rhadamanthys | hxxps://app[.]mediafire[.]com/v3txu5tkw7ln5

Analysis

max time kernel
578s
max time network
579s
platform
windows10-2004_x64
resource
win10v2004-20250129-en
resource tags

arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system
submitted
05-02-2025 16:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://app.mediafire.com/v3txu5tkw7ln5

Score

10^/10

rhadamanthys discovery stealer

Malware Config

Signatures

Detects Rhadamanthys payload 4 IoCs

resource	yara_rule
behavioral1/memory/2944-3480-0x0000000000580000-0x0000000000601000-memory.dmp	Rhadamanthys_v8
behavioral1/memory/2944-3481-0x0000000000580000-0x0000000000601000-memory.dmp	Rhadamanthys_v8
behavioral1/memory/2944-3483-0x0000000000580000-0x0000000000601000-memory.dmp	Rhadamanthys_v8
behavioral1/memory/2944-3482-0x0000000000580000-0x0000000000601000-memory.dmp	Rhadamanthys_v8

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys
Rhadamanthys family
rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 3 IoCs

description	pid	Process	procid_target
PID 2944 created 2844	2944	Louise.com	49
PID 5052 created 2844	5052	Louise.com	49
PID 4304 created 2844	4304	Louise.com	49

Checks computer location settings 2 TTPs 8 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000\Control Panel\International\Geo\Nation	[ex]acid1.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000\Control Panel\International\Geo\Nation	dnSpy.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000\Control Panel\International\Geo\Nation	[ex]acid1.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000\Control Panel\International\Geo\Nation	[ex]acid1.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000\Control Panel\International\Geo\Nation	[ex]acid1.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000\Control Panel\International\Geo\Nation	[ex]acid1.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000\Control Panel\International\Geo\Nation	dnSpy.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000\Control Panel\International\Geo\Nation	[ex]acid1.exe

Executes dropped EXE 15 IoCs

pid	Process
4136	dnSpy.Console.exe
4444	dnSpy.exe
3360	[ex]acid1.exe
2944	Louise.com
2356	[ex]acid1.exe
5052	Louise.com
3524	dnSpy.exe
3228	[ex]acid1.exe
4304	Louise.com
3968	[ex]acid1.exe
436	[ex]acid1.exe
3932	Louise.com
4064	Louise.com
4904	[ex]acid1.exe
1636	Louise.com

Loads dropped DLL 64 IoCs

pid	Process
4136	dnSpy.Console.exe
4136	dnSpy.Console.exe
4136	dnSpy.Console.exe
4136	dnSpy.Console.exe
4136	dnSpy.Console.exe
4136	dnSpy.Console.exe
4136	dnSpy.Console.exe
4136	dnSpy.Console.exe
4136	dnSpy.Console.exe
4136	dnSpy.Console.exe
4136	dnSpy.Console.exe
4136	dnSpy.Console.exe
4136	dnSpy.Console.exe
4136	dnSpy.Console.exe
4136	dnSpy.Console.exe
4136	dnSpy.Console.exe
4136	dnSpy.Console.exe
4444	dnSpy.exe
4444	dnSpy.exe
4444	dnSpy.exe
4444	dnSpy.exe
4444	dnSpy.exe
4444	dnSpy.exe
4444	dnSpy.exe
4444	dnSpy.exe
4444	dnSpy.exe
4444	dnSpy.exe
4444	dnSpy.exe
4444	dnSpy.exe
4444	dnSpy.exe
4444	dnSpy.exe
4444	dnSpy.exe
4444	dnSpy.exe
4444	dnSpy.exe
4444	dnSpy.exe
4444	dnSpy.exe
4444	dnSpy.exe
4444	dnSpy.exe
4444	dnSpy.exe
4444	dnSpy.exe
4444	dnSpy.exe
4444	dnSpy.exe
4444	dnSpy.exe
4444	dnSpy.exe
4444	dnSpy.exe
4444	dnSpy.exe
4444	dnSpy.exe
4444	dnSpy.exe
4444	dnSpy.exe
4444	dnSpy.exe
4444	dnSpy.exe
4444	dnSpy.exe
4444	dnSpy.exe
4444	dnSpy.exe
4444	dnSpy.exe
4444	dnSpy.exe
4444	dnSpy.exe
4444	dnSpy.exe
4444	dnSpy.exe
4444	dnSpy.exe
4444	dnSpy.exe
4444	dnSpy.exe
4444	dnSpy.exe
4444	dnSpy.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
193	raw.githubusercontent.com
291	camo.githubusercontent.com

Enumerates processes with tasklist 1 TTPs 12 IoCs

discovery

Process Discovery

T1057

pid	Process
3372	tasklist.exe
3784	tasklist.exe
3060	tasklist.exe
4256	tasklist.exe
2920	tasklist.exe
3352	tasklist.exe
1300	tasklist.exe
4916	tasklist.exe
3172	tasklist.exe
3672	tasklist.exe
1484	tasklist.exe
3012	tasklist.exe

Drops file in Windows directory 44 IoCs

description	ioc	Process
File opened for modification	C:\Windows\PricedReceptor	[ex]acid1.exe
File opened for modification	C:\Windows\PricedReceptor	[ex]acid1.exe
File opened for modification	C:\Windows\HansAssign	[ex]acid1.exe
File opened for modification	C:\Windows\InkjetLanding	[ex]acid1.exe
File opened for modification	C:\Windows\PricedReceptor	[ex]acid1.exe
File opened for modification	C:\Windows\RelationshipsPortions	[ex]acid1.exe
File opened for modification	C:\Windows\InkjetLanding	[ex]acid1.exe
File opened for modification	C:\Windows\PricedReceptor	[ex]acid1.exe
File opened for modification	C:\Windows\Installer\MSI9D62.tmp	msiexec.exe
File opened for modification	C:\Windows\HansAssign	[ex]acid1.exe
File opened for modification	C:\Windows\InkjetLanding	[ex]acid1.exe
File opened for modification	C:\Windows\TransitSaint	[ex]acid1.exe
File opened for modification	C:\Windows\RelationshipsPortions	[ex]acid1.exe
File opened for modification	C:\Windows\LicenseBacon	[ex]acid1.exe
File opened for modification	C:\Windows\HansAssign	[ex]acid1.exe
File opened for modification	C:\Windows\RelationshipsPortions	[ex]acid1.exe
File opened for modification	C:\Windows\LicenseBacon	[ex]acid1.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\e5f9a76.msi	msiexec.exe
File opened for modification	C:\Windows\LicenseBacon	[ex]acid1.exe
File opened for modification	C:\Windows\InkjetLanding	[ex]acid1.exe
File opened for modification	C:\Windows\LicenseBacon	[ex]acid1.exe
File opened for modification	C:\Windows\LicenseBacon	[ex]acid1.exe
File opened for modification	C:\Windows\TransitSaint	[ex]acid1.exe
File opened for modification	C:\Windows\Installer\e5f9a74.msi	msiexec.exe
File opened for modification	C:\Windows\HansAssign	[ex]acid1.exe
File opened for modification	C:\Windows\LicenseBacon	[ex]acid1.exe
File opened for modification	C:\Windows\HansAssign	[ex]acid1.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\InkjetLanding	[ex]acid1.exe
File opened for modification	C:\Windows\InkjetLanding	[ex]acid1.exe
File created	C:\Windows\Installer\e5f9a74.msi	msiexec.exe
File opened for modification	C:\Windows\HansAssign	[ex]acid1.exe
File opened for modification	C:\Windows\TransitSaint	[ex]acid1.exe
File opened for modification	C:\Windows\RelationshipsPortions	[ex]acid1.exe
File opened for modification	C:\Windows\TransitSaint	[ex]acid1.exe
File opened for modification	C:\Windows\PricedReceptor	[ex]acid1.exe
File opened for modification	C:\Windows\RelationshipsPortions	[ex]acid1.exe
File created	C:\Windows\Installer\SourceHash{A12FDAB1-731B-4A98-9749-D4815E86A07D}	msiexec.exe
File opened for modification	C:\Windows\PricedReceptor	[ex]acid1.exe
File opened for modification	C:\Windows\RelationshipsPortions	[ex]acid1.exe
File opened for modification	C:\Windows\TransitSaint	[ex]acid1.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\TransitSaint	[ex]acid1.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 3 IoCs

pid	pid_target	Process	procid_target
2984	2944	WerFault.exe	157
2156	5052	WerFault.exe	170
4956	4304	WerFault.exe	210

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	extrac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Louise.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Louise.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	extrac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Louise.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Louise.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[ex]acid1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Louise.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	extrac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[ex]acid1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fontdrvhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[ex]acid1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	extrac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	extrac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Louise.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[ex]acid1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dnSpy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000453bf937353af4350000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000453bf9370000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900453bf937000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d453bf937000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000453bf93700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	dnSpy.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	dnSpy.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2 = 14001f44471a0359723fa74489c55595fe6b30ee0000	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg	dnSpy.exe
Key created	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	dnSpy.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	dnSpy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\SniffedFolderType = "Generic"	dnSpy.exe
Key created	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	dnSpy.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202020202	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	dnSpy.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	dnSpy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	dnSpy.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202020202020202	dnSpy.exe
Key created	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4	dnSpy.exe
Key created	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell	dnSpy.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	dnSpy.exe
Key created	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\Shell\SniffedFolderType = "Generic"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	dnSpy.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 010000000200000000000000ffffffff	dnSpy.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Generic"	dnSpy.exe
Key created	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	dnSpy.exe
Key created	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\MRUListEx = 00000000ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	dnSpy.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	dnSpy.exe
Key created	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell	dnSpy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell\SniffedFolderType = "Downloads"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	dnSpy.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	dnSpy.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0 = 200000001a00eebbfe23000010009bee837d4422704eb1f55393042af1e400000000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	dnSpy.exe
Key created	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	dnSpy.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	dnSpy.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 010000000200000000000000ffffffff	dnSpy.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616193"	dnSpy.exe
Key created	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell	dnSpy.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	dnSpy.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	dnSpy.exe
Key created	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0\MRUListEx = 00000000ffffffff	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	dnSpy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Downloads"	dnSpy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	dnSpy.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\MRUListEx = 00000000ffffffff	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	dnSpy.exe
Key created	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell	dnSpy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	dnSpy.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 376535.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 775260.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
756	msedge.exe
756	msedge.exe
4392	msedge.exe
4392	msedge.exe
1920	identity_helper.exe
1920	identity_helper.exe
1832	msedge.exe
1832	msedge.exe
1832	msedge.exe
1832	msedge.exe
2460	msedge.exe
2460	msedge.exe
4864	msedge.exe
4864	msedge.exe
2944	Louise.com
2944	Louise.com
2944	Louise.com
2944	Louise.com
2944	Louise.com
2944	Louise.com
5052	Louise.com
5052	Louise.com
5052	Louise.com
5052	Louise.com
5052	Louise.com
5052	Louise.com
2944	Louise.com
2944	Louise.com
2944	Louise.com
2944	Louise.com
2488	svchost.exe
2488	svchost.exe
2488	svchost.exe
2488	svchost.exe
5052	Louise.com
5052	Louise.com
5052	Louise.com
5052	Louise.com
4148	fontdrvhost.exe
4148	fontdrvhost.exe
4148	fontdrvhost.exe
4148	fontdrvhost.exe
4920	msedge.exe
4920	msedge.exe
3504	msedge.exe
3504	msedge.exe
4348	msiexec.exe
4348	msiexec.exe
4304	Louise.com
4304	Louise.com
4304	Louise.com
4304	Louise.com
4304	Louise.com
4304	Louise.com
4304	Louise.com
4304	Louise.com
4304	Louise.com
4304	Louise.com
216	fontdrvhost.exe
216	fontdrvhost.exe
216	fontdrvhost.exe
216	fontdrvhost.exe
3932	Louise.com
3932	Louise.com

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 26 IoCs

pid	Process
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	5000	7zG.exe
Token: 35	5000	7zG.exe
Token: SeSecurityPrivilege	5000	7zG.exe
Token: SeSecurityPrivilege	5000	7zG.exe
Token: SeRestorePrivilege	1044	7zG.exe
Token: 35	1044	7zG.exe
Token: SeSecurityPrivilege	1044	7zG.exe
Token: SeSecurityPrivilege	1044	7zG.exe
Token: SeRestorePrivilege	1764	7zG.exe
Token: 35	1764	7zG.exe
Token: SeSecurityPrivilege	1764	7zG.exe
Token: SeSecurityPrivilege	1764	7zG.exe
Token: SeDebugPrivilege	3352	tasklist.exe
Token: SeDebugPrivilege	1300	tasklist.exe
Token: SeDebugPrivilege	4444	dnSpy.exe
Token: SeDebugPrivilege	4916	tasklist.exe
Token: SeDebugPrivilege	3172	tasklist.exe
Token: SeRestorePrivilege	2104	7zG.exe
Token: 35	2104	7zG.exe
Token: SeSecurityPrivilege	2104	7zG.exe
Token: SeSecurityPrivilege	2104	7zG.exe
Token: SeShutdownPrivilege	1764	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1764	msiexec.exe
Token: SeSecurityPrivilege	4348	msiexec.exe
Token: SeCreateTokenPrivilege	1764	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1764	msiexec.exe
Token: SeLockMemoryPrivilege	1764	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1764	msiexec.exe
Token: SeMachineAccountPrivilege	1764	msiexec.exe
Token: SeTcbPrivilege	1764	msiexec.exe
Token: SeSecurityPrivilege	1764	msiexec.exe
Token: SeTakeOwnershipPrivilege	1764	msiexec.exe
Token: SeLoadDriverPrivilege	1764	msiexec.exe
Token: SeSystemProfilePrivilege	1764	msiexec.exe
Token: SeSystemtimePrivilege	1764	msiexec.exe
Token: SeProfSingleProcessPrivilege	1764	msiexec.exe
Token: SeIncBasePriorityPrivilege	1764	msiexec.exe
Token: SeCreatePagefilePrivilege	1764	msiexec.exe
Token: SeCreatePermanentPrivilege	1764	msiexec.exe
Token: SeBackupPrivilege	1764	msiexec.exe
Token: SeRestorePrivilege	1764	msiexec.exe
Token: SeShutdownPrivilege	1764	msiexec.exe
Token: SeDebugPrivilege	1764	msiexec.exe
Token: SeAuditPrivilege	1764	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1764	msiexec.exe
Token: SeChangeNotifyPrivilege	1764	msiexec.exe
Token: SeRemoteShutdownPrivilege	1764	msiexec.exe
Token: SeUndockPrivilege	1764	msiexec.exe
Token: SeSyncAgentPrivilege	1764	msiexec.exe
Token: SeEnableDelegationPrivilege	1764	msiexec.exe
Token: SeManageVolumePrivilege	1764	msiexec.exe
Token: SeImpersonatePrivilege	1764	msiexec.exe
Token: SeCreateGlobalPrivilege	1764	msiexec.exe
Token: SeBackupPrivilege	4648	vssvc.exe
Token: SeRestorePrivilege	4648	vssvc.exe
Token: SeAuditPrivilege	4648	vssvc.exe
Token: SeBackupPrivilege	4348	msiexec.exe
Token: SeRestorePrivilege	4348	msiexec.exe
Token: SeRestorePrivilege	4348	msiexec.exe
Token: SeTakeOwnershipPrivilege	4348	msiexec.exe
Token: SeRestorePrivilege	4348	msiexec.exe
Token: SeTakeOwnershipPrivilege	4348	msiexec.exe
Token: SeBackupPrivilege	3460	srtasks.exe
Token: SeRestorePrivilege	3460	srtasks.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe

Suspicious use of SendNotifyMessage 42 IoCs

pid	Process
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
2944	Louise.com
2944	Louise.com
2944	Louise.com
5052	Louise.com
5052	Louise.com
5052	Louise.com
4304	Louise.com
4304	Louise.com
4304	Louise.com
3932	Louise.com
3932	Louise.com
3932	Louise.com
4064	Louise.com
4064	Louise.com
4064	Louise.com
1636	Louise.com
1636	Louise.com
1636	Louise.com

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4444	dnSpy.exe
4444	dnSpy.exe
4444	dnSpy.exe
3524	dnSpy.exe
3524	dnSpy.exe
3524	dnSpy.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4392 wrote to memory of 5056	4392	msedge.exe	83
PID 4392 wrote to memory of 5056	4392	msedge.exe	83
PID 4392 wrote to memory of 4928	4392	msedge.exe	84
PID 4392 wrote to memory of 4928	4392	msedge.exe	84
PID 4392 wrote to memory of 4928	4392	msedge.exe	84
PID 4392 wrote to memory of 4928	4392	msedge.exe	84
PID 4392 wrote to memory of 4928	4392	msedge.exe	84
PID 4392 wrote to memory of 4928	4392	msedge.exe	84
PID 4392 wrote to memory of 4928	4392	msedge.exe	84
PID 4392 wrote to memory of 4928	4392	msedge.exe	84
PID 4392 wrote to memory of 4928	4392	msedge.exe	84
PID 4392 wrote to memory of 4928	4392	msedge.exe	84
PID 4392 wrote to memory of 4928	4392	msedge.exe	84
PID 4392 wrote to memory of 4928	4392	msedge.exe	84
PID 4392 wrote to memory of 4928	4392	msedge.exe	84
PID 4392 wrote to memory of 4928	4392	msedge.exe	84
PID 4392 wrote to memory of 4928	4392	msedge.exe	84
PID 4392 wrote to memory of 4928	4392	msedge.exe	84
PID 4392 wrote to memory of 4928	4392	msedge.exe	84
PID 4392 wrote to memory of 4928	4392	msedge.exe	84
PID 4392 wrote to memory of 4928	4392	msedge.exe	84
PID 4392 wrote to memory of 4928	4392	msedge.exe	84
PID 4392 wrote to memory of 4928	4392	msedge.exe	84
PID 4392 wrote to memory of 4928	4392	msedge.exe	84
PID 4392 wrote to memory of 4928	4392	msedge.exe	84
PID 4392 wrote to memory of 4928	4392	msedge.exe	84
PID 4392 wrote to memory of 4928	4392	msedge.exe	84
PID 4392 wrote to memory of 4928	4392	msedge.exe	84
PID 4392 wrote to memory of 4928	4392	msedge.exe	84
PID 4392 wrote to memory of 4928	4392	msedge.exe	84
PID 4392 wrote to memory of 4928	4392	msedge.exe	84
PID 4392 wrote to memory of 4928	4392	msedge.exe	84
PID 4392 wrote to memory of 4928	4392	msedge.exe	84
PID 4392 wrote to memory of 4928	4392	msedge.exe	84
PID 4392 wrote to memory of 4928	4392	msedge.exe	84
PID 4392 wrote to memory of 4928	4392	msedge.exe	84
PID 4392 wrote to memory of 4928	4392	msedge.exe	84
PID 4392 wrote to memory of 4928	4392	msedge.exe	84
PID 4392 wrote to memory of 4928	4392	msedge.exe	84
PID 4392 wrote to memory of 4928	4392	msedge.exe	84
PID 4392 wrote to memory of 4928	4392	msedge.exe	84
PID 4392 wrote to memory of 4928	4392	msedge.exe	84
PID 4392 wrote to memory of 756	4392	msedge.exe	85
PID 4392 wrote to memory of 756	4392	msedge.exe	85
PID 4392 wrote to memory of 3736	4392	msedge.exe	86
PID 4392 wrote to memory of 3736	4392	msedge.exe	86
PID 4392 wrote to memory of 3736	4392	msedge.exe	86
PID 4392 wrote to memory of 3736	4392	msedge.exe	86
PID 4392 wrote to memory of 3736	4392	msedge.exe	86
PID 4392 wrote to memory of 3736	4392	msedge.exe	86
PID 4392 wrote to memory of 3736	4392	msedge.exe	86
PID 4392 wrote to memory of 3736	4392	msedge.exe	86
PID 4392 wrote to memory of 3736	4392	msedge.exe	86
PID 4392 wrote to memory of 3736	4392	msedge.exe	86
PID 4392 wrote to memory of 3736	4392	msedge.exe	86
PID 4392 wrote to memory of 3736	4392	msedge.exe	86
PID 4392 wrote to memory of 3736	4392	msedge.exe	86
PID 4392 wrote to memory of 3736	4392	msedge.exe	86
PID 4392 wrote to memory of 3736	4392	msedge.exe	86
PID 4392 wrote to memory of 3736	4392	msedge.exe	86
PID 4392 wrote to memory of 3736	4392	msedge.exe	86
PID 4392 wrote to memory of 3736	4392	msedge.exe	86
PID 4392 wrote to memory of 3736	4392	msedge.exe	86
PID 4392 wrote to memory of 3736	4392	msedge.exe	86

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2844
- C:\Windows\SysWOW64\svchost.exe
  "C:\Windows\System32\svchost.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2488
- C:\Windows\SysWOW64\fontdrvhost.exe
  "C:\Windows\System32\fontdrvhost.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4148
- C:\Windows\SysWOW64\fontdrvhost.exe
  "C:\Windows\System32\fontdrvhost.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:216

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://app.mediafire.com/v3txu5tkw7ln5
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff82f4e46f8,0x7ff82f4e4708,0x7ff82f4e4718
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,8293621621364618252,16742575764213735882,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,8293621621364618252,16742575764213735882,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,8293621621364618252,16742575764213735882,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2680 /prefetch:8
  2⤵
  PID:3736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8293621621364618252,16742575764213735882,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:3596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8293621621364618252,16742575764213735882,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,8293621621364618252,16742575764213735882,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5728 /prefetch:8
  2⤵
  PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,8293621621364618252,16742575764213735882,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5728 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8293621621364618252,16742575764213735882,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5808 /prefetch:1
  2⤵
  PID:1256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8293621621364618252,16742575764213735882,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5828 /prefetch:1
  2⤵
  PID:1688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8293621621364618252,16742575764213735882,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6140 /prefetch:1
  2⤵
  PID:3192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8293621621364618252,16742575764213735882,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2152,8293621621364618252,16742575764213735882,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5932 /prefetch:8
  2⤵
  PID:1016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8293621621364618252,16742575764213735882,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4836 /prefetch:1
  2⤵
  PID:2416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8293621621364618252,16742575764213735882,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:1
  2⤵
  PID:3888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8293621621364618252,16742575764213735882,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6292 /prefetch:1
  2⤵
  PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8293621621364618252,16742575764213735882,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6200 /prefetch:1
  2⤵
  PID:1792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,8293621621364618252,16742575764213735882,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6644 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8293621621364618252,16742575764213735882,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6728 /prefetch:1
  2⤵
  PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8293621621364618252,16742575764213735882,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6296 /prefetch:1
  2⤵
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8293621621364618252,16742575764213735882,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6708 /prefetch:1
  2⤵
  PID:2588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2152,8293621621364618252,16742575764213735882,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4864 /prefetch:8
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2152,8293621621364618252,16742575764213735882,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6928 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8293621621364618252,16742575764213735882,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7120 /prefetch:1
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8293621621364618252,16742575764213735882,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:4160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8293621621364618252,16742575764213735882,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6720 /prefetch:1
  2⤵
  PID:1748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8293621621364618252,16742575764213735882,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:1
  2⤵
  PID:1816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8293621621364618252,16742575764213735882,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3592 /prefetch:1
  2⤵
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8293621621364618252,16742575764213735882,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6136 /prefetch:1
  2⤵
  PID:3104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8293621621364618252,16742575764213735882,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1164 /prefetch:1
  2⤵
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=2152,8293621621364618252,16742575764213735882,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3556 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8293621621364618252,16742575764213735882,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6636 /prefetch:1
  2⤵
  PID:1720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2152,8293621621364618252,16742575764213735882,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5776 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8293621621364618252,16742575764213735882,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5844 /prefetch:1
  2⤵
  PID:3796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8293621621364618252,16742575764213735882,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6832 /prefetch:1
  2⤵
  PID:2504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8293621621364618252,16742575764213735882,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6312 /prefetch:1
  2⤵
  PID:3756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8293621621364618252,16742575764213735882,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6756 /prefetch:1
  2⤵
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,8293621621364618252,16742575764213735882,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6964 /prefetch:1
  2⤵
  PID:1648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2152,8293621621364618252,16742575764213735882,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6980 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3504

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3612

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4404

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1212

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\dnSpy-net-win64\" -spe -an -ai#7zMap22340:92:7zEvent6347
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5000

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\31jan_aciddd\" -spe -an -ai#7zMap10541:86:7zEvent12457
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1044

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\31jan_aciddd\acid_nopump31\" -spe -an -ai#7zMap17880:114:7zEvent2112
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1764

C:\Users\Admin\Downloads\dnSpy-net-win64\dnSpy.Console.exe
"C:\Users\Admin\Downloads\dnSpy-net-win64\dnSpy.Console.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4136

C:\Users\Admin\Downloads\dnSpy-net-win64\dnSpy.exe
"C:\Users\Admin\Downloads\dnSpy-net-win64\dnSpy.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4444
- C:\Users\Admin\Downloads\31jan_aciddd\acid_nopump31\bin2local\[ex]acid1.exe
  "C:\Users\Admin\Downloads\31jan_aciddd\acid_nopump31\bin2local\[ex]acid1.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in Windows directory
  PID:2356
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c copy Radio Radio.cmd & Radio.cmd
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1344
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4916
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /I "opssvc wrsa"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4556
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3172
  - - C:\Windows\SysWOW64\findstr.exe
      findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
      4⤵
      System Location Discovery: System Language Discovery
      PID:848
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c md 750915
      4⤵
      System Location Discovery: System Language Discovery
      PID:4136
  - - C:\Windows\SysWOW64\extrac32.exe
      extrac32 /Y /E Image
      4⤵
      System Location Discovery: System Language Discovery
      PID:1092
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c copy /b 750915\Louise.com + Cohen + Rca + Claimed + Seattle + Espn + Tanzania + Astrology + Fitted + Invest 750915\Louise.com
      4⤵
      System Location Discovery: System Language Discovery
      PID:2244
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c copy /b ..\Committed + ..\Joke + ..\Proudly + ..\Ur + ..\Rescue + ..\Unavailable + ..\Knight + ..\Transparent + ..\Bye F
      4⤵
      System Location Discovery: System Language Discovery
      PID:4920
  - - C:\Users\Admin\AppData\Local\Temp\750915\Louise.com
      Louise.com F
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SendNotifyMessage
      PID:5052
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5052 -s 936
        5⤵
        Program crash
        
        PID:2156
  - - C:\Windows\SysWOW64\choice.exe
      choice /d y /t 5
      4⤵
      PID:4820

C:\Users\Admin\Downloads\31jan_aciddd\acid_nopump31\bin2local\[ex]acid1.exe
"C:\Users\Admin\Downloads\31jan_aciddd\acid_nopump31\bin2local\[ex]acid1.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3360
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy Radio Radio.cmd & Radio.cmd
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2852
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3352
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "opssvc wrsa"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3644
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1300
- - C:\Windows\SysWOW64\findstr.exe
    findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3084
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c md 750915
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2168
- - C:\Windows\SysWOW64\extrac32.exe
    extrac32 /Y /E Image
    3⤵
    PID:3480
- - C:\Windows\SysWOW64\findstr.exe
    findstr /V "Allan" Bangladesh
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2028
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b 750915\Louise.com + Cohen + Rca + Claimed + Seattle + Espn + Tanzania + Astrology + Fitted + Invest 750915\Louise.com
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3468
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b ..\Committed + ..\Joke + ..\Proudly + ..\Ur + ..\Rescue + ..\Unavailable + ..\Knight + ..\Transparent + ..\Bye F
    3⤵
    PID:428
- - C:\Users\Admin\AppData\Local\Temp\750915\Louise.com
    Louise.com F
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SendNotifyMessage
    PID:2944
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2944 -s 924
      4⤵
      Program crash
      PID:2984
- - C:\Windows\SysWOW64\choice.exe
    choice /d y /t 5
    3⤵
    PID:412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 2944 -ip 2944
1⤵
PID:2884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 5052 -ip 5052
1⤵
PID:2736

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\dnSpy-net-win32\" -spe -an -ai#7zMap25962:92:7zEvent18376
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2104

C:\Windows\System32\msiexec.exe
"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\ILSpy_Installer_9.0.0.7889-x64.msi"
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:1764

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4348
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3460

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4648

C:\Users\Admin\Downloads\dnSpy-net-win32\dnSpy.exe
"C:\Users\Admin\Downloads\dnSpy-net-win32\dnSpy.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3524
- C:\Users\Admin\Downloads\31jan_aciddd\acid_nopump31\bin2local\[ex]acid1.exe
  "C:\Users\Admin\Downloads\31jan_aciddd\acid_nopump31\bin2local\[ex]acid1.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:3228
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c copy Radio Radio.cmd & Radio.cmd
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2668
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      System Location Discovery: System Language Discovery
      PID:3372
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /I "opssvc wrsa"
      4⤵
      PID:3656
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:3672
  - - C:\Windows\SysWOW64\findstr.exe
      findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
      4⤵
      PID:632
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c md 750915
      4⤵
      System Location Discovery: System Language Discovery
      PID:1460
  - - C:\Windows\SysWOW64\extrac32.exe
      extrac32 /Y /E Image
      4⤵
      System Location Discovery: System Language Discovery
      PID:1392
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /V "Allan" Bangladesh
      4⤵
      System Location Discovery: System Language Discovery
      PID:3372
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c copy /b 750915\Louise.com + Cohen + Rca + Claimed + Seattle + Espn + Tanzania + Astrology + Fitted + Invest 750915\Louise.com
      4⤵
      System Location Discovery: System Language Discovery
      PID:1132
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c copy /b ..\Committed + ..\Joke + ..\Proudly + ..\Ur + ..\Rescue + ..\Unavailable + ..\Knight + ..\Transparent + ..\Bye F
      4⤵
      System Location Discovery: System Language Discovery
      PID:536
  - - C:\Users\Admin\AppData\Local\Temp\750915\Louise.com
      Louise.com F
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SendNotifyMessage
      PID:4304
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4304 -s 936
        5⤵
        Program crash
        
        PID:4956
  - - C:\Windows\SysWOW64\choice.exe
      choice /d y /t 5
      4⤵
      System Location Discovery: System Language Discovery
      PID:3204
- C:\Users\Admin\Downloads\31jan_aciddd\acid_nopump31\bin2local\[ex]acid1.exe
  "C:\Users\Admin\Downloads\31jan_aciddd\acid_nopump31\bin2local\[ex]acid1.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:3968
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c copy Radio Radio.cmd & Radio.cmd
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2248
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      System Location Discovery: System Language Discovery
      PID:1484
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /I "opssvc wrsa"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4756
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      System Location Discovery: System Language Discovery
      PID:3012
  - - C:\Windows\SysWOW64\findstr.exe
      findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3384
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c md 750915
      4⤵
      System Location Discovery: System Language Discovery
      PID:4584
  - - C:\Windows\SysWOW64\extrac32.exe
      extrac32 /Y /E Image
      4⤵
      System Location Discovery: System Language Discovery
      PID:2776
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /V "Allan" Bangladesh
      4⤵
      System Location Discovery: System Language Discovery
      PID:5100
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c copy /b 750915\Louise.com + Cohen + Rca + Claimed + Seattle + Espn + Tanzania + Astrology + Fitted + Invest 750915\Louise.com
      4⤵
      PID:4024
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c copy /b ..\Committed + ..\Joke + ..\Proudly + ..\Ur + ..\Rescue + ..\Unavailable + ..\Knight + ..\Transparent + ..\Bye F
      4⤵
      System Location Discovery: System Language Discovery
      PID:2316
  - - C:\Users\Admin\AppData\Local\Temp\750915\Louise.com
      Louise.com F
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SendNotifyMessage
      PID:3932
  - - C:\Windows\SysWOW64\choice.exe
      choice /d y /t 5
      4⤵
      PID:3132
- C:\Users\Admin\Downloads\31jan_aciddd\acid_nopump31\bin2local\[ex]acid1.exe
  "C:\Users\Admin\Downloads\31jan_aciddd\acid_nopump31\bin2local\[ex]acid1.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in Windows directory
  PID:436
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c copy Radio Radio.cmd & Radio.cmd
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2672
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      System Location Discovery: System Language Discovery
      PID:2920
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /I "opssvc wrsa"
      4⤵
      System Location Discovery: System Language Discovery
      PID:224
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      System Location Discovery: System Language Discovery
      PID:3784
  - - C:\Windows\SysWOW64\findstr.exe
      findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2628
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c md 750915
      4⤵
      System Location Discovery: System Language Discovery
      PID:1476
  - - C:\Windows\SysWOW64\extrac32.exe
      extrac32 /Y /E Image
      4⤵
      System Location Discovery: System Language Discovery
      PID:4940
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c copy /b 750915\Louise.com + Cohen + Rca + Claimed + Seattle + Espn + Tanzania + Astrology + Fitted + Invest 750915\Louise.com
      4⤵
      System Location Discovery: System Language Discovery
      PID:1572
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c copy /b ..\Committed + ..\Joke + ..\Proudly + ..\Ur + ..\Rescue + ..\Unavailable + ..\Knight + ..\Transparent + ..\Bye F
      4⤵
      PID:3460
  - - C:\Users\Admin\AppData\Local\Temp\750915\Louise.com
      Louise.com F
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SendNotifyMessage
      PID:4064
  - - C:\Windows\SysWOW64\choice.exe
      choice /d y /t 5
      4⤵
      System Location Discovery: System Language Discovery
      PID:4024
- C:\Users\Admin\Downloads\31jan_aciddd\acid_nopump31\bin2local\[ex]acid1.exe
  "C:\Users\Admin\Downloads\31jan_aciddd\acid_nopump31\bin2local\[ex]acid1.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:4904
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c copy Radio Radio.cmd & Radio.cmd
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4760
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      System Location Discovery: System Language Discovery
      PID:3060
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /I "opssvc wrsa"
      4⤵
      PID:4940
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      System Location Discovery: System Language Discovery
      PID:4256
  - - C:\Windows\SysWOW64\findstr.exe
      findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
      4⤵
      PID:812
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c md 750915
      4⤵
      System Location Discovery: System Language Discovery
      PID:2652
  - - C:\Windows\SysWOW64\extrac32.exe
      extrac32 /Y /E Image
      4⤵
      System Location Discovery: System Language Discovery
      PID:2508
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c copy /b 750915\Louise.com + Cohen + Rca + Claimed + Seattle + Espn + Tanzania + Astrology + Fitted + Invest 750915\Louise.com
      4⤵
      System Location Discovery: System Language Discovery
      PID:2472
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c copy /b ..\Committed + ..\Joke + ..\Proudly + ..\Ur + ..\Rescue + ..\Unavailable + ..\Knight + ..\Transparent + ..\Bye F
      4⤵
      System Location Discovery: System Language Discovery
      PID:4304
  - - C:\Users\Admin\AppData\Local\Temp\750915\Louise.com
      Louise.com F
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SendNotifyMessage
      PID:1636
  - - C:\Windows\SysWOW64\choice.exe
      choice /d y /t 5
      4⤵
      System Location Discovery: System Language Discovery
      PID:2024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4304 -ip 4304
1⤵
PID:3012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e5f9a75.rbs

Filesize
17KB

MD5
07ab21c6c787a322c6bfc357bd1e1d9b

SHA1
20a97852eb5fe0c069c8ea30f726a98126ae2513

SHA256
0e8754b60256f48dbb2f7cf2ec4c7ba2363ee12b510a46258a0089d30e983120

SHA512
e49d0994d967a7e2045c35662e5d2d7745b35535e6b29d3223e98e9ca9ad0341f302b2a8220ff38c7ccefa3305ccc12ae5754a5a91b92d25ad745379581352f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6a53cceb7a396402c1eccd08dbe38a73

SHA1
96e06029b79791df1b1a0a7cef7508a5c44d13c4

SHA256
31c8ba2ce8a088515e4feff78968e8916c759331b7428421a990cc349a208b51

SHA512
bda381d092d0272a19350a66533ec0fac2efccfd26fc87695a8270eb3d4abec01483b31dfae75ba3f128623454d471c9e948c44df478edbdb6b5a15377637036

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a451e41e51facc395053e7b74c3490d0

SHA1
c866ac24af529f0265e99bd88529da46c9ff6dcc

SHA256
cc33bfdf9c856a2e9e9aa8eeddf9723a0396fad82b0dcae7a408bb4c84fdb584

SHA512
553489450d55d7adb9c859e521d0e46961490e54c533c826adc8c546ca0b51ecda82c159801bd060a291e724355c6d4fd2ee603ff65d4a15603f34f1472664fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

Filesize
19KB

MD5
8d29c092f3b694c3df643769af9b4266

SHA1
d130b3b41e6ad86562691a758c370cf8cf51cadb

SHA256
16ac3ca7f2c67facc78e0d6b55057693694df8be3b138eae1af9e3ad931530d1

SHA512
e2cc2a452ffc45d464c7c44380670af0c464cb828d42c38357f7977c0f19b408a2c9c19bbaa1e893af3d26d8b1957d2b8f80793207e3916a7b288e761dc32a0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

Filesize
48KB

MD5
df1d27ed34798e62c1b48fb4d5aa4904

SHA1
2e1052b9d649a404cbf8152c47b85c6bc5edc0c9

SHA256
c344508bd16c376f827cf568ef936ad2517174d72bf7154f8b781a621250cc86

SHA512
411311be9bfdf7a890adc15fe89e6f363bc083a186bb9bcb02be13afb60df7ebb545d484c597b5eecdbfb2f86cd246c21678209aa61be3631f983c60e5d5ca94

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

Filesize
62KB

MD5
c813a1b87f1651d642cdcad5fca7a7d8

SHA1
0e6628997674a7dfbeb321b59a6e829d0c2f4478

SHA256
df670e09f278fea1d0684afdcd0392a83d7041585ba5996f7b527974d7d98ec3

SHA512
af0d024ba1faafbd6f950c67977ed126827180a47cea9758ee51a95d13436f753eb5a7aa12a9090048a70328f6e779634c612aebde89b06740ffd770751e1c5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011

Filesize
70KB

MD5
3b06aa689e8bf1aed00d923a55cfdd49

SHA1
ca186701396ba24d747438e6de95397ed5014361

SHA256
cd1569510154d7fa83732ccf69e41e833421f4e5ec7f70a5353ad07940ec445c

SHA512
0422b94ec68439a172281605264dede7b987804b3acfdeeb86ca7b12249e0bd90e8e625f9549a9635165034b089d59861260bedf7676f9fa68c5b332123035ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012

Filesize
65KB

MD5
56d57bc655526551f217536f19195495

SHA1
28b430886d1220855a805d78dc5d6414aeee6995

SHA256
f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4

SHA512
7814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000013

Filesize
19KB

MD5
2e86a72f4e82614cd4842950d2e0a716

SHA1
d7b4ee0c9af735d098bff474632fc2c0113e0b9c

SHA256
c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f

SHA512
7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000014

Filesize
25KB

MD5
e580283a2015072bac6b880355fe117e

SHA1
0c0f3ca89e1a9da80cd5f536130ce5da3ad64bfe

SHA256
be8b1b612f207b673b1b031a7c67f8e2421d57a305bebf11d94f1c6e47d569ee

SHA512
65903ba8657d145cc3bbe37f5688b803ee03dd8ff8da23b587f64acaa793eaea52fcb6e8c0ec5032e0e3a2faacc917406ada179706182ce757d1c02979986dd6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000018

Filesize
21KB

MD5
fc503d061c58f17688376d8d6ededeea

SHA1
e57c19bef9f72f59c443a6c9172a64f2ecbe27f8

SHA256
c865260676e5b45676e59c3c4283c74d41c2f0edfcfc9778a18e8af3ab7e4fe4

SHA512
31d3a7c64b8b681be0bd5e5b6ae45dce82e5709ec6f2c10219944c78b74761b22bbb522ed1e3d496f27745bbcfdaee3f15dde11871afca5cc761de1c2d808ffe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
3002a7f109da420c5cacc6aeeaab0c63

SHA1
e9aea7b5f7cd8e391b2ac080769ea34c8df40f71

SHA256
4b70557fc20b2552d38ac5ccaa1d38450c67be2e3698c9d3044da3c5b9171e68

SHA512
60c501e0d7e4c23036d67b39dfdc0d18882346b5abf353ce1afe17b0a65258a8453b15e46187a63106a43c55e1217a19193e982aabc58119ff022affd60cf083

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
c63459edcceedea5acf40d09a6a52463

SHA1
a8d19a282f8cf0a23cd8e031d1777137062d5864

SHA256
6041addf39c8a604c385174043f0b96067c2d9231632aba1b748fd2759e258aa

SHA512
d814b64ada33623c96bfe17c62f7cbc08863474b99c69baf5aa90d2030e5ceff353c086f03673df6e4a48e4881289f67bb207008137d5120f3b04a87f1236b07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
7de3eb46106b458531bfe617a2cadadf

SHA1
4c7655ce723e78401157c5818e8cc865224a3819

SHA256
7b0b4a8340136b342a87706bd673993432f806e50399d3cd4dd0e227869ed7a4

SHA512
6491b02c667db881cc49c2d8ba86712a51834741152e91eebaeaedec45ce69ef961f2bb2ad7f4a2ab4919a56d347f0e83b77d48cde97da5f651b9a46a096194d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
23e65186cdef81ea6d65a92f53d3c0bd

SHA1
063bf0ddfc93343814676c92241762beccad043a

SHA256
8a55081d7b1b59f32c88b4833f5bebf75fb12d2484b13bae65525fdfc04bddab

SHA512
04a25dd63c98596f7ccd5efd6100b6950a925e293799dccd6bdb8038cfc26c48216a31416e12d1e301952018b1b7e399b3cba1cce27bc1dcb570cd454d3acd96

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
31911b073905f84ef97cd531ae2890d5

SHA1
13cdf9f16b260393a614049f59dd5c84ee1338cc

SHA256
554674cbc74bfb5c68796332abf47de4cf4ef9ac1e66b3a37e9098452d025b36

SHA512
ab5b624befc2d5180ea842d1c38157406996d67bf62e4ea6de92a7d598ee75a0157bf0348fab106510e4aa7c51d8d9424ee9f1ebd9d2e58edd60b429fe06eeb1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
df08ed1431cbbd3c467701279f29a25b

SHA1
d6bf3d4cccdd6f9c2faba3f14c7d445646043aa1

SHA256
192fdc1ab0365058ffa68d792081fb84c251f78573be4a9876e2ab8e672920c5

SHA512
85e896c71083f2ac3d775f7108ed90b5fc3c649b396cd046cd5683e09c39fd0857b949b7bafee469512b1a13728e89918504c07a7980777462a20d8a1fed9770

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
9876b683c0cedb5db041af932f957f40

SHA1
802760913174767fcb73d55a62da3ad978b00870

SHA256
ab6ce4528684143432896e4f772fa0732199148f1f57c1839bd37ac9a784df17

SHA512
cf03613ad53019bf22cce1438cc979f542cc35a3241477f7bb63bd254880288caec3b10b068759d39a29d9bc423b78054b4ca253466ef30878319ee89d053214

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
f997cd391ab2d9458e4932479c4dfe9e

SHA1
fefc6f63c2aed00ff34f45d9e82207a6eea58394

SHA256
2658f3a537f2c6936812120ad99dcbc459f8d45a01bfb38bbba63d9c9a15b651

SHA512
91cfbdca6ded90e11e9fc5cc1f7fffadde257a0bc7b31e129ec753f3167d90196e12aea6133544fe574cf453495a44b3d0769bb171bea2d5ee55e165c3d4334d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
982311de8e539bd9b3ee1b9116e94b21

SHA1
1e5fb68ab5cda1dda5ef88ebafa57e76770c9fb4

SHA256
0d3c8f81a5897fa1c07894a6344ce0c4bdaf01be1ec5d9620bbc0935c4b99803

SHA512
21f361b8da996e0fc3fa82f8b395d0426667fb8ba62f8c222aad15993478932c6611e6c776e7020dd77ffd85dbde0771cc6b3972fabd37f7c21092e6ca66a789

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
a06f2374f12f34b851e80e010891fb1f

SHA1
48dbf8369e053e5d6b20f659763e62835c922f5f

SHA256
38a6605eaff1345683626864ea986fb8f6d614105093f35867e96ae38aa76171

SHA512
88c86ea56ff34c2196b0b83c4950364adc1769c2d137716b881de93f0b04d3f796cacdcec2c0c91d71a09de150a9031241a11a29c867be0ccbb83556e6b4d920

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
59392773837b861f8a7b3141f98d794a

SHA1
0fbd9440d80eff56d2993906245f37fd0ac44d6c

SHA256
c2b031ac271fcd685c0cff3468f2ca5f0aeecf35b612bc890841ff69c6279ca0

SHA512
3a917bdc8922e29f5039438a93ca5a7740230acddabb8a40984248fc779534701b800bdfee3e829df37bb15e0e1608b6f5ef3e3ba3aab487e02bc67adb0a906f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
8a046fedfb9057d2d381772843d925e2

SHA1
1fc35b71accbd2585e643124093841482bc86ca1

SHA256
4e6f02e397717c6252bf52e11eeb3f80b2bcc652a6c640964a799c9cadd44f13

SHA512
643f1f338c433b5ff8de66d371a4663b798d967e7a93e37a841e498271db9db326f7097cde0406e3dd0e0c035ac4cd6fedf5c280334685503a21d94a545c165f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
ebd0e1ba16d3e93b35f66bc1bff88e33

SHA1
e47c4aeea75c924dedd91c378c00506d2f595645

SHA256
35e88c710a4a781193a5b472e32743114596508cadfa997deff4005d12d031e0

SHA512
218d91af32a6fa26edf45ff115c34089db850f81497a884153e112704a4b143fc5cf58d7cc8e5f5ba33ed566217bf2647e3e5642d6433e904b520796285bde99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
4d9c4fe26a7250d54437b0337f1b8cdf

SHA1
3da6b8e2ad04956f670d9d7706ca273f6ebc6d90

SHA256
1a07595e1e792f712c094b85036f10260e93a25d2098b6d3198711673bf417da

SHA512
f8c86a5eeebc63fc2ac3c89d2ea03226592c7bfc3575f6df1a5862fe1324df08eba06f37e331a0f8c54d3d613f311f785b170976235fe46936ddd23f629b5b7a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
706B

MD5
dfc9f521c206745f0c165a2bd9d8f7cd

SHA1
dba7a08c98a2cbf1798f3daf0bd6804bc0d17232

SHA256
9b28a9e6ed862c5110f69c3c7b619fef627376bcdd7f0315823e65e14adb38cb

SHA512
ff5f9d9dc4dce64c4b42068f7aed9b4058e0dfc10e12f0d299bf4c7d8cf9826f530d085db9e0cc153596e88fa69cab999e53ab34e60e7e0735a868aa2c68c3dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
0729e34838ed9daf27c52ae59e3f7bfb

SHA1
3c56ad82355dd9ff2eb4a3519ef69b610299c649

SHA256
a1d6b98a14a86b03e935236b00a8976e2651345e4b81f3f7371abc7269a294f9

SHA512
66486e550a8ef7f2a255bcbbef36ab12c26d1bc421ea505181fab2ce296681e05d6ceff58894efe5ffe145cc6472f9f8933fe658265f95115e07cb9cf2eb418d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
c26c3122d6ffe81d91614e21d1b99728

SHA1
23f8a1dfdb22e376789ee8d05cd82a7f6ad340f6

SHA256
21124127c708a98b91608fc1a1be115818b93888ff7393b576d8e8de847892fd

SHA512
ba4a2bab26506e8659844c6b51a2cb933932ac7b9f57ca3eb9ecc2e40c18c9335741d046efbc0bd52bdc9826aa1fa66a1285d0b384b956154121f79b7d23ab7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
117f3326b0f0d02ee051f5cc29719639

SHA1
caf53b3e30c50542e79768ec2efcf2aef58702dc

SHA256
6143fbbb5788b4a1515b5ad7788049c9a5ef522114079f421b3ceb6fbf2121b0

SHA512
f9d56a23c01c15b6e4a6dbcf855f788beb61bfc50cffeb0449bcc7efd6e76837f057f02d0cd8a13658754f1cc12c77ed1e4811fa717fa479c0849b408ed97587

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
a30b9222adeb9fbd07757207ca6937a8

SHA1
5ffa7eb55de7deb929cd88271d33e3cecec793de

SHA256
081ab18641efe80666aacab0ae75e65341715d5208bea0ba6614168193eec78c

SHA512
0c69d3ccb4cc998d29b7f7f500b883fe9424773ccd95f3d33f3c12dda62faaf53a1c81436416189c70f3d21cf3de2c1b65c1b24ab2fced9c7376cfe44da11293

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
7f734281bba47d3536f7ec9e12300f3d

SHA1
5fdc3d94f06199d91d52b563038d5d81ebf08360

SHA256
6135487be39b8542239464fb77da7c2fa13205562d750af18fbb66d9f3817ab7

SHA512
ef75fadd0842163fd8d2cbce2d838421a94905d38e0e4e74a07c398e87c7d6606f424f852ec31aac18d5595cdea11486f63977a62617fdc233154e9eedd0b398

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
1d0847102fd2c04ea63eee56173b9f07

SHA1
f52ebab0cf415d0c839c1364dddbd30e8b7c7ff7

SHA256
f386e8e14f2419d2213ae19e3789509e47c0b91688c0eea678fecb596c6862fa

SHA512
7a70ee74769b054e6515fe2f7eb04471a753762ea79497b9b8933ea072dac327da6d1b9aea3cfd0ccd4761a9e9a0ae08b0ae05f1adffee841ca5d6336f96ed04

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
fc969cde932976b045c31dcf86c26f49

SHA1
7bf66999ace34c5ef8022c222ec22a90d38e4d8e

SHA256
c4166eb3d5a18297190e48ca18b11af2e11ef9343e075563279e0898123e1945

SHA512
4ab351d1f75b58e95a9b53dd6127bea6fb687c0ecc7cac530d3949fb91176ba317a3fb17510a38602ae86e5f5dae1b40a00ca3888bdf35ccd54b59bc69c7c2b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
07c64e53ca5ec8a88fc17731726a0089

SHA1
47a3052763e94082ab559e3b6bad70720d5f7bbe

SHA256
0f6e632425e089768f29dc51cc344daf67217f50ed3e2638308d6a0384292f32

SHA512
0d62125633d4813a9a62e70c980bf8317843686e142fef9ded8e74a923621b6a8dc3ea494b19bf2680941d096046f024c6d2a6c1abc06206e28d4afa7841f63b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
3f7221880d9a48f7d03f1cd8fa31c816

SHA1
8d1c4f0d314da79c0e73e356883635748596d3f1

SHA256
eace2e7c9ce72d3efaaf954d0d02c48d4a1dfb18f78e489ef9702d9e4c5149e4

SHA512
0d110d590b7ea44f425efba346d0d02db8488d853da9ccb89be310f2b3b3465f4ee0f49c57b1cf74771b04e0885eb9a2e46e904b948f818559915711d6069f12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
31617ede0b73faef3826aa90b1edf40d

SHA1
9104ca279a123df0f14ed3420d90a0d8894e4a5d

SHA256
95364ad57abccae81cb90e48e7756a175302ac8d92a0c16b1c24c4c785104e82

SHA512
c8648bde395d0622937bd96e7ac85ab4446d0de05d75325430542dead112ac442621af7c8165fca1b515c78d3d5af778027cc4700fa986c1739472d48b1ed35a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe596121.TMP

Filesize
706B

MD5
591ddff723b140727fed8b8f0c3b8f56

SHA1
450c271b4ea8103e83271d726261c3815ae90e6e

SHA256
fffa6cbe476feeb469e31f5be4df4495f5b5165e9e22a8f14526034a69303c91

SHA512
a5f5254d92419abba6d7c184de41472680fe534ac577cc6a23aab297adc8527faffac4c3eee188205e53a1a2ca9c00fd3e28f74216d65b364dbef68edd1ca359

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ea131cdf-021e-49fb-b112-693840af7fe3.tmp

Filesize
10KB

MD5
6c157cd0b6fd0c204aae91dcbdac00f6

SHA1
fb306664647d72514b8e63efb31536a001f4dbea

SHA256
e508689aee8507ef9942d5457973c0894020b75f7a95a687a485087914944448

SHA512
c6e8fdbf5ad1c09adab7da74c2f09484c4f1d2f4ec1b46570ce84b47a3a6d51eb737000d93d52463dd9f091ec6d67e13c5f4815de7d14b65cf9ee2b4f88a4192

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
476fdd020400c8000fd17ae75a68b7fa

SHA1
2ac7d9ee77d200412b12c3296f894673f15cd157

SHA256
4c1df8cd294def6caa85458ccab0a9dceba07ba44651c020579b9fb729f010d0

SHA512
adbc7765e37c8fa99d0226f5e35a0df1d3ebf5c31f163bb961bda63d3cc0eb6dd027608c683bf33305b0c3e677734d801a50355c06acb9b3d82f45e68cc681a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
b1ca0f803d5369eb0374606c169df2a1

SHA1
9e2d49139b7f5b65d43184672faaf3dfcbd6a7ac

SHA256
1fcfefb06760b22cded0be51fc38581c8389ea63a1401c94ce7033587d862c3e

SHA512
1e5b838e8d1a0da88b391e74a57ad033716a5669bb7aac742a3325d8df065de477ef5c763e348c7ddb855b46f9ec7abc70a1b0da15ed66c6741f7c63b6a6000d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
cf649adf830bf3ca221344da66855979

SHA1
973b8e4c179a62910874562e34a75eca0de3680b

SHA256
3e8a69333bac554143ef6ba0b2fb2cb9eb0cbba9db42b5fb1bcc55fa035b82ac

SHA512
f8b656d1d040289c96eeadf4a3250a20e0f958aa0602b4daa062d90741a23488e323fea5cea91d0baff020abb9545589b4abcfc9e40be049e4522f0c44042f7a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
35dacd818425a53723390e677ef7db6c

SHA1
e8cc62887c1a23ca1c8f4ecadfae2b90d7a8a30d

SHA256
fdba7599b14dc97c6b0aed33cf6b0fde05b73d069c983d2c6bc9b030537c8268

SHA512
53e23fd0856e4a31892d42b7df189a22701be1a83508612fc345db8c17ce0537f7156de7c7faf0c61aebde544cb270480b47dd3b31897be885c872dfb48b59e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
2d1defd80033e063a996db7776c6f50c

SHA1
2fd424f7cbf5469592500be32eb02d1f3a209ab2

SHA256
0a1db1cf86948ea21ed1d7357a06a320154087130656ea4c2a573575bf2683a2

SHA512
d71276111e985d995cc01863563047ba96fd42006caf185e83ba9766958def98ced4a97c799c61f4d480b792f11e17c5de2434e97dc76e7cb7a91c9a5856c3a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
bb2e8bf140c07104aa3115c9e191dc4e

SHA1
a9d4081227d2b26b3d0911c921bc780caca81c77

SHA256
d54d4cb67cc6d868e8fed15985689af446ade99817ad58a31a9647ddac53d4ef

SHA512
9e59177c6ed4ab9565ff0c5f2310f31f73a3215b793475772745f45c3ee383b9947da91b368da08c1dbff1649c108618bef6da6f77d2ea3552a2db1aa80e74fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
5b939e9b8f322b1db21780479b03c4fb

SHA1
4a3c40a6c8fd18a6aa87fba975610cab572f3b23

SHA256
47e1df9cd7b01b09f6a79d1a284c7267d0800edb10e39111ce8946dacaf62786

SHA512
fe7566312d546d038a460848adf16929ffbdb4f4133a59ca932c8ad1241c67f4d2bc4a694d2092f5db75255bcb480aef9d30b464303e659761614f95c10be386

Download Submit
C:\Users\Admin\AppData\Local\Temp\750915\Louise.com

Filesize
925KB

MD5
62d09f076e6e0240548c2f837536a46a

SHA1
26bdbc63af8abae9a8fb6ec0913a307ef6614cf2

SHA256
1300262a9d6bb6fcbefc0d299cce194435790e70b9c7b4a651e202e90a32fd49

SHA512
32de0d8bb57f3d3eb01d16950b07176866c7fb2e737d9811f61f7be6606a6a38a5fc5d4d2ae54a190636409b2a7943abca292d6cefaa89df1fc474a1312c695f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Astrology

Filesize
147KB

MD5
e0e59d896743ed99efe27ce8ef577871

SHA1
3501259a297dc208ee83eb686e73f19355c2fda9

SHA256
938cd8a6ef53760b0cf10e38cf433cde74f803c62e17be4745819f0a0dbe1c54

SHA512
daf4451e9b6d3dae625113138366b1a76a542df7417ecd0644dc59e2284116f144907391e4d65b010e5ec224ff4d7046eba7d65411328e5e32584a960a21bc16

Download Submit
C:\Users\Admin\AppData\Local\Temp\Bangladesh

Filesize
964B

MD5
af5a9db699fb4e1c2c5125ca06c46df3

SHA1
800ca8a768ac484882b5a82ff53357adc2e155a8

SHA256
4053bb989625ddc9c7c00a2005159c5b08288a3b2d1ff8958c91a6f7b1b4ceb8

SHA512
1141e8d9f0bf8932a5493a01e212d829de07cf6a5dc2cf5ebd7226406c1f3c03150c9335fbf70c9fba2c8a9cea92da11fcf8c4301a4741f467455979f08eacb7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Bye

Filesize
91KB

MD5
1be298591623ad6c0f50014a8903712f

SHA1
391d84b0a12cde6a2b87fd91e5474116288290ee

SHA256
4ba4d7636b0cad20db4dde3781d1645cfeba927f25f6cf18b05c19634d10b3c5

SHA512
3f6c5b626c19682ef7f3e3832ffeb8e6b37e1aecfbf3883ac27ece9ac3f7b212d4f023600b9d7165ed3f1329ba72d41d248db379d51927719b54f648d06e581c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Claimed

Filesize
129KB

MD5
4b6d18552484cdd8a6deb3077cf32fdd

SHA1
c893203b03fbaaab7aa55269dc3ecf02becd8a16

SHA256
c8a8d3b83353f99d0d0c64c9e2a00f6a69fe93b7424b2be1562426127c0787d6

SHA512
79d79122f9d223cdd1ac6b5c4e20251558ca6274dfa4251332d958e2383809bf257558deb7d660c50b26d9950a638dd23d4b3fbb53571d5cb2f1c4d2c6403fed

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cohen

Filesize
90KB

MD5
605ff257d35d3c9a097b0e97a51627ec

SHA1
c4746bed66d3a8ab6a3c856ca3d2e4ffdb3f9033

SHA256
7a58897cf6648120946afbf9dcb80393179bb6196afea4e7fb1a0eb636e066a1

SHA512
bd499cf0f158dadf2135bacb09eb5a8c338d0d37aab71709ce8fca86050f1c4287f0413c9825c4681e143b3641ef103c93dc05d1281cacec1c864048c4873bd0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Committed

Filesize
54KB

MD5
d821e2b63580f332cb6d40df591b9a88

SHA1
58e2aee88db82f7ca51de0f694e8ca554c33a8fd

SHA256
3d8d15cf8f108b86a0e3e5be964b7a6c349f6d3d85ba75c411fbcda264260ff6

SHA512
b5688915b250bd6e66c676d7accd18d73848ba9b13c8cfbae0c7a6314f58d4150bf9f6c9623a3f4923c3194228a11c2e76fafbf1fc835426ba74ab9f7ffb6763

Download Submit
C:\Users\Admin\AppData\Local\Temp\Espn

Filesize
60KB

MD5
7e2c12b240f8bfecd37ead542879efa1

SHA1
5a6b37b3653430e7d4a9d11e8b9a5b9d943c254b

SHA256
490a5ca5c9fdeae90cbc4b9fdb24d876238423b73d705aeee3c65fb62d99b700

SHA512
fe913dce7bfff9fa79a3f56fd25a97c7a246acda42641c6d428ca5580161f429b427bce330e29ac42991948abaa2d24c0d2fa81d15bfa85939ba812ebd638ab9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Fitted

Filesize
108KB

MD5
41a1bb5d64a34dae1cc56a8a7d07f195

SHA1
b7d33997622f8e784c34097ef079c22aacbabc8e

SHA256
686bf8d3988f9f8f77aa8fbdc20ed453f81446de1267fb939a5343bb1190332c

SHA512
bd2c0834adbbb1dc7957da470be37c8adb833d568a04932afb8f29818ddf3513a1f61ede67fff85f9e098134a1cd32cc24caac5f333f8cf61e084f55dc3a26a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Image

Filesize
476KB

MD5
a3fabda4922043f202636f030d91415e

SHA1
f52eef855c6315ee32b8fb5cbfd736cb6e30722a

SHA256
31f176dcafe6f44db0abb607d973ec122252ee106d3a8464ebf009ca320b9aa2

SHA512
4c9060901fa5da5b5e0ae07ee6b64be01e82024c11c34fad4dede9d42d06ef589a09cb7326b7ba1795367b52c8fd36a342195b95d4077205898b3379fddcaa92

Download Submit
C:\Users\Admin\AppData\Local\Temp\Invest

Filesize
95KB

MD5
840cb10d8da8f9a5d2e6ce5589ddecf6

SHA1
0dc7875ba564d8fe91b13a34eba531920cac0575

SHA256
21347f46a097e78abf289b9d626b4b1b571fc16bcbf280937ee3e70ed08a4700

SHA512
3b8cb66538254ae248bc334406e1d8288cfd21785300803e5ddf7797dd4d59ccc2bb460a767fcde2125f2831cce89766cfec562aa0a2185321189ad5616d8826

Download Submit
C:\Users\Admin\AppData\Local\Temp\Joke

Filesize
50KB

MD5
b23484479d2135b6faf5a8d5014a5e52

SHA1
6adadf32e1467bc3fc2ea0be6e08c1a0130d47f8

SHA256
b005d3f9a19520e67c403459540f7ec8a5769a1524418e5489197ffce71d58dd

SHA512
d618607b1bfeded9985b8a0d178be75f0cece042aee10eb830edc1d9e7c1fc721bd0268cb4d11840d2f374f97e4eed2161f91ecf46811fc1ccabf1c652d066db

Download Submit
C:\Users\Admin\AppData\Local\Temp\Knight

Filesize
86KB

MD5
70ca3f70c2cc90f14e411ba404b6b7d8

SHA1
b1f002106af154839697124d34aa48a010daddd8

SHA256
742a79c9c0e28592fb844f6d136b00b84c450fbd9668450bc13b78f5e6a0817f

SHA512
bb4a8f58d3405531a64f4c1bdd88040329206d27f308adafd7071a7ee222f8ada619da9e260195e0ee3a3e5ce368f0274bdebe7c3c6580ebd2e8d74018245219

Download Submit
C:\Users\Admin\AppData\Local\Temp\Proudly

Filesize
54KB

MD5
a34ae33a22b4911fa7d843998e50611a

SHA1
1d1361171769c4f0c9542d86af294fb61cd26d4c

SHA256
4a0b98dca7e234c9bd35e719936ad8661c0ed5487bf7b8279a4087eac70059d1

SHA512
d22b2b331400091a61d6a87aac0d34816f3f0f8ed80643d9a9232551300169e7a0bac1054d719008a39d06729237bdc9a7ece7d2d59468418489f2508cf12dea

Download Submit
C:\Users\Admin\AppData\Local\Temp\Radio.cmd

Filesize
15KB

MD5
8c23cb4110dbd72072c4e0d8fafc8500

SHA1
f2f01a449593ef9f301cb176cfa215a4bcd6ac6b

SHA256
c37e9a72ac2565d50eaa0eff1340ca1668c063645f95fbbd7aef29c97a593b84

SHA512
6c7008b2ab188442027712ab4835afff79eb12282bcfbb1ea74834fa5118b0855726f5a0446ce2ba2a55bdbd02258611c28b0c2933290ef022f3e143c504f66f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Rca

Filesize
53KB

MD5
96f5abc8b52defb180e9063d9a9a125d

SHA1
dd9f5898c22d3a153aa490bdd8f7dbf54986135c

SHA256
145029900af465bb72e5240268fbca67c325843d81c3ca42cb6f9e75572f720d

SHA512
f930c230ebf2d5521a565f0c8e986e076598a550803d4cdaadf14307caeb894e1de16c26b64e8d0282a41ac1e6e48578d5b02faf662d04b29f0769d5097f293b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Rescue

Filesize
64KB

MD5
91a684cd9bc55e4d9dc0ef1eff72484e

SHA1
803952d4dac1aae17b284e8209f54d6478d6d094

SHA256
7f477975a1ee1b44ec1741cf677e65bb96cc7ad09dcf84a3e47a8fa5ec564512

SHA512
b12112a3cb30894cb75cd3368f8f72a42f5cbc414405526dbc06108f88690315e3dbadf16baa792f30baa18e19cc593f957617441e2550e53479c8f9f964f329

Download Submit
C:\Users\Admin\AppData\Local\Temp\Seattle

Filesize
99KB

MD5
1ac5eff9d2ef01220dd8d9d092074d7b

SHA1
00f4312b3c96cedc4f6e310dbe41fb61eccc785c

SHA256
6cb96756a45d4ef04838031c7e14e3dade9bbbd88575924ade9fc56e24ee9b4d

SHA512
29afbdd8bb5b1267d8fd57ba97b8929dcf0574c1a5959c4105639a30dc647fb2a9c6d05b29ed96aec398f84ffd3b1b365d880997046b497e9c12d10636ed5ed9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tanzania

Filesize
143KB

MD5
9e1d7827359c799133318765cf9dbace

SHA1
a789c11e8dfcf82c7811e3c3790343543325cd88

SHA256
54e5755c2268a0bc265425abed2e3ac700f6f816a316f0bf4eae4d2f83c92e9b

SHA512
aad52de6354ff54659eea8675d31df57d414e0ec2b629dcb216c8fa8db99b6d8cba7660a9565669d6e0d94aae65659303c41abbe34265a497409125e367ed8c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Transparent

Filesize
71KB

MD5
c6ee038292a86450536fb49a68261c0a

SHA1
6895b53cd7c504c018df7ce24a301663ab1508c8

SHA256
e2baaf1ddb47dc2f98276e1ee5028155907371b270a4c8baaec7be6b7a92350e

SHA512
2342d02e281861a00ef68e2b319470c7840e733287b253abf109e7144a2bc5dd3ef8f98023a8bd10516d22c53933e7b08a6f948f8d676b4af055c4267ac6be53

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unavailable

Filesize
93KB

MD5
f6ddccbdb7aaca275748eadf80b2fe66

SHA1
6356ce4f6335842828054ce36c8394bc63ebfed9

SHA256
fcf9b09e22833b1169b273a448214f810a74a167e688dcfde69d7f9e11880f9c

SHA512
d7696e0f20c35716695ff6831d355eb7092315a6d48dd333ba29378021adbfcfa5b91185c0722d0fa6c046e028f6de20860b37e20bb90d86b9e7b97f8b2291d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ur

Filesize
68KB

MD5
073dec9c18e04d43d37f4dde54056b2b

SHA1
77210dff5576bc81dc40d11d1fd255816c971525

SHA256
bfee0639fa4503a3fef6c894ab98ca194a26d79063468e36a47ac2f09ce615aa

SHA512
f04fd58cdd4779e5f435257273716d6c6ae82b839d13bf75e8a814647d72ffd57c64897b72aad93ff8aa7b84431446cb70a71c6483cc1f43d05109127384efaa

Download Submit
C:\Users\Admin\Downloads\31jan_aciddd.zip

Filesize
11.3MB

MD5
944b736d52d0b379c59f13f03901b80f

SHA1
fb6b11e6fc753c0a88210f2142712980f10c7fe5

SHA256
219e3b92a6e5c8a58c62eb4ca18fc3449edfa0e4c179b44f1630ee6fb211f335

SHA512
98b81cf4c451da32e6b8056bb31f44e9ce2fbbe5d96021706b6d6b1d2853f704641af08a6e6e7cc91008e9337ae653c0c5b9c88747be3890f2316e1f60d281bf

Download Submit
C:\Users\Admin\Downloads\31jan_aciddd\acid_nopump31.zip

Filesize
11.3MB

MD5
52d8607e8c337a7615c5f0d5a2033d83

SHA1
be6dadbf13662167467a7b399464632e5e063044

SHA256
fc8e9eea218b154610968e5ec783066eec2fc56efbd24a211d524b8b26e75ff2

SHA512
ae6ee8e490551670c16d80a66464acb16ae462bb343291b799684fdc8a8efd6548cd4861b6154eb3ca82b86c1388d9f8b24634dab6f48136afe6c765a9e9dc2a

Download Submit
C:\Users\Admin\Downloads\31jan_aciddd\acid_nopump31\bin2local\[ex]acid1.exe

Filesize
1.2MB

MD5
a408f39cef6236f43de3038325c1797b

SHA1
856066d03ad7faae5dd60d8e9f641fa4fe623b63

SHA256
978de0f64b32068bd7891c870ca55615a9937b3b29b49a5d64dc54382919aca8

SHA512
7ed362d9ddfc10593fc64da4f6392cd7b21155da53ea147c22b6bb913bfc321280228e02b3fc8dc5c7f0c54b878d62acec2d92a4b8a07c1c137ecac938cef6bc

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 376535.crdownload

Filesize
4.3MB

MD5
3d59e42b9ccac1a96e168921ae48350b

SHA1
ebc2b50e23dd0cd6f226ad6e299cd374e6c5a184

SHA256
fbc88f10e8631295526093825863d90709850939b146c080422ceef17f389dfd

SHA512
8e654167b352e68d7636b79c6259c0fc62cb29f72deb79b16caf717ef2924b357051d6b6ade6778cf9ae0ce10ce87bbf470c1125a76c0e34ea16e0b4bda737c1

Download Submit
C:\Users\Admin\Downloads\dnSpy-net-win64\bin\Microsoft.DiaSymReader.Native.amd64.dll

Filesize
1.4MB

MD5
7e31e92dd59449f41c900862a16f0879

SHA1
36ed049328fe585f2053a7e20be4b98a3c3a1f24

SHA256
95f301012ed09c09c9eb61a23a2803a7043e6a33f9c8957746379b610a52978d

SHA512
77fecd5611967f7234fce744e0e57525e8699ecb3eae99b6e7bb3e326ef4e10258ecdcc80ab5b9b402c4da32104b6a6566dc63bfb1b7c7192a75ebeb13e439c4

Download Submit
C:\Users\Admin\Downloads\dnSpy-net-win64\bin\System.Console.dll

Filesize
149KB

MD5
6f45e04af7913bc85bfc9664d8f9cbcc

SHA1
a0acab3bde38e00911b2e63550003f98c432fb63

SHA256
60c161a1ad5bc1121a51e67ec1f29ffa06c2e0c4551e508fb332699603c03a5d

SHA512
d227d2348b4f545686bf9f75eb72cb9a3aa9f261d5cf934bd905bb5927655f4f63185df51c5e04e86c0ec91ff5f6f60925ea84cd5f23c5e549522bdecdbbdab7

Download Submit
C:\Users\Admin\Downloads\dnSpy-net-win64\bin\System.Private.CoreLib.dll

Filesize
9.0MB

MD5
bd42384077787fb221c9f703fbb8bb88

SHA1
0228f9a53ff3abd70c711b86b489718307eeba05

SHA256
7a2279cd7d0507adcb206269bf0fe2e69f1059ebe5976f7413b76b769c75d531

SHA512
5e9c4a4182756d835bf231d5c8657eb98b82244740d9af034d59d0628d91ef0a25c11028f88c878513538bdb6cbc9ef4e4ec5b7564354ca346ea50fefd3c9fa2

Download Submit
C:\Users\Admin\Downloads\dnSpy-net-win64\bin\System.Runtime.InteropServices.dll

Filesize
47KB

MD5
48fb2d5f200c68a00ce0388770341478

SHA1
7279cd97c3f7f4753629e21cb8234e4082b1f890

SHA256
31286dd429d6588632adb78b514a0d9f8b8fc9ac2e88976d10f83d46cabdccb5

SHA512
e120bf83ca0bb6f91108d34839d88c23204e83b9805bac9bac3d08336132dbbd0c2b2012807d4ae1ebb1c5247d33cba4e2ba859ea45ed3f7517a0adbb1d3cdda

Download Submit
C:\Users\Admin\Downloads\dnSpy-net-win64\bin\System.Runtime.dll

Filesize
41KB

MD5
715f4dc52da61002d5bb4e1a64108e82

SHA1
a48ea9b3a88780ff489858bc02ca42ce969fa593

SHA256
7445aa86efeb0045d10ad97ec6a3b5bc72556e06501f471d754ae033df87d5d0

SHA512
b0dd8a363eaf975aa517fd7f109e7100da24f1d0f5fea52780c47dec7679609d0029c82cc79f5ee6d1bd296d3875f42ef9c9cd9033392a1269de4596ec27bd91

Download Submit
C:\Users\Admin\Downloads\dnSpy-net-win64\bin\System.Text.Encoding.Extensions.dll

Filesize
14KB

MD5
acb9d1c51f8c89ed44db353dbb308443

SHA1
44dcac1011a887471829d4089138b9126e708e13

SHA256
1a9ee9f297cdfdabbc0753f4c253ffc9c04e9b722ff1ad8c9c34bc37095649ac

SHA512
a247ab223452227a3f90383c779f13534a8284e4764a33f3484f8474eea1fe595731ebb37d48071ea6adf537ad2dcae4151b35b7f9f7b3acceae80a77ff5722b

Download Submit
C:\Users\Admin\Downloads\dnSpy-net-win64\bin\System.Threading.dll

Filesize
75KB

MD5
f792dbcb5d39526e0066f92e0f09e39f

SHA1
48ff372e76c61a3514619d3d2140e8fb8874b473

SHA256
015914b354e42b685bb289943416d9b8705c4a0710b42955c0cb720c61139e9e

SHA512
de5fdc0aa64587010f19112eccd9ba33d12c0b73decf7a9d240e85e5cb8f56a27dacbc6858f0546d37a9460a32c17824e6da13c8bece7292557cfa02ba04c2e2

Download Submit
C:\Users\Admin\Downloads\dnSpy-net-win64\bin\clrjit.dll

Filesize
1.3MB

MD5
ae031b7fafb431d7e30b08d5e9a0b831

SHA1
28a59dd780e0329ef19248e953e8cf703a9f97b3

SHA256
97c766dbd9786e66e967263371b9f06a9f21aa2950795d4254a11edcd20e430e

SHA512
036e35fa9751c9c54006077da4ec5d248e9572d9b5e30f1af83992700d11210981df10141316b6afeb7ebe82d6e3517575bc9ba77cc7a9d2383b08ceceaf50fc

Download Submit
C:\Users\Admin\Downloads\dnSpy-net-win64\bin\coreclr.dll

Filesize
4.9MB

MD5
27d49de876adc48752954f64f5db9da4

SHA1
2137a2a832fbb479bb2ae15297ca6d11a36cf68c

SHA256
f31d2089328db88ffd561f56db944cae79647478e2b72be201d95607b8ae1666

SHA512
d2bec99263f36fefe1760f22b656e8cdd27ba5c66d5df9e8509165a8f119f0ba63c6a766e25ed4895a927a089c816c59fdd0c2fc0b2b9f2a22db65abbb1d9fd0

Download Submit
C:\Users\Admin\Downloads\dnSpy-net-win64\bin\dnSpy.Console.deps.json

Filesize
45KB

MD5
a3c738fe74d13366259a2ffa0f9dce29

SHA1
a772250d5d3d7eed27144c5ce619cc8f1ab6bc1d

SHA256
627e129d29aa3bf684a808ef67a20ea94567cbb83de24e8f44b1b46d1558b28f

SHA512
fe4584c68f778a1c3d82c148bbd0631e74c52a01384d9ae6da90c346f9a498171976f7ab8730404a93546405175b125a411bea3d5e226913fc60b92c5b66613c

Download Submit
C:\Users\Admin\Downloads\dnSpy-net-win64\bin\dnSpy.Console.dll

Filesize
54KB

MD5
50db18c47b77014afc08933d36d1baa2

SHA1
9a65d68ff0128c83e1eeee3d9f640f09eb8e07c5

SHA256
e73f900e66ab45ea2b9a8411f1518ebe6063febe6c7912e3b162bb1be4c9248d

SHA512
c06a753c527adbb95482babbacfa1420e065af5c852fac826ac8db7cbd754b06a8cc99bdc877b10f76789c151173e5dd4d953c97ac930fc67b51ed1f15ff32bf

Download Submit
C:\Users\Admin\Downloads\dnSpy-net-win64\bin\dnSpy.Console.pdb

Filesize
22KB

MD5
e2c3522ef043ab686dc1e8e0e1aa9eb6

SHA1
8b1a072b109c031534ff4e37d265e41e89ee4c7e

SHA256
86e742e705cadfd203bbefd835f9f33f692822d92f27f8fd1dab2a334f6240f3

SHA512
b2902d0afa48412613c0c68e6dc1c86215d3db8e1a279f0119b0691a2911c00a6be9d4258bebcf5941d58cfb529b206b9f471f05dc2ff15b530514d06674ad36

Download Submit
C:\Users\Admin\Downloads\dnSpy-net-win64\bin\dnSpy.Console.runtimeconfig.json

Filesize
274B

MD5
c0bbae9a92c0004f0e48a1303834a4f1

SHA1
6254cc2e4595c272c88200a569ced499f82fb531

SHA256
d73d166ed2c36560e74ccd1067673bc17c881d570e09394ddd5ef0ffd3d9e8a4

SHA512
29a0025944bc65b708909a18e8d42723de52b5bf9fb191ab7936090f51edc4430791f341229f204e875d0673b046bc71e73842babc72312e19eb9c9019549272

Download Submit
C:\Users\Admin\Downloads\dnSpy-net-win64\bin\dnSpy.Decompiler.dll

Filesize
204KB

MD5
07b0f9afb082f6e5b3694bcf2de0cd01

SHA1
26bd1d8a8fb6ee24044f0d09cc07a66158bf0423

SHA256
cda009ba0abd7c22eaf28c917291193853fcf5189913f29845d42dbae361e302

SHA512
8af912133dc748e7a1f5cf1397148c0e63b1b14375bf5a5af2e6866c6eb66c8a313296754a2c2dd93dbc86cbb96586114df51af99e6297d87c24f55d940a1532

Download Submit
C:\Users\Admin\Downloads\dnSpy-net-win64\bin\dnlib.dll

Filesize
1.1MB

MD5
4d0b771879de85137ee7e5f0d4bb4b16

SHA1
fc32cccd0cd5c3ebd968bcdf48e32a7ea25e9bd7

SHA256
962332e8c8cb459fb2f7dacec5d7a618cc53b1b49bc1740156398c89742f43fd

SHA512
bae39862ea07ebc5c9aa07a7333a880471baf4bf52eebedc03536e45584887eecc1075e0c0171229a54900ab93a66db9f666aa631c160912f538666da8c9e980

Download Submit
C:\Users\Admin\Downloads\dnSpy-net-win64\bin\hostfxr.dll

Filesize
487KB

MD5
fa1ba429770bc8b64ce65511f29ff88f

SHA1
c9af6e053edc6f4ce1fcd165f1635cd15db98a9f

SHA256
48d9968db0001585b27c46c96d47952e86a42540b236a7d6877e8c67b7fa79a1

SHA512
c6dd92c56739e0b11dfeb496bbc14b24374e1910cb1a4c83edbb07d2565b2279fae0a9325d363ea7b2c548aea429ab6dcb875328ad48dcf2ef3256eb6c2778a3

Download Submit
C:\Users\Admin\Downloads\dnSpy-net-win64\bin\hostpolicy.dll

Filesize
494KB

MD5
af83b14c9628f161c980f69f7ae7b2be

SHA1
8b38008a74370379548a3accd259f43833b529ff

SHA256
fb249fed957ee658bfc20dbe18d1810aed29cd0b626374d147da5891a24b1b52

SHA512
a70d3f787b63345e7c2d6fcc50f66858d3c4bfccc952c637900067c1b59312d6c72febd04749fa36e027d65eaf07c5d7f6e90c1ed4b28767f6f5d36dded15712

Download Submit
C:\Users\Admin\Downloads\dnSpy-net-win64\bin\netstandard.dll

Filesize
111KB

MD5
349c39c3ff7dd2fb44d5fa3c5baf64c6

SHA1
b60d38ed5bcb35f66468a43dc4349dfa970b1c02

SHA256
737d504f6fa742b23cf4149cd0384fdbdc929bc4231bdd0d7bd772ea9dd1805f

SHA512
e63dd8f5e1392740a0e2228fcd88bba0392c5834ae2a3caa311e894b177623d636d12a5c0107f81f9b92e01fcdc75cbca287731eee4d136f73d1e9b6fca9bc0b

Download Submit
C:\Users\Admin\Downloads\dnSpy-net-win64\dnSpy.Console.exe

Filesize
139KB

MD5
56bb7df6ed7405a8ff99797423b44c6f

SHA1
99fafb636f51a5d1bc03cbf813f806e50d05bd2e

SHA256
826608b138ce60439dec9828aa246a847e02c34cc04a2933ba242696c770fcd2

SHA512
9f00bf86a1607f5bf441bbf6e6fa44b8c907ef431d7d5ba991cbadce09658a4322f952d3a7da7e8e2cad936501faf1fa156a1109289723c4f2ab233c2354e86d

Download Submit
memory/216-6596-0x0000000076E30000-0x0000000077045000-memory.dmp

Filesize
2.1MB

Download
memory/216-6593-0x0000000000E10000-0x0000000001210000-memory.dmp

Filesize
4.0MB

Download
memory/216-6594-0x00007FF83E130000-0x00007FF83E325000-memory.dmp

Filesize
2.0MB

Download
memory/2488-3489-0x0000000000530000-0x000000000053A000-memory.dmp

Filesize
40KB

Download
memory/2488-3492-0x00007FF83E130000-0x00007FF83E325000-memory.dmp

Filesize
2.0MB

Download
memory/2488-3494-0x0000000076E30000-0x0000000077045000-memory.dmp

Filesize
2.1MB

Download
memory/2488-3491-0x0000000000E00000-0x0000000001200000-memory.dmp

Filesize
4.0MB

Download
memory/2944-3483-0x0000000000580000-0x0000000000601000-memory.dmp

Filesize
516KB

Download
memory/2944-3485-0x0000000004DF0000-0x00000000051F0000-memory.dmp

Filesize
4.0MB

Download
memory/2944-3484-0x0000000004DF0000-0x00000000051F0000-memory.dmp

Filesize
4.0MB

Download
memory/2944-3481-0x0000000000580000-0x0000000000601000-memory.dmp

Filesize
516KB

Download
memory/2944-3480-0x0000000000580000-0x0000000000601000-memory.dmp

Filesize
516KB

Download
memory/2944-3478-0x0000000000580000-0x0000000000601000-memory.dmp

Filesize
516KB

Download
memory/2944-3477-0x0000000000580000-0x0000000000601000-memory.dmp

Filesize
516KB

Download
memory/2944-3488-0x0000000076E30000-0x0000000077045000-memory.dmp

Filesize
2.1MB

Download
memory/2944-3482-0x0000000000580000-0x0000000000601000-memory.dmp

Filesize
516KB

Download
memory/2944-3486-0x00007FF83E130000-0x00007FF83E325000-memory.dmp

Filesize
2.0MB

Download
memory/4148-3540-0x00000000012B0000-0x00000000016B0000-memory.dmp

Filesize
4.0MB

Download
memory/4148-3543-0x0000000076E30000-0x0000000077045000-memory.dmp

Filesize
2.1MB

Download
memory/4148-3541-0x00007FF83E130000-0x00007FF83E325000-memory.dmp

Filesize
2.0MB

Download
memory/4148-3538-0x0000000000D90000-0x0000000000D9A000-memory.dmp

Filesize
40KB

Download
memory/4304-6585-0x00000000040F0000-0x00000000044F0000-memory.dmp

Filesize
4.0MB

Download
memory/4304-6588-0x00007FF83E130000-0x00007FF83E325000-memory.dmp

Filesize
2.0MB

Download
memory/4304-6590-0x0000000076E30000-0x0000000077045000-memory.dmp

Filesize
2.1MB

Download
memory/5052-3537-0x0000000076E30000-0x0000000077045000-memory.dmp

Filesize
2.1MB

Download
memory/5052-3525-0x0000000004E90000-0x0000000005290000-memory.dmp

Filesize
4.0MB

Download
memory/5052-3535-0x00007FF83E130000-0x00007FF83E325000-memory.dmp

Filesize
2.0MB

Download