hxxps://sourceforge[.]net/projects/delta-executor-for-pc/

Analysis

user interaction
yes
max time kernel
240s
max time network
243s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/06/2026, 03:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://sourceforge.net/projects/delta-executor-for-pc/
Sample260602-efjs5aex2j

Score

7^/10

discovery installer ransomware

Malware Config

Signatures

Executes dropped EXE 15 IoCs

pid	Process
1548	DeltaExecutor.exe
5944	DependencyCore_415289.exe
5244	setup.exe
1140	vcredist_x86.exe
1504	install.exe
4256	DeltaExecutor.exe
6044	bzflag.exe
5868	bzfs.exe
536	bzfs.exe
5396	bzfs.exe
4400	bzfs.exe
2552	bzfs.exe
4364	bzfs.exe
5636	bzfs.exe
5640	DeltaExecutor.exe

Loads dropped DLL 13 IoCs

pid	Process
5244	setup.exe
5244	setup.exe
5244	setup.exe
1504	install.exe
6044	bzflag.exe
6044	bzflag.exe
5868	bzfs.exe
536	bzfs.exe
5396	bzfs.exe
4400	bzfs.exe
2552	bzfs.exe
4364	bzfs.exe
5636	bzfs.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\BZFlag2.0.16\data\automatic_icon.png	setup.exe
File created	C:\Program Files (x86)\BZFlag2.0.16\data\green_bolt.png	setup.exe
File created	C:\Program Files (x86)\BZFlag2.0.16\data\fire.wav	setup.exe
File created	C:\Program Files (x86)\BZFlag2.0.16\data\lock.wav	setup.exe
File created	C:\Program Files (x86)\BZFlag2.0.16\data\fonts\DejaVuSansCondensedBold_6.png	setup.exe
File created	C:\Program Files (x86)\BZFlag2.0.16\data\fonts\DejaVuSerifBold_8.png	setup.exe
File created	C:\Program Files (x86)\BZFlag2.0.16\killall.dll	setup.exe
File created	C:\Program Files (x86)\BZFlag2.0.16\data\raindrop.png	setup.exe
File created	C:\Program Files (x86)\BZFlag2.0.16\data\red_tank.png	setup.exe
File created	C:\Program Files (x86)\BZFlag2.0.16\data\burrow.wav	setup.exe
File created	C:\Program Files (x86)\BZFlag2.0.16\data\teamgrab.wav	setup.exe
File created	C:\Program Files (x86)\BZFlag2.0.16\data\teleport.wav	setup.exe
File created	C:\Program Files (x86)\BZFlag2.0.16\API\bzfs.lib	setup.exe
File created	C:\Program Files (x86)\BZFlag2.0.16\bzflag.exe	setup.exe
File created	C:\Program Files (x86)\BZFlag2.0.16\data\dusty_flare.png	setup.exe
File created	C:\Program Files (x86)\BZFlag2.0.16\data\flag.png	setup.exe
File created	C:\Program Files (x86)\BZFlag2.0.16\data\mesh.png	setup.exe
File created	C:\Program Files (x86)\BZFlag2.0.16\data\missile.png	setup.exe
File created	C:\Program Files (x86)\BZFlag2.0.16\data\fonts\DejaVuSansCondensedBold_32.fmt	setup.exe
File created	C:\Program Files (x86)\BZFlag2.0.16\data\fonts\DejaVuSerifBold_6.png	setup.exe
File created	C:\Program Files (x86)\BZFlag2.0.16\data\l10n\bzflag_nl.po	setup.exe
File created	C:\Program Files (x86)\BZFlag2.0.16\data\blue_bolt.png	setup.exe
File created	C:\Program Files (x86)\BZFlag2.0.16\data\moon.png	setup.exe
File created	C:\Program Files (x86)\BZFlag2.0.16\data\jump.wav	setup.exe
File created	C:\Program Files (x86)\BZFlag2.0.16\data\land.wav	setup.exe
File created	C:\Program Files (x86)\BZFlag2.0.16\data\fonts\DejaVuSansCondensedBold_16.fmt	setup.exe
File created	C:\Program Files (x86)\BZFlag2.0.16\data\fonts\DejaVuSansMonoBold_8.png	setup.exe
File created	C:\Program Files (x86)\BZFlag2.0.16\data\fonts\DejaVuSerifBold_32.png	setup.exe
File created	C:\Program Files (x86)\BZFlag2.0.16\data\l10n\ISO-639-2_values_8bits.txt	setup.exe
File created	C:\Program Files (x86)\BZFlag2.0.16\data\red_basetop.png	setup.exe
File created	C:\Program Files (x86)\BZFlag2.0.16\data\bubble.png	setup.exe
File created	C:\Program Files (x86)\BZFlag2.0.16\data\flag_drop.wav	setup.exe
File created	C:\Program Files (x86)\BZFlag2.0.16\data\flag_lost.wav	setup.exe
File created	C:\Program Files (x86)\BZFlag2.0.16\data\steamroller.wav	setup.exe
File created	C:\Program Files (x86)\BZFlag2.0.16\data\l10n\bzflag_de.po	setup.exe
File created	C:\Program Files (x86)\BZFlag2.0.16\data\l10n\bzflag_en_US_redneck.po	setup.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping556_1482611851\nav_config.json	msedge.exe
File created	C:\Program Files (x86)\BZFlag2.0.16\data\blue_laser.png	setup.exe
File created	C:\Program Files (x86)\BZFlag2.0.16\data\observer_icon.png	setup.exe
File created	C:\Program Files (x86)\BZFlag2.0.16\data\rabbit_laser.png	setup.exe
File created	C:\Program Files (x86)\BZFlag2.0.16\data\red_laser.png	setup.exe
File created	C:\Program Files (x86)\BZFlag2.0.16\data\fonts\DejaVuSansMonoBold_12.fmt	setup.exe
File created	C:\Program Files (x86)\BZFlag2.0.16\data\fonts\DejaVuSansMonoBold_6.png	setup.exe
File created	C:\Program Files (x86)\BZFlag2.0.16\data\purple_basewall.png	setup.exe
File created	C:\Program Files (x86)\BZFlag2.0.16\data\purple_icon.png	setup.exe
File created	C:\Program Files (x86)\BZFlag2.0.16\data\roof.png	setup.exe
File created	C:\Program Files (x86)\BZFlag2.0.16\data\zone_ground.png	setup.exe
File created	C:\Program Files (x86)\BZFlag2.0.16\data\killteam.wav	setup.exe
File created	C:\Program Files (x86)\BZFlag2.0.16\data\message_private.wav	setup.exe
File created	C:\Program Files (x86)\BZFlag2.0.16\data\message_team.wav	setup.exe
File created	C:\Program Files (x86)\BZFlag2.0.16\data\fonts\DejaVuSansMonoBold_16.png	setup.exe
File created	C:\Program Files (x86)\BZFlag2.0.16\data\frog.png	setup.exe
File created	C:\Program Files (x86)\BZFlag2.0.16\data\menu_arrow.png	setup.exe
File created	C:\Program Files (x86)\BZFlag2.0.16\data\explosion.wav	setup.exe
File created	C:\Program Files (x86)\BZFlag2.0.16\data\flag_alert.wav	setup.exe
File created	C:\Program Files (x86)\BZFlag2.0.16\data\fonts\DejaVuSansCondensedBold_6.fmt	setup.exe
File created	C:\Program Files (x86)\BZFlag2.0.16\data\l10n\bzflag_da.po	setup.exe
File created	C:\Program Files (x86)\BZFlag2.0.16\data\l10n\bzflag_fr.po	setup.exe
File created	C:\Program Files (x86)\BZFlag2.0.16\chathistory.dll	setup.exe
File created	C:\Program Files (x86)\BZFlag2.0.16\data\purple_laser.png	setup.exe
File created	C:\Program Files (x86)\BZFlag2.0.16\data\purple_super_bolt.png	setup.exe
File created	C:\Program Files (x86)\BZFlag2.0.16\data\pyrwall.png	setup.exe
File created	C:\Program Files (x86)\BZFlag2.0.16\data\flap.wav	setup.exe
File created	C:\Program Files (x86)\BZFlag2.0.16\data\fonts\DejaVuSerifBold_12.fmt	setup.exe

Drops file in Windows directory 62 IoCs

description	ioc	Process
File created	C:\Windows\WinSxS\InstallTemp\20260602045454437.0\mfc90cht.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260602045454421.0\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260602045454437.2\9.0.30729.4148.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260602045454406.0\x86_Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_353599c2.manifest	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260602045454437.0\mfc90rus.dll	msiexec.exe
File created	C:\Windows\Installer\e5a0c98.msi	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20260602045454421.1	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20260602045454437.0	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260602045454452.0\9.0.30729.4148.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260602045454452.1\9.0.30729.4148.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260602045454437.0\mfc90ita.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260602045454421.0\msvcr90.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260602045454468.1\9.0.30729.4148.policy	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20260602045454468.1	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260602045454421.1\mfc90.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260602045454437.0\mfc90jpn.dll	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20260602045454421.0	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20260602045454452.1	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260602045454437.1\x86_Microsoft.VC90.OpenMP_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_f0ccd4aa.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260602045454452.0\9.0.30729.4148.policy	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20260602045454437.2	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260602045454437.1\x86_Microsoft.VC90.OpenMP_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_f0ccd4aa.manifest	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\CFD2C1F142D260E3CB8B271543DA9F98\9.0.30729\FL_msdia71_dll_2_60035_x86_ln.3643236F_FC70_11D3_A536_0090278A1BB8	msiexec.exe
File created	C:\Windows\Installer\e5a0c94.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5a0c94.msi	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260602045454468.1\9.0.30729.4148.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260602045454437.0\mfc90deu.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260602045454437.0\mfc90esn.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260602045454437.0\mfc90esp.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260602045454437.2\9.0.30729.4148.policy	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260602045454437.0\mfc90kor.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260602045454421.1\mfc90u.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260602045454421.0\msvcp90.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260602045454421.0\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e.manifest	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260602045454437.0\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313.manifest	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260602045454452.1\9.0.30729.4148.policy	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260602045454468.0\9.0.30729.4148.policy	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260602045454437.1\vcomp90.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260602045454468.0\9.0.30729.4148.cat	msiexec.exe
File created	C:\Windows\Installer\SourceHash{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260602045454421.1\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260602045454437.0\mfc90enu.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260602045454421.1\mfcm90.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260602045454421.1\mfcm90u.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\CFD2C1F142D260E3CB8B271543DA9F98\9.0.30729	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\CFD2C1F142D260E3CB8B271543DA9F98\9.0.30729\FL_msdia71_dll_2_60035_x86_ln.3643236F_FC70_11D3_A536_0090278A1BB8	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260602045454437.0\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313.cat	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20260602045454452.0	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260602045454437.0\mfc90chs.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI10BA.tmp	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260602045454406.0\atl90.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260602045454421.1\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53.manifest	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\CFD2C1F142D260E3CB8B271543DA9F98	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260602045454406.0\x86_Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_353599c2.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260602045454421.0\msvcm90.dll	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20260602045454406.0	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20260602045454437.1	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260602045454437.0\mfc90fra.dll	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20260602045454468.0	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bzfs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bzfs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bzfs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	install.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bzfs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bzfs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bzfs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bzfs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DependencyCore_415289.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bzflag.exe

System Time Discovery 1 TTPs 5 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3412	msedge.exe
4892	msedge.exe
4492	msedge.exe
960	msedge.exe
3252	msedge.exe

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral1/files/0x000400000001e6a2-1573.dat	nsis_installer_1
behavioral1/files/0x000400000001e6a2-1573.dat	nsis_installer_2

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 15 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134248459881570095"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 55 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CFD2C1F142D260E3CB8B271543DA9F98\AuthorizedLUAApp = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{A61CE535-9B77-4952-B387-3A8E154B0D00}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{A6AEAC29-D97C-4463-84FD-98A1C68FD4AA}	msedge.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.9.0.Microsoft.VC90.MFC,version="9.0.30729.4148",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86",type="win32-policy" = 3400750074007e002c0069005a004c00780037006200340029003300420034003f00440045005400460054005f00560043005f005200650064006900730074005f004d00460043005f007800380036003e0028005200290025005200690047002d007900330033007e006a006f0054006300420060004b00650000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\CFD2C1F142D260E3CB8B271543DA9F98\VC_RED_enu_x86_net_SETUP	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CFD2C1F142D260E3CB8B271543DA9F98\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CFD2C1F142D260E3CB8B271543DA9F98\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CFD2C1F142D260E3CB8B271543DA9F98\SourceList\Net\1 = "f:\\9ede2c366d33d742ae71b30534a10e\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CFD2C1F142D260E3CB8B271543DA9F98\SourceList\Media\1 = ";1"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.9.0.Microsoft.VC90.ATL,version="9.0.30729.4148",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86",type="win32-policy" = 3400750074007e002c0069005a004c00780037006200340029003300420034003f00440045005400460054005f00560043005f005200650064006900730074005f00410054004c005f007800380036003e0072004600390039004e002c00610079007d00370030002d0079007e00460069007000780027003f0000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC90.MFC,version="9.0.30729.4148",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86",type="win32" = 3400750074007e002c0069005a004c00780037006200340029003300420034003f00440045005400460054005f00560043005f005200650064006900730074005f004d00460043005f007800380036003e003700730035004e00610066002d005b005d003400370033005e00520059005300310067005e00450000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{CC4EDA1B-995A-49AE-9A07-73A34D088910}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC90.MFCLOC,version="9.0.30729.4148",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86",type="win32" = 3400750074007e002c0069005a004c00780037006200340029003300420034003f00440045005400460054005f00560043005f005200650064006900730074005f004d00460043004c004f0043005f007800380036003e00530076002a0037002a005e0064006e004a00350039006f00420054006e006a0065002a006100550000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\CFD2C1F142D260E3CB8B271543DA9F98\Servicing_Key	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\CFD2C1F142D260E3CB8B271543DA9F98\FT_VC_Redist_CRT_x86 = "VC_Redist_12222_x86_enu"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CFD2C1F142D260E3CB8B271543DA9F98\DeploymentFlags = "3"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC90.ATL,version="9.0.30729.4148",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86",type="win32" = 3400750074007e002c0069005a004c00780037006200340029003300420034003f00440045005400460054005f00560043005f005200650064006900730074005f00410054004c005f007800380036003e0069005e004a006c005e0065004e0057002e0038002e00720078005d0043006900340035006900330000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\CFD2C1F142D260E3CB8B271543DA9F98\VC_Redist_12222_x86_enu	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\CFD2C1F142D260E3CB8B271543DA9F98\FT_VC_Redist_MFC_x86 = "VC_Redist_12222_x86_enu"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CFD2C1F142D260E3CB8B271543DA9F98\Version = "151025673"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\41A387AA3A7A33D3590FA953D1350011\CFD2C1F142D260E3CB8B271543DA9F98	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CFD2C1F142D260E3CB8B271543DA9F98\SourceList\PackageName = "vc_red.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CFD2C1F142D260E3CB8B271543DA9F98\SourceList\Media\DiskPrompt = "[1]"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CFD2C1F142D260E3CB8B271543DA9F98\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.9.0.Microsoft.VC90.CRT,version="9.0.30729.4148",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86",type="win32-policy" = 3400750074007e002c0069005a004c00780037006200340029003300420034003f00440045005400460054005f00560043005f005200650064006900730074005f004300520054005f007800380036003e0036007d0040005900620030003000420024003400710028003200760079005d0046002b007e002e0000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC90.OpenMP,version="9.0.30729.4148",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86",type="win32" = 3400750074007e002c0069005a004c00780037006200340029003300420034003f00440045005400460054005f00560043005f005200650064006900730074005f004f00700065006e004d0050005f007800380036003e006c0028006d0043002d0060003d00530052003600510038004a006100360021006d007d002400660000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\CFD2C1F142D260E3CB8B271543DA9F98\FT_VC_Redist_OpenMP_x86 = "VC_Redist_12222_x86_enu"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CFD2C1F142D260E3CB8B271543DA9F98	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CFD2C1F142D260E3CB8B271543DA9F98\PackageCode = "F709078B0C8D814418F6D4823715B182"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CFD2C1F142D260E3CB8B271543DA9F98\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CFD2C1F142D260E3CB8B271543DA9F98\SourceList\Media	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\CFD2C1F142D260E3CB8B271543DA9F98\FT_VC_Redist_MFCLOC_x86 = "VC_Redist_12222_x86_enu"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CFD2C1F142D260E3CB8B271543DA9F98\ProductName = "Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CFD2C1F142D260E3CB8B271543DA9F98\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CFD2C1F142D260E3CB8B271543DA9F98\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{14012C28-0467-4EDB-A43C-15A446DD1450}	msedge.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC90.CRT,version="9.0.30729.4148",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86",type="win32" = 3400750074007e002c0069005a004c00780037006200340029003300420034003f00440045005400460054005f00560043005f005200650064006900730074005f004300520054005f007800380036003e007e002700610061005a003d00250060003d00380048006f00420065002a005100300075006300600000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.9.0.Microsoft.VC90.OpenMP,version="9.0.30729.4148",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86",type="win32-policy" = 3400750074007e002c0069005a004c00780037006200340029003300420034003f00440045005400460054005f00560043005f005200650064006900730074005f004f00700065006e004d0050005f007800380036003e00300062006900480044004e00490038004000340061006a004500540046005f00360065005300330000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CFD2C1F142D260E3CB8B271543DA9F98\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\41A387AA3A7A33D3590FA953D1350011	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CFD2C1F142D260E3CB8B271543DA9F98\SourceList\LastUsedSource = "n;1;f:\\9ede2c366d33d742ae71b30534a10e\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{C1D4C363-797C-4A27-97F5-32915B6AFEB9}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{A337C10C-AC66-4EC5-9928-B472F7F58509}	msedge.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.9.0.Microsoft.VC90.MFCLOC,version="9.0.30729.4148",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86",type="win32-policy" = 3400750074007e002c0069005a004c00780037006200340029003300420034003f00440045005400460054005f00560043005f005200650064006900730074005f004d00460043004c004f0043005f007800380036003e0069002e007e0076007300250046007b00420034005d0047007b0064004e005d006b0056006400370000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\CFD2C1F142D260E3CB8B271543DA9F98	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\CFD2C1F142D260E3CB8B271543DA9F98\FT_VC_Redist_ATL_x86 = "VC_Redist_12222_x86_enu"	msiexec.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
4652	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
5944	DependencyCore_415289.exe
5944	DependencyCore_415289.exe
2168	msiexec.exe
2168	msiexec.exe
5380	msedge.exe
5380	msedge.exe
556	msedge.exe
556	msedge.exe

Suspicious behavior: LoadsDriver 7 IoCs

pid	Process
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 25 IoCs

pid	Process
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
5380	msedge.exe
5380	msedge.exe
5380	msedge.exe
5380	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	1552	7zG.exe
Token: 35	1552	7zG.exe
Token: SeSecurityPrivilege	1552	7zG.exe
Token: SeSecurityPrivilege	1552	7zG.exe
Token: SeDebugPrivilege	5944	DependencyCore_415289.exe
Token: SeShutdownPrivilege	1504	install.exe
Token: SeIncreaseQuotaPrivilege	1504	install.exe
Token: SeSecurityPrivilege	2168	msiexec.exe
Token: SeCreateTokenPrivilege	1504	install.exe
Token: SeAssignPrimaryTokenPrivilege	1504	install.exe
Token: SeLockMemoryPrivilege	1504	install.exe
Token: SeIncreaseQuotaPrivilege	1504	install.exe
Token: SeMachineAccountPrivilege	1504	install.exe
Token: SeTcbPrivilege	1504	install.exe
Token: SeSecurityPrivilege	1504	install.exe
Token: SeTakeOwnershipPrivilege	1504	install.exe
Token: SeLoadDriverPrivilege	1504	install.exe
Token: SeSystemProfilePrivilege	1504	install.exe
Token: SeSystemtimePrivilege	1504	install.exe
Token: SeProfSingleProcessPrivilege	1504	install.exe
Token: SeIncBasePriorityPrivilege	1504	install.exe
Token: SeCreatePagefilePrivilege	1504	install.exe
Token: SeCreatePermanentPrivilege	1504	install.exe
Token: SeBackupPrivilege	1504	install.exe
Token: SeRestorePrivilege	1504	install.exe
Token: SeShutdownPrivilege	1504	install.exe
Token: SeDebugPrivilege	1504	install.exe
Token: SeAuditPrivilege	1504	install.exe
Token: SeSystemEnvironmentPrivilege	1504	install.exe
Token: SeChangeNotifyPrivilege	1504	install.exe
Token: SeRemoteShutdownPrivilege	1504	install.exe
Token: SeUndockPrivilege	1504	install.exe
Token: SeSyncAgentPrivilege	1504	install.exe
Token: SeEnableDelegationPrivilege	1504	install.exe
Token: SeManageVolumePrivilege	1504	install.exe
Token: SeImpersonatePrivilege	1504	install.exe
Token: SeCreateGlobalPrivilege	1504	install.exe
Token: SeRestorePrivilege	2168	msiexec.exe
Token: SeTakeOwnershipPrivilege	2168	msiexec.exe
Token: SeRestorePrivilege	2168	msiexec.exe
Token: SeTakeOwnershipPrivilege	2168	msiexec.exe
Token: SeRestorePrivilege	2168	msiexec.exe
Token: SeTakeOwnershipPrivilege	2168	msiexec.exe
Token: SeRestorePrivilege	2168	msiexec.exe
Token: SeTakeOwnershipPrivilege	2168	msiexec.exe
Token: SeRestorePrivilege	2168	msiexec.exe
Token: SeTakeOwnershipPrivilege	2168	msiexec.exe
Token: SeRestorePrivilege	2168	msiexec.exe
Token: SeTakeOwnershipPrivilege	2168	msiexec.exe
Token: SeRestorePrivilege	2168	msiexec.exe
Token: SeTakeOwnershipPrivilege	2168	msiexec.exe
Token: SeRestorePrivilege	2168	msiexec.exe
Token: SeTakeOwnershipPrivilege	2168	msiexec.exe
Token: SeRestorePrivilege	2168	msiexec.exe
Token: SeTakeOwnershipPrivilege	2168	msiexec.exe
Token: SeRestorePrivilege	2168	msiexec.exe
Token: SeTakeOwnershipPrivilege	2168	msiexec.exe
Token: SeRestorePrivilege	2168	msiexec.exe
Token: SeTakeOwnershipPrivilege	2168	msiexec.exe
Token: SeRestorePrivilege	2168	msiexec.exe
Token: SeTakeOwnershipPrivilege	2168	msiexec.exe
Token: SeRestorePrivilege	2168	msiexec.exe
Token: SeTakeOwnershipPrivilege	2168	msiexec.exe
Token: SeRestorePrivilege	2168	msiexec.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
1552	7zG.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
6044	bzflag.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4180 wrote to memory of 1732	4180	msedge.exe	87
PID 4180 wrote to memory of 4892	4180	msedge.exe	88
PID 4180 wrote to memory of 4140	4180	msedge.exe	89
PID 4180 wrote to memory of 4140	4180	msedge.exe	89
PID 4180 wrote to memory of 4140	4180	msedge.exe	89
PID 4180 wrote to memory of 2432	4180	msedge.exe	91
PID 4180 wrote to memory of 2432	4180	msedge.exe	91
PID 4180 wrote to memory of 3576	4180	msedge.exe	93
PID 4180 wrote to memory of 3576	4180	msedge.exe	93
PID 4180 wrote to memory of 3576	4180	msedge.exe	93
PID 4180 wrote to memory of 1456	4180	msedge.exe	92
PID 4180 wrote to memory of 1456	4180	msedge.exe	92
PID 4180 wrote to memory of 1456	4180	msedge.exe	92
PID 4180 wrote to memory of 3404	4180	msedge.exe	94
PID 4180 wrote to memory of 3404	4180	msedge.exe	94
PID 4180 wrote to memory of 3404	4180	msedge.exe	94
PID 4180 wrote to memory of 4620	4180	msedge.exe	95
PID 4180 wrote to memory of 4620	4180	msedge.exe	95
PID 4180 wrote to memory of 4620	4180	msedge.exe	95
PID 4180 wrote to memory of 1688	4180	msedge.exe	98
PID 4180 wrote to memory of 1688	4180	msedge.exe	98
PID 4180 wrote to memory of 464	4180	msedge.exe	100
PID 4180 wrote to memory of 464	4180	msedge.exe	100
PID 4180 wrote to memory of 4500	4180	msedge.exe	101
PID 4180 wrote to memory of 4500	4180	msedge.exe	101
PID 4180 wrote to memory of 4500	4180	msedge.exe	101
PID 4180 wrote to memory of 960	4180	msedge.exe	103
PID 4180 wrote to memory of 960	4180	msedge.exe	103
PID 4180 wrote to memory of 960	4180	msedge.exe	103
PID 4180 wrote to memory of 3912	4180	msedge.exe	104
PID 4180 wrote to memory of 3912	4180	msedge.exe	104
PID 4180 wrote to memory of 3912	4180	msedge.exe	104
PID 4180 wrote to memory of 2312	4180	msedge.exe	107
PID 4180 wrote to memory of 3904	4180	msedge.exe	106
PID 4180 wrote to memory of 2312	4180	msedge.exe	107
PID 4180 wrote to memory of 3904	4180	msedge.exe	106
PID 4180 wrote to memory of 2720	4180	msedge.exe	109
PID 4180 wrote to memory of 4124	4180	msedge.exe	110
PID 4180 wrote to memory of 4124	4180	msedge.exe	110
PID 4180 wrote to memory of 4300	4180	msedge.exe	111
PID 4180 wrote to memory of 4300	4180	msedge.exe	111
PID 4180 wrote to memory of 564	4180	msedge.exe	112
PID 4180 wrote to memory of 564	4180	msedge.exe	112
PID 4180 wrote to memory of 4000	4180	msedge.exe	113
PID 4180 wrote to memory of 4000	4180	msedge.exe	113
PID 4180 wrote to memory of 4648	4180	msedge.exe	114
PID 4180 wrote to memory of 4648	4180	msedge.exe	114
PID 4180 wrote to memory of 4024	4180	msedge.exe	115
PID 4180 wrote to memory of 4024	4180	msedge.exe	115
PID 4180 wrote to memory of 5208	4180	msedge.exe	119
PID 4180 wrote to memory of 5208	4180	msedge.exe	119
PID 4180 wrote to memory of 5208	4180	msedge.exe	119
PID 4180 wrote to memory of 5348	4180	msedge.exe	120
PID 4180 wrote to memory of 5348	4180	msedge.exe	120
PID 4180 wrote to memory of 5348	4180	msedge.exe	120
PID 4180 wrote to memory of 5432	4180	msedge.exe	131
PID 4180 wrote to memory of 5432	4180	msedge.exe	131
PID 4180 wrote to memory of 5432	4180	msedge.exe	131
PID 4180 wrote to memory of 5440	4180	msedge.exe	132
PID 1548 wrote to memory of 732	1548	DeltaExecutor.exe	143
PID 732 wrote to memory of 2720	732	msedge.exe	144
PID 2720 wrote to memory of 716	2720	msedge.exe	145
PID 2720 wrote to memory of 6108	2720	msedge.exe	148
PID 2720 wrote to memory of 4492	2720	msedge.exe	147

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://sourceforge.net/projects/delta-executor-for-pc/
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffe7e6fc188,0x7ffe7e6fc194,0x7ffe7e6fc1a0
  2⤵
  PID:1732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1836,i,12834091352609466260,3091556501607647544,524288 --field-trial-handle=2852,i,16328574975784091729,1693179700390648350,262144 --variations-seed-version --mojo-platform-channel-handle=2904 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1724,i,15157499360946065700,1648631640826899578,262144 --field-trial-handle=2852,i,16328574975784091729,1693179700390648350,262144 --variations-seed-version --mojo-platform-channel-handle=2848 /prefetch:2
  2⤵
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2292,i,9516546008146316250,18071087062100253169,524288 --field-trial-handle=2852,i,16328574975784091729,1693179700390648350,262144 --variations-seed-version --mojo-platform-channel-handle=3084 /prefetch:8
  2⤵
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3548,i,3025314163269139511,8829087789885497421,2097152 --field-trial-handle=2852,i,16328574975784091729,1693179700390648350,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:1
  2⤵
  PID:1456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3572,i,9500371840901828021,9387516476020826608,2097152 --field-trial-handle=2852,i,16328574975784091729,1693179700390648350,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
  2⤵
  PID:3576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,5186872744161513554,2953937959984274059,2097152 --field-trial-handle=2852,i,16328574975784091729,1693179700390648350,262144 --variations-seed-version --mojo-platform-channel-handle=1716 /prefetch:1
  2⤵
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4232,i,7485068656979251159,2540881071380668490,2097152 --field-trial-handle=2852,i,16328574975784091729,1693179700390648350,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:2
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4976,i,17270406573419459888,17787065975904571627,524288 --field-trial-handle=2852,i,16328574975784091729,1693179700390648350,262144 --variations-seed-version --mojo-platform-channel-handle=4000 /prefetch:8
  2⤵
  PID:1688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5236,i,10781672519491793063,9072423512795790522,524288 --field-trial-handle=2852,i,16328574975784091729,1693179700390648350,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:8
  2⤵
  PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5408,i,16850809390016559523,8310086064117027055,2097152 --field-trial-handle=2852,i,16328574975784091729,1693179700390648350,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:1
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=3804,i,17923765612952183234,17070864516534258707,2097152 --field-trial-handle=2852,i,16328574975784091729,1693179700390648350,262144 --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:1
  2⤵
  PID:960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5756,i,98911646539339593,8949504072475481424,2097152 --field-trial-handle=2852,i,16328574975784091729,1693179700390648350,262144 --variations-seed-version --mojo-platform-channel-handle=5740 /prefetch:1
  2⤵
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,7353448506776983494,12881004412977549104,524288 --field-trial-handle=2852,i,16328574975784091729,1693179700390648350,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:8
  2⤵
  PID:3904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5408,i,13917325942155172308,8799674623466383161,524288 --field-trial-handle=2852,i,16328574975784091729,1693179700390648350,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:8
  2⤵
  PID:2312
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5284,i,5690840004260850374,18313645769361916436,524288 --field-trial-handle=2852,i,16328574975784091729,1693179700390648350,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:8
  2⤵
  PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5284,i,5690840004260850374,18313645769361916436,524288 --field-trial-handle=2852,i,16328574975784091729,1693179700390648350,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:8
  2⤵
  PID:2720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6656,i,16466061781203950764,5319859301163275950,524288 --field-trial-handle=2852,i,16328574975784091729,1693179700390648350,262144 --variations-seed-version --mojo-platform-channel-handle=6648 /prefetch:8
  2⤵
  PID:4124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,13962044643247955920,6509415863248923526,524288 --field-trial-handle=2852,i,16328574975784091729,1693179700390648350,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:8
  2⤵
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3600,i,14870010361649550839,11017717654728843382,524288 --field-trial-handle=2852,i,16328574975784091729,1693179700390648350,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:8
  2⤵
  PID:564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7256,i,18181120892591208043,14880877906794387982,524288 --field-trial-handle=2852,i,16328574975784091729,1693179700390648350,262144 --variations-seed-version --mojo-platform-channel-handle=7260 /prefetch:8
  2⤵
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7248,i,6555977723740404479,4518031666309810140,524288 --field-trial-handle=2852,i,16328574975784091729,1693179700390648350,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:8
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7220,i,16058220145643835174,11645542017583592100,524288 --field-trial-handle=2852,i,16328574975784091729,1693179700390648350,262144 --variations-seed-version --mojo-platform-channel-handle=7544 /prefetch:8
  2⤵
  PID:4024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7348,i,8004585850295312074,1036149629918632931,2097152 --field-trial-handle=2852,i,16328574975784091729,1693179700390648350,262144 --variations-seed-version --mojo-platform-channel-handle=7344 /prefetch:1
  2⤵
  PID:5208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=3524,i,8584182482705297394,12111050998923734034,2097152 --field-trial-handle=2852,i,16328574975784091729,1693179700390648350,262144 --variations-seed-version --mojo-platform-channel-handle=4948 /prefetch:1
  2⤵
  PID:5348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=5692,i,11227197700773160268,15757968649912445332,2097152 --field-trial-handle=2852,i,16328574975784091729,1693179700390648350,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:1
  2⤵
  PID:5432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3612,i,14451337953490189908,17044451634523259245,524288 --field-trial-handle=2852,i,16328574975784091729,1693179700390648350,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:8
  2⤵
  PID:5440

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4564

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4436

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\DeltaExecutor\" -ad -an -ai#7zMap12807:88:7zEvent28032
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1552

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\DeltaExecutor\README.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:4652

C:\Users\Admin\Downloads\DeltaExecutor\DeltaExecutor.exe
"C:\Users\Admin\Downloads\DeltaExecutor\DeltaExecutor.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://dw.xrsdownload.com/d/OBHCGJB?title=DependencyCore&tracker=DE
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://dw.xrsdownload.com/d/OBHCGJB?title=DependencyCore&tracker=DE
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2720
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x2ec,0x7ffe7e6fc188,0x7ffe7e6fc194,0x7ffe7e6fc1a0
      4⤵
      PID:716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1768,i,1645543508361768417,8251591882576525781,524288 --field-trial-handle=2308,i,12842676903541374616,10492220341816451529,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:3
      4⤵
      System Time Discovery
      PID:4492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1664,i,2121876621388756740,5601939823888996321,262144 --field-trial-handle=2308,i,12842676903541374616,10492220341816451529,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:2
      4⤵
      PID:6108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2528,i,16180284700911376519,13905157736144239116,524288 --field-trial-handle=2308,i,12842676903541374616,10492220341816451529,262144 --variations-seed-version --mojo-platform-channel-handle=3124 /prefetch:8
      4⤵
      PID:2600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3420,i,762722268125993744,10188708501170962110,2097152 --field-trial-handle=2308,i,12842676903541374616,10492220341816451529,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
      4⤵
      PID:5360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3424,i,3546064524793094218,15773444539276907337,2097152 --field-trial-handle=2308,i,12842676903541374616,10492220341816451529,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
      4⤵
      PID:5380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4872,i,7537009566598602605,13512575187471727680,2097152 --field-trial-handle=2308,i,12842676903541374616,10492220341816451529,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:1
      4⤵
      PID:2432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3400,i,6744748674940111493,13686599975528661567,2097152 --field-trial-handle=2308,i,12842676903541374616,10492220341816451529,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:1
      4⤵
      PID:3912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3388,i,6595470110776143266,9427070320177539342,524288 --field-trial-handle=2308,i,12842676903541374616,10492220341816451529,262144 --variations-seed-version --mojo-platform-channel-handle=3816 /prefetch:8
      4⤵
      Modifies registry class
      PID:5964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5236,i,4715337867375603573,16804628683417269977,524288 --field-trial-handle=2308,i,12842676903541374616,10492220341816451529,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:8
      4⤵
      PID:6044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5580,i,2228932919572368986,8945450489278997716,2097152 --field-trial-handle=2308,i,12842676903541374616,10492220341816451529,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:1
      4⤵
      PID:4192
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5788,i,10986120823221375143,786439941228103999,2097152 --field-trial-handle=2308,i,12842676903541374616,10492220341816451529,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:1
      4⤵
      PID:4596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5828,i,11766849852361553128,3587071007212251356,2097152 --field-trial-handle=2308,i,12842676903541374616,10492220341816451529,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:1
      4⤵
      PID:5664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6044,i,14359671147172511740,6228003688800313065,524288 --field-trial-handle=2308,i,12842676903541374616,10492220341816451529,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:8
      4⤵
      PID:5480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5200,i,8729009430481644072,6405672138896667575,524288 --field-trial-handle=2308,i,12842676903541374616,10492220341816451529,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:8
      4⤵
      PID:4260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5148,i,16881365403450705687,12086858456281602574,524288 --field-trial-handle=2308,i,12842676903541374616,10492220341816451529,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:8
      4⤵
      PID:344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6840,i,11645091607127030526,3480137359256442732,2097152 --field-trial-handle=2308,i,12842676903541374616,10492220341816451529,262144 --variations-seed-version --mojo-platform-channel-handle=3400 /prefetch:1
      4⤵
      PID:2104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6964,i,9270115078526630695,7168114029873414669,524288 --field-trial-handle=2308,i,12842676903541374616,10492220341816451529,262144 --variations-seed-version --mojo-platform-channel-handle=6976 /prefetch:8
      4⤵
      PID:5992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7192,i,11520248449843846263,13277905783781038632,524288 --field-trial-handle=2308,i,12842676903541374616,10492220341816451529,262144 --variations-seed-version --mojo-platform-channel-handle=7208 /prefetch:8
      4⤵
      PID:5032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7192,i,11520248449843846263,13277905783781038632,524288 --field-trial-handle=2308,i,12842676903541374616,10492220341816451529,262144 --variations-seed-version --mojo-platform-channel-handle=7208 /prefetch:8
      4⤵
      PID:1392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
      4⤵
      Checks processor information in registry
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      PID:5380
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ffe7e6fc188,0x7ffe7e6fc194,0x7ffe7e6fc1a0
        5⤵
        
        PID:5248
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1884,i,2003172866377835648,16820450431205337108,524288 --field-trial-handle=3228,i,9809526910257959919,9457960186093317616,262144 --variations-seed-version --mojo-platform-channel-handle=3248 /prefetch:3
        5⤵
        System Time Discovery
        
        PID:960
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1716,i,11016739875598531251,2813143161041521428,262144 --field-trial-handle=3228,i,9809526910257959919,9457960186093317616,262144 --variations-seed-version --mojo-platform-channel-handle=3224 /prefetch:2
        5⤵
        
        PID:5996
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2276,i,17903834342567772855,17965897004880984148,524288 --field-trial-handle=3228,i,9809526910257959919,9457960186093317616,262144 --variations-seed-version --mojo-platform-channel-handle=3256 /prefetch:8
        5⤵
        
        PID:4736
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4468,i,11000720330140457321,5549446499194584466,524288 --field-trial-handle=3228,i,9809526910257959919,9457960186093317616,262144 --variations-seed-version --mojo-platform-channel-handle=4524 /prefetch:8
        5⤵
        
        PID:4200
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4468,i,11000720330140457321,5549446499194584466,524288 --field-trial-handle=3228,i,9809526910257959919,9457960186093317616,262144 --variations-seed-version --mojo-platform-channel-handle=4524 /prefetch:8
        5⤵
        
        PID:5388
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=120,i,14793549714416853352,15407659176945961057,524288 --field-trial-handle=3228,i,9809526910257959919,9457960186093317616,262144 --variations-seed-version --mojo-platform-channel-handle=4788 /prefetch:8
        5⤵
        
        PID:5180
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4504,i,3606803794181888949,1740863532724509672,524288 --field-trial-handle=3228,i,9809526910257959919,9457960186093317616,262144 --variations-seed-version --mojo-platform-channel-handle=4752 /prefetch:8
        5⤵
        
        PID:1028
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4528,i,14096759084649612070,8135791042061848061,524288 --field-trial-handle=3228,i,9809526910257959919,9457960186093317616,262144 --variations-seed-version --mojo-platform-channel-handle=4828 /prefetch:8
        5⤵
        
        PID:1588
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5044,i,9313356058874293637,822079797393580272,2097152 --field-trial-handle=3228,i,9809526910257959919,9457960186093317616,262144 --variations-seed-version --mojo-platform-channel-handle=5088 /prefetch:1
        5⤵
        
        PID:5868
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5080,i,13099223040931966424,4580803075066545916,2097152 --field-trial-handle=3228,i,9809526910257959919,9457960186093317616,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:1
        5⤵
        
        PID:3828
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5584,i,15017576659033451460,16565822891231777482,524288 --field-trial-handle=3228,i,9809526910257959919,9457960186093317616,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:8
        5⤵
        
        PID:4644
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5568,i,10138867126788295710,15916367341616755075,524288 --field-trial-handle=3228,i,9809526910257959919,9457960186093317616,262144 --variations-seed-version --mojo-platform-channel-handle=5660 /prefetch:8
        5⤵
        
        PID:3904
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6040,i,6524098800191285744,4697762603112279349,2097152 --field-trial-handle=3228,i,9809526910257959919,9457960186093317616,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:1
        5⤵
        
        PID:4828
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6212,i,8815518002737809204,14761762008285707348,2097152 --field-trial-handle=3228,i,9809526910257959919,9457960186093317616,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:1
        5⤵
        
        PID:6000
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6376,i,3558348575056369170,1915270011374473435,524288 --field-trial-handle=3228,i,9809526910257959919,9457960186093317616,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:8
        5⤵
        Modifies registry class
        
        PID:5652
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6372,i,12222681233897081636,18334378775999617727,524288 --field-trial-handle=3228,i,9809526910257959919,9457960186093317616,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:8
        5⤵
        
        PID:4616
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
        5⤵
        Drops file in Program Files directory
        Checks processor information in registry
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        
        PID:556
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffe7e6fc188,0x7ffe7e6fc194,0x7ffe7e6fc1a0
        6⤵
        
        PID:1148
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1956,i,4121829446474421135,18402636417760130574,524288 --field-trial-handle=2304,i,12066340765096311435,14207838840132998957,262144 --variations-seed-version --mojo-platform-channel-handle=2408 /prefetch:3
        6⤵
        System Time Discovery
        
        PID:3252
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1736,i,16532103980741982906,15008820160678530960,262144 --field-trial-handle=2304,i,12066340765096311435,14207838840132998957,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:2
        6⤵
        
        PID:2484
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2524,i,10009168295723855132,14082842996336076771,524288 --field-trial-handle=2304,i,12066340765096311435,14207838840132998957,262144 --variations-seed-version --mojo-platform-channel-handle=2760 /prefetch:8
        6⤵
        
        PID:5460
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4572,i,17831759555689940555,1355546418320052073,524288 --field-trial-handle=2304,i,12066340765096311435,14207838840132998957,262144 --variations-seed-version --mojo-platform-channel-handle=4588 /prefetch:8
        6⤵
        
        PID:5672
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4572,i,17831759555689940555,1355546418320052073,524288 --field-trial-handle=2304,i,12066340765096311435,14207838840132998957,262144 --variations-seed-version --mojo-platform-channel-handle=4588 /prefetch:8
        6⤵
        
        PID:5920
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4440,i,5173898612917754994,7148870077463121895,524288 --field-trial-handle=2304,i,12066340765096311435,14207838840132998957,262144 --variations-seed-version --mojo-platform-channel-handle=4792 /prefetch:8
        6⤵
        
        PID:1472
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2084,i,6657400186883337339,10565926160006761682,524288 --field-trial-handle=2304,i,12066340765096311435,14207838840132998957,262144 --variations-seed-version --mojo-platform-channel-handle=4800 /prefetch:8
        6⤵
        
        PID:5608
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4796,i,10695225088386790203,9537057874084386659,524288 --field-trial-handle=2304,i,12066340765096311435,14207838840132998957,262144 --variations-seed-version --mojo-platform-channel-handle=4852 /prefetch:8
        6⤵
        
        PID:5312
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5052,i,1301601769409176214,9711350590521196056,524288 --field-trial-handle=2304,i,12066340765096311435,14207838840132998957,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:8
        6⤵
        
        PID:5156
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4888,i,14665689827667750470,9813244605641286919,524288 --field-trial-handle=2304,i,12066340765096311435,14207838840132998957,262144 --variations-seed-version --mojo-platform-channel-handle=4880 /prefetch:8
        6⤵
        
        PID:2132
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3052,i,2100173429860975106,9677865384070850857,524288 --field-trial-handle=2304,i,12066340765096311435,14207838840132998957,262144 --variations-seed-version --mojo-platform-channel-handle=4856 /prefetch:8
        6⤵
        
        PID:4228
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=4468,i,12806434150373392252,14112512651919598360,2097152 --field-trial-handle=2304,i,12066340765096311435,14207838840132998957,262144 --variations-seed-version --mojo-platform-channel-handle=5104 /prefetch:1
        6⤵
        
        PID:5516
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3612,i,5317065317714345438,16925820380368730322,2097152 --field-trial-handle=2304,i,12066340765096311435,14207838840132998957,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:1
        6⤵
        
        PID:3188
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5596,i,12987580548748773679,15002831616870958567,524288 --field-trial-handle=2304,i,12066340765096311435,14207838840132998957,262144 --variations-seed-version --mojo-platform-channel-handle=4832 /prefetch:8
        6⤵
        
        PID:4552
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5604,i,10869276277919605833,6678781011765999510,524288 --field-trial-handle=2304,i,12066340765096311435,14207838840132998957,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:8
        6⤵
        
        PID:3228
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6040,i,11167822754660106184,9352712646438775812,2097152 --field-trial-handle=2304,i,12066340765096311435,14207838840132998957,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:1
        6⤵
        
        PID:3960
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
        6⤵
        Enumerates system info in registry
        
        PID:1824
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffe7e6fc188,0x7ffe7e6fc194,0x7ffe7e6fc1a0
        7⤵
        
        PID:4364
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1868,i,16955157145189540440,10865150241390194845,524288 --field-trial-handle=3260,i,18410497075588765944,10280426672739538181,262144 --variations-seed-version --mojo-platform-channel-handle=3388 /prefetch:3
        7⤵
        System Time Discovery
        
        PID:3412
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1752,i,8166120861769508389,15066854360704391106,262144 --field-trial-handle=3260,i,18410497075588765944,10280426672739538181,262144 --variations-seed-version --mojo-platform-channel-handle=3256 /prefetch:2
        7⤵
        
        PID:4980
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2204,i,6903014207088693211,3412897856932666519,524288 --field-trial-handle=3260,i,18410497075588765944,10280426672739538181,262144 --variations-seed-version --mojo-platform-channel-handle=3396 /prefetch:8
        7⤵
        
        PID:1880
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4216,i,15435247028424241317,15386475059259537115,524288 --field-trial-handle=3260,i,18410497075588765944,10280426672739538181,262144 --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:8
        7⤵
        
        PID:4880
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4216,i,15435247028424241317,15386475059259537115,524288 --field-trial-handle=3260,i,18410497075588765944,10280426672739538181,262144 --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:8
        7⤵
        
        PID:2524

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1816

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5732

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1412

C:\Users\Admin\Downloads\DependencyCore_415289.exe
"C:\Users\Admin\Downloads\DependencyCore_415289.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5944
- C:\Users\Admin\AppData\Local\Temp\7zS8373AAF9\setup.exe
  .\setup.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:5244
- - C:\Users\Admin\AppData\Local\Temp\vcredist_x86.exe
    C:\Users\Admin\AppData\Local\Temp\vcredist_x86.exe /q
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1140
  - - \??\f:\9ede2c366d33d742ae71b30534a10e\install.exe
      f:\9ede2c366d33d742ae71b30534a10e\.\install.exe /q
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1504

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2168

C:\Users\Admin\Downloads\DeltaExecutor\DeltaExecutor.exe
"C:\Users\Admin\Downloads\DeltaExecutor\DeltaExecutor.exe"
1⤵
- Executes dropped EXE
PID:4256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://dw.xrsdownload.com/d/OBHCGJB?title=DependencyCore&tracker=DE
  2⤵
  PID:3752

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:448

C:\Program Files (x86)\BZFlag2.0.16\bzflag.exe
"C:\Program Files (x86)\BZFlag2.0.16\bzflag.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:6044
- C:\Program Files (x86)\BZFlag2.0.16\bzfs.exe
  bzfs -pf -h -mp 40 -ms 1 -f bad +s 10 -g
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5868
- C:\Program Files (x86)\BZFlag2.0.16\bzfs.exe
  bzfs -pf -h -mp 40 -ms 1 -f bad +s 10 -g
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:536
- C:\Program Files (x86)\BZFlag2.0.16\bzfs.exe
  bzfs -pf -h -mp 40 -ms 1 -f bad +s 10 -g
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5396
- C:\Program Files (x86)\BZFlag2.0.16\bzfs.exe
  bzfs -pf -h -mp 40 -ms 1 -f bad +s 10 -g
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4400
- C:\Program Files (x86)\BZFlag2.0.16\bzfs.exe
  bzfs -pf -h -mp 40 -ms 1 -f bad +s 10 -g
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2552
- C:\Program Files (x86)\BZFlag2.0.16\bzfs.exe
  bzfs -pf -h -mp 40 -ms 1 -f bad +s 10 -g
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4364
- C:\Program Files (x86)\BZFlag2.0.16\bzfs.exe
  bzfs -pf -h -mp 40 -ms 1 -f bad +s 10 -g
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5636

C:\Users\Admin\Downloads\DeltaExecutor\DeltaExecutor.exe
"C:\Users\Admin\Downloads\DeltaExecutor\DeltaExecutor.exe"
1⤵
- Executes dropped EXE
PID:5640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://dw.xrsdownload.com/d/OBHCGJB?title=DependencyCore&tracker=DE
  2⤵
  PID:3148

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1080

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5a0c97.rbs

Path C:\Config.Msi\e5a0c97.rbs
Size 25KB
SHA256 ff2eba813bbe0e5c39a0a339149390a3e3452aa36dc2b3f956ea382e763e2785
MD5 8cdb8701f6a883dfac8a88ae46a9894c
SHA1 fead478eb813c506dfcc2947e712fb5841cbe018
SHA512 c95ad3360f6a3f4ae17593643c8db4c488e5df0f5afba24b022df8644ba3198e86efc0388583a6497d925eb8bbfad39d6e2e413c6af6006bfd0a25bc9eeec620
SSDEEP 384:2T8m8KjfYwwlCpmJ8HpZp/u8Au8rXFVK+8bKu8g:2bjgPlCpmCTFKJXfK22
TLSH
T1E2C25402C602E6D3DD8A4B70DA737FA5F79B93B5C705834F02CDA1206D9A7CD4A542AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files (x86)\BZFlag2.0.16\Uninstall.exe
Size 102KB
SHA256 b942ba3b8ea0cbe8c3fc6c892f129a70e712d4abb8581692de8d077dabba9907
MD5 6dc878f4492c6e2160bda454d14c09c3
SHA1 9d66a8c2fedaf871764d24041ee193adbbc4b010
SHA512 2b40d69f7f40b86dd7f23b1df39b0fb4f99e30ce0996aa2a424019b6501c96ac6cead0cd468b5031af091060e48be650f7c5eea5817adea3e3b14d0cb1db1c01
SSDEEP 3072:GQIURTXJn65o5cQXk2ARf8yu+Pbv+mj7mXUG:GsQWM2o8ci2Ut
TLSH
T101A3E126E1D49CDFE4C689710BEF8A76D674B303D20423536FF06F9B1D21183AA16A96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bzflag.exe

Path C:\Program Files (x86)\BZFlag2.0.16\bzflag.exe
Size 1.7MB
SHA256 13e4b5b517c7c7d7b3791727b84f3ee4bccb0912ed55327e3802e143d0a3a14a
MD5 2d20264cd9336ad64e8761a8167e9531
SHA1 14d70ae63de6963c9d491c2f42d150db35328896
SHA512 528da7097ac6253dc3698216fcc128ab851d56aef6df09c5bc65dc9c91e6a203a6c55fed5a4cda074c1095fa4879cdc38b0a2847d4b59766441cc1b16388646d
SSDEEP 24576:kKhtWSpZ9Flxb7m01/3xHCT2BM2xo2NT0spFMT4u01M9tj:BoSnlxb601/hC2By2NTrpFMTB016
TLSH
T1CA855C02E759E0B7E9CB2DB040570A5E7E606758033957F3B7E45DBA8AF1EF2A830245
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bzfs.exe

Path C:\Program Files (x86)\BZFlag2.0.16\bzfs.exe
Size 1.1MB
SHA256 c76f804fc86933f1f6421a025bcfaff1ef2652716161b0b2457497854420042e
MD5 e9cc1fdde5a6dbe38189a639d9c748db
SHA1 ff002f242078b366166a717644417212c0c68328
SHA512 bc2b801dda9a2a08d35a3b9c868c7b999a306166371b6badcd053df7cb96abc1f1b497e24f180c0bc29f47f7019790d3b5a3e0cbbe781b8f8707f4bd2a16287a
SSDEEP 24576:Bz3IrjNgnGDmxTJsSMeP86S4fhGc+udJ09T26QkLlV0:BzkjkGksSMS86/fccaT26QkY
TLSH
T19A359E51E787D033CB8221B544A6872E7224674F873159D3F7D859CE4A22ED1FCFA28A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping556_1482611851\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping556_1792185853\manifest.json
Size 135B
SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
MD5 fbebd68ecaa98928909421f66909c054
SHA1 99d787d90f7ed2e5ad924f9c5668eb988b5a6c07
SHA512 749a3b2be47fe28399dc763888654a3e8d397e06e8d3c3af3965bb45846a1336e6ab4ca82c82c3df846b34a2afafa2156f2690e9bf347ab175408dc0171c61cc
TLSH
T158C04C668D51DEAB00A747A56B295315E23B4B4B5044800A7AF5429C1A288964171944
MD5 SHA1 SHA512 TLSH

Submit Download

123838ad-94a4-4b3b-9d40-371df8a2e62c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\123838ad-94a4-4b3b-9d40-371df8a2e62c.tmp
Size 26KB
SHA256 7808968e7fe0eff67346ab4492d338fe1b69fb95df10a984b31f0d461b3032d4
MD5 afba8a57649a5f96db195563c7287a6d
SHA1 9b951d0595bb5fea498557c3c8f1c6c105c000f0
SHA512 0011d948222b5f767013ac34d2e2d512aa216feecef2ea68b5f6da06fc536f58fd8203ecc413dbaa7bfd0d29edf3dfb894015e0ad5908e616cf610e697ee34bf
SSDEEP 384:yotNnNnb9z3sNOEFEHGPj2f+D8h8RX/uk6Lv/AS397o/Q49i4Qk8f8jZALEnL2Fd:BjZbB38Hjmn8/x6oS6/Q49i4Q6vHs
TLSH
T16DC25C759465ACE708D1E5C9A646F6033EF90137C9896A4CE7FCBB3A309F1F82306865
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
Size 3KB
SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
MD5 1de85fec2dfcc28011a7c2aaab95eb5f
SHA1 80e8c954bfbe8f7ee5a2335c8d969ae033935dc3
SHA512 9c7dd37eb0c094b6aa05201e7c71a8f33b9db81284223bcfa595a44a6ac95d5a6820ab6f07b7aa8d26bf207454e94277bf35332e9c009ee63f083752b6b51750
TLSH
T1D1611DB79A3048090E3412B86B19B35DF63E029F1AD598EB76BE568F1F710F7245C54C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6de34b260036ecaa4ce5839bc4a7ff7495e50b7b94349b12d9f840ca0e76da3b
MD5 56d82099872fb501c566d072ae897035
SHA1 2c96501551fc13c09496780960d8e7ccb4957b77
SHA512 c4b4017256caf25e88f146e6104134cddfd15089203e8e74c5196627fc92897f9fe7e3fc5c8305032be88e9409cdbc5dfe1e81017fcd5e38b3579b3d823b4a41
TLSH
T160D0C073378C7C00EA090170D013C3031FA7855824C39F03B100C01C54B43D9738B093
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b3aa46f376e5e174f60e9497e3adadf1b65ad7e49f846de19978e5ae1a6d69b5
MD5 5eaa6ae1f3209db21fa12c2d1df16b36
SHA1 44b73a414b7845cedef7f55f48dd8c82b64598a3
SHA512 687636e7b00791052ae8ceba7a2bf770306f20943eba63e275f970194ea3fdf30c2e29fa032d16ae0a0c8c213f7cc2f1aa495d1ac099902fb6b7afa8855b101f
TLSH
T112D0A7383299AC82D1881835490983463FDE8C8874E7AA22130698194DA36D6F599467
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b651c76f7cd6e8dcd161c3ad640c7e1f59b3cacd6feb59b3dbfec4c087c51685
MD5 d49a66b18ec3a1eccad067300770154f
SHA1 f1434cd9d110f408e35e9c72fdf70e66d37c651d
SHA512 821a3d48329ba2d335705302c77a5ca71692f5d9df188b1d06607a2fd1abe7f17dafb398804b9eee3b4bdb54f7da5e01ade3707fbd980b23c56c125eb0fb97df
TLSH
T177D0A7383289AC82D1881831490983463FDE8C88B4E7AA22120658094DA36D6F59A46B
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f5dece638cd89af82b06bd2fcb3d1738eef64d2275be237184ea8bff7af3fdfa
MD5 f19ec2293392af872f10929c41627e26
SHA1 0576f5277c470f5bb8c3f4d3786ca8d967d0a33e
SHA512 4cc85dc71d34bb516f8fe45b565a6a9b4cda255a931f33289247ed84150baf0e2df40fc87109df41771553b92545ed858197cdd3d673694c83458cf9812aa9dd
TLSH
T16CD02272268C6C00EA090170D01383021EA6855824839B03A100C01C44A52D9728A093
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 759ca84056c056849785a4082be7da8c40153780ce6329985fd3aec9d25d2870
MD5 71d58a2147fa57281670e21384065d46
SHA1 998a79684437b71d6cc6792806afc77a38bc5007
SHA512 b6506dd7cfb9dcc092bd9efe161dfd3858a487cc3dcd9cc7b66764370ead13c4b7caac70eb4ed66871211e48ce5792cb6dec76293d288a019963150f9f43892f
TLSH
T1BBD09730329AECC2D0281034881003022FCC89852083A20222008C0D8CB22C2B189897
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 91cfeeb83d514469900405b7d1ff82e989341ea098f5d71b3b605a74fba21910
MD5 8cddbc1b5a65f8734a8a7d4773c7c277
SHA1 ffd5f5ce6d65de9ddd2d24020ea7c7c5b24fdfbb
SHA512 e9c6f96b01feee92979fa2e126ad0cf04fdeb7208c26881cd7fa2cb4ccfbb1d348de5bffe7cb669a15778cd738c922e67ef6fcb3f05c4b4aa04c367392083d43
TLSH
T108D0A7383289AC82D1881831490983463FDE8C8874E7AA22120648095DA36D6F599467
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0257a7886cade48334781c50ab4bf600214cdf4f1c3086a673df311b4d96416d
MD5 758984c20713b2debbddd1aea232f5b5
SHA1 f8bbedf9f92404906f4832d5305aaa33334ddef2
SHA512 bf2b65c8affb56247d87bcb2ee648f977e4d419eef5d041f334c1abcc0d56bec3a4cda03202f3ba607a0a62c2b607c4adf5b1566dfb147c6e8848b092829b75c
TLSH
T155D0A7383289EC82D18818318D1983463FDE8CC874E7AA22120648094DA36D6F599467
MD5 SHA1 SHA512 TLSH

Submit Download

028299fe-3214-435f-b3d6-cd89ce6c5a39.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\028299fe-3214-435f-b3d6-cd89ce6c5a39.tmp
Size 414B
SHA256 7f87ce5526eebe67e5b867c08d96971cf67c6689539b41449dfa24a04a069759
MD5 08f3d7bc27e947e92e9e9807cc9628f6
SHA1 453f1730fa1b628339730d533aba53bc5b8dc633
SHA512 04ab0dcabb6840b02f6efdbd7c2d8337907b466d0d30a6077891f1047da6690096f5e2a043f5662db0fb4113a6fe985f8f4f6ca7f4b328bccdeee2149d463c8a
TLSH
T18EE02BA9DD21DC3708F9071930545785FB0013562740560F3A3DE20D8FB663B824685C
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 4867da05f88d72de815d3bd979ceeb26f933b336db01b8fc0ecbad7c315fdab9
MD5 33025edc6a7ce6b76a2e4c0bd2ebadf6
SHA1 82ff851b8c0ae85ee58e58f31f42c68bdf394c0b
SHA512 62ca414d8c6a2cb56fff79103d366e494a91ca834703b54ee16e541601df03be0525b38915a1aecc7e94e6e71065106b6118eaaef9b74d01566e8f7247e83199
SSDEEP 96:8MbIDPgUU2bDaVA9s8Z5j7CIW3yrV5q0+c:74fJWuiC5ClCrrP
TLSH
T12A9193088B435C43E7909E34DBF102357A369658052F6D7A2270DBFF5F0BB518266C68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 ab3d1a7f9e61e128bbf56d583f3edd7554c82ee5077a4389df05e8393ebfeb92
MD5 1ede4c8e88395e732d0110da1329c006
SHA1 39cb39b1e85f5a62445eee4d6ef6297f28aa2e32
SHA512 51fe1e63eeedeae6756102ef948861091369da2e3a2255ce7a5add44a4162f5e1695aaf16466c1e1da2e673a70c1382204f0c66387c59feb334bc9dd61eabfae
SSDEEP 96:NUcuQLCNI9KB+I+ueixHpyuLW6Eiv+mueUgqq:NUcdGNJB1Yuq6R7UgF
TLSH
T1109192088B435C43E7949E74C7F106753A36A694092F2E7A2374CBFF1B0BF528266D68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 d6c5dc201088285d4d31dcc44d6bae26f11cfcb2b22243c6c09465fd36481d3b
MD5 c23d5fe7bada9d0b9bbcbd909b5c16f2
SHA1 eee9e412808db9639a253d04b3556331ee68b93e
SHA512 53b322666c3fa887eb6be87cc2626cba88913178558a4f68f7f9e76745d1d04583d86508ce94a3638110099a74620684851f7ec7e5892ecf15ad54f21e9b4895
SSDEEP 96:cXHI/+QQkdJ7wRTXpzsG0y2+9mFAwojyxUH:GU7cTXpwGHYmOxQ
TLSH
T1529182048B435C43E7909E74DBF106353A369698052F2D7A2774CBFF6B0BB528266D68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58caec.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58caec.TMP
Size 3KB
SHA256 8741a3718cee49b381737d8a2ce68fa28c35d92636c7ad1064f5947cbcc0830f
MD5 f2e07a9bcd9a7d0ce2a71135aaca2c9e
SHA1 19b07e4be903f4a7945fb941abc0f0c8e4ef6e5d
SHA512 2ac631b10c51890a19b8c1f91d98d8a803bec4ebdcae9bd2554665d534fd9c094022f111f885f9a6cde763282b502ec2133a8c1333522c9515753cde98b2af69
TLSH
T1A2714E19CB834C53EB018E34D7F102B175324B98466F5D7A2174CBFF6E0EB218519D28
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

computed_hashes.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_1\_metadata\computed_hashes.json
Size 429B
SHA256 b829b0df7e3f2391bfba70090eb4ce2ba6a978ccd665eebf1073849bdd4b8fb9
MD5 5d1d9020ccefd76ca661902e0c229087
SHA1 dcf2aa4a1c626ec7ffd9abd284d29b269d78fcb6
SHA512 5f6e72720e64a7ac19f191f0179992745d5136d41dcdc13c5c3c2e35a71eb227570bd47c7b376658ef670b75929abeebd8ef470d1e24b595a11d320ec1479e3c
TLSH
T10AE055170A1A50B79BB8DB90EE525CA2E8A0A6B1C50438D63E608234B68A11F738347D
MD5 SHA1 SHA512 TLSH

Submit Download

verified_contents.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_1\_metadata\verified_contents.json
Size 1KB
SHA256 d23b2ba94ba22bbb681e6362ae5870acd8a3280fa9e7241b86a9e12982968947
MD5 738e757b92939b24cdbbd0efc2601315
SHA1 77058cbafa625aafbea867052136c11ad3332143
SHA512 dca3e12dd5a9f1802db6d11b009fce2b787e79b9f730094367c9f26d1d87af1ea072ff5b10888648fb1231dd83475cf45594bb0c9915b655ee363a3127a5ffc2
TLSH
T12B317466C8683D56267A63348E2D0602EB57C2BB0050640EB5AC558D4F7115FE242FAF
MD5 SHA1 SHA512 TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 28KB
SHA256 78e889dd1e9aec689e21ea8d413755732996d1159ef52c2f4dc3e6b95f219d0a
MD5 9d6a40b09b477e27805fcfde67ccee7f
SHA1 fd15c84f368dd1116a34779eb5a5b49b2b723c21
SHA512 8da4e8b7770bd876fa4ef56d71fdf1834fbdf863df11c4eb6427daac2a6d4b479856b7473aac38b51d7c33b03fcaf7545cc95f9ac68ee88b1d006862557d6aa8
SSDEEP 96:BBCJ6zeF5YtEFEbtMCvnzXPbbXpT7wPFdbKPN9UDRCL5x1m+mRmcuID60jqp:3I6zeF5YtE+bnzDb5T8tdWvUDRSBr
TLSH
T1E6D24A57EEB8B017EB451B3A3E160C7ADC3302581FD16DAAF23A9C2055351D1B27966C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\t\Paths\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_0
Size 44KB
SHA256 4474267f68b38bcea81b2d834ddd76e03bc7e087e1b4671d62f369ee09d78e78
MD5 41a4bd31a44c3bd6aec86b9cd5366548
SHA1 684d85f93c78a98961bf5192c5d8d9ef8fe5bd8f
SHA512 6417853ebf5f44c8b27a86f8ac722ff24c2610e8a3822e298f5925f84b6ba481d5836aab064a7e685915a6d657d1d633f1e58c985be9ea68a75effcb28d9c43a
SSDEEP 12:d4YX+CQEmr30qSslrMzlWio/TdjvX2nJP:d4Y8E630qSwio/TdjvX2n9
TLSH
T1C113D87D97503937DBC23037810D4FB40331C62AA9E321555EF6B4142712C270337384
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_0
Size 44KB
SHA256 3566dffac9795eda94f14c4df6408c11c7f76e2bf5102ce895baecff0ba37e85
MD5 8d831e26512b3f8d8548551eefa279e9
SHA1 8fb2b1b8398ea0c09cc193e229b3084352a7e44f
SHA512 793ece0902f1f4dfef1bf40eadf7fc4007e2ebd8effce89440d149cc738ec7e891f782c0eef9d68e2b4cc6d78822ca7abd9cf490e81a9df1bc69eb11943f315a
SSDEEP 6:/Fii2EtsUkM/lmr4shqzLa/22btU9DtuzlrMcolSlJ7:dHQEmr30qSslrMzlWJ
TLSH
T13613127CCA811C0FEFC70074990D4FB40323C1695AE352521965B068571552243B2341
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1
Size 264KB
SHA256 c437537cc4067b946b3c0b6c158454d63b1bf7ffc32e65cc534fcf04a9e8ff61
MD5 0ccc483672aeaf65c6c782c4ab376ee4
SHA1 1f60223e7ae77e3c30f278817ed7e41709118b7a
SHA512 d07e7fb766004eb338922d199cbbe35ec6edb4c246e0dd0ccdb3ad3f47bbbb72e705600e2b94cdbbb2307fafb8fdef720b5eb1befb128f84fdc1bdbd4e05d2aa
SSDEEP 24:C3VlV588AV09V/0bV1VBpVmMgVc4fhdVIoJVPb5QVDfWV39V:EV58zV2V/eV1V7VmHVndVIuVPbGVetV
TLSH
T1B544CF2338540C92F877C9B6BA327F65EF7CD1CAE2936E53131402646EB18758FD5588
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1
Size 264KB
SHA256 7fd7a9b239ec4b60dc0a63070df38b1d641971e37d90eafb530380ace08336dd
MD5 04f676e805d108b0eb80082b4e9bfac9
SHA1 968c85b7dbae3d40b5f391b208c7eb6f3cf3ebab
SHA512 83d2534b475e36a8e4dce8e8f85e6fea1250241bde42b68217e1c4d88c0468eba6f3940e7886cf038568bf8d807ff736678903896ccf2b176bbbfd072b38911f
SSDEEP 12:U/M1CXTpzJW2l9M04X8EpzJW29XyWkpzJW2D0hLpzJW2lklNYpzJW26:JglV588AV09V/0bV1V
TLSH
T10D44AC237C444C92F867CAF5BA327F65AF7C90CAD2936B1323100268ADB28B48FD5584
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_2
Size 1.0MB
SHA256 3b8ed88cbe33add570dcb000d9db8ca4476550f46a870e22ae5942515af30bc0
MD5 3967158e41d11567e19c6734753b01eb
SHA1 74170f5b022aa0b1b6d184ccfeb9e395409d07dd
SHA512 a2537b3eafc851e7c8e775591ba8e05dd173829100b3ff4f64daba2846f77718e70b4e9700b2c1eb0c2ab6ea1f860d25d1cd2e49ec413d1cf7880271b4803575
SSDEEP 192:MdxZdCEYENlyZysnEYRwymUWLTgBPl/E6Fwlyp7L3sgi72jl:4j2ENlQdbVy8bsG7LViC
TLSH
T1BE25B0F6769207CAE28AC473243614EDDE3717278965391D890901E5B7CC3469E82F54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 204KB
SHA256 07095b37b683aa4e36623817e5b67de0e979f657abb960f5c4412b66a50b188c
MD5 347c4ba5e98ea9f343ff624b34a99cc9
SHA1 ce87b09ffb0721271f70dfb128fe8628c0f2a0a6
SHA512 dcc629dfa4635a92bd23dd42859133473814241c62b41f67c11af1b505239fc5896cfbc062c72629eda4b78fdc0835a006e47ee0aae141e707683a183d1c269c
SSDEEP 192:yTxnsf+G83uy3Ct7XBBKtx544Ql47H7DXspU3ib:+s/83uICtTBBzc7DXspU3ib
TLSH
T11114B84F5F206322CE7C41762DA719939D3EF06F8B8665AAF4721870CDE3541B12C9AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 14KB
SHA256 fa53b7a9cf0623876f3af1148f78ed98fb6548a59666953739795dcf727bc620
MD5 d41255c546104292006570f2809c3946
SHA1 f4a030a2280188ca30cbc8983221bf035d0d7cb8
SHA512 f3dbe2686dde626bf820884a972f01956d241c0cd022d37c080b856f22a8e70e97c283f396f76ea239fca63f199008c50d2497cfdb1790e1d0e5c3f26dd92f64
SSDEEP 384:DscKl9HYarqEQ0n6uFBV4xu6WcgAmcMhiuGwsb7slxCV2NqFgfg2FXrOTXUCJkII:xRPZwCO/eDY
TLSH
T1A1628EF783E8C65DC96255F1A7283A2ECE5D0524431C3D5AC9E5EF8FA3E2071E141A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 8730eee1aba3843a5cc263f3e8f2b28bb9866df6ebe68bb80e7740199dfc0fa0
MD5 ef084ae74a8d74ebdfb66d0a779671b4
SHA1 682a44f3c7ca14077e49b790c243e299f2de9075
SHA512 ce40f4755cc285d0aabb5d14028a8cc730f88aea691f5bb1d160f98ef798fa072f1043b6ad356f318e98a3066fbc77103f79202fd21185a59b581e0cac022b4a
SSDEEP 192:DscKl9HYarqEQygAmcMhiupGj6wsb7slxCV2NqFgfg2FXrOTXUCI:DscKl9HYarqEQygAmcMhiupGGwsb7slh
TLSH
T119129CF787E8C56D897255F2A7243A2ACE5C052443183D66C4E5FF8F63E3071E241A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 948ff56f83f292654f431e4cddc9d41eb776c7fc8f49f99b948919c7412e95b7
MD5 ecd6f6bd3be90482df183cff9adf655b
SHA1 c0e23d4126832db485f28005da87a672395be881
SHA512 da17a6dadb9ae8120e2ea4e45f143081990c8470bd53f8eecae630002e778dd073fee963dae7deb4e126c3090ec47afabf1c4a0893fdf9fb1e4d65300806c37c
TLSH
T1F231A0A391BEA46350385DBF0D587C152DBBE4354251A8F6EEABC27CF0914F35702036
MD5 SHA1 SHA512 TLSH

Submit Download

f1e2d42e-d0c7-4a4d-91bb-c21a418962ac.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\f1e2d42e-d0c7-4a4d-91bb-c21a418962ac.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 3fd6893c60a54b2a0eacfc0e5550f3b4820030561603bc5af29638e7165b8c39
MD5 fd7661c57ce78518d2b3c33b2fc9c31a
SHA1 03fa27503b42ff02671820dbf0b16408a7977fb7
SHA512 1504ad962f666d65fa26793c38166fe2c6cc1a05d0d8037f24581383c97a148aef473b6d45d7e0d6765e4c40bb04ddbedda1a908cf2dbf91b3daa0ec0ccb1b12
SSDEEP 192:sxZwRTyM/jK1Ml8M9i/fNsikyu0OUjIdpezjHW6+WNhfv/z/wTukIg4J:sxZwF1i/fNsikf0OU8MHbV/mc
TLSH
T15952F806AB34597BCDDBD219FA45BB53D6F94572D6900D44AAFCCB0C04E6AED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 d785916cc7eaeda7b7272ac30d2a7098b51a392fb86e4acc0a9cc7ef9c26029a
MD5 d8323291b3f83591cead5eadd009cd39
SHA1 8a190d8e425aea15dfd2086255db87b0d61b6590
SHA512 e83d0af72caa2ad4140b5279f3d91e4b859d830bbfbe7c8325fde27ee9e450d0ae665923447e738684421f304f4303419c387a5214b97e885ca92fc70e13cd7b
SSDEEP 192:sxZwRTyM/jK1Ml8P9i/fNslWpVckyu0OUyIdpezoHW6+WN5+fv/ObJchpBYdm5rV:sxZwFYi/fNslWvckf0OU77Hbk/lVMC
TLSH
T10272D757A634497B8DDB9229F541BB27D7F9042696900E94AAFCCB0C00E7BFD6203C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 454cf7dd627fc0b076068bc3c2aa91e701a0e8916dcbd7c361bf975a696b3bae
MD5 294e1e9af5b43d22b323b2ec4d266ef2
SHA1 58007abeeffbf6d3343d1ea396523abaa4399a48
SHA512 b5c01f60205ccc153bb662aa2670c6c10ae05b5ae665466a6793546c8574fe809c6d8c908d0da43bf57bfc12d680f44fe5b5b2e70af04e38d071df462c88ed7f
SSDEEP 384:sxZwCYi/fNsDWvNt1f0OUyW0dHbne/2lVWC:sINi/f2YNt19/Hbk2lr
TLSH
T14582E957A6344ABB8DD79229F541BB27D7F9442696904E84AAFCCB0C00E7BFC7102C5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 20KB
SHA256 4c82c54d7118bc2000a3ebda8ca0a3d84e90645127310ce3fc405ced6ccbb243
MD5 2f218f5df6e981a35ddd5dc9b54ca89d
SHA1 d62ba6fdabfbec7d10f353b7c21b3f0e51c3f217
SHA512 11e31349dc1758dcf6db0b41bbdca1e08fee55321e2bb14ae594be6464518b9ed0e80f973a0ca9b2a4b30b6383558af8ecab4295a36e9aea56614aea1c4a5756
SSDEEP 384:sxZwksi/fNsLWvNtJ0OUyW0YHb5R4/21VdlJ:sI7i/fGYNtH+Hb5M21T
TLSH
T1A892E857A63449BB8DDBD629F545BB67D7F9142696804E80AAFCCB0C00E7BFC310285B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 0575334159a0591e7651cc53e7c75e3cb737efb742e979fce623789c24c99294
MD5 cf8c0ad47f01d4b582d94b6d9c5aead5
SHA1 7f2734012fd1daeb90098fac19922c3727bcb9ea
SHA512 d6c8572ef4119359f21e1a737d5173003a0812b24361c111fcc84464e1c95c35f9d344c3a802cb2856f25a144242241b3153677ef164e1671323f79378af93b3
SSDEEP 384:sxZwr6i/fNshpWvNM0J0OUyW0aHbsJ+/21VMlG:sIOi/fuYNlH8Hbsu21T
TLSH
T1DF92E757A63409BB8DDBD629F541BB27D7F9142696904E80AAFCCB0C00E7BEC3102C5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 e3892d0d4fa16beb571faee310c8ac302f21bbe7ca8d9febf69b813a2a9d178e
MD5 753e87d14ff7214cf5432fcfcea62d9a
SHA1 f0f847841c013ffa07f346d1cb4f865da09e89d8
SHA512 89ff409618e59792360313eb4f9541715a3b4fad4c4709e1f9f61b661e0f6a5560696eadf18511d02c4a6d0bcaf2d664a9d2324df52e3edb556e5180631687e9
SSDEEP 384:sxZwCHIi/fNsDWvNt1f0OUyW0dHbLe/2lV2C:sIMIi/f2YNt19/Hb42l3
TLSH
T1AB92D757A6344ABB8DD79229F541BB27D7F9442696D04E84AAFCCB0C00E7BEC3102C5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 9fd5fe1aed95237a768b7242f71d4a34ec66328127a02161b0e94f9285efdef1
MD5 4f53ac975809ac049a386499c7a69485
SHA1 cfe63ffa15fa383c8618672ab3748d619b4bfdee
SHA512 ef8df1054f6e0dcb7f4969f37647b6f25e8490212f5fdc5e0cd5468d76de528f045358fb2456acf6f9af0a491a6d7ed8ad99b44e5d57d6a46e6cbbca2d4249b2
SSDEEP 768:/Q4jey87pLuLXmmWvmKxE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVsm2NPLlrZ+dYrm:/Q4jeygEXmmWvmKxEu1jah1NPLZQdjMu
TLSH
T117F20B3B290CCF7E4F844E9CED2ABE8B6DE801CB5A98895447FA444C03C66EB51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 5cd7284a86c1fb0d6e7191193c2dbd73a29377864a5820b1b07fd7cabe1174aa
MD5 91f6f6988d3971191a318f78022077d7
SHA1 51a47bf73be3078a7e32ae08eaca93b31adb8ac3
SHA512 29cc578cf5e227af0850dbf5c19edf92eb266ca61896c50a95c171631d7b99caec2b438358dfaee1c240077c9185165c00ae92662f6d51c8dd28be2f454a6b0e
SSDEEP 768:/6Ojey87pLuLXEmWvmKdE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVsm2jPLlrZ+xYry:/6OjeygEXEmWvmKdEu1jah1jPLZQxjPD
TLSH
T172F2FB3B680CCF7E4F844E9DED2AAE8B2DE802CB5A98894447F9444C03C66EF51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 338B
SHA256 a93fa00488fb80dc7812f40423015685679e5ba07b2b0be59248a19c203c53fa
MD5 6c98e5d146b5dd3f2650747d59301a2e
SHA1 1314c25d9320061345b92d47ebc4be5273432cdb
SHA512 1307d59c8271ee9cb5affd2c36664e2c2287dbfc4e9fa91d32c62b4d9fa3d7de67ba705c9c284efed6c04d69f50d9dea580d577e474b56810e5947851644543b
TLSH
T1C7E0263806C8D1BDB057609702E89B48E2ECB40BD3C83D072FC0C84465C3524B1972D0
MD5 SHA1 SHA512 TLSH

Submit Download

Tabs_13424846010320891

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13424846010320891
Size 12KB
SHA256 7a78af68d757d64773f6233f63d0b6a4392ac63f3876dff3b176f8044b373b13
MD5 67deb672752195746ec71d42cfcc0863
SHA1 cf9dea3f0b7bfdb439ce5ad0b59722a5427c4685
SHA512 b76729a671d977e0d5abb5fbde90aa15078afc7da9ea643ebe0b2e7b87c23ebdae598848b0cc71cb76f6a9904ab2b70e686d9c053085eb685a763809304d4344
SSDEEP 96:38uSdOia4XNiAUOi7pdIQ+vdWT0b1AJlLedd52eRh9tsXY+a:37SOS8AUOi+EJYRtsXla
TLSH
T17452BB529FE1053EF37F4678A8BA1171A93AB52639C0CE2E4161415C0A33B519FB1FAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 8ba476b5408aa0050db0a4b2b3b76496f83fbd27c546277380b30fdceaf3388c
MD5 ab1feebdd4db78e5ecd927365299a74f
SHA1 0faefd7f3148afec398a04b3c17f5decedea107b
SHA512 059040b41a503bd53352158ce05de9093a251c1e9fb32bac41f6a7cfbff69bce1a2c6e65f062d73309378bbd67a217cbd910cb9d2ac3b164fc42b03ed2e40a58
TLSH
T189B01204B700C181C4880A339EA847F0A246F01502241513C9BDEF250E0D975BF668C4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 6362e88c840b2db11800a54735fb8fb832dae8d9d4216e80d0a08c9cf60002da
MD5 2a1a82c7d842e0c8f4a5a566ef43bf22
SHA1 c9b02265bc61728a4b8cf7be22ac9481a3af1580
SHA512 8a3e0cd187646d9f97aa99e4aa31605d4c9063718c83055590407621249cb607a24e99294c2ef20630bc1f48ebbd9daf38b4e3647a609db2301914987dca5f1a
TLSH
T185E0263417C9C36FF18770CB42E8F70CC2EAB40BE7C96A662F48D4A4A246140B2872A0
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 005d9acbe1650df492024061fd530256c6753d5ee153fa4bd01d9cc48ccfd1e1
MD5 08859fb0a24f55b9f697c868fd0a8775
SHA1 0a91dde1b5a445cb77e7092e35482cecfa2ac8cb
SHA512 4d23fa6c77bbe233fb7fc2ce27d93f4a356cd4807f326619b9d0f5cb863a5fa098f52fdb23c2b70fa11ff16ba38bddb0327caf651bcf70581274503635ce02b2
TLSH
T1ACE0CD7447C9D27DF046E0C746ECAB0CC2F8BC0BD7C97B9A5748C465B541154B6AA5E0
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 d34a123ce4a40b185e16df757f24bc390e3fefec142f912aa8a07a3b3f9b3c51
MD5 6339dd93e4c5d884e79e24e32bbce7c0
SHA1 ffacf26cf94304993f396314db424432fcd4cb8a
SHA512 8e852f24e02d2787845f9d86ea76dd93dab8d77cae37b4bf43c028cc361c88a2a458b07999f7672f8d43e71dd1c2f95af101e296ffa0a7bba789697adec89836
SSDEEP 48:KA1IBK2s8rydTI1K8cQMbIJKsA0nyVBIpK8:KA16K2sCOTKK8cfbOKsAOOBGK8
TLSH
T180A16425317622817C7EA95C93D4AA2A5B4530637029B82B3FE804BA4D27E241DFFCDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

load_statistics.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db
Size 136KB
SHA256 18737b5d5573e8fe7ca40508152523c7fc25767d43a763fe513d2e876f4d172a
MD5 65dad5ff44adcf83cb29619c85674083
SHA1 c085d2509cda3b5f85be07c1f80a277b5da39e33
SHA512 013a38c28ac099973fe43ccf13310d61a28aa005190a631b1ab6882e1286e6782a2ff604e1bd21eac8233343551e2e7efd65c874d5e900dbc0ee83f50a322c1e
SSDEEP 1536:Q1ImB1Za+clYfiBYdsbtfhvEqqiCNystlmd7TkhZwJ:qilYfiBYdefZEqKBlvhZwJ
TLSH
T132D30DF35D0E90ABDDCD8278D41BEF44407356618224E8F8FA7D0483777A60ABE79A85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

load_statistics.db-wal

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal
Size 3.9MB
SHA256 e3e4a72d02974d6e1486c309605101e462f8c8a2f4038c61747699c1680216ac
MD5 ff3c650dbd9b43a44ec4c93e124dc734
SHA1 a516b10956cfeea69e9894302179fa8c91f2879b
SHA512 ce3611f5ba96c685ea2871fcc8e83d0a444406f2732ee32966f5e49af0c642300ef8facdcd7c79e4c6b6b6cc934d60bf2b6483c2005d5891db63acb80802d45b
SSDEEP 49152:Q1ZMSzkZqnBPjZNCogSz/9gMocI4Itu/MKRQWWIFuabRvg9bcKhtj/t5X1drRdEl:M
TLSH
T1E316EDF33D0B81AFDCCD4278956AEF480073A6618264E5F4EA7D0882763950EFD7DA85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

55114fd7-d0b6-4a46-8512-bf1e70a5a294.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\55114fd7-d0b6-4a46-8512-bf1e70a5a294.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser
Size 120B
SHA256 9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4
MD5 a397e5983d4a1619e36143b4d804b870
SHA1 aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4
SHA512 4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816
TLSH
T1E0B012203BF9062CF3F74D00AA73AA3428BFF4080A14811D505102080C33E19C478FA3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 8c6b86f1712d7cbf121be0fb9a24b213ddf6d17e7596d4f512cf2d77381b555c
MD5 5dd07fa2bb732d8df04304fed3fbf65d
SHA1 c2b01feb55e80ac1d608de2aecf5c4535c25c778
SHA512 f5821b2b956994487b41e216abdf6c195100ad77c95ce0ce5f522b7236f36e08614fabe245bbf316033d4202852bbb1f8f454a2f475d33a61c3289c6b34e5dbe
SSDEEP 384:yAtNnNnb9z3sNodFEHGDj2f+D8h8Mzw3fAa9iWjZALEnL2F1/7Iz/s:RjZbB31bjmnNCIa9iUvHs
TLSH
T17EA25C3558259CE74CE2E4C5B60672032FB9417B8AC93A9CD6FCBB2D20DF1BC1306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 ce10ca702c16df60a19d017fc5f05c4d465e8afe37f3ff20dd444758d6040f03
MD5 a742f18ee6a13fe531c5861099798275
SHA1 fb7436060e4e7852255363c1d2ee638ebcb09f45
SHA512 52254572873162bb017e9a35b07ec36a83b50615cb192bc3f01c97a3ae0fc936608ba60741652dc51269308e29662c362eda56fc8bb081e4cc9394de5030ca11
SSDEEP 384:y6tNnNnb9+sN54FEHAlCf+D8h8RX/cFr8jZALEnLBE:fjZbEfnKn8/ar6vBE
TLSH
T11E926D3559396CF75EE2AE46F54B32435FF8016B89953FD8DAEC9B1D00CB2AC1306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 68KB
SHA256 9c76ffc7d5eeec519a135df291ae26e33638256f6baafea94baa5e67f1c54e03
MD5 6c9614618bf83874fb993302d17bb8df
SHA1 b0eebe198f3aedb9b9a3c8bd06a8da5f17b0a63e
SHA512 6e0adc3a343c7f85065b7d34046c35cdfad19fa41739afa2e97ae057eec1a1ed7b50ec5a5cae559656f99a383c96d73b64d8f0098ada07a33e417b4fab3f8c85
SSDEEP 1536:MfbJCJwonk5WCv6LgkDzx2/9HhAytjccmHs:MfvokG2CvM
TLSH
T1A2639DF588E78DBAD89E53C3637E6E062EBCC12375845599B7D82A1DDC861BFC302814
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 8543b876fb7a635145b58e5ebc6a4758a205f015140f2cfb257633e196e5da08
MD5 f430cfbc642b5a2592c1bff689ad17ed
SHA1 864024cb698dbbd6d41d904a9d7432bbea226a82
SHA512 a0fed47f7c633d159af6bdb013ec90e360aef06b82f16a65a9b649fabc75138d10bf5a208e34cfc71cea27ec8849dd9be96b6d7e3613e778af4756363a60f4ab
SSDEEP 192:EONnF6hZ0QmiUyY2pc/+jVpjzoruo8a5wOZQGU6:EONF6oWpu+D8h8h2HU6
TLSH
T18302D8356C686C7B8EE2AE45F48736139FE8112BEE956F84D6F85B1D00D769C2303836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 80c068c91010642c3d32cef8a82cd1dbe6b0b2abf251c708b48192778239fd1d
MD5 402ab15db05a24a1e620a4f01354aa2f
SHA1 9f537bb16252d35a1ad3e3772fa08f335db0f6ea
SHA512 fb973c84a231be500a0a47c8cb0abd30bb7a1637d60e75d1691f76b6ffaf89d7ef830a2834e0c6d2f2517562989738642754fc108e93ff048c1ac28ae2e50ea1
SSDEEP 384:yOtNnNnb9+sNM4FEHA0Cf+D8h8RX/cFEHvaASJ1qf/O/QxxKeYLMi8jZALEnLBE:9jZbEOaKn8/aI9St/QfKeYgi6vBE
TLSH
T1C8C24A71D8BA5DE704D2E4C9A646F1122EB8017789896E4CE7FDBB3A309F1FC2305426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 d4d51781e604e1faba22052df9b1f506ff41486c3db43d61eb744c4b64c1e304
MD5 d5fad862e3bbf24674c01af2a6d6eae9
SHA1 a6b23cece1e38807ab07c61cb56e893cc547b855
SHA512 f35c33ff7507b7b1236c40589c94c7cdbdb410a277e80a45d8f123732e0da12260b41b9ad93e488bf36ebb197f4d86e3bd29060a3fb3640e15ae89117ac312b2
SSDEEP 384:yqtNnNnb973sNO4FEHtOj2f+D8h8RX/uk//8jZALEnL2F1/7Iz/s:hjZbl3IVjmn8/xn6vHs
TLSH
T11A926D352839ACF35DD6A545F55B36836FF805B78D853F98D6FC9B0D008A2AD230B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 ee60b9a30692c13df9081c210ce99da5db6e63ade98fa0694c3c05873c62ea5d
MD5 3fd59f31d86b85eaf6bcbb8b7d9393dd
SHA1 0600e0ac62980f229c7e92cce919da4ac9ec620f
SHA512 532d3a8a35095fdbb2edf93f7632f2759b0d0b245722d16500e2f3603291a4730e9aed6a273383a82813f37b7148956023e65c77a5b029c9a7f2627e1919382c
SSDEEP 384:yYtNnNnb9z3sNodFEHGDj2f+D8h8RX/rzNw8jZALEnL2F1/7Iz/s:ljZbB31bjmn8/ni6vHs
TLSH
T190A25C352839ACF75DD6A545F65B36836FF801778D852F94D6FC9B0E00CA2AD230B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 57KB
SHA256 bf2ce2c9c924868c1bc6e9521ef33e44153d826a6a70cc424b3f8ac39d2bfb43
MD5 50e053b9b6c2dad0d85a1a8200d6a218
SHA1 901d6cee414ee13bfb0f0087cc164b7a4c45844e
SHA512 e7e611305e0f663415b6640e002ff2511718d15271fe3a006b774db8ae2e9b82ec8a4b9751a2eb336ea22230717a9fa7875e715f9d7e61e90bdfe18315062952
SSDEEP 768:pFqjZbzTwgZgjZxnfwXYnk5DpkwDv618EaCGHPixhDYZZLsSQg9T9vHs:6f3gfwonk5WCv6LgkD58FHs
TLSH
T13E4328F588D78DB6D89E97C7637DAD052ABCC12375885588B7E8692DEC8B0BFC301850
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 3e540e0bd151564e5e4cd1fa908fb625865213a892a839ad496a9961e7d8b544
MD5 d00c48a2c46016b7bbe322edc464fc73
SHA1 ebef7c28d72cf36184100af2ac6c7b835a016968
SHA512 78808de874eb87212e74ed039e5450c7aad14a1483a9965c1491d9df8e86aaa40141218570372e30fb09687cc632025729ff6f2169f2b76681e695ca3bc988a1
SSDEEP 768:nFqjZb1+wgZUjQWwXY0mZluTxzSL18Lg9ThvHs:cxESwo0cgzSu8RHs
TLSH
T15B13C4F184D78DB6D89D87C7533DAD0269BCC223B5485998B7E86A2DEC9B0BFC301845
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 49KB
SHA256 37287ed35079189064240ee0c55d8c063ade41a24576cb31674d74f134f6f742
MD5 a83c9d54d054ab2c8082f98ef59d6b48
SHA1 ed3aa058e6a5d7eac01dd8eb82cc53622c4d9f9d
SHA512 42eeadbba6a0bd457049ab6467c493e4b1b86c00a40b6f2f9feecbabb14a4c3222e1b0c8b359f2ef7599af87513ceb50acced731196a7840bafb13e7f9b3c0b6
SSDEEP 768:pFIjZbB3TwgZkjZxntwXYnk5DpkwDv618EaCGHPisCIa9i+vHs:sl33ktwonk5WCv6Lgh3+Hs
TLSH
T19C3329F588E789B6D89E9783633D6D026EBCC16775845588B7E86E1CDC861BFC302811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 4f414ed7ad23eace7d5eab25d2cc684b116260e303970b89aa6e3a11a22706f6
MD5 2f88a8cb45445c562ef526f996a0b157
SHA1 e5303c9cacbe7d3e3005633b889bb5855123292f
SHA512 c4612ffac931c31a814a4be09106518df8dff6e6373a41fa337d075ed84b7d94236d9f42570bd2538264022b7dc7a4470e7a1abe8deb47b24c7413d137a4af6d
SSDEEP 192:EON06hZfQmiUyX2ec/+jVpjzoruo8RX8EP85cOqBq+U6:EON06F3eu+D8h8RX/n9rU6
TLSH
T1E412F93569787C674EE2AE46F48B36535FE8212BDE956F84D6F81B2C008769C2307832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 ad61f33086f433c35139ccf7a2d10342dcbcaa24c89f123115b96f1e95c3a875
MD5 0da82256d439b9599191bd5f669cd262
SHA1 9ca2662e285634b134f7580cc8c9d32279b15e91
SHA512 9ad7194b098981f270b2ebcf1f680e7f60b0a0c7da7eede5380fc02c576e31fbfa96e4570fc2c69b1ecb957b03bea623b911ac830cd483d796442c276ec98d26
SSDEEP 384:yqtNnNnb9z3sNOEFEHtNj2f+D8h8RX/uk//8jZALEnL2F1/7Iz/s:hjZbB38Gjmn8/xn6vHs
TLSH
T150A26C352839ACF35DD6A545F55B36836FF805B78D852F98D6FC9B0D008A2AD230B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\OriginTrials\0.0.1.7\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

nav_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json
Size 2KB
SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
MD5 499d9e568b96e759959dc69635470211
SHA1 2462a315342e0c09fd6c5fbd7f1e7ff6914c17e6
SHA512 3a5922697b5356fd29ccf8dcc2e5e0e8c1fd955046a5bacf11b8ac5b7c147625d31ade6ff17be86e79c2c613104b2d2aebb11557399084d422e304f287d8b905
TLSH
T16B51DB73D5988C4B9BF4A29CE919A309F11107CF75D48C0B76BE010C1F7757AB5C6588
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

fc2e01e5-a27e-4c43-9c5f-8876bf6f9d8c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\fc2e01e5-a27e-4c43-9c5f-8876bf6f9d8c.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 5c88a86f4eb3e28afc978505ca698df4a58b1997bc382ca7f39f58747510f494
MD5 05d52f40c12d8a6e5904f3f4fb021966
SHA1 5f4d9d914f285dbbc010dd2d92ebf1ecad7bd9b8
SHA512 57af59263d4f7ea5eeb374539aec4ec1c34444a64a496fd3ef36d1c869ae65a8b53df7caa95c2d4bebf89035c6364c8280cd4172c619ead286bc418a02f95d2e
TLSH
T12D41F488A6EE1148B3776F5AABF6A96D487F7C772E0AD45D10110E4E0A63B40C862737
MD5 SHA1 SHA512 TLSH

Submit Download

97376271-18e1-4d0b-b902-eaba5f264132.tmp

Path C:\Users\Admin\AppData\Local\Temp\97376271-18e1-4d0b-b902-eaba5f264132.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

cc6318ad-332f-4be9-bd19-339235d4cbc8.tmp

Path C:\Users\Admin\AppData\Local\Temp\cc6318ad-332f-4be9-bd19-339235d4cbc8.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InstallOptions.dll

Path C:\Users\Admin\AppData\Local\Temp\nsnBB69.tmp\InstallOptions.dll
Size 14KB
SHA256 c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b
MD5 325b008aec81e5aaa57096f05d4212b5
SHA1 27a2d89747a20305b6518438eff5b9f57f7df5c3
SHA512 18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf
SSDEEP 192:86d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jwK72dwF7dBEnbok:86UdHXcIiY535zBt2jw+BEnbo
TLSH
T1ED622A11778888F3DBD2013EB4533707AF9D5126B4929ED2CA271ECA6D2B05D7EB2346
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartMenu.dll

Path C:\Users\Admin\AppData\Local\Temp\nsnBB69.tmp\StartMenu.dll
Size 7KB
SHA256 7755ff2707ca19344d489a5acec02d9e310425fa6e100d2f13025761676b875b
MD5 a4173b381625f9f12aadb4e1cdaefdb8
SHA1 cf1680c2bc970d5675adbf5e89292a97e6724713
SHA512 fcac79d42862da6bdd3ecad9d887a975cdff2301a8322f321be58f754a26b27077b452faa4751bbd09cd3371b4afce65255fbbb443e2c93dd2cba0ba652f4a82
SSDEEP 96:2fiqP7bO2qHkAC40KhvSE+6nrxtMn0iGd88qRLqtJ1tbRhElfRx2:siqP7OHX1Q4xtcf8qo/ttgfRx2
TLSH
T102F1E8BAF7C109B2CA4B5A302C177B178F66E621032561B3CA6356CAB5C15F3ED25712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsnBB69.tmp\ioSpecial.ini
Size 765B
SHA256 ea27214f35105c8b27b4db59aa2253264f5ec7051928913ef8ef3a247c98e3b4
MD5 6c2db9c2c085463408c9ea651e3846df
SHA1 b3c740a4c95fa47de82a3d7e16d5283b58bdc927
SHA512 75455c7bb94f5ce7c2954c28a38e603be2d967009317706c927d1a2a1a166430328926c3f7f1de950c3c2716d5daef58b7569c3abcd5e0611561bad8134f6bc8
TLSH
T12C01D048A92A93260421115254FF368663A11D240F12B8F9B4258886A38DCD3C6DDFD3
MD5 SHA1 SHA512 TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsnBB69.tmp\ioSpecial.ini
Size 756B
SHA256 bdaaaa4e11e9f8adaead7be38a2455740ce8c985ed5a67d0ba616ce58b01ba74
MD5 7f8bf5624894f33fc8732c88a9a9de7f
SHA1 8327deb89afc3aaca9ecbcaeeedd32c45bdcfac4
SHA512 fb9b368bf6c0ac8c578848563a26e3a95a0f69540edf74c133fc51de9e69c94483ad9842805a0bb474830711e475d73bd71faf7ba085b8f465ba533845666a7f
TLSH
T131012888912E421A8860914265FE3BA357E02D349B4669F0F6664C83A74EDD6C8ED692
MD5 SHA1 SHA512 TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsnBB69.tmp\ioSpecial.ini
Size 791B
SHA256 30e5873d81354a3b91a001e8dfb2a7c06f96a5bb0dac43417de5ac1c554f9624
MD5 5662964cc273fb510bceaf303fdc49a7
SHA1 3650f8107bb36d47cca418b298f024ab6f03a01d
SHA512 8cf7966ee059e3f158fc0ebb475241b49e4b3c04be39939ea21eda7a02ab2635d1468358a5f94120d41f3d10856831a3faad51179fbee51b08aa42531a0bc127
TLSH
T1D4016D8C901A02574824528265FF3F9267E01D348F1A7DF0F5664C83E74ECD2C8ED6C2
MD5 SHA1 SHA512 TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4180_1759684470\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

162b1a86-6fd4-40cf-afd8-3e98bf3307f2.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4180_773183299\162b1a86-6fd4-40cf-afd8-3e98bf3307f2.tmp
Size 147KB
SHA256 d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
MD5 a9f7675ff091bb15c88909424bab4a39
SHA1 90f753d8d7e4397de0f49631fcd9222a7f59148c
SHA512 ff1f89fb04ae9c9a4c6cf6b1475f5a77f1c4f90829acda95cb39889b6b15c3b4f0b3b822a668f8ec8520b002cc90dd397cc26d314ac8fd5f3e2c9826bd458df5
SSDEEP 3072:Ph3iICVe1DvTtr/3tOpPu8LdKBTJyU4AshzWnD7UVDvuZE4tkGL:PgTVWvTZPghwln0AD7UV8Eeky
TLSH
T12BE3E01D29E2846EC82B24F4BA4A718FC71ECF07910BE40F25D984A55C7474E17E2EED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DeltaExecutor.zip.crdownload

Path C:\Users\Admin\Downloads\DeltaExecutor.zip.crdownload
Size 1.1MB
SHA256 15b49244b18a21773aea3b3371f4743b60551fb7bbb80fca6594ed07416751db
MD5 0a7bed2d23df449d41402593f3baf26a
SHA1 3b48b5c5e3f7a91a3e555c0b464b09d3f27598ad
SHA512 b0c8d189c8679d01a5d9695531d52aa93642f3f572b06901c3e36ef224965ba0853790f427c09d1dd4f526007680dce7c5807484ba8f71594222da304137e389
SSDEEP 24576:K/Oh9RPpAZCpFoYqjE9yWf0yOLSfc/41tBkIPALl8VkjogTf:g6R2XwEHyE41tB1eJjoY
TLSH
T18645336F1C67BB12F9E01AB2E936248BE07BDDA764CF4D65C1380F874358A46A60D718
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ARMClient.Authentication.dll

Path C:\Users\Admin\Downloads\DeltaExecutor\ARMClient.Authentication.dll
Size 66KB
SHA256 9931b5d62e7fb38eeb8f86f6204b6055f7eeca08cba780698167c8846ca90647
MD5 bc1b4885c1bcc757113a7e2c000f4821
SHA1 e1153f6423567ca4a2b7d4947cbdb1aed5ca11d8
SHA512 5fcdc9d31956437a4bdf459e337b76f93070bbf430121a651e52517e833d79f38ce3c3c124d099bda5e039252ccb32f40f64ae3517250a47f73134402e0433c8
SSDEEP 1536:M9vycbM2Ur9ozNPl9kIzGcGJVOvALlqwhuPDmLNzR4INnS:Pcj7kIzGcO0DSRLNnS
TLSH
T196636C85A7FCCA23E6DF5ABCD1A4D1471B72E7966810F78E1C8CF4EA244338046416AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ARMClient.Library.dll

Path C:\Users\Admin\Downloads\DeltaExecutor\ARMClient.Library.dll
Size 32KB
SHA256 90d4ca5ab2baf128d46a3f5d5a71bea524c413f40bdbc4a03668436bcfcce5f3
MD5 d6bb28c67f08bead73403ae90787b64d
SHA1 449086e0b990918fc4f15c8ef9e8d48a6486b7d1
SHA512 6b29dec43b7ccdea3c74afe7a40d6391e26702238f4a9ecfd0fb223d279021ebbe0801723006beadf340bcd50ea8752adb696622dad83e0b32a5e75c6663fb1b
SSDEEP 768:OZmbSucRuI3sUeaHj2eQLUrDj08BkaXQyu6ewxaaicmhH9AIIKqU:vbj3yeaHjTQwHPkGQLNaa2IdkU
TLSH
T1FCE27CC48B6C9523C98B5EB896A8C1436E35D3DA5D21E65E08DCF8EA1CD33C9970473E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Autofac.dll

Path C:\Users\Admin\Downloads\DeltaExecutor\Autofac.dll
Size 221KB
SHA256 51bcc3c43fa7c57bd1343f771ff8e29b8dcd210bad2ad19a6705c7e76e90343a
MD5 75e99d33b32849c94777d49188c8f241
SHA1 73037dacfe90a5dc71a753b81b25d4f7a6536a6d
SHA512 ff4364e8c4ea3a56f5e43eb25922b2e1915b01df1c6b097f6c0821aa1d85fb30e72306349ef136c9e7a05b29e1f5bc01a92a169601df1d5ddbaf141ec1452880
SSDEEP 6144:KOw33WjAbz8/lCSCaJQzwz4VDnV/FblNd6S9chsNyZBiM0iS9zC:KOu3WjA/8/lCSC6Qzwz4/CVSNja
TLSH
T170245D0523FC0226C9FF1A76B67068554AB3F9079C57EB0F6D9874F905A3F019A90B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Colors.Net.dll

Path C:\Users\Admin\Downloads\DeltaExecutor\Colors.Net.dll
Size 9KB
SHA256 943e81fc9b5580fdb807e2ede32002f3f6b0aede608b1ded5b1694c798830c03
MD5 25b397da96f6053b0456d9b90d634f5a
SHA1 9e37cff677ad84db9ed40f68b46142edc1d598de
SHA512 2801b6683c86ca3cff70e2d3e8a774a595509c266712a33ecdfd5804ef3e448ece9059c672a80996cbd527fa6ac1687326217b1c8c0a237f2754508ae89c2539
SSDEEP 192:XJDf/YL6ABSsYe0i0GV/5Ex83a4PlOrkP:5D/Y2Ai9U/5Eg1PlOYP
TLSH
T1DD120A04D7EDA736CFBE067874A9122091B5FB148872D77F79A9C81A5D03BDC85223E2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DeltaExecutor.exe

Path C:\Users\Admin\Downloads\DeltaExecutor\DeltaExecutor.exe
Size 305KB
SHA256 576b74eb4ab1287fc39e4f1dbecc478deb8b0bd14f7104ae1c6446946ffd4a28
MD5 6d9dcaa75e1846e79d6f0eeef87aae10
SHA1 0d6231f8ed4445e7b1e716bb34b55e5e362a825d
SHA512 eb8edd40ff7881b15c809febdcab209ebaed7a6ea1098425f035d2b0cdac3f4e0ce832ef35b5e3802e7cbb4c7df661c38f471145c584ec3ff167654ca6c4f88e
SSDEEP 6144:jIQ4WYGDlFUBnNgVUq19v5pwOMw1cilZg:0Q4AFUBNgVr7FMQPlZg
TLSH
T14C644B86636CC7A1E16F1F76B86282EA8733F9069CA5D7DD194CE7EC18637818C10727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FluentCommandLineParser.dll

Path C:\Users\Admin\Downloads\DeltaExecutor\FluentCommandLineParser.dll
Size 60KB
SHA256 2ab565f92052e0faed368913c1882e9aa5220eb954c6cf8f303d452aa2489688
MD5 b625f3927c613409bfbec7e1af6c7cd8
SHA1 09ba317e7b4f768c7ff700c04d9d9d0f710bbd94
SHA512 33c1bf3ffd4c78dec64e22f875211e68b5420a083928bda85f88c37da81463f2460124d45d81f1b0f3d09155f61b04ca3a988618e27799f90f900f689fa4a17d
SSDEEP 768:YWDesbk1hc+zloHIC/+9LXPnnx+N8iRnFidzsREmmRyu6eh3x0KnmhVaAIIr:TDejkc9LnAzaIRSRLNxfnIUI
TLSH
T1A9535D154BBC8E23CA9F0A74A474955B0EBCC3432921DB762E64F9E719837C3CA72365
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Azure.WebJobs.Host.dll

Path C:\Users\Admin\Downloads\DeltaExecutor\Microsoft.Azure.WebJobs.Host.dll
Size 706KB
SHA256 6a10274cc84575e6cab127bced5cebdc9759d9016637adf5d46ceedddde3d515
MD5 ed43a835ca4030ad66e39e49f55883a5
SHA1 beb1755b9f57797a14e4717cf2a3e4436915d5a8
SHA512 499d5b1e6324d837b8838ba232c30c7a07ddf99c8fced4329f4059ca0abe3f43338511b669a33bbd4a03e2ec3335be45d9a1f03e69226d8dfecb33e73cd894f1
SSDEEP 12288:7x1Lt2OhhYPJpWfX1tkXuT9aLnbw+tB9GlMktqeS675HuDnT7:7qRQ1tEuT9aLbTqUeXuDnf
TLSH
T194F43955B3E89B27D99E2739BC200B599371E6CA522BFB0F978CD2EA1C437544E00367
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Azure.WebJobs.Script.WebHost.dll

Path C:\Users\Admin\Downloads\DeltaExecutor\Microsoft.Azure.WebJobs.Script.WebHost.dll
Size 494KB
SHA256 09392d824e45b08bc524b66b05effd4ad8e5c4a371cae9f47eff490bfdebe95e
MD5 4a4395c0023d10bfe4184b370d88d9f2
SHA1 173adb656022d8fea5e3c8a587e3e3985490df24
SHA512 18b334db61cd7a3e3b5e3ed9cc10e92212a59a985f919cc0716606aa378e34f55eaf82ec4e4938e78ae46d0689e050729c2524085b3a64c5454e1b892e8d3f9c
SSDEEP 6144:fJdbq8cIw+pIS6M8wgx0676XQ6E4jCTG2O676XQ6E4jCTG2zqX:fnTc8QcZWiQcZWnqX
TLSH
T13FB4CE7463AADA17D62F2ABAB4344815AF39868BA114DF5DBD8C17EC4B03744CE12373
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Azure.WebJobs.Script.dll

Path C:\Users\Admin\Downloads\DeltaExecutor\Microsoft.Azure.WebJobs.Script.dll
Size 372KB
SHA256 c5e451255d44c49a9e7d84144aed26a4704e4403d76a0fb93627b6c6d4ecc468
MD5 e050f35f4e827e786974d88d2819c42f
SHA1 2b8675c3eed0047c92e3ef9f88b1f5320ae36d43
SHA512 0a3ed7442fb364049034cb8fb55e3094cb588d6312faebab68010e47126d28fd2e25239738bdbdc2cad0fae2a992ce81251e6b5ba28927f1af00e455ba61104b
SSDEEP 6144:gPm5+eCBs7lpF31vjSSSkgV5XHAbuvn/6b2Mno5h+jARrd2:EBgSSSkgV5XHk4q14x2
TLSH
T1FA847C506BF8E312E4DF2735A83A458B57B4B7470066EB9E9E8CAEDD1887780CD11723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Newtonsoft.Json.dll

Path C:\Users\Admin\Downloads\DeltaExecutor\Newtonsoft.Json.dll
Size 531KB
SHA256 7b1bbdd36dfccf96d8b941782bc79a43072130989331242548c3553d5c8578ea
MD5 859adf11b4d2a656a8ee2d070b726743
SHA1 d53682045cf3b3d674b0c957643bc2abc7fa42c4
SHA512 6540acb9f3e8884af60394aad8e17964d4cf1469d7f0df589dee86a672f711588b70d3fd4033ecef5d954ef4cd7ba8581c2855d6311921da68a6a9b7c20e0eba
SSDEEP 6144:YeC37wbJmJ5bd4m15M+S50cK7q2UGu7WEYEaWdDBLH5WHxJ16Wi/h4aBTBFFu4J+:s37Ogr2VAHx7JijBZdPfPi
TLSH
T19AC43A502BF89726E6FE2771F438061557F9F45AE67EEB4F5A4095AA1C837808C00BB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

README.txt

Path C:\Users\Admin\Downloads\DeltaExecutor\README.txt
Size 994B
SHA256 2753efd57e93464431cc683e4e550b2c4241d1180c924da9bcc6ef5501412065
MD5 6da67bf44c7bcd450b7e247bf2c69adc
SHA1 3efa1ec832ce9a47521c9a9379f6f7ee5a25d6b8
SHA512 0521f4228727f5dec490e736168253c8a73eff3bff7e3784787e8690dcad16a7090656620a3c6b6ece3214e4fbbd80400b50ade533d44f50bfb9a7f75ced8626
TLSH
T12411024FDB51E977197013C89A1C7185B6178A072B04C985E868C01D733F795E3345DF
MD5 SHA1 SHA512 TLSH

Submit Download

System.IO.Abstractions.dll

Path C:\Users\Admin\Downloads\DeltaExecutor\System.IO.Abstractions.dll
Size 53KB
SHA256 7da16ef846948a94f665b694b9b65e6882496dbb27ba57a17abfbb51f7cf07be
MD5 f239405f612d8f172eaa8291be224ff1
SHA1 3328282fd11c277af4e55747dcfda358243d9942
SHA512 038d20ea3aa0419032b34c7dea4e4b613fe4f7bc75256820c94cbaf7bb8a5dc5f6bbcc08d21f3a6129cb5fb9773100d11bf7561dc11844a04dcaf3d6bb6ef0b4
SSDEEP 768:Dui8/DurjNnJRqqjqqBqqjqq5c55c3dxgYk9A9yu6eTLSnEKmh0QSnE5:Dui8/DurFc55CjgrA9LNHCIHh
TLSH
T19B33F75C2FF4E157DC2E05B479A0C22A6B38D682C803E31A2BB5BDF56C733A5C61245E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DependencyCore_415289.exe.crdownload

Path C:\Users\Admin\Downloads\DependencyCore_415289.exe.crdownload
Size 17.2MB
SHA256 9e23dcf384985c95904233147d146c9bcc13e2fd5bc44d87da348b699cc7f0e8
MD5 5960b24aac0b09e65c0c3e33e361ed60
SHA1 0512c6860a89efd9ebba01b3c9ca161d8e837fa0
SHA512 4f9853dbd1dab31de540e1f0aa96b8c59d1b70b00281609262b6533f92145f39e19de1a2801a1058e0f4cc9a37c2cbad92432b2b4969efcfc18ea74c6898d1b4
SSDEEP 393216:1HrYQfHMS7ViIfhMXZZy+MwMzoZG9toN2tgylAYLAbzzePj:z7Vnuk+ooZG9tzt3l8r+j
TLSH
T16007BEC4F228F549E7850661982536E449662D303754D9B9BF8B76C2893C2EAEDF0F33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a0c94.msi

Path C:\Windows\Installer\e5a0c94.msi
Size 218KB
SHA256 2cc196bed01619b5498a974c19cfcba6a04b7746e84808f06d9e4de3129ab4db
MD5 e493a21c57d160f4fa023c63145fe580
SHA1 f57a601c422201ec70650afcd987c132bef26d52
SHA512 a503f221de3b61aba7aa69e09382e7167dfb4246e1a31884b3381713e50b31b4b04088204b9277208f066127d8c3962b3351b3da1a6f52be3776cdc357d76778
SSDEEP 3072:2ZhkpPqoVVE9JXgvJVJS5XoZ/eATFNmHK0+E4mN2EJ4Eq5:Kp/QvzJ4ux8W
TLSH
T185244C12B512C133D8402371515ED7A26ABCBFE64B518AA723DD739C5EB27D0933A2CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1548-769-0x00000113FEE00000-0x00000113FEE62000-memory.dmp

Download

memory/1548-759-0x00000113E49B0000-0x00000113E49C2000-memory.dmp

Download

memory/1548-761-0x00000113E4940000-0x00000113E494A000-memory.dmp

Download

memory/1548-767-0x00000113FEB10000-0x00000113FEB90000-memory.dmp

Download

memory/1548-757-0x00000113FEA80000-0x00000113FEB06000-memory.dmp

Download

memory/1548-753-0x00000113E4950000-0x00000113E498A000-memory.dmp

Download

memory/1548-751-0x00000113E4530000-0x00000113E457E000-memory.dmp

Download

memory/1548-763-0x00000113E49D0000-0x00000113E49D8000-memory.dmp

Download

memory/1548-765-0x00000113FEBD0000-0x00000113FEC86000-memory.dmp

Download

memory/1548-770-0x00000113E49E0000-0x00000113E49E8000-memory.dmp

Download

memory/1548-772-0x00000113FEA10000-0x00000113FEA22000-memory.dmp

Download

memory/1548-755-0x00000113E4930000-0x00000113E4940000-memory.dmp

Download

memory/2168-1762-0x0000019A2FF30000-0x0000019A309F1000-memory.dmp

Download