Overview
overview
8Static
static
3VLaunch.zip
windows10-2004-x64
1VLaunch.zip
windows11-21h2-x64
1Hardcodet....pf.dll
windows10-2004-x64
1Hardcodet....pf.dll
windows11-21h2-x64
1VLaunch.deps.json
windows10-2004-x64
3VLaunch.deps.json
windows11-21h2-x64
3VLaunch.exe
windows10-2004-x64
1VLaunch.exe
windows11-21h2-x64
1VLaunch.exe
windows10-2004-x64
8VLaunch.exe
windows11-21h2-x64
8VLaunch.pdb
windows10-2004-x64
3VLaunch.pdb
windows11-21h2-x64
3VLaunch.ru...g.json
windows10-2004-x64
3VLaunch.ru...g.json
windows11-21h2-x64
3Analysis
- user interaction
yes - max time kernel
149s - max time network
155s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
29/05/2026, 15:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
VLaunch.zip
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
VLaunch.zip
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
Hardcodet.NotifyIcon.Wpf.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
Hardcodet.NotifyIcon.Wpf.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
VLaunch.deps.json
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
VLaunch.deps.json
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral7
Sample
VLaunch.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
VLaunch.exe
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
VLaunch.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral10
Sample
VLaunch.exe
Resource
win11-20260513-en
windows11-21h2-x64
22 signatures
150 seconds
Behavioral task
behavioral11
Sample
VLaunch.pdb
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral12
Sample
VLaunch.pdb
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral13
Sample
VLaunch.runtimeconfig.json
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral14
Sample
VLaunch.runtimeconfig.json
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
150 seconds
General
- Target VLaunch.exe
- Size 158KB
- Sample260529-s5eglafv21
- SHA256 35eb450f9a5eb4dac2495360bc74d7c574f9e744d492564e26c1fb3ff1c5de1b
- MD5 9255449a9c5b2d17d5f7a68d4dc9e154
- SHA1 785920f3620702a7e02b2377b71172497ba71b89
- SHA512 d8214ad0578e0911fdd9e584fa60ddf6394a1d5fcc7a9c46bc81183c1dd6eb78793ee92e3b86fd219612d011436455cdee3809a1cdbb25a00816515a814d2039
- SSDEEP 3072:alDJk88wN1QA7sxrYL1peQ3lOg9SkHNwG3JzaAT5+z:eAAwxrI14Q38gB/ox
- TLSH T176F33B13A6A851BEE1B3D678C9924941FB7278594B71A7CF03504EBA0F77BD09E39302
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Downloads MZ/PE file 1 IoCs
flow pid Process 64 3120 msedge.exe - Executes dropped EXE 6 IoCs
pid Process 5380 windowsdesktop-runtime-10.0.8-win-x64.exe 2304 wixstdba.exe 3272 windowsdesktop-runtime-10.0.8-win-x64.exe 792 windowsdesktop-runtime-10.0.8-win-x64.exe 2860 windowsdesktop-runtime-10.0.8-win-x64.exe 2412 wixstdba.exe - Loads dropped DLL 8 IoCs
pid Process 6004 MsiExec.exe 6004 MsiExec.exe 3420 MsiExec.exe 3420 MsiExec.exe 5256 MsiExec.exe 5256 MsiExec.exe 5824 MsiExec.exe 5824 MsiExec.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{044C9B3D-6B2E-4F02-BA14-700EE8ECE6BF} = "\"C:\\ProgramData\\Package Cache\\{044C9B3D-6B2E-4F02-BA14-700EE8ECE6BF}\\windowsdesktop-runtime-10.0.8-win-x64.exe\" /burn.runonce" windowsdesktop-runtime-10.0.8-win-x64.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.8\zh-Hans\PresentationFramework.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.8\System.Formats.Asn1.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.8\System.Security.Principal.Windows.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.8\de\UIAutomationClient.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.8\pt-BR\WindowsBase.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.8\.version msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.8\System.Reflection.Emit.ILGeneration.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.8\de\PresentationUI.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.8\Microsoft.NETCore.App.deps.json msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.8\System.ComponentModel.Annotations.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.8\PresentationFramework-SystemXmlLinq.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.8\wpfgfx_cor3.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.8\System.Net.Mail.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.8\System.Reflection.Extensions.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.8\System.Text.Encoding.Extensions.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.8\System.IO.FileSystem.Watcher.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.8\System.IO.UnmanagedMemoryStream.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.8\it\ReachFramework.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.8\System.IO.Compression.ZipFile.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.8\System.Net.WebSockets.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.8\System.Security.Cryptography.Xml.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.8\System.Windows.Forms.Design.Editors.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.8\cs\PresentationUI.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.8\zh-Hans\System.Xaml.resources.dll msiexec.exe File created C:\Program Files\dotnet\ThirdPartyNotices.txt msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.8\System.Private.DataContractSerialization.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.8\cs\System.Windows.Forms.Design.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.8\de\System.Xaml.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.8\System.Diagnostics.Tools.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.8\System.ComponentModel.TypeConverter.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.8\System.Diagnostics.Process.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.8\System.IO.IsolatedStorage.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.8\Microsoft.WindowsDesktop.App.runtimeconfig.json msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.8\de\System.Windows.Input.Manipulations.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.8\System.Runtime.Intrinsics.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.8\System.Web.HttpUtility.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.8\System.Buffers.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.8\System.Net.Primitives.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.8\tr\ReachFramework.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.8\System.Net.HttpListener.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.8\zh-Hans\WindowsBase.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.8\pl\WindowsFormsIntegration.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.8\zh-Hans\PresentationUI.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.8\System.Diagnostics.Contracts.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.8\System.Diagnostics.StackTrace.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.8\System.IO.Compression.FileSystem.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.8\System.Text.Encoding.CodePages.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.8\System.Design.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.8\de\System.Windows.Controls.Ribbon.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.8\es\System.Windows.Input.Manipulations.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.8\pl\System.Windows.Controls.Ribbon.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.8\tr\UIAutomationClientSideProviders.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.8\ru\UIAutomationClient.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.8\zh-Hant\UIAutomationClientSideProviders.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.8\System.Linq.AsyncEnumerable.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.8\System.Text.Encodings.Web.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.8\System.Threading.ThreadPool.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.8\clrgc.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.8\ja\UIAutomationProvider.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.8\zh-Hant\PresentationUI.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.8\zh-Hant\WindowsBase.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.8\System.Reflection.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.8\de\UIAutomationTypes.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.8\pt-BR\PresentationUI.resources.dll msiexec.exe - Drops file in Windows directory 57 IoCs
description ioc Process File created C:\Windows\Installer\e58c805.msi msiexec.exe File created C:\Windows\Installer\SourceHash{D5E1F20D-D271-483B-8963-1360DE7F28FF} msiexec.exe File created C:\Windows\SystemTemp\~DFBCD03955AE627297.TMP msiexec.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2136_942910886\manifest.json msedge.exe File opened for modification C:\Windows\Installer\MSIC986.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF8E963BEFC2ADCA27.TMP msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1\64.60.31149 msiexec.exe File created C:\Windows\Installer\e58c7fe.msi msiexec.exe File created C:\Windows\Installer\SourceHash{B57D6467-F8D0-45AD-AE54-0CF1B28B9982} msiexec.exe File opened for modification C:\Windows\Installer\MSID080.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSID63E.tmp msiexec.exe File opened for modification C:\Windows\Installer\e58c805.msi msiexec.exe File created C:\Windows\SystemTemp\~DF0B111D6E39FEF904.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSIE3DD.tmp msiexec.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2136_529108192\manifest.json msedge.exe File created C:\Windows\SystemTemp\~DF2A96650565D66B9B.TMP msiexec.exe File created C:\Windows\Installer\e58c80e.msi msiexec.exe File created C:\Windows\SystemTemp\~DFC92CCCDEA65C1E52.TMP msiexec.exe File created C:\Windows\SystemTemp\~DFA1C66A71E042E283.TMP msiexec.exe File created C:\Windows\Installer\SourceHash{FF569AC6-1EA2-422C-9E46-F013FDDC4776} msiexec.exe File opened for modification C:\Windows\SystemTemp msedge.exe File created C:\Windows\Installer\e58c80a.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIDF18.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIE12D.tmp msiexec.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2136_529108192\typosquatting_list.pb msedge.exe File opened for modification C:\Windows\Installer\MSIC8D9.tmp msiexec.exe File created C:\Windows\Installer\e58c813.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1\64.60.31149\fileCoreHostExe msiexec.exe File created C:\Windows\Installer\e58c809.msi msiexec.exe File created C:\Windows\SystemTemp\~DFA6110DACB03ACEB1.TMP msiexec.exe File created C:\Windows\Installer\SourceHash{455C1E9B-235E-4724-B36E-2C33FDA8BD1F} msiexec.exe File created C:\Windows\Installer\e58c80f.msi msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1 msiexec.exe File created C:\Windows\SystemTemp\~DF50DCBA8DB4341E1F.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF40C032195A12284B.TMP msiexec.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2136_942910886\data.txt msedge.exe File created C:\Windows\SystemTemp\~DFF1FBE5880055FE4E.TMP msiexec.exe File created C:\Windows\SystemTemp\~DFD322E15E48DE905B.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSICCE4.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSICC76.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF9DC25E9070295697.TMP msiexec.exe File opened for modification C:\Windows\Installer\e58c80f.msi msiexec.exe File created C:\Windows\SystemTemp\~DFC3ED5DAE9EEC27AC.TMP msiexec.exe File opened for modification C:\Windows\SystemTemp msedge.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\SystemTemp\~DFD027F7BFAC6B89B8.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF88E86D86328AFADA.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSIEB7F.tmp msiexec.exe File opened for modification C:\Windows\Installer\e58c7fe.msi msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1\64.60.31149\fileCoreHostExe msiexec.exe File opened for modification C:\Windows\Installer\e58c80a.msi msiexec.exe File created C:\Windows\SystemTemp\~DF27C1324474627596.TMP msiexec.exe File created C:\Windows\Installer\e58c804.msi msiexec.exe File opened for modification C:\Windows\Installer\MSICB0D.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSICDC0.tmp msiexec.exe - Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs
When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.
description ioc Process File opened for modification C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.8-win-x64.exe:Zone.Identifier msedge.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language windowsdesktop-runtime-10.0.8-win-x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wixstdba.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language windowsdesktop-runtime-10.0.8-win-x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language windowsdesktop-runtime-10.0.8-win-x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language windowsdesktop-runtime-10.0.8-win-x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wixstdba.exe - System Time Discovery 1 TTPs 2 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 3120 msedge.exe 4572 msedge.exe - Enumerates system info in registry 2 TTPs 6 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Modifies data under HKEY_USERS 12 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b msiexec.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry msedge.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry msedge.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a msiexec.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134245429677973482" msedge.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29 msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29 msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A msiexec.exe - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7646D75B0D8FDA54EA45C01F2BB89928 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D02F1E5D172DB38498363106EDF782FF\AuthorizedLUAApp = "0" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D02F1E5D172DB38498363106EDF782FF\Clients = 3a0000000000 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B9E1C554E53242743BE6C233DF8ADBF1\AdvertiseFlags = "388" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\97D23B51F1F59DB5FB711CFA7F676167\6CA965FF2AE1C224E9640F31DFCD7467 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.32.52183_x64\DisplayName = "Microsoft .NET Host FX Resolver - 10.0.8 (x64)" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B9E1C554E53242743BE6C233DF8ADBF1\InstanceType = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\3C5848EB8385204663774374DDEB8D98 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D02F1E5D172DB38498363106EDF782FF\ProductName = "Microsoft .NET Host FX Resolver - 10.0.8 (x64)" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B9E1C554E53242743BE6C233DF8ADBF1\Provider msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B9E1C554E53242743BE6C233DF8ADBF1\ProductName = "Microsoft .NET Runtime - 10.0.8 (x64)" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B9E1C554E53242743BE6C233DF8ADBF1\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B9E1C554E53242743BE6C233DF8ADBF1\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{455C1E9B-235E-4724-B36E-2C33FDA8BD1F}v80.32.52183\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_80.32.52183_x64\Version = "80.32.52183" msiexec.exe Key created \REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ msedge.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7646D75B0D8FDA54EA45C01F2BB89928\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A8A84F1AA6E5EFD5BE00C8237B84D6D4 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7646D75B0D8FDA54EA45C01F2BB89928\Clients = 3a0000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B9E1C554E53242743BE6C233DF8ADBF1 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_80.32.52183_x64\Dependents windowsdesktop-runtime-10.0.8-win-x64.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6CA965FF2AE1C224E9640F31DFCD7467\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{90d77843-5fbd-64ef-6bdf-df7574d01646}\Dependents\{044C9B3D-6B2E-4F02-BA14-700EE8ECE6BF} windowsdesktop-runtime-10.0.8-win-x64.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x64 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6CA965FF2AE1C224E9640F31DFCD7467\SourceList\Media\1 = ";" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_80.32.52183_x64\DisplayName = "Microsoft .NET Runtime - 10.0.8 (x64)" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B9E1C554E53242743BE6C233DF8ADBF1\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_80.32.52183_x64\Dependents\{044C9B3D-6B2E-4F02-BA14-700EE8ECE6BF} windowsdesktop-runtime-10.0.8-win-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{90d77843-5fbd-64ef-6bdf-df7574d01646}\ = "{044C9B3D-6B2E-4F02-BA14-700EE8ECE6BF}" windowsdesktop-runtime-10.0.8-win-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{90d77843-5fbd-64ef-6bdf-df7574d01646}\Version = "10.0.8.50000" windowsdesktop-runtime-10.0.8-win-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{90d77843-5fbd-64ef-6bdf-df7574d01646}\Dependents windowsdesktop-runtime-10.0.8-win-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B9E1C554E53242743BE6C233DF8ADBF1 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B9E1C554E53242743BE6C233DF8ADBF1\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6CA965FF2AE1C224E9640F31DFCD7467\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7646D75B0D8FDA54EA45C01F2BB89928\PackageCode = "E302F54FE54A20F43BAA8AD4BAD6E484" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x64\Dependents\{044C9B3D-6B2E-4F02-BA14-700EE8ECE6BF} windowsdesktop-runtime-10.0.8-win-x64.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D02F1E5D172DB38498363106EDF782FF\Version = "1344326615" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D02F1E5D172DB38498363106EDF782FF\InstanceType = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D02F1E5D172DB38498363106EDF782FF\SourceList\Media\1 = ";" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.32.52183_x64\Dependents\{044C9B3D-6B2E-4F02-BA14-700EE8ECE6BF} windowsdesktop-runtime-10.0.8-win-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B9E1C554E53242743BE6C233DF8ADBF1\PackageCode = "4AA1F0B5C1F60A34A8FD26BC37D9E630" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B9E1C554E53242743BE6C233DF8ADBF1\SourceList\PackageName = "dotnet-runtime-10.0.8-win-x64.msi" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7646D75B0D8FDA54EA45C01F2BB89928\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B9E1C554E53242743BE6C233DF8ADBF1\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{455C1E9B-235E-4724-B36E-2C33FDA8BD1F}v80.32.52183\\" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\dotnet_runtime_80.32.52183_x64 windowsdesktop-runtime-10.0.8-win-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6CA965FF2AE1C224E9640F31DFCD7467 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6CA965FF2AE1C224E9640F31DFCD7467\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{FF569AC6-1EA2-422C-9E46-F013FDDC4776}v80.32.52183\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{90d77843-5fbd-64ef-6bdf-df7574d01646}\DisplayName = "Microsoft Windows Desktop Runtime 10.0.8 (x64)" windowsdesktop-runtime-10.0.8-win-x64.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D02F1E5D172DB38498363106EDF782FF\Assignment = "1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6CA965FF2AE1C224E9640F31DFCD7467\SourceList\Media msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7646D75B0D8FDA54EA45C01F2BB89928\InstanceType = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_80.32.52183_x64\ = "{455C1E9B-235E-4724-B36E-2C33FDA8BD1F}" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7646D75B0D8FDA54EA45C01F2BB89928\Version = "1344326615" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.32.52183_x64\ = "{D5E1F20D-D271-483B-8963-1360DE7F28FF}" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B9E1C554E53242743BE6C233DF8ADBF1\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6CA965FF2AE1C224E9640F31DFCD7467\PackageCode = "931B477A782C6D947B38D5240B620454" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6CA965FF2AE1C224E9640F31DFCD7467\Version = "1344326615" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6CA965FF2AE1C224E9640F31DFCD7467\Assignment = "1" msiexec.exe Key created \REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ msedge.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x64\Version = "80.32.52183" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7646D75B0D8FDA54EA45C01F2BB89928\SourceList\PackageName = "dotnet-host-10.0.8-win-x64.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\3C5848EB8385204663774374DDEB8D98\B9E1C554E53242743BE6C233DF8ADBF1 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B9E1C554E53242743BE6C233DF8ADBF1\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7646D75B0D8FDA54EA45C01F2BB89928\ProductName = "Microsoft .NET Host - 10.0.8 (x64)" msiexec.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.8-win-x64.exe:Zone.Identifier msedge.exe - Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1580 msiexec.exe 1580 msiexec.exe 1580 msiexec.exe 1580 msiexec.exe 1580 msiexec.exe 1580 msiexec.exe 1580 msiexec.exe 1580 msiexec.exe 2136 msedge.exe 2136 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 5844 msedge.exe 5844 msedge.exe 5844 msedge.exe 5844 msedge.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3272 windowsdesktop-runtime-10.0.8-win-x64.exe Token: SeIncreaseQuotaPrivilege 3272 windowsdesktop-runtime-10.0.8-win-x64.exe Token: SeSecurityPrivilege 1580 msiexec.exe Token: SeCreateTokenPrivilege 3272 windowsdesktop-runtime-10.0.8-win-x64.exe Token: SeAssignPrimaryTokenPrivilege 3272 windowsdesktop-runtime-10.0.8-win-x64.exe Token: SeLockMemoryPrivilege 3272 windowsdesktop-runtime-10.0.8-win-x64.exe Token: SeIncreaseQuotaPrivilege 3272 windowsdesktop-runtime-10.0.8-win-x64.exe Token: SeMachineAccountPrivilege 3272 windowsdesktop-runtime-10.0.8-win-x64.exe Token: SeTcbPrivilege 3272 windowsdesktop-runtime-10.0.8-win-x64.exe Token: SeSecurityPrivilege 3272 windowsdesktop-runtime-10.0.8-win-x64.exe Token: SeTakeOwnershipPrivilege 3272 windowsdesktop-runtime-10.0.8-win-x64.exe Token: SeLoadDriverPrivilege 3272 windowsdesktop-runtime-10.0.8-win-x64.exe Token: SeSystemProfilePrivilege 3272 windowsdesktop-runtime-10.0.8-win-x64.exe Token: SeSystemtimePrivilege 3272 windowsdesktop-runtime-10.0.8-win-x64.exe Token: SeProfSingleProcessPrivilege 3272 windowsdesktop-runtime-10.0.8-win-x64.exe Token: SeIncBasePriorityPrivilege 3272 windowsdesktop-runtime-10.0.8-win-x64.exe Token: SeCreatePagefilePrivilege 3272 windowsdesktop-runtime-10.0.8-win-x64.exe Token: SeCreatePermanentPrivilege 3272 windowsdesktop-runtime-10.0.8-win-x64.exe Token: SeBackupPrivilege 3272 windowsdesktop-runtime-10.0.8-win-x64.exe Token: SeRestorePrivilege 3272 windowsdesktop-runtime-10.0.8-win-x64.exe Token: SeShutdownPrivilege 3272 windowsdesktop-runtime-10.0.8-win-x64.exe Token: SeDebugPrivilege 3272 windowsdesktop-runtime-10.0.8-win-x64.exe Token: SeAuditPrivilege 3272 windowsdesktop-runtime-10.0.8-win-x64.exe Token: SeSystemEnvironmentPrivilege 3272 windowsdesktop-runtime-10.0.8-win-x64.exe Token: SeChangeNotifyPrivilege 3272 windowsdesktop-runtime-10.0.8-win-x64.exe Token: SeRemoteShutdownPrivilege 3272 windowsdesktop-runtime-10.0.8-win-x64.exe Token: SeUndockPrivilege 3272 windowsdesktop-runtime-10.0.8-win-x64.exe Token: SeSyncAgentPrivilege 3272 windowsdesktop-runtime-10.0.8-win-x64.exe Token: SeEnableDelegationPrivilege 3272 windowsdesktop-runtime-10.0.8-win-x64.exe Token: SeManageVolumePrivilege 3272 windowsdesktop-runtime-10.0.8-win-x64.exe Token: SeImpersonatePrivilege 3272 windowsdesktop-runtime-10.0.8-win-x64.exe Token: SeCreateGlobalPrivilege 3272 windowsdesktop-runtime-10.0.8-win-x64.exe Token: SeRestorePrivilege 1580 msiexec.exe Token: SeTakeOwnershipPrivilege 1580 msiexec.exe Token: SeRestorePrivilege 1580 msiexec.exe Token: SeTakeOwnershipPrivilege 1580 msiexec.exe Token: SeRestorePrivilege 1580 msiexec.exe Token: SeTakeOwnershipPrivilege 1580 msiexec.exe Token: SeRestorePrivilege 1580 msiexec.exe Token: SeTakeOwnershipPrivilege 1580 msiexec.exe Token: SeRestorePrivilege 1580 msiexec.exe Token: SeTakeOwnershipPrivilege 1580 msiexec.exe Token: SeRestorePrivilege 1580 msiexec.exe Token: SeTakeOwnershipPrivilege 1580 msiexec.exe Token: SeRestorePrivilege 1580 msiexec.exe Token: SeTakeOwnershipPrivilege 1580 msiexec.exe Token: SeRestorePrivilege 1580 msiexec.exe Token: SeTakeOwnershipPrivilege 1580 msiexec.exe Token: SeRestorePrivilege 1580 msiexec.exe Token: SeTakeOwnershipPrivilege 1580 msiexec.exe Token: SeRestorePrivilege 1580 msiexec.exe Token: SeTakeOwnershipPrivilege 1580 msiexec.exe Token: SeRestorePrivilege 1580 msiexec.exe Token: SeTakeOwnershipPrivilege 1580 msiexec.exe Token: SeRestorePrivilege 1580 msiexec.exe Token: SeTakeOwnershipPrivilege 1580 msiexec.exe Token: SeRestorePrivilege 1580 msiexec.exe Token: SeTakeOwnershipPrivilege 1580 msiexec.exe Token: SeRestorePrivilege 1580 msiexec.exe Token: SeTakeOwnershipPrivilege 1580 msiexec.exe Token: SeRestorePrivilege 1580 msiexec.exe Token: SeTakeOwnershipPrivilege 1580 msiexec.exe Token: SeRestorePrivilege 1580 msiexec.exe Token: SeTakeOwnershipPrivilege 1580 msiexec.exe - Suspicious use of FindShellTrayWindow 14 IoCs
pid Process 5844 msedge.exe 5844 msedge.exe 5844 msedge.exe 5844 msedge.exe 5844 msedge.exe 5844 msedge.exe 5844 msedge.exe 5844 msedge.exe 5844 msedge.exe 5844 msedge.exe 5844 msedge.exe 5844 msedge.exe 5844 msedge.exe 2304 wixstdba.exe - Suspicious use of WriteProcessMemory 57 IoCs
description pid Process procid_target PID 4944 wrote to memory of 5844 4944 VLaunch.exe 80 PID 5844 wrote to memory of 5940 5844 msedge.exe 81 PID 5844 wrote to memory of 3120 5844 msedge.exe 82 PID 5844 wrote to memory of 4328 5844 msedge.exe 83 PID 5844 wrote to memory of 4328 5844 msedge.exe 83 PID 5844 wrote to memory of 4328 5844 msedge.exe 83 PID 5844 wrote to memory of 3708 5844 msedge.exe 85 PID 5844 wrote to memory of 3708 5844 msedge.exe 85 PID 5844 wrote to memory of 5196 5844 msedge.exe 86 PID 5844 wrote to memory of 5196 5844 msedge.exe 86 PID 5844 wrote to memory of 5196 5844 msedge.exe 86 PID 5844 wrote to memory of 5256 5844 msedge.exe 87 PID 5844 wrote to memory of 5256 5844 msedge.exe 87 PID 5844 wrote to memory of 5256 5844 msedge.exe 87 PID 5844 wrote to memory of 5980 5844 msedge.exe 89 PID 5844 wrote to memory of 5980 5844 msedge.exe 89 PID 5844 wrote to memory of 5980 5844 msedge.exe 89 PID 5844 wrote to memory of 4124 5844 msedge.exe 90 PID 5844 wrote to memory of 2536 5844 msedge.exe 91 PID 5844 wrote to memory of 4124 5844 msedge.exe 90 PID 5844 wrote to memory of 2536 5844 msedge.exe 91 PID 5844 wrote to memory of 2536 5844 msedge.exe 91 PID 5844 wrote to memory of 5660 5844 msedge.exe 92 PID 5844 wrote to memory of 4240 5844 msedge.exe 93 PID 5844 wrote to memory of 5660 5844 msedge.exe 92 PID 5844 wrote to memory of 4240 5844 msedge.exe 93 PID 5844 wrote to memory of 2184 5844 msedge.exe 94 PID 5844 wrote to memory of 4076 5844 msedge.exe 95 PID 5844 wrote to memory of 5168 5844 msedge.exe 97 PID 4076 wrote to memory of 6116 4076 msedge.exe 98 PID 5844 wrote to memory of 1520 5844 msedge.exe 101 PID 5844 wrote to memory of 4788 5844 msedge.exe 102 PID 5844 wrote to memory of 4792 5844 msedge.exe 103 PID 5844 wrote to memory of 2136 5844 msedge.exe 104 PID 2136 wrote to memory of 2100 2136 msedge.exe 105 PID 2136 wrote to memory of 4688 2136 msedge.exe 106 PID 2136 wrote to memory of 4572 2136 msedge.exe 107 PID 2136 wrote to memory of 4688 2136 msedge.exe 106 PID 2136 wrote to memory of 4688 2136 msedge.exe 106 PID 2136 wrote to memory of 224 2136 msedge.exe 108 PID 2136 wrote to memory of 224 2136 msedge.exe 108 PID 2136 wrote to memory of 2120 2136 msedge.exe 111 PID 5380 wrote to memory of 2304 5380 windowsdesktop-runtime-10.0.8-win-x64.exe 115 PID 5380 wrote to memory of 3272 5380 windowsdesktop-runtime-10.0.8-win-x64.exe 116 PID 792 wrote to memory of 2860 792 windowsdesktop-runtime-10.0.8-win-x64.exe 119 PID 1580 wrote to memory of 6004 1580 msiexec.exe 121 PID 1580 wrote to memory of 3420 1580 msiexec.exe 122 PID 1580 wrote to memory of 5256 1580 msiexec.exe 123 PID 2860 wrote to memory of 2412 2860 windowsdesktop-runtime-10.0.8-win-x64.exe 124 PID 1580 wrote to memory of 5824 1580 msiexec.exe 125 PID 2136 wrote to memory of 444 2136 msedge.exe 126 PID 2136 wrote to memory of 3436 2136 msedge.exe 127 PID 2136 wrote to memory of 4440 2136 msedge.exe 128 PID 2136 wrote to memory of 2128 2136 msedge.exe 130 PID 2136 wrote to memory of 2128 2136 msedge.exe 130 PID 2136 wrote to memory of 1724 2136 msedge.exe 131 PID 2136 wrote to memory of 1724 2136 msedge.exe 131
Processes
-
C:\Users\Admin\AppData\Local\Temp\VLaunch.exe"C:\Users\Admin\AppData\Local\Temp\VLaunch.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?framework=Microsoft.NETCore.App&framework_version=10.0.0&arch=x64&rid=win-x64&os=win10&gui=true2⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5844 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2e0,0x304,0x7fff7cafc188,0x7fff7cafc194,0x7fff7cafc1a03⤵PID:5940
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1848,i,1322881702651889482,11225739701001467692,524288 --field-trial-handle=2132,i,5588880758436968963,17376376344890798517,262144 --variations-seed-version --mojo-platform-channel-handle=2164 /prefetch:113⤵
- Downloads MZ/PE file
- System Time Discovery
PID:3120
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1588,i,17053010993173590979,11910824785441683152,262144 --field-trial-handle=2132,i,5588880758436968963,17376376344890798517,262144 --variations-seed-version --mojo-platform-channel-handle=2128 /prefetch:23⤵PID:4328
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2492,i,5231342988688180135,2375983540657784730,524288 --field-trial-handle=2132,i,5588880758436968963,17376376344890798517,262144 --variations-seed-version --mojo-platform-channel-handle=2728 /prefetch:133⤵PID:3708
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3428,i,3470173593187662149,9309586146627203737,2097152 --field-trial-handle=2132,i,5588880758436968963,17376376344890798517,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:13⤵PID:5196
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,5684477849059309377,16080248368017929070,2097152 --field-trial-handle=2132,i,5588880758436968963,17376376344890798517,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:13⤵PID:5256
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4916,i,12400613717727944454,6195339164508479705,2097152 --field-trial-handle=2132,i,5588880758436968963,17376376344890798517,262144 --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:13⤵PID:5980
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5148,i,3959856770837635393,6358740377672678918,524288 --field-trial-handle=2132,i,5588880758436968963,17376376344890798517,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:143⤵PID:4124
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5184,i,11841453552111780653,10893686508063903807,2097152 --field-trial-handle=2132,i,5588880758436968963,17376376344890798517,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:13⤵PID:2536
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5796,i,138941235556785118,5270628805996419892,524288 --field-trial-handle=2132,i,5588880758436968963,17376376344890798517,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:143⤵PID:5660
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5800,i,5455286491844715551,13062607597419458258,524288 --field-trial-handle=2132,i,5588880758436968963,17376376344890798517,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:143⤵PID:4240
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6632,i,5306131062908040539,1530429108871275624,524288 --field-trial-handle=2132,i,5588880758436968963,17376376344890798517,262144 --variations-seed-version --mojo-platform-channel-handle=6644 /prefetch:143⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
PID:2184
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6636,i,14633033527475145947,8795629615422951783,524288 --field-trial-handle=2132,i,5588880758436968963,17376376344890798517,262144 --variations-seed-version --mojo-platform-channel-handle=6696 /prefetch:143⤵
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.execookie_exporter.exe --cookie-json=11004⤵PID:6116
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6736,i,13143922548611437461,13267449710765180296,524288 --field-trial-handle=2132,i,5588880758436968963,17376376344890798517,262144 --variations-seed-version --mojo-platform-channel-handle=6752 /prefetch:143⤵PID:5640
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6736,i,13143922548611437461,13267449710765180296,524288 --field-trial-handle=2132,i,5588880758436968963,17376376344890798517,262144 --variations-seed-version --mojo-platform-channel-handle=6752 /prefetch:143⤵PID:5168
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5848,i,2002277075591928317,13152300100145520929,524288 --field-trial-handle=2132,i,5588880758436968963,17376376344890798517,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:143⤵PID:1520
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5444,i,17165575631079639558,6772672295215108321,524288 --field-trial-handle=2132,i,5588880758436968963,17376376344890798517,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:143⤵PID:4788
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6752,i,2260912332998364552,5130962887894457023,524288 --field-trial-handle=2132,i,5588880758436968963,17376376344890798517,262144 --variations-seed-version --mojo-platform-channel-handle=6804 /prefetch:143⤵PID:4792
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x260,0x7fff7cafc188,0x7fff7cafc194,0x7fff7cafc1a04⤵PID:2100
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,5380031848212056788,17322100462683289602,262144 --field-trial-handle=2164,i,9642747953462489521,7788202058023981380,262144 --variations-seed-version --mojo-platform-channel-handle=2160 /prefetch:24⤵PID:4688
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1828,i,17308224311463479099,344367907901294033,524288 --field-trial-handle=2164,i,9642747953462489521,7788202058023981380,262144 --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:114⤵
- System Time Discovery
PID:4572
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2528,i,3312424056900743560,7642142140671520800,524288 --field-trial-handle=2164,i,9642747953462489521,7788202058023981380,262144 --variations-seed-version --mojo-platform-channel-handle=2536 /prefetch:134⤵PID:224
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4264,i,3172829965635207142,17635615891608952173,524288 --field-trial-handle=2164,i,9642747953462489521,7788202058023981380,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:144⤵PID:436
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4264,i,3172829965635207142,17635615891608952173,524288 --field-trial-handle=2164,i,9642747953462489521,7788202058023981380,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:144⤵PID:2120
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4452,i,3822239065739322700,17212374964323979461,524288 --field-trial-handle=2164,i,9642747953462489521,7788202058023981380,262144 --variations-seed-version --mojo-platform-channel-handle=4456 /prefetch:144⤵PID:444
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4448,i,535701926185788989,15986423427767531838,524288 --field-trial-handle=2164,i,9642747953462489521,7788202058023981380,262144 --variations-seed-version --mojo-platform-channel-handle=4836 /prefetch:144⤵PID:3436
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4280,i,5436336622034573574,2269084407289735368,524288 --field-trial-handle=2164,i,9642747953462489521,7788202058023981380,262144 --variations-seed-version --mojo-platform-channel-handle=4880 /prefetch:144⤵PID:4440
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4196,i,4334269595240969301,597111931796243810,524288 --field-trial-handle=2164,i,9642747953462489521,7788202058023981380,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:144⤵PID:2128
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4556,i,5054386914197353618,15337633779740254993,524288 --field-trial-handle=2164,i,9642747953462489521,7788202058023981380,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:144⤵PID:1724
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵PID:3620
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵PID:3240
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵PID:3644
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2484
-
C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.8-win-x64.exe"C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.8-win-x64.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5380 -
C:\Windows\TEMP\{6B3A3AC4-0DCA-40E4-AE64-ACC9BF810D40}\.ba\wixstdba.exe"C:\Windows\TEMP\{6B3A3AC4-0DCA-40E4-AE64-ACC9BF810D40}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{66242E77-6775-457A-A848-848F56E72B4E} {0C304232-8269-426E-9BEC-78420B712C62}2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
PID:2304
-
-
C:\Windows\TEMP\{6B3A3AC4-0DCA-40E4-AE64-ACC9BF810D40}\.be\windowsdesktop-runtime-10.0.8-win-x64.exe"C:\Windows\TEMP\{6B3A3AC4-0DCA-40E4-AE64-ACC9BF810D40}\.be\windowsdesktop-runtime-10.0.8-win-x64.exe" -q -burn.elevated BurnPipe.{DD07A53E-6C69-4783-ADB5-83D3A564DE90} {4030796E-B754-4049-8208-856AF5C12727} 53802⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3272
-
-
C:\ProgramData\Package Cache\{044C9B3D-6B2E-4F02-BA14-700EE8ECE6BF}\windowsdesktop-runtime-10.0.8-win-x64.exe"C:\ProgramData\Package Cache\{044C9B3D-6B2E-4F02-BA14-700EE8ECE6BF}\windowsdesktop-runtime-10.0.8-win-x64.exe" /burn.runonce1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:792 -
C:\ProgramData\Package Cache\{044C9B3D-6B2E-4F02-BA14-700EE8ECE6BF}\windowsdesktop-runtime-10.0.8-win-x64.exe"C:\ProgramData\Package Cache\{044C9B3D-6B2E-4F02-BA14-700EE8ECE6BF}\windowsdesktop-runtime-10.0.8-win-x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.8_(x64)_20260529164316.log"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Windows\TEMP\{F51E90EE-E33C-493F-94D6-4AA642E2F8E7}\.ba\wixstdba.exe"C:\Windows\TEMP\{F51E90EE-E33C-493F-94D6-4AA642E2F8E7}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{EEB84C29-6A5F-4B00-9A31-99A6CD1F9795} {21C7B377-6315-474D-860B-D3140FC011BD}3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2412
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 8883C974BA2E3A2FFB4DF560CB07CC772⤵
- Loads dropped DLL
PID:6004
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 716980F5AE7CD753CF597DC8E89D71982⤵
- Loads dropped DLL
PID:3420
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 22D61EA1E5E432F16258731AF0CCCC742⤵
- Loads dropped DLL
PID:5256
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 26B98C017A7DD57CD442A30B12C405332⤵
- Loads dropped DLL
PID:5824
-
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Modify Registry
1Subvert Trust Controls
1SIP and Trust Provider Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e58c801.rbs
- Size 11KB
- SHA256 716781cdfee2b424440613e46794b2fc4bda1ea208518d5ee70bf6038f8d859a
- MD5 53faac90fc77c06313c06d915c854662
- SHA1 0d3e084717226a1e84ede96b3e8f9ea6eb6e005f
- SHA512 7b7894b0d0e5b1d8277c276787a56bbf69f59c67c333b57c113e8b61c7cba4272e125c41e764742ae1adf42eda09b2761f989776419ae79899834a4002af38c5
- SSDEEP 192:q/fCxu29t15H9QY9CStk0Idk0nnEe0ZC+nepa:q/fCxu29t15HSwk9kG+F
- TLSH T1E6321081760182D3D9AB2B76DB4B2B243F72D2D98314635B44EDE0349F137C91FA96CA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e58c808.rbs
- Size 9KB
- SHA256 5f4022a17e099707091f6753f4cc83ed96ea5f2bec665c19e537c567aaf8f1a0
- MD5 cba31eae5f8f6da577b005557b03417d
- SHA1 f1711dcc89565f5384edf017cf0cd5dc7a1f86e5
- SHA512 23c17a775d8e524fc11f2aca60e44a5a6ef18af426c87267f80306b2af07053d07466131bdca88fd55b2991f794790f95d75d322a8ea1ca3d8f719c7cdd0f71e
- SSDEEP 96:zm0ggGqALbroXJoCbOMXqUoeD2EBCsTl1qUoeD2EBC6jEd/Y3Tl5YHmE5U76/5yO:qNqgPoeCvtJ0IFJ0YJE0SAgepK
- TLSH T188122402631089E2ECF22B39C7131B61377AF3D99304935B09DE95A46F5B7881F6D1DA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e58c80d.rbs
- Size 49KB
- SHA256 ae37a4f004d92d68e8cae05291970171ac5b00d969899fae3ca358b3ade5e593
- MD5 607e9944c649b01041a1c84cddcd7ccd
- SHA1 2d529495f114ff9e129c61237e0457d498653d1f
- SHA512 c9a06a2c0a47955ec7ade5b08266a0c417bf47ae90569c2465ef869e576ea79feb75125f0735a06fe7ab3e5877b657b8be3c602f1259e25f764364f87d086af2
- SSDEEP 1536:MQi6szlPryWnXHwngQl2UmjItQbHS5RW4069EYj6sgaSbixaDWZRKTyKncCxDHoh:NrjE8
- TLSH T1D633DF22DB10C2EAEA33B9647371DE09B335D99327495CAD21ED4574DD82BAC5FAC0C8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e58c812.rbs
- Size 71KB
- SHA256 5dd52e9307df00ab5cee7bf3077b115e1adfda5a1a1ec315c1dbc5747e3ad13b
- MD5 2da2341c1b5ad444e98678387b23d1dc
- SHA1 d2c23cb46609842ee694405a26e315c2e268edab
- SHA512 144cfd40025dcf97602f1238076a1b1fff0e31efa0af040056173077ad564e6e89171bbcbf99720bbe65ceda4852b40de9bb340680d081453e27dbeeaa181bc7
- SSDEEP 1536:iv/IvioxFM23zr18Dww5FbH5nDsWsIWuMbJw3Fq6gZQLa1gQxT5+vXG3vHaUcG6h:e4byfOeaia6qAySwKkbwH
- TLSH T1DF63005A6600C2D1EA373E58337BEA099F54AC6A27488D2F19C5027BDDD1AC76F7C8C1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\ThirdPartyNotices.txt
- Size 77KB
- SHA256 deb4427a295e1ed474b0d81c5a0d972c1b550b9a715cda939cdfa9236b1b418f
- MD5 0d8867a25ba926e6e40cd52ab3536b5c
- SHA1 89390dc8b8318d0bfef1c6a2fb4783537e28a465
- SHA512 317ca335405274f4f91b173651ca2826760acb5ba5cf41aff51adc55c2cda9059fb268333665f13f62fa48119e55a303720a780dd58d28dd9967db4c88407d61
- SSDEEP 1536:HA9jHwsGfgg39/zwgAVkguQxrDjugtSEGepkWvrpX7anuqdLSVnfiStPq+3LefrL:HA97w/ogz1AVxuMjHtSFULryLOgrGWm+
- TLSH T17773A45F7E45077319E2C3916569A8C5F22FA02E3B6B2A44346EF248133B42DD6FF858
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 163KB
- SHA256 cbb1746f9b08dd9825129d451d99869e84e9024e62c804dede22c9fb61e0291d
- MD5 b1f5c9c9b65311bd825db803ce074f6f
- SHA1 90cb0a1406e2244cc447f627a7a0c841c8d5a29b
- SHA512 6d9ced782625334d0d67f926e83185b184a97b9658d5e643ebd661d9ddf1fd02aee22bfe78f8be8387e3f27e2a34a12b1afdd9d173089bb8bbeeba8e299270c5
- SSDEEP 3072:dGgPfwruvTSBbQ/vp4SbDqIG/Ik7l55wKPZGgX:dGvrubgbQJDvqIgt9B
- TLSH T1F9F3071AD65811AAD16E9575CB528941BB337C668BE0E3CB13C0F8BE0F726905EF9703
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
- Size 1024KB
- SHA256 1c02e2feba3b2af3c045d1ed01f8a67e0923f7e357b32c434e567eef6aac4138
- MD5 f05b0294ae4949feed0706bc80fa6418
- SHA1 346bb7d2d99251c193652ad4ae7ef2964565b98d
- SHA512 348366e162f3a037e74d0e9ff422ba7ca3e14c2b170f50bab2a4b88b29a572028e56965c332bc63cbe89de1a3467c215893ecf3cac514d786ec7ea30c08bcc05
- SSDEEP 12:bHiUXhV0xosfxCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:blRqxosfxWMk8xVZ4YWI30otWn
- TLSH T139257D85B34494FFC8C35A7189BD17903774F6DE5F42835B6A377A0E2E671D44B48220
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 90371bf7f2d9f3b60c0aa66ed89740cd725604cc541112971bd392e8746018f0
- MD5 a9d241f865f7d582346ece871b98ee14
- SHA1 c59a959f2a8673df7c09862b8f91a9e9492ec3cf
- SHA512 4822e1484423dfa2530e9a541260d4dcddb675339b2e5fb22cf50c15d65cd0b147c7d94ff11a6d6523e90406c9ad88e5919ccc3fc5ec3b74cbfa28567977506e
- TLSH T1F3D01266374AB001E76D8230E4C2C311266654E038864A01B214C81D99A41D86293186
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 ef8d4fb1554d5f8aaf2bc1e056bd8b54386e5eb40d675c6c8dc9d44c47827cff
- MD5 7b65052e96535ffc4b1e3b9c589b2fb0
- SHA1 8a2334e9c6b740a4f086cfd9160950e186e1fbdd
- SHA512 a406de2aada99dd0f73d2fa4f242d57da6674c5d34a76fc187afbb1e63ea477798c2a3d5229a1807f368f1538a0a7c840a91da7a4b403e477b9fe49d6c8b1831
- TLSH T1DDD023E86757F4D2D13C703E69D543013BDC84E1150212143B199C1D8CF11DED4D2CC5
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 61c7d040bd6aae5fdb176c39cd067cbde50b46941cbbdb7321baf2c1cc0e2235
- MD5 d8ea281a329255c754bf70b15717e967
- SHA1 74c90ea6ef26c607c88c77a963ed0fff7cca6a14
- SHA512 02dbf778a32fb72135451706a94c18de6158d2616adbdad287c2f8ee9869edb3efaa77d30d5e99041615a8a00c51ce58275c9da2db385fff5fffdd63f0ee7c33
- TLSH T12DD023EC3347A492C27C743B2DC9C3463BDC9CE0645115601B5A780D4DE159DD4A6455
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 b24846f4bb01e57dd47994ee8ca33e14a6a356938971c33205ed76a4fe3c7b61
- MD5 2415c177850265ec333bf407bedd2c4b
- SHA1 2ccfbe660996437603bf4e0b70309310c3095994
- SHA512 1a616d299248ea7424c92347e2568121b74d992540a7c2809c47f5e8113710d7965935a30c55d53ceef337cee1ae1bdbacfc42ed7e68109e206d0f729f22be4f
- TLSH T1E4D012663B4AB001E7698230E4C2C311267650E038864A01B254C81D99E41D86693186
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
- Size 649B
- SHA256 74816a90aa10dbd6720178d048bc3ad1e5548527e2a95e0fd7c37cda7a4fff5a
- MD5 4301fa0e4a99fe0ece862e464343df40
- SHA1 3a7e65b361da7866775d562385980b15a6614a6d
- SHA512 40a711e5c2c97782dec89f0dcbc61006b386d90502c5c0b3331527aad22acbc7423aa1f82ccf1e1407325f2a0ec9e0381f62ae96e112db202461b3c8653f97e1
- TLSH T11BF02DF5D821EC2B08FD0B2D34945B0AE75513272B40895F3B3C830C8FB563B459591C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
- Size 44KB
- SHA256 d6167a8fcce9bc93c4f87a6787822737edbade8e04a99ac37302107406c131ac
- MD5 3a4ec480368da240f60a381a480439d1
- SHA1 b9f146101523147237b604bd92821639133fe95d
- SHA512 5a5f73e53992e0900246edc3bacee9545a491982ac9b75f6eef32498f1716f417da32fb97b38596d7fc01c431384d0a650fcda8f64c3bf17be56f2003a33f848
- SSDEEP 384:3jlCRAzKUCRRudpyy4dsJ6NjjzCvM1fyXwFKoJ:ZPNCRWpytdxvz7/FH
- TLSH T1C513917D31011C0EEAE37DBD294B4EB16BFDF822D6C1432773B5B616032AB4A991E901
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
- Size 264KB
- SHA256 b8f1ab6051d31583cf068a4d10e49d11f16b9b79d71c0b49f4cf3446df964fdd
- MD5 ac618a987139bfbbc6c27a8ce4489fa2
- SHA1 4f05638fbe5e0e676995b274184c230115b51090
- SHA512 9e7643150fc5dd79a8330e2964cf5d3092b1e33d4e4aaa55097c036fb53351273a6fa806d5ab9c3771a12ffd91526ccb07b5790053fce7e2c177704d9073d1e4
- SSDEEP 3072:gNL/zL/2sx/UZ0L/cL/hkb7n/eUI501B8Tc:gNL/zL/Hx/UeL/cL/hQLGL03
- TLSH T14F4470FB5951A00BCFA812F5D3033A3DD17B015E2DD1E9E9E67C4C852825F22B6BDA84
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
- Size 1.0MB
- SHA256 35d0c34a34f440912f65bf015d07fe6e60ce6934d6d17b35c6c1487495c9b34c
- MD5 56efedd51fe51a57a8ec788db0398f97
- SHA1 0e5082a87b13f4939cadbd0f2fd056b811cbef62
- SHA512 7dc5f0e4ce8164d0af007f1a8f9207339140c619d95a9a6a5d53b1df47c04583c9b6cb7ee74bba5cad9a63c12016408b9e37db8b589400ebe2f3a5b48ae95619
- SSDEEP 3072:ivgg65mR3uEfiHCnZFEBcpDr/UolzE2yrZzjb:i4g65LEf5pDr/xlsZzjb
- TLSH T1562518EECB682C82CB6B877470E0D9077E712183B68CC0D39944C5D997D6B8576E82BD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
- Size 8.0MB
- SHA256 5024f7d89b9428017829c46c8e20af95caa7afdd6078e3e62e809bbc22a8a352
- MD5 9da3433607a4ca07e05e2113d402497a
- SHA1 ec8f47bbbd322bf827413328f70ff1fdbe08cc40
- SHA512 adad9859f7d2b19de087bda4179481875e2fe1c2cbdcea16412de63eac9169e64abeccc44297e8fd0996bc3d2df7340dff65e70b67bdaef008289f1bc77f5364
- SSDEEP 24576:Vwb6olBm8YHLJycM/mewHJEB7b6WzkBGSMAoOqq1k1Y+L7qTNjeW7Qo8118Sfi:Vwe8YHLZTpEsW2GS9oOZe1BLqJ0dxq
- TLSH T12C867DEDCA6898C3CD639970B1F0E9477C7463C3F594C1D6889CC184026BBC5BBAB669
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 2KB
- SHA256 c9266ef686ceffe1a0ab9eead35d52aa624a6e7fe4cc1e755c527bad94fe8293
- MD5 c0f0d06970d1800745dcf8599f10d6bb
- SHA1 7d37250f64805d8c4c55ac9c8f545bb99f85b287
- SHA512 6121116229f3dc9a0d1a869bc192a5d27d1aa4ea28deb9c121b128be1fa627054789f6b170988a5c28bbe771b7011767cb3d3b3dfe7a7189d6d678de94394e6b
- TLSH T17B5151088A870567F7123EF1B1C00BC473FD35641F5AAE428A64F976667BB2987E474C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe589fd5.TMP
- Size 2KB
- SHA256 48e8abbfdf21d3a48770c5c4d686b6230bc44e63badf198538f75d59980a5ceb
- MD5 eefc414c4524bbd62285932bb7e82ddd
- SHA1 9112a6ad5e3efd565299dc3288942b7c5ede6032
- SHA512 ac02af15a9dcb93b24b73f225e0e484dc3bd9374509a83a22cb3b4107d90a01d758f83f96ee1546dafd021a27a501b717ea770e25b163fb18decfdee1bb211c9
- TLSH T1335190098A8B0573F7423AF0B1C053C473FC71541D5B2E428994F9B6A46AB3A8BF0388
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnWebGPUCache\data_1
- Size 264KB
- SHA256 75082e602e510f38d5d5514aae56a77bacb57896467ff2ed98006ba90fdf8179
- MD5 dddb5499dc15d3b502958caeedb81b9b
- SHA1 ce034c760774c9e8ee16bf09daa528feb123acf5
- SHA512 2d747c436d79d1e76d2485df5602c357bf331500f36b5479b48158ac132fe1abd775ec1b7f5b30af3dd1f3a0872aba47058ea18d3bb338aea524c7db1d865d0f
- SSDEEP 3:MsEllllkEthXllkl2zEklkp:/M/xT02znkp
- TLSH T11F4404047FC10405C54010304011C3500370DC500D355753355734177FC75C00D00100
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
- Size 2B
- SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
- MD5 99914b932bd37a50b983c5e7c90ae93b
- SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
- SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
- Size 346B
- SHA256 2dc3a732ed0b07b0b476349afa4db536e383c172729552df71c92e8ede650c09
- MD5 b513da4c46ca4027066d86ee78925b3e
- SHA1 fa3ab910c68fbccf3470dd282d8dd3a4b561fa51
- SHA512 7db19e2027af1d6f4671258bef4e02855514edd5b6569fb1df8e231b9a4e6c3c03225aaa4d8a4dea5bd675af0daad307797f58bf057cbbb2a7eec8ce42ee3f04
- TLSH T10FE09AA8A4CAC12E752038D762386F5C82C13482D6C9AE033700CCC07682295EB86A8A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db
- Size 32KB
- SHA256 d8461165860de4be6b5a6abd219b209eea7b1c62cc9666fa391ee62e8e9b2290
- MD5 6f4cea0080122c5ae3b3bab2b208d98c
- SHA1 d934c26a485c12a90e5900be10d6fc2a30c23fd7
- SHA512 baedc23de3704dc16ffb741c9aa573801c2c05d7fe6fc7719100ba87d52e04675076be89c97e0669aeee33a1becc78551076432ac5dfd59c17c7d7d04eddccfb
- SSDEEP 24:TLAga0Zb7OaIbz+UOxUDDNzWjJ0npnyX7y+jzW5Lt7K5fKFtICqYpM:Tyi+7f+UZD4jJ/BHWxlCKFOCTpM
- TLSH T135E2CE4C3B11F511C8ED733DB0C2C6E06EBC697C864EB1B0623C98769D52661F59E14A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
- Size 319B
- SHA256 61e0e8356d55a3eabb3b2d98dd0331ff7720318b2d19250ac38e15969620a348
- MD5 bb0fd92b139ffed2cdafd1c51d4568a3
- SHA1 77fb4209cd8ee66366c0eba6d25fa96b29aacaba
- SHA512 eeb1cd18ccb0addfc2da55a91b2898e9461f306c883ff4befcd3bea3b8b0bf56ff8bcc390541d44aae02efdf245012d0c7f4babcc2b693cb3ccf3b7494a41621
- TLSH T17DE0869855DAD139D0557CE3837CA31CC3D23487A6C83D022709CC817542655EEEA684
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
- Size 20KB
- SHA256 f52651e143024f7effdd66aa3839ad0c2785f866f0c61ca8a2dd6da8ffeca23d
- MD5 0b8493e0b8632a988af0fafda6c366a3
- SHA1 d6e8cd7130d67d2c5eed7e2b8e1398115415ed92
- SHA512 d5a5a4fe369ca4a3126a19b96e36511cb25c168d36bb15678d9c7ecb3fce1a0f6f18d63d57de297141b29cbce76fd6102d66a8140c0533ed4e5823dfb46e9de9
- SSDEEP 96:6BCx1vW1iIOQXqpIgwW184QXq6ouXl87A307BYT+QTvW1FIOQXqCIg1W1k4QXq54:waEuJj7A307BixiZq
- TLSH T1EC926307EF70B403DF201A77336A5435DA7B911ABF8BDEC43CA14450D9B3697A0623AA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
- Size 204KB
- SHA256 5bc2ad9b90ac13fcc7f55113978da22675e292465c09038b677508356d882fee
- MD5 4dfa1404b3719d249cc137ec1e8edeba
- SHA1 3567ce40d205004e66f0994e88d5848dedb1d8ff
- SHA512 5947e6f69e462852472cd64f4fefff858986030dabf40ca1a203e301fe86c7b6ac452c3a001362afb7f227b386a8b071f6aefccd366f2c9038935a7561399c6f
- SSDEEP 192:GRgd750+G83uxXBBK31GkSJDA9EJH7DNspUM:Igl5a83uFBBQ1GkS9Ak7DNspUM
- TLSH T1EA14785F9F302612CE7851365AFB95A3DDAEF43F8792A6C96C600460CDE3B53901C4AE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
- Size 106KB
- SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
- MD5 25dca813dd764f2197142ef84bc5ce66
- SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
- SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
- SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
- TLSH T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
- Size 712B
- SHA256 7cd9b317e83aa067c7c92eab3eec9c12af7759bd12104d94fd5f9cddb322745b
- MD5 eeb85e6fb9edb5f254a63bb4efd43867
- SHA1 074741aab7b9d3402143e740346546d1213dc1f3
- SHA512 cd00bc1f078b28e509dc509f05e6022d9cbf8caa932d9ad24d00405864ce4967589133936e45ab07e77168ee7c3f4fdcf946d291ecd39bcca90c1fc49ad12618
- TLSH T14401D676D018D423FB013EF20B44F9647757E76B7E81E7CCC48AE0488D672E96597066
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
- Size 334B
- SHA256 f2eff7f03743f29c750d526d1d18cf3cc71249f463dfd1725a592ff84ed66a56
- MD5 2e951c54c9fe6106a7ad45afaf2bb548
- SHA1 725e299a47579902ff56b6cfd1b4aebceafb50e9
- SHA512 e85884a69d14ef6351cef2ba8328987c2d8ace1d0e1d0a45cf061367de9acd5d61718c6d0e2e042e228e909e81de710cc4d4dae1ec5e3062461c0bf8bb424150
- TLSH T17EE0206845DEC16DB30428DB433CB70CC3F1354BEAC87E816B04DC45B446004AFC61C5
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
- Size 20KB
- SHA256 40b40982973c2b2071377c57e4c77353ac83079fc51455b75601fa062aa2d5e7
- MD5 440b83b85c506cfa0f03d36220c64ad3
- SHA1 9b08c2761eead168e728ff6de3f1b9e3d3bce5aa
- SHA512 14d8bc27f7396bf38ade638be83ba8d701286c02210b4e54e423d8356d9f3ea7424e22de9ecb90ac461d70224798d52956815f5ce074aa20c7ed432625591f52
- SSDEEP 96:iSeMatUaA/4923rkXIKDVAgtDS1uASJG6zQkrfPlr:iSLaSa23WpLnHJF
- TLSH T1C192770EEF242123C6D217369EE0CA213E6C120BA713D7855564E0B25D67BEEF51F179
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
- Size 3KB
- SHA256 3ec0287ac467c6a2d2a9b234484c9e8707ebf7ce0296638c3449703c6a68ca05
- MD5 825b98feb6d508c8176b4e3da3426c17
- SHA1 a840ffa2d8b284406186fe39e2f3e5b13999684c
- SHA512 8ee4158012a58778e7413930dece6799f0463a1e66fed153a47f56e490a7760ed61970c5106b0b30d741bf55a79b373b90dae638bcfa53935c3d2cfaf38be8dc
- TLSH T1DD61ADF783B4856ECA1195F0AA18AE2FDF2D0615431C3C6A89E0AE27E3E3471E14165F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
- Size 3KB
- SHA256 f670e81c3919f4d449ae1ba2613a960e5d4ff75978701208a37408db329bf443
- MD5 2813c7d9fa092fc7d41ceedb5030cc56
- SHA1 d9691799124dc809cbbe577370e8ba7edac2d9f4
- SHA512 59e47772e04ed4baac747f0e515a3e6abccf8e21cd8dbc3ede6ecefa3f58eeca423e655c12afc8ec68d776c47df14b4b03801d6e80f0be1b529658aa0a5d5aaf
- TLSH T10B61ADF783F4856ECA1195F0AA18AE2FDF2D0555431C3C6A89E0AE27E3E3471E04165F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL
- Size 36KB
- SHA256 4424bb8388718bfc2121e819d09824a8daf2b304359efdb0d32332e4547c98a5
- MD5 670640dd5221f5cb681eac20f465a476
- SHA1 c213f6ec296477d8f114bc2b31580daf9d994524
- SHA512 fe1bf8276970b3439e2a70aa22c3556e69cea27f12c0cc6958fcd78f519915b34f323a9116b6e471389537b2d045156457047d32bb8e6f86dc2a18062cc07fb5
- SSDEEP 96:+IEumQv8m1ccnvS6QRdsgt/Sf5nFXWP8Oi4g:+IEumQv8m1ccnvS6QdUWu
- TLSH T172F2CDFA07236106D98444F0E4009F8FAF16010B47B6B6EC76D447E3F7A21E2B6B9796
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
- Size 40B
- SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
- MD5 20d4b8fa017a12a108c87f540836e250
- SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
- SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
- Size 858B
- SHA256 1a94fed94c91bb4771deb339bbf899c861e196669ba8a86620ccbc807934feac
- MD5 2f4337d4453b28b5bf279a3b5510c60d
- SHA1 ccdb1c55cafb1ce55ccce8cb4d38885625b04aee
- SHA512 1d6b52ae966768707cb6612d03fcfd65f5630d5c928154f075de67196415d7a4b6291fe2ae5c19954afefa38c40d22a1157f36f836b3d7a6fc8056b06960baa5
- TLSH T19E11666BC17FB57BA07848BF1D58BC093AB6A435419368E8CA57823FB0414F7273101A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 15KB
- SHA256 1fb5c7541d6285549b8893f668df5f9214fc9c90c565e8ed095c8575bee6a182
- MD5 a34f71e44ec10b4ff43a0d7f334b1ee5
- SHA1 32e3530c178140d48bb8d1c11aa6237004a0d0f9
- SHA512 88e2f94f83357c045d7a3669f12dc87d955389c51bb0c41888787583c089137630f53f83aaa12e5c44eed72a8823ed045dde94a173786c1434a3f94345372a0e
- SSDEEP 192:sxZGGRPyMqZjK1Ml8MgS/fZsL+tKQ7PgYsw0Yzodp5D/W6+WNro2/Y0ZGn0DIgjc:sxZVs4S/fZsL+tV7orw0rl/bV/58UjJm
- TLSH T1C6620A16AA34A977CCDBD219FA557B53D7F91563D2800E449AFC8B0C04E67ED221382F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 16KB
- SHA256 b3d8b94cb6015b456372437a9bbaf656c18a3f52d34e8cad7e9f987be07fa61c
- MD5 33121cf1be6508aae942e8bd69c6f5a3
- SHA1 1bfbee0ed004e87c41d95389e28d41b9a9a57859
- SHA512 650208728f3d9ef8953f66a573c01e3d62821fe2fe66ca0d767be1d953e6722bec06687fefeec9f4ac4893c200559f7ea60c774251326771a5b22faf604b0e71
- SSDEEP 384:sxZNsHS/fZs6Wvr+wV7orn0rl/bz/5KFbHJV:slUS/fXYr+wxB/bL5Kp
- TLSH T1A972E816AA34A97BCCDBD219FA557B53D7F91523D2804E449AFC8B0C04E67ED221382F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
- Size 37KB
- SHA256 23e6c8b0d93c508f7feac261dfcbd9d9ef1ae93bdd4587258a7d057f30dd386c
- MD5 72c351503bc2838669b2af9ea979283c
- SHA1 c874fcd28ab656b8e38f032e535cddeaeb8e0694
- SHA512 b1d00a1bde300fbc825305f9923b2ef4ee7a406bbdbc638e797a411e2ccbff49e98a1915fdd7e6f56b3adf8b941824ec9bb3f47b6a2f84e9788822d07115fd4a
- SSDEEP 768:XwZh38Dv2C47pLuLnZFWRm6GQFm8F1+UoAYDCx9Tuqh0VfUC9xbog/OV34Gq9Llw:XwZh38Dv2CkEnZFWRm6GQFmu1jaK4GqQ
- TLSH T1BA031B3B280CCB7E4F844E9CED267F8A6DE8028B96988D5447FA494C03C66EF55174DB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
- Size 36KB
- SHA256 f5867cd1eef6da1d2fb99a3f72dfb71e9c5c1724fc66fc43efeef65f8551e3ce
- MD5 cefaccc4612a3a3d869192c7d175551b
- SHA1 19deffa27e748614416639a7eda946309647f963
- SHA512 b2f7a66643856c4fb35f1d5fb5620f1ebc29591efba79b342b8c8f3c83c71de25a9a5082a7ae16d7fd1a497fa74f1e35796a6375f18c4e9a3c86e82e795543fb
- SSDEEP 768:XwZh38Dv2S47pLuLnZFWRm6GQFm8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3XGq9LlH:XwZh38Dv2SkEnZFWRm6GQFmu1jaKXGqn
- TLSH T1A8030A3B280CCB7E4F844E9CED267F8A6EE8028B56988D5447FA494C02C66EF55174DB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
- Size 338B
- SHA256 b2236918ac51750bd18854eb55cb3b062d269a807762bdb0b9b44383717601a8
- MD5 a72d4d0cf9ef6145cfb02e245f08ada4
- SHA1 093719fc9548769f1702def37a2c7044655f0bc2
- SHA512 050b597acaec17260e18b9866c9f46ee6691f3bff295d8c18b81b7426634c678436e8b1105100719ba607c8bcce3fa56348b6d21dc03b1e06c5c14554c7e46e4
- TLSH T176E0DF1816CAD179B01524D30628E30CE2E97847D3C83D022F08CC856147504BA96180
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
- Size 112B
- SHA256 83160baf7a42f6cbf61e0aa51fe00df88af6f4d500b219f1e470219911ef2946
- MD5 77fd1f8cb9952f52ccc523458110bc42
- SHA1 050bf199beddf385e110f29d25b9402f15c27d9e
- SHA512 f7115d74755c90ddde34ceb8631d6fcae9e3c87e16b43ddb3bdd7b048bb71113207311c81b887cf4d2dd44848dc306a75f01ad2236955ec3d98218a937054951
- TLSH T1C9B01286BF60511BCC4BCC770F905BA2A720F09251404407A8A4CE115D1D778AD020C8
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
- Size 350B
- SHA256 5e686b082d04b3e3ba3e15584b7c157c90024b8dc0239cb353b7450e2e66a137
- MD5 d80889eadc6d9a1a6a84915eb044c169
- SHA1 dd56f14bc076f27fe60443d9f575f9738eed61ff
- SHA512 1d517bc69a733b8894b5626ed9258413ea77967ebaa4af2bdb87077a328ddf558f67f44f123957e581b95dd5928cdde58378c7f02dbd2a3c8f7e46fd315a07a1
- TLSH T1C6E0486C3ADED2ABA58724DB8368F71CC1E37407D7C82D11BF08E95172071447797545
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
- Size 326B
- SHA256 003ad486e53445f67027a9d9d01d5227fc0a57acc750ce2a1d4384be4651c8e4
- MD5 c1ea0bd7b925d78cd3a130c37861bdf5
- SHA1 7f961758e4fecff636415d3da94073a449ad422a
- SHA512 d11d24291717e1eefdc65bf0a81508b060bcddc6bd0470c7fd7a79351298749e2c1a1de54d94d99f3ce6146f48dcdf7c7bd43394eb44d62a0c357a95b0c27616
- TLSH T173E0867C45DED239950464D3437CE71CC2F17C0B97C83F5A6B0CC881B102148BBEA589
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
- Size 23KB
- SHA256 e0127cdfe501dd1eee78d6efa15eb4bf6a62cdc511a2fd46c5c51f49a26c22a5
- MD5 6736e00fb42ea2c91ce5f20046d3e329
- SHA1 9efe4c8a2bd61ae184a2032634a10290ba336e45
- SHA512 e6f77abe04c80fb5b37d1a393ceff5b785b876a9bc59fe86369f0ff06889537f800766f6d8be558bd15e44b22db30820a5b2018fa36dd651050375c6843d7728
- SSDEEP 192:cFkbIH791le1K77LTl56jbSp+bv+TVCNnCtTq/tVZ3KjlnrBa:ctGj+BCNC5qFVpKxn1a
- TLSH T17FB28A1632BA02033C3DB91D87A597375A42B2633058E93B7BE954B60E67E214DFD8CD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
- Size 26KB
- SHA256 de89c8e1af59b64594b7983128648348562e34f26a7fedfa6f0b6834cef238bd
- MD5 298aac4c839e5a1e4fcf3cce2ddbeeb2
- SHA1 acc3807adb1d0eaa553a0a2fa0d2a5c43a899032
- SHA512 c491657c42e123c22abca396493f597fc3336f7c9a967fb487b3e7b88eab633f6e2f373db0a0e26ea4649702d5166ecc7f8329e215cacd056abf77fcaf6f9a86
- SSDEEP 192:cFkbIH791le1K77LTl56jbSp+bv+TVCNnCtTq/tVZ3KjlnrBPTZg9:ctGj+BCNC5qFVpKxn1PFC
- TLSH T17CC2A91632BA02023C3D791C87A5973B5A42B1A33058E93B7BE954B60E67E214DFD9CD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
- Size 224KB
- SHA256 a528f432a2346e3fd40c03ad40b19cdc36e68a6942fa8ee8f7f7086abf544441
- MD5 9b86a034f252a9d2078dacd023c7d67b
- SHA1 450b466377fc87e1aa040599d3f31a037062ac27
- SHA512 75a35cd96199545675a9dad3012f93a0061f5fca9de61e3636c3afd518134675ac95d97781041efb948f1788d01c0430c24f0ab911d08316718d4a00bf2dcf29
- SSDEEP 192:FvoWKjtfT8wRJQnGL11HLfzNSivuvTNN+u/egddCeyv/hVRdbsCEV:axtfQ0JQn6lLfzAivuvBN+wtP2s
- TLSH T17724630A7B747001DDE7E9725CB080771E3CB16ECF22A6915DA254698DB2853A23D8FF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a4aa029d-5bac-4249-8b38-45c5dcf102db.tmp
- Size 15KB
- SHA256 f67d3cc5b1676d7e69dec380048242d34c273e6b611c845260d9436fd77cd1d6
- MD5 89dfcf9e3571987928e6ad397827f78b
- SHA1 8aba483da0b0f0d43c12567af396b9ec8219575a
- SHA512 15b64f1606921896f8f654acd27e687596b50aa999d09bbe71f0d13d5312b0663d31f97fa1d44a6f716e9fae96841b5a497edd4be51f26c0925431f217ebe784
- SSDEEP 192:sxZGCRPyMqZjK1Ml8MHS/fZsL+tKQ7PgYsW0Yzodp5D/W6+WNro2/Y0Z4k0DIg5x:sxZNs/S/fZsL+tV7orW0rl/bV/5nUoJm
- TLSH T1D1720A16A634A97BCCDBD209FA557B53D7F91563D2800E449AFC8B0C04E67ED221382F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json
- Size 13KB
- SHA256 f9e4da319fe1f5a7d497c452421f4648a24ec7588f309ebea0f0cd61a6251eef
- MD5 256c40bace492c4e28451ce149d2f9ac
- SHA1 b48b0eaf986b9efc91d5c8dd394dccb6d82e2adc
- SHA512 33b38d1ced015798722180fc8c8ce6daedb18cd5d0e4b3db27d6176c13cf3ccb1bd79f2e68ca390d6eb43ac508c29067e8f1a3ee9f0167cabe37ebbddf6b0ec0
- SSDEEP 384:l7BJeojewj9mg1IZyvASoIL5QJwTcoEnE0YU/VwTcoEnE0GU58:l7BJeojewjcg1IZyvASos5FEnE0YREnA
- TLSH T12452007AD2211C7719B8636858BC4692F524137F8281C81F78BC656C8F7FA79A089FDC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
- Size 17KB
- SHA256 c128aba3ba95d7f5acaf0f9fa3f0c85a45cbf99d4dc41c1aa23fa1d2299c3f3c
- MD5 dd570f881bd6312620f98788ab4fd556
- SHA1 ccfbb88adf47742be9b799588d0361e083ec227b
- SHA512 2976fe5f26b45df2276bf215951858765cd79fe41fd00f31152d86dcb0f18c01709dac21892aabbcd73a1797e0e5ade668760d26f2cfb2ae0ebcc1c42ad766c9
- SSDEEP 192:HeOQjAsvlrqxrsj5RLhFCA1BhK4IqbdKTjrKTjMQGIIIxbJMIMrFQYcY0esW:FQ8sNis/rrCjgjMQGIIIxbJMIMxQBmj
- TLSH T135828256AB411773C51D6F7302A9C7519BD2DC830962A3AC3470684F9CF3A67C2C56FA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
- Size 319B
- SHA256 522e1bc14cf02c55c2538d8c2cf13b1c9f12ee2db3ee25427b0a6efba6d1c749
- MD5 73ea7758725fceed1cce8adcbd9ae3f3
- SHA1 380c2c112ec0f68c568c7cb8a294460f02f8b2e3
- SHA512 498b292c98e897213ff2b0f0af90a1138c37ae19b782e9ae9e1133c8ca3ce5e81bf7e8230836143eac30469466fae54e7f813e4f49f751a8830a9e1ca22d732a
- TLSH T1DFE08655EDDED16EE11424D70678A35CD3D33D07EAC83D462F08C885B942144FAEB185
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
- Size 1KB
- SHA256 f0133e103c624453a6732ca95b9e4ca2f7f15b16699444b7a52ac89a1f8d39a6
- MD5 e5d24f0158b3a0d449a3fa8ebf05718c
- SHA1 21d8bc6c2ed1347dbd571b7c844a38efc30448d8
- SHA512 cbc932deef35ae9882f8f437098ac3547b115db9f046a19c7f5c0310bee4ae384b8123d1b4ded81cb4d73483133c0c7ea549f39f1a467681b860fc53a0e38625
- TLSH T1C1216056F321C149E14E8A7EA12AAB361328E8029FFCED0F447920256D76F015E8F6E5
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
- Size 337B
- SHA256 cf3f24c5874cc36162c36842e15e6786a3a21595a90b7b79899c03e98bb70006
- MD5 6b6b693d1615187a38f203cadd535e9c
- SHA1 841c95334522a6df7cbbcc77bb4d8a726e90d236
- SHA512 92af91a6a5e0015a71a3bc05b5a8cee5a9f44ff7e1aadadd38388e229788784ebf4499452e3496fcfae8b2b0942b981ae69da1addf207d2070ff4e86c7a81bdd
- TLSH T126E04F54E8DAD1AF911424E30678E35CD2D33C47EAC83E062F08CC85B942145BAAB185
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
- Size 264KB
- SHA256 6bead9068df822517cb5224e90f83693cb1831a04ffd7d44de9b6840a5cb0fc1
- MD5 4f7fc9f4d7949bcc1c57f0d709a6afc8
- SHA1 845cd80e22364b101413872980ef6bb3f0d8eadb
- SHA512 545241ee77f13654b1bc240063fe8b3a310ffdcaab7e14c123e6238db3ed2dd7a0fa4babb2f265e2e1c8b172a8e5b47436bd8997e5d51c5cbb0ca47752b7b145
- SSDEEP 3:MsEllllkEthXllkl2zEelo:/M/xT02zNo
- TLSH T14844040C7FC73507C51C15304011C3500370DC110D1757C33DD104135FC75504C00103
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser
- Size 120B
- SHA256 9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4
- MD5 a397e5983d4a1619e36143b4d804b870
- SHA1 aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4
- SHA512 4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816
- TLSH T1E0B012203BF9062CF3F74D00AA73AA3428BFF4080A14811D505102080C33E19C478FA3
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
- Size 14B
- SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
- MD5 8297da058a737611abcc3a0ede9ffc24
- SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
- SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 24KB
- SHA256 f7b1b67585c4047e8d24211a12e1d9bcca7c173320461da40c1e97aeb1f8c2aa
- MD5 e6fa3d02d6198714d09549b69c362c0c
- SHA1 8933f82a634acba26a6fdb2fdc2f3ada7f292603
- SHA512 83af2f7dfecc3ed94457403124734d39f51fc2744a63ce0438e2e6071b16c587886435de375b6ee55097afbf2fab9a57f99b8518ff880c2ec025b45aa2df5580
- SSDEEP 384:nwiF9CcmyWCs38NL8TUNTUlIxBrk6oABF1ifbMoQ1uJ80aKGS92e4KV8p0jdty/J:LFccps3wwg48BToQ1uCJ3S92I8p0+
- TLSH T1ACB26B36EC59CABBECDB4F99F74A7607DEE0126385889AD4DADC4D0C008B19D170B827
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 34KB
- SHA256 202f49a23f789be6946464727078cd851848213a9e2eb3e9f56e85b3bf160265
- MD5 e7053f3f3f40a706206f17e91692d92b
- SHA1 9702b716ab52c7ae577b8d70089e75847e1fecee
- SHA512 c2b57d1025b389ab52cc17805bc0b1e64c8f2db096412bb945c32d3a2a9be2dd3b9d128b4dff64148b0321cb338e468ed590c1f848399a8ca574a7c47e3687a9
- SSDEEP 768:rFwjZbETwgi/woQ1uCJK81VlSAE9/1ygRD0nj:KoMKACHbM1ygR2j
- TLSH T136F23A72D854DEE798D6CFC5A34AF542A9E40273C48C99CCE6F87D6D208F1BD1B0A816
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 24KB
- SHA256 58b3c283b66daf990cd5cf20fa9a7c24246335422c56dd48abd2514d37a73d90
- MD5 1d4eecfed6cc1f6d9675d89a90bd2a5a
- SHA1 6e7e86de4478f1e3081b98ade3808c1f62ac20e6
- SHA512 0296fe7b897f4a355dedec7c3edb4a1d69aa1c1122bfa58e4b5e16802ad782d5bf2929eb867040a091fc2b13fc5e851c23a6f42415797edbd28fad1bb5ee27b7
- SSDEEP 384:nEiF9CcmyWCs38NE8TUNTUlIRqrk6gURu1ifbMoQ1uJ80aK3X8o9BDtty/7Igj:fFccps3TwgXkwoQ1uCJK8o9RQ
- TLSH T1A0B23B36EC59DAABECD74F89F74A7643CEE40163958C8AD4CADC4D0D008719D170BC26
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 34KB
- SHA256 34580300691cf2493cd138507aaa0f458640c86ac88ecb2f421e35027ff5e804
- MD5 95d8c1307effd713dafda5ef20b5eeb3
- SHA1 353cbb78a3addc36747705ac459123305efae38d
- SHA512 df9c3bcb7eca94754745d62ac41611a2a4dfaed3e272c3ecc2155db4454392e2f0ceb0fdfbe9e170f27c0a9d57aa0a7db56b849fe999abe211bd978c6bcfdc42
- SSDEEP 768:rFwjZbETwgiSwoQ1uCJK81VlSAE9/1ygRD0nj:KoM3ACHbM1ygR2j
- TLSH T10BF23A72D854DEE798D6CFC5A34AF542A9E40273C48C99CCE6F87D6D208F1BD1B0A816
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 28KB
- SHA256 88f426686fa7bd307324d01fdda3e8c401ab0b20caa06d12d833976921f863af
- MD5 0ddd0458450f7ae10df53c36b612d5cf
- SHA1 2e37ea5fa70d158d30a669f779b7413d5c32d5b0
- SHA512 e3ba5ce4f480ca04c93620712000a2357cf6d758e2a6691ef5741cfbdd5cbb9416ef0b9bbfae758b707d7d0f49796f22bc55e98570868220a889423c8ed06808
- SSDEEP 384:nEiF1tNnNnb9N38NE8TUNTUlIR/rk6gURu1ifbMoQ1uJ80aK3X8o9BDB872+sRD2:fF1jZb33TwgikwoQ1uCJK8o9RygRD0nj
- TLSH T15ED25A36A868EEABEDE74F99F34A7643DFE40193848C5AC4DAD80D4D00C719D170BC26
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 28KB
- SHA256 59c10320c21514fc6d29534dde75db08901e85adf416870dca9a46b5c6babff0
- MD5 1dc99e1eecacbfbafecdf72785e7cdee
- SHA1 f5aee937b283861e0d861f3aff25dcbc70b0778a
- SHA512 072c0a1d690103d87173525e71985babead04d4cc3bf54452c00fbdf97f871ae6ef1969e8ee2eb6d5965bb881220c6a566d3ec76f3de43ea638a97f393d3f3ac
- SSDEEP 384:nEiFKtNnNnb9i38NE8TUNTUlIRDrk65URu1ifbMoQ1uJ80aK3X8l9BDB872+sRD2:fFKjZb83TwgiNwoQ1uCJK8l9RygRD0nj
- TLSH T155D24A36A869EAABEDEB4F99F34A7643DFE40193848C5AC4DAD80D4D00C719D170BC26
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 30KB
- SHA256 34546a8949a96e71470d41bd363a0935e309986bf60c6348f8285f4b6ab886a3
- MD5 710d937c0fdd0553ac009de2d0111b2e
- SHA1 0c85aab07df3e0d799e8b8ff3261268ca2b0e46e
- SHA512 8fa97283212e9f65b4bb5b370bf7cc71f95980ef670286a30ceb7631bad69db1af1ae59717ce20cf79cc6db99c3575b26ec9f8fb731d64b39f004862a40aa7f9
- SSDEEP 768:fFwjZbEfwgiQwoQ1uCJOO1AKnA4JgRD0lj:GoQhACIQAKA4JgR0j
- TLSH T1B2D25C3ADC64DEBFECEB5F89B30E7A02DEE40167C4A859D4D7D80E4D409719DA30A816
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history
- Size 20KB
- SHA256 3e8c033202a660fd763337a6dabbe580423573cae6cb100905e34b8122e268d0
- MD5 d948adf88c4f161e1a9e582ef0d8a535
- SHA1 fc984bdb3b88a02fbae9349350ff98ddc19d352a
- SHA512 f476a7a91b9afef07019c7a46b85afef2e05e81f51a6b5a12f0999ba06b59b545d111d914bd5a9aa113902e7fc221d0bc474cc5ba1710a21bd0379c66d52f22d
- SSDEEP 12:TLyeSjPFUxOUDaaWZXiDiIF8izX4fhhdWeci2oesJa/Si3iscQQtydIKSzcQAJmO:TLyT5UOl0afDdWec9sJBwTR2DB5fc
- TLSH T12092AF23B9351073ECDA877ABD5385D10DBC165EC9B7B808DED049620DB2BC6A2991FC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
- Size 264KB
- SHA256 b980c2199f972880683cfa0263d23a27b5d0372f0e51f5ab0c65d3acc528df24
- MD5 054054bd677f2c95b5b314e502095f71
- SHA1 a56b1c27136a049c02a8b953148f50645851e1b0
- SHA512 8f02e2b2e4f20a779ef771394b5e2537daedf6ad4cb3cf79aae366dd3b4a30650eeb2288de5c99f62e0da6db03ee12b479376eefe77c6ba8a1cc6a7651e0cd65
- SSDEEP 3:MsEllllkEthXllkl2zEel1oa:/M/xT02zN
- TLSH T16444040C7FC5140FC51C10314011C3504370FC100D1557433D5104135FD75454C00510
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.5.28.1\typosquatting_list.pb
- Size 507KB
- SHA256 b34c96309ee41ff6d06dea8e605991b9b8c4d67fb4885cde883350c3b5ad674d
- MD5 60b2b141019ad9ca0918db29dce42c12
- SHA1 574e04a0a62023df2271a4633378f57320d33c8c
- SHA512 918e6ea325b74876026691a37440441ffd3be78736595127ce77288e0bf3ab8597d52c62f94956f5567d1f985c2d38fa82f288ee330f8282f0e804ec2dc06b14
- SSDEEP 3072:diBzZPXsIPv9aayls9OPzItqVCLWtQAMDvUlDetL81QFh9QGFFXaYllJzCWCD43s:ozZsIPv9akA0WuIDo/FhJFXNfFw43s
- TLSH T189B4C5B9DFC00194DB78112D20BE71D8181412A580E9DFEAFE7D855F2BC2AC977E85E8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
- Size 86B
- SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
- MD5 961e3604f228b0d10541ebf921500c86
- SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
- SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
- TLSH T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
- Size 2KB
- SHA256 ce121bc2ca2672edc8fa99b69343940ff674fee51aee6d42122017e02b080415
- MD5 1d29057cd57c32e206004c628c8c2d0a
- SHA1 57807bfb9e40c56a5a9280010d87d116f4a8b191
- SHA512 974c2ccad12b287b53d1c493069d316dd20dfe1a7e9aced65419766bcd1ee7708f73c80f6e0cbd6a6efb965fd1a7778f3914271512c63f82fa00ef69286329a7
- TLSH T1114130E00C7856C1D4BD0ABE708B34FC81DCD72AF5A434BD2C58EAD54A7962C688443F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
- Size 2KB
- SHA256 165cf5a9177168235a0f94a4d5ab5ba11aa0c043395c84d375516228566b00d1
- MD5 a99aae595cab39cdd856a5e35d35b930
- SHA1 fca03e6f99539fc5dc594ee94930d8d91fa9bd52
- SHA512 9f07697006a65e57a3c4c890902a1d99bf7650534122459ae45071b1b57664868d0cd1af82c12aa30b774514c3e9ec0f58b3f0fc156f900e4ae7737a4201f94e
- TLSH T158413FE05C786AC1D4BD0EAF70CB34FC82D89739F5A4357D6C58EA940A7961D688483F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.8-win-x64.exe:Zone.Identifier
- Size 185B
- SHA256 8c395943b16e36564765fb40286b4cf32b43e74a1ee8d07250a66969fbf21a03
- MD5 72e46e861359d6dc61a9a5db60e15373
- SHA1 2dadb6bde3de2c683e5f79f16cce6fb7a5778da3
- SHA512 7644740f984da3050aa726b1d307355a78c84cfcf9512bd1a695e9e9774f9c5459e05ba9d16ad26db555a069701b72dd7a600e49f9d856d8a25fd235f8cb79ea
- TLSH T15DC012EBC80044520E3022921B6ED569EE0F2D466DC1C3888CC48496E9539D6C152895
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Installer\MSICC76.tmp
- Size 392KB
- SHA256 a28ed81b8594774c7e1e82f9bbe858c3b36f0d7a93067001387a5a872288231a
- MD5 f1fafe5c54813a5d7b60d08b859bd58b
- SHA1 95e6598ce1c02220d68edab5474980b7f0f0a12c
- SHA512 6dbc8b10277c6fae8d7ba961a843810df0bb11c9c6e3ba54eea1b24e13b1069e454ef5d76d345839a32f94871855928578a15948ba242d03c990b21d8f845df9
- SSDEEP 6144:u/VbdUw0z9ursTolCJSqJiIUk8AeWNxFqYrtUc06N:u/VbdJ0zErWolCJ9TeWxqYZfN
- TLSH T1CC846A29F7E418EDD4B782B6C5A68030FF75754D332095AF8BA845291F3BAA470BB701
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e58c7fe.msi
- Size 1012KB
- SHA256 538cbacb8ae48e780ad16aecc9d873e0d8f0a7017ebc5f3e2eb61d51decf73c4
- MD5 dbfbeb4d900dac0d7eb8ffaab5ce99ad
- SHA1 d915fee14f72296553853f6ad3ad29e9e08c6fbf
- SHA512 1dbbc6b721dc0d13f8ca061c4034e5f3408b6f70ccd1099da7fb09b9aa519dfc280a15874cf932d255136bb0c8844afc378760cdf6e567059f2cbc6fc844f0cc
- SSDEEP 12288:/N2etgX0xsm7HrObWMInYLE/BbdJ0zErWolCJ9TeWxqYZfDk3BJi:126gG74W6WBbdJwEqECJ9Te7Yxib
- TLSH T1B2257B1BBFA404A9D8B24E75C4B78321EE357C482320969F43A47229DEFB7D0647A7D1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e58c80a.msi
- Size 28.1MB
- SHA256 7b3c945f4be3350087b55bdfa79110df89bce9a54fc7811ec9440d985a1fba43
- MD5 423d6a2b5c3de430dbd2ce169ce2d0f9
- SHA1 9edc9445e1234c586c12e059a20d81726bb1caeb
- SHA512 8c6c261670795bd849ffd3410bb2e59960472d13c265e2636ff132541f2b8a8d3fb90c0bd308dde3bd1ef67c7ced54bdb80efd161f77d50a1fd7d80488af9066
- SSDEEP 786432:IDzJqP7jcu4qUWR5qPSa4aERvSJYbz+U0zflc:IDzJYPc3qdR5mhu6JSx0zNc
- TLSH T12B5733537FA208AAC8724E3185BB4715BA753C893321855F03A4751ADEFB3D461BEBC2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2136_529108192\manifest.json
- Size 118B
- SHA256 1b90c1e9cbd34978ee21dae135f1ea9f51599d19014f9219cd47d730fd914f55
- MD5 7cbc275e0cbde8ca623fc70c406367c3
- SHA1 2b9fecd47ed8ad353bfdd958e0f5197f20dc370c
- SHA512 6966dbc5899213f4b9d0e241409cd834f67ef2df35a5b437cb194893c6c6f7fcd8a33c0f22344a20682a84dabaa2d0f95b9d739e5d0a840a91fc2806e09e0b06
- TLSH T198B092B00C0BA47B22809720ECA166C283FC0218E8466B1A08C036481F9817880362B2
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2136_942910886\data.txt
- Size 146KB
- SHA256 4d3b611b8b664c9b2e4503f41eabf3833860e521447c1dc921f0849e0c8633de
- MD5 824a5940f80f495eec4743b1e719aa38
- SHA1 1194b5bb383ef6fb33dcf906c99743f23cfaf790
- SHA512 979860e2f4dbf25a3562c9e29c218f8d779a98a0f652dbfda04752f537d86f11bf8d27aad22d9b6ce16d34f734f9efb883e89ec326cc645506b7b163e429c2b6
- SSDEEP 3072:TBPAgDcCHaLHl65aynyosxb3+B1xh0OrlwYEpASogqAlrE7FkEBih5:9X1aI5aZoKzMJ07N8gqAlrE7OXv
- TLSH T1D7E3F110CEC41FDCDFA9291C90BD0F0963E1C79E853BAA85EB63FE466F67A045617089
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2136_942910886\manifest.json
- Size 52B
- SHA256 98fd5d8bd64136534587ef4cd3f9151defa2a6dae9f0b269a2cbb06433c50336
- MD5 4b38fcc473ed6f7c17ddfb82a738f25e
- SHA1 ecdc59ae25620ddc8111f05fa358f9bd829ab553
- SHA512 8a7b883c0f656ec7bca3c0239dc7f362db0375236f234844d07b4a9639e7c26a3fcefb1b6927e32bda3dfc2ca5cb1872a9b422fa7f8881d56409c33063176a92
- TLSH T114900260042491571AE10E606570F8859395761955950D1D04451548029946CE050298
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Temp\{6B3A3AC4-0DCA-40E4-AE64-ACC9BF810D40}\.be\windowsdesktop-runtime-10.0.8-win-x64.exe
- Size 966KB
- SHA256 b809e0aacdaf9d423d009d3c5321cf60792119fd27419194414c4195b891a240
- MD5 785c0fd93971cb849bdbadc1af4486b8
- SHA1 d2806e3ebfa4f543a0f074f41b85465da78f9f43
- SHA512 e7bf91b59f0985b97ec59ab1b8a85124c5db4b749835b06a20f91899dabe710adf08c99ce35322227626dbefd8fa1a5b1cb33d5d442409db36d377547dec5368
- SSDEEP 12288:FVGWl6qCmyZeU6lqlDjC+fScn6X8GwMgJET5A6GTBB9F3henBpzGkzPV:FVGWl6qCmyt6UdmcpMzFz6XUnn5zPV
- TLSH T195257D32A166242BD6F50973F914D2307E28D7082B5C95B6C6C0DD0D39689FA6FFB24B
- MD5 SHA1 SHA512 SSDEEP TLSH