agenttesla | hxxps://cdn[.]discordapp[.]com/attachments/1275135282223775926/1280323890933010482/Stix_Free_Utility_Installer[.]exe?ex=66d7aa0a&is=66d6588a&hm=a7b019f6107733314fd8a09e0314260b79f1f8a8763c1ba146afc9e39f6c5bef&

Analysis

max time kernel
193s
max time network
185s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03-09-2024 12:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://cdn.discordapp.com/attachments/1275135282223775926/1280323890933010482/Stix_Free_Utility_Installer.exe?ex=66d7aa0a&is=66d6588a&hm=a7b019f6107733314fd8a09e0314260b79f1f8a8763c1ba146afc9e39f6c5bef&

Score

10^/10

agenttesla discovery keylogger spyware stealer trojan

Malware Config

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla payload 1 IoCs

resource	yara_rule
behavioral1/memory/5256-483-0x0000021677200000-0x0000021677412000-memory.dmp	family_agenttesla

Downloads MZ/PE file

Executes dropped EXE 4 IoCs

pid	Process
3400	Stix Free Utility Installer.exe
5044	Stix Free Utility Installer.exe
5256	Stix Free Utility V1.0.0.exe
5080	Stix Free Utility V1.0.0.exe

Loads dropped DLL 18 IoCs

pid	Process
5292	MsiExec.exe
5292	MsiExec.exe
5292	MsiExec.exe
5568	MsiExec.exe
5568	MsiExec.exe
5568	MsiExec.exe
5568	MsiExec.exe
5568	MsiExec.exe
5568	MsiExec.exe
5568	MsiExec.exe
5568	MsiExec.exe
6036	MsiExec.exe
6036	MsiExec.exe
6036	MsiExec.exe
6036	MsiExec.exe
6036	MsiExec.exe
6036	MsiExec.exe
4776	MsiExec.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	Stix Free Utility Installer.exe
File opened (read-only)	\??\H:	Stix Free Utility Installer.exe
File opened (read-only)	\??\U:	Stix Free Utility Installer.exe
File opened (read-only)	\??\Y:	Stix Free Utility Installer.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\E:	Stix Free Utility Installer.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\P:	Stix Free Utility Installer.exe
File opened (read-only)	\??\N:	Stix Free Utility Installer.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	Stix Free Utility Installer.exe
File opened (read-only)	\??\J:	Stix Free Utility Installer.exe
File opened (read-only)	\??\Q:	Stix Free Utility Installer.exe
File opened (read-only)	\??\S:	Stix Free Utility Installer.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\I:	Stix Free Utility Installer.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\L:	Stix Free Utility Installer.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\O:	Stix Free Utility Installer.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\T:	Stix Free Utility Installer.exe
File opened (read-only)	\??\M:	Stix Free Utility Installer.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	Stix Free Utility Installer.exe
File opened (read-only)	\??\X:	Stix Free Utility Installer.exe
File opened (read-only)	\??\Z:	Stix Free Utility Installer.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\W:	Stix Free Utility Installer.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe

Drops file in Program Files directory 24 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Stix Pc Services\Stix Free\Release\System.Runtime.CompilerServices.Unsafe.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Stix Pc Services\Stix Free\Release\MaterialSkin.dll	7zG.exe
File opened for modification	C:\Program Files (x86)\Stix Pc Services\Stix Free\Release\Stix Free Utility V1.0.0.exe	7zG.exe
File opened for modification	C:\Program Files (x86)\Stix Pc Services\Stix Free\Release\System.Runtime.CompilerServices.Unsafe.dll	7zG.exe
File created	C:\Program Files (x86)\Stix Pc Services\Stix Free\Release\System.Numerics.Vectors.dll	msiexec.exe
File created	C:\Program Files (x86)\Stix Pc Services\Stix Free\Release\System.Memory.dll	msiexec.exe
File created	C:\Program Files (x86)\Stix Pc Services\Stix Free\Release\Newtonsoft.Json.dll	msiexec.exe
File created	C:\Program Files (x86)\Stix Pc Services\Stix Free\Release\Newtonsoft.Json.xml	msiexec.exe
File created	C:\Program Files (x86)\Stix Pc Services\Stix Free\Release\System.Numerics.Vectors.xml	msiexec.exe
File created	C:\Program Files (x86)\Stix Pc Services\Stix Free\Release\System.Runtime.CompilerServices.Unsafe.xml	msiexec.exe
File created	C:\Program Files (x86)\Stix Pc Services\Stix Free\Release\Stix Premium Utility V2.exe.config	msiexec.exe
File created	C:\Program Files (x86)\Stix Pc Services\Stix Free\Release\System.Memory.xml	msiexec.exe
File opened for modification	C:\Program Files (x86)\Stix Pc Services\Stix Free\Release\Guna.UI2.dll	7zG.exe
File opened for modification	C:\Program Files (x86)\Stix Pc Services\Stix Free\Release\Newtonsoft.Json.dll	7zG.exe
File opened for modification	C:\Program Files (x86)\Stix Pc Services\Stix Free\Release\System.Numerics.Vectors.dll	7zG.exe
File created	C:\Program Files (x86)\Stix Pc Services\Stix Free\Release\System.Buffers.dll	msiexec.exe
File created	C:\Program Files (x86)\Stix Pc Services\Stix Free\Release\Guna.UI2.dll	msiexec.exe
File created	C:\Program Files (x86)\Stix Pc Services\Stix Free\Release\MaterialSkin.dll	msiexec.exe
File created	C:\Program Files (x86)\Stix Pc Services\Stix Free\Release\System.Buffers.xml	msiexec.exe
File created	C:\Program Files (x86)\Stix Pc Services\Stix Free\Release\Stix Premium Utility V2.pdb	msiexec.exe
File created	C:\Program Files (x86)\Stix Pc Services\Stix Free\Release\Stix Free Utility V1.0.0.exe	msiexec.exe
File created	C:\Program Files (x86)\Stix Pc Services\Stix Free\Release.7z.tmp	7zG.exe
File opened for modification	C:\Program Files (x86)\Stix Pc Services\Stix Free\Release\System.Buffers.dll	7zG.exe
File opened for modification	C:\Program Files (x86)\Stix Pc Services\Stix Free\Release\System.Memory.dll	7zG.exe

Drops file in Windows directory 17 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI17FF.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE54.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEF1.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI127D.tmp	msiexec.exe
File created	C:\Windows\Installer\{EC61106E-C669-4BA3-9D48-86FAF10CF7CD}\StixFreeUtilityV1.0.0.exe	msiexec.exe
File created	C:\Windows\Installer\e57ffed.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\e57ffeb.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e57ffeb.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID78.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF9E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI15EA.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{EC61106E-C669-4BA3-9D48-86FAF10CF7CD}\StixFreeUtilityV1.0.0.exe	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{EC61106E-C669-4BA3-9D48-86FAF10CF7CD}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI14A1.tmp	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Stix Free Utility Installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Stix Free Utility Installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000082ad35faf8c7b7730000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000082ad35fa0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff00000000070001000068090082ad35fa000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d82ad35fa000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000082ad35fa00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Stix Free Utility V1.0.0.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	Stix Free Utility V1.0.0.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	Stix Free Utility V1.0.0.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Stix Free Utility V1.0.0.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	Stix Free Utility V1.0.0.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	Stix Free Utility V1.0.0.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupView = "0"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 010000000200000000000000ffffffff	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E60116CE966C3AB4D98468AF1FC07FDC\SourceList\Media\DiskPrompt = "[1]"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\IconSize = "48"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:PID = "0"	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E60116CE966C3AB4D98468AF1FC07FDC\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\MRUListEx = ffffffff	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1092616257"	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E60116CE966C3AB4D98468AF1FC07FDC	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E60116CE966C3AB4D98468AF1FC07FDC\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\E8CEF0381F832534C8335C8B2CBFB431\E60116CE966C3AB4D98468AF1FC07FDC	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E60116CE966C3AB4D98468AF1FC07FDC\SourceList\Net	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\LogicalViewMode = "3"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\LogicalViewMode = "3"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupView = "0"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:PID = "0"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\IconSize = "48"	msedge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E60116CE966C3AB4D98468AF1FC07FDC\AdvertiseFlags = "388"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E60116CE966C3AB4D98468AF1FC07FDC\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\E8CEF0381F832534C8335C8B2CBFB431	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Mode = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1"	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E60116CE966C3AB4D98468AF1FC07FDC\ProductName = "Stix Free"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E60116CE966C3AB4D98468AF1FC07FDC\PackageCode = "3CA7207B877F49749A6D967EA0AE0200"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E60116CE966C3AB4D98468AF1FC07FDC\AuthorizedLUAApp = "0"	msiexec.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 020000000100000000000000ffffffff	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E60116CE966C3AB4D98468AF1FC07FDC\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E60116CE966C3AB4D98468AF1FC07FDC\SourceList\Media\1 = "Disk1;Disk1"	msiexec.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\NodeSlot = "4"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByDirection = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Mode = "1"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2718105630-359604950-2820636825-1000\{E03E5CEC-0342-4279-8ABE-0718ABA06174}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E60116CE966C3AB4D98468AF1FC07FDC\SourceList	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByDirection = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 020000000100000000000000ffffffff	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E60116CE966C3AB4D98468AF1FC07FDC\MainFeature	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E60116CE966C3AB4D98468AF1FC07FDC\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E60116CE966C3AB4D98468AF1FC07FDC\SourceList\Media	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E60116CE966C3AB4D98468AF1FC07FDC\SourceList\PackageName = "Stix Free.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E60116CE966C3AB4D98468AF1FC07FDC\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 812964.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
4768	msedge.exe
4768	msedge.exe
1884	msedge.exe
1884	msedge.exe
2100	identity_helper.exe
2100	identity_helper.exe
2092	msedge.exe
2092	msedge.exe
5044	Stix Free Utility Installer.exe
5044	Stix Free Utility Installer.exe
5736	msedge.exe
5736	msedge.exe
5212	msiexec.exe
5212	msiexec.exe
5256	Stix Free Utility V1.0.0.exe
5256	Stix Free Utility V1.0.0.exe
5688	msedge.exe
5688	msedge.exe
5828	msedge.exe
5828	msedge.exe
5828	msedge.exe
5828	msedge.exe
5484	msedge.exe
5484	msedge.exe
5080	Stix Free Utility V1.0.0.exe
5080	Stix Free Utility V1.0.0.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 24 IoCs

pid	Process
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeSecurityPrivilege	5212	msiexec.exe
Token: SeCreateTokenPrivilege	5044	Stix Free Utility Installer.exe
Token: SeAssignPrimaryTokenPrivilege	5044	Stix Free Utility Installer.exe
Token: SeLockMemoryPrivilege	5044	Stix Free Utility Installer.exe
Token: SeIncreaseQuotaPrivilege	5044	Stix Free Utility Installer.exe
Token: SeMachineAccountPrivilege	5044	Stix Free Utility Installer.exe
Token: SeTcbPrivilege	5044	Stix Free Utility Installer.exe
Token: SeSecurityPrivilege	5044	Stix Free Utility Installer.exe
Token: SeTakeOwnershipPrivilege	5044	Stix Free Utility Installer.exe
Token: SeLoadDriverPrivilege	5044	Stix Free Utility Installer.exe
Token: SeSystemProfilePrivilege	5044	Stix Free Utility Installer.exe
Token: SeSystemtimePrivilege	5044	Stix Free Utility Installer.exe
Token: SeProfSingleProcessPrivilege	5044	Stix Free Utility Installer.exe
Token: SeIncBasePriorityPrivilege	5044	Stix Free Utility Installer.exe
Token: SeCreatePagefilePrivilege	5044	Stix Free Utility Installer.exe
Token: SeCreatePermanentPrivilege	5044	Stix Free Utility Installer.exe
Token: SeBackupPrivilege	5044	Stix Free Utility Installer.exe
Token: SeRestorePrivilege	5044	Stix Free Utility Installer.exe
Token: SeShutdownPrivilege	5044	Stix Free Utility Installer.exe
Token: SeDebugPrivilege	5044	Stix Free Utility Installer.exe
Token: SeAuditPrivilege	5044	Stix Free Utility Installer.exe
Token: SeSystemEnvironmentPrivilege	5044	Stix Free Utility Installer.exe
Token: SeChangeNotifyPrivilege	5044	Stix Free Utility Installer.exe
Token: SeRemoteShutdownPrivilege	5044	Stix Free Utility Installer.exe
Token: SeUndockPrivilege	5044	Stix Free Utility Installer.exe
Token: SeSyncAgentPrivilege	5044	Stix Free Utility Installer.exe
Token: SeEnableDelegationPrivilege	5044	Stix Free Utility Installer.exe
Token: SeManageVolumePrivilege	5044	Stix Free Utility Installer.exe
Token: SeImpersonatePrivilege	5044	Stix Free Utility Installer.exe
Token: SeCreateGlobalPrivilege	5044	Stix Free Utility Installer.exe
Token: SeCreateTokenPrivilege	5044	Stix Free Utility Installer.exe
Token: SeAssignPrimaryTokenPrivilege	5044	Stix Free Utility Installer.exe
Token: SeLockMemoryPrivilege	5044	Stix Free Utility Installer.exe
Token: SeIncreaseQuotaPrivilege	5044	Stix Free Utility Installer.exe
Token: SeMachineAccountPrivilege	5044	Stix Free Utility Installer.exe
Token: SeTcbPrivilege	5044	Stix Free Utility Installer.exe
Token: SeSecurityPrivilege	5044	Stix Free Utility Installer.exe
Token: SeTakeOwnershipPrivilege	5044	Stix Free Utility Installer.exe
Token: SeLoadDriverPrivilege	5044	Stix Free Utility Installer.exe
Token: SeSystemProfilePrivilege	5044	Stix Free Utility Installer.exe
Token: SeSystemtimePrivilege	5044	Stix Free Utility Installer.exe
Token: SeProfSingleProcessPrivilege	5044	Stix Free Utility Installer.exe
Token: SeIncBasePriorityPrivilege	5044	Stix Free Utility Installer.exe
Token: SeCreatePagefilePrivilege	5044	Stix Free Utility Installer.exe
Token: SeCreatePermanentPrivilege	5044	Stix Free Utility Installer.exe
Token: SeBackupPrivilege	5044	Stix Free Utility Installer.exe
Token: SeRestorePrivilege	5044	Stix Free Utility Installer.exe
Token: SeShutdownPrivilege	5044	Stix Free Utility Installer.exe
Token: SeDebugPrivilege	5044	Stix Free Utility Installer.exe
Token: SeAuditPrivilege	5044	Stix Free Utility Installer.exe
Token: SeSystemEnvironmentPrivilege	5044	Stix Free Utility Installer.exe
Token: SeChangeNotifyPrivilege	5044	Stix Free Utility Installer.exe
Token: SeRemoteShutdownPrivilege	5044	Stix Free Utility Installer.exe
Token: SeUndockPrivilege	5044	Stix Free Utility Installer.exe
Token: SeSyncAgentPrivilege	5044	Stix Free Utility Installer.exe
Token: SeEnableDelegationPrivilege	5044	Stix Free Utility Installer.exe
Token: SeManageVolumePrivilege	5044	Stix Free Utility Installer.exe
Token: SeImpersonatePrivilege	5044	Stix Free Utility Installer.exe
Token: SeCreateGlobalPrivilege	5044	Stix Free Utility Installer.exe
Token: SeCreateTokenPrivilege	5044	Stix Free Utility Installer.exe
Token: SeAssignPrimaryTokenPrivilege	5044	Stix Free Utility Installer.exe
Token: SeLockMemoryPrivilege	5044	Stix Free Utility Installer.exe
Token: SeIncreaseQuotaPrivilege	5044	Stix Free Utility Installer.exe
Token: SeMachineAccountPrivilege	5044	Stix Free Utility Installer.exe

Suspicious use of FindShellTrayWindow 61 IoCs

pid	Process
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
5044	Stix Free Utility Installer.exe
5456	msiexec.exe
5456	msiexec.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1768	7zG.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe

Suspicious use of SendNotifyMessage 42 IoCs

pid	Process
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5688	msedge.exe
5484	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1884 wrote to memory of 3732	1884	msedge.exe	84
PID 1884 wrote to memory of 3732	1884	msedge.exe	84
PID 1884 wrote to memory of 2172	1884	msedge.exe	85
PID 1884 wrote to memory of 2172	1884	msedge.exe	85
PID 1884 wrote to memory of 2172	1884	msedge.exe	85
PID 1884 wrote to memory of 2172	1884	msedge.exe	85
PID 1884 wrote to memory of 2172	1884	msedge.exe	85
PID 1884 wrote to memory of 2172	1884	msedge.exe	85
PID 1884 wrote to memory of 2172	1884	msedge.exe	85
PID 1884 wrote to memory of 2172	1884	msedge.exe	85
PID 1884 wrote to memory of 2172	1884	msedge.exe	85
PID 1884 wrote to memory of 2172	1884	msedge.exe	85
PID 1884 wrote to memory of 2172	1884	msedge.exe	85
PID 1884 wrote to memory of 2172	1884	msedge.exe	85
PID 1884 wrote to memory of 2172	1884	msedge.exe	85
PID 1884 wrote to memory of 2172	1884	msedge.exe	85
PID 1884 wrote to memory of 2172	1884	msedge.exe	85
PID 1884 wrote to memory of 2172	1884	msedge.exe	85
PID 1884 wrote to memory of 2172	1884	msedge.exe	85
PID 1884 wrote to memory of 2172	1884	msedge.exe	85
PID 1884 wrote to memory of 2172	1884	msedge.exe	85
PID 1884 wrote to memory of 2172	1884	msedge.exe	85
PID 1884 wrote to memory of 2172	1884	msedge.exe	85
PID 1884 wrote to memory of 2172	1884	msedge.exe	85
PID 1884 wrote to memory of 2172	1884	msedge.exe	85
PID 1884 wrote to memory of 2172	1884	msedge.exe	85
PID 1884 wrote to memory of 2172	1884	msedge.exe	85
PID 1884 wrote to memory of 2172	1884	msedge.exe	85
PID 1884 wrote to memory of 2172	1884	msedge.exe	85
PID 1884 wrote to memory of 2172	1884	msedge.exe	85
PID 1884 wrote to memory of 2172	1884	msedge.exe	85
PID 1884 wrote to memory of 2172	1884	msedge.exe	85
PID 1884 wrote to memory of 2172	1884	msedge.exe	85
PID 1884 wrote to memory of 2172	1884	msedge.exe	85
PID 1884 wrote to memory of 2172	1884	msedge.exe	85
PID 1884 wrote to memory of 2172	1884	msedge.exe	85
PID 1884 wrote to memory of 2172	1884	msedge.exe	85
PID 1884 wrote to memory of 2172	1884	msedge.exe	85
PID 1884 wrote to memory of 2172	1884	msedge.exe	85
PID 1884 wrote to memory of 2172	1884	msedge.exe	85
PID 1884 wrote to memory of 2172	1884	msedge.exe	85
PID 1884 wrote to memory of 2172	1884	msedge.exe	85
PID 1884 wrote to memory of 4768	1884	msedge.exe	86
PID 1884 wrote to memory of 4768	1884	msedge.exe	86
PID 1884 wrote to memory of 2292	1884	msedge.exe	87
PID 1884 wrote to memory of 2292	1884	msedge.exe	87
PID 1884 wrote to memory of 2292	1884	msedge.exe	87
PID 1884 wrote to memory of 2292	1884	msedge.exe	87
PID 1884 wrote to memory of 2292	1884	msedge.exe	87
PID 1884 wrote to memory of 2292	1884	msedge.exe	87
PID 1884 wrote to memory of 2292	1884	msedge.exe	87
PID 1884 wrote to memory of 2292	1884	msedge.exe	87
PID 1884 wrote to memory of 2292	1884	msedge.exe	87
PID 1884 wrote to memory of 2292	1884	msedge.exe	87
PID 1884 wrote to memory of 2292	1884	msedge.exe	87
PID 1884 wrote to memory of 2292	1884	msedge.exe	87
PID 1884 wrote to memory of 2292	1884	msedge.exe	87
PID 1884 wrote to memory of 2292	1884	msedge.exe	87
PID 1884 wrote to memory of 2292	1884	msedge.exe	87
PID 1884 wrote to memory of 2292	1884	msedge.exe	87
PID 1884 wrote to memory of 2292	1884	msedge.exe	87
PID 1884 wrote to memory of 2292	1884	msedge.exe	87
PID 1884 wrote to memory of 2292	1884	msedge.exe	87
PID 1884 wrote to memory of 2292	1884	msedge.exe	87

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cdn.discordapp.com/attachments/1275135282223775926/1280323890933010482/Stix_Free_Utility_Installer.exe?ex=66d7aa0a&is=66d6588a&hm=a7b019f6107733314fd8a09e0314260b79f1f8a8763c1ba146afc9e39f6c5bef&
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8bcd146f8,0x7ff8bcd14708,0x7ff8bcd14718
  2⤵
  PID:3732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2016,10827552606427299636,4121981517917189654,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2052 /prefetch:2
  2⤵
  PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2016,10827552606427299636,4121981517917189654,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2348 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2016,10827552606427299636,4121981517917189654,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2884 /prefetch:8
  2⤵
  PID:2292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,10827552606427299636,4121981517917189654,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,10827552606427299636,4121981517917189654,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:1248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,10827552606427299636,4121981517917189654,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:1
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,10827552606427299636,4121981517917189654,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
  2⤵
  PID:2844
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2016,10827552606427299636,4121981517917189654,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3508 /prefetch:8
  2⤵
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2016,10827552606427299636,4121981517917189654,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3508 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2016,10827552606427299636,4121981517917189654,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5512 /prefetch:8
  2⤵
  PID:3800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,10827552606427299636,4121981517917189654,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:1
  2⤵
  PID:492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,10827552606427299636,4121981517917189654,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5552 /prefetch:1
  2⤵
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,10827552606427299636,4121981517917189654,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:1
  2⤵
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2016,10827552606427299636,4121981517917189654,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5588 /prefetch:8
  2⤵
  PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2016,10827552606427299636,4121981517917189654,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6044 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2092
- C:\Users\Admin\Downloads\Stix Free Utility Installer.exe
  "C:\Users\Admin\Downloads\Stix Free Utility Installer.exe"
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:5044
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\Stix Free.msi" AI_SETUPEXEPATH="C:\Users\Admin\Downloads\Stix Free Utility Installer.exe" SETUPEXEDIR=C:\Users\Admin\Downloads\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1725124759 "
    3⤵
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:5456
- C:\Users\Admin\Downloads\Stix Free Utility Installer.exe
  "C:\Users\Admin\Downloads\Stix Free Utility Installer.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,10827552606427299636,4121981517917189654,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3580 /prefetch:1
  2⤵
  PID:6048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,10827552606427299636,4121981517917189654,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5892 /prefetch:1
  2⤵
  PID:5164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2016,10827552606427299636,4121981517917189654,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3764 /prefetch:8
  2⤵
  PID:5728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2016,10827552606427299636,4121981517917189654,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5372 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:5736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,10827552606427299636,4121981517917189654,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6012 /prefetch:1
  2⤵
  PID:2580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,10827552606427299636,4121981517917189654,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6600 /prefetch:1
  2⤵
  PID:3876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,10827552606427299636,4121981517917189654,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:1
  2⤵
  PID:3916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,10827552606427299636,4121981517917189654,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6988 /prefetch:1
  2⤵
  PID:368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,10827552606427299636,4121981517917189654,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:1
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,10827552606427299636,4121981517917189654,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:1
  2⤵
  PID:5364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2016,10827552606427299636,4121981517917189654,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2096 /prefetch:8
  2⤵
  PID:5452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,10827552606427299636,4121981517917189654,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6332 /prefetch:1
  2⤵
  PID:5124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,10827552606427299636,4121981517917189654,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5840 /prefetch:1
  2⤵
  PID:772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=2016,10827552606427299636,4121981517917189654,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5968 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:5688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2016,10827552606427299636,4121981517917189654,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2888 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=2016,10827552606427299636,4121981517917189654,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6532 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:5484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,10827552606427299636,4121981517917189654,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4828 /prefetch:1
  2⤵
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,10827552606427299636,4121981517917189654,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:1
  2⤵
  PID:5800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,10827552606427299636,4121981517917189654,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6124 /prefetch:1
  2⤵
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,10827552606427299636,4121981517917189654,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4744 /prefetch:1
  2⤵
  PID:5812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,10827552606427299636,4121981517917189654,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6136 /prefetch:1
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,10827552606427299636,4121981517917189654,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3560 /prefetch:1
  2⤵
  PID:2568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,10827552606427299636,4121981517917189654,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3780 /prefetch:1
  2⤵
  PID:2896

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5032

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2676

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5212
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 98BE787F0ED21A2D3C0E868698E6BF7C C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5292
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 6DABD5E6DE78698DBDC322E5D8416D33 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5568
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:3032
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 5FA3CE19ACBAB1E52A7224D34DF9DBB2
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:6036
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding F2626743284A6F676532966C170E17ED E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4776

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:5876

C:\Program Files (x86)\Stix Pc Services\Stix Free\Release\Stix Free Utility V1.0.0.exe
"C:\Program Files (x86)\Stix Pc Services\Stix Free\Release\Stix Free Utility V1.0.0.exe"
1⤵
- Executes dropped EXE
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:5256

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2508

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" a -i#7zMap26705:118:7zEvent31097 -ad -saa -- "C:\Program Files (x86)\Stix Pc Services\Stix Free\Release"
1⤵
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
PID:1768

C:\Program Files (x86)\Stix Pc Services\Stix Free\Release\Stix Free Utility V1.0.0.exe
"C:\Program Files (x86)\Stix Pc Services\Stix Free\Release\Stix Free Utility V1.0.0.exe"
1⤵
- Executes dropped EXE
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:5080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e57ffec.rbs

Filesize
10KB

MD5
f03053975a69f761020f1d78c7a0f67e

SHA1
a89b494314035ae6765d149109763b60787969ed

SHA256
5ac351a3c667b06b7ac07bf41869a8a38c11f03ea9a8acb8dc3c8d47ab33acf0

SHA512
21e091dee6d615c55bb1dc6d0ae4f4b64aa600ec95e3440e8a8c1afb9e5d709cf6b75e15550802288e6024ac7191fd6291a83cc2d5721b753fbbae96ab70e2b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ab8ce148cb7d44f709fb1c460d03e1b0

SHA1
44d15744015155f3e74580c93317e12d2cc0f859

SHA256
014006a90e43ea9a1903b08b843a5aab8ad3823d22e26e5b113fad5f9fa620ff

SHA512
f685423b1eaee18a2a06030b4b2977335f62499c0041c142a92f6e6f846c2b9ce54324b6ae94efbbb303282dcda70e2b1597c748fddc251c0b3122a412c2d7c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
38f59a47b777f2fc52088e96ffb2baaf

SHA1
267224482588b41a96d813f6d9e9d924867062db

SHA256
13569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b

SHA512
4657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
62KB

MD5
c3c0eb5e044497577bec91b5970f6d30

SHA1
d833f81cf21f68d43ba64a6c28892945adc317a6

SHA256
eb48be34490ec9c4f9402b882166cd82cd317b51b2a49aae75cdf9ee035035eb

SHA512
83d3545a4ed9eed2d25f98c4c9f100ae0ac5e4bc8828dccadee38553b7633bb63222132df8ec09d32eb37d960accb76e7aab5719fc08cc0a4ef07b053f30cf38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
67KB

MD5
ed124bdf39bbd5902bd2529a0a4114ea

SHA1
b7dd9d364099ccd4e09fd45f4180d38df6590524

SHA256
48232550940208c572ebe487aa64ddee26e304ba3e310407e1fc31a5c9deed44

SHA512
c4d180292afa484ef9556d15db1d3850416a85ad581f6f4d5eb66654991fa90f414029b4ce13ed142271a585b46b3e53701735ee3e0f45a78b67baa9122ba532

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
41KB

MD5
f3d0a156d6ecb39d1805d60a28c8501d

SHA1
d26dd641e0b9d7c52b19bc9e89b53b291fb1915c

SHA256
e8be4436fcedf9737ea35d21ec0dcc36c30a1f41e02b3d40aa0bfa2be223a4a3

SHA512
076acfd19e4a43538f347ab460aa0b340a2b60d33f8be5f9b0ef939ef4e9f365277c4ff886d62b7edb20a299aacf50976321f9f90baba8ccd97bc5ac24a580bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
19KB

MD5
2e86a72f4e82614cd4842950d2e0a716

SHA1
d7b4ee0c9af735d098bff474632fc2c0113e0b9c

SHA256
c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f

SHA512
7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
65KB

MD5
56d57bc655526551f217536f19195495

SHA1
28b430886d1220855a805d78dc5d6414aeee6995

SHA256
f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4

SHA512
7814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
88KB

MD5
b38fbbd0b5c8e8b4452b33d6f85df7dc

SHA1
386ba241790252df01a6a028b3238de2f995a559

SHA256
b18b9eb934a5b3b81b16c66ec3ec8e8fecdb3d43550ce050eb2523aabc08b9cd

SHA512
546ca9fb302bf28e3a178e798dd6b80c91cba71d0467257b8ed42e4f845aa6ecb858f718aac1e0865b791d4ecf41f1239081847c75c6fb3e9afd242d3704ad16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
1.2MB

MD5
0f8b921dbbb4c77e341ca7a14c6cc2c5

SHA1
ce7263b6d1fc4fd721d6ce4262b4a120608d9ef3

SHA256
abc209a8da0e0fb8d80d30a19152402a1916afac9f15934bd6b3af69676be6d3

SHA512
c0b49d55c7bcb44cc81e35e11858d5eb32b2c9de7a1522346a4cdcff164be73a84b5dab8e73c1ac438a5a124f2c298e00b8baad5003b2cff2f2acc6cf8656247

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001a

Filesize
24KB

MD5
c594a826934b9505d591d0f7a7df80b7

SHA1
c04b8637e686f71f3fc46a29a86346ba9b04ae18

SHA256
e664eef3d68ac6336a28be033165d4780e8a5ab28f0d90df1b148ef86babb610

SHA512
04a1dfdb8ee2f5fefa101d5e3ff36e87659fd774e96aa8c5941d3353ccc268a125822cf01533c74839e5f1c54725da9cc437d3d69b88e5bf3f99caccd4d75961

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001b

Filesize
211KB

MD5
e7226392c938e4e604d2175eb9f43ca1

SHA1
2098293f39aa0bcdd62e718f9212d9062fa283ab

SHA256
d46ec08b6c29c4ca56cecbf73149cc66ebd902197590fe28cd65dad52a08c4e1

SHA512
63a4b99101c790d40a813db9e0d5fde21a64ccaf60a6009ead027920dbbdb52cc262af829e5c4140f3702a559c7ac46efa89622d76d45b4b49a9ce01625ef145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001d

Filesize
27KB

MD5
6b5c5bc3ac6e12eaa80c654e675f72df

SHA1
9e7124ce24650bc44dc734b5dc4356a245763845

SHA256
d1d3f1ebec67cc7dc38ae8a3d46a48f76f39755bf7d78eb1d5f20e0608c40b81

SHA512
66bd618ca40261040b17d36e6ad6611d8180984fd7120ccda0dfe26d18b786dbf018a93576ebafe00d3ce86d1476589c7af314d1d608b843e502cb481a561348

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
c4c462825e1ddd0e19883d841ae5794c

SHA1
c993713ee8a0f9bd9ef71b941cd19350a1d7cf70

SHA256
a49c2323b07e5e5111ceca451502e1396e82f6307b1adcb68f05995f8295c93f

SHA512
57397e079186c2ff46fcf221228f3ed3b303012fd29e9fb159495cbc5c00c9a8a64d47e9dffe0fc03f3712855e38cc3807e94acf3bab170928e568e532819ed5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
2b9647376e22443926f5d89e6085c85f

SHA1
53d8605e5cb39d25eea6fb8da514734a64e57040

SHA256
a745f820eb6add480e6d1fc76a07152cc2a2e08418125133c2fdd39edd2483a2

SHA512
54f100a207c0ca6639e8644c4813d94986dfbe3056f5a8f299e1dbc38ab159397d86464f9c30be761873c335ae562e507a6885d7d4e8b562822071e7469961d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.virustotal.com_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
3bad4c26fe383f6d4e2092d63f35de7f

SHA1
72dcf29066dde47ce671403ef6b3c3db422413f0

SHA256
81477dd299cc2a377018b785def874d3df5099b8f52af2fa01266e9addb14e2a

SHA512
f6742e12391f2434128b48997c9cd25b37a7c1ace65042ac624e4b71e0fb0f23135e61fd605a14696d28a6317d029282e956c7ac46382625fdd7ffa48e448a65

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
f629ff033a503c1cad58a5b69eef9222

SHA1
b1916ba250e8f3fad572ede1fb65dde2f80080f9

SHA256
e41fe3c8ff771ff1db679b259fc170b3be5a47abe86dd0934beca76b351f5bee

SHA512
a4476e6264722983f675767460eccffdb84e603c2ae808a2b9fbccbd2eb4d2f9eb92f4364fca491bfa5821c6ee2e6c8ef9b874a2a35c8196bd342fc26a9d55aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
887c07e669d07de76d3f69c3fe9e2678

SHA1
0ef3c7a37c2a7347093f5c8b0294f17663014440

SHA256
ea3aafb2d683105cf8586c49e54e276084728562e4ea997c0e349516391be0c9

SHA512
b3e13e8f69d233dd668125a0b1d9dce6f3d04db8e49eb5f797af9b473bebac845cb885f9abd031a15b2ce4e15aadf7a5f107141a415ac1f3fd80e53d673212d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b50a0eef961322de70309c199dfeb661

SHA1
073da0350337ac232a3cd3fd7a63a6edf50953d0

SHA256
dd509763f489df87080de0f03f48c9edf841f0c8ba590b4f42afd4996bfcf669

SHA512
b39bc53f72a8c486682cbd33c391c20657d5cc58050f76fb8cf8f06c2df05c76bdfb300c5af923110e3074e251fd7a111582635eee1f118fbb080dbb13104ed2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b75f95f940a77a06e2d138ce6593ff38

SHA1
1db5e2cd39cd9c5d3db2432a1b35b9c45857d5dc

SHA256
23715536bd705b9044ed4c8bd9760f40681f7a8922d2f18daf2847ff67b29f24

SHA512
fbe0a67f9f451ca8869a24cbbf1346123785751c53030b021b35d09710a7cf7784291ed355a29d4cc27cdd69b61f1277f90e55607176f84fdf74b42857da6862

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
e000d5fc9e81e151dedbd57afaa9c84e

SHA1
879323901d40ce46bde3d4ab1914c0a149184d35

SHA256
21197445142eff32fbfb939d77600c90e3b6bc87903b32ac374080830af84107

SHA512
d1ddfa929e51191cc41ae30adaaeb6f43a90b18eedef92666597def67b52bc5ede4dfaafbca185936385bf7034970d9d728d144ee8f74d91839ce19e4608cf5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
202b767c39ba360d7d45d4d3c53476cb

SHA1
aeae8aef9c869acc02d000c7651bf6a66e99db1f

SHA256
e3a7365a8f6dbfa9aad43c740c29f0bcdb8d90378bf51d7c2b2599316c218ce4

SHA512
37be620135014d0cee1d0f72b1427cea45a4aad6ed510db859b77d35532fe271c93f0faa769a63be2eeb253790d1373772ed7bf272bcee8cfac3375a79298480

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
c693b377269ad723448ba839da279421

SHA1
d3345ba0120ed1905ff54195d54cefd2513aa695

SHA256
f6f6e40187e8b0d12ed137febe9cf19dac99c24140281ef30c9dab5fd412209e

SHA512
153a2d378f8ec096fecf94d407dbc6a568539f339c203e2ae11e9d0465601559937b7a8e3f416a8828cdc186aae1b9841f7d781376713b69f68872064f06df23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
236e7ebbb54988759d8292623fce4221

SHA1
13b61c88f1ab2e3d3edbab6a4508929e98d3c036

SHA256
9ea6a96022c4cb895b16a9a84da2bdc42fbe6cdee127d4a80e7ec1c91d7a8927

SHA512
80757261eba1b32207308ea600e09571a6b401aa13f12db3cc14033ac798b01856bef6cbd318688baa577a6086521ce738e8d08629c1dba83869deb8f2eb6ce0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
8d9a3bf3f256ae33f623285152a63620

SHA1
98c2d8199aa8ca2b4c4cc554bace642aa45fabd6

SHA256
f121ec4b76f195abac0ac7d7854446617257f7b8651ee7724fe2e4c49182b066

SHA512
af06ac19bd584638a4f4aa1e88cdaf0e22bc96238f200cf71ed27919ce46736352093c75f3b8f09c926c2c7d0f3b5deaaddce0d850dbf1336823fe6e732cf55e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\198b1dbef7ece2ad03770a72810f2b485859f245\f31eef8c-c364-42cb-b453-ad7a3cfd1374\index-dir\the-real-index

Filesize
456B

MD5
d572f45e1d5c87130193846fa9cbd8d5

SHA1
6024777a31446072ed8c9c68bf37d71914d77f33

SHA256
dba032f2fc2934be369f4858e59c69f7c00f65de131d737302f077cf84006db0

SHA512
3c69e38df48e3532c84e7fe6420eee6a0fdea1c28b6a00bdda0153a270e117b4e6dc05646caa544ef922e963e639ae519e2d3ef732340b516ef103611d92614f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\198b1dbef7ece2ad03770a72810f2b485859f245\f31eef8c-c364-42cb-b453-ad7a3cfd1374\index-dir\the-real-index~RFe5a5b7f.TMP

Filesize
48B

MD5
fa7394bc9e83f1f744fe182c1cc2a985

SHA1
18b3d734d84d0e9e6bfc46e11472a47992fd381a

SHA256
976728a2cb2a0444cbed3e97b9c979fa54ca5ed07709f74166a18ac5a1675a33

SHA512
712b960a9789117836c27857a0f16b486c12dff057416096e5c0b931437a15008cae512e6a964166eaf1c593a6cfa74d576be3e81cf60bbee272e7f37a3222b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\198b1dbef7ece2ad03770a72810f2b485859f245\index.txt

Filesize
95B

MD5
b63a21f079dfcfca86e9920d6157c7d2

SHA1
df51195736ed9b1a9929d662fb87fe20304bfd9f

SHA256
6666a7626aa10a2c3fcf853f3ba9789963ff96ef8e9f7f6a14abb104654552ce

SHA512
87b050363c8c333c72e32254077be4dc38e552f186dd19242f0ecbf7adf298117acea9e9bead65f6e378c0753dda2999711845163d42ebe30c3f8223add484ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\198b1dbef7ece2ad03770a72810f2b485859f245\index.txt

Filesize
90B

MD5
278dbe7bf49a15da1d74fc16397bd0c0

SHA1
4e98c94f8989e886419173096c37c2634dc1c160

SHA256
e32d22a92e5dd9a6cc861019082b0dba42f6dd2a65a311711d8895aa0ecea941

SHA512
f4ae83136ddc6a332dbf639320ca6a0944862e8be6dff9dcbc62789edc7786dea7408437037fe527c93decd3cd867bd3fcc69705665140b7def15a60a3b11c04

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
31fabe67b7a5d947bfda2f102b19dcdc

SHA1
1f6ec9f95a5984d2ddbfd018409699e658796fef

SHA256
17935895c72c8123990e650e7684689d45ea6c17fea13f1f87638700ac3eba1b

SHA512
7d66233948c3ff095eb6e9df1306fd46c8fd0bf0b1ba44482c623924286237a46e5c8714000f52e5cb12fc5f28db6bff8d3ad6a6bbe81fb966525e8cf261fd60

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5846c8.TMP

Filesize
48B

MD5
9000a94ee4464f68f6ec1cff76cc8e5d

SHA1
8368f946a3ad796d1346d3a58e68e8f18f0d5c3e

SHA256
e788f41eaf0b26793685eaa714dec362f7d619f2762bef8c82c8883d546d71b2

SHA512
6167147dd919f1505a05276445cd009350f276f41c97f410c8f5f5874ff623ea1315992b7107eaf6f9ef3ed4360fefcbcf63bab4bf695e78bdf04bb1533bf2e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d5a443e3a830f2fa38947b57997cafd2

SHA1
2d125eb46eef63e7f58b75c5593aaabafebbd485

SHA256
c9389b40493adf4a77eaa450736646a7ad1136dacdc19783115fffa44b609e60

SHA512
e05ff6bf40e7d0fa82831d28f1b74f43f5927c48746133a29f8f06b4d68e7b0daaa56d583ed8554e749edbefb92e0b0a021dda63aac982df89b5131bd133a13c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5a180d.TMP

Filesize
1KB

MD5
8a670e301bdbce20b8fde3e4237880b4

SHA1
7ac891eab85cb4cf7adec0ff35e90aa1f3582dd3

SHA256
1a86c813b6dc9d1ee613f5faa62983bcde12414138e85597eae7bba455c3718d

SHA512
f7e7203444c877f1e5f0f9621f802936f9503494c9f6ce22c7b41717da0fe3796c17251405d17621399c78e8845751f2db1196f55f4d93a779eb816b7c531ab3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
214183163c41297ddb1772b66d5d5013

SHA1
72be4a070e73352c3ab977438cd6e62c623c0339

SHA256
3a59695009741aa8a446bc1d23bae5d2ccf37a805413da72bc74228ab613ed36

SHA512
be8f01b8e031ba10339036fbde802af40765bf81ea09968896a77f18d106b828238fa2caf9e1d4df323ac9d2b13e879c651ed6b90a44f6b4fc404e61605206e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6b15444ff5d41503650e1030f00c4e41

SHA1
0e63975ec022f8ff4db6d01b2e317beca2d3b1f8

SHA256
df9ec5ca81b396d0b29731866af63bdbf4ac210ffa2a87e7b74d98626db0828b

SHA512
f7ecdb3b7ad5067042106ed21372242c0d9a4d34d428c2a6e1dd4d3da396c94068309290aa42aaf39425cbe02971e148fffd59485a31e07da80d7cbee1713f05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
af098afa1254e80737879915f86a1cbb

SHA1
5c26c69d67c8ef94052e2ba609c159a3675e70e1

SHA256
a014f451946421e508a3e68265fc18bc408edb4e439e0c1bf2b9496fc40c8f14

SHA512
7a428c0f5063a4faa06e9955d6fa8159e6c86e74e174a5e2c28ba74bed39bc6c1e3f0be21bea57f43fe48ce6954fa48b2bf59094b39e37b74e40aff56da1b646

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
bc6df5d44aa00a0e924c22e97207280a

SHA1
539335a94a456dac1f3d8b946455bc037e23217e

SHA256
ffe845f8565ae131257c01353a1586007a9a7ada53e81042f817258f8acec402

SHA512
3aea83410f7600d87860732afb166eb92585943daeab3e7781fd7b8e4c0229914800fa2c67a1518b8dcc7ce18862c92f5a9518d39edaa20fb0a3376c435db008

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
484d6d00765be6fd0bc773f757ff6891

SHA1
e8ece9c8fc7dc8a14b194dcfc8ea8f9c02c443f8

SHA256
5e0a91413c9c8cbeae1be2a001607745761239576f0886e0405f150a88dde64e

SHA512
13590c35217205861866920744ebbf0870f25e64c192d80f459f993eae86de6965ab61febb82e76912b1cacab159a7dfa867c43ad58ea618fb6778e0ddfc2f89

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI7a671.LOG

Filesize
232B

MD5
b8fbdcf3c10e47eb4d5c7c1899fe136b

SHA1
dc2de6e109d7b4eea46811ea850ec7984769b2cc

SHA256
3d1ae9294e7b921cd05e08ea6fe27697de6d3c701ac4b8d43b36d9496d13ed42

SHA512
3c408f0fdfe80265c6271f2404a01a6f31b716cadf805137c098a4255dd53e5777a0983fac5e49b0f11532d7bf2dae9c6fd545808731c2271eea621c2943b1a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIA132.tmp

Filesize
936KB

MD5
13056f6fc48a93c1268d690e554f4571

SHA1
b83de3638e8551a315bb51703762a9820a7e0688

SHA256
aeda49baf2d79da2f7a9266f1fb7884111c2620e187090321f5278af5131c996

SHA512
ca828b4248e399178a8614f941332d159a30bad0156df0d5f4c4ca9d74d0ccb61fac59f34c945f5f914e22ec639bd97718f76d21b452825b07fe4041d1a44824

Download Submit
C:\Users\Admin\AppData\Local\Temp\Stix Free.msi

Filesize
2.7MB

MD5
b4daf951e41c21795eeeb4c7141a3aeb

SHA1
8436ab7e8aab0edae48714e8260a3ffd51bafa5d

SHA256
45667d98b375a24c5a33a77e98533b8b79effa873dc384f012ca23deb9a25199

SHA512
ddfc981be2930e9813302905c74798bf76a58cae6871365f07a42f73d0acc20af780c4c718799f33cb9d4a75a4b0489c9eff1ababd4455c1b5085d495f995c43

Download Submit
C:\Users\Admin\AppData\Local\Temp\Stix Free1.cab

Filesize
5.6MB

MD5
7d357b9e5c3a214866667cff39abaa81

SHA1
3f727c98e343f8f5c9708e28868a09f532e9d482

SHA256
9ac5553c6dba1089de9b6b1c8780601ed09ceac58015d991f93ea011eb6d2bc2

SHA512
c90d6bb561bb882e5fbe1e6c961d894a9a2b0b2a789e316d6c762bbf910fa1aa90f82451510fb1e20d8763c689c9c7094d511bc7cb48cd326deba2d1f86544bf

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
92bb50ec3bcc7870b311c5ca49550607

SHA1
98cd5718ccae700b6799baf1fd0644fcd1e74247

SHA256
749d575f69fbe58e47bb970f80603c60e18c60db15b0f252d06342cf5fcfc162

SHA512
a861bb47325b4c8792049b58322acebafd6243a7be7d90ebfcd8d54214b92e86c1ea929ef497ef5f64e802d83364fbc43bfaa53dc8e97070506811b37dc478fb

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 812964.crdownload

Filesize
12.3MB

MD5
b5ecb6d0a487cff57891ec2cc46370fd

SHA1
1229b2fa0c40d88a7e1b6f457695c7af8c3b55e9

SHA256
80caaa2035880fc2b582398310208a9d25b1f07820f23da06e769bedb36030b6

SHA512
cea39367b838c1f35f9d197d979f6cc23919b8c1198b87adb9ec28db46aa14c19a55b688586428a89dee74a801b888819943a41049b9ee5a93d317d3e93758c0

Download Submit
C:\Windows\Installer\MSI14A1.tmp

Filesize
409KB

MD5
2ef8b550ddd397348f68184c98574db7

SHA1
10c90533fb98e44a1b2e9cc41c48d4467a134669

SHA256
15553ef5606978f9291107565df7e254b375acffc30098ff5b395bba43c3b02c

SHA512
720cf96f01dc0e38b208668bc1fd719e08c44edea64142b85389581a6a5c67469da5ba73ebe4edc7747a091e56a2b0bb7a36b48a3ba29f0a3ab984a588efc2f0

Download Submit
C:\Windows\Installer\MSIF9E.tmp

Filesize
881KB

MD5
1dfd211901db1786649a911dfedc3f7f

SHA1
5785489170086bbfa69ac1c324b3437ca337d926

SHA256
7f4713f31958704586a9173759dc568dd48b21de022eeae19e5152ae2d011b4d

SHA512
4c7cd03d9067ce17f15df2ddb6073aa372999d00a4475dbc04b947232357b8cca27aaae1630a5a58959ade379d2b073c2df6b0e41fd97e7ded5bf8ab5ade93eb

Download Submit
memory/5256-484-0x0000021677AA0000-0x0000021678114000-memory.dmp

Filesize
6.5MB

Download
memory/5256-483-0x0000021677200000-0x0000021677412000-memory.dmp

Filesize
2.1MB

Download
memory/5256-482-0x00000216741C0000-0x0000021674606000-memory.dmp

Filesize
4.3MB

Download