hxxps://bingwallpaper[.]microsoft[.]com

Resubmissions

10-01-2025 17:57

250110-wjlkka1nbw 8

10-01-2025 15:16

250110-snhspazrbm 8

Analysis

max time kernel
91s
max time network
94s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
10-01-2025 15:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://bingwallpaper.microsoft.com

Score

8^/10

microsoft defense_evasion discovery persistence phishing ransomware spyware stealer

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
42	4552	rundll32.exe

Executes dropped EXE 6 IoCs

pid	Process
3004	BingWallpaper.exe
3700	StartupInstaller.exe
2072	BWInstaller.exe
4392	BingWallpaperApp.exe
3160	DefaultSetup.exe
4136	DefaultSetup.exe

Loads dropped DLL 24 IoCs

pid	Process
2072	BWInstaller.exe
2072	BWInstaller.exe
2072	BWInstaller.exe
2072	BWInstaller.exe
2072	BWInstaller.exe
2072	BWInstaller.exe
1044	MsiExec.exe
1648	rundll32.exe
1648	rundll32.exe
1648	rundll32.exe
1648	rundll32.exe
1648	rundll32.exe
1044	MsiExec.exe
4552	rundll32.exe
4552	rundll32.exe
4552	rundll32.exe
4552	rundll32.exe
4552	rundll32.exe
4552	rundll32.exe
4392	BingWallpaperApp.exe
4392	BingWallpaperApp.exe
4136	DefaultSetup.exe
4136	DefaultSetup.exe
4136	DefaultSetup.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	BingWallpaper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000\Software\Microsoft\Windows\CurrentVersion\Run\BingWallpaperApp = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\BingWallpaperApp\\BingWallpaperApp.exe"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\!DefaultSetup = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\DefaultSetup\\DefaultSetup.exe"	BWInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	DefaultSetup.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe

Detected potential entity reuse from brand MICROSOFT.
phishing microsoft

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\BingWallpaperApp\\WPImages\\20250110.jpg"	BingWallpaperApp.exe

Drops file in Windows directory 22 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e587907.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7C02.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI7F30.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File created	C:\Windows\Installer\e587903.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{217B7A56-3DCD-4C47-9F1E-2C13A2B658E3}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7AE8.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7C02.tmp-\DispatchQueue.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI7F30.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\e587903.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF9A15BA6A4851E41F.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF5C072666B54D2C4B.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7C02.tmp-\CustomActions.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI7C02.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File created	C:\Windows\SystemTemp\~DF7BB137068142724D.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7C02.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7F30.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7F30.tmp-\CustomActions.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI7F30.tmp-\DispatchQueue.dll	rundll32.exe
File created	C:\Windows\SystemTemp\~DF08EB34D365A9D3E2.TMP	msiexec.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\BingWallpaper.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BWInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DefaultSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BingWallpaper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	StartupInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BingWallpaperApp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DefaultSetup.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4552	rundll32.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies Control Panel 1 IoCs

evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000\Control Panel\Desktop\TileWallpaper = "0"	BingWallpaperApp.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 735710.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\BingWallpaper.exe:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 36 IoCs

pid	Process
2020	msedge.exe
2020	msedge.exe
2152	msedge.exe
2152	msedge.exe
1996	identity_helper.exe
1996	identity_helper.exe
3656	msedge.exe
3656	msedge.exe
4748	msedge.exe
4748	msedge.exe
2072	BWInstaller.exe
2072	BWInstaller.exe
2072	BWInstaller.exe
2072	BWInstaller.exe
2072	BWInstaller.exe
2072	BWInstaller.exe
2072	BWInstaller.exe
3140	msiexec.exe
3140	msiexec.exe
1648	rundll32.exe
1648	rundll32.exe
4392	BingWallpaperApp.exe
4392	BingWallpaperApp.exe
4392	BingWallpaperApp.exe
4392	BingWallpaperApp.exe
4392	BingWallpaperApp.exe
4392	BingWallpaperApp.exe
4392	BingWallpaperApp.exe
4392	BingWallpaperApp.exe
2072	BWInstaller.exe
2072	BWInstaller.exe
4136	DefaultSetup.exe
4136	DefaultSetup.exe
4136	DefaultSetup.exe
4136	DefaultSetup.exe
4136	DefaultSetup.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2072	BWInstaller.exe
Token: SeShutdownPrivilege	4064	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4064	msiexec.exe
Token: SeSecurityPrivilege	3140	msiexec.exe
Token: SeCreateTokenPrivilege	4064	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4064	msiexec.exe
Token: SeLockMemoryPrivilege	4064	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4064	msiexec.exe
Token: SeMachineAccountPrivilege	4064	msiexec.exe
Token: SeTcbPrivilege	4064	msiexec.exe
Token: SeSecurityPrivilege	4064	msiexec.exe
Token: SeTakeOwnershipPrivilege	4064	msiexec.exe
Token: SeLoadDriverPrivilege	4064	msiexec.exe
Token: SeSystemProfilePrivilege	4064	msiexec.exe
Token: SeSystemtimePrivilege	4064	msiexec.exe
Token: SeProfSingleProcessPrivilege	4064	msiexec.exe
Token: SeIncBasePriorityPrivilege	4064	msiexec.exe
Token: SeCreatePagefilePrivilege	4064	msiexec.exe
Token: SeCreatePermanentPrivilege	4064	msiexec.exe
Token: SeBackupPrivilege	4064	msiexec.exe
Token: SeRestorePrivilege	4064	msiexec.exe
Token: SeShutdownPrivilege	4064	msiexec.exe
Token: SeDebugPrivilege	4064	msiexec.exe
Token: SeAuditPrivilege	4064	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4064	msiexec.exe
Token: SeChangeNotifyPrivilege	4064	msiexec.exe
Token: SeRemoteShutdownPrivilege	4064	msiexec.exe
Token: SeUndockPrivilege	4064	msiexec.exe
Token: SeSyncAgentPrivilege	4064	msiexec.exe
Token: SeEnableDelegationPrivilege	4064	msiexec.exe
Token: SeManageVolumePrivilege	4064	msiexec.exe
Token: SeImpersonatePrivilege	4064	msiexec.exe
Token: SeCreateGlobalPrivilege	4064	msiexec.exe
Token: SeRestorePrivilege	3140	msiexec.exe
Token: SeTakeOwnershipPrivilege	3140	msiexec.exe
Token: SeRestorePrivilege	3140	msiexec.exe
Token: SeTakeOwnershipPrivilege	3140	msiexec.exe
Token: SeRestorePrivilege	3140	msiexec.exe
Token: SeTakeOwnershipPrivilege	3140	msiexec.exe
Token: SeRestorePrivilege	3140	msiexec.exe
Token: SeTakeOwnershipPrivilege	3140	msiexec.exe
Token: SeRestorePrivilege	3140	msiexec.exe
Token: SeTakeOwnershipPrivilege	3140	msiexec.exe
Token: SeRestorePrivilege	3140	msiexec.exe
Token: SeTakeOwnershipPrivilege	3140	msiexec.exe
Token: SeRestorePrivilege	3140	msiexec.exe
Token: SeTakeOwnershipPrivilege	3140	msiexec.exe
Token: SeRestorePrivilege	3140	msiexec.exe
Token: SeTakeOwnershipPrivilege	3140	msiexec.exe
Token: SeRestorePrivilege	3140	msiexec.exe
Token: SeTakeOwnershipPrivilege	3140	msiexec.exe
Token: SeRestorePrivilege	3140	msiexec.exe
Token: SeTakeOwnershipPrivilege	3140	msiexec.exe
Token: SeRestorePrivilege	3140	msiexec.exe
Token: SeTakeOwnershipPrivilege	3140	msiexec.exe
Token: SeRestorePrivilege	3140	msiexec.exe
Token: SeTakeOwnershipPrivilege	3140	msiexec.exe
Token: SeRestorePrivilege	3140	msiexec.exe
Token: SeTakeOwnershipPrivilege	3140	msiexec.exe
Token: SeRestorePrivilege	3140	msiexec.exe
Token: SeTakeOwnershipPrivilege	3140	msiexec.exe
Token: SeRestorePrivilege	3140	msiexec.exe
Token: SeTakeOwnershipPrivilege	3140	msiexec.exe
Token: SeRestorePrivilege	3140	msiexec.exe

Suspicious use of FindShellTrayWindow 44 IoCs

pid	Process
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
4392	BingWallpaperApp.exe
4392	BingWallpaperApp.exe
2152	msedge.exe

Suspicious use of SendNotifyMessage 14 IoCs

pid	Process
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
4392	BingWallpaperApp.exe
4392	BingWallpaperApp.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2152 wrote to memory of 2860	2152	msedge.exe	77
PID 2152 wrote to memory of 2860	2152	msedge.exe	77
PID 2152 wrote to memory of 780	2152	msedge.exe	78
PID 2152 wrote to memory of 780	2152	msedge.exe	78
PID 2152 wrote to memory of 780	2152	msedge.exe	78
PID 2152 wrote to memory of 780	2152	msedge.exe	78
PID 2152 wrote to memory of 780	2152	msedge.exe	78
PID 2152 wrote to memory of 780	2152	msedge.exe	78
PID 2152 wrote to memory of 780	2152	msedge.exe	78
PID 2152 wrote to memory of 780	2152	msedge.exe	78
PID 2152 wrote to memory of 780	2152	msedge.exe	78
PID 2152 wrote to memory of 780	2152	msedge.exe	78
PID 2152 wrote to memory of 780	2152	msedge.exe	78
PID 2152 wrote to memory of 780	2152	msedge.exe	78
PID 2152 wrote to memory of 780	2152	msedge.exe	78
PID 2152 wrote to memory of 780	2152	msedge.exe	78
PID 2152 wrote to memory of 780	2152	msedge.exe	78
PID 2152 wrote to memory of 780	2152	msedge.exe	78
PID 2152 wrote to memory of 780	2152	msedge.exe	78
PID 2152 wrote to memory of 780	2152	msedge.exe	78
PID 2152 wrote to memory of 780	2152	msedge.exe	78
PID 2152 wrote to memory of 780	2152	msedge.exe	78
PID 2152 wrote to memory of 780	2152	msedge.exe	78
PID 2152 wrote to memory of 780	2152	msedge.exe	78
PID 2152 wrote to memory of 780	2152	msedge.exe	78
PID 2152 wrote to memory of 780	2152	msedge.exe	78
PID 2152 wrote to memory of 780	2152	msedge.exe	78
PID 2152 wrote to memory of 780	2152	msedge.exe	78
PID 2152 wrote to memory of 780	2152	msedge.exe	78
PID 2152 wrote to memory of 780	2152	msedge.exe	78
PID 2152 wrote to memory of 780	2152	msedge.exe	78
PID 2152 wrote to memory of 780	2152	msedge.exe	78
PID 2152 wrote to memory of 780	2152	msedge.exe	78
PID 2152 wrote to memory of 780	2152	msedge.exe	78
PID 2152 wrote to memory of 780	2152	msedge.exe	78
PID 2152 wrote to memory of 780	2152	msedge.exe	78
PID 2152 wrote to memory of 780	2152	msedge.exe	78
PID 2152 wrote to memory of 780	2152	msedge.exe	78
PID 2152 wrote to memory of 780	2152	msedge.exe	78
PID 2152 wrote to memory of 780	2152	msedge.exe	78
PID 2152 wrote to memory of 780	2152	msedge.exe	78
PID 2152 wrote to memory of 780	2152	msedge.exe	78
PID 2152 wrote to memory of 2020	2152	msedge.exe	79
PID 2152 wrote to memory of 2020	2152	msedge.exe	79
PID 2152 wrote to memory of 2648	2152	msedge.exe	80
PID 2152 wrote to memory of 2648	2152	msedge.exe	80
PID 2152 wrote to memory of 2648	2152	msedge.exe	80
PID 2152 wrote to memory of 2648	2152	msedge.exe	80
PID 2152 wrote to memory of 2648	2152	msedge.exe	80
PID 2152 wrote to memory of 2648	2152	msedge.exe	80
PID 2152 wrote to memory of 2648	2152	msedge.exe	80
PID 2152 wrote to memory of 2648	2152	msedge.exe	80
PID 2152 wrote to memory of 2648	2152	msedge.exe	80
PID 2152 wrote to memory of 2648	2152	msedge.exe	80
PID 2152 wrote to memory of 2648	2152	msedge.exe	80
PID 2152 wrote to memory of 2648	2152	msedge.exe	80
PID 2152 wrote to memory of 2648	2152	msedge.exe	80
PID 2152 wrote to memory of 2648	2152	msedge.exe	80
PID 2152 wrote to memory of 2648	2152	msedge.exe	80
PID 2152 wrote to memory of 2648	2152	msedge.exe	80
PID 2152 wrote to memory of 2648	2152	msedge.exe	80
PID 2152 wrote to memory of 2648	2152	msedge.exe	80
PID 2152 wrote to memory of 2648	2152	msedge.exe	80
PID 2152 wrote to memory of 2648	2152	msedge.exe	80

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://bingwallpaper.microsoft.com
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fffa4593cb8,0x7fffa4593cc8,0x7fffa4593cd8
  2⤵
  PID:2860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1924,12253169463073924464,16557246352353908760,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1932 /prefetch:2
  2⤵
  PID:780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1924,12253169463073924464,16557246352353908760,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1924,12253169463073924464,16557246352353908760,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2568 /prefetch:8
  2⤵
  PID:2648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,12253169463073924464,16557246352353908760,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:2612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,12253169463073924464,16557246352353908760,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:3340
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1924,12253169463073924464,16557246352353908760,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4872 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,12253169463073924464,16557246352353908760,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4824 /prefetch:1
  2⤵
  PID:956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1924,12253169463073924464,16557246352353908760,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3964 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,12253169463073924464,16557246352353908760,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3804 /prefetch:1
  2⤵
  PID:1948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,12253169463073924464,16557246352353908760,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:1
  2⤵
  PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1924,12253169463073924464,16557246352353908760,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5720 /prefetch:8
  2⤵
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,12253169463073924464,16557246352353908760,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:1
  2⤵
  PID:2980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,12253169463073924464,16557246352353908760,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 /prefetch:1
  2⤵
  PID:1800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,12253169463073924464,16557246352353908760,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6096 /prefetch:1
  2⤵
  PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,12253169463073924464,16557246352353908760,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5860 /prefetch:1
  2⤵
  PID:4232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1924,12253169463073924464,16557246352353908760,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5816 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4748
- C:\Users\Admin\Downloads\BingWallpaper.exe
  "C:\Users\Admin\Downloads\BingWallpaper.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:3004
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\StartupInstaller.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\StartupInstaller.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3700
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\BWInstaller.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\BWInstaller.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2072
    - - C:\Windows\SysWOW64\msiexec.exe
        
        "C:\Windows\System32\msiexec.exe" /q /i BWCInstaller.msi /norestart
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:4064
    - - C:\Users\Admin\AppData\Local\Microsoft\DefaultSetup\DefaultSetup.exe
        
        /c:"DefaultSetup.exe CD=1"
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:3160
      - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\DefaultSetup.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\DefaultSetup.exe CD=1
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,12253169463073924464,16557246352353908760,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,12253169463073924464,16557246352353908760,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:1
  2⤵
  PID:2748

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1744

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2700

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3140
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding C9E9E8C1B24ACC9B2DD7798FB6D5A17E
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1044
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI7C02.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240680000 2 CustomActions!CustomActions.CustomActions.StartApp
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:1648
  - - C:\Users\Admin\AppData\Local\Microsoft\BingWallpaperApp\BingWallpaperApp.exe
      "C:\Users\Admin\AppData\Local\Microsoft\BingWallpaperApp\BingWallpaperApp.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Sets desktop wallpaper using registry
      System Location Discovery: System Language Discovery
      Modifies Control Panel
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:4392
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI7F30.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240680875 8 CustomActions!CustomActions.CustomActions.InstallPing
    3⤵
    - Blocklisted process makes network request
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:4552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e587906.rbs

Filesize
9KB

MD5
1b9ef8bcceaaa1d7e02c9fbb840e7346

SHA1
9f1b06aa0062ef32141c2e14918115a452a31f7e

SHA256
753e0573c73c381156493b624b82f09d0d8119966161ac9f22f79e30f1a2b664

SHA512
77ed2ed90ae0a3406442ff2edd1760b098798dbe987b575bfb4c2b0668f87af30ba24e755d7fe37a96551cd2e77e641722e0f3fb303c239a778492cc21a83518

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\BGAHelperLib\BrowserSettings.dll

Filesize
1.3MB

MD5
884f63dbc809dcec05912a05477fa078

SHA1
3aa2d5b9a24db61b4532cc4a3b33040e36827eed

SHA256
afddc2cf125104f3b907f0645a9f921475e02eda0a54179fb77ea677a608501d

SHA512
30853c127905c6cfe9360279f334d50c273d53db09ebd869e4107fddbb3cd75ccadf531b783ed0afb5a6e25dba338709be67e3468d4bc64f56f407dc6975f8a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\BingWallpaperApp\BWAConfig.bin

Filesize
5KB

MD5
8276e654974759a77d33b44ee053e456

SHA1
74b32a6199f249f53404fd5bf1551d17f466813b

SHA256
a180dad15efeb2c0ebdfb5095608849e8a0555ee7f7140c263c3bf50eaf186c7

SHA512
6b9c17cc4e86373b8b20c62efb6bbd527e91c5d18d48deab5ba2063d4acc71645f9cd8c990ed082c4c6099e1e8067d4db6df3242d6bd0b80d5f9427511aedf9d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\BingWallpaperApp\BingWallpaperApp.exe

Filesize
7.9MB

MD5
b34ce96cb54d927a0d75a1e76888cce1

SHA1
033d501f1c688de169456baeea502ec8799cec66

SHA256
037af8085ab9f453cbaf325ac922d309a6aa4d3e624b521f0a590054a98f9aa4

SHA512
7f44b1d811e32c384e62cbbd19a85db4c4366848c511d52821a0afd064deda14175e586a086db5e1b03b961118bc1cc167c5d988c04f691c759fc0e43650363b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\BingWallpaperApp\WPImages\20250103.jpg

Filesize
464KB

MD5
fd1ae8741410218865b874c86b794170

SHA1
8e17b55acf482a201f5197a2195df00089701e9a

SHA256
e8983655333b1afe8246758c3efdcf5cee6df55cd8d449da4ff4bb23e1b334a2

SHA512
896594ef8755277ecb72e2b07f2107d2a6fdb8489cbcfd578f0769eb2d4040f6661273bff414951b63100791fd0ac2d0ce39c8e492635dddebe52eb8f8cc4d80

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\BingWallpaperApp\WPImages\20250104.jpg

Filesize
899KB

MD5
073082152224c87c2420286bb881d96d

SHA1
67538c0aae4cdcd20493233894729f0ba3285e7e

SHA256
9a39b16b9f93fea7294c2ef5bf76c69339234fd46ee4eed8a573085edc41d03a

SHA512
0a604cc96bd79bdbd41f1249f5984261018dcaf7f4515c3ca6d416e5cba10b64bf5c070bf84092e06ae5da0068a89504e9e6b53611dca58ce919dc8e03afc7cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\BingWallpaperApp\WPImages\20250105.jpg

Filesize
226KB

MD5
e967de071938ec449f5d317060d7a7dc

SHA1
738005607b5a754fcbb23b060f54c6e53dca5fae

SHA256
e146498d229bb4b3ca42b2c52defc227f1ecc3608a159072bd6185df3d005405

SHA512
8d30d2f461c9ffe08d968226942ae913ae08612eb822a30ca2c960f063f996f4c4fb32fe2d5db9c91bb36edbe43e92a43cbc04a66c20f4ecdb27f6f7723f5dc6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\BingWallpaperApp\WPImages\20250106.jpg

Filesize
684KB

MD5
22256a4d3467e24b926ab1288697ffb8

SHA1
63a8b0e2a73b34a39bcbf6d8e3503716a07795bc

SHA256
251625c1e60cb2c9883a574f0b284431a722fa2bdfd743052229b393b57beaab

SHA512
6a44bcc9205eea3f4ca727572139adb2320f2d8374a02130009f230fc27cc331b779d9200f336cd689c09bebe69a96efa452d6c8a77c871f75233ad2b56192c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\BingWallpaperApp\WPImages\20250107.jpg

Filesize
197KB

MD5
58328558c57d6ef7961583188bfa3e08

SHA1
76abc9d2729655e4e56f246d253bff0b63efb8b2

SHA256
abb18da05f34ae011d114ff2bb776e9bcda33290e2e034d24dae8a47d86371c4

SHA512
ed38cbcba8dd096a3abe9925d40cba0f4afad6a4b573467e3129bce6ca5caf376ad9277d10b32c5917b509ba04424023157a47894e553bb63b6bb38f8c34c59b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\BingWallpaperApp\WPImages\20250108.jpg

Filesize
717KB

MD5
9470068c57d474fedea45b71901fdfe9

SHA1
3e3fcb061cfcc385c1208d9d1edb1b6075ab9b45

SHA256
9dc101d85f5a88579bf13f5c338c3157aec0b4a512f491e079129888c00f3d21

SHA512
0a4e690880f670928b3dd58c82b851724dd8cd92cb4a8ff84102cab8ff668ab2b18d600d9b7b143a8f69dd02fd2c4a40a0183d7866ca693f639b2e3eb2e54250

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\BingWallpaperApp\WPImages\20250110.jpg

Filesize
419KB

MD5
9bef8950b8ecee0a190b3aebde37ac6e

SHA1
12c9c6f0244ff697a6daaa96274a69bc51dfc6bb

SHA256
3d1d675eee8b8270e9bf1ac5512496c4422b00f0ab372fee82bfd89e224f79e5

SHA512
243363d44891780b607468a5a914ae155422dba134e63175673130854a72e36ba503f9be5f306bc637e8ab2d4102108556b6b8174a27c3240eebc38382c306c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rundll32.exe.log

Filesize
651B

MD5
c4ce6fd8431b5747fd7a4c401325fb3a

SHA1
2f227bb73b2fae1020ca2b8b95b5b73b8f35403a

SHA256
3c801df6bf214e7b7b80514241c3f6d0d250ddbefd8c3dcffc7402c2e755f970

SHA512
379915b75023e787a13d55c35bc64f48b23dc59dda5ea65aeab4815aeb45b676f7364e7c42acc416cb8b1f9142c4af89c2a193913a3cc01672e6bf2c9d9bda26

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\DefaultSetup\DefaultSetup.exe

Filesize
1.1MB

MD5
92362723de1d43ab3ae6ea5378b3c211

SHA1
c73304a354ed3dc70d1ff3a677a53a0309bd4786

SHA256
2e4100c3b6d986f703edf2640614109d7095df87c31dc263abeae2505c763c87

SHA512
75bbf7c5dbf8d81d1ed10b6a0ba170f19ab8a0a036d79f0c2e79bf874567f8d62151f7533d230bc92ad661ce9a0f3971da2856461cfae6ff7df6e198789c7f30

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Dispatcher\DispatchQueueBWCApp.bin

Filesize
86B

MD5
6edde9c152ef9a3e7d5f24b5f22622f5

SHA1
15db8e85bae98c30bfebb3c2044dee536bd0b784

SHA256
3f6664566ce09cf643413ba5cc078b446c1c82021db73a81bc992350bf2bcee0

SHA512
901de660cf8c602ffe72d56e7cb011d534dbe7252bee126d05e5af5b9f5b2cc904edaeafd6d110ad989f9d8f7d7f10b1c510936234242b8f7aac9f6d1db712b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4c1a24fa898d2a98b540b20272c8e47b

SHA1
3218bff9ce95b52842fa1b8bd00be073177141ef

SHA256
bbcc378fcbf64580e7a48b4e7ca9be57fa0a1f2e747f488325685bdb18d73a95

SHA512
e61f196e7f1c9a5fe249abe9b11eea770fb2f4babc61f60b12c71f43e6fe9354cf14869daf46abc2c2655bce180252acd43c10562a2dcd31fa7d90d33253820e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f1d2c7fd2ca29bb77a5da2d1847fbb92

SHA1
840de2cf36c22ba10ac96f90890b6a12a56526c6

SHA256
58d0f80310f4a84f687c5ce0adaa982eb42fe4480510399fa2ae975d40bb8bc5

SHA512
ede1fafea2404f16948fe0b5ea5161ccee3ee6e40c55ff98c337eac981a6776b9c73dc030a5c59e4347aec91259f497539206e71949c33adcecbf2c846709e14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
384B

MD5
b5343f647112da4a3a289e582880e02e

SHA1
a5edcd4494029e3ee6f00474b4f4d67375fda822

SHA256
ae523b5adbcee86a08e3864a24c04f97d5bed68f592aa697f367ebd5bc63b502

SHA512
3371a3618aa5283a122a22ae2e8fe5d557482d8ba07944bc6b3c5c2a82e30fd10155139271697675c2bed11f6707d502b66eae4b351f1c7b8d592670bac75491

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

Filesize
116KB

MD5
7397dcde2a18a6214b49193d6d552dca

SHA1
bc6a33f11732463810d2fff40ed813b663826bda

SHA256
bc6318fe3671c94a2884ad2a09ffb57056914b01b374983e873bf595357fe7d5

SHA512
cdd9aa4d99e238c1b063ec15b4fbc460c560231bdacbc311c5453a91132422878c93cf6c68315fccdf77f76cd1f251d820aa50e572099b348ee8002fd46536c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
668B

MD5
282ff5ba82ce06194b08f063b7ae40e3

SHA1
95de9e73fdce8a8f1ca0abe7e395c407a7eafb62

SHA256
85eb275b3cbdb795e9b34e79f808ebc7578727fdf7210d77c9057608cd8bc519

SHA512
bcf13772ca8ff1d0014f5312e0d8359c194dade0f0bee8a6142e7c9864fee953e51bcaf0793a5459fb89f8492734b381f8b11f2bf9bf99dc1c47a44d6731c5d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6512744225c5515bb124281ed8ea7640

SHA1
c0c68a09ea16c7e8c27255d4298b0f776151ed7c

SHA256
437c58b671ceed7b74b165f19eb2f21e4c6e411ee975323c5e51a17adf524e2f

SHA512
c0e95229440304bd59817ed032ac0dc0bdfd34476fc02693832d210cf74bfc0db6de315acb7be8a5eddf2275c78e265dc2ff80f1929432272e9f8e7bc53d79c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
f66d5ba821a80916f966f4d4c3b3f71d

SHA1
3ad159e2c3775b1f6bc8a8c4bf08c25f32a7572c

SHA256
ae066fd15c9f1880914892eb7d9f2afaca8d79dfb9d9b5d3b5b0a28996837103

SHA512
0dc747abd22045c578cad0da842e7e7e321a24cbc2cbb479340aa6e26888bfa8f9d296d9a8e59effcd8609c87c8c42298b3a5de671f38388aa969e0afc6bfcd7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9e9c80ece2a66ab7e062d4797423e08a

SHA1
ededaa2c297b18ac388d81636d18df6963b9f527

SHA256
9784a1f4e7d7c6d6bd594f803a4a03af41a47dcf257d95c7906fef7e2896e29f

SHA512
6db785732dbb53f2d134ef8cad263399e6ca7eb10d35a481be45ecc0685901363230a500fe663a0e5a28e2b57cd8abb89e9a160eb3f37c2d74dae9aa4b06c8a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8e9eb93d6f8be6972bc238fd28fe87e9

SHA1
1cf2fefd2649762d405a1d21c7200d145353c5fc

SHA256
36c39e8fb0ef7d5cef2604c33881bcb49cc398cb628e69f90c3f37e3637707a0

SHA512
3a9cd6cbb96273842c5b8b2e4cc7dfd501168cd012ea0915ae61018560a0342814a30e69ad59182da3d6616515287dc6aa2fd3525f576e87ea86937fd74bcf18

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
705B

MD5
e9099b2f2767d18da9b32326bc5abfaf

SHA1
b6f2f6d56d3f6f05085c339ac6d56ec4b35e4055

SHA256
e34b79872504d6b977626da60a40044ed03964a572abdcceecee545d8e963870

SHA512
3abc4da28f68b8ee038da37213172b42c8db9b2725ca68468f721d532945b595a62524ee4ffbec2fa41351d731cc7055beef67deff248f436a31e3dd75745637

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5807bb.TMP

Filesize
705B

MD5
bb84c5099d1c604b11f0278e3e670791

SHA1
0385952f31195b2110d25696797e61a0495f93ad

SHA256
fb1148b6f11752e7104c3c302ce6500a936fe425b226a4058960016731f7fab2

SHA512
fe39b8140f7c04002050a763246461cb1c0803f3a2b5bb0b7db3ad9ae8d2f936a21e6ee628e869fc5a4322d1707b2a555a1462bb28fc9abc05f0b996f1018188

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
262abe779ba54d0c1d28464361bf281a

SHA1
02ee8ab3d3e467106d2b662229fb7c0454aa9e8e

SHA256
a2c6eb8054a9f5d544477cd5d976c6af9b0358292038103784a7267d05eb2352

SHA512
7e97c25c46e4b11ce3c9762eed36d81f6e53263f32a68beb4faf3bc73ad46f12d07242c60aecbb9424bb0d683177716c34bfe84b32ab0e1f41da17c1761a57d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
fd7ffd09909593b15eb103dd5bc865a0

SHA1
64200218725fd603bd9ce2704121b8a6ceb02d86

SHA256
6956fd6027e1df6df8a479a1246317d5c1c1ecd561bcbc5827ef33f87c899ad6

SHA512
eac6ce1dc5fd968068d3d3129bfdc9687a5f0ccd8474017458b1e46ccb0b35720f9e6a5b6343c2a3ebd34631433065170e0aaad6a968d0298f61367c6d8886df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
dfb9d996e2111ba05fdf596bc351be04

SHA1
b3ca750ab0a9003d0fde7fbf5b37c2ae602566c8

SHA256
c18b60cd16345f94d5154d7100d5c92e42c80cdfd5e64a1170c289ef695f2f8f

SHA512
7faa057322c79963cb30468175d42bc8605aefca0045136c216e528aafc115916373eb3b352573355e2f82bc2257c6fad54bbe6cda4c3ee52a9bc45beaa2b97f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
aa0ee71263bf3757d553c2fafd130222

SHA1
ac50e6501390dc08cd241a9d7630bb0e92c76f4b

SHA256
6fa63aee4f32392ff38a41a23adc24fa07fe65a103e6f5f411a61e6434afd21d

SHA512
d33c4904cec672f713a6bcce3b79c9de48db39a24caf1a0ef29b35961bb19012d81cd38703103b7785c965516bd81bb7e523bc6cdba47d80802bfb383c724077

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\BWCInstaller.msi

Filesize
8.2MB

MD5
758ae2c8b2cc90be0bb6ccc69b43b84b

SHA1
a6cfd161eee74ac4ecd2f0ce38f51a3553a5dbfb

SHA256
700804cdbc1501b825d23ec23a4e81b135b9ce7c18859a14b5190fa615322a2b

SHA512
c73f175a8f639f8e31a1364f154f1fb84df4336a195b5992d633f6feba0e29633311705b180f8d3a020555ef3f4061a28604d06da07bfa8a50edc0dabf48ee4c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\BWCProgressBar.dll

Filesize
23KB

MD5
1368cbda6193c6975d5e821063857264

SHA1
0db5a926e301f27d383e128ebe151a1395ea929c

SHA256
b9ab5eeb1fb007df27cb75286792c4adc2d00e0060aaeac45759d450f8ec22d1

SHA512
b1bd81a123b9299c798d83565e6ee8b5dcc42f9b6368f6aebefd970b0feeafafa4349c1e4f1d8812bebae1b02dc80efa019f410f8c508745abd7e841b3d459de

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\BWCUI.json

Filesize
332KB

MD5
e35c2eaf3320422da13059b70adf01af

SHA1
24f7d27beb428c78d9ae13120e1f5cbe83a295b0

SHA256
1938994de1615b21b49014e02b8d94744098463dc36fc7f5467bed7626808839

SHA512
9c554cd62788167ebac594bb9c4cf2ccda8c432002a568c2004a61c7198bc5ff9f3621675ccf13d04c667fbc72b19d64d0268e6418ae34b3cbf30d45de2e2744

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\BWInstaller.exe

Filesize
4.0MB

MD5
69cfd2651cc5f8c5e56580e0aac92f37

SHA1
17e0e08606df14a798ce1660622dcd56457e10f6

SHA256
966ce391d11604d595215e9b59f8ddc2d1c0231096ef803066d0cccc0f468afd

SHA512
fec894586bd27d36e651766c694febb3e4be54ecea5eb1ef5434106de9ebe05bcf5a05dec9c6ef77818210d62d327cd57e1574bb51f6a89ca4e09507736eee22

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\BWInstaller.exe.config

Filesize
801B

MD5
e469d9f754a66fd95cff05a4f3c4fee1

SHA1
91b91cefc2d169b83372633ddc6a1b3e1a45d96c

SHA256
104ee2cf017ec62e0387d636599519a3b260dae3f9da8a6bac3557b436e4b536

SHA512
7798da5521e0b711018404890400e11048193867a094e31c74fa1c6908fa37fcfe5d35c8e251c2c26e7e8f46abf68ab6506615e11dfedbd92e4c0344aa376506

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\BrowserDefMgr.dll

Filesize
1.8MB

MD5
dc54a5cf3776e2a936b289ae3a37ef83

SHA1
039bd560b024ed392e29b4129ec65d2675e742e6

SHA256
c78b29567031b933061230a3878782cb6781416823cdff9ba2277bce5abda525

SHA512
35c4a28ceb78feaac121b4a158aa22600047b31b3eeec66fbfc086c9a33eb7d2045ca389aafe79a6465914e5ac480f2813a94c9b5b297949a6b494962ac36388

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\DispatchQueue.dll

Filesize
158KB

MD5
588b3b8d0b4660e99529c3769bbdfedc

SHA1
d130050d1c8c114421a72caaea0002d16fa77bfe

SHA256
d05a41ed2aa8af71e4c24bfff27032d6805c7883e9c4a88aa0a885e441bec649

SHA512
e5f2fac5e12a7e1828e28c7395435e43449898a18a2a70b3f7ea6a1982e1c36f11da6ee7cc8ac7cefaab266e53d6f99ee88067bc9d719e99f4f69b4834b7f50b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Newtonsoft.Json.dll

Filesize
695KB

MD5
195ffb7167db3219b217c4fd439eedd6

SHA1
1e76e6099570ede620b76ed47cf8d03a936d49f8

SHA256
e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d

SHA512
56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\StartupInstaller.exe

Filesize
145KB

MD5
6d82a313035a9a8a9475fc95dbaa791c

SHA1
ff8cba4e8f004d01da206a4300443557ff015e05

SHA256
031a7b5fa53531cffe904ca6c77abbceffc29295b66d5d9d30990ff4e0da57fd

SHA512
eb3752099db1d1b4dea201ef89fb4af44f374153da8f243846ca3f5b05bab74f3222a737bed9eb39af637fd6113b9591213fb99691979a90e8087c347e86f27d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\DefaultSetup.exe

Filesize
61KB

MD5
350e7fc9681d0b4f1ab361f8e365bc0e

SHA1
80da5528474300bc2a7b2f987e5e8423fc875386

SHA256
f0296f36a6915640f958e8cd1794b49aea5630c302f6d8e99b3829b624773278

SHA512
414a36a8f6d8527f9adf46d95ca4f0284dcc5a617f5982ceb90e07d69017758286ec26a1dcdb60e27b58d93898cef88c21b1efdd11c4a98e4b6436446b7bf521

Download Submit
C:\Users\Admin\Downloads\BingWallpaper.exe:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 735710.crdownload

Filesize
13.6MB

MD5
41cfd22d05f19bfd31e44e5210f8f060

SHA1
7196b7d2fa9344af569006966af21808e4d77cff

SHA256
9bda0bc4025c234bbbcd9d06c8f1dd07d396fe642008c79d81263f75110b9b7b

SHA512
1a683c5fe89f6b1bb47f5c9a6b3710a1110fe0335237665d04baf8c68d4fd72089c119b6108032874f760f776f24325c4fa92acde9e3dfdc5af5c78a6f2584e6

Download Submit
C:\Windows\Installer\MSI7C02.tmp

Filesize
332KB

MD5
dc96169066bad280198e607d292cbb5d

SHA1
23b92d164290f1e4fb2063a22c27e99d53e80734

SHA256
38441f08ba0e5d283b2ded184b1988eac3c4f9da5820dd794e7ed3a783b88875

SHA512
d7c9c07d294b51deef587f81e4ac016dad73b7eccf81ee98f6a86733019e6d221ae2842c826d8880adb08363b13f70e52dc95bf89ef5116d86b0b3b0d4a165c4

Download Submit
C:\Windows\Installer\MSI7C02.tmp-\CustomActions.dll

Filesize
21KB

MD5
c09ca336a284eeb68655c663dfbe4011

SHA1
bad950ccd2cf7b62b374d00b01edf4db9ec49db0

SHA256
72af578be2076588cc4b146fd08273994513d4f4adfbcdce449abb4a610a3778

SHA512
19e475540c95e75e436642f2c0fdd1fcc3b3015398e999f8673f54d132e4be68cfca2a725be88112b5fe1bdcbe8052bff10a025d01a4286d094703b820d440a3

Download Submit
C:\Windows\Installer\MSI7C02.tmp-\Microsoft.Deployment.WindowsInstaller.dll

Filesize
172KB

MD5
4e04a4cb2cf220aecc23ea1884c74693

SHA1
a828c986d737f89ee1d9b50e63c540d48096957f

SHA256
cfed1841c76c9731035ebb61d5dc5656babf1beff6ed395e1c6b85bb9c74f85a

SHA512
c0b850fbc24efad8207a3fcca11217cb52f1d08b14deb16b8e813903fecd90714eb1a4b91b329cf779afff3d90963380f7cfd1555ffc27bd4ac6598c709443c4

Download Submit
C:\Windows\Installer\MSI7F30.tmp-\CustomAction.config

Filesize
1KB

MD5
01c01d040563a55e0fd31cc8daa5f155

SHA1
3c1c229703198f9772d7721357f1b90281917842

SHA256
33d947c04a10e3aff3dca3b779393fa56ce5f02251c8cbae5076a125fdea081f

SHA512
9c3f0cc17868479575090e1949e31a688b8c1cdfa56ac4a08cbe661466bb40ecfc94ea512dc4b64d5ff14a563f96f1e71c03b6eeacc42992455bd4f1c91f17d5

Download Submit
memory/1648-290-0x0000000004DA0000-0x0000000004DAC000-memory.dmp

Filesize
48KB

Download
memory/1648-286-0x0000000004D60000-0x0000000004D8E000-memory.dmp

Filesize
184KB

Download
memory/2072-205-0x0000000000910000-0x0000000000D16000-memory.dmp

Filesize
4.0MB

Download
memory/2072-224-0x00000000067D0000-0x00000000067F2000-memory.dmp

Filesize
136KB

Download
memory/2072-222-0x000000000A710000-0x000000000A7C2000-memory.dmp

Filesize
712KB

Download
memory/2072-225-0x000000000AAD0000-0x000000000AE27000-memory.dmp

Filesize
3.3MB

Download
memory/2072-226-0x0000000005D30000-0x00000000062D6000-memory.dmp

Filesize
5.6MB

Download
memory/2072-207-0x000000000A0F0000-0x000000000A182000-memory.dmp

Filesize
584KB

Download
memory/2072-206-0x00000000068A0000-0x0000000006C00000-memory.dmp

Filesize
3.4MB

Download
memory/2072-245-0x0000000005CD0000-0x0000000005CDA000-memory.dmp

Filesize
40KB

Download
memory/2072-241-0x0000000005C20000-0x0000000005C2A000-memory.dmp

Filesize
40KB

Download
memory/2072-240-0x00000000062E0000-0x000000000638A000-memory.dmp

Filesize
680KB

Download
memory/4136-484-0x0000000005B00000-0x0000000005BB0000-memory.dmp

Filesize
704KB

Download
memory/4136-481-0x0000000000DE0000-0x0000000000DF2000-memory.dmp

Filesize
72KB

Download
memory/4392-328-0x000000000A3C0000-0x000000000AE56000-memory.dmp

Filesize
10.6MB

Download
memory/4392-329-0x000000000E690000-0x000000000E740000-memory.dmp

Filesize
704KB

Download
memory/4392-301-0x0000000000E60000-0x0000000001642000-memory.dmp

Filesize
7.9MB

Download
memory/4392-349-0x000000000FD70000-0x000000000FDAA000-memory.dmp

Filesize
232KB

Download
memory/4392-358-0x0000000011CC0000-0x0000000011D26000-memory.dmp

Filesize
408KB

Download