hxxps://bingwallpaper[.]microsoft[.]com

Resubmissions

10-01-2025 17:57

250110-wjlkka1nbw 8

10-01-2025 15:16

250110-snhspazrbm 8

Analysis

max time kernel
92s
max time network
93s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
10-01-2025 17:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://bingwallpaper.microsoft.com

Score

8^/10

microsoft defense_evasion discovery persistence phishing ransomware spyware stealer

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
45	4060	rundll32.exe

Executes dropped EXE 6 IoCs

pid	Process
2936	BingWallpaper.exe
764	StartupInstaller.exe
4700	BWInstaller.exe
3708	BingWallpaperApp.exe
4600	DefaultSetup.exe
4828	DefaultSetup.exe

Loads dropped DLL 24 IoCs

pid	Process
4700	BWInstaller.exe
4700	BWInstaller.exe
4700	BWInstaller.exe
4700	BWInstaller.exe
4700	BWInstaller.exe
4700	BWInstaller.exe
2728	MsiExec.exe
436	rundll32.exe
436	rundll32.exe
436	rundll32.exe
436	rundll32.exe
436	rundll32.exe
2728	MsiExec.exe
4060	rundll32.exe
4060	rundll32.exe
4060	rundll32.exe
4060	rundll32.exe
4060	rundll32.exe
4060	rundll32.exe
3708	BingWallpaperApp.exe
3708	BingWallpaperApp.exe
4828	DefaultSetup.exe
4828	DefaultSetup.exe
4828	DefaultSetup.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	BingWallpaper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\Windows\CurrentVersion\Run\BingWallpaperApp = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\BingWallpaperApp\\BingWallpaperApp.exe"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\!DefaultSetup = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\DefaultSetup\\DefaultSetup.exe"	BWInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	DefaultSetup.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe

Detected potential entity reuse from brand MICROSOFT.
phishing microsoft

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\BingWallpaperApp\\WPImages\\20250110.jpg"	BingWallpaperApp.exe

Drops file in Windows directory 22 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI58DA.tmp-\CustomActions.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI5BB9.tmp-\CustomActions.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\e5853eb.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI58DA.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI5BB9.tmp-\CustomAction.config	rundll32.exe
File created	C:\Windows\SystemTemp\~DFB4B66375B5F765C6.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e5853e7.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{217B7A56-3DCD-4C47-9F1E-2C13A2B658E3}	msiexec.exe
File created	C:\Windows\SystemTemp\~DFABD9E96F7BA1B793.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI58DA.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5BB9.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5BB9.tmp-\DispatchQueue.dll	rundll32.exe
File created	C:\Windows\Installer\e5853e7.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI557E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI58DA.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI58DA.tmp-\DispatchQueue.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI5BB9.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File created	C:\Windows\SystemTemp\~DF301F0B450F6E7AD4.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF6A67B69FC2B91853.TMP	msiexec.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\BingWallpaper.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BingWallpaper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BingWallpaperApp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DefaultSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DefaultSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	StartupInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BWInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4060	rundll32.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies Control Panel 1 IoCs

evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Control Panel\Desktop\TileWallpaper = "0"	BingWallpaperApp.exe

Modifies registry class 5 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	BackgroundTransferHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	BackgroundTransferHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	BackgroundTransferHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\MuiCache	BackgroundTransferHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 744922.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\BingWallpaper.exe:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
3868	msedge.exe
3868	msedge.exe
400	msedge.exe
400	msedge.exe
2408	identity_helper.exe
2408	identity_helper.exe
2128	msedge.exe
2128	msedge.exe
1828	msedge.exe
1828	msedge.exe
4700	BWInstaller.exe
4700	BWInstaller.exe
4700	BWInstaller.exe
4700	BWInstaller.exe
4700	BWInstaller.exe
4700	BWInstaller.exe
4700	BWInstaller.exe
2016	msiexec.exe
2016	msiexec.exe
436	rundll32.exe
436	rundll32.exe
3708	BingWallpaperApp.exe
3708	BingWallpaperApp.exe
3708	BingWallpaperApp.exe
3708	BingWallpaperApp.exe
3708	BingWallpaperApp.exe
3708	BingWallpaperApp.exe
3708	BingWallpaperApp.exe
3708	BingWallpaperApp.exe
4700	BWInstaller.exe
4700	BWInstaller.exe
4828	DefaultSetup.exe
4828	DefaultSetup.exe
4828	DefaultSetup.exe
4828	DefaultSetup.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4700	BWInstaller.exe
Token: SeShutdownPrivilege	3252	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3252	msiexec.exe
Token: SeSecurityPrivilege	2016	msiexec.exe
Token: SeCreateTokenPrivilege	3252	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3252	msiexec.exe
Token: SeLockMemoryPrivilege	3252	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3252	msiexec.exe
Token: SeMachineAccountPrivilege	3252	msiexec.exe
Token: SeTcbPrivilege	3252	msiexec.exe
Token: SeSecurityPrivilege	3252	msiexec.exe
Token: SeTakeOwnershipPrivilege	3252	msiexec.exe
Token: SeLoadDriverPrivilege	3252	msiexec.exe
Token: SeSystemProfilePrivilege	3252	msiexec.exe
Token: SeSystemtimePrivilege	3252	msiexec.exe
Token: SeProfSingleProcessPrivilege	3252	msiexec.exe
Token: SeIncBasePriorityPrivilege	3252	msiexec.exe
Token: SeCreatePagefilePrivilege	3252	msiexec.exe
Token: SeCreatePermanentPrivilege	3252	msiexec.exe
Token: SeBackupPrivilege	3252	msiexec.exe
Token: SeRestorePrivilege	3252	msiexec.exe
Token: SeShutdownPrivilege	3252	msiexec.exe
Token: SeDebugPrivilege	3252	msiexec.exe
Token: SeAuditPrivilege	3252	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3252	msiexec.exe
Token: SeChangeNotifyPrivilege	3252	msiexec.exe
Token: SeRemoteShutdownPrivilege	3252	msiexec.exe
Token: SeUndockPrivilege	3252	msiexec.exe
Token: SeSyncAgentPrivilege	3252	msiexec.exe
Token: SeEnableDelegationPrivilege	3252	msiexec.exe
Token: SeManageVolumePrivilege	3252	msiexec.exe
Token: SeImpersonatePrivilege	3252	msiexec.exe
Token: SeCreateGlobalPrivilege	3252	msiexec.exe
Token: SeRestorePrivilege	2016	msiexec.exe
Token: SeTakeOwnershipPrivilege	2016	msiexec.exe
Token: SeRestorePrivilege	2016	msiexec.exe
Token: SeTakeOwnershipPrivilege	2016	msiexec.exe
Token: SeRestorePrivilege	2016	msiexec.exe
Token: SeTakeOwnershipPrivilege	2016	msiexec.exe
Token: SeRestorePrivilege	2016	msiexec.exe
Token: SeTakeOwnershipPrivilege	2016	msiexec.exe
Token: SeRestorePrivilege	2016	msiexec.exe
Token: SeTakeOwnershipPrivilege	2016	msiexec.exe
Token: SeRestorePrivilege	2016	msiexec.exe
Token: SeTakeOwnershipPrivilege	2016	msiexec.exe
Token: SeRestorePrivilege	2016	msiexec.exe
Token: SeTakeOwnershipPrivilege	2016	msiexec.exe
Token: SeRestorePrivilege	2016	msiexec.exe
Token: SeTakeOwnershipPrivilege	2016	msiexec.exe
Token: SeRestorePrivilege	2016	msiexec.exe
Token: SeTakeOwnershipPrivilege	2016	msiexec.exe
Token: SeRestorePrivilege	2016	msiexec.exe
Token: SeTakeOwnershipPrivilege	2016	msiexec.exe
Token: SeRestorePrivilege	2016	msiexec.exe
Token: SeTakeOwnershipPrivilege	2016	msiexec.exe
Token: SeRestorePrivilege	2016	msiexec.exe
Token: SeTakeOwnershipPrivilege	2016	msiexec.exe
Token: SeRestorePrivilege	2016	msiexec.exe
Token: SeTakeOwnershipPrivilege	2016	msiexec.exe
Token: SeRestorePrivilege	2016	msiexec.exe
Token: SeTakeOwnershipPrivilege	2016	msiexec.exe
Token: SeRestorePrivilege	2016	msiexec.exe
Token: SeTakeOwnershipPrivilege	2016	msiexec.exe
Token: SeRestorePrivilege	2016	msiexec.exe

Suspicious use of FindShellTrayWindow 40 IoCs

pid	Process
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
3708	BingWallpaperApp.exe
3708	BingWallpaperApp.exe

Suspicious use of SendNotifyMessage 14 IoCs

pid	Process
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
3708	BingWallpaperApp.exe
3708	BingWallpaperApp.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3548	MiniSearchHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 400 wrote to memory of 2524	400	msedge.exe	77
PID 400 wrote to memory of 2524	400	msedge.exe	77
PID 400 wrote to memory of 4548	400	msedge.exe	78
PID 400 wrote to memory of 4548	400	msedge.exe	78
PID 400 wrote to memory of 4548	400	msedge.exe	78
PID 400 wrote to memory of 4548	400	msedge.exe	78
PID 400 wrote to memory of 4548	400	msedge.exe	78
PID 400 wrote to memory of 4548	400	msedge.exe	78
PID 400 wrote to memory of 4548	400	msedge.exe	78
PID 400 wrote to memory of 4548	400	msedge.exe	78
PID 400 wrote to memory of 4548	400	msedge.exe	78
PID 400 wrote to memory of 4548	400	msedge.exe	78
PID 400 wrote to memory of 4548	400	msedge.exe	78
PID 400 wrote to memory of 4548	400	msedge.exe	78
PID 400 wrote to memory of 4548	400	msedge.exe	78
PID 400 wrote to memory of 4548	400	msedge.exe	78
PID 400 wrote to memory of 4548	400	msedge.exe	78
PID 400 wrote to memory of 4548	400	msedge.exe	78
PID 400 wrote to memory of 4548	400	msedge.exe	78
PID 400 wrote to memory of 4548	400	msedge.exe	78
PID 400 wrote to memory of 4548	400	msedge.exe	78
PID 400 wrote to memory of 4548	400	msedge.exe	78
PID 400 wrote to memory of 4548	400	msedge.exe	78
PID 400 wrote to memory of 4548	400	msedge.exe	78
PID 400 wrote to memory of 4548	400	msedge.exe	78
PID 400 wrote to memory of 4548	400	msedge.exe	78
PID 400 wrote to memory of 4548	400	msedge.exe	78
PID 400 wrote to memory of 4548	400	msedge.exe	78
PID 400 wrote to memory of 4548	400	msedge.exe	78
PID 400 wrote to memory of 4548	400	msedge.exe	78
PID 400 wrote to memory of 4548	400	msedge.exe	78
PID 400 wrote to memory of 4548	400	msedge.exe	78
PID 400 wrote to memory of 4548	400	msedge.exe	78
PID 400 wrote to memory of 4548	400	msedge.exe	78
PID 400 wrote to memory of 4548	400	msedge.exe	78
PID 400 wrote to memory of 4548	400	msedge.exe	78
PID 400 wrote to memory of 4548	400	msedge.exe	78
PID 400 wrote to memory of 4548	400	msedge.exe	78
PID 400 wrote to memory of 4548	400	msedge.exe	78
PID 400 wrote to memory of 4548	400	msedge.exe	78
PID 400 wrote to memory of 4548	400	msedge.exe	78
PID 400 wrote to memory of 4548	400	msedge.exe	78
PID 400 wrote to memory of 3868	400	msedge.exe	79
PID 400 wrote to memory of 3868	400	msedge.exe	79
PID 400 wrote to memory of 1304	400	msedge.exe	80
PID 400 wrote to memory of 1304	400	msedge.exe	80
PID 400 wrote to memory of 1304	400	msedge.exe	80
PID 400 wrote to memory of 1304	400	msedge.exe	80
PID 400 wrote to memory of 1304	400	msedge.exe	80
PID 400 wrote to memory of 1304	400	msedge.exe	80
PID 400 wrote to memory of 1304	400	msedge.exe	80
PID 400 wrote to memory of 1304	400	msedge.exe	80
PID 400 wrote to memory of 1304	400	msedge.exe	80
PID 400 wrote to memory of 1304	400	msedge.exe	80
PID 400 wrote to memory of 1304	400	msedge.exe	80
PID 400 wrote to memory of 1304	400	msedge.exe	80
PID 400 wrote to memory of 1304	400	msedge.exe	80
PID 400 wrote to memory of 1304	400	msedge.exe	80
PID 400 wrote to memory of 1304	400	msedge.exe	80
PID 400 wrote to memory of 1304	400	msedge.exe	80
PID 400 wrote to memory of 1304	400	msedge.exe	80
PID 400 wrote to memory of 1304	400	msedge.exe	80
PID 400 wrote to memory of 1304	400	msedge.exe	80
PID 400 wrote to memory of 1304	400	msedge.exe	80

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://bingwallpaper.microsoft.com
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffc27423cb8,0x7ffc27423cc8,0x7ffc27423cd8
  2⤵
  PID:2524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1892,14229122638096334337,8189581360985465041,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1924 /prefetch:2
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1892,14229122638096334337,8189581360985465041,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1892,14229122638096334337,8189581360985465041,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2720 /prefetch:8
  2⤵
  PID:1304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,14229122638096334337,8189581360985465041,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3164 /prefetch:1
  2⤵
  PID:852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,14229122638096334337,8189581360985465041,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3172 /prefetch:1
  2⤵
  PID:1744
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1892,14229122638096334337,8189581360985465041,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4896 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,14229122638096334337,8189581360985465041,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:1
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1892,14229122638096334337,8189581360985465041,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4052 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,14229122638096334337,8189581360985465041,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:1
  2⤵
  PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,14229122638096334337,8189581360985465041,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:1
  2⤵
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1892,14229122638096334337,8189581360985465041,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5544 /prefetch:8
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,14229122638096334337,8189581360985465041,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3948 /prefetch:1
  2⤵
  PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,14229122638096334337,8189581360985465041,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5940 /prefetch:1
  2⤵
  PID:244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,14229122638096334337,8189581360985465041,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:1
  2⤵
  PID:1844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,14229122638096334337,8189581360985465041,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:1
  2⤵
  PID:2472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1892,14229122638096334337,8189581360985465041,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6032 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:1828
- C:\Users\Admin\Downloads\BingWallpaper.exe
  "C:\Users\Admin\Downloads\BingWallpaper.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:2936
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\StartupInstaller.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\StartupInstaller.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:764
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\BWInstaller.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\BWInstaller.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4700
    - - C:\Windows\SysWOW64\msiexec.exe
        
        "C:\Windows\System32\msiexec.exe" /q /i BWCInstaller.msi /norestart
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:3252
    - - C:\Users\Admin\AppData\Local\Microsoft\DefaultSetup\DefaultSetup.exe
        
        /c:"DefaultSetup.exe CD=1"
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:4600
      - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\DefaultSetup.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\DefaultSetup.exe CD=1
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:4828

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:480

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1968

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2016
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding B0D8877371B3C0A7C30D6A586A995D71
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2728
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI58DA.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240670984 2 CustomActions!CustomActions.CustomActions.StartApp
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:436
  - - C:\Users\Admin\AppData\Local\Microsoft\BingWallpaperApp\BingWallpaperApp.exe
      "C:\Users\Admin\AppData\Local\Microsoft\BingWallpaperApp\BingWallpaperApp.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Sets desktop wallpaper using registry
      System Location Discovery: System Language Discovery
      Modifies Control Panel
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:3708
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI5BB9.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240671765 8 CustomActions!CustomActions.CustomActions.InstallPing
    3⤵
    - Blocklisted process makes network request
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:4060

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3548

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13
1⤵
- Modifies registry class
PID:2980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e5853ea.rbs

Filesize
9KB

MD5
5c020e56b849d09f409c2277eb1cc045

SHA1
f9304cd8669f649a42d68700c15b1ea86003ce9e

SHA256
0856ab57c860a1074e0a18d337b384b304f5a6517dfc3c4dbb8409c71f8c567e

SHA512
c09efa45678b6da3107f2033deac9f4d3de763ea5a8df8fba5206bf4cd6dd213924fdec43c360304e9061f5a879b1bed67f51431fafc948d5c879f6ecc9a963f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\BGAHelperLib\BrowserSettings.dll

Filesize
1.3MB

MD5
884f63dbc809dcec05912a05477fa078

SHA1
3aa2d5b9a24db61b4532cc4a3b33040e36827eed

SHA256
afddc2cf125104f3b907f0645a9f921475e02eda0a54179fb77ea677a608501d

SHA512
30853c127905c6cfe9360279f334d50c273d53db09ebd869e4107fddbb3cd75ccadf531b783ed0afb5a6e25dba338709be67e3468d4bc64f56f407dc6975f8a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\BingWallpaperApp\BWAConfig.bin

Filesize
5KB

MD5
0b4f823951d9370d8afda6542dcca656

SHA1
5b696cd05935e3fcde8eefd6a0401433f93e8a70

SHA256
b5f4737e2c7f464d883003456188113b35c9f986bfade00fbd63c756034d6216

SHA512
02803ffcab20200e0b5ef4e66f6d21754b76ba6330746f3ac548aa7754d79ebc80366e3a15e1ff52600c813cde8e948becc0d32d958e332ce562f34bf5146cfc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\BingWallpaperApp\BingWallpaperApp.exe

Filesize
7.9MB

MD5
b34ce96cb54d927a0d75a1e76888cce1

SHA1
033d501f1c688de169456baeea502ec8799cec66

SHA256
037af8085ab9f453cbaf325ac922d309a6aa4d3e624b521f0a590054a98f9aa4

SHA512
7f44b1d811e32c384e62cbbd19a85db4c4366848c511d52821a0afd064deda14175e586a086db5e1b03b961118bc1cc167c5d988c04f691c759fc0e43650363b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\BingWallpaperApp\WPImages\20250103.jpg

Filesize
464KB

MD5
fd1ae8741410218865b874c86b794170

SHA1
8e17b55acf482a201f5197a2195df00089701e9a

SHA256
e8983655333b1afe8246758c3efdcf5cee6df55cd8d449da4ff4bb23e1b334a2

SHA512
896594ef8755277ecb72e2b07f2107d2a6fdb8489cbcfd578f0769eb2d4040f6661273bff414951b63100791fd0ac2d0ce39c8e492635dddebe52eb8f8cc4d80

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\BingWallpaperApp\WPImages\20250104.jpg

Filesize
899KB

MD5
073082152224c87c2420286bb881d96d

SHA1
67538c0aae4cdcd20493233894729f0ba3285e7e

SHA256
9a39b16b9f93fea7294c2ef5bf76c69339234fd46ee4eed8a573085edc41d03a

SHA512
0a604cc96bd79bdbd41f1249f5984261018dcaf7f4515c3ca6d416e5cba10b64bf5c070bf84092e06ae5da0068a89504e9e6b53611dca58ce919dc8e03afc7cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\BingWallpaperApp\WPImages\20250105.jpg

Filesize
226KB

MD5
e967de071938ec449f5d317060d7a7dc

SHA1
738005607b5a754fcbb23b060f54c6e53dca5fae

SHA256
e146498d229bb4b3ca42b2c52defc227f1ecc3608a159072bd6185df3d005405

SHA512
8d30d2f461c9ffe08d968226942ae913ae08612eb822a30ca2c960f063f996f4c4fb32fe2d5db9c91bb36edbe43e92a43cbc04a66c20f4ecdb27f6f7723f5dc6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\BingWallpaperApp\WPImages\20250106.jpg

Filesize
684KB

MD5
22256a4d3467e24b926ab1288697ffb8

SHA1
63a8b0e2a73b34a39bcbf6d8e3503716a07795bc

SHA256
251625c1e60cb2c9883a574f0b284431a722fa2bdfd743052229b393b57beaab

SHA512
6a44bcc9205eea3f4ca727572139adb2320f2d8374a02130009f230fc27cc331b779d9200f336cd689c09bebe69a96efa452d6c8a77c871f75233ad2b56192c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\BingWallpaperApp\WPImages\20250107.jpg

Filesize
197KB

MD5
58328558c57d6ef7961583188bfa3e08

SHA1
76abc9d2729655e4e56f246d253bff0b63efb8b2

SHA256
abb18da05f34ae011d114ff2bb776e9bcda33290e2e034d24dae8a47d86371c4

SHA512
ed38cbcba8dd096a3abe9925d40cba0f4afad6a4b573467e3129bce6ca5caf376ad9277d10b32c5917b509ba04424023157a47894e553bb63b6bb38f8c34c59b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\BingWallpaperApp\WPImages\20250108.jpg

Filesize
717KB

MD5
9470068c57d474fedea45b71901fdfe9

SHA1
3e3fcb061cfcc385c1208d9d1edb1b6075ab9b45

SHA256
9dc101d85f5a88579bf13f5c338c3157aec0b4a512f491e079129888c00f3d21

SHA512
0a4e690880f670928b3dd58c82b851724dd8cd92cb4a8ff84102cab8ff668ab2b18d600d9b7b143a8f69dd02fd2c4a40a0183d7866ca693f639b2e3eb2e54250

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\BingWallpaperApp\WPImages\20250110.jpg

Filesize
419KB

MD5
9bef8950b8ecee0a190b3aebde37ac6e

SHA1
12c9c6f0244ff697a6daaa96274a69bc51dfc6bb

SHA256
3d1d675eee8b8270e9bf1ac5512496c4422b00f0ab372fee82bfd89e224f79e5

SHA512
243363d44891780b607468a5a914ae155422dba134e63175673130854a72e36ba503f9be5f306bc637e8ab2d4102108556b6b8174a27c3240eebc38382c306c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rundll32.exe.log

Filesize
651B

MD5
c4ce6fd8431b5747fd7a4c401325fb3a

SHA1
2f227bb73b2fae1020ca2b8b95b5b73b8f35403a

SHA256
3c801df6bf214e7b7b80514241c3f6d0d250ddbefd8c3dcffc7402c2e755f970

SHA512
379915b75023e787a13d55c35bc64f48b23dc59dda5ea65aeab4815aeb45b676f7364e7c42acc416cb8b1f9142c4af89c2a193913a3cc01672e6bf2c9d9bda26

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\DefaultSetup\DefaultSetup.exe

Filesize
1.1MB

MD5
92362723de1d43ab3ae6ea5378b3c211

SHA1
c73304a354ed3dc70d1ff3a677a53a0309bd4786

SHA256
2e4100c3b6d986f703edf2640614109d7095df87c31dc263abeae2505c763c87

SHA512
75bbf7c5dbf8d81d1ed10b6a0ba170f19ab8a0a036d79f0c2e79bf874567f8d62151f7533d230bc92ad661ce9a0f3971da2856461cfae6ff7df6e198789c7f30

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Dispatcher\DispatchQueueBWCApp.bin

Filesize
86B

MD5
6edde9c152ef9a3e7d5f24b5f22622f5

SHA1
15db8e85bae98c30bfebb3c2044dee536bd0b784

SHA256
3f6664566ce09cf643413ba5cc078b446c1c82021db73a81bc992350bf2bcee0

SHA512
901de660cf8c602ffe72d56e7cb011d534dbe7252bee126d05e5af5b9f5b2cc904edaeafd6d110ad989f9d8f7d7f10b1c510936234242b8f7aac9f6d1db712b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e1544690d41d950f9c1358068301cfb5

SHA1
ae3ff81363fcbe33c419e49cabef61fb6837bffa

SHA256
53d69c9cc3c8aaf2c8b58ea6a2aa47c49c9ec11167dd9414cd9f4192f9978724

SHA512
1e4f1fe2877f4f947d33490e65898752488e48de34d61e197e4448127d6b1926888de80b62349d5a88b96140eed0a5b952ef4dd7ca318689f76e12630c9029da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9314124f4f0ad9f845a0d7906fd8dfd8

SHA1
0d4f67fb1a11453551514f230941bdd7ef95693c

SHA256
cbd58fa358e4b1851c3da2d279023c29eba66fb4d438c6e87e7ce5169ffb910e

SHA512
87b9060ca4942974bd8f95b8998df7b2702a3f4aba88c53b2e3423a532a75407070368f813a5bbc0251864b4eae47e015274a839999514386d23c8a526d05d85

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
432B

MD5
603c77644cb5498dbe045a646de1a3c4

SHA1
7f2e1dc3a853db980fc41ffbebeab5e5f26fc919

SHA256
e1556ea5b14d0f730219027ef8799e076ea4597f1bed9715eba6576209f8c94d

SHA512
097f55f1efa777f5a5763bf32285d615c00ac1da2907725b12823b056cffc2bf539e68bf16fcef100bc296b60e1eb466bf1529af2d0f74118ca1125c5bcc15e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

Filesize
116KB

MD5
a0f3639ee0287a8998146ceb12b6b6af

SHA1
d54336e6268bc2a71cc15812b665a45cacc92060

SHA256
410e2f0b1faeda33da606b36ec1791f78cef9ec15fb837748ee3077122f7a8b1

SHA512
585525f0cdaa3dbf2e488e04b25bfe4a99c9fbb8146a00c3bcfb8a049e61eb395ee65ce2f260eee2a29bf15bec2979f69fd3cb14eb7f3e0814ee483ba59cfc71

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
931B

MD5
78205212f086c06d01d922e383f29add

SHA1
97e0845213c66a0b62c0affc421cafdc6308ac34

SHA256
974b51683a673f0332af7c2bec51efa8a8a3c7f34b99c7f77ebb061e235f747f

SHA512
6782a4afecf039b2346570412283942ce3ae958367f5fb135a24fa77df451b9f754b0362e6131ee324c0d8555d71e9ff03df1e6d36423eb3c2a6dc02051d882f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e890d891d6e7df8ed32a29c5b82cac2a

SHA1
cedc396ece20c0e1f6a7c6ffaf90d71701e92e96

SHA256
0376007896497071942f4fa42f9043984f5e810036743555198f5836acc10bda

SHA512
a24d44c6fd5593ad6ab9957de0221475df012f0271c567a708c9599d93edb193a2f45e4d18f7396ef30028357f9a351a96f830d2b31296feb046e76d3aeedaff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
2d0a8a4f1b2498b9feae71e04a757fe4

SHA1
cad7d1ee387b8fb76f3405fe4e8e2826d1836f4b

SHA256
b27e24398763c5b1428e40b9e36d9e29ea6c4664edc41f74dd684d51b96cb8a2

SHA512
76800a5e1a69b38d7f0adbbffc63cca81f884debc82fb723e59eedaa90da97008be7da14f3aab869c56df9ee9880fc30c06e2b04c70d673db25c415b698d1405

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e435d24a634dc63992ac8b24c75fe6a4

SHA1
4bf77c3a1f817bcf43700d856cbd6cd6357b9e2b

SHA256
74bfc3ecc7027c8a33a2beeb1fb0456d2ca3758402203e4e2c6908c6f128105d

SHA512
7957643c5f8f3d399757154290ac9fcc6b64c7db8441641da7f2c15b2ac6b219c6de21cb50d94a3719b1ccc6f92f11b5e2f870601453f1b1b1b1103a060b3489

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
022b98ce06cc2492ba5f73cbbd962350

SHA1
da7f96562f137f41e21696dfe18103fa71e4a91b

SHA256
4cf1280aa1414c0a170c94937c1c09eafe100aee2e642d417616924a995d7113

SHA512
4d6e354ab8dee674456b904f1ddc6cb302d81978b673f1d38c5ce6545d597b0e83511a5fa795575feeeddcaf79c2ef691dd8aa249fc00d26b157b1b20bdb6e4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
c179bbabf182392c4d5c0a7886614302

SHA1
aceaba11575bcad61da751cc47c065984f56d404

SHA256
a3c9625acebf74239e167bca87ab58ee9ee5d069db21b6a9bbd6a7f6e3f8e42d

SHA512
439fc16fb9cb46ebfb6cd90501babe5302f0438e5943bc0bf9e2d3e1bd819ba6a1559e722315dae147af0e020685684150de2cc2f482d181c31862ecc87e20dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
48cc7782e9e94a49a915054daab0c8f8

SHA1
61922c2e13469361da46338cc536ef3ba0152e29

SHA256
bda2001a5eca27d946676e535b1f99101297e81438a541058df300813eb94b41

SHA512
ef0935359a138da414c7ca0575b9a6e6058a7c398c408038732caf878aceffe9f7c1480e319c27a78c849abfb09faba4b7cfeb2700bbc6e665027a8879b71faf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
c8079c2e5b02a24b016dae59aeb099de

SHA1
5c5740f8380048647513b72d8c0b7b5fe47fd298

SHA256
90d528c9bc46655fe2a2e391cab8129eefa79046fa91a6d38310ccf59ec6de45

SHA512
c0d35c7aa0f89355ae497a31927b6a4c2935af9171d45ce7b20e8f46ab0915357aae01222a12d918e87946d89792cdf410738249562909edcfffa1341fe31446

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\BackgroundTransferApi\77e0e765-ab3e-4478-8ad2-af19e1a277f8.down_data

Filesize
555KB

MD5
5683c0028832cae4ef93ca39c8ac5029

SHA1
248755e4e1db552e0b6f8651b04ca6d1b31a86fb

SHA256
855abd360d8a8d6974eba92b70cbd09ce519bc8773439993f9ab37cb6847309e

SHA512
aba434bd29be191c823b02ea9b639beb10647bbe7759bbffdaa790dfb1ec2c58d74c525ef11aacda209e4effe322d1d3a07b115446c8914b07a3bce4d8a0e2c3

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
10KB

MD5
23f6514e7db5301805570f87b0d7f140

SHA1
7f16d3f9516bf226de5467116a210f44398b1b1a

SHA256
fa40e7aff24110441b61463b4cf0c773fe189efb6c2e807f201515ed0c9529d7

SHA512
1842d6a8c64c90ad8ba58c7a8fd415bb5e57ed19e318f00cb86e8efbafcafb403ed08e2dc7d8e167fae03ebff4d444f8d15da56e011d6be97c18d33e0154c842

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\BWCInstaller.msi

Filesize
8.2MB

MD5
758ae2c8b2cc90be0bb6ccc69b43b84b

SHA1
a6cfd161eee74ac4ecd2f0ce38f51a3553a5dbfb

SHA256
700804cdbc1501b825d23ec23a4e81b135b9ce7c18859a14b5190fa615322a2b

SHA512
c73f175a8f639f8e31a1364f154f1fb84df4336a195b5992d633f6feba0e29633311705b180f8d3a020555ef3f4061a28604d06da07bfa8a50edc0dabf48ee4c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\BWCProgressBar.dll

Filesize
23KB

MD5
1368cbda6193c6975d5e821063857264

SHA1
0db5a926e301f27d383e128ebe151a1395ea929c

SHA256
b9ab5eeb1fb007df27cb75286792c4adc2d00e0060aaeac45759d450f8ec22d1

SHA512
b1bd81a123b9299c798d83565e6ee8b5dcc42f9b6368f6aebefd970b0feeafafa4349c1e4f1d8812bebae1b02dc80efa019f410f8c508745abd7e841b3d459de

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\BWCUI.json

Filesize
332KB

MD5
e35c2eaf3320422da13059b70adf01af

SHA1
24f7d27beb428c78d9ae13120e1f5cbe83a295b0

SHA256
1938994de1615b21b49014e02b8d94744098463dc36fc7f5467bed7626808839

SHA512
9c554cd62788167ebac594bb9c4cf2ccda8c432002a568c2004a61c7198bc5ff9f3621675ccf13d04c667fbc72b19d64d0268e6418ae34b3cbf30d45de2e2744

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\BWInstaller.exe

Filesize
4.0MB

MD5
69cfd2651cc5f8c5e56580e0aac92f37

SHA1
17e0e08606df14a798ce1660622dcd56457e10f6

SHA256
966ce391d11604d595215e9b59f8ddc2d1c0231096ef803066d0cccc0f468afd

SHA512
fec894586bd27d36e651766c694febb3e4be54ecea5eb1ef5434106de9ebe05bcf5a05dec9c6ef77818210d62d327cd57e1574bb51f6a89ca4e09507736eee22

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\BWInstaller.exe.config

Filesize
801B

MD5
e469d9f754a66fd95cff05a4f3c4fee1

SHA1
91b91cefc2d169b83372633ddc6a1b3e1a45d96c

SHA256
104ee2cf017ec62e0387d636599519a3b260dae3f9da8a6bac3557b436e4b536

SHA512
7798da5521e0b711018404890400e11048193867a094e31c74fa1c6908fa37fcfe5d35c8e251c2c26e7e8f46abf68ab6506615e11dfedbd92e4c0344aa376506

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\BrowserDefMgr.dll

Filesize
1.8MB

MD5
dc54a5cf3776e2a936b289ae3a37ef83

SHA1
039bd560b024ed392e29b4129ec65d2675e742e6

SHA256
c78b29567031b933061230a3878782cb6781416823cdff9ba2277bce5abda525

SHA512
35c4a28ceb78feaac121b4a158aa22600047b31b3eeec66fbfc086c9a33eb7d2045ca389aafe79a6465914e5ac480f2813a94c9b5b297949a6b494962ac36388

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\DispatchQueue.dll

Filesize
158KB

MD5
588b3b8d0b4660e99529c3769bbdfedc

SHA1
d130050d1c8c114421a72caaea0002d16fa77bfe

SHA256
d05a41ed2aa8af71e4c24bfff27032d6805c7883e9c4a88aa0a885e441bec649

SHA512
e5f2fac5e12a7e1828e28c7395435e43449898a18a2a70b3f7ea6a1982e1c36f11da6ee7cc8ac7cefaab266e53d6f99ee88067bc9d719e99f4f69b4834b7f50b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Newtonsoft.Json.dll

Filesize
695KB

MD5
195ffb7167db3219b217c4fd439eedd6

SHA1
1e76e6099570ede620b76ed47cf8d03a936d49f8

SHA256
e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d

SHA512
56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\StartupInstaller.exe

Filesize
145KB

MD5
6d82a313035a9a8a9475fc95dbaa791c

SHA1
ff8cba4e8f004d01da206a4300443557ff015e05

SHA256
031a7b5fa53531cffe904ca6c77abbceffc29295b66d5d9d30990ff4e0da57fd

SHA512
eb3752099db1d1b4dea201ef89fb4af44f374153da8f243846ca3f5b05bab74f3222a737bed9eb39af637fd6113b9591213fb99691979a90e8087c347e86f27d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\DefaultSetup.exe

Filesize
61KB

MD5
350e7fc9681d0b4f1ab361f8e365bc0e

SHA1
80da5528474300bc2a7b2f987e5e8423fc875386

SHA256
f0296f36a6915640f958e8cd1794b49aea5630c302f6d8e99b3829b624773278

SHA512
414a36a8f6d8527f9adf46d95ca4f0284dcc5a617f5982ceb90e07d69017758286ec26a1dcdb60e27b58d93898cef88c21b1efdd11c4a98e4b6436446b7bf521

Download Submit
C:\Users\Admin\Downloads\BingWallpaper.exe:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 744922.crdownload

Filesize
13.6MB

MD5
41cfd22d05f19bfd31e44e5210f8f060

SHA1
7196b7d2fa9344af569006966af21808e4d77cff

SHA256
9bda0bc4025c234bbbcd9d06c8f1dd07d396fe642008c79d81263f75110b9b7b

SHA512
1a683c5fe89f6b1bb47f5c9a6b3710a1110fe0335237665d04baf8c68d4fd72089c119b6108032874f760f776f24325c4fa92acde9e3dfdc5af5c78a6f2584e6

Download Submit
C:\Windows\Installer\MSI58DA.tmp

Filesize
332KB

MD5
dc96169066bad280198e607d292cbb5d

SHA1
23b92d164290f1e4fb2063a22c27e99d53e80734

SHA256
38441f08ba0e5d283b2ded184b1988eac3c4f9da5820dd794e7ed3a783b88875

SHA512
d7c9c07d294b51deef587f81e4ac016dad73b7eccf81ee98f6a86733019e6d221ae2842c826d8880adb08363b13f70e52dc95bf89ef5116d86b0b3b0d4a165c4

Download Submit
C:\Windows\Installer\MSI58DA.tmp-\CustomActions.dll

Filesize
21KB

MD5
c09ca336a284eeb68655c663dfbe4011

SHA1
bad950ccd2cf7b62b374d00b01edf4db9ec49db0

SHA256
72af578be2076588cc4b146fd08273994513d4f4adfbcdce449abb4a610a3778

SHA512
19e475540c95e75e436642f2c0fdd1fcc3b3015398e999f8673f54d132e4be68cfca2a725be88112b5fe1bdcbe8052bff10a025d01a4286d094703b820d440a3

Download Submit
C:\Windows\Installer\MSI58DA.tmp-\Microsoft.Deployment.WindowsInstaller.dll

Filesize
172KB

MD5
4e04a4cb2cf220aecc23ea1884c74693

SHA1
a828c986d737f89ee1d9b50e63c540d48096957f

SHA256
cfed1841c76c9731035ebb61d5dc5656babf1beff6ed395e1c6b85bb9c74f85a

SHA512
c0b850fbc24efad8207a3fcca11217cb52f1d08b14deb16b8e813903fecd90714eb1a4b91b329cf779afff3d90963380f7cfd1555ffc27bd4ac6598c709443c4

Download Submit
C:\Windows\Installer\MSI5BB9.tmp-\CustomAction.config

Filesize
1KB

MD5
01c01d040563a55e0fd31cc8daa5f155

SHA1
3c1c229703198f9772d7721357f1b90281917842

SHA256
33d947c04a10e3aff3dca3b779393fa56ce5f02251c8cbae5076a125fdea081f

SHA512
9c3f0cc17868479575090e1949e31a688b8c1cdfa56ac4a08cbe661466bb40ecfc94ea512dc4b64d5ff14a563f96f1e71c03b6eeacc42992455bd4f1c91f17d5

Download Submit
memory/436-374-0x0000000002A80000-0x0000000002A8C000-memory.dmp

Filesize
48KB

Download
memory/436-370-0x0000000002A40000-0x0000000002A6E000-memory.dmp

Filesize
184KB

Download
memory/3708-439-0x00000000107F0000-0x000000001082A000-memory.dmp

Filesize
232KB

Download
memory/3708-448-0x0000000010A50000-0x0000000010AB6000-memory.dmp

Filesize
408KB

Download
memory/3708-421-0x0000000007D20000-0x0000000007DD0000-memory.dmp

Filesize
704KB

Download
memory/3708-412-0x0000000009E80000-0x000000000A916000-memory.dmp

Filesize
10.6MB

Download
memory/3708-385-0x00000000008C0000-0x00000000010A2000-memory.dmp

Filesize
7.9MB

Download
memory/4700-214-0x000000000AEC0000-0x000000000B217000-memory.dmp

Filesize
3.3MB

Download
memory/4700-230-0x0000000005EE0000-0x0000000005EEA000-memory.dmp

Filesize
40KB

Download
memory/4700-229-0x0000000005F50000-0x0000000005FFA000-memory.dmp

Filesize
680KB

Download
memory/4700-215-0x0000000006010000-0x00000000065B6000-memory.dmp

Filesize
5.6MB

Download
memory/4700-234-0x0000000006000000-0x000000000600A000-memory.dmp

Filesize
40KB

Download
memory/4700-213-0x0000000006AB0000-0x0000000006AD2000-memory.dmp

Filesize
136KB

Download
memory/4700-211-0x000000000AB00000-0x000000000ABB2000-memory.dmp

Filesize
712KB

Download
memory/4700-205-0x000000000A4D0000-0x000000000A562000-memory.dmp

Filesize
584KB

Download
memory/4700-204-0x0000000006C80000-0x0000000006FE0000-memory.dmp

Filesize
3.4MB

Download
memory/4700-203-0x0000000000D20000-0x0000000001126000-memory.dmp

Filesize
4.0MB

Download
memory/4828-551-0x0000000000670000-0x0000000000682000-memory.dmp

Filesize
72KB

Download
memory/4828-552-0x00000000053A0000-0x0000000005450000-memory.dmp

Filesize
704KB

Download