Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
109s -
max time network
152s -
platform
windows10-1703_x64 -
resource
win10-20230703-en -
resource tags
arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system -
submitted
20/08/2023, 14:43
Behavioral task
behavioral1
Sample
EonUpdater.exe
Resource
win10-20230703-en
General
-
Target
EonUpdater.exe
-
Size
12.2MB
-
MD5
a44d994ee5bd215580d5e76cfc568a4a
-
SHA1
dbbf76bbd5fa1a19fa14fe1fa8dad0f87936ece5
-
SHA256
6ab53ebad85480bcdbb01797c34683a4807d5056495c325841c67e2cbde42952
-
SHA512
cf7bae29828ed8fe9dd21a8ee648243a7dd6977b7a52533e53437910964de110f4b8ff3afae07d5fb06250af28160e9f60036f882a6d9830b2a348e4816d234c
-
SSDEEP
196608:NcsFdAw/iIHcLtMqxYdqu/p5Lz0vHblk5CeVeObAbN0l:uK/inA/x530/bECe0IAOl
Malware Config
Signatures
-
Downloads MZ/PE file
-
Executes dropped EXE 3 IoCs
pid Process 4376 windowsdesktop-runtime-6.0.21-win-x64.exe 4472 windowsdesktop-runtime-6.0.21-win-x64.exe 2124 windowsdesktop-runtime-6.0.21-win-x64.exe -
Loads dropped DLL 9 IoCs
pid Process 4472 windowsdesktop-runtime-6.0.21-win-x64.exe 4452 MsiExec.exe 4452 MsiExec.exe 360 MsiExec.exe 360 MsiExec.exe 1680 MsiExec.exe 1680 MsiExec.exe 4468 MsiExec.exe 4468 MsiExec.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{0f39db03-9030-48f3-82ef-5384bed81d85} = "\"C:\\ProgramData\\Package Cache\\{0f39db03-9030-48f3-82ef-5384bed81d85}\\windowsdesktop-runtime-6.0.21-win-x64.exe\" /burn.runonce" windowsdesktop-runtime-6.0.21-win-x64.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.Net.Requests.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\cs\WindowsBase.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\WindowsBase.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\zh-Hant\System.Windows.Forms.Design.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\api-ms-win-core-processthreads-l1-1-0.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.Private.Uri.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\pt-BR\Microsoft.VisualBasic.Forms.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.ComponentModel.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\zh-Hant\ReachFramework.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\System.Drawing.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\ja\System.Windows.Forms.Primitives.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\vcruntime140_cor3.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\ko\System.Xaml.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\Accessibility.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\WindowsFormsIntegration.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\System.Windows.Forms.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\zh-Hant\System.Windows.Forms.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\System.Design.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.Security.Principal.Windows.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\pl\System.Windows.Input.Manipulations.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\msquic.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\Microsoft.Win32.Primitives.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\ru\System.Windows.Forms.Primitives.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\Microsoft.Win32.Registry.AccessControl.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.Net.Primitives.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.Security.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.IO.Compression.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.Collections.Immutable.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\System.Windows.Forms.Design.Editors.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\pl\System.Windows.Forms.Primitives.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\ja\WindowsBase.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\pt-BR\PresentationCore.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.Threading.Overlapped.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\mscordbi.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.Xml.XPath.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\ja\System.Windows.Input.Manipulations.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\ru\Microsoft.VisualBasic.Forms.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.Resources.ResourceManager.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.Runtime.CompilerServices.Unsafe.dll msiexec.exe File created C:\Program Files\dotnet\ThirdPartyNotices.txt msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\ja\UIAutomationClientSideProviders.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\ru\System.Windows.Controls.Ribbon.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\es\System.Xaml.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.Numerics.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\Microsoft.VisualBasic.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.Web.HttpUtility.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.Collections.Concurrent.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\System.Drawing.Design.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\zh-Hans\WindowsBase.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\ja\WindowsFormsIntegration.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\de\PresentationCore.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\PresentationCore.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.Net.WebHeaderCollection.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\System.Security.Cryptography.Pkcs.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\pt-BR\System.Windows.Controls.Ribbon.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\de\System.Windows.Forms.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\ko\PresentationFramework.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\ko\UIAutomationClient.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\ko\System.Windows.Forms.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\ja\Microsoft.VisualBasic.Forms.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\UIAutomationClientSideProviders.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.21\cs\UIAutomationClientSideProviders.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.IO.Pipes.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.21\System.Threading.Tasks.dll msiexec.exe -
Drops file in Windows directory 38 IoCs
description ioc Process File created C:\Windows\Installer\SourceHash{8D2EC92E-5903-4B25-9406-182B8EFA834F} msiexec.exe File created C:\Windows\Installer\e590fc9.msi msiexec.exe File created C:\Windows\Installer\e590fb6.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\e590fc0.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI4FC6.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI8650.tmp msiexec.exe File created C:\Windows\rescache\_merged\3720402701\2219095117.pri MicrosoftEdgeCP.exe File created C:\Windows\rescache\_merged\3720402701\2219095117.pri MicrosoftEdgeCP.exe File opened for modification C:\Windows\Installer\MSI1F76.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI3ED8.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI4428.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI49A8.tmp msiexec.exe File opened for modification C:\Windows\Installer\e590fc5.msi msiexec.exe File opened for modification C:\Windows\Installer\e590fb6.msi msiexec.exe File created C:\Windows\Installer\e590fbb.msi msiexec.exe File created C:\Windows\Installer\e590fbf.msi msiexec.exe File created C:\Windows\Installer\e590fc5.msi msiexec.exe File created C:\Windows\rescache\_merged\3720402701\2219095117.pri MicrosoftEdgeCP.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI1795.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{26FF35F7-ADBB-4C9F-97DA-79120DB80EC6} msiexec.exe File opened for modification C:\Windows\Installer\MSI5209.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI5B45.tmp msiexec.exe File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe File created C:\Windows\rescache\_merged\3720402701\2219095117.pri MicrosoftEdgeCP.exe File created C:\Windows\Installer\e590fba.msi msiexec.exe File created C:\Windows\Installer\SourceHash{D937EF87-F11D-4778-973C-B71E178F95D0} msiexec.exe File created C:\Windows\Installer\e590fc4.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI5614.tmp msiexec.exe File created C:\Windows\rescache\_merged\3720402701\2219095117.pri MicrosoftEdge.exe File created C:\Windows\rescache\_merged\3720402701\2219095117.pri MicrosoftEdgeCP.exe File opened for modification C:\Windows\Installer\e590fbb.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI4C3B.tmp msiexec.exe File opened for modification C:\Windows\Installer\e590fc0.msi msiexec.exe File created C:\Windows\Installer\SourceHash{AF6BF7DD-2B12-40C5-919C-2EC99054BBE1} msiexec.exe File opened for modification C:\Windows\Installer\MSI62F6.tmp msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000\Software\Microsoft\Internet Explorer\Main browser_broker.exe Key created \REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdgeCP.exe -
Modifies data under HKEY_USERS 9 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\21 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22 msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1E\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\20 msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1F msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\20 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\21 msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f msiexec.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{0f39db03-9030-48f3-82ef-5384bed81d85}\Dependents\{0f39db03-9030-48f3-82ef-5384bed81d85} windowsdesktop-runtime-6.0.21-win-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\78FE739DD11F877479C37BE171F8590D\PackageCode = "44C0CE721D44C91429496EFE8E61E9A2" msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\NextUpdateDate = "399363257" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\microsoft.com\ = "0" MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$WordPress MicrosoftEdge.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E29CE2D8309552B4496081B2E8AF38F4\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{8D2EC92E-5903-4B25-9406-182B8EFA834F}v48.87.64667\\" msiexec.exe Key created \REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionHigh = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListDOSTime = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Disallowed\Certificates MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs MicrosoftEdge.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\78FE739DD11F877479C37BE171F8590D\SourceList\Media msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI MicrosoftEdge.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DD7FB6FA21B25C0419C9E29C0945BB1E\Assignment = "1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\16F350F7730518B71214A03200AA04D5 msiexec.exe Key created \REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\microsoft.com MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000 MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\trust\CTLs MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\TrustedPublisher\CRLs MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\CRLs MicrosoftEdge.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7F53FF62BBDAF9C479AD9721D08BE06C\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{26FF35F7-ADBB-4C9F-97DA-79120DB80EC6}v48.87.64667\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DD7FB6FA21B25C0419C9E29C0945BB1E msiexec.exe Set value (data) \REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{AEBA21FA-782A-4A90-978D-B7216 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "268435456" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\TrustedPublisher\CTLs MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BingPageData\RulesFileNextUpdateDate = "398704761" MicrosoftEdge.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{0f39db03-9030-48f3-82ef-5384bed81d85}\Version = "6.0.21.32717" windowsdesktop-runtime-6.0.21-win-x64.exe Set value (data) \REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus\DynamicCodePolicy = 05000000 MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Content\CachePrefix MicrosoftEdgeCP.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\78FE739DD11F877479C37BE171F8590D\AuthorizedLUAApp = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_48.3.31210_x64\ = "{26FF35F7-ADBB-4C9F-97DA-79120DB80EC6}" msiexec.exe Set value (data) \REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\PersistedStorageItemTable\System\{30470450-041C-49EF-8B5B-1A260F7150 = 6f345bed74d3d901 browser_broker.exe Set value (data) \REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 034a03cf74d3d901 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PivotIndex MicrosoftEdge.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\78FE739DD11F877479C37BE171F8590D\MainFeature msiexec.exe Set value (int) \REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Cookies\CacheLimit = "1" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion\NextUpdateDate = "399319334" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main MicrosoftEdgeCP.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\527B4FA944956476D4A7C20451951DD2 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DD7FB6FA21B25C0419C9E29C0945BB1E\SourceList\Net msiexec.exe Key created \REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\SubSysId = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\PersistedStorageItemTable\System\{30470450-041C-49EF-8B5B-1A260F7150 = "\\\\?\\Volume{251BA123-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\TempState\\Downloads\\windowsdesktop-runtime-6.0.21-win-x64.exe" browser_broker.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E29CE2D8309552B4496081B2E8AF38F4\SourceList\PackageName = "dotnet-runtime-6.0.21-win-x64.msi" msiexec.exe Set value (int) \REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionLow = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "395205405" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\Certificates\AA549154B737EF29C = 030000000100000014000000aa549154b737ef29c55000081fdf1f8b3ebb40910400000001000000100000001e9b655c2563f0f8b7cf2fa979f89a920f00000001000000200000001c169fb8bea23cbb597a7d0330f5f2c6fb82969934da9d676058363ca94854c614000000010000001400000039c8e33fb6d4c223863e8a9838ee2fcbbe567a13190000000100000010000000baa9030082855b9e52cb543799fa36f35c0000000100000004000000000800001800000001000000100000002d581a49c8eb5b3b3c6ef9bb65314d702000000001000000e7050000308205e3308203cba003020102021333000001d92cb2c0c2c9e054b40000000001d9300d06092a864886f70d01010b0500307e310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312830260603550403131f4d6963726f736f667420536563757265205365727665722043412032303131301e170d3232303630373138323634325a170d3233303930373138323634325a3081a5310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e310d300b060355040b130442696e67311b301906035504031312494520496e737472756d656e746174696f6e3123302106092a864886f70d0109011614777362657870406d6963726f736f66742e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100d345fb3624263a3b1856614f76c90c184e75fc1ab123f51b38c31a32311a70bbec8667c0831a74b00255149eac86eb0b2e4bc21010346a0bfaed29bbba29ab5e69a8b707f955c12eeb575a70cfeccd7ca8de3de7c883dd7bb79e85c8062128750eba60d9bcb6e0a21a4e97deef8cdff249e7d7ed312b8ed769c00c80629fc31ffe942f792d67b8e360f084858065ca7c0114a231072d7380b9ee828b1e717bc81938d5c58b75f12f457d4320f90a11d1d326e0b24c69dcbb185054bf8ab0c136f8f38264911aca2edaa93754a9685eb0878b62800020838f656e4d7d3aa53a0cc07d76cfbc7d77f570346cd2bba3836d24428c2723dd6e39afd107c0f7889bdd0203010001a38201303082012c300e0603551d0f0101ff0404030204f030150603551d25040e300c060a2b0601040182374c0c01301d0603551d0e0416041439c8e33fb6d4c223863e8a9838ee2fcbbe567a13301f0603551d230418301680143656896549cb5b9b2f3cac4216504d91b933d79130530603551d1f044c304a3048a046a0448642687474703a2f2f7777772e6d6963726f736f66742e636f6d2f706b696f70732f63726c2f4d69635365635365724341323031315f323031312d31302d31382e63726c306006082b0601050507010104543052305006082b060105050730028644687474703a2f2f7777772e6d6963726f736f66742e636f6d2f706b696f70732f63657274732f4d69635365635365724341323031315f323031312d31302d31382e637274300c0603551d130101ff04023000300d06092a864886f70d01010b05000382020100c36cdc2a65c64372b6118a63a5c7ed1ecfa5b939531465ca9af136bd76d942a74ad37481be984496cd20deca7b469dc4f2e439db9e2e0eafd2b4dcab7c7b0d131a98a88e9c34787d209fe84fd1bf1031c31a63a794d8448654d9f6e1267ca9513f6d9bb17be844f225a15133665568503b50bdd2b74e1199b3afbb822dc3d9b07147f374427991b7d04234dfb77c7b4518a554b65b69b318ff2be7e541762de2726789d01f2f866523861aea19ff8ccbfaafc7d78fc242aca7f74d6ba335b4c3d7c7b5b1f5b8dbb6b3104f24dbb8f95b39ecfbdc1a4469ab254263371e8f231c32c68c574290c81c388c3148200344d9b9b3fa8bb6394ac2536f66803302873f3f857bbdbe279d9bf7d2df3422c9bf927ef7b8eb92e872fdfac7cd1fd185847555b4239740734d043b167098ede21a83d5b35431fbd4768905a474218801cf320084043f608133bc8c26752c6b15210859dad17f3cdb1f8546c8cde2b5ccb6634681aaf88339eeab1ad92b8e4babf96333a99e6ff7ada19433913a8101d63b36fcccade21ec6a41cdb44d3abad7c4065368e51eb46b5c237c37bbf04c89871e2e0da20d2e569eaf67b19787ed46c2038faf181bd00cd1d5ff1fee0ad70b457528415fce74f37c22e3bfb1b17d57e59200625989090a2bb1e3b238cb348768a98126537198be58282f64856420280d5858fc0575182dbc6d1fb4f7611b339babc MicrosoftEdge.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\BE3E5325A595AB443B7CED4E083B14EB\E29CE2D8309552B4496081B2E8AF38F4 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7F53FF62BBDAF9C479AD9721D08BE06C msiexec.exe Key created \REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3 MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\microsoft.com\ = "0" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-2393848421-2120571652-2495149697-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "1" MicrosoftEdge.exe -
NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\windowsdesktop-runtime-6.0.21-win-x64.exe.k2055s1.partial:Zone.Identifier browser_broker.exe -
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 4964 NOTEPAD.EXE -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2596 msiexec.exe 2596 msiexec.exe 2596 msiexec.exe 2596 msiexec.exe 2596 msiexec.exe 2596 msiexec.exe 2596 msiexec.exe 2596 msiexec.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 2100 MicrosoftEdgeCP.exe 2100 MicrosoftEdgeCP.exe 2100 MicrosoftEdgeCP.exe 2100 MicrosoftEdgeCP.exe 2100 MicrosoftEdgeCP.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3696 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 3696 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 3696 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 3696 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 1168 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 1168 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 5100 MicrosoftEdge.exe Token: SeDebugPrivilege 5100 MicrosoftEdge.exe Token: SeShutdownPrivilege 2124 windowsdesktop-runtime-6.0.21-win-x64.exe Token: SeIncreaseQuotaPrivilege 2124 windowsdesktop-runtime-6.0.21-win-x64.exe Token: SeSecurityPrivilege 2596 msiexec.exe Token: SeCreateTokenPrivilege 2124 windowsdesktop-runtime-6.0.21-win-x64.exe Token: SeAssignPrimaryTokenPrivilege 2124 windowsdesktop-runtime-6.0.21-win-x64.exe Token: SeLockMemoryPrivilege 2124 windowsdesktop-runtime-6.0.21-win-x64.exe Token: SeIncreaseQuotaPrivilege 2124 windowsdesktop-runtime-6.0.21-win-x64.exe Token: SeMachineAccountPrivilege 2124 windowsdesktop-runtime-6.0.21-win-x64.exe Token: SeTcbPrivilege 2124 windowsdesktop-runtime-6.0.21-win-x64.exe Token: SeSecurityPrivilege 2124 windowsdesktop-runtime-6.0.21-win-x64.exe Token: SeTakeOwnershipPrivilege 2124 windowsdesktop-runtime-6.0.21-win-x64.exe Token: SeLoadDriverPrivilege 2124 windowsdesktop-runtime-6.0.21-win-x64.exe Token: SeSystemProfilePrivilege 2124 windowsdesktop-runtime-6.0.21-win-x64.exe Token: SeSystemtimePrivilege 2124 windowsdesktop-runtime-6.0.21-win-x64.exe Token: SeProfSingleProcessPrivilege 2124 windowsdesktop-runtime-6.0.21-win-x64.exe Token: SeIncBasePriorityPrivilege 2124 windowsdesktop-runtime-6.0.21-win-x64.exe Token: SeCreatePagefilePrivilege 2124 windowsdesktop-runtime-6.0.21-win-x64.exe Token: SeCreatePermanentPrivilege 2124 windowsdesktop-runtime-6.0.21-win-x64.exe Token: SeBackupPrivilege 2124 windowsdesktop-runtime-6.0.21-win-x64.exe Token: SeRestorePrivilege 2124 windowsdesktop-runtime-6.0.21-win-x64.exe Token: SeShutdownPrivilege 2124 windowsdesktop-runtime-6.0.21-win-x64.exe Token: SeDebugPrivilege 2124 windowsdesktop-runtime-6.0.21-win-x64.exe Token: SeAuditPrivilege 2124 windowsdesktop-runtime-6.0.21-win-x64.exe Token: SeSystemEnvironmentPrivilege 2124 windowsdesktop-runtime-6.0.21-win-x64.exe Token: SeChangeNotifyPrivilege 2124 windowsdesktop-runtime-6.0.21-win-x64.exe Token: SeRemoteShutdownPrivilege 2124 windowsdesktop-runtime-6.0.21-win-x64.exe Token: SeUndockPrivilege 2124 windowsdesktop-runtime-6.0.21-win-x64.exe Token: SeSyncAgentPrivilege 2124 windowsdesktop-runtime-6.0.21-win-x64.exe Token: SeEnableDelegationPrivilege 2124 windowsdesktop-runtime-6.0.21-win-x64.exe Token: SeManageVolumePrivilege 2124 windowsdesktop-runtime-6.0.21-win-x64.exe Token: SeImpersonatePrivilege 2124 windowsdesktop-runtime-6.0.21-win-x64.exe Token: SeCreateGlobalPrivilege 2124 windowsdesktop-runtime-6.0.21-win-x64.exe Token: SeRestorePrivilege 2596 msiexec.exe Token: SeTakeOwnershipPrivilege 2596 msiexec.exe Token: SeRestorePrivilege 2596 msiexec.exe Token: SeTakeOwnershipPrivilege 2596 msiexec.exe Token: SeRestorePrivilege 2596 msiexec.exe Token: SeTakeOwnershipPrivilege 2596 msiexec.exe Token: SeRestorePrivilege 2596 msiexec.exe Token: SeTakeOwnershipPrivilege 2596 msiexec.exe Token: SeRestorePrivilege 2596 msiexec.exe Token: SeTakeOwnershipPrivilege 2596 msiexec.exe Token: SeRestorePrivilege 2596 msiexec.exe Token: SeTakeOwnershipPrivilege 2596 msiexec.exe Token: SeRestorePrivilege 2596 msiexec.exe Token: SeTakeOwnershipPrivilege 2596 msiexec.exe Token: SeRestorePrivilege 2596 msiexec.exe Token: SeTakeOwnershipPrivilege 2596 msiexec.exe Token: SeRestorePrivilege 2596 msiexec.exe Token: SeTakeOwnershipPrivilege 2596 msiexec.exe Token: SeRestorePrivilege 2596 msiexec.exe Token: SeTakeOwnershipPrivilege 2596 msiexec.exe Token: SeRestorePrivilege 2596 msiexec.exe Token: SeTakeOwnershipPrivilege 2596 msiexec.exe Token: SeRestorePrivilege 2596 msiexec.exe Token: SeTakeOwnershipPrivilege 2596 msiexec.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4472 windowsdesktop-runtime-6.0.21-win-x64.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 5100 MicrosoftEdge.exe 2100 MicrosoftEdgeCP.exe 3696 MicrosoftEdgeCP.exe 2100 MicrosoftEdgeCP.exe -
Suspicious use of WriteProcessMemory 37 IoCs
description pid Process procid_target PID 2100 wrote to memory of 760 2100 MicrosoftEdgeCP.exe 74 PID 2100 wrote to memory of 760 2100 MicrosoftEdgeCP.exe 74 PID 2100 wrote to memory of 760 2100 MicrosoftEdgeCP.exe 74 PID 2100 wrote to memory of 760 2100 MicrosoftEdgeCP.exe 74 PID 2100 wrote to memory of 760 2100 MicrosoftEdgeCP.exe 74 PID 2100 wrote to memory of 760 2100 MicrosoftEdgeCP.exe 74 PID 2100 wrote to memory of 760 2100 MicrosoftEdgeCP.exe 74 PID 2100 wrote to memory of 760 2100 MicrosoftEdgeCP.exe 74 PID 2100 wrote to memory of 760 2100 MicrosoftEdgeCP.exe 74 PID 2100 wrote to memory of 760 2100 MicrosoftEdgeCP.exe 74 PID 2100 wrote to memory of 760 2100 MicrosoftEdgeCP.exe 74 PID 2100 wrote to memory of 760 2100 MicrosoftEdgeCP.exe 74 PID 2100 wrote to memory of 760 2100 MicrosoftEdgeCP.exe 74 PID 2100 wrote to memory of 760 2100 MicrosoftEdgeCP.exe 74 PID 2100 wrote to memory of 760 2100 MicrosoftEdgeCP.exe 74 PID 2100 wrote to memory of 760 2100 MicrosoftEdgeCP.exe 74 PID 4436 wrote to memory of 4376 4436 browser_broker.exe 80 PID 4436 wrote to memory of 4376 4436 browser_broker.exe 80 PID 4436 wrote to memory of 4376 4436 browser_broker.exe 80 PID 4376 wrote to memory of 4472 4376 windowsdesktop-runtime-6.0.21-win-x64.exe 82 PID 4376 wrote to memory of 4472 4376 windowsdesktop-runtime-6.0.21-win-x64.exe 82 PID 4376 wrote to memory of 4472 4376 windowsdesktop-runtime-6.0.21-win-x64.exe 82 PID 4472 wrote to memory of 2124 4472 windowsdesktop-runtime-6.0.21-win-x64.exe 83 PID 4472 wrote to memory of 2124 4472 windowsdesktop-runtime-6.0.21-win-x64.exe 83 PID 4472 wrote to memory of 2124 4472 windowsdesktop-runtime-6.0.21-win-x64.exe 83 PID 2596 wrote to memory of 4452 2596 msiexec.exe 85 PID 2596 wrote to memory of 4452 2596 msiexec.exe 85 PID 2596 wrote to memory of 4452 2596 msiexec.exe 85 PID 2596 wrote to memory of 360 2596 msiexec.exe 86 PID 2596 wrote to memory of 360 2596 msiexec.exe 86 PID 2596 wrote to memory of 360 2596 msiexec.exe 86 PID 2596 wrote to memory of 1680 2596 msiexec.exe 87 PID 2596 wrote to memory of 1680 2596 msiexec.exe 87 PID 2596 wrote to memory of 1680 2596 msiexec.exe 87 PID 2596 wrote to memory of 4468 2596 msiexec.exe 88 PID 2596 wrote to memory of 4468 2596 msiexec.exe 88 PID 2596 wrote to memory of 4468 2596 msiexec.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\EonUpdater.exe"C:\Users\Admin\AppData\Local\Temp\EonUpdater.exe"1⤵PID:2288
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5100
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:4436 -
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\windowsdesktop-runtime-6.0.21-win-x64.exe"C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\windowsdesktop-runtime-6.0.21-win-x64.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4376 -
C:\Windows\Temp\{A258B757-EECB-43E1-9DE7-5AFBCAE28DAD}\.cr\windowsdesktop-runtime-6.0.21-win-x64.exe"C:\Windows\Temp\{A258B757-EECB-43E1-9DE7-5AFBCAE28DAD}\.cr\windowsdesktop-runtime-6.0.21-win-x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\windowsdesktop-runtime-6.0.21-win-x64.exe" -burn.filehandle.attached=592 -burn.filehandle.self=5283⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Windows\Temp\{FDF572CD-FDDD-41DD-9FC7-B64BB691A505}\.be\windowsdesktop-runtime-6.0.21-win-x64.exe"C:\Windows\Temp\{FDF572CD-FDDD-41DD-9FC7-B64BB691A505}\.be\windowsdesktop-runtime-6.0.21-win-x64.exe" -q -burn.elevated BurnPipe.{E0FBA286-830F-46AF-9178-0493B7F5259B} {87CC05CF-A2ED-47A4-B5DB-CD1183E6A994} 44724⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2124
-
-
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2100
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3696
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
PID:760
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1168
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
PID:992
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
PID:4700
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
PID:4788
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 62FD4912A2992F222B2FC10C35EE4E0E2⤵
- Loads dropped DLL
PID:4452
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding DF86C96282EE5276543604D59C227B482⤵
- Loads dropped DLL
PID:360
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 16090FAF668F06C30ADA46B0772C7D982⤵
- Loads dropped DLL
PID:1680
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 8425F85B13278662BFF945A04A17C7A12⤵
- Loads dropped DLL
PID:4468
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4812
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\UninstallRedo.txt1⤵
- Opens file in notepad (likely ransom note)
PID:4964
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
55KB
MD548f04a779dee3a5585bf5cf07dbbfa28
SHA1ea1f7a22d253238db34876466d03a2600ae157c0
SHA2563555a113e994b8ab26557498ae9131eca0360302a8a3c864aba771174734a10c
SHA51264b672665ee3c1523ba958562d2d21225cd6504a5d1326848c009111567ddaa74f0cc2094a860918af1c20a117b0f3bb0f5c3c4641af7e59100369837755f73b
-
Filesize
8KB
MD5e70ed60923e0e0f15f4269f8b871ac9c
SHA17cf1918d51966161c1c8416511f7c9e7b544a630
SHA25646917531b412e72b2897709b8834b708df7a6637640dbdeec56aeb3b9e69d447
SHA512cc27ace1db8e5ce599ad14102b933d22e29c6f26b101b3d603a6d6350b43d774e3d0f33924587abf5ed9e2cb9ba0293ba0cf259af4faf358e7d4d76c97c5e238
-
Filesize
9KB
MD5a9cf4e284752557c57b79d7cee38fee9
SHA1fbc85b53c0a085d4ccfcd47f7d2bb314a7b9640e
SHA256929050e4377943f04b8081499d5461a3a9c2930e1fa88e3e47260eb13551555a
SHA512e72dd529aee5dd41708c9377f26b4c6bf1ae4f55f73e7959556da079cf61cfabb790579f4c0b8a66b4e42776f3975e45e27a7acd2645834b9932bcf0d0d80197
-
Filesize
87KB
MD5b5fc2f972ddd6259f57ecaeeb593374e
SHA1ecb2972fd199ffa22f4f8ed17caa6400ba1ae80d
SHA256be64dab1c7bdb88db6affb4db855caaf8307251217f879bcaadaf835c1812a5d
SHA51244adb01f81b493fd8ddbe74f9fd17171f4b8196f0676b00ef75479a4873dd8e1017f74c3cbab95d2378a45381040f69bbe584d68fefea3982aac2f16967349dd
-
Filesize
9KB
MD531c5a77b3c57c8c2e82b9541b00bcd5a
SHA1153d4bc14e3a2c1485006f1752e797ca8684d06d
SHA2567f6839a61ce892b79c6549e2dc5a81fdbd240a0b260f8881216b45b7fda8b45d
SHA512ad33e3c0c3b060ad44c5b1b712c991b2d7042f6a60dc691c014d977c922a7e3a783ba9bade1a34de853c271fde1fb75bc2c47869acd863a40be3a6c6d754c0a6
-
Filesize
78KB
MD5f77a4aecfaf4640d801eb6dcdfddc478
SHA17424710f255f6205ef559e4d7e281a3b701183bb
SHA256d5db0ed54363e40717ae09e746dec99ad5b09223cc1273bb870703176dd226b7
SHA5121b729dfa561899980ba8b15128ea39bc1e609fe07b30b283001fd9cf9da62885d78c18082d0085edd81f09203f878549b48f7f888a8486a2a526b134c849fd6b
-
Filesize
4KB
MD5f7dcb24540769805e5bb30d193944dce
SHA1e26c583c562293356794937d9e2e6155d15449ee
SHA2566b88c6ac55bbd6fea0ebe5a760d1ad2cfce251c59d0151a1400701cb927e36ea
SHA512cb5ad678b0ef642bf492f32079fe77e8be20c02de267f04b545df346b25f3e4eb98bb568c4c2c483bb88f7d1826863cb515b570d620766e52476c8ee2931ea94
-
C:\Users\Admin\AppData\Local\MicrosoftEdge\SharedCacheContainers\MicrosoftEdge_iecompat\IECompatData.xml
Filesize74KB
MD5d4fc49dc14f63895d997fa4940f24378
SHA13efb1437a7c5e46034147cbbc8db017c69d02c31
SHA256853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1
SHA512cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\DFJRR53J\dotnet.microsoft[1].xml
Filesize13B
MD5c1ddea3ef6bbef3e7060a1a9ad89e4c5
SHA135e3224fcbd3e1af306f2b6a2c6bbea9b0867966
SHA256b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db
SHA5126be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\G6U9J2W2\suggestions[1].en-US
Filesize17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\S8PP3Y3L\favicon[1].ico
Filesize16KB
MD512e3dac858061d088023b2bd48e2fa96
SHA1e08ce1a144eceae0c3c2ea7a9d6fbc5658f24ce5
SHA25690cdaf487716184e4034000935c605d1633926d348116d198f355a98b8c6cd21
SHA512c5030c55a855e7a9e20e22f4c70bf1e0f3c558a9b7d501cfab6992ac2656ae5e41b050ccac541efa55f9603e0d349b247eb4912ee169d44044271789c719cd01
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\ImageStore\3hpaabu\imagestore.dat
Filesize26KB
MD50c9a6c15b27046a7e99ca8a709a27314
SHA1e6a4b252bc581b4e82a312c062693876f446c68f
SHA2563a639989c80320313f282fcd06f2b4e931d3cef86a12e63749fd8f74b8e441ef
SHA512740bb4a3053b7ca75fce84bfe826124a1a955fdd0b4c086e0542bf32a48fbb4dc8206a8d0594a30826ac1b8472d628a25297df57f67035bec356cdda0d1d2db1
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\windowsdesktop-runtime-6.0.21-win-x64.exe
Filesize54.7MB
MD51a6d60add2d112dd73e83fb46dca474d
SHA18b374a54f508cfdb8c8176bfaef96f37edf7170b
SHA256aa0c922c9c65f11b75747343b4711a0bdc8dc8ac1bd38da7c3ecd01ce28c8545
SHA51249192c5141bb04dc19483e8b1adec9c6f56fa54ef8c55e2f4fa4aae73abf9119bb7b1dff3d8f9b3307c50de8989669398a5f6d8dc4323b81b6a1def5ee6c6e79
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\windowsdesktop-runtime-6.0.21-win-x64.exe
Filesize54.7MB
MD51a6d60add2d112dd73e83fb46dca474d
SHA18b374a54f508cfdb8c8176bfaef96f37edf7170b
SHA256aa0c922c9c65f11b75747343b4711a0bdc8dc8ac1bd38da7c3ecd01ce28c8545
SHA51249192c5141bb04dc19483e8b1adec9c6f56fa54ef8c55e2f4fa4aae73abf9119bb7b1dff3d8f9b3307c50de8989669398a5f6d8dc4323b81b6a1def5ee6c6e79
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\windowsdesktop-runtime-6.0.21-win-x64.exe
Filesize54.7MB
MD51a6d60add2d112dd73e83fb46dca474d
SHA18b374a54f508cfdb8c8176bfaef96f37edf7170b
SHA256aa0c922c9c65f11b75747343b4711a0bdc8dc8ac1bd38da7c3ecd01ce28c8545
SHA51249192c5141bb04dc19483e8b1adec9c6f56fa54ef8c55e2f4fa4aae73abf9119bb7b1dff3d8f9b3307c50de8989669398a5f6d8dc4323b81b6a1def5ee6c6e79
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\windowsdesktop-runtime-6.0.21-win-x64.exe.k2055s1.partial
Filesize54.7MB
MD51a6d60add2d112dd73e83fb46dca474d
SHA18b374a54f508cfdb8c8176bfaef96f37edf7170b
SHA256aa0c922c9c65f11b75747343b4711a0bdc8dc8ac1bd38da7c3ecd01ce28c8545
SHA51249192c5141bb04dc19483e8b1adec9c6f56fa54ef8c55e2f4fa4aae73abf9119bb7b1dff3d8f9b3307c50de8989669398a5f6d8dc4323b81b6a1def5ee6c6e79
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\QK7Z33RI\windowsdesktop-runtime-6.0.21-win-x64[1].exe
Filesize272KB
MD5cd580c4c3384585ed2e31d43792fe9bf
SHA16c94c4922922ec9761b0704d1cfb90242ece67fa
SHA2562ef47b163ade7f6b08692821260049bb91de8ae1e7bfbbc9057c25faf086ca67
SHA51248fe131a5d58f704e2446fa23f66d7ff6bf689a89b830472cc91cca00d7fe3d71513a11ccbf9ead6b0dc518c0ae312a59a171bd259e2dca04167a0e5563d23ce
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\QK7Z33RI\windowsdesktop-runtime-6.0.21-win-x64[2].exe
Filesize560KB
MD5e57d28dd0bb4325bd0bba17c8c2c3ede
SHA110beeb51eb77e3f4731e699851fa9dc10a61b842
SHA256e4fd913074e965401f6ac2c2e4a9a1c0e8a1761a9472216ea87512e9f4ee19dd
SHA512acd8d27a5d8985e622f3539a04bf9a519eaf70076b6a2b5c2569323c46af308f081d97f6f02acf2900e6a7e858329e7b24788932b7fa4d0c5ebf5544dd2b169d
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\QK7Z33RI\windowsdesktop-runtime-6.0.21-win-x64[3].exe
Filesize1024KB
MD5bb46b4755990b212c22b285549cf82e5
SHA180e0d7589bb233b4fe173a180622b4e067cf05ab
SHA25686f366d2f22b5135bc5140aa7ea6d0fa121bb50090667e6268387c687f87ab82
SHA5125f4ca2babd4e1228e1c522dcd01a448c14205f0a4921e90ba3a55bfcbf61c67ee09e810ba2758b9a78d8bf22a722d67537d8af8e77059cf52952e42c256ce4c6
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\QK7Z33RI\windowsdesktop-runtime-6.0.21-win-x64[4].exe
Filesize32KB
MD513f416c4cbb94e27a9519f1dc7e1856d
SHA1cc840a2a72584c4eec236ff8e4f25081bbaf3fc5
SHA25609738cf448f4097752c79e3d48f1c763fe98374d6fb1c1aaa7a6859d40bc9814
SHA51258fb0d03912bffd59b2a7de67093f1ed3db63875f91d30f9ea01eb3d63d3643e5254d399b7981cf203283921b0dd91779509b9fc639b8fc0fb8c6b0217cf065e
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize471B
MD546bfae4526f50754213d8b7f07ab771f
SHA1690b0a533baac520b4cbfdf8ca5ddadf775c54a6
SHA25667242283cdc5f89491e11eecc0679f0bb531e654ff61c02095d130a2deb72477
SHA51296becfc0834508daac8aaa614cc31203f50a4f3e6dfa8be52749ae9711f375cda2b352d0c3b84f7fd2ba7be5471dac93e1e6946ea296a1469f0bae2f7cf59d59
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize404B
MD554b235d0fa2890ca86423249b89521b8
SHA143a2d839d5968a7acdaa53a62744709e5135e531
SHA256b415d638cc6fa72b2c508d2140e459f8563dcf5eb9e73a7e7b5078b9cda7b895
SHA51299686657edfe2acd20cbdedb594c873e719241beb1f275d8a30c4bd4d17a07a64bf6ac5888fdb06b47c226ef6e23f52b2087f0c4e77fcd50b957c2892c5558b1
-
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.21_(x64)_20230820144524_000_dotnet_runtime_6.0.21_win_x64.msi.log
Filesize3KB
MD51d62385bb796bc4facd3bc90619a8bea
SHA1652eebd7d7a17682c45a72e6cadf214ba79552c5
SHA25632aadb3cf2a0f2008767a464e44c4cede160736e0d7102d1c6429168598f1adf
SHA5127160a6aa55fea625c143c4a5044857b0c1250e3281d5244472a488d10e22c06170aa6485b6e3b0a176a7cc261472bcc2a8fe22262e19d3b594075c4d4332ae73
-
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.21_(x64)_20230820144524_001_dotnet_hostfxr_6.0.21_win_x64.msi.log
Filesize2KB
MD500ce812b161eb6d260f9302e9e6b5390
SHA10b094267973bfeefdbc7b0d76700146f581635cf
SHA256927feb4c36f26b9d3bac33d4e621e095a2b27917dca616999117b0cda44ad37b
SHA512e35b910862777f98ff5c12cf0d31aadd97c877ba1076b77b38ae95974d73c6c2ee766353e668f0354a38beb0359aa0a53218e8f5828478e5b8b3aad659c39a2c
-
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.21_(x64)_20230820144524_002_dotnet_host_6.0.21_win_x64.msi.log
Filesize2KB
MD51029e60333ff6d75fb7479b07ffd79a6
SHA17a4fdeb193630955b586862c01f89938e95dfd50
SHA256e9a70ef68e7e46aabf9de1881ba1f5a6d3ad4827c13a2c00805bd5da0a6b4379
SHA512555cb7085bd099b03faf0c0cf6aeb81909741e8d028fe67e6307be849bca6c4a3cea483ba6048300a2074783c6ac41527ad232e3e218ed46c3bcc99ada2fa941
-
C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.21_(x64)_20230820144524_003_windowsdesktop_runtime_6.0.21_win_x64.msi.log
Filesize2KB
MD5882f2a0030fe615971601fff7fe1d1d4
SHA117b4e2096c524d2698cd96cc238ac74b270540f8
SHA2561fbf43990684d4bfd55f2326e184f1d5ac1529e43f3fa23bab8ff0122aa859a9
SHA512cd87e51d8c326520ffa69f9eefd4553c09df312a2f6bc540c7bdde1d4bb36e0c01db8e47b060e8893a073f8ed53cb2108c1ee7d0b33084d1f0740ec3163aa0e2
-
Filesize
225KB
MD5d711da8a6487aea301e05003f327879f
SHA1548d3779ed3ab7309328f174bfb18d7768d27747
SHA2563d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283
SHA512c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681
-
Filesize
225KB
MD5d711da8a6487aea301e05003f327879f
SHA1548d3779ed3ab7309328f174bfb18d7768d27747
SHA2563d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283
SHA512c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681
-
Filesize
225KB
MD5d711da8a6487aea301e05003f327879f
SHA1548d3779ed3ab7309328f174bfb18d7768d27747
SHA2563d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283
SHA512c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681
-
Filesize
225KB
MD5d711da8a6487aea301e05003f327879f
SHA1548d3779ed3ab7309328f174bfb18d7768d27747
SHA2563d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283
SHA512c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681
-
Filesize
225KB
MD5d711da8a6487aea301e05003f327879f
SHA1548d3779ed3ab7309328f174bfb18d7768d27747
SHA2563d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283
SHA512c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681
-
Filesize
225KB
MD5d711da8a6487aea301e05003f327879f
SHA1548d3779ed3ab7309328f174bfb18d7768d27747
SHA2563d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283
SHA512c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681
-
Filesize
225KB
MD5d711da8a6487aea301e05003f327879f
SHA1548d3779ed3ab7309328f174bfb18d7768d27747
SHA2563d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283
SHA512c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681
-
Filesize
225KB
MD5d711da8a6487aea301e05003f327879f
SHA1548d3779ed3ab7309328f174bfb18d7768d27747
SHA2563d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283
SHA512c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681
-
Filesize
225KB
MD5d711da8a6487aea301e05003f327879f
SHA1548d3779ed3ab7309328f174bfb18d7768d27747
SHA2563d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283
SHA512c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681
-
Filesize
25.7MB
MD50fda2bb0ba0c1dd265e9540265a035b7
SHA103461f9f268e5ec0a997990c05b16086a03505dc
SHA256bb994af42653ab3738ea3b689f6870c2549f6f170f23a1a8a161c7e02ccec9b1
SHA512acdcb21c4ac6587b7a7cc43078a075f2f06d71823ace65e175611e0ef8af2bc7c753b7618447ba6d9f24cbea63cf582bcd5f71ca3b7a79066ca6cd61c43ed7d6
-
Filesize
804KB
MD55dce0ef6b5d0bd2b850106a22b5e0264
SHA1263cfbd815de6b877d084ab4b3d2f878d71c9b1f
SHA256c98010f7c473bdb2a182e61aae35a20c044006fee26ffb378346cbdf255d2736
SHA512fc7297d142cf8d0247ac86732182a031e819a4fc41b034d1b9a7dba5cdb56d73e158dd57132b6a083b3f6184859b4dca4a1a21205f6d11b2be6ca3913e89891b
-
Filesize
28.5MB
MD56ec2d8f7944d0766603fa3b043fe2410
SHA1000a79c4792abbfdf65ca3b5367b7a3b02146732
SHA256619074e13358e2c259086bf306083229ae8d3472187bc755951413858949cb68
SHA5124f86befae9a437985e4ae491f416b0c06a72344ffccfb00c325e91d48244b46edee784003c0a519bc39fdb14409d949c7fe7cde7f51b3479d504c61d88f6371b
-
C:\Windows\Temp\{A258B757-EECB-43E1-9DE7-5AFBCAE28DAD}\.cr\windowsdesktop-runtime-6.0.21-win-x64.exe
Filesize610KB
MD5ff67a2a55ed6998ab527273d547fc00f
SHA1852712b95ca05de8f336f07ff9ac672281b91215
SHA25671dc12e39274b7a94f1a44b1ebe1a1507adf9884db5fdcd4cd9346b4c9fbe0c9
SHA51248eb6bcb087d23ffb4e85501d23e55a4a15e8e0d2b4ca402a46df5946640f7e33c47deb785142af0fbc8cb10b6f9731500a370168cb43fd02642b29a880151d9
-
C:\Windows\Temp\{A258B757-EECB-43E1-9DE7-5AFBCAE28DAD}\.cr\windowsdesktop-runtime-6.0.21-win-x64.exe
Filesize610KB
MD5ff67a2a55ed6998ab527273d547fc00f
SHA1852712b95ca05de8f336f07ff9ac672281b91215
SHA25671dc12e39274b7a94f1a44b1ebe1a1507adf9884db5fdcd4cd9346b4c9fbe0c9
SHA51248eb6bcb087d23ffb4e85501d23e55a4a15e8e0d2b4ca402a46df5946640f7e33c47deb785142af0fbc8cb10b6f9731500a370168cb43fd02642b29a880151d9
-
Filesize
4KB
MD59eb0320dfbf2bd541e6a55c01ddc9f20
SHA1eb282a66d29594346531b1ff886d455e1dcd6d99
SHA2569095bf7b6baa0107b40a4a6d727215be077133a190f4ca9bd89a176842141e79
SHA5129ada3a1757a493fbb004bd767fab8f77430af69d71479f340b8b8ede904cc94cd733700db593a4a2d2e1184c0081fd0648318d867128e1cb461021314990931d
-
C:\Windows\Temp\{FDF572CD-FDDD-41DD-9FC7-B64BB691A505}\.be\windowsdesktop-runtime-6.0.21-win-x64.exe
Filesize610KB
MD5ff67a2a55ed6998ab527273d547fc00f
SHA1852712b95ca05de8f336f07ff9ac672281b91215
SHA25671dc12e39274b7a94f1a44b1ebe1a1507adf9884db5fdcd4cd9346b4c9fbe0c9
SHA51248eb6bcb087d23ffb4e85501d23e55a4a15e8e0d2b4ca402a46df5946640f7e33c47deb785142af0fbc8cb10b6f9731500a370168cb43fd02642b29a880151d9
-
C:\Windows\Temp\{FDF572CD-FDDD-41DD-9FC7-B64BB691A505}\.be\windowsdesktop-runtime-6.0.21-win-x64.exe
Filesize610KB
MD5ff67a2a55ed6998ab527273d547fc00f
SHA1852712b95ca05de8f336f07ff9ac672281b91215
SHA25671dc12e39274b7a94f1a44b1ebe1a1507adf9884db5fdcd4cd9346b4c9fbe0c9
SHA51248eb6bcb087d23ffb4e85501d23e55a4a15e8e0d2b4ca402a46df5946640f7e33c47deb785142af0fbc8cb10b6f9731500a370168cb43fd02642b29a880151d9
-
C:\Windows\Temp\{FDF572CD-FDDD-41DD-9FC7-B64BB691A505}\.be\windowsdesktop-runtime-6.0.21-win-x64.exe
Filesize610KB
MD5ff67a2a55ed6998ab527273d547fc00f
SHA1852712b95ca05de8f336f07ff9ac672281b91215
SHA25671dc12e39274b7a94f1a44b1ebe1a1507adf9884db5fdcd4cd9346b4c9fbe0c9
SHA51248eb6bcb087d23ffb4e85501d23e55a4a15e8e0d2b4ca402a46df5946640f7e33c47deb785142af0fbc8cb10b6f9731500a370168cb43fd02642b29a880151d9
-
Filesize
736KB
MD512b8c5914e56f4bd933c8490f7f6cd45
SHA12ec135cdd97adbcfe7decb04f1a5e95b6f0614e3
SHA2563b83682de5bfeabde75ffc34330f470df11ce5e62c2509c50b3e48e35130fa51
SHA512ecc9ddd52d097ca6f643f7ce78399b01d37e776e30abb8b82b6278711716e6893528340b6719f8287848931759ae41427c252cb00df97742583dbe5d7ea4277a
-
Filesize
804KB
MD55dce0ef6b5d0bd2b850106a22b5e0264
SHA1263cfbd815de6b877d084ab4b3d2f878d71c9b1f
SHA256c98010f7c473bdb2a182e61aae35a20c044006fee26ffb378346cbdf255d2736
SHA512fc7297d142cf8d0247ac86732182a031e819a4fc41b034d1b9a7dba5cdb56d73e158dd57132b6a083b3f6184859b4dca4a1a21205f6d11b2be6ca3913e89891b
-
Filesize
25.7MB
MD50fda2bb0ba0c1dd265e9540265a035b7
SHA103461f9f268e5ec0a997990c05b16086a03505dc
SHA256bb994af42653ab3738ea3b689f6870c2549f6f170f23a1a8a161c7e02ccec9b1
SHA512acdcb21c4ac6587b7a7cc43078a075f2f06d71823ace65e175611e0ef8af2bc7c753b7618447ba6d9f24cbea63cf582bcd5f71ca3b7a79066ca6cd61c43ed7d6
-
Filesize
28.5MB
MD56ec2d8f7944d0766603fa3b043fe2410
SHA1000a79c4792abbfdf65ca3b5367b7a3b02146732
SHA256619074e13358e2c259086bf306083229ae8d3472187bc755951413858949cb68
SHA5124f86befae9a437985e4ae491f416b0c06a72344ffccfb00c325e91d48244b46edee784003c0a519bc39fdb14409d949c7fe7cde7f51b3479d504c61d88f6371b
-
Filesize
225KB
MD5d711da8a6487aea301e05003f327879f
SHA1548d3779ed3ab7309328f174bfb18d7768d27747
SHA2563d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283
SHA512c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681
-
Filesize
225KB
MD5d711da8a6487aea301e05003f327879f
SHA1548d3779ed3ab7309328f174bfb18d7768d27747
SHA2563d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283
SHA512c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681
-
Filesize
225KB
MD5d711da8a6487aea301e05003f327879f
SHA1548d3779ed3ab7309328f174bfb18d7768d27747
SHA2563d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283
SHA512c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681
-
Filesize
225KB
MD5d711da8a6487aea301e05003f327879f
SHA1548d3779ed3ab7309328f174bfb18d7768d27747
SHA2563d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283
SHA512c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681
-
Filesize
225KB
MD5d711da8a6487aea301e05003f327879f
SHA1548d3779ed3ab7309328f174bfb18d7768d27747
SHA2563d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283
SHA512c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681
-
Filesize
225KB
MD5d711da8a6487aea301e05003f327879f
SHA1548d3779ed3ab7309328f174bfb18d7768d27747
SHA2563d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283
SHA512c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681
-
Filesize
225KB
MD5d711da8a6487aea301e05003f327879f
SHA1548d3779ed3ab7309328f174bfb18d7768d27747
SHA2563d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283
SHA512c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681
-
Filesize
225KB
MD5d711da8a6487aea301e05003f327879f
SHA1548d3779ed3ab7309328f174bfb18d7768d27747
SHA2563d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283
SHA512c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681
-
Filesize
197KB
MD54356ee50f0b1a878e270614780ddf095
SHA1b5c0915f023b2e4ed3e122322abc40c4437909af
SHA25641a8787fdc9467f563438daba4131191aa1eb588a81beb9a89fe8bd886c16104
SHA512b9e482efe9189683dabfc9feff8b386d7eba4ecf070f42a1eebee6052cfb181a19497f831f1ea6429cfcce1d4865a5d279b24bd738d702902e9887bb9f0c4691