hxxps://pvz-fusion[.]com

Analysis

max time kernel
584s
max time network
589s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
20-01-2025 09:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://pvz-fusion.com

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 6 IoCs

pid	Process
908	VC-Redist-x64.exe
4972	VC-Redist-x64.exe
4860	VC_redist.x64.exe
3284	WindowsDesktop-Runtime-6.0.18-WIN-x64.exe
4576	WindowsDesktop-Runtime-6.0.18-WIN-x64.exe
2976	windowsdesktop-runtime-6.0.18-win-x64.exe

Loads dropped DLL 9 IoCs

pid	Process
4972	VC-Redist-x64.exe
5032	VC_redist.x64.exe
4576	WindowsDesktop-Runtime-6.0.18-WIN-x64.exe
3044	MsiExec.exe
3044	MsiExec.exe
1676	MsiExec.exe
1676	MsiExec.exe
640	MsiExec.exe
640	MsiExec.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{77169412-f642-45e7-b533-0c6f48de12f9} = "\"C:\\ProgramData\\Package Cache\\{77169412-f642-45e7-b533-0c6f48de12f9}\\VC_redist.x64.exe\" /burn.runonce"	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{70624c55-d0e1-40a6-913e-96560feea689} = "\"C:\\ProgramData\\Package Cache\\{70624c55-d0e1-40a6-913e-96560feea689}\\windowsdesktop-runtime-6.0.18-win-x64.exe\" /burn.runonce"	windowsdesktop-runtime-6.0.18-win-x64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe

Drops file in System32 directory 51 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\mfcm140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140fra.dll	msiexec.exe
File created	C:\Windows\system32\mfc140kor.dll	msiexec.exe
File created	C:\Windows\system32\mfcm140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vccorlib140.dll	msiexec.exe
File created	C:\Windows\system32\vcruntime140_1.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfcm140u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140ita.dll	msiexec.exe
File created	C:\Windows\system32\mfc140chs.dll	msiexec.exe
File created	C:\Windows\system32\mfc140enu.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcruntime140_1.dll	msiexec.exe
File opened for modification	C:\Windows\system32\concrt140.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_codecvt_ids.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140kor.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140rus.dll	msiexec.exe
File created	C:\Windows\system32\mfc140esn.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcamp140.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_atomic_wait.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140cht.dll	msiexec.exe
File created	C:\Windows\system32\mfc140deu.dll	msiexec.exe
File created	C:\Windows\system32\mfc140rus.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_atomic_wait.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_2.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140deu.dll	msiexec.exe
File created	C:\Windows\system32\mfc140fra.dll	msiexec.exe
File created	C:\Windows\system32\mfc140u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcomp140.dll	msiexec.exe
File created	C:\Windows\system32\vcamp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140chs.dll	msiexec.exe
File created	C:\Windows\system32\mfc140.dll	msiexec.exe
File created	C:\Windows\system32\mfc140cht.dll	msiexec.exe
File created	C:\Windows\system32\concrt140.dll	msiexec.exe
File created	C:\Windows\system32\vcruntime140_threads.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_codecvt_ids.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140esn.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140jpn.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcruntime140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_2.dll	msiexec.exe
File created	C:\Windows\system32\vccorlib140.dll	msiexec.exe
File created	C:\Windows\system32\vcomp140.dll	msiexec.exe
File created	C:\Windows\system32\vcruntime140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140enu.dll	msiexec.exe
File created	C:\Windows\system32\mfc140ita.dll	msiexec.exe
File created	C:\Windows\system32\mfc140jpn.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_1.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_1.dll	msiexec.exe
File created	C:\Windows\system32\mfcm140u.dll	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.18\de\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.18\pl\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.18\it\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.18\api-ms-win-crt-stdio-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.18\api-ms-win-crt-private-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.18\zh-Hans\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.18\System.IO.Compression.FileSystem.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.18\ko\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.18\ko\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.18\vcruntime140_cor3.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.18\System.IO.Packaging.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.18\de\System.Windows.Forms.Design.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.18\de\System.Windows.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.18\it\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.18\PresentationFramework.Classic.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.18\System.Linq.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.18\api-ms-win-core-handle-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.18\ja\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.18\cs\UIAutomationTypes.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.18\System.Security.Cryptography.ProtectedData.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.18\ko\UIAutomationClient.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.18\zh-Hans\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.18\Microsoft.NETCore.App.deps.json	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.18\System.Text.RegularExpressions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.18\ru\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.18\System.IO.FileSystem.AccessControl.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.18\zh-Hans\UIAutomationClient.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.18\de\UIAutomationClient.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.18\zh-Hant\System.Windows.Forms.Design.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.18\System.Windows.Forms.Design.Editors.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.18\zh-Hans\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.18\de\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.18\fr\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.18\fr\WindowsFormsIntegration.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.18\pl\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.18\it\WindowsBase.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.18\pt-BR\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.18\System.Security.Cryptography.OpenSsl.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.18\ja\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.18\tr\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.18\fr\ReachFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.18\pl\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.18\System.Windows.Controls.Ribbon.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.18\zh-Hant\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.18\System.Net.WebSockets.Client.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.18\System.Runtime.InteropServices.RuntimeInformation.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.18\System.Xml.XPath.XDocument.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.18\WindowsFormsIntegration.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.18\it\UIAutomationClient.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.18\System.Diagnostics.Tracing.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.18\api-ms-win-core-console-l1-2-0.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.18\System.Net.Sockets.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.18\it\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.18\zh-Hant\System.Windows.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.18\Microsoft.VisualBasic.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.18\cs\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.18\System.Windows.Forms.Design.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.18\fr\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.18\System.IO.Pipes.AccessControl.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.18\System.IO.Pipes.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.18\tr\UIAutomationTypes.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.18\PresentationFramework-SystemData.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.18\System.Runtime.Loader.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.18\System.Linq.Queryable.dll	msiexec.exe

Drops file in Windows directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSIB1C7.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBB8D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e5c7c8e.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{5904914B-9FC8-44C2-AE48-5C7F30A603EC}	msiexec.exe
File created	C:\Windows\SystemTemp\~DF5C8A5077E9A74CF3.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFACB3767C0A1146E8.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBDE1.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF8DDA109E370C9CF6.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF1392CECBAB4A921D.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\SystemTemp\~DF942C17B34498D669.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e5c7c89.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF9E98F7DD124DB739.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF7F447B5D2DF5831E.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF08F059D7AD61E660.TMP	msiexec.exe
File created	C:\Windows\Installer\e5c7c89.msi	msiexec.exe
File created	C:\Windows\Installer\e5c7c6e.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICDF2.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFAE7A5DBFED12BFC6.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8680.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{81D7013F-AB4C-4DEF-8549-2AC6A3D612BB}	msiexec.exe
File created	C:\Windows\SystemTemp\~DF0DA9F5F557F35E51.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBFC7.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF939C928A37EEC381.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{CB1B935F-234E-452D-91DA-4CBA519E9581}	msiexec.exe
File created	C:\Windows\SystemTemp\~DF7EDCD2183217D24C.TMP	msiexec.exe
File created	C:\Windows\Installer\e5c7c84.msi	msiexec.exe
File created	C:\Windows\Installer\e5c7c88.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBD05.tmp	msiexec.exe
File created	C:\Windows\Installer\e5c7c8d.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF22562C9BA072904F.TMP	msiexec.exe
File created	C:\Windows\Installer\e5c7c92.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFD78C89E077E55A7D.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI841E.tmp	msiexec.exe
File created	C:\Windows\Installer\e5c7c8e.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8016.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFB6A8E0423B52AEEE.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{8BBCB5E9-5775-4465-AABC-3E276EBBD496}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC1CC.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e5c7c5b.msi	msiexec.exe
File created	C:\Windows\Installer\e5c7c83.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFF430497290FE1811.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFCF0B62355A96F82D.TMP	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{560D2DA4-096E-4868-B22A-DA6418FDE6FB}	msiexec.exe
File created	C:\Windows\Installer\e5c7c6d.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF18E03985A602C84D.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBEBD.tmp	msiexec.exe
File created	C:\Windows\Installer\e5c7c5b.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7EFB.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFF07622887D2D567E.TMP	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\SystemTemp\~DFE9A8F78439DCA9BA.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB3AD.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e5c7c6e.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5c7c84.msi	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-6.0.18-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC-Redist-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC-Redist-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsDesktop-Runtime-6.0.18-WIN-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsDesktop-Runtime-6.0.18-WIN-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000002fc80c284bade0450000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800002fc80c280000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809002fc80c28000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d2fc80c28000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000002fc80c2800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000\HARDWARE\DESCRIPTION\System\CentralProcessor\0	PlantsVsZombiesRH.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	PlantsVsZombiesRH.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	PlantsVsZombiesRH.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	PlantsVsZombiesRH.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 16 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2d	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2B	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2C	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_48.75.61559_x64	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F539B1BCE432D25419ADC4AB15E95918\SourceList\PackageName = "dotnet-hostfxr-6.0.18-win-x64.msi"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F539B1BCE432D25419ADC4AB15E95918\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AD2D065E69086842BA2AD4681DF6EBF\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{560D2DA4-096E-4868-B22A-DA6418FDE6FB}v14.40.33816\\packages\\vcRuntimeMinimum_amd64\\"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A567BD6FA501A947AD1F646E53EEC14\SourceList	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B41940958CF92C44EA84C5F7036A30CE\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{70624c55-d0e1-40a6-913e-96560feea689}\ = "{70624c55-d0e1-40a6-913e-96560feea689}"	windowsdesktop-runtime-6.0.18-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E5BCBB857755644AACBE372E6BB4D69\ProductName = "Microsoft .NET Runtime - 6.0.18 (x64)"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E5BCBB857755644AACBE372E6BB4D69\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\2973306351553D541492C0B1D18186D3\F3107D18C4BAFED45894A26C3A6D21BB	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F3107D18C4BAFED45894A26C3A6D21BB\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{81D7013F-AB4C-4DEF-8549-2AC6A3D612BB}v48.75.61602\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AD2D065E69086842BA2AD4681DF6EBF\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14\Version = "14.40.33816"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E5BCBB857755644AACBE372E6BB4D69\AdvertiseFlags = "388"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E5BCBB857755644AACBE372E6BB4D69\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F539B1BCE432D25419ADC4AB15E95918\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\2973306351553D541492C0B1D18186D3	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AD2D065E69086842BA2AD4681DF6EBF	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AD2D065E69086842BA2AD4681DF6EBF\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\88AAB0B9F51EF1A3CA0C2B609EDD7FC1\B41940958CF92C44EA84C5F7036A30CE	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\E85F24987B15EB45F4D2EBF02D8E2133	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F539B1BCE432D25419ADC4AB15E95918	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_48.75.61602_x64\DisplayName = "Microsoft Windows Desktop Runtime - 6.0.18 (x64)"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_48.75.61602_x64\Dependents	windowsdesktop-runtime-6.0.18-win-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings	msedge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AD2D065E69086842BA2AD4681DF6EBF\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AD2D065E69086842BA2AD4681DF6EBF\SourceList\Net	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A567BD6FA501A947AD1F646E53EEC14	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E5BCBB857755644AACBE372E6BB4D69\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\windowsdesktop_runtime_48.75.61602_x64	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F3107D18C4BAFED45894A26C3A6D21BB\SourceList\PackageName = "windowsdesktop-runtime-6.0.18-win-x64.msi"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F3107D18C4BAFED45894A26C3A6D21BB\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9E5BCBB857755644AACBE372E6BB4D69\MainFeature	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E5BCBB857755644AACBE372E6BB4D69	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E5BCBB857755644AACBE372E6BB4D69\Version = "810283127"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\dotnet_runtime_48.75.61559_x64	windowsdesktop-runtime-6.0.18-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_48.75.61559_x64\ = "{8BBCB5E9-5775-4465-AABC-3E276EBBD496}"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E5BCBB857755644AACBE372E6BB4D69\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F539B1BCE432D25419ADC4AB15E95918\PackageCode = "AD70D332B1EF1C440BD535E06637E65F"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F539B1BCE432D25419ADC4AB15E95918\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_48.75.61559_x64\ = "{CB1B935F-234E-452D-91DA-4CBA519E9581}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_48.75.61559_x64\DisplayName = "Microsoft .NET Host FX Resolver - 6.0.18 (x64)"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F539B1BCE432D25419ADC4AB15E95918	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F3107D18C4BAFED45894A26C3A6D21BB\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4AD2D065E69086842BA2AD4681DF6EBF\Servicing_Key	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_48.75.61559_x64	windowsdesktop-runtime-6.0.18-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F3107D18C4BAFED45894A26C3A6D21BB\Provider	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B41940958CF92C44EA84C5F7036A30CE\SourceList\Net	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B41940958CF92C44EA84C5F7036A30CE\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{70624c55-d0e1-40a6-913e-96560feea689}\Dependents\{70624c55-d0e1-40a6-913e-96560feea689}	windowsdesktop-runtime-6.0.18-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_48.75.61559_x64\Version = "48.75.61559"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E5BCBB857755644AACBE372E6BB4D69\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F3107D18C4BAFED45894A26C3A6D21BB\ProductName = "Microsoft Windows Desktop Runtime - 6.0.18 (x64)"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F3107D18C4BAFED45894A26C3A6D21BB\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14\DisplayName = "Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.40.33816"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B41940958CF92C44EA84C5F7036A30CE\ProductName = "Microsoft Visual C++ 2022 X64 Additional Runtime - 14.40.33816"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B41940958CF92C44EA84C5F7036A30CE\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\dotnet_runtime_48.75.61559_x64	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_48.3.31210_x64\Dependents\{70624c55-d0e1-40a6-913e-96560feea689}	windowsdesktop-runtime-6.0.18-win-x64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.40,bundle	VC_redist.x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\09A86F63C932FD435BC8463B1035EC53	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\09A86F63C932FD435BC8463B1035EC53\4AD2D065E69086842BA2AD4681DF6EBF	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AD2D065E69086842BA2AD4681DF6EBF\SourceList	msiexec.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\PvZ Fusion 2.1.6 [English Translation] Patch.zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\PC_PVZ-Fusion-2.1.6-beta.zip:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
4828	msedge.exe
4828	msedge.exe
644	msedge.exe
644	msedge.exe
740	msedge.exe
740	msedge.exe
4400	identity_helper.exe
4400	identity_helper.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
2000	msedge.exe
2000	msedge.exe
3016	msiexec.exe
3016	msiexec.exe
3016	msiexec.exe
3016	msiexec.exe
3016	msiexec.exe
3016	msiexec.exe
3016	msiexec.exe
3016	msiexec.exe
3016	msiexec.exe
3016	msiexec.exe
3016	msiexec.exe
3016	msiexec.exe
3016	msiexec.exe
3016	msiexec.exe
2028	msedge.exe
2028	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 24 IoCs

pid	Process
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	1140	7zG.exe
Token: 35	1140	7zG.exe
Token: SeSecurityPrivilege	1140	7zG.exe
Token: SeSecurityPrivilege	1140	7zG.exe
Token: SeBackupPrivilege	4476	vssvc.exe
Token: SeRestorePrivilege	4476	vssvc.exe
Token: SeAuditPrivilege	4476	vssvc.exe
Token: SeShutdownPrivilege	4860	VC_redist.x64.exe
Token: SeIncreaseQuotaPrivilege	4860	VC_redist.x64.exe
Token: SeSecurityPrivilege	3016	msiexec.exe
Token: SeCreateTokenPrivilege	4860	VC_redist.x64.exe
Token: SeAssignPrimaryTokenPrivilege	4860	VC_redist.x64.exe
Token: SeLockMemoryPrivilege	4860	VC_redist.x64.exe
Token: SeIncreaseQuotaPrivilege	4860	VC_redist.x64.exe
Token: SeMachineAccountPrivilege	4860	VC_redist.x64.exe
Token: SeTcbPrivilege	4860	VC_redist.x64.exe
Token: SeSecurityPrivilege	4860	VC_redist.x64.exe
Token: SeTakeOwnershipPrivilege	4860	VC_redist.x64.exe
Token: SeLoadDriverPrivilege	4860	VC_redist.x64.exe
Token: SeSystemProfilePrivilege	4860	VC_redist.x64.exe
Token: SeSystemtimePrivilege	4860	VC_redist.x64.exe
Token: SeProfSingleProcessPrivilege	4860	VC_redist.x64.exe
Token: SeIncBasePriorityPrivilege	4860	VC_redist.x64.exe
Token: SeCreatePagefilePrivilege	4860	VC_redist.x64.exe
Token: SeCreatePermanentPrivilege	4860	VC_redist.x64.exe
Token: SeBackupPrivilege	4860	VC_redist.x64.exe
Token: SeRestorePrivilege	4860	VC_redist.x64.exe
Token: SeShutdownPrivilege	4860	VC_redist.x64.exe
Token: SeDebugPrivilege	4860	VC_redist.x64.exe
Token: SeAuditPrivilege	4860	VC_redist.x64.exe
Token: SeSystemEnvironmentPrivilege	4860	VC_redist.x64.exe
Token: SeChangeNotifyPrivilege	4860	VC_redist.x64.exe
Token: SeRemoteShutdownPrivilege	4860	VC_redist.x64.exe
Token: SeUndockPrivilege	4860	VC_redist.x64.exe
Token: SeSyncAgentPrivilege	4860	VC_redist.x64.exe
Token: SeEnableDelegationPrivilege	4860	VC_redist.x64.exe
Token: SeManageVolumePrivilege	4860	VC_redist.x64.exe
Token: SeImpersonatePrivilege	4860	VC_redist.x64.exe
Token: SeCreateGlobalPrivilege	4860	VC_redist.x64.exe
Token: SeRestorePrivilege	3016	msiexec.exe
Token: SeTakeOwnershipPrivilege	3016	msiexec.exe
Token: SeRestorePrivilege	3016	msiexec.exe
Token: SeTakeOwnershipPrivilege	3016	msiexec.exe
Token: SeRestorePrivilege	3016	msiexec.exe
Token: SeTakeOwnershipPrivilege	3016	msiexec.exe
Token: SeRestorePrivilege	3016	msiexec.exe
Token: SeTakeOwnershipPrivilege	3016	msiexec.exe
Token: SeRestorePrivilege	3016	msiexec.exe
Token: SeTakeOwnershipPrivilege	3016	msiexec.exe
Token: SeRestorePrivilege	3016	msiexec.exe
Token: SeTakeOwnershipPrivilege	3016	msiexec.exe
Token: SeRestorePrivilege	3016	msiexec.exe
Token: SeTakeOwnershipPrivilege	3016	msiexec.exe
Token: SeRestorePrivilege	3016	msiexec.exe
Token: SeTakeOwnershipPrivilege	3016	msiexec.exe
Token: SeRestorePrivilege	3016	msiexec.exe
Token: SeTakeOwnershipPrivilege	3016	msiexec.exe
Token: SeRestorePrivilege	3016	msiexec.exe
Token: SeTakeOwnershipPrivilege	3016	msiexec.exe
Token: SeRestorePrivilege	3016	msiexec.exe
Token: SeTakeOwnershipPrivilege	3016	msiexec.exe
Token: SeRestorePrivilege	3016	msiexec.exe
Token: SeTakeOwnershipPrivilege	3016	msiexec.exe
Token: SeRestorePrivilege	3016	msiexec.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2008	PlantsVsZombiesRH.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 644 wrote to memory of 4544	644	msedge.exe	78
PID 644 wrote to memory of 4544	644	msedge.exe	78
PID 644 wrote to memory of 1852	644	msedge.exe	79
PID 644 wrote to memory of 1852	644	msedge.exe	79
PID 644 wrote to memory of 1852	644	msedge.exe	79
PID 644 wrote to memory of 1852	644	msedge.exe	79
PID 644 wrote to memory of 1852	644	msedge.exe	79
PID 644 wrote to memory of 1852	644	msedge.exe	79
PID 644 wrote to memory of 1852	644	msedge.exe	79
PID 644 wrote to memory of 1852	644	msedge.exe	79
PID 644 wrote to memory of 1852	644	msedge.exe	79
PID 644 wrote to memory of 1852	644	msedge.exe	79
PID 644 wrote to memory of 1852	644	msedge.exe	79
PID 644 wrote to memory of 1852	644	msedge.exe	79
PID 644 wrote to memory of 1852	644	msedge.exe	79
PID 644 wrote to memory of 1852	644	msedge.exe	79
PID 644 wrote to memory of 1852	644	msedge.exe	79
PID 644 wrote to memory of 1852	644	msedge.exe	79
PID 644 wrote to memory of 1852	644	msedge.exe	79
PID 644 wrote to memory of 1852	644	msedge.exe	79
PID 644 wrote to memory of 1852	644	msedge.exe	79
PID 644 wrote to memory of 1852	644	msedge.exe	79
PID 644 wrote to memory of 1852	644	msedge.exe	79
PID 644 wrote to memory of 1852	644	msedge.exe	79
PID 644 wrote to memory of 1852	644	msedge.exe	79
PID 644 wrote to memory of 1852	644	msedge.exe	79
PID 644 wrote to memory of 1852	644	msedge.exe	79
PID 644 wrote to memory of 1852	644	msedge.exe	79
PID 644 wrote to memory of 1852	644	msedge.exe	79
PID 644 wrote to memory of 1852	644	msedge.exe	79
PID 644 wrote to memory of 1852	644	msedge.exe	79
PID 644 wrote to memory of 1852	644	msedge.exe	79
PID 644 wrote to memory of 1852	644	msedge.exe	79
PID 644 wrote to memory of 1852	644	msedge.exe	79
PID 644 wrote to memory of 1852	644	msedge.exe	79
PID 644 wrote to memory of 1852	644	msedge.exe	79
PID 644 wrote to memory of 1852	644	msedge.exe	79
PID 644 wrote to memory of 1852	644	msedge.exe	79
PID 644 wrote to memory of 1852	644	msedge.exe	79
PID 644 wrote to memory of 1852	644	msedge.exe	79
PID 644 wrote to memory of 1852	644	msedge.exe	79
PID 644 wrote to memory of 1852	644	msedge.exe	79
PID 644 wrote to memory of 4828	644	msedge.exe	80
PID 644 wrote to memory of 4828	644	msedge.exe	80
PID 644 wrote to memory of 3436	644	msedge.exe	81
PID 644 wrote to memory of 3436	644	msedge.exe	81
PID 644 wrote to memory of 3436	644	msedge.exe	81
PID 644 wrote to memory of 3436	644	msedge.exe	81
PID 644 wrote to memory of 3436	644	msedge.exe	81
PID 644 wrote to memory of 3436	644	msedge.exe	81
PID 644 wrote to memory of 3436	644	msedge.exe	81
PID 644 wrote to memory of 3436	644	msedge.exe	81
PID 644 wrote to memory of 3436	644	msedge.exe	81
PID 644 wrote to memory of 3436	644	msedge.exe	81
PID 644 wrote to memory of 3436	644	msedge.exe	81
PID 644 wrote to memory of 3436	644	msedge.exe	81
PID 644 wrote to memory of 3436	644	msedge.exe	81
PID 644 wrote to memory of 3436	644	msedge.exe	81
PID 644 wrote to memory of 3436	644	msedge.exe	81
PID 644 wrote to memory of 3436	644	msedge.exe	81
PID 644 wrote to memory of 3436	644	msedge.exe	81
PID 644 wrote to memory of 3436	644	msedge.exe	81
PID 644 wrote to memory of 3436	644	msedge.exe	81
PID 644 wrote to memory of 3436	644	msedge.exe	81

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://pvz-fusion.com
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff16c53cb8,0x7fff16c53cc8,0x7fff16c53cd8
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1924,9875342635430906737,10730473674469999356,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1932 /prefetch:2
  2⤵
  PID:1852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1924,9875342635430906737,10730473674469999356,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1924,9875342635430906737,10730473674469999356,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2656 /prefetch:8
  2⤵
  PID:3436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,9875342635430906737,10730473674469999356,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:3348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,9875342635430906737,10730473674469999356,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,9875342635430906737,10730473674469999356,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4704 /prefetch:1
  2⤵
  PID:3760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,9875342635430906737,10730473674469999356,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4864 /prefetch:1
  2⤵
  PID:2248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1924,9875342635430906737,10730473674469999356,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5768 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,9875342635430906737,10730473674469999356,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5964 /prefetch:1
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1924,9875342635430906737,10730473674469999356,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5244 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,9875342635430906737,10730473674469999356,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:1
  2⤵
  PID:2460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,9875342635430906737,10730473674469999356,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6060 /prefetch:1
  2⤵
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,9875342635430906737,10730473674469999356,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5944 /prefetch:1
  2⤵
  PID:1544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,9875342635430906737,10730473674469999356,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6480 /prefetch:1
  2⤵
  PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,9875342635430906737,10730473674469999356,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6508 /prefetch:1
  2⤵
  PID:2960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,9875342635430906737,10730473674469999356,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5772 /prefetch:1
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,9875342635430906737,10730473674469999356,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6860 /prefetch:1
  2⤵
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,9875342635430906737,10730473674469999356,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5320 /prefetch:1
  2⤵
  PID:3892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,9875342635430906737,10730473674469999356,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7088 /prefetch:1
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,9875342635430906737,10730473674469999356,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6856 /prefetch:1
  2⤵
  PID:1924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,9875342635430906737,10730473674469999356,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6156 /prefetch:1
  2⤵
  PID:412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,9875342635430906737,10730473674469999356,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5548 /prefetch:1
  2⤵
  PID:1376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,9875342635430906737,10730473674469999356,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6648 /prefetch:1
  2⤵
  PID:2772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,9875342635430906737,10730473674469999356,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:1
  2⤵
  PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1924,9875342635430906737,10730473674469999356,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2060 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1924,9875342635430906737,10730473674469999356,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5024 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,9875342635430906737,10730473674469999356,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7384 /prefetch:1
  2⤵
  PID:836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,9875342635430906737,10730473674469999356,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7648 /prefetch:1
  2⤵
  PID:1376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,9875342635430906737,10730473674469999356,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7680 /prefetch:1
  2⤵
  PID:1276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,9875342635430906737,10730473674469999356,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5900 /prefetch:1
  2⤵
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1924,9875342635430906737,10730473674469999356,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=7976 /prefetch:8
  2⤵
  PID:840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,9875342635430906737,10730473674469999356,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5824 /prefetch:1
  2⤵
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1924,9875342635430906737,10730473674469999356,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3160 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:2028

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1276

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3400

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2172

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\PvZ Fusion 2.1.6 [English Translation] Patch\" -spe -an -ai#7zMap9756:150:7zEvent7397
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1140

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\PvZ Fusion 2.1.6 [English Translation] Patch\[RM-EN] Read Me.txt
1⤵
PID:4600

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\PvZ Fusion 2.1.6 [English Translation] Patch\Launch Game.bat" "
1⤵
PID:404

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\PvZ Fusion 2.1.6 [English Translation] Patch\Patch\Launch Game.bat" "
1⤵
PID:2976

C:\Users\Admin\Downloads\PvZ Fusion 2.1.6 [English Translation] Patch\_Redist\VC-Redist-x64.exe
"C:\Users\Admin\Downloads\PvZ Fusion 2.1.6 [English Translation] Patch\_Redist\VC-Redist-x64.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:908
- C:\Windows\Temp\{6E3BC9F5-134D-43FA-8681-45F0173974D3}\.cr\VC-Redist-x64.exe
  "C:\Windows\Temp\{6E3BC9F5-134D-43FA-8681-45F0173974D3}\.cr\VC-Redist-x64.exe" -burn.clean.room="C:\Users\Admin\Downloads\PvZ Fusion 2.1.6 [English Translation] Patch\_Redist\VC-Redist-x64.exe" -burn.filehandle.attached=764 -burn.filehandle.self=768
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4972
- - C:\Windows\Temp\{6BAD991F-7532-4CCF-B639-52F048204BF6}\.be\VC_redist.x64.exe
    "C:\Windows\Temp\{6BAD991F-7532-4CCF-B639-52F048204BF6}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{FB4D274E-D713-4739-A235-69FE4B740006} {4E4D9CD8-4B1F-475D-BB27-2AD57CC6AE4E} 4972
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    PID:4860
  - - C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
      "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={77169412-f642-45e7-b533-0c6f48de12f9} -burn.filehandle.self=1148 -burn.embedded BurnPipe.{C6DA49D4-F670-418A-82B9-963A741C09C1} {12F7763C-2B08-4B11-B529-C2066FA96E5E} 4860
      4⤵
      System Location Discovery: System Language Discovery
      PID:4480
    - - C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=572 -burn.filehandle.self=588 -uninstall -quiet -burn.related.upgrade -burn.ancestors={77169412-f642-45e7-b533-0c6f48de12f9} -burn.filehandle.self=1148 -burn.embedded BurnPipe.{C6DA49D4-F670-418A-82B9-963A741C09C1} {12F7763C-2B08-4B11-B529-C2066FA96E5E} 4860
        5⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:5032
      - C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{D2B05EF7-DEEB-4877-A866-A39B7617059C} {D5650011-C5ED-4EA7-9E86-F26AFAD6B8B6} 5032
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4340

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4476

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
PID:1940

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3016
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 5EBBD48CD10AD7C8FC5A27799B16290F
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3044
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding E33B136E93DFC7F3B024D16A03B3B4AB
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1676
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 772D6C041E29CE2C7F22D50728C85229
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:640

C:\Users\Admin\Downloads\PvZ Fusion 2.1.6 [English Translation] Patch\_Redist\WindowsDesktop-Runtime-6.0.18-WIN-x64.exe
"C:\Users\Admin\Downloads\PvZ Fusion 2.1.6 [English Translation] Patch\_Redist\WindowsDesktop-Runtime-6.0.18-WIN-x64.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3284
- C:\Windows\Temp\{505D2A3D-3882-4283-A3D3-C99A79EC8260}\.cr\WindowsDesktop-Runtime-6.0.18-WIN-x64.exe
  "C:\Windows\Temp\{505D2A3D-3882-4283-A3D3-C99A79EC8260}\.cr\WindowsDesktop-Runtime-6.0.18-WIN-x64.exe" -burn.clean.room="C:\Users\Admin\Downloads\PvZ Fusion 2.1.6 [English Translation] Patch\_Redist\WindowsDesktop-Runtime-6.0.18-WIN-x64.exe" -burn.filehandle.attached=596 -burn.filehandle.self=608
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4576
- - C:\Windows\Temp\{FF0AEEE0-4AFC-42DF-B51E-F0402EDB9EC7}\.be\windowsdesktop-runtime-6.0.18-win-x64.exe
    "C:\Windows\Temp\{FF0AEEE0-4AFC-42DF-B51E-F0402EDB9EC7}\.be\windowsdesktop-runtime-6.0.18-win-x64.exe" -q -burn.elevated BurnPipe.{466CD8BD-B031-4DC1-BAB0-E0FB1B19EFFA} {2CA2E281-8BED-4254-BCC9-820057EE2E6A} 4576
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:2976

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\PvZ Fusion 2.1.6 [English Translation] Patch\Launch Game.bat" "
1⤵
PID:1676

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004DC 0x00000000000004C8
1⤵
PID:4792

C:\Users\Admin\Downloads\PC_PVZ-Fusion-2.1.6-beta\PlantsVsZombiesRH.exe
"C:\Users\Admin\Downloads\PC_PVZ-Fusion-2.1.6-beta\PlantsVsZombiesRH.exe"
1⤵
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
PID:2008
- C:\Users\Admin\Downloads\PC_PVZ-Fusion-2.1.6-beta\UnityCrashHandler64.exe
  "C:\Users\Admin\Downloads\PC_PVZ-Fusion-2.1.6-beta\UnityCrashHandler64.exe" --attach 2008 2411437625344
  2⤵
  PID:1708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e5c7c60.rbs

Filesize
19KB

MD5
8248effd860f375179acfc1231542887

SHA1
9931a9574c7c747e06f8630ac248d16a0c0fbc21

SHA256
d46ddbfd891e2ce8cff8b259de30b56fbe1a8cdc3eaf3e12633d6360698a79f8

SHA512
6046704bb63abbbfa0b67b408146b11a818428a370ddd02dbfe9d8f4b1866709dd21743f3b57969769a8a66683ce4be9b75a85b5e71c8692bfe61b5944c46d06

Download Submit
C:\Config.Msi\e5c7c6c.rbs

Filesize
19KB

MD5
ae4d5bc76bf9ec26bb706b07dc9a9faf

SHA1
b5a24efb1bb7036d35b6bcc7cae595d5b70b9a71

SHA256
99abb1842e591cd209e26f83f03a883f17c5e88b883505cd7a1bae7d4f0aa8da

SHA512
17ff438e7eddca9c7a1e8f56b7760fe251160073d8efc3508518dab5e60351739cccadf53703b7c8b492a950164374988cb5f655f2a30781d4b3ea1240050982

Download Submit
C:\Config.Msi\e5c7c73.rbs

Filesize
21KB

MD5
c9b9df111396521ee50633dcff3268b7

SHA1
f42a856019a49b56103253858f3f9fecd5a61558

SHA256
01a6183fd7f267554250715dc7657ebc62c838d35c380b37effef21e51314d91

SHA512
e9405793b58cf9e82b0eef87b709e1e40ed5419a5f18548bf84cfa760c55f456ad25c7dab41e14aa03e3114d955e3ab9fee3130ecd420faad2fbaf10b7414aea

Download Submit
C:\Config.Msi\e5c7c82.rbs

Filesize
21KB

MD5
ded91b2e0887cc10e061cc1d4e88fc22

SHA1
70767655f9979371eddb061353350d192c7b01d8

SHA256
d671ffae038bf9a1dd6329048c4f6750df40ff7dcc6174470465a53f11de4fe0

SHA512
f7ce6dfcd75ace2113c06d77fbbcd92b48873be7c0b2e1158d9393bbdc93fdac33f76209a0a68dec8ee7be5fb89bf7c703f52513d0e52b5aa8310339663004ed

Download Submit
C:\Config.Msi\e5c7c87.rbs

Filesize
56KB

MD5
f70eb2e597f8f9545e70effbeefcf58e

SHA1
55f26b5ff21d97637c1150f27527f7f2a64453df

SHA256
b13b215326f27bee5618afc487417404ef8ee05a2b154627d19d39bf9bc13268

SHA512
d76bbfcade73127f451c9a537ebd746f3107ee0093a51459dec501ac0ad9e7264dc49c95ee534304848690f5425388f21d4b8e58e32b60390a72baee20cc3b89

Download Submit
C:\Config.Msi\e5c7c8c.rbs

Filesize
9KB

MD5
688df6ddafe5f8e5754b0c7d9d82cc0c

SHA1
fece1315c235faac3d1462be1eea71db0cd24b7a

SHA256
d63349b67e82724a77e78aa59d96a701aa87ba099aa068c6c30ea5fa49f2aead

SHA512
d8ef0d7baf818c07ea7345f0719c15f94955a270e355223fa7db4db10150d2a0ab04cda2cb8b0021c2003245d867cb0f95da60192382df01d31067714e97847a

Download Submit
C:\Config.Msi\e5c7c91.rbs

Filesize
87KB

MD5
93a11a2081e475813b308172bd1e73dc

SHA1
b264e29436555cfb9b56259886411e326c3ad0f6

SHA256
84b359be9015d32084934cce5c5d7d0ccfb4621866a1c7cae2cda0668d8ec03f

SHA512
830e3d9b38638b577d685ea2b6908cedce5a495a034fe3d91c0ab948a4740adf70932e11ec65b51deb80b379c63f0dcf8ec89a40cbcc969b9304729f658623b5

Download Submit
C:\ProgramData\Package Cache\{77169412-f642-45e7-b533-0c6f48de12f9}\state.rsm

Filesize
1KB

MD5
65cb76e28595581a44a2eaca3378fa21

SHA1
d73867320f4312f5162e6d2e542a33fa1fc504e9

SHA256
457d6eb683334542dd187a19a907c9e9fcb86561326e2af094cce2b061cc60f5

SHA512
9e1a65c80ef93eef6d417ff7bda6a6b7c397445dbde4f0367d9259700ccd648e44d042636264f7125c8d0a9a08741216b0ec0e9cd262e7d18051689056ad5e64

Download Submit
C:\Users\Admin\AppData\LocalLow\LanPiaoPiao\PlantsVsZombiesRH\Unity\local.9930545fac62bb54b88029ee6340031a\Analytics\ArchivedEvents\173736471900002.636a65b5\c

Filesize
1B

MD5
c81e728d9d4c2f636f067f89cc14862c

SHA1
da4b9237bacccdf19c0760cab7aec4a8359010b0

SHA256
d4735e3a265e16eee03f59718b9b5d03019c07d8b6c51f90da3a666eec13ab35

SHA512
40b244112641dd78dd4f93b6c9190dd46e0099194d5a44257b7efad6ef9ff4683da1eda0244448cb343aa688f5d3efd7314dafe580ac0bcbf115aeca9e8dc114

Download Submit
C:\Users\Admin\AppData\LocalLow\LanPiaoPiao\PlantsVsZombiesRH\Unity\local.9930545fac62bb54b88029ee6340031a\Analytics\ArchivedEvents\173736471900002.636a65b5\s

Filesize
466B

MD5
00fb6a0715affe0cbd6288fd05240de7

SHA1
69533828421e668a91460ff5ffc632f66bb77694

SHA256
58524274fd03fdf92e6dfa8b01656ffc6e7b9ae57b06b705e021ba4bef18fe80

SHA512
fff893cdcf7ef248b54e7a36581f208f7645230a5f4e4298c45d66897978548de730916f08420b619b810d34c77c784b6030327e30d9135200d9aa4b14718b34

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e9a2c784e6d797d91d4b8612e14d51bd

SHA1
25e2b07c396ee82e4404af09424f747fc05f04c2

SHA256
18ddbb93c981d8006071f9d26924ce3357cad212cbb65f48812d4a474c197ce6

SHA512
fc35688ae3cd448ed6b2069d39ce1219612c54f5bb0dd7b707c9e6f39450fe9fb1338cf5bd0b82a45207fac2fbab1e0eae77e5c9e6488371390eab45f76a5df1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1fc959921446fa3ab5813f75ca4d0235

SHA1
0aeef3ba7ba2aa1f725fca09432d384b06995e2a

SHA256
1b1e89d3b2f3da84cc8494d07cf0babc472c426ccb1c4ae13398243360c9d02c

SHA512
899d1e1b0feece25ac97527daddcaaeb069cb428532477849eba43a627502c590261f2c26fef31e4e20efd3d7eb0815336a784c4d2888e05afcf5477af872b06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
52KB

MD5
969d74171d03af4ba94d242c68d8c8db

SHA1
bba7984ad7cc35772a81f6be06af618487525ecb

SHA256
e4868439c4cc29efb7742ed511225e57bfcbd98c81790d6b518eb36153709299

SHA512
cee53b8a577c0a4873daf0bd971005204a1ee0459647292a41e806cc3fa235d7f3ac4e87f465aa10accfcd50cf2b287f2863df167e2ffa8401899777d63353de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
31KB

MD5
514647c00986143aa8044764ab774e08

SHA1
77725aed72f5d2bc75f448842f91d3ecd63188cf

SHA256
eb06a75627ea813967ae8a8568405eafedd2638b0d0131c2eb5189b3e31d1b12

SHA512
60f6f4aabe8cd91a8242e55880aaf8d422640ad424d65968733e1400b8ba64c5ca83bff6c8dccc978f03fd20814938ce1a050d13245e19f1dad7dc09a7866f74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

Filesize
145KB

MD5
5bfb152210bdf7d7b93d1aaab191db02

SHA1
fea8e084571d0ac8e42ddbedf39782a42a902269

SHA256
f660c44cf575cc3ad72fb659d1f486d7a573c6f129ad7532e00b2c18b428fefa

SHA512
eaa5e214a6add367a4abb7eb08f79ca9d9a261d3ffe3f2bdb6793c2d05f7b61f0861a59c7378b5b3351330ba50f8c81456e93d37dc3d828724a0825c5782414f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

Filesize
25KB

MD5
3e385ad8ecd56924300cd51a9e880071

SHA1
43593fbfbdbb188d88e659efe2d007d84377e7ea

SHA256
736773de44b8b94e3d2035fde2256b68425f207eafd3c79a46d60629e42fd560

SHA512
b19b5d9fead1bc473e84fe9f9c82b9872f0af7a7964b97bbae76312729e8f3969e2f20636b3b820cbf26f0539283c88afb8471c0b2897814be01d02f167cfc88

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015

Filesize
20KB

MD5
760732f59eb4b6667ea7abb23565cd9f

SHA1
1091bb22993c329339b95a007b890fb68ad2aa1f

SHA256
09353aeed9bbcb92f5c59024b36912866cafbfd5fba5ba7f248a51817257396e

SHA512
0d3686556737c58ef71113a89e6a9cbdb698754a5c38d4399e213d97061d0c9a677e70131f4b3e4e6aa5a290be21408597206d7678ec626128694676d2158096

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000018

Filesize
59KB

MD5
93c78a12cc27f28f1bd58ebb37b0faeb

SHA1
618f6fcd69ab91acd29dab76e0e110e326e5079f

SHA256
16b4cef5b4fadd0b6a9340779eb74297ccd39b367b5bf5da9db56d5ed6d0986f

SHA512
5bbbe69909a3440ba74fc1e615492ff99e268714fd7fcf8173680b0365f6d6035da06d640f8462b5658ea78768ef2ff72f3b70b91d3603fb57b4310c4be590ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000019

Filesize
20KB

MD5
bf19963f072b61208a423c95d2b0dbb2

SHA1
7b39999fbfdfc5f646c47e07eddff767a8f77057

SHA256
cc731c3775c0ab17bb6d658c01591c6aa240fc0fd4ef4872792389020f1ddc8c

SHA512
49ad4dd456ee69f86de1ef6dc6b8c48bf9e6652e0df7e3370ddf944867c7b416d3e7e3703f01831cafa845270f0af6a1b088b897afc6a48c67477c424fa6cbee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001e

Filesize
20KB

MD5
6408c37d09ecb7370b4d61ea51a15ad0

SHA1
8fa447851c7db6c2a4e20a13d769ed926daee5d5

SHA256
38c4bb35d2dc312b0e82bf8c5098495fd12d73029dedb6014c8f3ead635e641e

SHA512
5436d6204625fcc424989776d5ceb7fbbe286bd37bf077967289ce336ecea0e1db85f064d51d4a18877cd96be0d20557c682bbf2ccc6e34d6e096557aa357311

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000027

Filesize
88KB

MD5
ad4fd2174f9ef2eacd66a7aef8c541c5

SHA1
8a2afc8763ec5ccf7173ad22a87ea773debfcc56

SHA256
130584e5376099a1ac2a00b318a3c4419f599a48d67798dec345a780bbacdec4

SHA512
44f1dd34bedbe6e913003d675dfd6888465435c6ecc2d0abdd95001d9c01d6f05e5eb18412ae45e62d670d0d67ae2cbd7edf03e9e4ad130dc43f67934e78e6cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000049

Filesize
215KB

MD5
d474ec7f8d58a66420b6daa0893a4874

SHA1
4314642571493ba983748556d0e76ec6704da211

SHA256
553a19b6f44f125d9594c02231e4217e9d74d92b7065dc996d92f1e53f6bcb69

SHA512
344062d1be40db095abb7392b047b16f33ea3043158690cf66a2fa554aa2db79c4aa68de1308f1eddf6b9140b9ac5de70aad960b4e8e8b91f105213c4aace348

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\7f78e1206f91203f_0

Filesize
32KB

MD5
2ace4ffe166438b79b055754aa9eac80

SHA1
bb010940994f75fc4eabaad4f4ad2e5f245cb53b

SHA256
2dd242e0486b329973133c61ba0bbb8e726fcb40eb6bb7732194675a17895011

SHA512
322449aa29ea6b221934fbb2eb11733e57ef414ded184404f8090cba69ea2585e096586b30fb936ee24b1f3068805011c9035a36087713bb20ea6d589e21f4a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
f73ce1a8c5724ebaa327d5b9158e4d75

SHA1
6ffb81508b2247d7786bb897f383e8080b88ed6b

SHA256
895fbd4c4334ba76a0fbea404b87ebd2bc663b0dc175ebf62dfa2222ff7b5d39

SHA512
0dfeecb0df965676d4e97dfde3f7e66fa0f1114152f5d98c68142ad1c13552b9f8081d22b97f057ab41a6234ee4fbe50061961b8eac7829cd44618c4acb3839b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
9138ad42e250ed921a7dd39555d2f341

SHA1
c1445d520e639600fe0d36cd4c9851b98312c14b

SHA256
511014c6a93ae08187fbbb0a3f8ab9d9b0fe4f94b16d388fa26e412900b0f40f

SHA512
04a36cd664c6f52fa6074d806dc5b517dfcd958ec8b7d9c739b8ab6a3a2460af00452df8c89a9459acddbecf5879d998d45d4d8d261c883763a5d2c1dfc04cf0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\t\00\00000000

Filesize
4.5MB

MD5
d368cddb2d478b57ed2d176c5ce31ec6

SHA1
bf49b6646321ed11e4f688113f307b63ea08154f

SHA256
65d3ce367274ee9f5a8753bbe653e1abd172c464cdada2384c1824fdaecccf1d

SHA512
442db4ec86637577478422660fc3e0084f96b2028c55fe719605ddb6e1dafe165c680959c58feac746e7ebce26e707867ac2572d19182afb7e8c586932915ce9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\LOG.old

Filesize
1KB

MD5
af679d51147ef02859274486961be52d

SHA1
3aee4ff7007f51c94fd97f6d903c455daeca3134

SHA256
cad2ba1a72b46ee338a59798fc0329444e4b69998990ff9de2c250c5135192ea

SHA512
1c46d4a0043675887c8b8d8853b844cfbacc7a8151d9c8b9baf4c897be3df4bfefa6d4d9b889dcfa3b167cf647fae92fb446ab5f250dfcb0de659067a858bed4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\LOG.old

Filesize
1KB

MD5
d4727678ec69dbba17d3340ff9c9a1a8

SHA1
ca5e249ff413ef55f35055d833f2a80f64b2cd7c

SHA256
e5adf5250e172bc8941dc2c5af5326088d5b09051a08071231ed6fcabf5af8e3

SHA512
412b43206b13db905d14a59f5174cbd13282bc7c64b0f3500ba59f16f9018f4da22d94a355ada7941bc80dab29d1db928a122f63ca93a0ced2632896ba383706

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\LOG.old

Filesize
1KB

MD5
d60b881fc64632b408bd051bf21cf53c

SHA1
e7c30c42de24a541ccb6a65a9b0730996d5ae972

SHA256
e332d1c927c04f9c75c64ab1e495fcc252e038f412acf5c0ff05e94e2979c4b4

SHA512
78fde0bf6803caca2c8abe4f51c9508bd03ccd472445c0c34e51970b3496d88e864b45ff9ab3f824fe597d9571710b9418e27675081a861e1f5cb5de8c51c84a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\LOG.old

Filesize
1KB

MD5
938131657c77625941419cc948038e29

SHA1
b827d11e681ddf8e15f2027e45e8ae849f49b7d2

SHA256
d183890e2bd6bc5e2e73e5e5b86a3e5649703c7699a6ccebb391d89dc87b1102

SHA512
0b0288b73364f3bea6fba591c7fefe84db184465d7a75a69155a5851573c26c00d302e4e26365797c82afa7f4c24851286b13a37789a3a3c3cc4c2cfcd211985

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\LOG.old

Filesize
1KB

MD5
bb19d71411ffee7b0b49b32c11eeba0a

SHA1
c8dc8561e1bd8af0e854a6798444942af158dc43

SHA256
a788359128d4a6a2ce490435103e36b5e3419989bc44a0e8919e248c3eeda18e

SHA512
fe25022a35c23c51e9761c691d6919b16c97c026e243d72f0bd77ecfd36e629c5ffdf4c051584c3e9e60e0adced8adcc13fa11db1eff20966a31d83e84fe9f27

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\LOG.old

Filesize
1KB

MD5
664732c82a80acb581ca45dfe109daa9

SHA1
bd46e728ce0d6a69f52b5682442fc1e54d4a670f

SHA256
9bbb13f7c864d1da8bb98d3fb1c18081acf2c90e473bc61ca0a02ae44fcc33a0

SHA512
5e87dbf1e2c716b6278f9d1386f62e163bb827264d59bcd11b227c049a56be3d34642c15e3366472bc5cb8a47724d0726f24e67c75b98c1eb5552e8180ea9c89

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\LOG.old

Filesize
1KB

MD5
14887d5eb7120843e242b8d8376f703e

SHA1
52d0770e93ded044cddf144ca3662f3419b88c2e

SHA256
d55933d0f06a3e9e6de13cbabf8275cd3534aff9d9b849464aa89a8f4c18605e

SHA512
2b656e0978e29b8e24c3256217dc18e284813ba7bdee91b4af802b52c926507b9057cc346774e790ddc4632f7eaa05ce80b7f0f9abed8eb9c76c4cccfbc9e0cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\LOG.old~RFe5e2846.TMP

Filesize
598B

MD5
a650a70d8f300aaa691d53350329c347

SHA1
3f9941c5f91f8e4973d4debb8b9cf8f6596a5024

SHA256
706b9adab69026eac34bfcff60222730a6df5291e734f3175bd55d6f89662206

SHA512
6c816e5303e8ceff4af01fcf75699d4a93f88b5cba1ff60cd0678ff9f00d4d0533ba8e029da15ba081d4524c735ab91a48232138d45628a8a0428c024bae48be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
5KB

MD5
cefcfdf1c14951a7784697dff8fc7ef0

SHA1
e19410681f867de6ec4d98b6f03ade7bd5002114

SHA256
9f834147cebab7714322fb056e0bb61718ef56f77d048448f701fab43917c1ed

SHA512
ab0aa90a7dd5584611eb43b78613100aa4cf6f9f176cb794e81f4f8afbeea8b5877d252d35ed25397f005cb59bfb717729bd10af758624ab1c9696d46b75123f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
5KB

MD5
d8af38b04aa1eb9bc754fd9f034d0f80

SHA1
9e4309754740e5fda6c2f035e78bf47b3b22ec01

SHA256
78913b57b2251f6dc97271ee7df72f3314dc7dbd5ff5ac51b28a5eb33cfb72c4

SHA512
ee1396fd0a2ad4d8607f5472cf71303fda160e06dac8ad7b54257953c4cb87ee1c3188e6a55985f77e2876ac7be7e01674620baa10f60abb9369ef1b4975651d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
5KB

MD5
5ef0ddfdd3bfc09bc8d1c819a8a86237

SHA1
75db20d28fa6887ab4ff95034241852992d0a0c5

SHA256
8df8da7f8d70c48fbb2de121d7992a682e11871e8aa4cf79e93e6c3de3aa4b04

SHA512
d50e3a598f8766be8d50127cb88e7bd5e64c40c663eb91e38dd94336ba548596c9a7b2074a938b322c4039c0b43c4d3c94545a7f6057a42bdba5509e8d2cff46

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
01d8f4f267b117952ecc04424c27802f

SHA1
898b9b9e065e5fec2ae6cdc5cf64af9efc3ee868

SHA256
16bf86fbfdd1062b7045de8c509119af965d011e1e17e6655f136454b950fe64

SHA512
21dcaaf8668cded17d73f5a2968ca68a61fd1d5776a3f255d5925778275c47899c3995b4f796608fee379fe99ed1994451d3557008b698d738c44848561a9b06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7c34d8e417ce6d0c6a44133de42182f2

SHA1
e727e4b59f58148aff4ea6d050a13f019652faf5

SHA256
3766d6915e81f5dcbd4610cc0c0c8b66751a9d94afa340bc199c419ad6a3df8f

SHA512
6af09129d575bb6d2d9f8664e123e36cdd7fff9fb7417e61a48ecdc82456e0fcf0e90f8e34c77f31c854e3d7135c440463693dda520256d17af0709b59636f6c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
612292286c03b2fb191adf03990531be

SHA1
94a6693d458a750c5e8f9f6d583ce83885b96249

SHA256
589273285bcbed0429f6193fbc95861141fe966f4d562d7a24f7718a3b3a0afb

SHA512
acc2b5cc7d2b2b357ecad6a20ace7cab880c59418b97647b4f047523edc30ab1135a623b8cbb34abd3f00ea099e52cd0790589757b15e677b6f2b9141e513d7e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8b5d3e41b54758bb735ee29e42cc7cf4

SHA1
e75295285bf5eee9198182ad113bbee929eb9924

SHA256
3d610482e827653f0b7c451fbaec867c276c8d7f2e0fabf8a798923f1147afbf

SHA512
03ce6f7882787f47f88ac9bfbcfb8f9c891b28b318b5825d1371ce992433bdf1912775717b3513d32af56853087ffc104f9f380c0d110e5ee00f6731a0a90319

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
cb5c0e2739109380c76883eaee6f41b6

SHA1
84e05370bb4edcbb6039470ca9b1b6d6bde9bb35

SHA256
39c5a540938219bda011433f68488c4661aa9c1fe49a93a9b4ffcd1d3b9423ef

SHA512
b43d44d7cd532d234493cbb8e59723578bb8a76894f238a1391e9e654c07a91944576622895c164128f4ffdf0bb1fb88dfd5879a5c94229a67b81361c1c241ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
b633f3744fb95eaddd650d02a94dab99

SHA1
0c036681ac54983973b81c885db028fd8e21b56f

SHA256
b52d85a81c99729f117f8c8d2123167a4bbcac9f602d34a7da27860224d36f2a

SHA512
108270a0797c0ee51e2d7d9ddfa633a0ca01e0b30064833b814258712d344c86b659c714daa6cf82b6392d2be17fe6f4c6a658824d98cc9ed3b515c0482a0c06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5e3f1a.TMP

Filesize
48B

MD5
f9fb7a3ab80fae4d871d38198b8da18a

SHA1
ed70438d939ea01c44c2dd946a313344c21e987a

SHA256
ba5d228ff0842d859dc4007d1f4b6cabfc46ac76266d8babc3a7a276ed531702

SHA512
151ee38fb68def057b577ed20ff40134e7c8c59b251cad996e8dbf2713bab9f645ab79fdcb61b42e59d3a92de8ec7d6915d26a0177f419e7ea72459403e09545

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
db5527e2555d9b45e785e9abf658fc8b

SHA1
1f3251ff1fe638fa4118366f37a8cfc34d76db66

SHA256
f9032c473f4095b01dbfa2b12d62350880bfabdda580e080a4265d53b7b63d9f

SHA512
58bf99a3b30b23610daf3a03d5fbeae84b6d08447a4ea3d9a8371f382c54bade1bfbb96a3ea411cb8f8245cf57219b4b0805d142eef75f53fe7dbd421b72b70b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
8bc526cccd9c1bd534d7fe01c9962597

SHA1
292003d15831b3cad92003b4c050209cec1869ad

SHA256
dda6a9c03dfeb10c351851f680d16d96c798df7d39a81486d3b48ac09f8bb29c

SHA512
57f3894cb25dc2592e7e47335834df2ede443c31c7d2626dc1a7e4e9a09c07c2710189e71897bc2bf5820e32c22d85e529bfb235c091a699094f0ba5ae34f9b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
cf03fdfdd68f272683dfc7d34699debd

SHA1
d17ffc1d68252f1b718a9a504861c2e9a66be503

SHA256
550fd2757da329666f0bd43ee21200fa127ecefe0783f15a77e2720b1d6a1fc8

SHA512
1fd3affbe7ed25c37e38cee0c60f3c89be710dee7d0148c7befad0fbda214a4c18f4600feaae0bcea0402a6483bca64a4bc85ea42ef47bed212921e0db9d1da1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
48cffa86f6904dae20639f2e7f9cbb23

SHA1
70601000a29c19b58ed39c03fdc2c2b6e3c81869

SHA256
5add543f2fd4c13c4cf3ac4f27403fcb1e42ab58076c4e0d596df4e6bfe81d29

SHA512
923aed3d02370a3aa1a9823dbd3b5d7cd301ac5e98d4864066047812decea5423e05c56098925adcc9ca0e8f79f5b13677254f794a88d28370e09201516fe839

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe580c6f.TMP

Filesize
371B

MD5
c2f32c5ee69000e4887143b3934faca8

SHA1
fe4e0cd7af4eae0b09761ce327cd5ad0c1cb3669

SHA256
e6454128827d770e2eaabcbe9ea3508963b527e7d0d4f2f466c99add3a5a8d71

SHA512
393e38d5d19e261a55f23e6d5c91e1cb35c09225773a94085fd794de32f12525a6b124b9ddffbd82d81e112240bb76263155b4a5d0cdd8ca76132231513833c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
eb01b7aedb40a5828beb7fc60fbd562f

SHA1
d916d31f44c47f96c54d6c5465614a7bad93d0bc

SHA256
d917390533ac9a149decd4499dbc48ba552531394f68ddbef15a8dc39387c256

SHA512
f0aa7cd26a02e3a8e491ef31e1e9e359ab470557a0b6193444a85ba7d808e2b6b82427d8234dc9bf3f8a49c219bd9f3f5d4922654e216f6a0ff7a7306f951706

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
2a49551cc41bcf89ac48fb23a0249d40

SHA1
ac7a9e41c941332d617fb9e0001e55aea7a092f4

SHA256
7dce7753101b2e2138cf6fad5d85f837fb36ff0b5aaf6ebe2da080072be978e1

SHA512
6858d09bcc0681c2d7843c835bef3112d9d5db4fa247456c692a3935b1c1ab0704593ba192f38ecbb81f57a0a9cd68585a1d5298f21ff9b041686c22d84324aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1358f6936ccbbfecc986905377bd0ba4

SHA1
9543d9854f150d7b1982402f84ad335eef713181

SHA256
748eafee61301c7afe1ed32f619af7aaa14f6b15eae331cbfc2f7299cc49947c

SHA512
b72ca522dc5251eb053234a7208464ab2febd8bccaccc681f9494574cbc4c65123887fc72038715c2bf8c97fa8399abc16f371e458036c916d84058f5cbe3b6a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
702f938dbb39b8af945b97acc9d473b8

SHA1
943442cdb1290e7aa096b3818c413039d2c7a6a7

SHA256
a60f173e2e641fc63d3ae373706190f7a9a2e6a0c183f099315b4ebe44c0cd30

SHA512
c48d364add65d49764c2793e8ab98097550f89a875bdddfd15bb2fbcffa9f4ec80e309c5a537b71995c8cb6dfd3cbbf7edd7b7b743a2d1b1253374cd7145c71a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.18_(x64)_20250120091452_000_dotnet_runtime_6.0.18_win_x64.msi.log

Filesize
4KB

MD5
32fb73d29ddcd15716df871ce6ba431e

SHA1
b5d1c759be224a432643d5be7321cf8c7e8edcfa

SHA256
2000e065e3c153d4854c18ef99cf319fa6c073c5fcf4dca47b8ee6b9827eb0e8

SHA512
8ff2826819ed48065e24905a89ddb648f9619a071b38502d49e1abbe17568b711da5336624c54cbc0b2a61f279ed6d3287e5b1e3cd4760235e029e25516739dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.18_(x64)_20250120091452_001_dotnet_hostfxr_6.0.18_win_x64.msi.log

Filesize
2KB

MD5
92058dce9458ac3e5317f7430ce6ed77

SHA1
faa8063ac92e721d4182af2dbabe9f2586035677

SHA256
ef177af680b3d954d22d63a14b721a185519b05c296fd8d04ccf584d0f11f633

SHA512
80f3099c2efe11ccde4293fea051f676e8e3e2f5f40eb3076f0e7a78bd8ed3e6333420e6bde39718f075497aa05be5de5cd9de93ba4a05b22406785d318b9132

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20250120091428_000_vcRuntimeMinimum_x64.log

Filesize
2KB

MD5
c9a72564aa498ae134c957e09a0ef86c

SHA1
c2cd91b4d2d32aab49644c05493e2691abcd4bd8

SHA256
3ecee6e6f9002d685350571a843c2f0f7827e4440290fd6ae094d0340cc2d693

SHA512
2b39dcfc548c47be335e49ec58fe455344c787ad313f2e696a556869ddb13f7e53d0384650ef905fc5c846f7327dc5fb4b249a1f5c187198e0527f6d9534cc2f

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20250120091428_001_vcRuntimeAdditional_x64.log

Filesize
2KB

MD5
b2bb07bd3405ebdbd07765114dc6aaf0

SHA1
00a8644848006733f6161a09b5c52d842d48fbd3

SHA256
f4eb963be48be03dbb1197d37e7e5088b4ed9751d8009c91499ece5c7c119ed1

SHA512
05fada9ac9a2fea4b269cf5890df01d0fc3fd65e47244ba938aa80852f8127ea7a015aacc780a4e8a692a31b636d1c54cafd1db9c24e2780a1c75aa80fea2dc0

Download Submit
C:\Users\Admin\Downloads\PvZ Fusion 2.1.6 [English Translation] Patch.zip:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Downloads\PvZ Fusion 2.1.6 [English Translation] Patch\Launch Game.bat

Filesize
86B

MD5
002339aa84cc7efbc1c78c4b5f67c9ad

SHA1
fcc120b69548c7b472821733d42b3a962c4783d0

SHA256
da9ad8a74258cd56fb24569ec35c66f5fa4a3344d011dd983c39a3f54c00c3b7

SHA512
22947322cd1ff3b727d9d0ebb77dd2710be24e8dff304fa41e6531dd51cc68f5ee04f1edd8eeabca369858a5f9aaae116d9aae2bad23cc9a821ed41fcb8e3b0f

Download Submit
C:\Users\Admin\Downloads\PvZ Fusion 2.1.6 [English Translation] Patch\Patch\Launch Game.bat

Filesize
69B

MD5
4875dddb3f66f772f7ee962f405579cc

SHA1
fbec655afb903dcbe277c8af65ce03b277405fa8

SHA256
3fb5a6f6050fa4b2efbe241b4010455619534884018ef15de4ad10313c74008e

SHA512
89bb8c3f5b026c05dd5e0bc5fe05f0aeadf12adfdd87048d4503b67c06680c9bfd772e5803a5260e0dea085c9e68ea912e7e20da094489af00d93eda5852c5e9

Download Submit
C:\Users\Admin\Downloads\PvZ Fusion 2.1.6 [English Translation] Patch\[RM-EN] Read Me.txt

Filesize
3KB

MD5
8adace6514ff459d1f5f88eee792d7a5

SHA1
73d3b4868508f1888949c0695eb693f8fd3abe16

SHA256
dd7058f113b32084da26514a3f18308557d636f17b23575c3bda8ba65ad7e3f6

SHA512
d684a4330169dfcb0eda7ccf97a0f14324108486aeab719656c63be98becc23112c5c2c8e4fa4831f7c8950802eefee518edf92c30a5db22f8bdf01d915ce887

Download Submit
C:\Users\Admin\Downloads\PvZ Fusion 2.1.6 [English Translation] Patch\_Redist\VC-Redist-x64.exe

Filesize
24.3MB

MD5
689d09bce45c75db883db7e78b6f4e9b

SHA1
ba92a00f0f55dcae85c1bbd098efe606bd080b3c

SHA256
814e9da5ec5e5d6a8fa701999d1fc3baddf7f3adc528e202590e9b1cb73e4a11

SHA512
4db5078fdd9eb9ce00a1b6195a67c779a1d3c719de0fbd4729adbdac2d8ca442cf4e0a31aa40d213f29617ec073f1a7e42570dcc2f931eb9534c45f1ec6de253

Download Submit
C:\Windows\Installer\MSIB1C7.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Temp\{3C18F0C9-E8C3-4A54-98EF-BD6AD1DEFD56}\.ba\wixstdba.dll

Filesize
191KB

MD5
eab9caf4277829abdf6223ec1efa0edd

SHA1
74862ecf349a9bedd32699f2a7a4e00b4727543d

SHA256
a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041

SHA512
45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2

Download Submit
C:\Windows\Temp\{505D2A3D-3882-4283-A3D3-C99A79EC8260}\.cr\WindowsDesktop-Runtime-6.0.18-WIN-x64.exe

Filesize
610KB

MD5
65859f87cdb16d45fd818610767a9da8

SHA1
8d31d3363a167f037f63dee994077bc581234149

SHA256
2a7691d5a960edf7eb1d9473f0a390e86336b8d37bce5049788ddb914d3d7cc9

SHA512
6b141d47a7dc05a5f3903354cc4547890a055971c7fb2c5a25e1222d267103f9aa564e59bc856a4f6529f17e1c3c16900b7cc80d293bc8649a224ab774a8778e

Download Submit
C:\Windows\Temp\{6BAD991F-7532-4CCF-B639-52F048204BF6}\.ba\logo.png

Filesize
1KB

MD5
d6bd210f227442b3362493d046cea233

SHA1
ff286ac8370fc655aea0ef35e9cf0bfcb6d698de

SHA256
335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef

SHA512
464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b

Download Submit
C:\Windows\Temp\{6BAD991F-7532-4CCF-B639-52F048204BF6}\.ba\wixstdba.dll

Filesize
215KB

MD5
f68f43f809840328f4e993a54b0d5e62

SHA1
01da48ce6c81df4835b4c2eca7e1d447be893d39

SHA256
e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e

SHA512
a7a799ecf1784fb5e8cd7191bf78b510ff5b07db07363388d7b32ed21f4fddc09e34d1160113395f728c0f4e57d13768a0350dbdb207d9224337d2153dc791e1

Download Submit
C:\Windows\Temp\{6BAD991F-7532-4CCF-B639-52F048204BF6}\cab2C04DDC374BD96EB5C8EB8208F2C7C92

Filesize
5.4MB

MD5
92f06ebd6d7dd8fc4373a257ba81e19e

SHA1
479f3a9fa2d3fed500088812f9201197adf01e17

SHA256
8265bab100e281ddd366a9a435aee439bb87a1fe848fbfce0881449c4f08e485

SHA512
76eb034b06f05a0dcbe62843d791a28959c9354c5e290b90a4320451ba0d5081432f2f6581fb16aedde1fbdc7a60b85c0d7f13907ab7d5e563c57dd2aa6fb9ea

Download Submit
C:\Windows\Temp\{6BAD991F-7532-4CCF-B639-52F048204BF6}\cab5046A8AB272BF37297BB7928664C9503

Filesize
967KB

MD5
3ec3d0ebf9e94535ab326fb3ed1ebefd

SHA1
5331e4062617df4cfe8dd1fed67a39e1778c3e86

SHA256
78cd0d63fb93470f11a300d79c5bafe4554142035126068710d6583fc23d49fa

SHA512
c3f4899d2bf3079485c5c47c8a910023b654e0ae4821ced54b995df5626692551e12fecdc65551d56d9a99f8e5dcdb6176011afe97dc45a734c192834ed0485a

Download Submit
C:\Windows\Temp\{6BAD991F-7532-4CCF-B639-52F048204BF6}\vcRuntimeAdditional_x64

Filesize
208KB

MD5
c41d1aa655205cb772e3aeb0de9c14df

SHA1
a3d95bdfa9c9552536adb589f66ccf28dfeabb1c

SHA256
a4b5cd38dbac2d9588bb15d6b02b24a05c340c2c0a10d1ac86037e6dd14262c5

SHA512
dd5b8f32021bcff98f2a96582d4cfc28571bef870ca3b1d6f7e58d6d4e18f12eb91063f2524094beb699396814109e39f87183e9935742b9579bae75f5f32f52

Download Submit
C:\Windows\Temp\{6BAD991F-7532-4CCF-B639-52F048204BF6}\vcRuntimeMinimum_x64

Filesize
208KB

MD5
cbb2aeab99bcc3085738c1c41fdf3225

SHA1
9462fcbb04046d68df7250f5124e79c269f771b2

SHA256
59a148da299c73d6bd4ef9a8e99736c3d3eabb3b9f895ad8ab183b657516cc22

SHA512
aec8238b7d7a4727b1f3fdcd5d3c6064bf72af6da5d8ef6542fe5fd97b8e24b7d15540426fae029a628d7e160f9fb31fc482edccc416d970f93656ecad0fd5e7

Download Submit
C:\Windows\Temp\{6E3BC9F5-134D-43FA-8681-45F0173974D3}\.cr\VC-Redist-x64.exe

Filesize
670KB

MD5
261f741c93973d184d4fccf833f0c075

SHA1
cb7846fc45cc545b3ac6ab0aa3425461e219b196

SHA256
1ec6ded595b12262d8bfcf8436046c9d84febff424924cb839a1946dad76ca4e

SHA512
90ca6a11c6bbd5f97d1ed146da5279bf40330bf9020b40eb816ede0d914ed4d769e9c48cb8c839924700dec818d4f818f89e6d6afbc7091e2a2809ebe099da81

Download Submit
C:\Windows\Temp\{FF0AEEE0-4AFC-42DF-B51E-F0402EDB9EC7}\.ba\bg.png

Filesize
4KB

MD5
9eb0320dfbf2bd541e6a55c01ddc9f20

SHA1
eb282a66d29594346531b1ff886d455e1dcd6d99

SHA256
9095bf7b6baa0107b40a4a6d727215be077133a190f4ca9bd89a176842141e79

SHA512
9ada3a1757a493fbb004bd767fab8f77430af69d71479f340b8b8ede904cc94cd733700db593a4a2d2e1184c0081fd0648318d867128e1cb461021314990931d

Download Submit
C:\Windows\Temp\{FF0AEEE0-4AFC-42DF-B51E-F0402EDB9EC7}\.ba\wixstdba.dll

Filesize
197KB

MD5
4356ee50f0b1a878e270614780ddf095

SHA1
b5c0915f023b2e4ed3e122322abc40c4437909af

SHA256
41a8787fdc9467f563438daba4131191aa1eb588a81beb9a89fe8bd886c16104

SHA512
b9e482efe9189683dabfc9feff8b386d7eba4ecf070f42a1eebee6052cfb181a19497f831f1ea6429cfcce1d4865a5d279b24bd738d702902e9887bb9f0c4691

Download Submit
C:\Windows\Temp\{FF0AEEE0-4AFC-42DF-B51E-F0402EDB9EC7}\dotnet_hostfxr_6.0.18_win_x64.msi

Filesize
804KB

MD5
2162c0e65061dda036218ecea8b497a8

SHA1
ee8829eb386562767157638013f4728831757995

SHA256
e4eca83c677f42e746790760ae088f6f80b8849bc3d9546d2a253cb3cf91e7d6

SHA512
5b8c43798249d85ef6b24d4106970f686f595f40b7d255183a3a174dac530601c9ed94b38c71d1e5f4b3c2556d737e509f5f92328a539f778879080508ff461e

Download Submit
C:\Windows\Temp\{FF0AEEE0-4AFC-42DF-B51E-F0402EDB9EC7}\dotnet_runtime_6.0.18_win_x64.msi

Filesize
25.5MB

MD5
6b5270ab8c648584c18ff2ec70dbdfa6

SHA1
ea37efd3d242cd319a235e88fa4ae6e51c4e007e

SHA256
6d00b20ee657d994628b9948724682e1ed52165db6ea4844f1f7722d950c0c3d

SHA512
ff78f7a78bb642c56f8f0cb98107e286ff55955172e3bd3320dc3b741aecf1f9d749e05c3721d9aa1d4e7dcb80dd8b1df7eb16d55e925dc4c57451a19846e562

Download Submit
C:\Windows\Temp\{FF0AEEE0-4AFC-42DF-B51E-F0402EDB9EC7}\windowsdesktop_runtime_6.0.18_win_x64.msi

Filesize
28.7MB

MD5
7f505d2d26ce2c013f6087454904f946

SHA1
c39e7e12f4ca2a26339bacc6469317d95cfa576e

SHA256
a9b908404e5a02d055dd40673ba465317098953ea1ea8480b7bb157189120ac2

SHA512
69a75dc60a552f9f666b1ceb150ec03ed58774834408ee1579531813efc6e3ead2ff3b58b890339c915c07919c516fb7a7f35eaa8fb73dd711052ffc59e7af0c

Download Submit
memory/4340-1842-0x0000000000350000-0x00000000003C7000-memory.dmp

Filesize
476KB

Download
memory/4480-1880-0x0000000000350000-0x00000000003C7000-memory.dmp

Filesize
476KB

Download
memory/5032-1879-0x0000000000350000-0x00000000003C7000-memory.dmp

Filesize
476KB

Download