hxxps://www[.]romspedia[.]com/emulators/programs/project64/wiki/controllers

Analysis

user interaction
yes
max time kernel
203s
max time network
209s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
21/04/2026, 15:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.romspedia.com/emulators/programs/project64/wiki/controllers
Sample260421-ta5kzag15n

Score

8^/10

discovery persistence

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
348	5508	msedge.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\Control Panel\International\Geo\Nation	windowsdesktop-runtime-6.0.36-win-x86.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\Control Panel\International\Geo\Nation	windowsdesktop-runtime-6.0.36-win-x86.exe

Executes dropped EXE 7 IoCs

pid	Process
5416	windowsdesktop-runtime-6.0.36-win-x86.exe
1000	windowsdesktop-runtime-6.0.36-win-x86.exe
6128	windowsdesktop-runtime-6.0.36-win-x86.exe
3804	windowsdesktop-runtime-6.0.36-win-x86.exe
4272	windowsdesktop-runtime-6.0.36-win-x86.exe
4176	windowsdesktop-runtime-6.0.36-win-x86.exe
5108	windowsdesktop-runtime-6.0.36-win-x86.exe

Loads dropped DLL 64 IoCs

pid	Process
1000	windowsdesktop-runtime-6.0.36-win-x86.exe
3696	MsiExec.exe
2932	MsiExec.exe
4176	windowsdesktop-runtime-6.0.36-win-x86.exe
2020	MsiExec.exe
1992	MsiExec.exe
5788	MsiExec.exe
2364	MsiExec.exe
2696	DS4Windows.exe
2696	DS4Windows.exe
2696	DS4Windows.exe
2696	DS4Windows.exe
2696	DS4Windows.exe
2696	DS4Windows.exe
2696	DS4Windows.exe
2696	DS4Windows.exe
2696	DS4Windows.exe
2696	DS4Windows.exe
2696	DS4Windows.exe
2696	DS4Windows.exe
2696	DS4Windows.exe
2696	DS4Windows.exe
2696	DS4Windows.exe
2696	DS4Windows.exe
2696	DS4Windows.exe
2696	DS4Windows.exe
2696	DS4Windows.exe
2696	DS4Windows.exe
2696	DS4Windows.exe
2696	DS4Windows.exe
2696	DS4Windows.exe
2696	DS4Windows.exe
2696	DS4Windows.exe
2696	DS4Windows.exe
2696	DS4Windows.exe
2696	DS4Windows.exe
2696	DS4Windows.exe
2696	DS4Windows.exe
2696	DS4Windows.exe
2696	DS4Windows.exe
2696	DS4Windows.exe
2696	DS4Windows.exe
2696	DS4Windows.exe
2696	DS4Windows.exe
2696	DS4Windows.exe
2696	DS4Windows.exe
2696	DS4Windows.exe
2696	DS4Windows.exe
2696	DS4Windows.exe
2696	DS4Windows.exe
2696	DS4Windows.exe
2696	DS4Windows.exe
2696	DS4Windows.exe
2696	DS4Windows.exe
2696	DS4Windows.exe
2696	DS4Windows.exe
2696	DS4Windows.exe
2696	DS4Windows.exe
2696	DS4Windows.exe
2696	DS4Windows.exe
2696	DS4Windows.exe
2696	DS4Windows.exe
2696	DS4Windows.exe
2696	DS4Windows.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{c37854d7-1852-4785-82ff-86ff988e4caf} = "\"C:\\ProgramData\\Package Cache\\{c37854d7-1852-4785-82ff-86ff988e4caf}\\windowsdesktop-runtime-6.0.36-win-x86.exe\" /burn.runonce"	windowsdesktop-runtime-6.0.36-win-x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{c37854d7-1852-4785-82ff-86ff988e4caf} = "\"C:\\ProgramData\\Package Cache\\{c37854d7-1852-4785-82ff-86ff988e4caf}\\windowsdesktop-runtime-6.0.36-win-x86.exe\" /burn.runonce"	windowsdesktop-runtime-6.0.36-win-x86.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
388	raw.githubusercontent.com
389	raw.githubusercontent.com

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Videos\Captures\desktop.ini	svchost.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.36\tr\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.36\zh-Hans\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.36\System.Net.NameResolution.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.36\System.Net.WebProxy.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.36\System.Threading.Channels.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.36\es\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.36\api-ms-win-core-file-l2-1-0.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.36\System.Reflection.TypeExtensions.dll	msiexec.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4416_1980460091\regex_patterns.json	msedge.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.36\api-ms-win-core-errorhandling-l1-1-0.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.36\System.Text.RegularExpressions.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.36\zh-Hant\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.36\pl\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.36\ru\UIAutomationClient.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.36\api-ms-win-crt-process-l1-1-0.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.36\D3DCompiler_47_cor3.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.36\System.Windows.Extensions.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.36\System.Security.AccessControl.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.36\ja\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.36\it\UIAutomationTypes.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.36\System.Reflection.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.36\System.Collections.Concurrent.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.36\ja\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.36\System.Security.Permissions.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.36\ru\WindowsFormsIntegration.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.36\de\UIAutomationTypes.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.36\fr\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.36\cs\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.36\api-ms-win-core-timezone-l1-1-0.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.36\mscordaccore_x86_x86_6.0.3624.51421.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.36\es\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.36\PresentationFramework-SystemXmlLinq.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.36\es\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.36\fr\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.36\pt-BR\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4416_1849385883\deny_full_domains.list	msedge.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.36\System.Security.Cryptography.OpenSsl.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.36\api-ms-win-crt-convert-l1-1-0.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.36\tr\ReachFramework.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.36\pt-BR\UIAutomationTypes.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.36\UIAutomationClientSideProviders.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.36\api-ms-win-crt-environment-l1-1-0.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.36\ru\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.36\de\System.Windows.Forms.Design.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.36\ja\System.Windows.Forms.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.36\System.Linq.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.36\System.Reflection.Extensions.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.36\System.ServiceModel.Web.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.36\System.IO.FileSystem.DriveInfo.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.36\System.Xml.XmlDocument.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.36\System.Transactions.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.36\Microsoft.WindowsDesktop.App.deps.json	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.36\PresentationFramework-SystemData.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.36\es\UIAutomationClient.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.36\zh-Hans\WindowsBase.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.36\System.Threading.ThreadPool.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.36\it\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.36\es\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.36\ko\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.36\ja\System.Windows.Forms.Primitives.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.36\System.Collections.Immutable.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.36\Microsoft.Win32.Primitives.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.36\pt-BR\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.36\de\System.Windows.Forms.Primitives.resources.dll	msiexec.exe

Drops file in Windows directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\e5a8696.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8D7C.tmp	msiexec.exe
File created	C:\Windows\Installer\e5a86a4.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{9A00C541-6944-4969-9DFE-A7289215800D}	msiexec.exe
File created	C:\Windows\Installer\e5a8696.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI955D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9B68.tmp	msiexec.exe
File created	C:\Windows\Installer\e5a869a.msi	msiexec.exe
File created	C:\Windows\Installer\e5a869b.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC65A.tmp	msiexec.exe
File created	C:\Windows\Installer\e5a869f.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9C63.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e5a86a0.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{FBC9D6AE-6396-4FC7-BC18-00852836F16D}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB0DA.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC1E2.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC251.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC61A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\e5a869b.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{6F73FE7B-B9C3-4A05-8138-0E44543D755F}	msiexec.exe
File created	C:\Windows\Installer\e5a86a5.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA773.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\e5a86a0.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9F91.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA0AB.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e5a86a5.msi	msiexec.exe
File created	C:\Windows\Installer\e5a86a9.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{89C09E22-01D0-41F6-BAD3-CA0A8B74AD22}	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-6.0.36-win-x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-6.0.36-win-x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DS4Windows.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-6.0.36-win-x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DS4Windows.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DS4Windows.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-6.0.36-win-x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-6.0.36-win-x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-6.0.36-win-x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-6.0.36-win-x86.exe

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5508	msedge.exe
4752	msedge.exe
6000	msedge.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 17 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2B	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Direct3D\LastTelemetryChangeStamp = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134212603551278534"	msedge.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Direct3D	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2C	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2d	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EA6D9CBF69367CF4CB81005882631FD6\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{FBC9D6AE-6396-4FC7-BC18-00852836F16D}v48.144.23141\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\22E90C980D106F14AB3DACA0B847DA22\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\22E90C980D106F14AB3DACA0B847DA22\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\145C00A944969694D9EF7A82295108D0\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{9A00C541-6944-4969-9DFE-A7289215800D}v48.144.23186\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_48.144.23141_x86	windowsdesktop-runtime-6.0.36-win-x86.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EA6D9CBF69367CF4CB81005882631FD6\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\145C00A944969694D9EF7A82295108D0\Assignment = "1"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B7EF37F63C9B50A41883E04445D357F5\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EA6D9CBF69367CF4CB81005882631FD6\PackageCode = "5DAF53D1906D6764A9715267AE967F33"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_48.3.31210_x86\Dependents\{c37854d7-1852-4785-82ff-86ff988e4caf}	windowsdesktop-runtime-6.0.36-win-x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\7D8220F7C505E2961E1E20532028E1E5\22E90C980D106F14AB3DACA0B847DA22	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B7EF37F63C9B50A41883E04445D357F5\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{6F73FE7B-B9C3-4A05-8138-0E44543D755F}v48.144.23141\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EA6D9CBF69367CF4CB81005882631FD6\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EA6D9CBF69367CF4CB81005882631FD6\SourceList\PackageName = "dotnet-host-6.0.36-win-x86.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\145C00A944969694D9EF7A82295108D0	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A51AFDF7B84566F4E2CBCE788C31DEA8\145C00A944969694D9EF7A82295108D0	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_48.144.23186_x86\Dependents\{c37854d7-1852-4785-82ff-86ff988e4caf}	windowsdesktop-runtime-6.0.36-win-x86.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EA6D9CBF69367CF4CB81005882631FD6\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_48.3.31210_x86\Dependents\{c37854d7-1852-4785-82ff-86ff988e4caf}	windowsdesktop-runtime-6.0.36-win-x86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\22E90C980D106F14AB3DACA0B847DA22\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_48.3.31210_x86\ = "{FBC9D6AE-6396-4FC7-BC18-00852836F16D}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EA6D9CBF69367CF4CB81005882631FD6\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_48.3.31210_x86	windowsdesktop-runtime-6.0.36-win-x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_48.144.23141_x86\DisplayName = "Microsoft .NET Host FX Resolver - 6.0.36 (x86)"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1609746302-1884177235-1125644204-1000\{1A30F7CC-439E-434B-B3BF-9E8F981189B0}	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B7EF37F63C9B50A41883E04445D357F5\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\145C00A944969694D9EF7A82295108D0\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_48.144.23141_x86\Dependents\{c37854d7-1852-4785-82ff-86ff988e4caf}	windowsdesktop-runtime-6.0.36-win-x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\145C00A944969694D9EF7A82295108D0\SourceList\PackageName = "windowsdesktop-runtime-6.0.36-win-x86.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_48.144.23141_x86\Version = "48.144.23141"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_48.3.31210_x86\DisplayName = "Microsoft .NET Host - 6.0.36 (x86)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_48.144.23141_x86\Version = "48.144.23141"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B7EF37F63C9B50A41883E04445D357F5	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B7EF37F63C9B50A41883E04445D357F5\Version = "814766693"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EA6D9CBF69367CF4CB81005882631FD6\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\5A036181AE3507D45E36606F9464ED83\EA6D9CBF69367CF4CB81005882631FD6	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{c37854d7-1852-4785-82ff-86ff988e4caf}\Version = "6.0.36.34217"	windowsdesktop-runtime-6.0.36-win-x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{c37854d7-1852-4785-82ff-86ff988e4caf}\DisplayName = "Microsoft Windows Desktop Runtime - 6.0.36 (x86)"	windowsdesktop-runtime-6.0.36-win-x86.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\145C00A944969694D9EF7A82295108D0\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B7EF37F63C9B50A41883E04445D357F5\MainFeature	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EA6D9CBF69367CF4CB81005882631FD6	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EA6D9CBF69367CF4CB81005882631FD6\SourceList\Net	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\145C00A944969694D9EF7A82295108D0\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1609746302-1884177235-1125644204-1000\{0155D884-015D-4656-AEB8-096FA6D33676}	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_48.144.23141_x86\ = "{6F73FE7B-B9C3-4A05-8138-0E44543D755F}"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B7EF37F63C9B50A41883E04445D357F5\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B7EF37F63C9B50A41883E04445D357F5\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_48.3.31210_x86\Version = "48.144.23141"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EA6D9CBF69367CF4CB81005882631FD6\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\dotnet_runtime_48.144.23141_x86	windowsdesktop-runtime-6.0.36-win-x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\22E90C980D106F14AB3DACA0B847DA22\PackageCode = "1EDA8C11467820D449A1BF3CE4FAD80C"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_48.144.23141_x86	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\{c37854d7-1852-4785-82ff-86ff988e4caf}	windowsdesktop-runtime-6.0.36-win-x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\145C00A944969694D9EF7A82295108D0\MainFeature	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EA6D9CBF69367CF4CB81005882631FD6\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\145C00A944969694D9EF7A82295108D0\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{c37854d7-1852-4785-82ff-86ff988e4caf}\Dependents	windowsdesktop-runtime-6.0.36-win-x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\22E90C980D106F14AB3DACA0B847DA22\ProductName = "Microsoft .NET Runtime - 6.0.36 (x86)"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\BF1BE48D5F759425B65919A4C084BA7B	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\145C00A944969694D9EF7A82295108D0\PackageCode = "BBC6A55F130E7CC45B23E2D0A72895F6"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\windowsdesktop_runtime_48.144.23186_x86	windowsdesktop-runtime-6.0.36-win-x86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{c37854d7-1852-4785-82ff-86ff988e4caf}\Dependents\{c37854d7-1852-4785-82ff-86ff988e4caf}	windowsdesktop-runtime-6.0.36-win-x86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B7EF37F63C9B50A41883E04445D357F5\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\5A036181AE3507D45E36606F9464ED83	msiexec.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
5840	msedge.exe
5840	msedge.exe
5528	msiexec.exe
5528	msiexec.exe
5528	msiexec.exe
5528	msiexec.exe
5528	msiexec.exe
5528	msiexec.exe
5528	msiexec.exe
5528	msiexec.exe
5528	msiexec.exe
5528	msiexec.exe
5528	msiexec.exe
5528	msiexec.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs

pid	Process
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	6128	windowsdesktop-runtime-6.0.36-win-x86.exe
Token: SeIncreaseQuotaPrivilege	6128	windowsdesktop-runtime-6.0.36-win-x86.exe
Token: SeSecurityPrivilege	5528	msiexec.exe
Token: SeCreateTokenPrivilege	6128	windowsdesktop-runtime-6.0.36-win-x86.exe
Token: SeAssignPrimaryTokenPrivilege	6128	windowsdesktop-runtime-6.0.36-win-x86.exe
Token: SeLockMemoryPrivilege	6128	windowsdesktop-runtime-6.0.36-win-x86.exe
Token: SeIncreaseQuotaPrivilege	6128	windowsdesktop-runtime-6.0.36-win-x86.exe
Token: SeMachineAccountPrivilege	6128	windowsdesktop-runtime-6.0.36-win-x86.exe
Token: SeTcbPrivilege	6128	windowsdesktop-runtime-6.0.36-win-x86.exe
Token: SeSecurityPrivilege	6128	windowsdesktop-runtime-6.0.36-win-x86.exe
Token: SeTakeOwnershipPrivilege	6128	windowsdesktop-runtime-6.0.36-win-x86.exe
Token: SeLoadDriverPrivilege	6128	windowsdesktop-runtime-6.0.36-win-x86.exe
Token: SeSystemProfilePrivilege	6128	windowsdesktop-runtime-6.0.36-win-x86.exe
Token: SeSystemtimePrivilege	6128	windowsdesktop-runtime-6.0.36-win-x86.exe
Token: SeProfSingleProcessPrivilege	6128	windowsdesktop-runtime-6.0.36-win-x86.exe
Token: SeIncBasePriorityPrivilege	6128	windowsdesktop-runtime-6.0.36-win-x86.exe
Token: SeCreatePagefilePrivilege	6128	windowsdesktop-runtime-6.0.36-win-x86.exe
Token: SeCreatePermanentPrivilege	6128	windowsdesktop-runtime-6.0.36-win-x86.exe
Token: SeBackupPrivilege	6128	windowsdesktop-runtime-6.0.36-win-x86.exe
Token: SeRestorePrivilege	6128	windowsdesktop-runtime-6.0.36-win-x86.exe
Token: SeShutdownPrivilege	6128	windowsdesktop-runtime-6.0.36-win-x86.exe
Token: SeDebugPrivilege	6128	windowsdesktop-runtime-6.0.36-win-x86.exe
Token: SeAuditPrivilege	6128	windowsdesktop-runtime-6.0.36-win-x86.exe
Token: SeSystemEnvironmentPrivilege	6128	windowsdesktop-runtime-6.0.36-win-x86.exe
Token: SeChangeNotifyPrivilege	6128	windowsdesktop-runtime-6.0.36-win-x86.exe
Token: SeRemoteShutdownPrivilege	6128	windowsdesktop-runtime-6.0.36-win-x86.exe
Token: SeUndockPrivilege	6128	windowsdesktop-runtime-6.0.36-win-x86.exe
Token: SeSyncAgentPrivilege	6128	windowsdesktop-runtime-6.0.36-win-x86.exe
Token: SeEnableDelegationPrivilege	6128	windowsdesktop-runtime-6.0.36-win-x86.exe
Token: SeManageVolumePrivilege	6128	windowsdesktop-runtime-6.0.36-win-x86.exe
Token: SeImpersonatePrivilege	6128	windowsdesktop-runtime-6.0.36-win-x86.exe
Token: SeCreateGlobalPrivilege	6128	windowsdesktop-runtime-6.0.36-win-x86.exe
Token: SeRestorePrivilege	5528	msiexec.exe
Token: SeTakeOwnershipPrivilege	5528	msiexec.exe
Token: SeRestorePrivilege	5528	msiexec.exe
Token: SeTakeOwnershipPrivilege	5528	msiexec.exe
Token: SeRestorePrivilege	5528	msiexec.exe
Token: SeTakeOwnershipPrivilege	5528	msiexec.exe
Token: SeRestorePrivilege	5528	msiexec.exe
Token: SeTakeOwnershipPrivilege	5528	msiexec.exe
Token: SeRestorePrivilege	5528	msiexec.exe
Token: SeTakeOwnershipPrivilege	5528	msiexec.exe
Token: SeRestorePrivilege	5528	msiexec.exe
Token: SeTakeOwnershipPrivilege	5528	msiexec.exe
Token: SeRestorePrivilege	5528	msiexec.exe
Token: SeTakeOwnershipPrivilege	5528	msiexec.exe
Token: SeRestorePrivilege	5528	msiexec.exe
Token: SeTakeOwnershipPrivilege	5528	msiexec.exe
Token: SeRestorePrivilege	5528	msiexec.exe
Token: SeTakeOwnershipPrivilege	5528	msiexec.exe
Token: SeRestorePrivilege	5528	msiexec.exe
Token: SeTakeOwnershipPrivilege	5528	msiexec.exe
Token: SeRestorePrivilege	5528	msiexec.exe
Token: SeTakeOwnershipPrivilege	5528	msiexec.exe
Token: SeRestorePrivilege	5528	msiexec.exe
Token: SeTakeOwnershipPrivilege	5528	msiexec.exe
Token: SeRestorePrivilege	5528	msiexec.exe
Token: SeTakeOwnershipPrivilege	5528	msiexec.exe
Token: SeRestorePrivilege	5528	msiexec.exe
Token: SeTakeOwnershipPrivilege	5528	msiexec.exe
Token: SeRestorePrivilege	5528	msiexec.exe
Token: SeTakeOwnershipPrivilege	5528	msiexec.exe
Token: SeRestorePrivilege	5528	msiexec.exe
Token: SeTakeOwnershipPrivilege	5528	msiexec.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe

Suspicious use of SendNotifyMessage 40 IoCs

pid	Process
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
2696	DS4Windows.exe
2696	DS4Windows.exe
2696	DS4Windows.exe
2696	DS4Windows.exe
2696	DS4Windows.exe
2696	DS4Windows.exe
2696	DS4Windows.exe
2696	DS4Windows.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4324	OpenWith.exe
4184	OpenWith.exe
4960	OpenWith.exe
5252	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4416 wrote to memory of 5628	4416	msedge.exe	84
PID 4416 wrote to memory of 5508	4416	msedge.exe	85
PID 4416 wrote to memory of 4616	4416	msedge.exe	86
PID 4416 wrote to memory of 4616	4416	msedge.exe	86
PID 4416 wrote to memory of 4616	4416	msedge.exe	86
PID 4416 wrote to memory of 632	4416	msedge.exe	87
PID 4416 wrote to memory of 632	4416	msedge.exe	87
PID 4416 wrote to memory of 1072	4416	msedge.exe	88
PID 4416 wrote to memory of 1072	4416	msedge.exe	88
PID 4416 wrote to memory of 1072	4416	msedge.exe	88
PID 4416 wrote to memory of 2388	4416	msedge.exe	89
PID 4416 wrote to memory of 2388	4416	msedge.exe	89
PID 4416 wrote to memory of 2388	4416	msedge.exe	89
PID 4416 wrote to memory of 4700	4416	msedge.exe	93
PID 4416 wrote to memory of 5080	4416	msedge.exe	94
PID 4416 wrote to memory of 4700	4416	msedge.exe	93
PID 4416 wrote to memory of 5080	4416	msedge.exe	94
PID 4416 wrote to memory of 228	4416	msedge.exe	95
PID 4416 wrote to memory of 228	4416	msedge.exe	95
PID 4416 wrote to memory of 228	4416	msedge.exe	95
PID 4416 wrote to memory of 5860	4416	msedge.exe	96
PID 4416 wrote to memory of 5860	4416	msedge.exe	96
PID 4416 wrote to memory of 5860	4416	msedge.exe	96
PID 4416 wrote to memory of 2540	4416	msedge.exe	97
PID 4416 wrote to memory of 2540	4416	msedge.exe	97
PID 4416 wrote to memory of 2540	4416	msedge.exe	97
PID 4416 wrote to memory of 1884	4416	msedge.exe	99
PID 4416 wrote to memory of 3344	4416	msedge.exe	103
PID 4416 wrote to memory of 3344	4416	msedge.exe	103
PID 4416 wrote to memory of 3344	4416	msedge.exe	103
PID 4416 wrote to memory of 3212	4416	msedge.exe	112
PID 4416 wrote to memory of 744	4416	msedge.exe	113
PID 4416 wrote to memory of 4524	4416	msedge.exe	114
PID 4416 wrote to memory of 5856	4416	msedge.exe	116
PID 4416 wrote to memory of 5856	4416	msedge.exe	116
PID 4416 wrote to memory of 2364	4416	msedge.exe	117
PID 4416 wrote to memory of 2364	4416	msedge.exe	117
PID 4416 wrote to memory of 2364	4416	msedge.exe	117
PID 4416 wrote to memory of 476	4416	msedge.exe	118
PID 4416 wrote to memory of 5204	4416	msedge.exe	119
PID 4416 wrote to memory of 5204	4416	msedge.exe	119
PID 4416 wrote to memory of 5204	4416	msedge.exe	119
PID 4416 wrote to memory of 3488	4416	msedge.exe	120
PID 4416 wrote to memory of 5304	4416	msedge.exe	127
PID 4416 wrote to memory of 5304	4416	msedge.exe	127
PID 2584 wrote to memory of 4752	2584	DS4Windows.exe	129
PID 4752 wrote to memory of 6000	4752	msedge.exe	130
PID 4416 wrote to memory of 1220	4416	msedge.exe	131
PID 4416 wrote to memory of 1220	4416	msedge.exe	131
PID 4416 wrote to memory of 1220	4416	msedge.exe	131
PID 4416 wrote to memory of 2972	4416	msedge.exe	132
PID 4416 wrote to memory of 2972	4416	msedge.exe	132
PID 4416 wrote to memory of 5268	4416	msedge.exe	133
PID 4416 wrote to memory of 5268	4416	msedge.exe	133
PID 4416 wrote to memory of 5268	4416	msedge.exe	133
PID 4416 wrote to memory of 1232	4416	msedge.exe	134
PID 4416 wrote to memory of 1232	4416	msedge.exe	134
PID 4416 wrote to memory of 1232	4416	msedge.exe	134
PID 4416 wrote to memory of 4464	4416	msedge.exe	135
PID 4416 wrote to memory of 4464	4416	msedge.exe	135
PID 4416 wrote to memory of 1016	4416	msedge.exe	136
PID 4416 wrote to memory of 1016	4416	msedge.exe	136
PID 4416 wrote to memory of 1016	4416	msedge.exe	136
PID 4416 wrote to memory of 3596	4416	msedge.exe	138

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.romspedia.com/emulators/programs/project64/wiki/controllers
1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2ac,0x7ffdd68dc188,0x7ffdd68dc194,0x7ffdd68dc1a0
  2⤵
  PID:5628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1892,i,565223693320567573,4512204130396377455,524288 --field-trial-handle=2304,i,8281090816803857995,7434127566261419427,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:5508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1668,i,15168068887832041041,8290300757910020134,262144 --field-trial-handle=2304,i,8281090816803857995,7434127566261419427,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:2
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2652,i,1472810331460283893,14942375085309078953,524288 --field-trial-handle=2304,i,8281090816803857995,7434127566261419427,262144 --variations-seed-version --mojo-platform-channel-handle=2788 /prefetch:8
  2⤵
  PID:632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,12036252158723818329,7993157472311603879,2097152 --field-trial-handle=2304,i,8281090816803857995,7434127566261419427,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:1072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3472,i,6501578534263695689,14585686871744429046,2097152 --field-trial-handle=2304,i,8281090816803857995,7434127566261419427,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4988,i,18395521436325148930,10643580578550310132,524288 --field-trial-handle=2304,i,8281090816803857995,7434127566261419427,262144 --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:8
  2⤵
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4984,i,11402817848717687979,8672294129782876372,524288 --field-trial-handle=2304,i,8281090816803857995,7434127566261419427,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:8
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5544,i,8562089599255893515,13900609489429646563,2097152 --field-trial-handle=2304,i,8281090816803857995,7434127566261419427,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:1
  2⤵
  PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=6060,i,11169920931250557748,1181968320317621781,2097152 --field-trial-handle=2304,i,8281090816803857995,7434127566261419427,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:1
  2⤵
  PID:5860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=6212,i,13360696457276107494,17172653859241461280,2097152 --field-trial-handle=2304,i,8281090816803857995,7434127566261419427,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:1
  2⤵
  PID:2540
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5572,i,17535505790239146782,15952634276662480511,524288 --field-trial-handle=2304,i,8281090816803857995,7434127566261419427,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:8
  2⤵
  PID:3256
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5572,i,17535505790239146782,15952634276662480511,524288 --field-trial-handle=2304,i,8281090816803857995,7434127566261419427,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:8
  2⤵
  PID:1884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6380,i,15627687094879469128,17575111050616667647,2097152 --field-trial-handle=2304,i,8281090816803857995,7434127566261419427,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:1
  2⤵
  PID:3344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6652,i,4986431572367553430,6840684523010120624,524288 --field-trial-handle=2304,i,8281090816803857995,7434127566261419427,262144 --variations-seed-version --mojo-platform-channel-handle=6952 /prefetch:8
  2⤵
  PID:3212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6452,i,10452265047833925539,13094442802750620835,524288 --field-trial-handle=2304,i,8281090816803857995,7434127566261419427,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:8
  2⤵
  PID:744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6500,i,348775090372648838,2295087349613264565,524288 --field-trial-handle=2304,i,8281090816803857995,7434127566261419427,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:8
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6244,i,13768188108011793275,8200229201039468638,524288 --field-trial-handle=2304,i,8281090816803857995,7434127566261419427,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:8
  2⤵
  PID:5856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6212,i,18120143570745026485,888099716966368640,2097152 --field-trial-handle=2304,i,8281090816803857995,7434127566261419427,262144 --variations-seed-version --mojo-platform-channel-handle=7000 /prefetch:1
  2⤵
  PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6264,i,4192147715312515044,16162448364132559159,524288 --field-trial-handle=2304,i,8281090816803857995,7434127566261419427,262144 --variations-seed-version --mojo-platform-channel-handle=7216 /prefetch:8
  2⤵
  PID:476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5664,i,7791323107230886125,777538929575604684,2097152 --field-trial-handle=2304,i,8281090816803857995,7434127566261419427,262144 --variations-seed-version --mojo-platform-channel-handle=6544 /prefetch:1
  2⤵
  PID:5204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7308,i,14870781900355176609,17834683977086856680,524288 --field-trial-handle=2304,i,8281090816803857995,7434127566261419427,262144 --variations-seed-version --mojo-platform-channel-handle=6664 /prefetch:8
  2⤵
  PID:3488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7004,i,10441447500676706679,12613555611775797907,524288 --field-trial-handle=2304,i,8281090816803857995,7434127566261419427,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:8
  2⤵
  PID:5304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=5200,i,17946596304244003666,10047053409576068371,2097152 --field-trial-handle=2304,i,8281090816803857995,7434127566261419427,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:1
  2⤵
  PID:1220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6408,i,12311267964445980917,14879604909466158578,524288 --field-trial-handle=2304,i,8281090816803857995,7434127566261419427,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:8
  2⤵
  PID:2972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7328,i,8349048659400057747,16313710990758711600,2097152 --field-trial-handle=2304,i,8281090816803857995,7434127566261419427,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:1
  2⤵
  PID:5268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=5236,i,3419793538825282081,17883408980702159260,2097152 --field-trial-handle=2304,i,8281090816803857995,7434127566261419427,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:1
  2⤵
  PID:1232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5716,i,14394488642125538416,7752149255851468449,524288 --field-trial-handle=2304,i,8281090816803857995,7434127566261419427,262144 --variations-seed-version --mojo-platform-channel-handle=6932 /prefetch:8
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=2064,i,12482612996856194020,16845956504744511025,2097152 --field-trial-handle=2304,i,8281090816803857995,7434127566261419427,262144 --variations-seed-version --mojo-platform-channel-handle=7124 /prefetch:1
  2⤵
  PID:1016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7244,i,18031902705348838079,4713030358634256759,524288 --field-trial-handle=2304,i,8281090816803857995,7434127566261419427,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:8
  2⤵
  PID:3596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=7448,i,15047425438073524332,10517685171705615396,2097152 --field-trial-handle=2304,i,8281090816803857995,7434127566261419427,262144 --variations-seed-version --mojo-platform-channel-handle=7496 /prefetch:1
  2⤵
  PID:5604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=7712,i,9428915970980887427,4831346155643761634,2097152 --field-trial-handle=2304,i,8281090816803857995,7434127566261419427,262144 --variations-seed-version --mojo-platform-channel-handle=7340 /prefetch:1
  2⤵
  PID:6116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=7848,i,4228035153870019197,7466298381813206879,2097152 --field-trial-handle=2304,i,8281090816803857995,7434127566261419427,262144 --variations-seed-version --mojo-platform-channel-handle=7820 /prefetch:1
  2⤵
  PID:1612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=7896,i,8831533243026882404,15254691429843058341,2097152 --field-trial-handle=2304,i,8281090816803857995,7434127566261419427,262144 --variations-seed-version --mojo-platform-channel-handle=8048 /prefetch:1
  2⤵
  PID:6040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=8196,i,16476263726739580017,4801881387354920531,2097152 --field-trial-handle=2304,i,8281090816803857995,7434127566261419427,262144 --variations-seed-version --mojo-platform-channel-handle=8212 /prefetch:1
  2⤵
  PID:5196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8428,i,5212444323372183806,12418922522632163598,524288 --field-trial-handle=2304,i,8281090816803857995,7434127566261419427,262144 --variations-seed-version --mojo-platform-channel-handle=7816 /prefetch:8
  2⤵
  PID:1692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6384,i,12421365853826476605,14899230309497334563,524288 --field-trial-handle=2304,i,8281090816803857995,7434127566261419427,262144 --variations-seed-version --mojo-platform-channel-handle=8492 /prefetch:8
  2⤵
  PID:5792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=8660,i,4046513541536829921,18051479652285132947,262144 --field-trial-handle=2304,i,8281090816803857995,7434127566261419427,262144 --variations-seed-version --mojo-platform-channel-handle=8652 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8148,i,5921231135771089099,18402979410475756167,524288 --field-trial-handle=2304,i,8281090816803857995,7434127566261419427,262144 --variations-seed-version --mojo-platform-channel-handle=8116 /prefetch:8
  2⤵
  PID:5204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=7988,i,10329269276613996972,2377234596528878233,2097152 --field-trial-handle=2304,i,8281090816803857995,7434127566261419427,262144 --variations-seed-version --mojo-platform-channel-handle=8636 /prefetch:1
  2⤵
  PID:780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6432,i,12760107622560179919,2373746631853019211,524288 --field-trial-handle=2304,i,8281090816803857995,7434127566261419427,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:8
  2⤵
  PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5388,i,7202688181693310149,4715730457031734434,524288 --field-trial-handle=2304,i,8281090816803857995,7434127566261419427,262144 --variations-seed-version --mojo-platform-channel-handle=7724 /prefetch:8
  2⤵
  PID:2888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7188,i,14019550100645629021,14557136019597865831,524288 --field-trial-handle=2304,i,8281090816803857995,7434127566261419427,262144 --variations-seed-version --mojo-platform-channel-handle=7568 /prefetch:8
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7980,i,15080039170914826477,18314800040502665153,524288 --field-trial-handle=2304,i,8281090816803857995,7434127566261419427,262144 --variations-seed-version --mojo-platform-channel-handle=7588 /prefetch:8
  2⤵
  PID:1004

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6016

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3868

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4776

C:\Users\Admin\Downloads\DS4Windows_3.2.11_x86\DS4Windows\DS4Windows.exe
"C:\Users\Admin\Downloads\DS4Windows_3.2.11_x86\DS4Windows\DS4Windows.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?missing_runtime=true&arch=x86&rid=win10-x86&apphost_version=6.0.16&gui=true
  2⤵
  - System Time Discovery
  - Suspicious use of WriteProcessMemory
  PID:4752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://aka.ms/dotnet-core-applaunch?missing_runtime=true&arch=x86&rid=win10-x86&apphost_version=6.0.16&gui=true
    3⤵
    - System Time Discovery
    PID:6000

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4324

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
PID:600

C:\Users\Admin\Downloads\windowsdesktop-runtime-6.0.36-win-x86.exe
"C:\Users\Admin\Downloads\windowsdesktop-runtime-6.0.36-win-x86.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5416
- C:\Windows\Temp\{DB3CFE86-9F43-477D-B0B5-11C3153B3D53}\.cr\windowsdesktop-runtime-6.0.36-win-x86.exe
  "C:\Windows\Temp\{DB3CFE86-9F43-477D-B0B5-11C3153B3D53}\.cr\windowsdesktop-runtime-6.0.36-win-x86.exe" -burn.clean.room="C:\Users\Admin\Downloads\windowsdesktop-runtime-6.0.36-win-x86.exe" -burn.filehandle.attached=576 -burn.filehandle.self=588
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1000
- - C:\Windows\Temp\{109E8020-5376-41EF-9035-BEC55362C570}\.be\windowsdesktop-runtime-6.0.36-win-x86.exe
    "C:\Windows\Temp\{109E8020-5376-41EF-9035-BEC55362C570}\.be\windowsdesktop-runtime-6.0.36-win-x86.exe" -q -burn.elevated BurnPipe.{59526260-6E83-4551-8E4D-ED1BA4EA21E0} {4888C1E7-4448-45B0-B0A7-70982A8D1D13} 1000
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    PID:6128

C:\ProgramData\Package Cache\{c37854d7-1852-4785-82ff-86ff988e4caf}\windowsdesktop-runtime-6.0.36-win-x86.exe
"C:\ProgramData\Package Cache\{c37854d7-1852-4785-82ff-86ff988e4caf}\windowsdesktop-runtime-6.0.36-win-x86.exe" /burn.runonce
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3804
- C:\ProgramData\Package Cache\{c37854d7-1852-4785-82ff-86ff988e4caf}\windowsdesktop-runtime-6.0.36-win-x86.exe
  "C:\ProgramData\Package Cache\{c37854d7-1852-4785-82ff-86ff988e4caf}\windowsdesktop-runtime-6.0.36-win-x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.36_(x86)_20260421165452.log"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4272
- - C:\ProgramData\Package Cache\{c37854d7-1852-4785-82ff-86ff988e4caf}\windowsdesktop-runtime-6.0.36-win-x86.exe
    "C:\ProgramData\Package Cache\{c37854d7-1852-4785-82ff-86ff988e4caf}\windowsdesktop-runtime-6.0.36-win-x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{c37854d7-1852-4785-82ff-86ff988e4caf}\windowsdesktop-runtime-6.0.36-win-x86.exe" -burn.filehandle.attached=520 -burn.filehandle.self=540 /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.36_(x86)_20260421165452.log"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:4176
  - - C:\ProgramData\Package Cache\{c37854d7-1852-4785-82ff-86ff988e4caf}\windowsdesktop-runtime-6.0.36-win-x86.exe
      "C:\ProgramData\Package Cache\{c37854d7-1852-4785-82ff-86ff988e4caf}\windowsdesktop-runtime-6.0.36-win-x86.exe" -q -burn.elevated BurnPipe.{14A70728-571D-4577-877E-E6628A0D54A5} {3A27DCA7-0300-4829-B257-8441229692C9} 4176
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:5108

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5528
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 624F85100686BA61E88050180895B04F
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3696
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding A22FAC1774A95B402ED4F850FB4F33C7
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2932
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding D456A75F5F66A5F5059979CAE62B194E
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2020
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 1EA5D6BDEC0CB7E617796F658C7740A7
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1992
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 21F1EBE9D395703E4F5BC2E730B4481B
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5788
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 641630BCA70087E9A8A16EBFD30A4BA3
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2364

C:\Users\Admin\Downloads\DS4Windows_3.2.11_x86\DS4Windows\DS4Windows.exe
"C:\Users\Admin\Downloads\DS4Windows_3.2.11_x86\DS4Windows\DS4Windows.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SendNotifyMessage
PID:2696
- C:\Users\Admin\Downloads\DS4Windows_3.2.11_x86\DS4Windows\DS4Windows.exe
  "C:\Users\Admin\Downloads\DS4Windows_3.2.11_x86\DS4Windows\DS4Windows.exe" -driverinstall
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6092

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4184

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Checks processor information in registry
PID:5360

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4960

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:5252

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k GraphicsPerfSvcGroup -s GraphicsPerfSvc
1⤵
- Checks processor information in registry
- Modifies data under HKEY_USERS
PID:3188

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
PID:1280

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5a8699.rbs

Path C:\Config.Msi\e5a8699.rbs
Size 57KB
SHA256 e5b29138460535851ca669832859da7a54a11ff549388c7c72820be77de6541e
MD5 e21d2bd2953234b73423e38a715410e5
SHA1 faf321a6c29631a19deac0e1e311f28742d27334
SHA512 71120461d6207ac6becfe87bf114e89c103657a7b088a778418719d97dfba6a135ffc25edc3a25a9ae924839b6dc1a2ecf0dd60814e20d93c56bb7282a26d491
SSDEEP 384:Mrp5qonqdtTzcwFkQWMurXw2ai753dF+VZHVx487ZqMfRCYtk4Wp+h4IdZNZBW9I:Mt5qTTuLdrXwx+Cb8GXI/i2Ru
TLSH
T193430F16DB01D0C2E2A22DB133A0BD0CB3174D92D75299480DEB4667C5E2BF87AFE957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a869e.rbs

Path C:\Config.Msi\e5a869e.rbs
Size 8KB
SHA256 b7e274e0bbde1133277ef093252c0ca79a4759844c17301cc12164bd1631e621
MD5 d9e9811b9db6b49d78943b6de7b8e675
SHA1 b63e5b6274cef6ba3813f797befc62077b7cb5c7
SHA512 6d368dfdb2afbde27b7b371d5b4a3db3851c6ca16db24eb839e6b5f1d1de85b30cdc5c748c25ebf04c603622f7534c719c96414d2f9d9f3da1fdd3c0251886d5
SSDEEP 96:al4uc4CVccGeS9x1UafeD2q/CsThq1UafeD2q/C6jAFAsYRThqAH1NRhE5R7r/59:a/RNeaOpKIdpKTObhE/j1WQvbIpqt
TLSH
T1CB122F86720185E3ED566B30C7071A3137BFE6D6C240574B0ADD92A8DF0B7C81EA99E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a86a3.rbs

Path C:\Config.Msi\e5a86a3.rbs
Size 9KB
SHA256 85e6ae661b4a2596b58f629c68be6310c15dd2c7ff4ac794e6bafaa639a8163d
MD5 cb44df45aad7a977398f9d7f32372ae6
SHA1 5f2b38aaa426ff1aaef7340dfbb8f9b403a615e3
SHA512 bdd7cb54de1360179a354c534bc95153d47a0f5fa1ca4d7e6713d4d1968f9dd2ea3df477e6264f086bf8416e183d116e1af172441e33c3f2f10404fb7cb0236c
SSDEEP 96:aJT2N4Yc1t7LRcerW+u+g1UseD2b/CsThqxUseD2b/C6jD6+jMRThqkH5NlE537I:ahY6YerzbgOsKIdsKuQbERuKOIpU
TLSH
T1B9220016760192C3F4423B74C70317123BEBDBE6E314578F44CDA7295EC67882BAA79A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a86a8.rbs

Path C:\Config.Msi\e5a86a8.rbs
Size 90KB
SHA256 51b18b650c55121ca358cdfd52e31f72767ac462aed7310612676534ea384d6f
MD5 33b8741cef1656bf596683ef26ea8bc9
SHA1 344270c3d9a610502100d2b9ce087e387ac21186
SHA512 66144d70d8f444e9a7f8f47486f60864c7599ecafe46e85df6c76006037fd1e4053d5e4487a85b7b32952abd2dd5b6da113a316f824f36bc8c26340074470736
SSDEEP 1536:cODTSsfTKxej8ddmeAVv3gRhhRp+BmfULv:qe8dseAV/g/hRp+BhD
TLSH
T16C93F12E5710C0C6DA316E1B277FEB8CAD0D4CBF5789592925C40636C8E2A562FFC8E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a86ac.rbs

Path C:\Config.Msi\e5a86ac.rbs
Size 3KB
SHA256 f53e6f706e8b9de3e782667b4a21d80b24456001ed1772d1bc6da5f14a79fba3
MD5 007976566be52c22862055a7ef600a17
SHA1 2a74ab257e29cbb4e79e93b09d86442b7c4d88bb
SHA512 f916c59eac160d08c246f043d5e76d93d9f8927c988a43ff3f0edce2d987f0545109fcf7065c8841dcbb70cfa25ef7e4050c602f1779c999fa05add3e065a982
TLSH
T1BB713B03A600D283E8A22F70CE171B1137B7D7E6D725878B50CC92745E8BBC56FEA655
MD5 SHA1 SHA512 TLSH

Submit Download

e5a86af.rbs

Path C:\Config.Msi\e5a86af.rbs
Size 3KB
SHA256 40bd561b8cec356cc5a883b033d172c83a8801510054ea80441e5ad1552f7afb
MD5 cf6cf50f54beeb0e7a465d5808cd4b22
SHA1 290b2088529592e260ff1eb18fcad17cbbe2e9d9
SHA512 723659eb660cf446113ee0979f019d459ba1a098ac37c743802bfc9c51204bc0559a0a02f8d1cc175320868dd1cf88668b3de0716907bd0d1165a80e1e1138ee
TLSH
T10A81DD03AA14A283DDA22F34CD1B675133BBD7EAC754434751CC82704E87B965FFAA89
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE.txt

Path C:\Program Files (x86)\dotnet\LICENSE.txt
Size 9KB
SHA256 7f6839a61ce892b79c6549e2dc5a81fdbd240a0b260f8881216b45b7fda8b45d
MD5 31c5a77b3c57c8c2e82b9541b00bcd5a
SHA1 153d4bc14e3a2c1485006f1752e797ca8684d06d
SHA512 ad33e3c0c3b060ad44c5b1b712c991b2d7042f6a60dc691c014d977c922a7e3a783ba9bade1a34de853c271fde1fb75bc2c47869acd863a40be3a6c6d754c0a6
SSDEEP 192:ydP0KvBLCqikR/EgGJLrlwD+eilNi5Py1SDeoDXDw9lF5OMz6Q:PWBuqikR/EDJLriwlNi5KI1Tw9lF5OjQ
TLSH
T1EC12B57D7284177109D207E16A0AB9D6F62A953C3117AA2438FDC15923AAF2CC37F3E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ThirdPartyNotices.txt

Path C:\Program Files (x86)\dotnet\ThirdPartyNotices.txt
Size 78KB
SHA256 d5db0ed54363e40717ae09e746dec99ad5b09223cc1273bb870703176dd226b7
MD5 f77a4aecfaf4640d801eb6dcdfddc478
SHA1 7424710f255f6205ef559e4d7e281a3b701183bb
SHA512 1b729dfa561899980ba8b15128ea39bc1e609fe07b30b283001fd9cf9da62885d78c18082d0085edd81f09203f878549b48f7f888a8486a2a526b134c849fd6b
SSDEEP 1536:HA9jHwQZGfgg39/zwgAVkguQXrDjugtSEGepkWvrpX7anuqdLS4mfiStPq+3Lefj:HA97wfogz1AVxuujHtSFULryLggrGRwJ
TLSH
T19C73A55F7E45077319E2C3916569A8C5F22FA02E3B6B2A44346EF248233B42DD6FF458
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4416_1849385883\manifest.json
Size 177B
SHA256 096e772e0f2e8c15e6dec9087ee0a1fb8b0c56b25061626aedc9e7e705adfc2e
MD5 2714a51ed8c2a891ad73b7488ab655b9
SHA1 9a8cc479aec8de1b4eb678e5d68b23b16a39dc99
SHA512 4811522c06ad6946626a9f4d12eb62a1d623825d18a1cd0ad7b628f4c059f37d299b5857abffd959e4ea53239412490539f5705b4aa6c6951d13c68e6d5b72ad
TLSH
T1E6C012EFDC509DB215EB4323156D43C4E733CF4B1546490935FB66082A25981C193500
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4416_1896683515\manifest.json
Size 52B
SHA256 36565d2ebd6c48537cb3e6fe24ac74ca68dda18b3f0f8be13f47d01aec181d62
MD5 152537f005b8875f68b1af4ac41c46f1
SHA1 70f529940adc1404721cbc1542c65eee289216ff
SHA512 bfcf5e9523b9268e1b0a546b5786498b1decc624ab1ba4fdd89e2e92edacd20800d731fef37c98aef45c64268d267b97d09f78124167685dd152bacd620dc9d0
TLSH
T1D0900260053491171AC10E546570F8859391661955850D1D0545154806A546CE051298
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4416_1980460091\manifest.json
Size 119B
SHA256 7169d86e87f904218238cd293e043e20b7828afad9acd1ff2e5d64188530b9d7
MD5 7382260298fc06c135b7c7399e9acff9
SHA1 6a829f795a3b8be25200675e00abfa1908fdefdf
SHA512 f0ce77f9f72fb6721bcfa9b03f77b0771e8217988183787c00dba4f9d9f19cdba252ddd656422336035f81939cb97c8b5dcb4f036a39280198c17cd04faaaed4
TLSH
T191B09273A800E83830E9EB91093A8243F320AB4BA585640A3625485C0B2B9F990606C4
MD5 SHA1 SHA512 TLSH

Submit Download

keys.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4416_495480228\keys.json
Size 8KB
SHA256 ae6e69a145f84c0a261b4e82888779fbf137f193881d687588e1af71609ae947
MD5 d3ebc1cb4b692c6e2d29a4625420fe73
SHA1 4ce74c1e9af6fd34d6379ec0fec6afb24082a7c1
SHA512 e34b855615e6a3bf770f27d85aa29ca57a324c08bd8f8d9c0130e2a142c0e4a5f17bffd0861b725acc8a2316f73b7fe50406b0af26264a5c2d8f37599b260860
SSDEEP 192:uNtGbR+mFGfvPNyR9Pm4lOvMwkoR9PuGMXcy:ORmqwKjA
TLSH
T18402A57F14A41181CE7FC1698F0B78B78FA038065BCA3A83539BFA49494296D173B5B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4416_495480228\manifest.json
Size 79B
SHA256 7ea98f2308a9c51d17a1ac71b64afbe2a41ff0a083a166a0e4cc428bf44f0715
MD5 817fea104100763cd1bf4f15a51bfe94
SHA1 589717cf98cf7e2d55fc0d6025a4b8e215ed13d6
SHA512 da7b959d93113c5a6be360f90d9c721989c5e7acad7fa592081b582c4c3a0c4a9066a71473fd8492ce7fe7b0fbfd6870d939428a67fbd508fcf6b2c6dc1a41ea
TLSH
T15EA0122058019233108407600360478243551C022015244809461041258813A12A3128
MD5 SHA1 SHA512 TLSH

Submit Download

state.rsm

Path C:\ProgramData\Package Cache\{c37854d7-1852-4785-82ff-86ff988e4caf}\state.rsm
Size 928B
SHA256 1986e1c06e87f9ad169d9b958be47e50fc7bb6d18344b2f3669cdf17fecbaa97
MD5 79752b8e582a784ecf6c61b649f3149b
SHA1 391cba0d5975262b2c114a7a2c7b4a624393e9e0
SHA512 6f16ddb8f2ef0e1c55bde1d306c7cf89903de59e3fac7411144ab56a875a67403ca77c4b91084920702efd16ce9db0c30d24d34b9075b862554b45d8b593cf3b
TLSH
T16B119A505BFA0629E3F36B34A9F56712743AB8025E32C46C0101328A8E32BA0C870F73
MD5 SHA1 SHA512 TLSH

Submit Download

autofill_bypass_cache_forms.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\autofill_bypass_cache_forms.json
Size 161B
SHA256 f7510e38f81f8a84027304070205dd55127e3233fdf011411465ede67b5b5d92
MD5 4b1a79b1996f03fb926a97912835c881
SHA1 ca43e23f7bbb4ff3839751f722df3c38ef7bd8a7
SHA512 c2e07a1b311ab71d94c7b874d645fe1114fdccfe4468875d6b23318fbe327481a60b2782af105b7546b3c1e6c3a7ec67261b21a0587f914cc7bf77c55f1f568e
TLSH
T1E5C08C07ABB804230B414E0B590DEFC9990476F6D5C146FEAB75A5A98A3C6B0005B74A
MD5 SHA1 SHA512 TLSH

Submit Download

edge_autofill_global_block_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\edge_autofill_global_block_list.json
Size 6KB
SHA256 7d3c45c8207ba69066516e51e10a2137bc4f1fce070a692e0c65225f9856e04c
MD5 5d4464dabc1289c3a010e14c05b92c57
SHA1 d2d185faca1cd13a6d42dea68803a9941074707d
SHA512 f93f4b58efc0127946ffa1b2950a1cf71da6f77a6ab4cf98ad8ada6a751d6261be4818ff8c64fe1f1d45467aa070e0823d15be36c8259c1044fb2d1289df9994
SSDEEP 192:C73stL7O9FnLk25+tF4B8K5b+QiGoztWuDpR6lFuftdHAa4/i:nwJ2r
TLSH
T133D16A2BA91C54B32A044839128E5BE47DDD73B6DD6008D6D650C0B9AEDFCB8203FDA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v1FieldTypes.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\v1FieldTypes.json
Size 509KB
SHA256 611e7995ab7599a0c89f98d6c6152a42aaedf7449748109a465bb5b0badd0af2
MD5 b1c140ef49f01eea089d3957da1a529f
SHA1 de64781f20aac98b4d2bbc497e3defa83b25aa8f
SHA512 02ddfcbaf9eaff793f251bd983394cf473b1340182ac1f3217cb7258ddfbd2de066ab08af16b47a378644bcc1871ad6ed8c641f6a053802c90e77f648e4f4be8
SSDEEP 1536:jlKS/dYt+dtxX9U2/W++dGcUooTHR6rF1azQmkEMUmxralqDAtyttVJAC5c8KrVx:B
TLSH
T148B48E2BF9F25C634D822A32053E18996A30615F5CEC6CD4BB3E211F4F2C1791E797A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c7296caf0e9cce556825f28f3642cb5ac31e31a0ff760d227744d879c3a93dee
MD5 1fd2da899cebd4d5aac2a3d85c0bfd18
SHA1 3f4e6dbc96df63582e9ba17acceda5012e453d7a
SHA512 840622178b39a880be2d80a1349d1dc0f7bfb63bf38c38c71fd96b89033d54de3e6a88f15ad237f3b66a8ebbff2bcfb19f5b6a6e94882c94044f73046f231584
TLSH
T1D5D0C0CC33B13C26C58C807004457F4D340BC4A20D42C3263433297C0CC30C428514C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cd04dec9a65c9ebbd9698b7d59631c916e6b6a0a7afdb22ef48d8a4a82d902d0
MD5 5491f296a003c3ba16025eb18fdfb799
SHA1 8104d473f5d8f681400a64b5d0ac5523a5d56b8e
SHA512 118ab6dad3343099380a953888db90a14fe8c7dcb62f906e55a163cdde9b95460d37b865178c48bfd20c166ef6b725e5b61ca55fc83a0221383e062a36b68b84
TLSH
T1CAD080D837B16C26C589947104857F4D351BC4A24D46D7267477297C5CC30C46D555D7
MD5 SHA1 SHA512 TLSH

Submit Download

3c6fd837-1962-4fda-8d4d-c34d9d0a8f4b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3c6fd837-1962-4fda-8d4d-c34d9d0a8f4b.tmp
Size 17KB
SHA256 8e282ab19b317e86229d14e563890b3b1d89e25e8a09914c3823581f874b15b8
MD5 36b6ed3c7f5bd1b9a12e157bee691bfa
SHA1 169f814ca2beeb09298bcf206baf8bc1e599068f
SHA512 716d21cf74ad578d43bc03d296a47a0428fe41734a7105561ddb86e05aff582dcac241d201c93874bbd5e176add2b7081d0b116d5649f43123b5b64ace317001
SSDEEP 192:sxZzRQyMqZ/K1Ml8Mkf/fzsEfip8iAM4MvTzodp6+kaPHW6+WN5+5x/e3UtcNBIS:sxZzxMf/fzsEyOEvItHbA/eEQ/NfNjz
TLSH
T10082E6566938997B8CC7D719F641BB63D6F5142396904E84AEFC8B0C00E6AED2203C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8dc3b0b0-1903-4ec3-81c5-fc02ccf56929.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8dc3b0b0-1903-4ec3-81c5-fc02ccf56929.tmp
Size 20KB
SHA256 68dacac26d47ef800ad1c34121ad961b1fc4f096872725aeb3150b4a673d658c
MD5 5c3cfc9e8e0335f068ea19e0b24d7622
SHA1 113c29919e17052109479e31860cd3eec3d88ae0
SHA512 600356f28bd8f72f3090dbd891fa736cc6bc586bc91044cf8841f1d83d0abdab3301859bc984cb79a0ee4bd5ac11267cda97115fd93e55f78c5fa9ac48ebcfee
SSDEEP 384:sxZ4nrxuPf/fzsgmOEvGCDUHbOsdeb1QFNfNav:sarOf/fTmOpHHbdeb1SNfK
TLSH
T16592F85665344A7B9DD7D229F9557BA3D6F81023D6904E84ABFCCB0C04E6AED2203C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 2a8f280466b1d5bf102130efbda8a2e86fa0066fb6d811aec16662ab9eaa091f
MD5 587feeaf3ad910a473dbfa70713427b5
SHA1 c84d4572cca9d5aa081269c2a7ff2ccb90d99472
SHA512 a2bc5a2b4df55bc9aaf4abaf0ca451a0fa829492e52617e5069674696ac88a841faeab2419c9e0c4fea72f8a0dd4b47ffc6fd6257e5688dd5f4c73cd0494a00d
TLSH
T174E02BEEC821DC2B18FA0B2960524647EB51235F5B50884B7B3DA208CFF16770556C6C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000080

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000080
Size 26KB
SHA256 27d7809f42a437784b7a81304d0222790e2ce1553ee8978cd10482ae07ffa58d
MD5 16a4dcac4209abf19491e4cacd5b22ae
SHA1 1bd36cd7830b3993bf8049f5179ad3fc017f0e2a
SHA512 ebd86f2de2ffbc399378e4ed67cba95dfd252225f393e5b4198d783a459d875b9c42c3a91f6a8aba338ba803d1a080b0f2c0adcea0d4bb0e651863b2d828ab5f
SSDEEP 768:2SDgXJbZ9syQa5ja5FOMITqvcP5we8oBUW:27sDija5FOM0ye8o6W
TLSH
T167C2F58389518FEB9A8ED6E42E934DDC5F660789D2D63EEF10170B4B3B90663099C06D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000089

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000089
Size 43KB
SHA256 cfb522c80e92df376e1cadf7a33717cde32b7f56de7bf52571342ba6fcad4cc5
MD5 40a16294053e19327fc2a3a4f9a9d86b
SHA1 0f60f45e985033c9d1d4773e814c041300c6f222
SHA512 7ae5771731f5c0d6e19126ab6ef3385ac85c6df54eed9d2ca53d53666b0157d581f1b1f528d1a7fa6e8f3c086891d0240c777c176baff8c8b0420938d58447da
SSDEEP 768:9QDtMSQe7mzXK0C0XBo0NfhaTT6nbteMedidag/mowuG9Duu7hyiR6v8cSSna:9QxjazXvNxo0NEv6n5eMedhgpiJt1yI7
TLSH
T10D13C00B59008F139D9DE390BF1A8D42D7987D7A37A7BACD90550DAA73953F80D0A1BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000092

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000092
Size 48KB
SHA256 fab36a2ded9052f21d4d1eb9130855ad19da80fa4695c6d3c8412f8a0b289a73
MD5 98e6644347e312d500a1a855a6e50610
SHA1 1959816a480968f69dbbcc3f4980fb4f731d58c9
SHA512 3bd2348605c3f31913846251c1374a9f754e080c4ed0e76fd4fb7235dfd7ceb647d1728f0be40f554d59be1bfdf3a7761e26c55c9c179b17ad2bb38c936fcaef
SSDEEP 1536:0/aYI31Ows1ZVdAkgg80/obTBEnHFUaAX:8p6LGag80/o3BElJAX
TLSH
T1B623288B9E95CB63F85843ECFA435C646A4B1749F68337F611764CEB6E402620DE683C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000b7

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b7
Size 21KB
SHA256 232242bced1c7ae16bdea7ad636a2466d8c350499e9f0d63f8126d42735cd441
MD5 2bdd40802ded145ca9d98786bbd3dcd2
SHA1 f1c84b3b07e1cf24b1fcdcb8e31f0297f734087d
SHA512 a94f4438dfac41a6f67410c4aa973c84322e6d9383cba49bac808566fe97d97c4820d2270f9746cd9149250b428f5e49a6606b6d1cbd57533860d2b8252084ad
SSDEEP 384:syX+Zx3UAHPVcIu33J0jV52boVkgwEXZLLpk2iwnSBKpEwDMnUZUiFaIJzseJ:sAu2AHPuJnmkgwEXZL1FiwSBKWwDMUZ1
TLSH
T183A2F1BFE7EAE97D4D642F81EB113CD2BDE97291850031547A279AE0F0C291D69C5C4C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000be

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000be
Size 4.2MB
SHA256 e07ee5670032b42baaed8f6229f2122a026bfcb58ea92448ee166fb02c8fef05
MD5 3986ad6019abb0a4be15603f3c89cc75
SHA1 98c9bac6eaec2c2c9503eda79f18bd0f69c4ad32
SHA512 dd65e5d3645bb63812e96ca906f45e5a13a8f13b97dc2c30813d832d53910f4cdf6ba3a4c09a759f554630dd78854bd7459c1067a90b4780d53904a9020e8412
SSDEEP 98304:Yy1oUGF94j/clsj2rtQDqPxbb70taMrg6rMjq9P0cJ/gt:Yy1fEiMXQD4bv0tDrWqVN0
TLSH
T190163323E422FCE4FF85373981CF8E19BEDA016FA278E25B44AC9511F61D2D1188D667
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000118

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000118
Size 23KB
SHA256 cbd89e5637327e186b67ddf3d1d27f53566022e627530ab3cf0c5e38aff8cd5a
MD5 c1b1b034b050af51bdea2dae6f390a97
SHA1 2855882b8159541682b4ceff0176c5f1ce6472ae
SHA512 0d49ae4d90414c35b18c02c1a928daded1782def517f55e27a69156a9ad22c2b295653bd1403c1705c4d68979856b1929d9925cee47fce220e2076912f224d35
SSDEEP 384:P0zrnuA3jB866z80wRGWV+D+plmj95IFBP7Fu9IXt+fTptL4EGMGlvxMni7/xcH:cOyeD8DDVu+pA9K5Xt8ArH2iWH
TLSH
T16EB26C6433E05B24D66B223C889E972C9D7AFC253631C25F21A99D3D1C646C1AF217FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 1b16fe3352ace9e0df382085d34880efd83c0a6c556d7c70581bd203b1078a13
MD5 71957bfe3d4a5106090918abf64ab06c
SHA1 79e9ade98ce9f769fe5b60daa0d5f8933ed9a92c
SHA512 ea606e89d49da93f11a1469faf8747a394f27b5f105714260a71bffdc549991b90ca9c2394269810163029448e0aeb1ce1753abf80c65333f64c7c67d6352e52
TLSH
T18A51B95342BBCC52EBD824BDFBA2345D2262835A5D6E8E2AB3F907FD6B513D10000C1C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 7KB
SHA256 35d310de9ee2e8ed1331fe4228a2394a48c90c38300b12d3f8b2efb98552c4ee
MD5 915020a8310075e0d309f3395673bd1f
SHA1 ef76be42b7b9330684129e96b75ac44b97db566d
SHA512 b44f927d3391c363d676bc4c74e7eb2bcee45513b72aaf41048fb6a0c47dc1c996d058063f1b60f9be84635ff55f4c92391bff3ec5662add854642f71d6c5c81
SSDEEP 96:9KyBgAo+Vcd9ubEvoxjMAoUpuk7mkl15L7tLaX8wzk861B95B:9KLAo+SyhmAoafakv5fteswzk8OB
TLSH
T1E4E176524DA6DC52FBE43C7CBA9F2999313143A6489F6F66E7F5067C156A39C3880C0C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58c762.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58c762.TMP
Size 2KB
SHA256 5ec6d879889637936d3d5ea64d735a6dd1c80fbc8d93ae94f6dbe329331e933d
MD5 d37a56317f78ada76c587eafdbd8dc1c
SHA1 e5e5f4e3d9e31ab22907573c72a1de21996fa139
SHA512 ee0cc9d58d1b6280cd066e05ae7bf043873cfdf2d851e3f2e0f2e7555b030e8b49338e6988ab24694217db2fba3114ed4d314d06d0f4aff01a32c8d9f186394a
TLSH
T19651A89703B74CA6EBE5247CF7A4356E226793A91C4E0F1A33F947FD2AA17D1440080C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 6edc80e4611b2139f7371fe7687ef240893449c0895244b1472db8da713c7e26
MD5 54ecf07bd823f1ac888f9ccd8971bc4b
SHA1 98d2ce71f592acdc069385845eaec30d6b83794c
SHA512 de803f09d4ed0198ee8f0c957ed00ea3da2c7eeeb33087faa6325f7056a062c694634d5e0df935c1360917916d282668e93b48f77e6e070527a3e859385e33c2
TLSH
T15431CCF3C3E8953D8A0195F4AA187F2BCEAD0951931C3D9AD5E4AE0B93E2475E24084B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 13KB
SHA256 7b7022f2f44db5e6673d54f1d79a3f9eae65917c17b7b7139bb49b0b67e9fdee
MD5 9eda083071956b463eeabd4a3e3976ee
SHA1 b69eaad10338b7cde226b2074a9fd882ceef1a1d
SHA512 0834f691439ee53183aaced6fe0fd8dc8f2315b4866c7833fd836989cb9b34c78f9f12d6a2af3fa91e9f11885002ce25c0d9240ece634ddaa83956a061f546d5
SSDEEP 384:D5GLKCbJ4zkeQq5WCJ+fhOfdfasn+qG/kYZZ3VZj37GBdsisQz/m07KpR5HXtMz4:KGarX+i5e6
TLSH
T1D7529CF783E4862DDC1156F4AA14AE1BCF1D0519832C3D6689E4BF4B93E2472E24169F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 77292e59d4ee859664aab38be725a916c848ae81c6cd234ad687f767ec7cb984
MD5 fd995449ab91b66ace66e3364faf3802
SHA1 1a006b20ead89dbe447632664c8f59cc9ba4a8a6
SHA512 5ffe1afdb2de76a45607a18a7ee15272ca2a08085fcde38e63e6966e445603da8c7fb0d76b1f67e1745664649ee0a9aeb9fd69873dafe15d3e20032e38382734
TLSH
T16631CEF3C3E8953D8A0195F4AA187F3BCE6D0951931C3D5AD5E4AE0B93E2475E24085B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 75075a606efd104d931d47c79e9203c638ab830379534b1b054229119bda00cf
MD5 235f09696b2c71de4ef9e06f3b9951f4
SHA1 44b08f4b0951d35a43bc98964e96163fee49acff
SHA512 5b896343ed2952c5ab21d24abef7fe070f1073a7dce5a00a1c9683daa9e41c4e05ec39b2493ccddfd5be11a9941284de467aef51dcb6d53781966579a4315105
SSDEEP 192:D5G9JKCbJ4zkeQyJXJWCJWassY+Pij6/M1YZm23VZj37POBPwpGfsisQz8q7qSjp:D5GLKCbJ4zkeQq5WCJWassY+qG/kYZZ6
TLSH
T18B126BB783D4CA6D9C1156F4A654AD1BCE1E091C822C3DA6CDE4FF8B93E2472E24158F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 3ca12964ac088a8ccb3346ef351976b244324c6c61210e9519e156e2a3083547
MD5 c1be6abb0c0c5307e075ad63893d1b23
SHA1 abcef9a7d3b1cd061b1a6c4b6f6561899a1ed026
SHA512 f88021af2fe58ce36705f0f00206913d79d48b61a62eb7ff83d07e349fd9eef36ac0c01fc37501491e92670a8e18404fbbab3c534aef2f31988463cde851fcdf
TLSH
T1FBD022A3530031B5BA6D2E82A06FAC8FC367003888C2DDD712E0E9EC093646C85172C5
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 e8f0d30a8335c11345ce5378d22b958e8b22dbed1f8a71195d97e74992daa39f
MD5 88b9d33c95423971ee5fd92f1cd48ab2
SHA1 19afd41a39b25af8812b523a5e88cbc05a61b459
SHA512 c056e69f57c41ff51a1e9a5f8872b7369f6107ed36e7074e007536d8e1d7733c594af7debafb00ccc9cc15fe2bb2911608f2bad25cc8ba17dc1a3400a74f4d05
SSDEEP 768:AasqZl+7pLuL/BlWvBDkT8F1+UoAYDCx9Tuqh0VfUC9xbog/OVkEx4Llhf51YroN:AasqZl+E/BlWvBDkTu1japEx4LXB1jAg
TLSH
T1C0F20A3B2C0CCB7E4F804E9CDC2A7E9E6EE8018B9698895447F9881C03D66EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\84cd36f7-f5c5-4e1b-8bf9-42bb83eefe27\index-dir\the-real-index
Size 144B
SHA256 5d2273497507b5300116791b6c0da28f3632fc1687ac9fbab7265baf1b3d4ff7
MD5 3e24e471b26a68abcd22da5924bc6271
SHA1 c21625a30e67ac83d11fd2a5fed86d64f4d04a92
SHA512 499cf634b6f70ffe42f10cbde09170499743586473b8be5f6a77a58e5c00af6fafdb524c0a4b4aaef04c7cba9d3571202379c9b00c7e204d5c7fd6b81fe52774
TLSH
T14DC01271ACE8C210E93207BA009308DC339E142091015FCA87E0BCA88A0DA458601CDC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a36b1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\84cd36f7-f5c5-4e1b-8bf9-42bb83eefe27\index-dir\the-real-index~RFe5a36b1.TMP
Size 120B
SHA256 7100319045abf72ece2714d231d6a013bf0e693903ef322d9c0f9680b47d23ee
MD5 4ed8b45c508ff00794236f872d7e18ee
SHA1 76699455dd99a92adaea1f11bf60edf98462d4fe
SHA512 6c3b3b91b3e072e4462774db00d249b846bdfa7cb1078242309817cc8a4185f426cfb2f753ad7792e8607536b0d18b770e01f535811fd1bd06abc6240ac9791f
TLSH
T18EB0121014C01100F532597171034AC031904530D8448FC363E4F864A52B1C4F10A998
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\96624b6a-d162-40b9-8a92-e680adedc754\index-dir\the-real-index
Size 72B
SHA256 1b5cba583713b064c24b352e9161fd0bd3981138e71d72e5009b2cf87817be1c
MD5 f88b43ebaf9fc38f4e60d4f8a73b411a
SHA1 aedd02c17af1ae96a2c6477054ce1617e1b265a0
SHA512 df68b58087ff73e202ab17a5b88dcaa834ff569eb7a0a3b2203aa7e5aaa43bc4ab7d8a526ccefbcbc68c3b061cb2e50e8ba1a5e07ddef1ae7db170232ccee9dc
TLSH
T149A002140A944501C81697F0669711462354FB144302D78756A00088CC629D54E5194C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a2387.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\96624b6a-d162-40b9-8a92-e680adedc754\index-dir\the-real-index~RFe5a2387.TMP
Size 72B
SHA256 ae616d3dd9f16c4c8a9b4ad006a916070570eef3f94b1a3c5019bfa9b12a2265
MD5 1ca41641e89c37d396fc583842d1b9e3
SHA1 6fe8c35afe043d2918455fb4d6c26f9a82756e24
SHA512 fadacfc8ec994051c2615ca08786e1cc4a0553fa888be149ef5805fbed19c8dd046396c434c593855082427b37fd6f3b7788c356803e51389054942203b42b35
TLSH
T1A7A0021013800009D452D9F11962724153108E652186565A51D61295CE5448157414FD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d21ad22b-5df7-47e8-891a-c7f90723595c\index-dir\the-real-index
Size 72B
SHA256 ef92373873fbbe2c69030f39e532234139a739b9a72096d31e00b941ce2e5a9e
MD5 942594c4ba7b32f90f734297f81a050f
SHA1 99eb35ff41617c5a4cf264a685aff8c7dfb51909
SHA512 3916411082d4a300277414afe5ba329251a7b4de12450f63f0741f1e7d477858b389ac302709e8abdaaf6a4e7796b1eefec8cb5b86556d943dc7eb2ad35648d4
TLSH
T13CA002228D684441C4010BF0524B13902315DCE641215307819004668CB115C4E024C9
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d864f7e2-3df7-400a-972a-26ff447d73c6\index-dir\the-real-index
Size 2KB
SHA256 3b517966f640372f5cf2608119d89910419e5c9adc0096c2fc7f1f8ad7188321
MD5 f53a1d261faf159d819ff982e808f15e
SHA1 767a623fd4381d709ae801252b86d43ea81e974d
SHA512 b962ca1ec68fb41977a5c2f1629287481eef75f2f95585778ce07ae2139e6a011140b6a65ffe619122e191b6a5f5bda75e16de2d78c49588d9b6076340cde0ef
TLSH
T1B151B41D9C4B4B22DC7816B348B608453378A8CD6FE80A17ECDC98B068532191E5963A
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 476B
SHA256 255a32071ebbe1dff47c546cce688304d7024c116c48ef1b5b7bb21836017085
MD5 6823506d3ee9e1a4b738f8d2bc6d5bf9
SHA1 2c7f59154b23b0f9c2dcfe77ed92f9c89387ba5b
SHA512 bf25a464aedac8becf9411828586a687fc7c1e651b1ea5a73be7f280c98a77a5c96620c86d2d02e8217c80df9f9265b14f8e6de665fee3b7cd0b7cb3604b66b6
TLSH
T140F027BB3EFB1A44BEAF93E924B2106140413C24D985EC9F6426A3A750F5219649AD63
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\d4079fd752603fdbbf916c56e1d5774dd6a42e91\8d59b245-ee3f-42d4-b882-828e32e87095\index-dir\the-real-index
Size 1KB
SHA256 5fb0aee3da6e65091b1afe70c519941ec59a820cd7629d97cbac3ec2dffd9069
MD5 648c94e791ecee1845137451e259939f
SHA1 da288e1b89d2e03ebe48121554600740451fc456
SHA512 2db401c2aba2507b31f72c0a7a79ce0ba3075025c7cbb74e7ad16d76f674208acbbc10ff713683868e8005c0d97cac2cbc8289d0e7a027c94acc8c552c1c3e87
TLSH
T1093146862F86518EF211D5F52C6F93A4676ECCCD473D43875F49F414AEE21045F50149
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58c8aa.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\d4079fd752603fdbbf916c56e1d5774dd6a42e91\8d59b245-ee3f-42d4-b882-828e32e87095\index-dir\the-real-index~RFe58c8aa.TMP
Size 48B
SHA256 d151be34be50f5239a2948e7721eac5c142b30f3baff45ca0d2298ce6e9c6844
MD5 8db779038f5e23c35fab64558cad64b3
SHA1 558f6c9652bec53843209d3d9cbbcdd2cd0cbdeb
SHA512 550e5be12083ebd2f07158e3eb52a32c71c8fad86cdbfc23f791ba81fd393db80057a6c62923e6f161078f3c71a2fe3ed7ff673db0b259a6463ed3497804c4c4
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\d4079fd752603fdbbf916c56e1d5774dd6a42e91\ed83c028-434e-4a23-9f42-b1972231a551\index-dir\the-real-index
Size 72B
SHA256 11e03651e7795f71cf723d86487b8903c6bd1daa354a425a9b025f3d42d45be9
MD5 c9ba4fbc4772813357962e333ed35fe4
SHA1 660f19dad8c6d6eb21647b099574358fad28ac7f
SHA512 9836e91104f075105cf0e784ad25ae07480c7b37af20ab1a89c0fa6454e8faff0e9ec82489e093abbec8814513c0b7f0526ecef7b82aa318602ba3d35b1c26a9
TLSH
T190A0025BBE409481C19123B0968769C17F52C8744105879380900D58DEA1DA06D1EC44
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe588ece.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\d4079fd752603fdbbf916c56e1d5774dd6a42e91\ed83c028-434e-4a23-9f42-b1972231a551\index-dir\the-real-index~RFe588ece.TMP
Size 48B
SHA256 2ab43d5a2750cc54a9bd88cba513172000b82b9307132ad00b1c43fd15d69d69
MD5 3f96277affd59afe16899630e4cb0c33
SHA1 a8c37705e47061a4cd13f0d64ff95fa218562ede
SHA512 bb0d06bae6df5a3f5951e0c40a1a887ef47363e53be663fa9c32b47dd1a276cd5c136456a31bc0a57c7f79cf34293e39a4181f895efac0ea1d7e2877e28b7604
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\d4079fd752603fdbbf916c56e1d5774dd6a42e91\index.txt
Size 60B
SHA256 0e9ff7c78cf4c23eacf5da32703e22b77de929b4cc0313065b9100cccc3f6919
MD5 f4bcff9532fe9dca425dcb7769b7eda5
SHA1 cdcfe7f3273af8251f870d9ba3732a65290c46fd
SHA512 b544ad6ee99a765ff5c8ad9937b91815bb60659eafadf2b4198df699bb9b6047b7783c57607c7eca6e2ff62429c94e52408eb36c0567e408ff38c973922e4117
TLSH
T186A002F7008083003F8083CA2020A319C60F388EECA884E898028340000CA63100A859
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\d4079fd752603fdbbf916c56e1d5774dd6a42e91\index.txt
Size 131B
SHA256 916c1a2099a4d68e8438dc1f366628b20eac93c83021b0c43308b6461575a4eb
MD5 2aa3f75ba82ec29d8a029df064ffaa10
SHA1 aa24409dc24035eb8f486a4f887b8e6f8847e29a
SHA512 6161ed09175d1b0000c4879e6d3606441fe790225596283a920553f2cb711bba64a54711f06d2bd7cf678ee67fc354c01a46e10c650a9ba9b393294a02999c0a
TLSH
T134C092F71591E7103F84C7D721D5E357C24A39CEEDAA9BEA5C0A9358C00CB26001AA88
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\d4079fd752603fdbbf916c56e1d5774dd6a42e91\index.txt
Size 135B
SHA256 8e7dfbce0c9e0a600e4ac7da51a7d7b6a99cedef764e053f8a864b9e7e9b6225
MD5 498de4915300b7725bfdc5df0500591e
SHA1 260cdab6c73ed82a4df8a322c1e9458359bb85f8
SHA512 04c7daa4b8cf21c38e067bb854890f7237b473151e1a4728d8f96d00edd8df620eca8550ecae79786529eeb812a11a76897d41abd55f24a9af3a9e3ab4de542b
TLSH
T163C09BF7019193007F84C7D765D5A347C2063DCEDD5997D95C067354C03C7260059544
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5840ae.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\d4079fd752603fdbbf916c56e1d5774dd6a42e91\index.txt~RFe5840ae.TMP
Size 135B
SHA256 e423aface1b6354a9f8587d0b9214f261ae3c02af8083f3ef6606796400f5555
MD5 403b6aeff4ac6593a675395eb7587568
SHA1 2022189713d544cbf536389a60db7e4b3b8d1925
SHA512 281b4a4a5e6c38029f619429e9ac573309e4fe44dc2ee523296af13c24eb40a3a0636424719516cce08c4eeda28adf86d7285f3bfa2fa2e406fb0a9ff1f5da73
TLSH
T177C09BF701549700774946D774E4575FC6177C4DEC5746F449077355013D52F0205454
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 43f24216a07e1633b4dbdd41f7d62ae0885d0357d816eed73187847530c58284
MD5 e2918a0d2a12dcdecff042fefc635540
SHA1 8bd09a6882552ad6c0b44c28001e6e568da7fa69
SHA512 b57721446a6ca5747ae908ce484f3a7ea1fe34cf6b79fe054b2c2cebbeca3d5268b0995fc360214cb9054ab29e51df5b82fd4828f3fcc85f0b4ff9b747aaa960
TLSH
T126B0121088489009D0444B7401D398C0211808640E0620211474D1E494A950052C4403
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 f85157b1a6e01bd25a39cd4abab6da63f66c31235e2ff6bae5153a7afcef25c3
MD5 1531dfc3294318b30628f3523027114d
SHA1 45a1d3ab2554a076ba3fb7b45d43a27f5e526030
SHA512 5275ce576173140b7d3270389d7071c1ee783c06020771386c7e72939055c6e3dc223394a264dad6c4e57cb67789769c5ff335fd9822cdf9dfbfbc11dafa7646
TLSH
T121B00111C88EA31AC8450BB422A738C83A748E9A9B42720998A4F5AAA95A2615695652
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 b5017ccf9f8db9060977eb6a4c0fd7ecb93be0d0ec85dc64ec272277493e0958
MD5 3868bf110443b23ec84bd5ad387c5671
SHA1 a27a8c831eea4b2923ff03b3c8ccab33f8e01165
SHA512 fefeff22a9cf0432b2bcdf7a319969073b5a1254dc4edd587acb2a8dbe0ea6e6df1532b0ad02709e284d2c5637b8105aa922356708d4e4b17492d9f2246dee56
SSDEEP 192:+HhOVXSe5i+EkETc3+uWvwAn+mPoOTR7uVhrx9aVYh5D+wHMT7glRZVrd9th/qnh:+BOVglYXrbtZqRvJF7/
TLSH
T10FB22C11767A0380397E258A9194B46F62C270A37098B42B7BB945B64F6BF20CDFD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.4.4\data.txt
Size 145KB
SHA256 7dd75cb36b4cc7c5f2df67bac823b9d9d2c3653172ff73ce6cccd39683970a08
MD5 79f8327a9cd094a4edb1fd159e289e95
SHA1 4d3615906d16d8a807e1bd394bef139507ce12ff
SHA512 9ab212871ccbe15c062da9898a782d75d208a2591b4c804df3e32581751801889f8cad8fae53dc0307cb89172c4536d35e44c06d63df6928ec4c4446a55a1343
SSDEEP 3072:tPAgDcCHaLHl65aynyosxb3+B1xh0OrlwYEEY6lCuZY:9X1aI5aZoKzMJ07NtxoY
TLSH
T1C7E3F110CDC51FA8CEAC362C60FE0F1A63D1C69D4867A5C9DB63FD0A6F97A0492275C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 73a6a86cbb8f5fc3c9ddadd0cf2e2b2b9fea794569904a2a98eac6668f27cd2d
MD5 1c6bf6a95fb8eeaadadcee0815ab8eee
SHA1 d1cdfd6715a58f44f1ccad770b6929d75539d3ed
SHA512 0dcf93ca9766bf7b3ba79de9eb7566655ced3ab3c58c3eb394a9d608a30da9160d21578343d27b6905b4f865982d957f7e488cb62b742e2e1d2f4c125ea93410
SSDEEP 384:nukiFavqMg3sNy8TUNTUlIm2RihYqrrmvfDYWP3jVf5eQhCSS7o1dKuiNGXdrN1D:u/Fayv3ZwgTiN2YWPxf2Smo1tiwXZD
TLSH
T131C23A31E898D9ABEDE69F8AEB0A7B07DEE00257C5CC4AD4D9E84D1D10D719E1307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 1d3d57477ed637db29628d3a0d4e81816c4bda51c03e77aec4c614df67dc63d7
MD5 b372ecec7395788b846748ba70a01589
SHA1 6bb8342b4f3b3243dab770fbf2987f994edcaa85
SHA512 7342cc0e02292680a47f6a374e1b02aa1336e16e9a3ec596711412cf6687115d179060b61005047d8d3682e4248f0cb8677902bc63e611ee1797cac49b1d0f68
SSDEEP 384:npiFJjccCs+Bt0S3Z3sNp8TUNTUlI4+RihFLkuumvfDYWP3jVf5eQb8Haih7ASBO:AFJccQ53Owgfic+YWPxfccS4qA
TLSH
T132C23A319894DDBBEDE78F99A75A7A47EEE00163C68C4AD4DAD84E1C00C71DE030BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 09156aac34608b8b20bf67397a08d0ab9dd5853011a879b2e9cfd7052f835f84
MD5 c6878ff0e12db0836b4953d79d434fa2
SHA1 70893945ace48f9d298380b93d2002bef88d8269
SHA512 3cd1b4378d6acca4ddcea4a6bd5fe21f8fdaf0ca0bdee95ea7b952ab20386279f8c56f84b6a02e5912733f3d780e965ac0afe9d21c1b8866a63e796d2089d465
SSDEEP 384:nkiFavqMg3sNN8TUNTUlIm2RihrAqAmvfDYWP3jVf5eQb8Haqh7AS7o1dKuiNGX9:/Fayv3ewgTitLYWPxfwcmo1tiwXZD
TLSH
T115C24B31E898D9A7EDE69F8AE70A7A07DEE04257C6CC4AD4D9E84D0D10D71DE130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 4aa92de3a6fbd84781adc0d4ab28ff75aa15748e68544b02f6b684820b52951b
MD5 edb3fa757a0017ca7a5f54cb8abb85f3
SHA1 f0453db7d6cdf952ec83905d7386e0a0c4897de1
SHA512 da1417f543d449f733995f2a81932ccc0c682c1e2e34b6cbd96f369c3ce0cc05c61a522ac53f71e523915c940be0d3016ac6cf6c8c3f67398923e2645b85f9cb
SSDEEP 384:npiFYjccCs+Bt0S3Z3sNp8TUNTUlI4CRihiLkuumvfDYWP3jVf5eQb8Haih7ASBO:AFGccQ53OwgziV+YWPxfccS4qA
TLSH
T18AC23A329894DDBBEDE68F99A75A7647EEE00163C68C4ED4DAD84E1C00871DE130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 9cda44c153aa3d0e141a2a91495200e816012b267265b5c894cf27340836d2a7
MD5 56aac2fa0d0a989a8345ababe0f8a1c4
SHA1 50faf6b5575c16bf3af0f3f7582851757541ce95
SHA512 9ed69c681b90a705e2ca64084a93b244ef1b7fe8de16d2db69186f68b6d834c6d13e763a1bf06c07da1eed27785157f827ba2cd5d15d077f1c25e38ccf270092
SSDEEP 384:nHiF3jccCs+Bt0S3QZ3sNL68TUNTUlI4KTsihmTOuymwfiIYWP3jVf5eQb8HafrY:CFzccQw3g6wgaiftYWPxfpcS4qA
TLSH
T158E2B3F198D79976E89E8B97A33D2E029AFCC153B5884994F7D44D0CCC861BFC306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 c0dcad4eaf173f6b6632eaa8431691c40a97dc17dc8faaf6abba303dabaca72d
MD5 b7033a24c212f9e99768feb9434a74ac
SHA1 ed422a1a8c816d53b5ef0e5ec45235aac621c0a4
SHA512 ce2e1346cf3199c2d75911896cc12ad9f5a5ebf66c0f215af8072644acf4dff778ab37dbeef5c0b346db38006845d3f59af47bceef82e64a75bda2eeb5aed2b0
SSDEEP 384:nHiFYjccCs+Bt0S3Ql3sNp8TUNTUlI4CRihiLkuumvfDYWP3jVf5eQb8Haon7ASU:CFGccQA3OwgziV+YWPxf8cS4qA
TLSH
T16AD23A329894DDB7EDE68F99A75A7A47EEE01163868C4ED4DAD84E1C00C71DE030BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 046a6486a10a34f06f45fdb38027b9088a478c8bc6dc63d81e99bc692557b490
MD5 306c8e1823bd438333623d10630edd21
SHA1 070672d7786d2415b41a9ede63568978d2c4ca4b
SHA512 6fb90ad5a565dd3477626576f8ad834b503a0468d07749c3e019ac04a9bb36feb241848c760ae13d78e2551b488e830efa1d9f77750350ba5225103beb8cdc28
SSDEEP 384:nYiFJjccCs+Bt0S3Z3sNp8TUNTUlI4+RihpL5uumvfDYWP3jVf5eQb8Haih7ASBO:jFJccQ53Owgfit+YWPxfccS4qA
TLSH
T1E0C23A319894DDBBEDE78F99A75A7A47EEE00163C68C4AD4DAD84E1C00C71DE130BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 43c119e0d1a486d527b2692397f83d326f7f32ef92e46685187a3046e84ed3c9
MD5 c41edd3de187d033d98185d388e28712
SHA1 e23f76ae2448fde3110450ad0854d30bbc649ec3
SHA512 6d9d7ad98ebdf6688ea393ceeee359c27dc95a4ad9516f6a125fccb34ad73679c110579c76b030d6a3d27f9d6d7d98c21ef0eb4c911aa415247f12ab60b135d3
SSDEEP 384:nHiFejccCs+Bt0S3Ql3sNp8TUNTUlI4CRih7TnuP2mvfDYWP3jVf5eQb8Hafr7AZ:CFIccQA3OwgzixUBYWPxfpcS4qA
TLSH
T158E2A4F198D79976E89E8B97A33D2E029AFCC153B5884994F7D44D0CCC861BFC306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 0e0056c75b121ff70b3afc36227f5156f3626ca2ca91e3e8b7a90a9de11b19e9
MD5 f3bf419aff13bbf5cb8559b55c8ee139
SHA1 5f99c280aaf148e0542d7ca9ef5154dc3fb7f9ac
SHA512 f65afa7031fa3babc1c9516e5cd24cb44f2b5ef15f599088cca0e6265014b6001b462752f3c3e8b60562a00f954cc8aafe415a880065b2ff0532fa6f011b6d42
TLSH
T118E00445D30110DCC05DDD310043173047C1C0141050030F755017C57C151005F755C0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 d9c029775acd7803dff111e5716906aaf8cb574828982f07290ce136a9c10412
MD5 029264669498867e5c6a7e4491f606a5
SHA1 b6c7d46fa77e58a078b91a7078e95854146a761a
SHA512 cc1abf3b21ecf0a2be79ea4799e87f99a7bbb84b284e72cddfb34b7b8bd1430a52758b3914c1c66846a5902d8e747f4e36f8507930bb817b44c25baeabaed555
TLSH
T111E00247D30110FCC06D9B31004317304BC3C06410F0030B6E5016897E173006F75FC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 755bb8779c2fc393df9e6afb41ce4cab8b5914ee362c20221d5e2fef95006807
MD5 16f01655958f5cf0b831dd49157e555a
SHA1 4caf505d48e7b73325feebee62b685d0e20982a9
SHA512 7105e093907051c04c404293e5d78f250c3d1344f552f10a974943e24fec043c0b53de42bd551551cf83d027d53249098243eb01fe7c14514ab6f13b8fc2e26b
TLSH
T144E00146D34290BDC0699B31008317345AD2806411B1020A6A501A997E173006F75FC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe59dd08.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe59dd08.TMP
Size 392B
SHA256 d3ebbb7932dcb24f374061e89096a8574498ba1ddfe5424270727c647bb8827f
MD5 9008a3d142505ae9cd679e561128fd3d
SHA1 85d8af020ac998fab5ed13f3e43e53e999d9dce5
SHA512 a7ed57f4fc0800575cd125e633f4264a408f31580b957be536a3bd8311e6888f0ebb4a82644d78b9c4a8017a507b4e3a49c38dd2d802819f5fdf97a8f5c362ce
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 1e3ffd30014b729494af4bf2189499583a73e14e899275ff78a0a2e8e7724b00
MD5 2d3a1ccfb9c2d7cf9dc1700a8ddee94d
SHA1 f1fac183ed98847ee026b886bf048337978c5557
SHA512 39fa2567a2fa0982d8040260ed84d90adcc196e1ed238f65300dd129034fdd548292dd985c43c8688511a39c37ac4a4445fc3adae1e1d1127ca0237cc1fafa22
TLSH
T1494120E1893D2AD1D4FD0E6E649778FC95D8C32AF4B8707D6464DE98473A61EA04043F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 30c9899f44b617b35683f17ad7c78f375004087f564fe5fa74702c16492beb02
MD5 dc315870113f85a5525c7eadfe269d0f
SHA1 2963a09c0050cbb8b88951665732497b47f4a2eb
SHA512 92cba1b7335f3ea8ca17a6c44db1f22aa09ff85289ff56c605d22cfec4a32cda98eaf92f4aad585cd92e057db94bed3ef37091a7c254374200a766bf43183446
TLSH
T101414EE1493E2AD1C4FD0A6E649738FC91D8C32AF4B8303D6420DE98073A60E644043F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 8e69f4b90364bd1ce3d3693c007a0a06ad6fefedaa4b23d9b34d709b7dbd73c0
MD5 20f2d91696b0725b209b6e008e0464aa
SHA1 09b75cd1eb39bbdf39c7c15dd4d7ec49431852df
SHA512 827d45bdd31df9940201785188c44ca11921ebfc36b54d628512de7746cd850ff49342dfb01cc99fd92930e959fdaafb968d54ad0c44811b444d4c1038185006
TLSH
T118412EE15D3D2AD1D0BD0A7F749B38FC95D8C72AF9A8303D2864DA98473A60E658043F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 e3163f2e07491384bdaf37a8e6f58dd18a1cdf0f665f312b13ced02ceccf33c2
MD5 6899aba47c49993530287a81c4de46a8
SHA1 405287952180e4cbbf888ff4849e624e9f25d284
SHA512 9a8cf0c4e7274e315ee297505dc76eabb17addfe135247a7a4b911e776c671364e52045a9741fee15312bdb7dba1a1da2929720cc969deb0f263e228b0d98d80
TLSH
T1DE4130E1483D2AD1D0BD096FB49738FC94D8C72AF5A4313D2424DD94433A20E614003F
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 6944716434c46f07b0daf0897c5164d0e412f7001fb5c255d992989a42357abe
MD5 5f3d624bca0ed8ae34e3039fdab2e7da
SHA1 00633f20c45479f399dd59fe29a5673f391ee1ca
SHA512 64357eb353f41c07534eb796a616a13649713f94cd01a9dfa3e927b3328c844766828f97a25f1fce3bc59bef284dc33161afd94e8fa482f315c1b28fc8ec964b
TLSH
T1BE411A98B7FA1148B7777E5AABF7696D487EB8772F07D49D00110E4E0622B00C861737
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_-_6.0.36_(x86)_20260421165452_000_dotnet_runtime_6.0.36_win_x86.msi.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.36_(x86)_20260421165452_000_dotnet_runtime_6.0.36_win_x86.msi.log
Size 4KB
SHA256 197bb20da55ce431e62a251b31d89116cf5ae1d365bee3de2c67f263272a475c
MD5 29584563812d49b977b035c0a944f5fc
SHA1 7ba5a467fef4548b5632d11940ada205f43025b0
SHA512 136f2fd3d3f65ce021a4ece62e4aa8ce0739854019ad31c58fcaa5f2d336aaf17b3df915fa104fc5d164e8624d1694879c661c312d6d0cf7f1d35c4caa0eae64
SSDEEP 48:YcFwU+itRMJw1JBdOxlFORLBj/AcKaqcaWS1+dOaWFJb1JKdOxk1JNQfiOKFMR:Ya+oGErYOL9flmiUTPmvy1KFMR
TLSH
T1AD810E551AE80946B1F7570BEEF3C012B933BCC6A935DB4C2346C31942AB906687DB7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_-_6.0.36_(x86)_20260421165452_001_dotnet_hostfxr_6.0.36_win_x86.msi.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.36_(x86)_20260421165452_001_dotnet_hostfxr_6.0.36_win_x86.msi.log
Size 2KB
SHA256 36698047592c486b90ab0c9513913e15b23c07942dd30a560be72944f2110895
MD5 f78a91cad2686d61813d9ef2c04aafe6
SHA1 d0ef6132109e500a4c5e141dd8f3c6cb2ed5795e
SHA512 e8df56f4da0a9c2fa750a2af1d7954cae684361aca49284e76a8985a440e90d912ed49f69b13f311edb2400db7653b54bce3a9ff80745cda3af7c722ea7ac374
TLSH
T1A64116641AE90A46B6B3974799F3C112FA33FCD2B835CF4C23468319026A9046C6DF6E
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_-_6.0.36_(x86)_20260421165452_002_dotnet_host_6.0.36_win_x86.msi.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.36_(x86)_20260421165452_002_dotnet_host_6.0.36_win_x86.msi.log
Size 2KB
SHA256 1309381efcdbb63557b78d315b7508e55a2af705c79b25873a1c8daf7f940358
MD5 ea7de7665eff174d70b65c23bd5b72f6
SHA1 71d455dd83d767f346c91c18730bfd67a1b59c6d
SHA512 136ec14fc42e944b0b78bb882717ef104da3886565348f0e0a11b263366d4e5be85a248eeede8ffe286b623f7a4c77689d8d49c9a8f75d9f8572773ed38e853f
TLSH
T12A4126551AE80A0AB1F29747EDF3C012AA33FCD5B839CF4D2345831902A7D04686CF6E
MD5 SHA1 SHA512 TLSH

Submit Download

DS4Windows_3.2.11_x64.zip.crdownload

Path C:\Users\Admin\Downloads\DS4Windows_3.2.11_x64.zip.crdownload
Size 4.2MB
SHA256 53186b12b03ab4f60dfe7fe8815738104d46a1b22a32f7e669a308eb794e3937
MD5 f3ee69cc906f1fcafb60f103151bc989
SHA1 023ceb3d274d9b5b62816d5d70be68fefc626f7f
SHA512 df80ee5539e309b6d6f87f0654021a93309149686e941ed991c5970d73c185c9d576c1622383a7424651f1887450374a3fbd7bf658a2119a52fc823d7da7545c
SSDEEP 98304:ey1oUGFzV28EqTrtQDqG2uMR0taKWgZDKj6rMjqIE5PL0//n8p6A:ey1fEzIJqFQD92uE0tESDJWqIgAn8pF
TLSH
T13F16331B24A1FC6DEB637E7EC04F8E6DD8EF949F2268E5A700D8E011B1197C5588D21B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windowsdesktop-runtime-6.0.36-win-x86.exe

Path C:\Users\Admin\Downloads\windowsdesktop-runtime-6.0.36-win-x86.exe
Size 49.8MB
SHA256 4e77bd970df0a06528ee88d33e4a8c9fb85beedbdd7219b017083acf0c3aa39e
MD5 9c62d5c212725b00563ca6b201326b8f
SHA1 9fa17882c43a1f968228042b6aded9c80d5db1ab
SHA512 a18351aabfe1590e58af79e57ac2414254ba80cb7a1fef19545a6b8418575c735fc1dc164c3c7fed426c4698f099991487fa4f443bab93afd41d1563845fbcf4
SSDEEP 786432:ISB5roNf+J2Crca0OttJ/xYtKMBWMZf6YAoe/C3z1CpJp1Xkwb5SgvaOLh0dqNR:vSU2Cr0alxw9J6YAoT3z1mfXkw0AaN0
TLSH
T1E8B733338900D635F16106B6A899B1733C24F2741B81895EE3E8D8BE7DA2CD7D673993
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\Videos\Captures\desktop.ini
Size 190B
SHA256 86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
MD5 b0d27eaec71f1cd73b015f5ceeb15f9d
SHA1 62264f8b5c2f5034a1e4143df6e8c787165fbc2f
SHA512 7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c
TLSH
T11EC0121892F93224A1728D12BD7460119AB1F4217C16CA9D1380508F08A1601E631B53
MD5 SHA1 SHA512 TLSH

Submit Download

MSI955D.tmp

Path C:\Windows\Installer\MSI955D.tmp
Size 219KB
SHA256 2bf33a9b9980e44d21d48f04cc6ac4eed4c68f207bd5990b7d3254a310b944ae
MD5 928f4b0fc68501395f93ad524a36148c
SHA1 084590b18957ca45b4a0d4576d1cc72966c3ea10
SHA512 7f2163f651693f9b73a67e90b5c820af060a23502667a5c32c3beb2d6b043f5459f22d61072a744089d622c05502d80f7485e0f86eb6d565ff711d5680512372
SSDEEP 3072:FVzl3qiEZybztEwiUx6D02cWVsV1v2vZR3X6j7zo6k2FkngTLrOrORT9flQnS6lg:FVIMEgXmEAR3oHon2VaFuG0eEp
TLSH
T1AF248D217494947EEAFA0832A57EDA71BF3DF2241760C8AEC3409D1E6D604C167B7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bg.png

Path C:\Windows\Temp\{109E8020-5376-41EF-9035-BEC55362C570}\.ba\bg.png
Size 4KB
SHA256 9095bf7b6baa0107b40a4a6d727215be077133a190f4ca9bd89a176842141e79
MD5 9eb0320dfbf2bd541e6a55c01ddc9f20
SHA1 eb282a66d29594346531b1ff886d455e1dcd6d99
SHA512 9ada3a1757a493fbb004bd767fab8f77430af69d71479f340b8b8ede904cc94cd733700db593a4a2d2e1184c0081fd0648318d867128e1cb461021314990931d
SSDEEP 48:u+Xg+NXWbdlIr33lx9W5OstaDIy3r5XpPyvZKmXYTDeiByNxcaaaaaaaaaaaaaaE:AaXWPIrHT932JsdpPyjqDeioatEn
TLSH
T19891B4D8FCF95322C6002BF255F4C0735A0215B713ABFEC82F496BD90E6878E25058B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wixstdba.dll

Path C:\Windows\Temp\{109E8020-5376-41EF-9035-BEC55362C570}\.ba\wixstdba.dll
Size 190KB
SHA256 dcea15f3710822ffc262e62ec04cc7bbbf0f33f5d1a853609fbfb65cb6a45640
MD5 f1919c6bd85d7a78a70c228a5b227fbe
SHA1 71647ebf4e7bed3bc1663d520419ac550fe630ff
SHA512 c7ff9b19c9bf320454a240c6abbc382950176a6befce05ea73150eeb0085d0b6ed5b65b2dcb4b04621ef9cca1d5c4e59c6682b9c85d1d5845e5ce3e5eedfd2eb
SSDEEP 3072:sjEoXsLW9OLG8Qp51ySdjDXY33b+Av7O5IkI+/AYkPAEc527uu3k/gLtxavf0ir2:sjEo8LW9553hXWy15I2YrAW7FUVEihs3
TLSH
T1FF14AF1176D0A07AEBFB16307A39A5216E7DBA200FA0C9DF63449D2B1D715C19B36B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet_host_6.0.36_win_x86.msi

Path C:\Windows\Temp\{109E8020-5376-41EF-9035-BEC55362C570}\dotnet_host_6.0.36_win_x86.msi
Size 704KB
SHA256 c6803039a17fe759c547e234faae4a2e417b88c9c2fa6c1bb1c64f42654f7a92
MD5 d54419f4ced0a31ff799a3321e029dbd
SHA1 c27f63faaff2d9dde3d4c2a0b00ea937828e7d66
SHA512 a2b09c3b9bc5f9f28989cd2ad806fbc53cbf2e433019e9ba2f9846d11e6bdd5e0ae971c65ef9d3ad5bf6394d3e366154090db84df3774ae6257c340d0b77545e
SSDEEP 12288:RHkpvBD4Rxbp4K+1uiqNV+EgXmEI3os2Qx7E:RGin+s18dc3/7
TLSH
T170E48C137D80803AD9BA0D31853AD7B16F3DBD204A64989B6380B91DDDF15C0AF76BE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet_hostfxr_6.0.36_win_x86.msi

Path C:\Windows\Temp\{109E8020-5376-41EF-9035-BEC55362C570}\dotnet_hostfxr_6.0.36_win_x86.msi
Size 760KB
SHA256 2f5bb388c393977ad4bb651d6a4961b92b0666e8f92b9c2c12711d3b97ddb8cf
MD5 ed60bcf3c2074780eb156a62370a95f8
SHA1 25aa9e8016b6977630d1ec5272867e4faef519f3
SHA512 0eb65e4f3e30779fb16a8d6e685cf29ca9bfb6b167e95b3b7b0c3a8adfefb5e12a6aa4ba7e760ec761942173ffe18e173dd41b8e98a56a3238f33748883ed924
SSDEEP 12288:Uf17Y31p//D4Rxbp4K+1uiqAV+EgXmEI3os2Qx7ET:2crbin+sY8dc3/7c
TLSH
T163F49D237D80803AD8BA1D719539D7B16F3DBD204A64989B6380B91DDDF11C0AF36BE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet_runtime_6.0.36_win_x86.msi

Path C:\Windows\Temp\{109E8020-5376-41EF-9035-BEC55362C570}\dotnet_runtime_6.0.36_win_x86.msi
Size 23.5MB
SHA256 b1fdb52ff94b7c108fd8f7a6c50d2b0b9d50dda690b94d1c618c7faa27967363
MD5 06169a7f97f141c287fe63fb095e04d8
SHA1 86690887d059ce35aa573d9bafedae546bc881fc
SHA512 7e028859d6ba20f78111ed26c2f164443b2b2ef9eea81a6016da7379ae8b370627862622fdcb1b9d121af70d6b7f3e0b9b9a25a2081c49f39f0b29d8aef413a1
SSDEEP 393216:T0Zsa+EllPVuOjw6tCNB/VzDUmCfLlYwtScX3M9ictnkEATcsAbnJQ/tK7unOWqG:TbZEvsCtCNNxUmCzlYiNX4ictkxc5G/h
TLSH
T1804733137D819835D0692E7500BECBE24A39AD343B95CD4B6391746DECF26D0EB326E2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windowsdesktop_runtime_6.0.36_win_x86.msi

Path C:\Windows\Temp\{109E8020-5376-41EF-9035-BEC55362C570}\windowsdesktop_runtime_6.0.36_win_x86.msi
Size 25.8MB
SHA256 f40827ff39f4da04777d3720f4bb69e31a3999db2b0a6e80ca453f8e173424c2
MD5 43f943ec1c108d5be454df13962cdc73
SHA1 821796b476470a3b2dfda08a2741e50494505cdf
SHA512 849084191db73515a90924c7af5e21dfbc742157705caa04e9d58c0de5672add743cf8cb690377417f031ae4c7098fdbe2ba1039333d893cc6bd1f9d7ea4c2ac
SSDEEP 393216:DpyMtTPvBA/2ynkuI287lX5ebJGruTNyjzUIf8Ri3q450Jq/h+eSf50PFDD:D/tTnBj3N2usbuc4LG47kfhOF
TLSH
T103573337BD41D03EC9060D759636E3A2BA3ADC709B60851763A0B23EDCF54D05AA6FD2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{787D856D-16B0-4769-A351-E95F83D4EC5A}\.ba\1033\thm.wxl
Size 5KB
SHA256 81a68046b06e09385be8449373e7ceb9e79f7724c3cf11f0b18a4489a8d4926a
MD5 d5070cb3387a0a22b7046ae5ab53f371
SHA1 bc9da146a42bbf9496de059ac576869004702a97
SHA512 8fcf621fb9ce74725c3712e06e5b37b619145078491e828c6069e153359de3bd5486663b1fa6f3bcf1c994d5c556b9964ea1a1355100a634a6c700ef37d381e3
SSDEEP 96:MT0abTxmup/vrCKATQdYQHdYCwgoVOBq9LjP5dbSE7:OQNkdYQHdYCYXt7
TLSH
T1F1C1DBA778CF53C128731255EA925AAA5911C19C537F2DF4FC8B454B838A827A373F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windowsdesktop-runtime-6.0.36-win-x86.exe

Path C:\Windows\Temp\{DB3CFE86-9F43-477D-B0B5-11C3153B3D53}\.cr\windowsdesktop-runtime-6.0.36-win-x86.exe
Size 608KB
SHA256 1000661f29a30a03f49072845fdbdf56c948ce014d319b9aa0ac68f271be8b05
MD5 02bf79bbba633e662a3cedec69322a44
SHA1 0bd4cf64bc18d254b7908dc915082362a9442e03
SHA512 02d9a1f6b55ac2b7c82e4f288afba7538089d5ed4fd04b31e34e8c55517e1bcda7c531868de8c90625a5a5f6ebf55dac4ad05af70f20d504c49122e5c67b8417
SSDEEP 12288:ZmEsd9PZfePv3xl7ft7V+6uC+zd5qLlv43wWSfubJ6Dnmey:Zm39PZfePv3r7fm6t+jqpA3ufubspy
TLSH
T1A4D47D32A5614032E7F10273B968D6303E3CE328275489AAE7C4AD1D7EB84D667F7257
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/600-806-0x00000207B6670000-0x00000207B671D000-memory.dmp

Download

memory/600-797-0x00000207B6670000-0x00000207B671D000-memory.dmp

Download

memory/1000-2985-0x0000000000D00000-0x0000000000D87000-memory.dmp

Download

memory/1000-2407-0x0000000000D00000-0x0000000000D87000-memory.dmp

Download

memory/1884-448-0x0000029A94200000-0x0000029A942AD000-memory.dmp

Download

memory/2584-788-0x0000000004060000-0x00000000040E7000-memory.dmp

Download

memory/2696-3033-0x000000000DAA0000-0x000000000DB27000-memory.dmp

Download

memory/2696-3013-0x000000000DAA0000-0x000000000DB27000-memory.dmp

Download

memory/3804-2241-0x0000000000570000-0x00000000005F7000-memory.dmp

Download

memory/4176-2977-0x0000000003170000-0x00000000031F7000-memory.dmp

Download

memory/4176-2777-0x0000000003170000-0x00000000031F7000-memory.dmp

Download

memory/4184-2998-0x000001C373130000-0x000001C3731DD000-memory.dmp

Download

memory/4272-2776-0x00000000005B0000-0x0000000000637000-memory.dmp

Download

memory/4272-2978-0x00000000005B0000-0x0000000000637000-memory.dmp

Download

memory/4324-787-0x0000026096700000-0x00000260967AD000-memory.dmp

Download

memory/4776-755-0x00000278FFBC0000-0x00000278FFC5B000-memory.dmp

Download

memory/4960-3012-0x00000224E5520000-0x00000224E55CD000-memory.dmp

Download

memory/5108-2976-0x0000000002580000-0x0000000002607000-memory.dmp

Download

memory/5252-3026-0x000001EBE36A0000-0x000001EBE374D000-memory.dmp

Download

memory/5360-3014-0x0000024092400000-0x00000240924AD000-memory.dmp

Download

memory/5360-3015-0x0000024092400000-0x00000240924AD000-memory.dmp

Download

memory/5416-2266-0x0000000002460000-0x00000000024E7000-memory.dmp

Download

memory/5416-2986-0x0000000002460000-0x00000000024E7000-memory.dmp

Download

memory/5528-2773-0x0000019DB8740000-0x0000019DB874C000-memory.dmp

Download

memory/5528-2774-0x0000019DB88C0000-0x0000019DB896D000-memory.dmp

Download

memory/6092-3027-0x000000000D800000-0x000000000D887000-memory.dmp

Download

memory/6092-3028-0x000000000D800000-0x000000000D887000-memory.dmp

Download

memory/6128-2983-0x0000000002F10000-0x0000000002F97000-memory.dmp

Download

memory/6128-2632-0x0000000002F10000-0x0000000002F97000-memory.dmp

Download