

SHA256
53d7e3962cad0b7f5575be02bd96bd27fcf7fb30ac5b4115bb950cf086f1a799

SHA512
b90ae8249108df7548b92af20fd93f926248b31aedf313ef802381df2587a6bba00025d6d99208ab228b8c0bb9b6559d8c5ec7fa37d19b7f47979f8eb4744146

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000025

Filesize
87KB

MD5
65b0f915e780d51aa0bca6313a034f32

SHA1
3dd3659cfd5d3fe3adc95e447a0d23c214a3f580

SHA256
27f0d8282b7347ae6cd6d5a980d70020b68cace0fbe53ad32048f314a86d4f16

SHA512
e5af841fd4266710d181a114a10585428c1572eb0cd4538be765f9f76019a1f3ea20e594a7ee384d219a30a1d958c482f5b1920551235941eec1bcacd01e4b6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000026

Filesize
25KB

MD5
2863ef4fd88221dba09a7e72dcb8225b

SHA1
9a7f8cfb062d8b5713d90e2b32c878b834f85a1f

SHA256
e193edeebafd52b8efeb11f12b4c8e6896a82f81370fdc8684072a5f75c9e13e

SHA512
18d3d272ee719b2c87a7ee4175bf0340a9b2b24f26e37bc1a3b5e769d5f49f870ce63de866826d9a62770a6e32a9ac656bff04b9ad8406e7d560b0d8009226ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000027

Filesize
107KB

MD5
5229229ea75490496d7f8a86d5c2860a

SHA1
f2deb6d9b43e811f486fac1fbee1d9517ce9b0dc

SHA256
487cfcbffcf804d2965bc4d45d846acd8724562714ceae80bfe1ca78534aea58

SHA512
9b42f14e130181117e2379ff23d6e08bfe739e27b0756785d6f20669139d870d4f73d03653d820f278a71f2371213a0104158d791ab867622014b1ab8d637520

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002a

Filesize
16KB

MD5
5615a54ce197eef0d5acc920e829f66f

SHA1
7497dded1782987092e50cada10204af8b3b5869

SHA256
b0ba6d78aad79eaf1ae10f20ac61d592ad800095f6472cfac490411d4ab05e26

SHA512
216595fb60cc9cfa6fef6475a415825b24e87854f13f2ee4484b290ac4f3e77628f56f42cb215cd8ea3f70b10eebd9bc50edeb042634777074b49c129146ef6a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
432B

MD5
cbae73de0a6f35868c3d4914643bc584

SHA1
0c58498891d1a3e0bcc0999bbb2dc15640ea733d

SHA256
2809a79c91c35f617ee040e616c80fb71e40b3d38b3191878fedab78b003064f

SHA512
b03589c50114104595f2ba90b17e92bf408b0370fbc7c4c39d1b26bab091658a888a6eb8c1a2124db8d708a3312b45ab844a7b7aec518cc1e35f5ac478d519d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
8d9cf16bdfdd79b114bebd1b470a96d7

SHA1
61822381ed3af76e584512253b66e1473ce4e169

SHA256
c811aaf2bd7a1d16d697ef61c29fedf29ffde651b4c51a02ae111dac18397e90

SHA512
6abbea2b69539431b12f1f440bf0b660d11a2a7fdd4c18a692b3a769b9ef6485f8731b6e00a8aed5dac1fdac9fc10b709569674b6279839d548b0ff98f51b88d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58894f.TMP

Filesize
48B

MD5
aa4a87f1c267abfc9fe771a36563ca67

SHA1
15d5ce7dbdd2272e17ab7e41660db471dc88edeb

SHA256
d52f166b5c6075301503bb8f4b9b0675c1a90106288cf2c67b56649399732f48

SHA512
41afe48069a42dc516d29826852bc551a3866d43105b2f47515b1edb2eeff9cd2ca2863a09f99007f10e9843faed0e0cf2eb5baaf84a0dd8d733820868ff10f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
1d5a23cd6a856336536b115d78d9edd0

SHA1
a78a70681b6eb2b21f31b3bb2890a7812dbb78e9

SHA256
f4d989590b12301fef65f604f91056738d602bde1bbbd3dd7235b77fcd8f76fe

SHA512
a42b13d5ac1f5a96388152088a35129a8d03fe9f5599b59efa6435fcd286bad932a5c34fe559dae82d309f6bc1e78f550d5eaea16dd7232749b7950a9d1c6e66

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
d62bd73466258bc3645093a32738a85a

SHA1
8f08fb48b4a7d0a025c3160de0bdd57668e319cb

SHA256
cfb0ed1180d784cc530ab5ebbe3ba9df0b80803ff8026aba266ba995e90eaafe

SHA512
8151eeaad52b54e163441f039ee00bd414d3464d167710ca8d7a43a96f4d669e8658526848d9e60027c0e621230d873de233d45ab787275e52a21da524efb651

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
908d58376da70911a543cd318bbc821a

SHA1
7a485067de46c0e60f225ffcf041597bacd182fa

SHA256
5bdaef20749a9803fe461fe326497bdcc865049000291dfe3702506d165b4368

SHA512
7fe37c9a08864796f3c77c26ab9088fd9f41e89b6c110dd1c299c9152dc3b11a6fe34487213588e9d6147b4a2fc6f3131aff31bfc7fd273f3c75ebe56c1d3239

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State~RFe5889ad.TMP

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3c40b09e0d7f97ba833978b72c507479

SHA1
32edec3803065b1ff9f457181f606447725d8b4e

SHA256
2682c393bf0aba42a413dea70456a7e86a6f2f91258c197c2d388ae6b244f01d

SHA512
5767d8b5d310527d109519515a33fa4afe72847b3c98d81801bef38799371b3ba174f79485c9144c5a0642c626443f529a5284eba54ee75a1871f1ab64ef3029

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
aecca650188cfc06c28833949c7813e8

SHA1
fbfa59fe8217e933d67051408606d7ff8a46457a

SHA256
dc3283412c87cabbb86aff1bb6b4ee73e424910f139b187c5df77202418381b8

SHA512
825b3d02ccfb9647b9a372db62cf948fb066f7a2a8b7f398b86c133c14d0e3bafa8609c0a890793a2c6fd47e6c29efd35acae0e030689bb663c910516eadd2db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
efbd36f4f8d4002877085916d0ff351d

SHA1
28b1e0b4752b509ded20a2fd3ac141d08763c7ef

SHA256
ceb7e34f65081b739cd2a60f598eeaa52d7d007fe68e037dfe6aa45f2b629252

SHA512
89da5d0e3b8f4d4d0417e35fd649faddfe2eb0e4c02877091754de2e4fc023ed522d65d34cb1393d4261d89bae834846d7bcf6d2a47b7e97a06284da519d289a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
d457f3b11a0b5ae843273fcda5a1c361

SHA1
f3adafb2b6ac6810ff08513fc1544c076d020b42

SHA256
d34ff20a1025c9fbbd5577584dc9ce6832ad20a1b66d852282bc9c9c77b73b7a

SHA512
5f07b0936859ee6802702550e5dfc86117fc4c3ee4b31385b9f4ce9a73111b4191d25b1348dbe1f108ad25c8f8aa45d24137e4e1ef856fd4a1e908180eea79f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
cabc931490f3c02c74d02d16e300aade

SHA1
eb0560962575847e884c62e9bc9d5ad3ea1a1c9c

SHA256
bc7bafee841ad42e4ff278992c99ee242252b13ac9ac1776e0dad6134a5db8f2

SHA512
bf54d03fc9e724fa488a95491c047f206e07e65518897e313ec2387ae4a81b3df61b088705ada3ae495861e77afb8d97fa6520c6cd48e49fe1420f3b3ad99364

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ee39999e9d5c6afe9a51c6e5232b96f6

SHA1
1d5323f4097ab0528ff37bce76dcdc650314e2e1

SHA256
6f3d64c170f5e6a1c2fc99eee3302b10740d84e53d61646f6731842e35aa0b8b

SHA512
bfe33eb2c44a66dab6b17d5913fdab32bd6c2b6e3d339fb92c1b707a68f056cd4f2f7f80f146e3fd70b9ba261978bcb69fbfb86e06428e23e8c6b25161f42060

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
4bd1b16a82a3592010ec1bbc269f98c0

SHA1
00cdf816f5529fd0d3eac43563d52bc430c2099e

SHA256
46f6fb8ba88054d049a83d056b998dc38f6a27841557ec16573834e2907362f6

SHA512
7f906f55718ef45c3e291fc7356d9207e74bd9de1b917e150289d7b2e54dd3dd918958d78549007353ee833dd909af364980b22c245de5e1b48bc4c1d3894065

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
89a8a0f4da1478619abca55752ebb19a

SHA1
068c51cf89fb794f5d59e720033dc1f955255f4a

SHA256
1ba57a8809d644be51973988c8e5ec76cc9ce7e98f3cb91a8644a132a17fa4a1

SHA512
cad7afcf605ea7598ae535934e6e4276e9a5c2f6c46930825a117dd49a7e87b8d0b6b23a8fefd5f96d8f8dc3880ef81f161a799169174776196c33228620def7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a30e6dfdcd01f9d7911f8654934e65ad

SHA1
cdd88f784191f6d5b490fabda14fe08435b4f719

SHA256
72580e10ecb1963baaa71cf19a5d081dde01d6c14a73e1965f4a4d5edc35501b

SHA512
16103adc25ead9d1ea3cb0e5e29b7c7b12b73f2506f1340c8edb45d6fdad8929d881a6bd8160df4dbd2d980356ffa0f860a226b86e6bf9ec7a91f53e61aa9f12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6c00359ba08e9b1adcd5ea15810b7a94

SHA1
753290e8e5c6f7b4614974eb2fb164df15e1946d

SHA256
38be711af2590ffd3798440f20707caa825348978c3b7c20d1b3d9ce735cde15

SHA512
58a18ea84156647a76a22314e4a1b0eadf2c247442aa9ea32673aa6c44d12d7b93ce57708ec8222cedffd46aaaacef3707264551ac278554aca59183da2f4fd6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
3e9c64e0dae975d1a96130ddcad2e036

SHA1
afef9c299b7670aedee3202219523aee75c91d93

SHA256
1c912550de63aa490856a5acf69d9d8393e7cfd955b90ab00b26867ff12eb5b7

SHA512
c20c23e28d79b09e905a8984225f8098554cb936fe3aa051c62f462efc233a7cf3b65f9ad5e30840111933ba366b641ba5098b3908652d171f3e262bdb47297f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
62aee047a3c6cf2fec2a29a34157633b

SHA1
51b6eed704d65a62d8793ea18885d12aa39a5cf2

SHA256
342e67b65a4070bbd6e7c2fbf75c98e727d9db45fa071181cae0f5eade726ddf

SHA512
21ee4907a0dcf077f9233542462b8bfd01d976dc1fe4a7b7c4ad70d691e7b9101bddcc292e13fc83a22f56355aa5b93949ac124c84da1f43a80851bf313d895e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
a18e33a424007376b810134dde07fec6

SHA1
3acbb4070e7fab6fea0f6c618aeca0964e39f7f8

SHA256
12852fe3bc04c3a3f6cdb76d7fa37cf0d7f91ffe801c70caf5ee4f5bb34e2821

SHA512
3a08afee6762546ba967965d72b90a0e0ed2a45bee0e195696c92f511c4b92634acdb669e6320359cb436e809c9672c0371042990aaf26b90da06da523ce6b9b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
ebb72f9966c513a0a406a4b6755b9d26

SHA1
13ae6d128cdf28cf37eb2c9508cb8d47e4ef0c0b

SHA256
38da558bdca429b4c3aa7b9b5cbe0caf91d30050bceab5e8df66fe48a2765013

SHA512
b6b0fcdf0c06e6d11ac17ec3bf900490c2b20cb4b9b1caa561df48cba57fb111de77996ef3492dae9911afef19eec8ea1340a30bdf92c4292f03e194ed533ab6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
22a45eb475612585dc30942541630008

SHA1
f80098eea870b3639f9548d7a8e0b3bb6128e7c1

SHA256
a7a7424bff10f1708d0c6a31f40f5f67c797a0f7c7d813f85e552f15a6a0aa47

SHA512
d020c7f14ce8cfef54ddadc9a4192f8a23d32c4dc2b3cf2a17aa6be5cb37ed4ce778aa2a64397b3303cc0a8d7d86c0129ad4c74b77ed5b1f5df9581a9c744bb3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
0521685248a027013fcb566a467036b9

SHA1
391dddf31cf3b10417adc326efb5a01e68bd8e57

SHA256
d66abc8c289078cbb9be67aab9998b89252e88263109e0cac5d63845e83250a6

SHA512
215a2352aa02ff67ad89aa5b36d09b55d28cda528b8acfa124280fc54dec40650f45649770fcaa60362770e0a659cf00fdf83a66daace146b128a6701a7dcb7b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
5a326fba3a4a09fc28d7cac71a426451

SHA1
b8dc4400b42a46367fda4e20b88977cfe8efa8b3

SHA256
02b9c76181357196c32cebc620857aab20312ed64623b0bd77f6a7df37893cb5

SHA512
2222095e63c532132a1660a3a504939e2dde43b639511a3539613a1423ed01c4d6687501b04422d70b733b6d7002d44974306f7fbbb5280b6acbe142e99d682b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
7e9bc5ecd8b5ec6f03f6167e62b3db0d

SHA1
c5c57152ee437b73afc77c23f6b809184f263dcc

SHA256
2b326ce1d468c387346f54bcf23a724bf80838c603fa8dbed3428b0cb5ea590c

SHA512
2bcd2653ba3c0ddcdfce24019563fba3cada122edaa79f5d55fa9ef28bb1a58fbb1b67e0e6980f5336c056a042e470026462431c5128dd3715f088186688ee0a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58899d.TMP

Filesize
874B

MD5
6b4a2fd94e2261c9038eeb971f439360

SHA1
883b21e24a6ae721bb0db21ae37b1604b03e8f3f

SHA256
9cbd53294f5fbb7519363cc0fefeeb760975d477b514c2b88d172885a13ac763

SHA512
dae97873a22bf4e014066d0e3d03e6187e9624ce36b4382d7b22d7a850368053e8896d16d0e565dbb96020254d931fd1486b6f73830819ceea2cc601a68237e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a21b17c85a955170753bcc1ef79c96d0

SHA1
e7c68753c0480c60ad60bd0d9aa7008c106b9143

SHA256
5103e1fc6a8f89bd072e277f76f751cf2ad48e16f3e4925c7b722f924ef4a490

SHA512
30d0ee099a79a0842bdaf87e68a46c0ac36a7ccfb3bf18cbfdbf3f1eadacb3d3bab6667ce81bad67be0684c7879ea2151627b18d0c71f49494022c88ec9b40dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
3535ca5d5b78795a68b1459a9004bfd9

SHA1
2cc815357f92180dff16dcf442121373c9123ea1

SHA256
4ab6e24be74199a73f3c35a6d200f0f74e0f990005f3dcf4da7df408a2701754

SHA512
8cea0240c9571045b90a77caaed62ca673a3d52ab8032c10c41e76a7eaa978e6e88dad1d9a706e429b0d84daea2523155da14d08f6f0e8f294cdb9ededcc24e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
0a34b490577d103ac802e983dc8f50f6

SHA1
b4f286873cf7f3ecc58eac2d2f16ea4c62064c17

SHA256
07bda244fe4be403cea6fb1f6fe711f62e8f3bb19178dc91590c06f199a12224

SHA512
b9c24d0afa18b73dc66165dca2dc830e86c77befcb47606ba5675b543f42fd915d47948aa47de876e7dc2ee1b140089407e3ea3828cb234e818d9a0c97648433

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
5c9691fb66f03f88444c8f4bed3ab067

SHA1
3627de73a26f4032d1211c8b17d4a284374e5140

SHA256
a08c861fa4612eea7035af832a3d7325a8bc2150f78e3d084ec9aadf4d380e12

SHA512
67f383c8e5a81985e2b503a7c939dbcfb72876ca454cf7f1fa527adfb7b85f521d1b0d7dd8e64f1e039e91cc913a06659967b032c458d5bcc96e292a30188392

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_.NET_Core_Runtime_-_3.1.32_(x64)_20250115010703_000_dotnet_runtime_3.1.32_win_x64.msi.log

Filesize
2KB

MD5
facb50ba586444a3b0307c2394bb2f4d

SHA1
085fcc1b107050c4a8019027bb6a725b3590c07f

SHA256
9cb17a2d67819c412f2fc30dc04651bd94bbcda67c5f1a8ca25c3c3d81ae00c5

SHA512
27a6ae5f44544d8f9e7775fb07caa6a9800d4910c17a91ead56ca3da7bc56386020ab8e7875fec6e5c30c5db5446f3c875b68c5a9c5351d09d38a3e04d1284e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_.NET_Core_Runtime_-_3.1.32_(x64)_20250115010703_001_dotnet_hostfxr_3.1.32_win_x64.msi.log

Filesize
2KB

MD5
5d0684ae0bbf1594287ac7e5aa25f945

SHA1
66d6eecf029ed53ebd0ccbb284f507f581e22c6b

SHA256
a0aca0d0e6d6f06c19855aa3f1a50ff5f3ebe3c11ccaac701fbd81cfdba31e76

SHA512
918281c37af87fec5fb92d55007a532836671562947b978571e3278a236f5817deff52533341bb3996167dc286aa17e6f1b4facb90837abf39dd7b63b51e91aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_.NET_Core_Runtime_-_3.1.32_(x64)_20250115010703_002_dotnet_host_3.1.32_win_x64.msi.log

Filesize
2KB

MD5
bc2352cc3eecedac52bfa8ea5fe25a48

SHA1
90530c008b5f35ae1c649a0a947d1a1faaebaa17

SHA256
b25e57e139f8c1f9fb1a8468ac4ba93d804fd22e4f78841d3686d0aa636b40ed

SHA512
4398aaba05c22e267ac90a601e084e2ba151ea49d16abbd3de42a7c94ccbe195622eeba5a968d7f49e345272f85b72f9e6a6f1fbfe96626a509663c2d78b6df2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
6222fb090f72e1190eeccabe7fa41033

SHA1
223133d7620d501306fd04a249fa7163a0c2f921

SHA256
909417157ed6ac66e887fc10daacc7665b20dcab3222cbd391d3a9f660098b8d

SHA512
067985ad68543a51ebe9239eab4a70f8a2d1f453507830060ce065390720e556468865daa036d2d43bdd298b69c6378cad89f8ce3b54684d17620b3b9eae564d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
d871826e56f42ff9e4ea4997df1d1b9c

SHA1
59532caf232ebecaed8e59d1e7122135db80c0d7

SHA256
94996d65e7a59fdff723dfbf43816a05a097452c2d3444c620103e9726c6c539

SHA512
56a4a132aafa69d33822ec777094476c6975c48fee652a9a8b72de657bdc2cdad352bffc6bb352b2742421c4ab82c238f2efc9bd1e7516fba599f0a13091554f

Download Submit
C:\Users\Admin\Desktop\250106-ba332atjcl_pw_infected.zip

Filesize
201KB

MD5
6c6b9b0a0320f8bbe21839ae9dd0c971

SHA1
f5b603d7e0a6bcb9812474a67dc83f5d9865b0ef

SHA256
48cfc3b64c1fd909a855978169b66fc304081e214dc017fa01cc2721102b10b1

SHA512
b817530fdf1f42a5a0469fb65240e1cd31d9548907bdf4bcd8bfcee98213b5c49cb6ec63f75dce8ef941fbcb8ee2631dff4111c7a14ac6594fa6fdc03c98be32

Download Submit
C:\Users\Admin\Desktop\de4dot-netcoreapp3.1\de4dot.deps.json

Filesize
6KB

MD5
889fcd0d98cc6afc40b3b1b390be9326

SHA1
8194ca0acc5e30facd98e7005dab7cda3c7a29a5

SHA256
8d3262358010f2e84379fd1e1f70e5ce6b5d2578bf0127a563abc59290f4b950

SHA512
b4b5eb5806e9ec5f45509d8ebdb9182d1cc0e4064d3c05129c2b72015f9be0b734df49c8d76cbe1e0c6aed65d65e73ae7994e45e3a81c1a77eaa86ab285d2c3c

Download Submit
C:\Users\Admin\Desktop\de4dot-netcoreapp3.1\de4dot.dll

Filesize
4KB

MD5
ffcab852b8444c4fbdb3327d1be3cef8

SHA1
353d3cefb8250b29737b3ad2d9225fd2736b1be6

SHA256
19d46ec7a2173196e6fc3c764687509d1d8914f166ad7a38dde9016ab9eecfa6

SHA512
53b0a396b79404a7faaa08bf1d22dc952e949af55b07f5cb15a4fe1b424e4c15a8dc47bd54e7b0cca3e0aa22cb6e1f0cae0ca579f556fbb936767e8166556592

Download Submit
C:\Users\Admin\Desktop\de4dot-netcoreapp3.1\de4dot.exe

Filesize
170KB

MD5
a772c36905c44f133f148f5a8aca7595

SHA1
77ca0c6f241e096a2f68134ed259f6b1d972a4ee

SHA256
c64781620b666f64b0130ffcfb733687dc6e8c889cf184c63abae6ab597c396a

SHA512
fee54fa57eed0dfd7084b25b692610778db60dd2d1c8e4098b08a701117960796768379e38ae05a9629cf0d51d70553cdcec507c43ec87216d37c26c81c6048a

Download Submit
C:\Users\Admin\Desktop\de4dot-netcoreapp3.1\de4dot.runtimeconfig.json

Filesize
154B

MD5
42f40b6c1b9ab7f8f92b0ae5d8c5fdab

SHA1
92e1d5e7ffae89550a815389b851648f9bb6e64b

SHA256
ed69fdc80437b2d0fd2b177d018a6e800517200e4fb6dd54705f5a62a908ec38

SHA512
dac3b6a2cf992f23e0d15ad31449ba15f1a309dbbdaf11f7e62c44c7081fab8968986ff6690039c86522609b03ae95b127938c5e6f3c3ff9396a2911e81bc40e

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 719409.crdownload

Filesize
25.0MB

MD5
4ac58dd04d1766f3925e6c7804c28310

SHA1
b319156006fcf5a0bc0cadfd536cbafa99b219b2

SHA256
4393d2cdacecc096e964ea9761dfd5c336fb002b1b3ae0808e7d2d445e2dea89

SHA512
299217c743d3b5527205110a20ef00097c5e8373a256e4e079e723471d5cd68f4976b769ad052c19312a55b6dccc965749a0a724da01d8f879e2a3c1b6c2bf6b

Download Submit
C:\Windows\Installer\MSI870D.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Temp\{953D0C29-B7C2-4E36-A454-540AA7163851}\.cr\dotnet-runtime-3.1.32-win-x64.exe

Filesize
609KB

MD5
695041789b692004042068c362f7248f

SHA1
5103ad1893b4087431044ce21076e9c010bf11ec

SHA256
b0739523977d215db394883a369fb4a2d418a36caf73e3a2035405552f6b33a8

SHA512
95396d00cabb48c41f55152347f5cda7a783b03bb69e73b173d2c4aae7912a26160fd329521a104cfcf49e378155e72e20f0c057e61ab672bbdcb9e82d168d33

Download Submit
C:\Windows\Temp\{D2715D87-202F-4CDF-8EF1-4507ABB52AC6}\.ba\bg.png

Filesize
4KB

MD5
9eb0320dfbf2bd541e6a55c01ddc9f20

SHA1
eb282a66d29594346531b1ff886d455e1dcd6d99

SHA256
9095bf7b6baa0107b40a4a6d727215be077133a190f4ca9bd89a176842141e79

SHA512
9ada3a1757a493fbb004bd767fab8f77430af69d71479f340b8b8ede904cc94cd733700db593a4a2d2e1184c0081fd0648318d867128e1cb461021314990931d

Download Submit
C:\Windows\Temp\{D2715D87-202F-4CDF-8EF1-4507ABB52AC6}\.ba\wixstdba.dll

Filesize
197KB

MD5
4356ee50f0b1a878e270614780ddf095

SHA1
b5c0915f023b2e4ed3e122322abc40c4437909af

SHA256
41a8787fdc9467f563438daba4131191aa1eb588a81beb9a89fe8bd886c16104

SHA512
b9e482efe9189683dabfc9feff8b386d7eba4ecf070f42a1eebee6052cfb181a19497f831f1ea6429cfcce1d4865a5d279b24bd738d702902e9887bb9f0c4691

Download Submit
C:\Windows\Temp\{D2715D87-202F-4CDF-8EF1-4507ABB52AC6}\dotnet_host_3.1.32_win_x64.msi

Filesize
732KB

MD5
8ae6adcd191737d04ea1db84182135fc

SHA1
a297f85537c6997cdb9f5a4b0a54ec8a34a4a7b7

SHA256
70ef94aaf302874c4c70595a9061a4a01c0c8d45ed60a1240e03e1b68c133336

SHA512
8cedf93ea908431e241674a576089e273773a2c8fcd0a08b5e450fba270717815dc98804e195e2c739e9e092f4c188c9bf36ff00a4fb0003670de9de7fb075ba

Download Submit
C:\Windows\Temp\{D2715D87-202F-4CDF-8EF1-4507ABB52AC6}\dotnet_hostfxr_3.1.32_win_x64.msi

Filesize
804KB

MD5
d814a92dc057a052a99c73391114f340

SHA1
ffa8f9e063594bcf8db633978523750f92ca1591

SHA256
f2cf795cc9c235eb45e4e6112f8f98508292b07bdbe07462b8592a7b3b059490

SHA512
caaa9b6fceef35215d7e2af922e08cb5d064bba1c78f00ea429b2590e8749d19434d87615edb67db67795935c812cc36feef907725398a758745a4d179937333

Download Submit
C:\Windows\Temp\{D2715D87-202F-4CDF-8EF1-4507ABB52AC6}\dotnet_runtime_3.1.32_win_x64.msi

Filesize
24.1MB

MD5
c049fde98cfe29297cb90658107f3917

SHA1
40c24cb8f5d4051915f08ee119c8b0a176e73d69

SHA256
2b07cb90a82e5fe8eb8115e1c8d1eafdfc2e5f5132de95586e53b59decabd455

SHA512
902fa027b0261d75c8ec3ef86dd61432fe75c3d40cea3c6b912b990ee7b35fbcbd6ba24bc925ec80d6e1dbae79254dfafe5ff3dfc0dad30f8b9737c3ae94cc52

Download Submit
memory/5656-959-0x000001F1F6B90000-0x000001F1F7652000-memory.dmp

Filesize
10.8MB

Download