163b72f08fd988f4bc5688c8b95ceff4fd827d536dcccc72ea7421abaa1b8b34

Analysis

max time kernel
252s
max time network
242s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31-12-2023 22:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

LocalCooling2.msi
Size

3.9MB
MD5

a223dca66661d5625459d2b5fd465304
SHA1

6b4a29bd8afcfaba983335bf5665a0c2203279b5
SHA256

59c6e708a2694c3e83d72ab195c38e2dfcb55e4662de9015e8397592692fd948
SHA512

c94e12544536c9520a4f0d8e3347f59b7b415bcc978ead53982588c79369d3e0cb73a989aa300017d8f91b47ddaa76af88437a0c7efe1e260b393859387cea66
SSDEEP

98304:MgXge0/vIpzeeFoOAwToCh61Mhm3AVrwMr1hD4TyXh:MgXgeSIpKOAWI3AVrwMxt4T

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Local Cooling Setup.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Control Panel\International\Geo\Nation	Local Cooling Setup.exe

Drops startup file 1 IoCs

Processes:

msiexec.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LocalCooling.lnk msiexec.exe
Executes dropped EXE 3 IoCs

Processes:

{53F120D8-EC02-4B68-8397-7F938B50A300}.exeLocal Cooling Setup.exelocalcooling2.exe

pid process

212 {53F120D8-EC02-4B68-8397-7F938B50A300}.exe
5784 Local Cooling Setup.exe
4764 localcooling2.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LocalCooling.lnk	msiexec.exe

pid	process
212	{53F120D8-EC02-4B68-8397-7F938B50A300}.exe
5784	Local Cooling Setup.exe
4764	localcooling2.exe

Loads dropped DLL 10 IoCs

Processes:

MsiExec.exeLocal Cooling Setup.exeMsiExec.exe

pid	process
5820	MsiExec.exe
5784	Local Cooling Setup.exe
5784	Local Cooling Setup.exe
5784	Local Cooling Setup.exe
5784	Local Cooling Setup.exe
2672	MsiExec.exe
2672	MsiExec.exe
2672	MsiExec.exe
2672	MsiExec.exe
2672	MsiExec.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe

Drops file in Program Files directory 1 IoCs

Processes:

msiexec.exe

description ioc process

File created C:\Program Files (x86)\Uniblue\LocalCooling\localcooling2.exe msiexec.exe

description	ioc	process
File created	C:\Program Files (x86)\Uniblue\LocalCooling\localcooling2.exe	msiexec.exe

Drops file in Windows directory 28 IoCs

Processes:

msiexec.exe

description	ioc	process
File opened for modification	C:\Windows\Installer\MSI8DC4.tmp	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20231231221638684.0\msvcm80.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20231231221639137.0\8.0.50727.762.policy	msiexec.exe
File created	C:\Windows\Installer\e58ee62.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF691.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{79166E9D-4D2B-405A-B8F5-B43E0C795FF2}	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20231231221638684.0\msvcp80.dll	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20231231221638684.0	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20231231221638684.0\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700.manifest	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20231231221638684.0\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700.cat	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF17F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8D56.tmp	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20231231221638684.0\msvcr80.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8B02.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8CA9.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8FCA.tmp	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20231231221639137.0\8.0.50727.762.cat	msiexec.exe
File created	C:\Windows\Installer\e58ee69.msi	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20231231221639137.0	msiexec.exe
File opened for modification	C:\Windows\Installer\e58ee62.msi	msiexec.exe
File created	C:\Windows\Installer\e58ee64.msi	msiexec.exe
File created	C:\Windows\Installer\e58ee65.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e58ee65.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{A9547F93-3477-4057-8BA3-AB85BA5FA4FE}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8EDE.tmp	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

vssvc.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000006c2b12180e4adb550000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800006c2b12180000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809006c2b1218000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d6c2b1218000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000006c2b121800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Control Panel 18 IoCs

evasion

Processes:

localcooling2.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Control Panel\PowerCfg	localcooling2.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Control Panel\PowerCfg\PowerPolicies\6\Policies = 01000000020000000100000000000000020000000000000000000000000000002c0100003232000304000000040000000000000000000000840300008403000000000000580200000101645064640000	localcooling2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Control Panel\PowerCfg\PowerPolicies\6\Description = "Local Cooling - Power Policy"	localcooling2.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Control Panel\PowerCfg\PowerPolicies\6\Policies = 01000000040000000100000000000000040000000000000000000000000000000000000032320003040000000400000000000000000000008403000084030000100e0000100e00000101645064640000	localcooling2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Control Panel\PowerCfg\PowerPolicies\6\Name = "LocalCooling"	localcooling2.exe
Key created	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Control Panel\PowerCfg\GlobalPowerPolicy	localcooling2.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Control Panel\PowerCfg\PowerPolicies\6\Policies = 01000000020000000100000000000000020000000000000000000000000000002c01000032320003040000000400000000000000000000008403000084030000100e0000100e00000101645064640000	localcooling2.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Control Panel\PowerCfg\PowerPolicies\0\Policies = 01000000020000000100000000000000020000000000000000000000000000002c0100003232000304000000040000000000000000000000b00400002c01000000000000580200000101645064640000	localcooling2.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Control Panel\PowerCfg\PowerPolicies\6	localcooling2.exe
Key created	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Control Panel\PowerCfg\PowerPolicies\6	localcooling2.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Control Panel\PowerCfg\GlobalPowerPolicy\Policies = 01000000060000000300000010000000060000000300000010000000020000000300000000000000020000000300000000000000020000000100000000000000020000000100000000000000000000000500000000000000000000c00100000005000000000000000a0000000000000003000000010001000100000000000000000000000000000000000000000002000000000000000000000000000000000000000000000003000000000016000000	localcooling2.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Control Panel\PowerCfg\PowerPolicies\6\Policies = 01000000040000000100000000000000040000000000000000000000000000000000000032320003040000000400000000000000000000002c0100002c010000100e0000100e00000101645064640000	localcooling2.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Control Panel\PowerCfg\PowerPolicies\6\Policies = 01000000040000000100000000000000040000000000000000000000100e0000100e000032320003040000000400000000000000000000002c0100002c01000084030000840300000101645064640000	localcooling2.exe
Key created	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Control Panel\PowerCfg\PowerPolicies\0	localcooling2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Control Panel\PowerCfg\CurrentPowerPolicy = "6"	localcooling2.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Control Panel\PowerCfg\PowerPolicies\6\Policies = 01000000020000000100000000000000020000000000000000000000000000000000000032320003040000000400000000000000000000008403000084030000100e0000100e00000101645064640000	localcooling2.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Control Panel\PowerCfg\PowerPolicies\6\Policies = 01000000040000000100000000000000040000000000000000000000000000000000000032320003040000000400000000000000000000002c0100002c01000084030000840300000101645064640000	localcooling2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Control Panel\PowerCfg\CurrentPowerPolicy = "0"	localcooling2.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

msedge.exemsedge.exemsedge.exemsedge.exeidentity_helper.exemsiexec.exemsedge.exelocalcooling2.exe

pid	process
4148	msedge.exe
4148	msedge.exe
2812	msedge.exe
2812	msedge.exe
4780	msedge.exe
4780	msedge.exe
5344	msedge.exe
5344	msedge.exe
6096	identity_helper.exe
6096	identity_helper.exe
5096	msiexec.exe
5096	msiexec.exe
5096	msiexec.exe
5096	msiexec.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4764	localcooling2.exe
4764	localcooling2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

Processes:

msedge.exe

pid process

2812 msedge.exe
2812 msedge.exe
2812 msedge.exe
2812 msedge.exe
2812 msedge.exe
2812 msedge.exe
2812 msedge.exe
2812 msedge.exe
2812 msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

msiexec.exemsiexec.exevssvc.exe

description	pid	process
Token: SeShutdownPrivilege	1288	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1288	msiexec.exe
Token: SeSecurityPrivilege	5096	msiexec.exe
Token: SeCreateTokenPrivilege	1288	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1288	msiexec.exe
Token: SeLockMemoryPrivilege	1288	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1288	msiexec.exe
Token: SeMachineAccountPrivilege	1288	msiexec.exe
Token: SeTcbPrivilege	1288	msiexec.exe
Token: SeSecurityPrivilege	1288	msiexec.exe
Token: SeTakeOwnershipPrivilege	1288	msiexec.exe
Token: SeLoadDriverPrivilege	1288	msiexec.exe
Token: SeSystemProfilePrivilege	1288	msiexec.exe
Token: SeSystemtimePrivilege	1288	msiexec.exe
Token: SeProfSingleProcessPrivilege	1288	msiexec.exe
Token: SeIncBasePriorityPrivilege	1288	msiexec.exe
Token: SeCreatePagefilePrivilege	1288	msiexec.exe
Token: SeCreatePermanentPrivilege	1288	msiexec.exe
Token: SeBackupPrivilege	1288	msiexec.exe
Token: SeRestorePrivilege	1288	msiexec.exe
Token: SeShutdownPrivilege	1288	msiexec.exe
Token: SeDebugPrivilege	1288	msiexec.exe
Token: SeAuditPrivilege	1288	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1288	msiexec.exe
Token: SeChangeNotifyPrivilege	1288	msiexec.exe
Token: SeRemoteShutdownPrivilege	1288	msiexec.exe
Token: SeUndockPrivilege	1288	msiexec.exe
Token: SeSyncAgentPrivilege	1288	msiexec.exe
Token: SeEnableDelegationPrivilege	1288	msiexec.exe
Token: SeManageVolumePrivilege	1288	msiexec.exe
Token: SeImpersonatePrivilege	1288	msiexec.exe
Token: SeCreateGlobalPrivilege	1288	msiexec.exe
Token: SeBackupPrivilege	4784	vssvc.exe
Token: SeRestorePrivilege	4784	vssvc.exe
Token: SeAuditPrivilege	4784	vssvc.exe
Token: SeBackupPrivilege	5096	msiexec.exe
Token: SeRestorePrivilege	5096	msiexec.exe
Token: SeRestorePrivilege	5096	msiexec.exe
Token: SeTakeOwnershipPrivilege	5096	msiexec.exe
Token: SeRestorePrivilege	5096	msiexec.exe
Token: SeTakeOwnershipPrivilege	5096	msiexec.exe
Token: SeRestorePrivilege	5096	msiexec.exe
Token: SeTakeOwnershipPrivilege	5096	msiexec.exe
Token: SeRestorePrivilege	5096	msiexec.exe
Token: SeTakeOwnershipPrivilege	5096	msiexec.exe
Token: SeRestorePrivilege	5096	msiexec.exe
Token: SeTakeOwnershipPrivilege	5096	msiexec.exe
Token: SeRestorePrivilege	5096	msiexec.exe
Token: SeTakeOwnershipPrivilege	5096	msiexec.exe
Token: SeRestorePrivilege	5096	msiexec.exe
Token: SeTakeOwnershipPrivilege	5096	msiexec.exe
Token: SeRestorePrivilege	5096	msiexec.exe
Token: SeTakeOwnershipPrivilege	5096	msiexec.exe
Token: SeRestorePrivilege	5096	msiexec.exe
Token: SeTakeOwnershipPrivilege	5096	msiexec.exe
Token: SeRestorePrivilege	5096	msiexec.exe
Token: SeTakeOwnershipPrivilege	5096	msiexec.exe
Token: SeRestorePrivilege	5096	msiexec.exe
Token: SeTakeOwnershipPrivilege	5096	msiexec.exe
Token: SeRestorePrivilege	5096	msiexec.exe
Token: SeTakeOwnershipPrivilege	5096	msiexec.exe
Token: SeRestorePrivilege	5096	msiexec.exe
Token: SeTakeOwnershipPrivilege	5096	msiexec.exe
Token: SeRestorePrivilege	5096	msiexec.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

msiexec.exemsedge.exe

pid	process
1288	msiexec.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

msedge.exe

pid	process
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exemsedge.exemsedge.exemsedge.exe

description	pid	process	target process
PID 1368 wrote to memory of 2944	1368	msedge.exe	msedge.exe
PID 1368 wrote to memory of 2944	1368	msedge.exe	msedge.exe
PID 3136 wrote to memory of 4768	3136	msedge.exe	msedge.exe
PID 3136 wrote to memory of 4768	3136	msedge.exe	msedge.exe
PID 1436 wrote to memory of 4960	1436	msedge.exe	msedge.exe
PID 1436 wrote to memory of 4960	1436	msedge.exe	msedge.exe
PID 2812 wrote to memory of 4748	2812	msedge.exe	msedge.exe
PID 2812 wrote to memory of 4748	2812	msedge.exe	msedge.exe
PID 2812 wrote to memory of 4172	2812	msedge.exe	msedge.exe
PID 2812 wrote to memory of 4172	2812	msedge.exe	msedge.exe
PID 2812 wrote to memory of 4172	2812	msedge.exe	msedge.exe
PID 2812 wrote to memory of 4172	2812	msedge.exe	msedge.exe
PID 2812 wrote to memory of 4172	2812	msedge.exe	msedge.exe
PID 2812 wrote to memory of 4172	2812	msedge.exe	msedge.exe
PID 2812 wrote to memory of 4172	2812	msedge.exe	msedge.exe
PID 2812 wrote to memory of 4172	2812	msedge.exe	msedge.exe
PID 2812 wrote to memory of 4172	2812	msedge.exe	msedge.exe
PID 2812 wrote to memory of 4172	2812	msedge.exe	msedge.exe
PID 2812 wrote to memory of 4172	2812	msedge.exe	msedge.exe
PID 2812 wrote to memory of 4172	2812	msedge.exe	msedge.exe
PID 2812 wrote to memory of 4172	2812	msedge.exe	msedge.exe
PID 2812 wrote to memory of 4172	2812	msedge.exe	msedge.exe
PID 2812 wrote to memory of 4172	2812	msedge.exe	msedge.exe
PID 2812 wrote to memory of 4172	2812	msedge.exe	msedge.exe
PID 2812 wrote to memory of 4172	2812	msedge.exe	msedge.exe
PID 2812 wrote to memory of 4172	2812	msedge.exe	msedge.exe
PID 2812 wrote to memory of 4172	2812	msedge.exe	msedge.exe
PID 2812 wrote to memory of 4172	2812	msedge.exe	msedge.exe
PID 2812 wrote to memory of 4172	2812	msedge.exe	msedge.exe
PID 2812 wrote to memory of 4172	2812	msedge.exe	msedge.exe
PID 2812 wrote to memory of 4172	2812	msedge.exe	msedge.exe
PID 2812 wrote to memory of 4172	2812	msedge.exe	msedge.exe
PID 2812 wrote to memory of 4172	2812	msedge.exe	msedge.exe
PID 2812 wrote to memory of 4172	2812	msedge.exe	msedge.exe
PID 2812 wrote to memory of 4172	2812	msedge.exe	msedge.exe
PID 2812 wrote to memory of 4172	2812	msedge.exe	msedge.exe
PID 2812 wrote to memory of 4172	2812	msedge.exe	msedge.exe
PID 2812 wrote to memory of 4172	2812	msedge.exe	msedge.exe
PID 2812 wrote to memory of 4172	2812	msedge.exe	msedge.exe
PID 2812 wrote to memory of 4172	2812	msedge.exe	msedge.exe
PID 2812 wrote to memory of 4172	2812	msedge.exe	msedge.exe
PID 2812 wrote to memory of 4172	2812	msedge.exe	msedge.exe
PID 2812 wrote to memory of 4172	2812	msedge.exe	msedge.exe
PID 2812 wrote to memory of 4172	2812	msedge.exe	msedge.exe
PID 2812 wrote to memory of 4172	2812	msedge.exe	msedge.exe
PID 2812 wrote to memory of 4172	2812	msedge.exe	msedge.exe
PID 2812 wrote to memory of 4172	2812	msedge.exe	msedge.exe
PID 2812 wrote to memory of 4172	2812	msedge.exe	msedge.exe
PID 2812 wrote to memory of 4148	2812	msedge.exe	msedge.exe
PID 2812 wrote to memory of 4148	2812	msedge.exe	msedge.exe
PID 2812 wrote to memory of 5068	2812	msedge.exe	msedge.exe
PID 2812 wrote to memory of 5068	2812	msedge.exe	msedge.exe
PID 2812 wrote to memory of 5068	2812	msedge.exe	msedge.exe
PID 2812 wrote to memory of 5068	2812	msedge.exe	msedge.exe
PID 2812 wrote to memory of 5068	2812	msedge.exe	msedge.exe
PID 2812 wrote to memory of 5068	2812	msedge.exe	msedge.exe
PID 2812 wrote to memory of 5068	2812	msedge.exe	msedge.exe
PID 2812 wrote to memory of 5068	2812	msedge.exe	msedge.exe
PID 2812 wrote to memory of 5068	2812	msedge.exe	msedge.exe
PID 2812 wrote to memory of 5068	2812	msedge.exe	msedge.exe
PID 2812 wrote to memory of 5068	2812	msedge.exe	msedge.exe
PID 2812 wrote to memory of 5068	2812	msedge.exe	msedge.exe
PID 2812 wrote to memory of 5068	2812	msedge.exe	msedge.exe
PID 2812 wrote to memory of 5068	2812	msedge.exe	msedge.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\LocalCooling2.msi
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1288

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Drops startup file
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5096

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
2⤵
PID:3000

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 339FDEB084A18EFD66346F1C1E500843
2⤵
- Loads dropped DLL
PID:5820

C:\Users\Admin\AppData\Local\Temp\{53F120D8-EC02-4B68-8397-7F938B50A300}.exe
"C:\Users\Admin\AppData\Local\Temp\{53F120D8-EC02-4B68-8397-7F938B50A300}.exe" "/g=C:\Users\Admin\AppData\Local\Temp\" ALLUSERS=FALSE
3⤵
- Executes dropped EXE
PID:212

C:\Users\Admin\AppData\Local\Temp\miaF6A0.tmp\Local Cooling Setup.exe
".\Local Cooling Setup.exe" "/g=C:\Users\Admin\AppData\Local\Temp\" ALLUSERS=FALSE /m="C:\Users\Admin\AppData\Local\Temp\{53F12~1.EXE" /k=""
4⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
PID:5784

C:\Program Files (x86)\Uniblue\LocalCooling\localcooling2.exe
"C:\Program Files (x86)\Uniblue\LocalCooling\localcooling2.exe"
5⤵
- Executes dropped EXE
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
PID:4764

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 1AD662092D7A4A733B94BE90905B31BB
2⤵
- Loads dropped DLL
PID:2672

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Suspicious use of WriteProcessMemory
PID:1436

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf8,0x124,0x7ffe370b46f8,0x7ffe370b4708,0x7ffe370b4718
2⤵
PID:4960

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2176,1902310947328127673,7564510932219885837,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4780

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2176,1902310947328127673,7564510932219885837,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
2⤵
PID:1616

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Suspicious use of WriteProcessMemory
PID:3136

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffe370b46f8,0x7ffe370b4708,0x7ffe370b4718
2⤵
PID:4768

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1496,10971071971730474379,17064460935537610416,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 /prefetch:3
2⤵
PID:5488

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Suspicious use of WriteProcessMemory
PID:1368

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffe370b46f8,0x7ffe370b4708,0x7ffe370b4718
2⤵
PID:2944

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1972,8333353832109550332,13939931629956522542,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2000 /prefetch:2
2⤵
PID:5124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1972,8333353832109550332,13939931629956522542,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2100 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5344

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2812

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe370b46f8,0x7ffe370b4708,0x7ffe370b4718
2⤵
PID:4748

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,55533789613009297,641214731917644866,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4148

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,55533789613009297,641214731917644866,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
2⤵
PID:4172

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,55533789613009297,641214731917644866,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2692 /prefetch:8
2⤵
PID:5068

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,55533789613009297,641214731917644866,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
2⤵
PID:4584

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,55533789613009297,641214731917644866,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
2⤵
PID:4100

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,55533789613009297,641214731917644866,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:1
2⤵
PID:6100

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,55533789613009297,641214731917644866,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1
2⤵
PID:6092

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,55533789613009297,641214731917644866,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:1
2⤵
PID:5264

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,55533789613009297,641214731917644866,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4864 /prefetch:1
2⤵
PID:5832

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,55533789613009297,641214731917644866,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5940 /prefetch:1
2⤵
PID:5148

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,55533789613009297,641214731917644866,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4740 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:6096

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,55533789613009297,641214731917644866,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4740 /prefetch:8
2⤵
PID:5140

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,55533789613009297,641214731917644866,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:1
2⤵
PID:1164

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,55533789613009297,641214731917644866,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5844 /prefetch:1
2⤵
PID:5228

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,55533789613009297,641214731917644866,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1968 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4316

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4784

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5208

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e58ee63.rbs
Filesize
8KB

MD5
8433ee321c6ed5e65386edb244f8a7b0

SHA1
20462b8d035a23a9e808e422ec85f932dc95b285

SHA256
67e74524655d87ab79c1430008670c6556a1b060bfad0fe158dc8b5e5eed3eca

SHA512
8ecb31f052766364c4b465c8501411a52fe2b11c7bcb85800f956398c23d6b854a03f5e82bc15b00aa5763d8b6676bf085f35652ee830e34bf1897370f9bb621

Download Submit
C:\Config.Msi\e58ee68.rbs
Filesize
20KB

MD5
4c1d4a8039452d5980d55dd97fd583c4

SHA1
048f40524defaacc804c5723c5ee1c8dca0d7d2e

SHA256
462074c0a4a17f207d3dfe733ff65a85e2e22e19ed6a04c6d0255af171e58b49

SHA512
74ee5cdd4279002c0b8c17896d8dcb32a1dcd97b6adef226ccf918e7f4aea4a6b7191e4fe0ec0f6a3bba8dd9d0e30371f84e174eeb5130e7d6bed39bc4c92e8c

Download Submit
C:\Program Files (x86)\Uniblue\LocalCooling\localcooling2.exe
Filesize
4.8MB

MD5
8cbb820f4f48c6c8d5275dc7b74d0524

SHA1
9f1276766136ca15a50e0cf07cc3dbc73c92aa29

SHA256
e95125d7f9002dc20ac4391c65e5a8a7b01d507f3def9626a8d8fb20be95a787

SHA512
b801fafac1f03d0c2d335b2945a0c2379491b45e9104f599e9f6e6b4e9c0940a06909ba084befd3d049207956298a770b62cbd4a51c9cf2c26715d756f8df872

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
7a5862a0ca86c0a4e8e0b30261858e1f

SHA1
ee490d28e155806d255e0f17be72509be750bf97

SHA256
92b4c004a9ec97ccf7a19955926982bac099f3b438cd46063bb9bf5ac7814a4b

SHA512
0089df12ed908b4925ba838e07128987afe1c9235097b62855122a03ca6d34d7c75fe4c30e68581c946b77252e7edf1dd66481e20c0a9cccd37e0a4fe4f0a6fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
51ccd7d9a9392ebca4c1ae898d683d2f

SHA1
f4943c31cc7f0ca3078e57e0ebea424fbd9691c4

SHA256
e36c7d688cd7d187eacc4fc1ccdd2968de91cee60f15ecb0e0d874da07be7665

SHA512
e3773c19314c66f09c0f556ade29cd63d84cc778be64060a570eed8f6c7918b7d09d2694d9e2d379bdaecb4e20cb140749a8111ef267c67a620d64cb598e0619

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
e2b2504ad7cd6dec8288fdbf13ba114f

SHA1
b1ed0ea5d850552a825cdf5b141cd44ab23582b5

SHA256
4662a5da528e2f9e52c5f1e5814fcbda5645541a1a47fac92073019ec43f59f0

SHA512
1f762ab4c5a0e49f063d5e6dd7bc83cf8c2f103907690e43730a1502c643267f23ea434b916caed4c839b86d19a7be2ed82cccb6831fe8caafa3213c93d6de19

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
caada9b67895226cfb4aa1a1ac2c5c42

SHA1
451070dba197481c6c47aac9624c47f71477f4de

SHA256
63c032d4c0d47264ede92a7264d6a07f0b8bbf0f78581bf40b9e0015e2ecb9e6

SHA512
4a3c3aed0233f06057b7184339a3ae757f2d628e0add75aba030e9c1089ebb14509906fbaebfdd581b0fc440acc6c122617c2c64d4fddbef7c5b9e97f7f459fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
9725135b80a86fc49cdae9f3d044380e

SHA1
3b57fe305ab7dc4690849ede10ec7239f0451a17

SHA256
e940ed92d4d4a88c1b8f0c521b7955b5f136d0ab332bd48843946d14dac582da

SHA512
5bad39b313f286a04b8d882e4a926b7302910d9afd169a2b001d927a2a7dc7bcc7a697af12a2f2214a9534b28c33bd54e8651295dd87f62efe7904ac3e3be6cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Filesize
24KB

MD5
52826cef6409f67b78148b75e442b5ea

SHA1
a675db110aae767f5910511751cc3992cddcc393

SHA256
98fc43994599573e7181c849e5865f23b4f05f85c1115dff53c58764d80373fb

SHA512
f18df18cab6b5ecd71b79c81a2a1fdac42cc9960f62f06ac25f4d6487792705f2766ee3a10239eaac940d090186e6bc820e4eb7a5ee138f6e5c1c64f951b960c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
2KB

MD5
0d34c4e646dd5db86f31f12e91f1ae66

SHA1
764035b9eeff99807ec5a48eb34fe8ba09defc8d

SHA256
e89554104bdfa2183b0bb9c56ff0cf373a6f9ef3bcf30df77441bed5d330770e

SHA512
ac3bfeefb3b1cb5a2ad565bfa2f4434d641ef198da219b74d32af25c75e3634185398279ea07903d768d3761d49ac4458d2deebcce745cac3b6f41c18ead5005

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
2KB

MD5
7801492f3abf53de1504efaf4c5506f0

SHA1
4b80eb2e1cd88038fb76b46e3426d36f0305d5a9

SHA256
f01b634ed3c800d4d313bda2c49065e874c655941a2a53c8faf9c6867a32b653

SHA512
01f73b365d06dfd41ed3df39bf9253ccfd49da4f5edfad6d0b3812f9fa40d69674b978f5d461bb9ccbd8b4dbed020877d0b3fc273979abf875c8a7d6e9269add

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
2KB

MD5
a15662f4d6b13349923732f98784b67a

SHA1
b0211c01d1564345158490249cd0edaf92d89859

SHA256
9de882d55c99c8b971f4a93eb3f16a56e1bf90166b7e1315af518cab62146748

SHA512
c7ccc8187442716ea1c25b485120c7b57967ab157f375b1875a0d32170bff656e357afa9710226f1887fb4b050bd348f686e17b705f57710c3c8a0c29e8ef3a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
65b32ca7c36418cd10c3e308564b342f

SHA1
3287643ba757eb3cf255c271992d2b047b8b4930

SHA256
d0802e87a0a902150d5df3b87988970b18e6b4f53fcb5c9e20a84053c2a03038

SHA512
e05a0bcb38fcfecd473c6b3de9929baa742c8717700c718c6d6e1562503f4651df68ea5fa18fd3b6c21f5c42e44c6e1d99353aa3386d2c2bd8144ee174ccd806

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
12KB

MD5
5150f6a6dbd0ad399c274ef7f590b42b

SHA1
6baa02461a2f0eb28b627c2194ecf4d6d5aeba0f

SHA256
8f6121a360eaf54a8450304ce6c0da43018e41afa90a359e4ff1cd4f54f92de5

SHA512
6901e9277ade77a605c9bc2de9f6ef7708292150efb27d475c53cd2f1ea179c062eeac0b5f0f38cf7cd803d2ab5d873849238809da6e3812123cfd10239d1fc6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
12KB

MD5
c332266e9b448946017288ad5c1d307d

SHA1
76873ad284747040c4c7b04a66f4e4898c3ce838

SHA256
5e5efd8c69dc8eba5df6080777b58babde13d6059c4b357a51f74ef05b110a7d

SHA512
a51cf5980195e494f1b9bc45bdcfdfa1748bc6f1cd223be8dc328c4d5a9faa4613f7526bcb1272531d6a8a0cf999c8f2e2bfc049c32b8b2afb33680038eb4812

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
10KB

MD5
c96fd8eb55a2a584ef67234ddf0261e2

SHA1
f3a2a6d89670ae9921fa58644354753f55341b34

SHA256
8ff2d1d96abc82cd7e63abcfeb9b9de1415ff21559a134e8fa39e50a02cf80a3

SHA512
102d498d09b4b13d5c972539549704aa26cc65c189c04fa600ae0a7d0f5b7912c3e40a225d4d6a40dbafd5989dc481cb30dd6843b4e9d04655ace771dbd85788

Download Submit
C:\Users\Admin\AppData\Local\Temp\mia1\DllCheckPwrScheme.dll
Filesize
11KB

MD5
d866e29274e9a0e32297b6cdac65e395

SHA1
eae173f609878a864f2f25edb726970dd95e6c59

SHA256
8fb2734d8a202a9868f94f0369c0741d0c1d738dd96d7b0c75483a3303c32825

SHA512
dc46402c9a419804737b66cd0665cf78ac897eb537873bd1639957e6f13de0fe002018c09ff31a0dbd37c31d5c6c8d70a8ec0d4744935823cbb0722c51ef3ee7

Download Submit
C:\Users\Admin\AppData\Local\Temp\mia1\Local Cooling Setup.msi
Filesize
500KB

MD5
04ed8db8dd57aeb238e9ccea0160282a

SHA1
fcc777d5d70a9e84e906c2d1e78ac9e153b4c8bb

SHA256
6bb4cbd594601b723fac10620d2d232c8759988fbbc0e79e6283c6f82e496c18

SHA512
b14ea74a3b6f68f233665e456a02bef0dad6f69dcd9392e2b3817430c1bb09e25d9bbcefc93b8ae557c887a7525c2de4f31c8942ef0a88999906fcd1937551d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\mia1\Local Cooling Setup.msi
Filesize
500KB

MD5
575a32c6d5357330093ee6b6f0466ca9

SHA1
2367ae0bf684bed517c416f382afea7b49ef75f8

SHA256
de1fc230f273046b75f80f0bccf11bb8fc2bce3122614d3daaa071cf8f3f6939

SHA512
eccb34d83312d95b0e4301d55c533f4700123561a80f4c178d2ffdf952db42bfced172079c0b38b6a6fc8c47ebb6c3fc619aae70f735935a963a13670e58f0d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\mia1\licensecheck.dfm.miaf
Filesize
128B

MD5
26d8eb4cc3defa59f4e8fd1713ea2ab0

SHA1
3d39a67ab169ca9f6ee0a9e2073142b5b75dd1e8

SHA256
d5de1f79d4aea2327a85379fb51ac3157907809043aa1e4aa34878e3e9787442

SHA512
5e3d9b5d65896a5c836babdd892a306863342563fb2d41c56fb342a7e165f0319eca6d24ce2825011ef0b109c304c7c4cb0dc4d0a493bc4281e32ce8970a1acc

Download Submit
C:\Users\Admin\AppData\Local\Temp\mia1\mEXEFunc.dll
Filesize
99KB

MD5
753d2cfcf85e008dfa2d00f045d79e39

SHA1
7b84893ce35f6a3f04f4ec9f873049265f0ef71e

SHA256
86a7055285ff1b82fca333553d692597fc241145f534a160fbfc3b3518458a1d

SHA512
ad2dab8ee86f540996788624ead410327d2db010df5491e56684fbc647ce8fb98af78c4f2703c167a634d74440767046cceaa59cf2cf9b51392afc206dde2996

Download Submit
C:\Users\Admin\AppData\Local\Temp\mia1\mMSIExec.dll
Filesize
423KB

MD5
1db6bed2c2ced33aa5069b5756e9d8d5

SHA1
3632f909ec011c443e617087815623dac75cc11f

SHA256
1b05680b80000e362a83720880fee96d16df28f53bd42838e881558cb9ec6f8c

SHA512
779a8d3b889b746da0e2a382a8fd1e2078e3a3019c2a5f92e4d6a59459f8da51ef1c58c147a6e9110e6753887a47ceeca0a35f2f73e4357592418bb6657ea2ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\mia1\startinstallation.dfm
Filesize
46KB

MD5
eae069b0065ef597597d1a633a3c6208

SHA1
d021bdb4b2c84f61984e88dc2726792c034530d2

SHA256
2d3965106629f70db9c3de99c1a5ebca05ededb757af058e9c8762b071a0d4a1

SHA512
a7f58650959873e3be005c8eddaed1ff2872a9a64788853cf03d219727a96a77c67232ddd0c58868ca92a13b31c0f6af643c7cf2a15f6630bbeec17041375347

Download Submit
C:\Users\Admin\AppData\Local\Temp\miaF6A0.tmp\Local Cooling Setup.exe
Filesize
845KB

MD5
b5416919869a8786121d3d72fd0e2528

SHA1
1d9234ed8eb21bdcd0b2d30e850c71e9ec16da2c

SHA256
57517f7053eb3e9a005dfe55351ec628e4b88ecaa485df5f4fbd925cf14345f7

SHA512
af352ecc1b1f509cf96d1e01d6b025b5b90c97abcde7669bf38d06743029c0c82229db427ea2ab5dc747ee692af46f398eecaaa22f81be41f681666644890976

Download Submit
C:\Users\Admin\AppData\Local\Temp\miaF6A0.tmp\Local Cooling Setup.exe
Filesize
1.5MB

MD5
922389b50697f6cc9d765e0da206515c

SHA1
fbbd8f72920070e0ce55988e823c7c1c3df5be36

SHA256
946fa2e7d02f4034eb0379bdd4d2e4bef6063a65537321eb0af44d37d47a262f

SHA512
b53b59cbc438da489ebc647da83d72e9329a0f9e32c34690b73992f37fc6822a991a913d8bb010035d05b326f18f9b27dfa062be7db6ddca0b8eac87fdd88650

Download Submit
C:\Users\Admin\AppData\Local\Temp\miaF6A0.tmp\Local Cooling Setup.res
Filesize
1.0MB

MD5
01ca4113975558826bc8a55226709fdb

SHA1
5f9dfc0cc847e2d4abd7f5a2b68a9b7e08148761

SHA256
9e0405b0f8d9937b94567d618b8a2949cf400c869aff9d600f046276ef5cbea6

SHA512
edc0a5fa66484ad8eb5d83e131d2ac038fb73cac85a6a180df22772dec3e36f099ac2b17cd8f06655e1b734da366908069a685ebbff6f2fd6acf53da377f02cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\miaF6A0.tmp\data\Windows\winsxs\b2rg91xw.1p4\msvcm80.dll
Filesize
468KB

MD5
cae6861b19a2a7e5d42fefc4dfdf5ccf

SHA1
609b81fbd3acda8c56e2663eda80bfafc9480991

SHA256
c4c8c2d251b90d77d1ac75cbd39c3f0b18fc170d5a95d1c13a0266f7260b479d

SHA512
c01d27f5a295b684c44105fcb62fb5f540a69d70a653ac9d14f2e5ef01295ef1df136ae936273101739eb32eff35185098a15f11d6c3293bbdcd9fcb98cb00a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\miaF6A0.tmp\data\Windows\winsxs\b2rg91xw.1p4\msvcp80.dll
Filesize
536KB

MD5
4c8a880eabc0b4d462cc4b2472116ea1

SHA1
d0a27f553c0fe0e507c7df079485b601d5b592e6

SHA256
2026f3c4f830dff6883b88e2647272a52a132f25eb42c0d423e36b3f65a94d08

SHA512
6a6cce8c232f46dab9b02d29be5e0675cc1e968e9c2d64d0abc008d20c0a7baeb103a5b1d9b348fa1c4b3af9797dbcb6e168b14b545fb15c2ccd926c3098c31c

Download Submit
C:\Users\Admin\AppData\Local\Temp\miaF6A0.tmp\data\Windows\winsxs\b2rg91xw.1p4\msvcr80.dll
Filesize
612KB

MD5
e4fece18310e23b1d8fee993e35e7a6f

SHA1
9fd3a7f0522d36c2bf0e64fc510c6eea3603b564

SHA256
02bdde38e4c6bd795a092d496b8d6060cdbe71e22ef4d7a204e3050c1be44fa9

SHA512
2fb5f8d63a39ba5e93505df3a643d14e286fe34b11984cbed4b88e8a07517c03efb3a7bf9d61cf1ec73b0a20d83f9e6068e61950a61d649b8d36082bb034ddfc

Download Submit
C:\Users\Admin\AppData\Local\Temp\miaF6A0.tmp\data\Windows\winsxs\b2rg91xw.1p4\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700.cat
Filesize
8KB

MD5
790adaf5e825415e35ad65990e071ae0

SHA1
e23d182ab1edfef5fd3793313d90935fc034abc8

SHA256
88b03fe13d2710ad787d5d96cd0e5cbeda3a61c2a0a2bdc0c0984a48365242e2

SHA512
050bbad3122cd0627ecacaf3fb24ebf1e1845f209c33ed6607b282d9dcd4f5d99e345df3a99e4344af2aba6e7923c8483e8d5a8d709bf97f3cb37926d975fdad

Download Submit
C:\Users\Admin\AppData\Local\Temp\miaF6A0.tmp\data\Windows\winsxs\b2rg91xw.1p4\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700.manifest
Filesize
1KB

MD5
541423a06efdcd4e4554c719061f82cf

SHA1
2e12c6df7352c3ed3c61a45baf68eace1cc9546e

SHA256
17ad1a64ba1c382abf89341b40950f9b31f95015c6b0d3e25925bfebc1b53eb5

SHA512
11cf735dcddba72babb9de8f59e0c180a9fec8268cbfca09d17d8535f1b92c17bf32acda86499e420cbe7763a96d6067feb67fa1ed745067ab326fd5b84188c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\miaF6A0.tmp\mia.lib
Filesize
565KB

MD5
e6c930ab2d929ce6ac088799b57ae430

SHA1
8d1628b4f816dc93b8f843e7a28d760ad0edccc6

SHA256
d3125717c7f99cee05045995d10f2986f9a2608ffdedfb29b34b472f3f36f952

SHA512
a3d082674d9a4314bdae8e9ac429bd22030bc7ff69c695afd53ba9a785c7a5ff44fd7599278bb0422378b0aae3102d652f2cc03574285729196078f2717bae4f

Download Submit
C:\Users\Admin\AppData\Local\Temp\{53F120D8-EC02-4B68-8397-7F938B50A300}.exe
Filesize
3.4MB

MD5
64ebe16cc58d33f4697182de5f5cd8dc

SHA1
c84e8d90689beeed381f0c0c92d384885621ea4c

SHA256
584e4a09c38761466b653547468d6d9104b11830b7c3baec10238184bb649624

SHA512
5e5ed526e6edaa0e4b83ee3875a40b5593db28edba530a3bbaa3362ad38d741fca228d9b626bd79e99fe93c71fbbae8b83464f85da27869db6ebd8f74dfe964d

Download Submit
C:\Users\Admin\AppData\Local\Temp\{53F120D8-EC02-4B68-8397-7F938B50A300}.exe
Filesize
1.9MB

MD5
dd494c4070856d5f032c937d90af16ab

SHA1
f702aa05e39c49cc6ec1c12ee0cf26a86e44859a

SHA256
e7e4a35bcd801dc4f050188a629b685ad8aa3ef7d34ff4d6124bed547af23033

SHA512
28769770b7f83c43e45334231b8824fa1da60bef0491f976eb92ee53cef7c529c99065eef97bf3edbc5d1706950ea4b88caed56728472fd5f7d8db3efafff537

Download Submit
C:\Users\Admin\AppData\Local\Temp\{53F120D8-EC02-4B68-8397-7F938B50A300}.exe
Filesize
2.4MB

MD5
ed97c2cba5fad504bdb6843c24a119a6

SHA1
da2c3c15228b26785e62b5efbcf85a032bbb1e45

SHA256
f8240596a3bcb97659c8af5dcfd69f2b4213cdf3bbd95d66497dde47392ddf7a

SHA512
1054726f3a6c8f9b0e9b2f1f0f69c199997ca6d04d1e79fcc0cfc5d82de6ca724e0270737fd92f04706535dddd31e8e129f2a455a4916edae1cf65225834af4c

Download Submit
C:\Users\Admin\AppData\Local\Temp\{A9547F93-3477-4057-8BA3-AB85BA5FA4FE}
Filesize
3KB

MD5
a3244462c9ea02f6a2c525721532680f

SHA1
de9e61a39d6aff31dd9787a38bcca683f9e50c7e

SHA256
0840cdd098913916111d9224f98a7c03d9fecde9e2df6741eb4bbdf8cede54bc

SHA512
5e581462a4c795d209e115f74836489f642a2c3a536193d53fbcd73a967cd0a471011b2feddaf72e0f0115ad4486eadd34d30526b7611fa02b4876149a2370e4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Installer\{A9547F93-3477-4057-8BA3-AB85BA5FA4FE}\ient5cui5clocalcooling.ico0.ico
Filesize
89KB

MD5
979218d3eb6c21c8d418fd8bad64dbb8

SHA1
08b9a273b59da9e8fd45dae45e616a6e666763ee

SHA256
a5b8ff4fb8793ac2308360b37381ca4a3bc5ceb844e3bd8a53d75029015a94e0

SHA512
410e9fe08854a131dbcdd3ab1ef636337c6f927f45b586d4e0f72e0a5100724976e0929ad29948fc221a6357ca171a9bc12b565a0aa67f645d6e65d0060fdec1

Download Submit
C:\Windows\Installer\MSI8B02.tmp
Filesize
90KB

MD5
125ee0a0d1852d90b00fcc37956308b4

SHA1
4b350a2ab52c7b4d6b2b15ff2268040e0fe38089

SHA256
08c72daa01f1420d4bb22046afbd2cdebf76d5e70bacd7ee133c3675642dbe23

SHA512
1c1500be14fdafa20484d2bab61a4158567be20cc9b9fe25f33d0b1ec0eda91d803a738cf0a76276c911f1379f7a41c7019c6ea54fff96cb819b4e801f57c6f2

Download Submit
C:\Windows\Installer\MSI8CA9.tmp
Filesize
43KB

MD5
ca7731abb1d0a7ddf63ca9935c9490eb

SHA1
9c8dcd0aa645011e115a28d5313096f4b7789e1f

SHA256
0acadf47a54cdf59a3bb68f6146400c7a071d9ad797c6bbd0e6c27e19ca091b5

SHA512
1fe3b1ac3a20e17613f7bf44bb3d2c2ff4764964bdeec8f4cd509917d8ddb6940f38b18c9793197f98e30066e9668ae872ab06d5196ee55aeea59658cc9cc3e3

Download Submit
C:\Windows\Installer\MSI8EDE.tmp
Filesize
28KB

MD5
85221b3bcba8dbe4b4a46581aa49f760

SHA1
746645c92594bfc739f77812d67cfd85f4b92474

SHA256
f6e34a4550e499346f5ab1d245508f16bf765ff24c4988984b89e049ca55737f

SHA512
060e35c4de14a03a2cda313f968e372291866cc4acd59977d7a48ac3745494abc54df83fff63cf30be4e10ff69a3b3c8b6c38f43ebd2a8d23d6c86fbee7ba87d

Download Submit
C:\Windows\Installer\MSIF17F.tmp
Filesize
391KB

MD5
99d6a45cebd95df1092b971e1f916da1

SHA1
adc70928c2f7ab581b850290a39ddd789e41c86a

SHA256
3127c41956f6578fcbd2406cf65cfc4242e832e20b08d96e8ce57badf7b1bdc5

SHA512
6196673aab3c190dc6e569ad37f17e2be142e877eb6025a346fdb9cd7191f2ed9df290c7d1c493b4a5d829a534fea5e0474aa38b6873fe249f0463098d101dc1

Download Submit
C:\Windows\WinSxS\InstallTemp\20231231221639137.0\8.0.50727.762.cat
Filesize
8KB

MD5
29c0897d5d709a2394960b26999126d0

SHA1
56501eda82ecf05c4a90b035be62b422a24c71c3

SHA256
dd72f7ab2def5f75f58d01b24643b308750c38685daaed50bcddf61c18460dee

SHA512
75fb603d58105f0a2aacade320e2eab212dd6b3d6fcbdab09ca137d123cc1decb88c848b81e017bbddd41d9591900ff723aed90fb0d6166e8c62e3c14d39166e

Download Submit
C:\Windows\WinSxS\InstallTemp\20231231221639137.0\8.0.50727.762.policy
Filesize
800B

MD5
a785ce93c7468dbcdfa7bc379f8ffddc

SHA1
d10440930cc994409e920d94c7c45f0405d60422

SHA256
3a131923c7403c1eef33b59fdca57d8272549b7912d2b522fc8a4c840cbca735

SHA512
8e514e11887f6a198756f4a4b1a584e0a337abef90f1a9330436e21e75cd5fffe7e90a80424018c03ea55ae43758fcfa16f5a7c266d5476ce8f985f76ce5cada

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Filesize
3.1MB

MD5
4fcaf19dd6f70c9ab701a5ce1d581055

SHA1
a7eb80038fbdb59276a08bd6259b9ddf57cad589

SHA256
51b69e5ead3ab706da6651651ce5271d4acf8477cdb2585161b24acc6518817b

SHA512
fc2f51e7fd7ebb3a76339b64c8c0275b3cfb4f8ed60a31139538586be0b4b985246ec37bcde1923523fac8d8d6024f65d4464370eaa3ce93a72b7bd6439e9cbe

Download Submit
\??\Volume{18122b6c-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{81523b6a-513e-4f15-aee8-749b98a608d5}_OnDiskSnapshotProp
Filesize
6KB

MD5
e1489545bf69823b3869a1e1e361072e

SHA1
a26796c204679af203a617e1bbc331000a65563b

SHA256
1e71aec39b304899abfbfa227e204dfc07f70fe87bf3b2ac3b671f63fe298150

SHA512
90242553ea51dfac951a02357814d5138b1bb5e31aab5efb1ebce0a6b7ef60832bbb8bccd30975a132648cf8de2fb8306684cce0f3783c148980401137cb8c8c

Download Submit
\??\pipe\LOCAL\crashpad_2812_BNLGNROPKYBHCXFL
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/5784-421-0x0000000000400000-0x000000000066A000-memory.dmp

Filesize
2.4MB

Download
memory/5784-307-0x00000000023F0000-0x00000000023F1000-memory.dmp

Filesize
4KB

Download
memory/5784-486-0x0000000000400000-0x000000000066A000-memory.dmp

Filesize
2.4MB

Download
memory/5784-511-0x0000000000400000-0x000000000066A000-memory.dmp

Filesize
2.4MB

Download
memory/5784-418-0x0000000000400000-0x000000000066A000-memory.dmp

Filesize
2.4MB

Download
memory/5784-419-0x0000000000400000-0x000000000066A000-memory.dmp

Filesize
2.4MB

Download
memory/5784-420-0x00000000023F0000-0x00000000023F1000-memory.dmp

Filesize
4KB

Download
memory/5784-592-0x0000000000400000-0x000000000066A000-memory.dmp

Filesize
2.4MB

Download
memory/5820-238-0x0000000002D40000-0x0000000002D41000-memory.dmp

Filesize
4KB

Download