d9f3d3c693bfb92ba9631b8af5fc99fb7935ed980dbe494140d69d8b0126d65b

Analysis

user interaction
yes
max time kernel
210s
max time network
214s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/06/2026, 17:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sagr-steam-tools.exe
Size 14.7MB
Sample260623-v86rcsez2w
SHA256 d9f3d3c693bfb92ba9631b8af5fc99fb7935ed980dbe494140d69d8b0126d65b
MD5 785f3339200903a9d37584e475b61f25
SHA1 914dc1b2e09a3b4a496418f81cf988897f3daf2a
SHA512 ca11d50ef992b404306d8645c900623085cd49477397d5f61b1ad4b15ace455c476a54548ef729cea1d89ba18394a22e59e95694a00bce5c3a5797f0eb33ec09
SSDEEP 98304:qWPAK/+QcKD3VudoZl/IKPPZLLt1hPw9aEbbEqP900YdkjpksF5m8r1MziqViTD8:PTVcoZl/IKjsHrazi153oT
TLSH
T193F606217B5A99ACC19BC47483474A725A7130DB0B35BAFF449492393F6ABF42F38358
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery persistence ransomware trojan

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
81	560	msedge.exe

Executes dropped EXE 9 IoCs

pid	Process
6444	dotnet-runtime-9.0.11-win-x64.exe
4296	dotnet-runtime-9.0.11-win-x64.exe
5140	dotnet-runtime-9.0.11-win-x64.exe
5224	dotnet-runtime-9.0.11-win-x64.exe
5948	dotnet-runtime-9.0.11-win-x64.exe
2156	dotnet-runtime-9.0.11-win-x64.exe
3668	dotnet-runtime-9.0.11-win-x64.exe
6092	dotnet-runtime-9.0.11-win-x64.exe
6260	dotnet.exe

Loads dropped DLL 11 IoCs

pid	Process
4296	dotnet-runtime-9.0.11-win-x64.exe
5224	dotnet-runtime-9.0.11-win-x64.exe
3092	MsiExec.exe
3092	MsiExec.exe
2104	MsiExec.exe
2104	MsiExec.exe
5316	MsiExec.exe
5316	MsiExec.exe
6092	dotnet-runtime-9.0.11-win-x64.exe
6260	dotnet.exe
4548	msedge.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{0019b11f-9474-4643-b590-4b4ddbe9039c} = "\"C:\\ProgramData\\Package Cache\\{0019b11f-9474-4643-b590-4b4ddbe9039c}\\dotnet-runtime-9.0.11-win-x64.exe\" /burn.runonce"	dotnet-runtime-9.0.11-win-x64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	sagr-steam-tools.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	sagr-steam-tools.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Videos\Captures\desktop.ini	svchost.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.11\System.Memory.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.11\System.Runtime.Handles.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.11\System.Xml.XPath.XDocument.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.11\System.Xml.Serialization.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.11\System.Net.ServicePoint.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.11\System.Resources.ResourceManager.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.11\System.Reflection.DispatchProxy.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.11\System.Runtime.CompilerServices.Unsafe.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.11\clrgc.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.11\clretwrc.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.11\System.IO.Compression.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.11\System.Runtime.Extensions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.11\System.IO.Pipes.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.11\System.Dynamic.Runtime.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.11\System.Threading.Timer.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.11\System.Resources.Writer.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.11\System.Security.Cryptography.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.11\System.Resources.Reader.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.11\System.AppContext.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.11\System.Reflection.TypeExtensions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.11\System.Private.Uri.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.11\Microsoft.VisualBasic.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.11\System.Drawing.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.11\System.Threading.Tasks.Parallel.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.11\System.Globalization.Calendars.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.11\System.Console.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.11\System.Buffers.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.11\System.Security.Cryptography.Primitives.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.11\System.Net.NetworkInformation.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.11\System.Xml.Linq.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.11\System.Diagnostics.Debug.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.11\System.IO.Pipelines.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.11\System.ComponentModel.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.11\System.Core.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.11\System.Globalization.Extensions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.11\Microsoft.NETCore.App.deps.json	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.11\System.Collections.Immutable.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.11\System.Diagnostics.DiagnosticSource.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.11\System.Threading.Thread.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.11\System.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.11\System.Private.Xml.Linq.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.11\System.Net.WebSockets.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.11\System.Security.Cryptography.Csp.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.11\System.Security.Claims.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.11\System.Reflection.Extensions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.11\System.Net.Sockets.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.11\System.Diagnostics.Process.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.11\System.Net.NameResolution.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.11\System.Threading.Tasks.Extensions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.11\mscordaccore_amd64_amd64_9.0.1125.51716.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.11\System.Diagnostics.StackTrace.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.11\System.Xml.ReaderWriter.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.11\System.Numerics.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.11\System.Net.WebProxy.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.11\System.Runtime.InteropServices.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.11\WindowsBase.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.11\System.Data.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.11\System.Diagnostics.TraceSource.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.11\System.Diagnostics.Tools.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.11\System.Drawing.Primitives.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.11\System.Net.Http.Json.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.11\System.Windows.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.11\System.Globalization.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.11\System.Private.DataContractSerialization.dll	msiexec.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1004_898238693\hyph-pa.hyb	msedgewebview2.exe
File created	C:\Windows\Installer\SourceHash{CF6D52E0-F74C-4C62-8A86-F870C5FE8770}	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4548_1722617693\Sigma\Content	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4548_1722617693\Sigma\Staging	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1004_898238693\hyph-el.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1004_898238693\hyph-en-gb.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1004_898238693\hyph-hr.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1004_898238693\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\~DF3F71521A1FAD05F0.TMP	msiexec.exe
File created	C:\Windows\Installer\e5a2dcd.msi	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1004_1754927758\Microsoft.CognitiveServices.Speech.core.dll	msedgewebview2.exe
File created	C:\Windows\Installer\e5a2dcc.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4167.tmp	msiexec.exe
File created	C:\Windows\Installer\e5a2dd8.msi	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4548_1818289783\ct_config.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1004_898238693\hyph-be.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1004_898238693\hyph-fr.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1004_898238693\hyph-or.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1004_898238693\manifest.json	msedgewebview2.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1\64.60.31149\fileCoreHostExe	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1004_1415122751\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4548_1722617693\Mu\Analytics	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1004_898238693\hyph-et.hyb	msedgewebview2.exe
File created	C:\Windows\Installer\e5a2dc8.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1004_898238693\hyph-es.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\~DF299E8AA00E918E93.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1004_898238693\hyph-cu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1004_898238693\hyph-cy.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1004_898238693\hyph-kn.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1004_898238693\hyph-mr.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1004_1987639467\manifest.json	msedgewebview2.exe
File opened for modification	C:\Windows\Installer\MSI40AA.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1004_898238693\hyph-hi.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1004_413799041\manifest.json	msedgewebview2.exe
File opened for modification	C:\Windows\Installer\MSI3BC4.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{EABD407D-A4D7-426F-BCEB-2BD0C34B63AA}	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4548_1722617693\Mu\Entities	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4548_1722617693\Mu\Other	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1004_898238693\hyph-af.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1004_985325142\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\~DFDCEF32A0A5EE1666.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1004_1415122751\passwords.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4548_1722617693\Sigma\Fingerprinting	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1004_898238693\hyph-ta.hyb	msedgewebview2.exe
File created	C:\Windows\Installer\SourceHash{15A74731-6EA1-4EDD-9A78-2E1A0BCBE573}	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1004_898238693\hyph-da.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1004_898238693\hyph-de-ch-1901.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1004_898238693\hyph-sv.hyb	msedgewebview2.exe
File opened for modification	C:\Windows\Installer\MSI31A0.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1004_1415122751\us_tv_and_film.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4548_1722617693\Mu\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1004_921951396\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1004_898238693\hyph-it.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1004_898238693\hyph-mn-cyrl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1004_898238693\hyph-uk.hyb	msedgewebview2.exe
File opened for modification	C:\Windows\Installer\MSI3D6B.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1004_1415122751\male_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4548_1722617693\Mu\CompatExceptions	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4548_1722617693\Sigma\Cryptomining	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4548_1818289783\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1004_898238693\hyph-sl.hyb	msedgewebview2.exe
File opened for modification	C:\Windows\SystemTemp	msedgewebview2.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dotnet-runtime-9.0.11-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dotnet-runtime-9.0.11-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dotnet-runtime-9.0.11-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dotnet-runtime-9.0.11-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dotnet-runtime-9.0.11-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dotnet-runtime-9.0.11-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dotnet-runtime-9.0.11-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dotnet-runtime-9.0.11-win-x64.exe

System Time Discovery 1 TTPs 12 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4548	msedge.exe
560	msedge.exe
5140	dotnet-runtime-9.0.11-win-x64.exe
5224	dotnet-runtime-9.0.11-win-x64.exe
6092	dotnet-runtime-9.0.11-win-x64.exe
2088	dotnet.exe
6444	dotnet-runtime-9.0.11-win-x64.exe
4296	dotnet-runtime-9.0.11-win-x64.exe
5948	dotnet-runtime-9.0.11-win-x64.exe
2156	dotnet-runtime-9.0.11-win-x64.exe
3668	dotnet-runtime-9.0.11-win-x64.exe
6260	dotnet.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134267102423266086"	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\13747A511AE6DDE4A987E2A1B0BC5E37\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\13747A511AE6DDE4A987E2A1B0BC5E37\DeploymentFlags = "3"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D704DBAE7D4AF624CBBEB20D3CB436AA\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\0E25D6FCC47F26C4A8688F075CEF7807\MainFeature	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0E25D6FCC47F26C4A8688F075CEF7807\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0E25D6FCC47F26C4A8688F075CEF7807\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{CF6D52E0-F74C-4C62-8A86-F870C5FE8770}v72.44.42384\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{0019b11f-9474-4643-b590-4b4ddbe9039c}\DisplayName = "Microsoft .NET Runtime - 9.0.11 (x64)"	dotnet-runtime-9.0.11-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{0019b11f-9474-4643-b590-4b4ddbe9039c}\Dependents	dotnet-runtime-9.0.11-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_9.0_x64\ = "{CF6D52E0-F74C-4C62-8A86-F870C5FE8770}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0E25D6FCC47F26C4A8688F075CEF7807\ProductName = "Microsoft .NET Host - 9.0.11 (x64)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0E25D6FCC47F26C4A8688F075CEF7807\SourceList\PackageName = "dotnet-host-9.0.11-win-x64.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0E25D6FCC47F26C4A8688F075CEF7807\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\dotnet_runtime_72.44.42384_x64	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\13747A511AE6DDE4A987E2A1B0BC5E37\PackageCode = "B29BE7D8AF6FE6C4697911CEA05D4080"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\13747A511AE6DDE4A987E2A1B0BC5E37\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{15A74731-6EA1-4EDD-9A78-2E1A0BCBE573}v72.44.42384\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_72.44.42384_x64\Dependents	dotnet-runtime-9.0.11-win-x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D704DBAE7D4AF624CBBEB20D3CB436AA\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D704DBAE7D4AF624CBBEB20D3CB436AA\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D704DBAE7D4AF624CBBEB20D3CB436AA\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_9.0_x64\Version = "72.44.42384"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_72.44.42384_x64\DisplayName = "Microsoft .NET Runtime - 9.0.11 (x64)"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_72.44.42384_x64	dotnet-runtime-9.0.11-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_9.0_x64\DisplayName = "Microsoft .NET Host - 9.0.11 (x64)"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0E25D6FCC47F26C4A8688F075CEF7807\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_9.0_x64	dotnet-runtime-9.0.11-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_9.0_x64\Dependents\{0019b11f-9474-4643-b590-4b4ddbe9039c}	dotnet-runtime-9.0.11-win-x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\13747A511AE6DDE4A987E2A1B0BC5E37\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\13747A511AE6DDE4A987E2A1B0BC5E37\SourceList\PackageName = "dotnet-runtime-9.0.11-win-x64.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_72.44.42384_x64\Dependents\{0019b11f-9474-4643-b590-4b4ddbe9039c}	dotnet-runtime-9.0.11-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_72.44.42384_x64\ = "{EABD407D-A4D7-426F-BCEB-2BD0C34B63AA}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\B4854B44EF7534E79611B76BA0738BD3	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D704DBAE7D4AF624CBBEB20D3CB436AA\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D704DBAE7D4AF624CBBEB20D3CB436AA\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{EABD407D-A4D7-426F-BCEB-2BD0C34B63AA}v72.44.42384\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0E25D6FCC47F26C4A8688F075CEF7807\Version = "1210885520"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3246620872-1649211507-2285877732-1000\{AA056C18-C24C-4CD9-891B-B851C7E4FB6F}	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_72.44.42384_x64\ = "{15A74731-6EA1-4EDD-9A78-2E1A0BCBE573}"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\13747A511AE6DDE4A987E2A1B0BC5E37\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\13747A511AE6DDE4A987E2A1B0BC5E37\SourceList\Media	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\13747A511AE6DDE4A987E2A1B0BC5E37\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D704DBAE7D4AF624CBBEB20D3CB436AA\Provider	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D704DBAE7D4AF624CBBEB20D3CB436AA\Version = "1210885520"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D704DBAE7D4AF624CBBEB20D3CB436AA\Clients = 3a0000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\13747A511AE6DDE4A987E2A1B0BC5E37\Version = "1210885520"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\13747A511AE6DDE4A987E2A1B0BC5E37\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\dotnet_runtime_72.44.42384_x64	dotnet-runtime-9.0.11-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D704DBAE7D4AF624CBBEB20D3CB436AA\MainFeature	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D704DBAE7D4AF624CBBEB20D3CB436AA\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_9.0_x64	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0E25D6FCC47F26C4A8688F075CEF7807\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0E25D6FCC47F26C4A8688F075CEF7807\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{CF6D52E0-F74C-4C62-8A86-F870C5FE8770}v72.44.42384\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{0019b11f-9474-4643-b590-4b4ddbe9039c}\Dependents\{0019b11f-9474-4643-b590-4b4ddbe9039c}	dotnet-runtime-9.0.11-win-x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\13747A511AE6DDE4A987E2A1B0BC5E37\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\0E25D6FCC47F26C4A8688F075CEF7807	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0E25D6FCC47F26C4A8688F075CEF7807	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0E25D6FCC47F26C4A8688F075CEF7807\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\F71950C1A6A51F479A1ED20855BD5918	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0E25D6FCC47F26C4A8688F075CEF7807\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\13747A511AE6DDE4A987E2A1B0BC5E37\MainFeature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\13747A511AE6DDE4A987E2A1B0BC5E37\ProductName = "Microsoft .NET Runtime - 9.0.11 (x64)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\13747A511AE6DDE4A987E2A1B0BC5E37\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{15A74731-6EA1-4EDD-9A78-2E1A0BCBE573}v72.44.42384\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D704DBAE7D4AF624CBBEB20D3CB436AA	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D704DBAE7D4AF624CBBEB20D3CB436AA\PackageCode = "B0A4651E97620DF438CEFC58D3F535CE"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0E25D6FCC47F26C4A8688F075CEF7807\PackageCode = "DC8A028AF3B7F9B4D90BEA31A63D3BF7"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3246620872-1649211507-2285877732-1000\{2D8DB85A-BA72-4E2E-B6D5-BE76F06E3306}	svchost.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1248	msiexec.exe
1248	msiexec.exe
1248	msiexec.exe
1248	msiexec.exe
1248	msiexec.exe
1248	msiexec.exe
6792	msedgewebview2.exe
6792	msedgewebview2.exe
4240	msedge.exe
4240	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1004	msedgewebview2.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
1004	msedgewebview2.exe
4548	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5948	dotnet-runtime-9.0.11-win-x64.exe
Token: SeIncreaseQuotaPrivilege	5948	dotnet-runtime-9.0.11-win-x64.exe
Token: SeSecurityPrivilege	1248	msiexec.exe
Token: SeCreateTokenPrivilege	5948	dotnet-runtime-9.0.11-win-x64.exe
Token: SeAssignPrimaryTokenPrivilege	5948	dotnet-runtime-9.0.11-win-x64.exe
Token: SeLockMemoryPrivilege	5948	dotnet-runtime-9.0.11-win-x64.exe
Token: SeIncreaseQuotaPrivilege	5948	dotnet-runtime-9.0.11-win-x64.exe
Token: SeMachineAccountPrivilege	5948	dotnet-runtime-9.0.11-win-x64.exe
Token: SeTcbPrivilege	5948	dotnet-runtime-9.0.11-win-x64.exe
Token: SeSecurityPrivilege	5948	dotnet-runtime-9.0.11-win-x64.exe
Token: SeTakeOwnershipPrivilege	5948	dotnet-runtime-9.0.11-win-x64.exe
Token: SeLoadDriverPrivilege	5948	dotnet-runtime-9.0.11-win-x64.exe
Token: SeSystemProfilePrivilege	5948	dotnet-runtime-9.0.11-win-x64.exe
Token: SeSystemtimePrivilege	5948	dotnet-runtime-9.0.11-win-x64.exe
Token: SeProfSingleProcessPrivilege	5948	dotnet-runtime-9.0.11-win-x64.exe
Token: SeIncBasePriorityPrivilege	5948	dotnet-runtime-9.0.11-win-x64.exe
Token: SeCreatePagefilePrivilege	5948	dotnet-runtime-9.0.11-win-x64.exe
Token: SeCreatePermanentPrivilege	5948	dotnet-runtime-9.0.11-win-x64.exe
Token: SeBackupPrivilege	5948	dotnet-runtime-9.0.11-win-x64.exe
Token: SeRestorePrivilege	5948	dotnet-runtime-9.0.11-win-x64.exe
Token: SeShutdownPrivilege	5948	dotnet-runtime-9.0.11-win-x64.exe
Token: SeDebugPrivilege	5948	dotnet-runtime-9.0.11-win-x64.exe
Token: SeAuditPrivilege	5948	dotnet-runtime-9.0.11-win-x64.exe
Token: SeSystemEnvironmentPrivilege	5948	dotnet-runtime-9.0.11-win-x64.exe
Token: SeChangeNotifyPrivilege	5948	dotnet-runtime-9.0.11-win-x64.exe
Token: SeRemoteShutdownPrivilege	5948	dotnet-runtime-9.0.11-win-x64.exe
Token: SeUndockPrivilege	5948	dotnet-runtime-9.0.11-win-x64.exe
Token: SeSyncAgentPrivilege	5948	dotnet-runtime-9.0.11-win-x64.exe
Token: SeEnableDelegationPrivilege	5948	dotnet-runtime-9.0.11-win-x64.exe
Token: SeManageVolumePrivilege	5948	dotnet-runtime-9.0.11-win-x64.exe
Token: SeImpersonatePrivilege	5948	dotnet-runtime-9.0.11-win-x64.exe
Token: SeCreateGlobalPrivilege	5948	dotnet-runtime-9.0.11-win-x64.exe
Token: SeRestorePrivilege	1248	msiexec.exe
Token: SeTakeOwnershipPrivilege	1248	msiexec.exe
Token: SeRestorePrivilege	1248	msiexec.exe
Token: SeTakeOwnershipPrivilege	1248	msiexec.exe
Token: SeRestorePrivilege	1248	msiexec.exe
Token: SeTakeOwnershipPrivilege	1248	msiexec.exe
Token: SeRestorePrivilege	1248	msiexec.exe
Token: SeTakeOwnershipPrivilege	1248	msiexec.exe
Token: SeRestorePrivilege	1248	msiexec.exe
Token: SeTakeOwnershipPrivilege	1248	msiexec.exe
Token: SeRestorePrivilege	1248	msiexec.exe
Token: SeTakeOwnershipPrivilege	1248	msiexec.exe
Token: SeRestorePrivilege	1248	msiexec.exe
Token: SeTakeOwnershipPrivilege	1248	msiexec.exe
Token: SeRestorePrivilege	1248	msiexec.exe
Token: SeTakeOwnershipPrivilege	1248	msiexec.exe
Token: SeRestorePrivilege	1248	msiexec.exe
Token: SeTakeOwnershipPrivilege	1248	msiexec.exe
Token: SeRestorePrivilege	1248	msiexec.exe
Token: SeTakeOwnershipPrivilege	1248	msiexec.exe
Token: SeRestorePrivilege	1248	msiexec.exe
Token: SeTakeOwnershipPrivilege	1248	msiexec.exe
Token: SeRestorePrivilege	1248	msiexec.exe
Token: SeTakeOwnershipPrivilege	1248	msiexec.exe
Token: SeRestorePrivilege	1248	msiexec.exe
Token: SeTakeOwnershipPrivilege	1248	msiexec.exe
Token: SeRestorePrivilege	1248	msiexec.exe
Token: SeTakeOwnershipPrivilege	1248	msiexec.exe
Token: SeRestorePrivilege	1248	msiexec.exe
Token: SeTakeOwnershipPrivilege	1248	msiexec.exe
Token: SeRestorePrivilege	1248	msiexec.exe
Token: SeTakeOwnershipPrivilege	1248	msiexec.exe

Suspicious use of FindShellTrayWindow 13 IoCs

pid	Process
2780	sagr-steam-tools.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4296	dotnet-runtime-9.0.11-win-x64.exe
6340	sagr-steam-tools.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1248	msiexec.exe
3092	MsiExec.exe
2104	MsiExec.exe
5316	MsiExec.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2780 wrote to memory of 1004	2780	sagr-steam-tools.exe	90
PID 1004 wrote to memory of 1204	1004	msedgewebview2.exe	91
PID 1004 wrote to memory of 5028	1004	msedgewebview2.exe	92
PID 1004 wrote to memory of 5028	1004	msedgewebview2.exe	92
PID 1004 wrote to memory of 5028	1004	msedgewebview2.exe	92
PID 1004 wrote to memory of 5028	1004	msedgewebview2.exe	92
PID 1004 wrote to memory of 500	1004	msedgewebview2.exe	93
PID 1004 wrote to memory of 5820	1004	msedgewebview2.exe	94
PID 1004 wrote to memory of 5820	1004	msedgewebview2.exe	94
PID 1004 wrote to memory of 5820	1004	msedgewebview2.exe	94
PID 1004 wrote to memory of 4528	1004	msedgewebview2.exe	95
PID 1004 wrote to memory of 4528	1004	msedgewebview2.exe	95
PID 1004 wrote to memory of 4528	1004	msedgewebview2.exe	95
PID 1004 wrote to memory of 4528	1004	msedgewebview2.exe	95
PID 1004 wrote to memory of 4528	1004	msedgewebview2.exe	95
PID 2780 wrote to memory of 2088	2780	sagr-steam-tools.exe	96
PID 1004 wrote to memory of 4824	1004	msedgewebview2.exe	99
PID 1004 wrote to memory of 4824	1004	msedgewebview2.exe	99
PID 1004 wrote to memory of 4824	1004	msedgewebview2.exe	99
PID 2780 wrote to memory of 4548	2780	sagr-steam-tools.exe	100
PID 4548 wrote to memory of 4820	4548	msedge.exe	101
PID 4548 wrote to memory of 560	4548	msedge.exe	103
PID 4548 wrote to memory of 7024	4548	msedge.exe	104
PID 4548 wrote to memory of 7024	4548	msedge.exe	104
PID 4548 wrote to memory of 7024	4548	msedge.exe	104
PID 4548 wrote to memory of 2192	4548	msedge.exe	105
PID 4548 wrote to memory of 2192	4548	msedge.exe	105
PID 4548 wrote to memory of 6500	4548	msedge.exe	106
PID 4548 wrote to memory of 4928	4548	msedge.exe	107
PID 4548 wrote to memory of 6500	4548	msedge.exe	106
PID 4548 wrote to memory of 6500	4548	msedge.exe	106
PID 4548 wrote to memory of 4928	4548	msedge.exe	107
PID 4548 wrote to memory of 4928	4548	msedge.exe	107
PID 1004 wrote to memory of 3912	1004	msedgewebview2.exe	108
PID 1004 wrote to memory of 3912	1004	msedgewebview2.exe	108
PID 1004 wrote to memory of 3912	1004	msedgewebview2.exe	108
PID 4548 wrote to memory of 2620	4548	msedge.exe	109
PID 4548 wrote to memory of 2792	4548	msedge.exe	110
PID 4548 wrote to memory of 2620	4548	msedge.exe	109
PID 4548 wrote to memory of 2792	4548	msedge.exe	110
PID 4548 wrote to memory of 2792	4548	msedge.exe	110
PID 4548 wrote to memory of 6052	4548	msedge.exe	111
PID 4548 wrote to memory of 6948	4548	msedge.exe	112
PID 4548 wrote to memory of 2728	4548	msedge.exe	113
PID 4548 wrote to memory of 6948	4548	msedge.exe	112
PID 4548 wrote to memory of 2728	4548	msedge.exe	113
PID 4548 wrote to memory of 2896	4548	msedge.exe	115
PID 4548 wrote to memory of 6444	4548	msedge.exe	119
PID 6444 wrote to memory of 4296	6444	dotnet-runtime-9.0.11-win-x64.exe	120
PID 4548 wrote to memory of 5140	4548	msedge.exe	121
PID 5140 wrote to memory of 5224	5140	dotnet-runtime-9.0.11-win-x64.exe	122
PID 1004 wrote to memory of 2392	1004	msedgewebview2.exe	123
PID 1004 wrote to memory of 2392	1004	msedgewebview2.exe	123
PID 1004 wrote to memory of 2392	1004	msedgewebview2.exe	123
PID 4296 wrote to memory of 5948	4296	dotnet-runtime-9.0.11-win-x64.exe	124
PID 2156 wrote to memory of 3668	2156	dotnet-runtime-9.0.11-win-x64.exe	128
PID 3668 wrote to memory of 6092	3668	dotnet-runtime-9.0.11-win-x64.exe	129
PID 1248 wrote to memory of 3092	1248	msiexec.exe	130
PID 1248 wrote to memory of 2104	1248	msiexec.exe	131
PID 1248 wrote to memory of 5316	1248	msiexec.exe	132
PID 4548 wrote to memory of 4468	4548	msedge.exe	133
PID 4548 wrote to memory of 1584	4548	msedge.exe	134
PID 4548 wrote to memory of 3772	4548	msedge.exe	135
PID 6340 wrote to memory of 2256	6340	sagr-steam-tools.exe	139

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\sagr-steam-tools.exe
"C:\Users\Admin\AppData\Local\Temp\sagr-steam-tools.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2780
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=sagr-steam-tools.exe --webview-exe-version=0.1.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.sagarchaulagai.sagrsteamtools\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=2780.2940.3491030211501972807 /pfhostedapp:cf4c60c6415ee22acfe496bee5405483edd45b1e
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:1004
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.sagarchaulagai.sagrsteamtools\EBWebView /prefetch:4 /pfhostedapp:cf4c60c6415ee22acfe496bee5405483edd45b1e --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.sagarchaulagai.sagrsteamtools\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ff90c9b5fd8,0x7ff90c9b5fe4,0x7ff90c9b5ff0
    3⤵
    PID:1204
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.sagarchaulagai.sagrsteamtools\EBWebView" --webview-exe-name=sagr-steam-tools.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1792 --field-trial-handle=1796,i,5081584593398102822,9443355282641999931,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:cf4c60c6415ee22acfe496bee5405483edd45b1e
    3⤵
    PID:5028
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.sagarchaulagai.sagrsteamtools\EBWebView" --webview-exe-name=sagr-steam-tools.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=1940 --field-trial-handle=1796,i,5081584593398102822,9443355282641999931,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:cf4c60c6415ee22acfe496bee5405483edd45b1e
    3⤵
    PID:500
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.sagarchaulagai.sagrsteamtools\EBWebView" --webview-exe-name=sagr-steam-tools.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2432 --field-trial-handle=1796,i,5081584593398102822,9443355282641999931,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:cf4c60c6415ee22acfe496bee5405483edd45b1e
    3⤵
    PID:5820
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.sagarchaulagai.sagrsteamtools\EBWebView" --webview-exe-name=sagr-steam-tools.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3400 --field-trial-handle=1796,i,5081584593398102822,9443355282641999931,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:cf4c60c6415ee22acfe496bee5405483edd45b1e /prefetch:1
    3⤵
    PID:4528
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.sagarchaulagai.sagrsteamtools\EBWebView" --webview-exe-name=sagr-steam-tools.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=3608 --field-trial-handle=1796,i,5081584593398102822,9443355282641999931,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:cf4c60c6415ee22acfe496bee5405483edd45b1e
    3⤵
    PID:4824
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.sagarchaulagai.sagrsteamtools\EBWebView" --webview-exe-name=sagr-steam-tools.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4320 --field-trial-handle=1796,i,5081584593398102822,9443355282641999931,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:cf4c60c6415ee22acfe496bee5405483edd45b1e
    3⤵
    PID:3912
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.sagarchaulagai.sagrsteamtools\EBWebView" --webview-exe-name=sagr-steam-tools.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4376 --field-trial-handle=1796,i,5081584593398102822,9443355282641999931,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:cf4c60c6415ee22acfe496bee5405483edd45b1e
    3⤵
    PID:2392
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.sagarchaulagai.sagrsteamtools\EBWebView" --webview-exe-name=sagr-steam-tools.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=4456 --field-trial-handle=1796,i,5081584593398102822,9443355282641999931,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:cf4c60c6415ee22acfe496bee5405483edd45b1e /prefetch:1
    3⤵
    PID:3992
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.sagarchaulagai.sagrsteamtools\EBWebView" --webview-exe-name=sagr-steam-tools.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4780 --field-trial-handle=1796,i,5081584593398102822,9443355282641999931,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:cf4c60c6415ee22acfe496bee5405483edd45b1e
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:6792
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.sagarchaulagai.sagrsteamtools\EBWebView" --webview-exe-name=sagr-steam-tools.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4896 --field-trial-handle=1796,i,5081584593398102822,9443355282641999931,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:cf4c60c6415ee22acfe496bee5405483edd45b1e
    3⤵
    PID:2728
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.sagarchaulagai.sagrsteamtools\EBWebView" --webview-exe-name=sagr-steam-tools.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4912 --field-trial-handle=1796,i,5081584593398102822,9443355282641999931,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:cf4c60c6415ee22acfe496bee5405483edd45b1e
    3⤵
    PID:3964
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.sagarchaulagai.sagrsteamtools\EBWebView" --webview-exe-name=sagr-steam-tools.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=5060 --field-trial-handle=1796,i,5081584593398102822,9443355282641999931,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:cf4c60c6415ee22acfe496bee5405483edd45b1e
    3⤵
    PID:2140
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.sagarchaulagai.sagrsteamtools\EBWebView" --webview-exe-name=sagr-steam-tools.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4000 --field-trial-handle=1796,i,5081584593398102822,9443355282641999931,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:cf4c60c6415ee22acfe496bee5405483edd45b1e
    3⤵
    PID:2516
- C:\Program Files\dotnet\dotnet.exe
  "dotnet" --list-runtimes
  2⤵
  - System Time Discovery
  PID:2088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://dotnet.microsoft.com/en-us/download/dotnet/thank-you/runtime-9.0.11-windows-x64-installer?cid=getdotnetcore
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Time Discovery
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ff909d8c188,0x7ff909d8c194,0x7ff909d8c1a0
    3⤵
    PID:4820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2092,i,6938272867224687998,501525857687856973,524288 --field-trial-handle=2512,i,7347435824077437236,1358315228139828801,262144 --variations-seed-version --mojo-platform-channel-handle=2540 /prefetch:11
    3⤵
    - Downloads MZ/PE file
    - System Time Discovery
    PID:560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1940,i,15694335713051257491,16526534959574013984,262144 --field-trial-handle=2512,i,7347435824077437236,1358315228139828801,262144 --variations-seed-version --mojo-platform-channel-handle=2508 /prefetch:2
    3⤵
    PID:7024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2804,i,4145712301742265414,14711542285221263114,524288 --field-trial-handle=2512,i,7347435824077437236,1358315228139828801,262144 --variations-seed-version --mojo-platform-channel-handle=2796 /prefetch:13
    3⤵
    PID:2192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3548,i,6029741839760931045,14588038326408394285,2097152 --field-trial-handle=2512,i,7347435824077437236,1358315228139828801,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
    3⤵
    PID:6500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3552,i,13389102605667096423,7943905849387071335,2097152 --field-trial-handle=2512,i,7347435824077437236,1358315228139828801,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
    3⤵
    PID:4928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5220,i,12449294190031449936,17928792798929707025,524288 --field-trial-handle=2512,i,7347435824077437236,1358315228139828801,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:14
    3⤵
    PID:2620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=5396,i,7425039540528945414,17418383930688718655,2097152 --field-trial-handle=2512,i,7347435824077437236,1358315228139828801,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:1
    3⤵
    PID:2792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,2003632438027257487,12681801013829714544,524288 --field-trial-handle=2512,i,7347435824077437236,1358315228139828801,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:14
    3⤵
    PID:6052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,7483773946356548002,5727431534573957123,524288 --field-trial-handle=2512,i,7347435824077437236,1358315228139828801,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:14
    3⤵
    PID:6948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5940,i,17732676567671493154,13110068227576127030,524288 --field-trial-handle=2512,i,7347435824077437236,1358315228139828801,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:14
    3⤵
    PID:2728
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6596,i,18124652276221254103,11457890139475483441,524288 --field-trial-handle=2512,i,7347435824077437236,1358315228139828801,262144 --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:14
    3⤵
    PID:5856
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6596,i,18124652276221254103,11457890139475483441,524288 --field-trial-handle=2512,i,7347435824077437236,1358315228139828801,262144 --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:14
    3⤵
    PID:2896
- - C:\Users\Admin\Downloads\dotnet-runtime-9.0.11-win-x64.exe
    "C:\Users\Admin\Downloads\dotnet-runtime-9.0.11-win-x64.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - System Time Discovery
    - Suspicious use of WriteProcessMemory
    PID:6444
  - - C:\Windows\Temp\{1AF8E040-6603-4CE7-8EF7-31BE0F36683E}\.cr\dotnet-runtime-9.0.11-win-x64.exe
      "C:\Windows\Temp\{1AF8E040-6603-4CE7-8EF7-31BE0F36683E}\.cr\dotnet-runtime-9.0.11-win-x64.exe" -burn.clean.room="C:\Users\Admin\Downloads\dotnet-runtime-9.0.11-win-x64.exe" -burn.filehandle.attached=748 -burn.filehandle.self=752
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      System Time Discovery
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:4296
    - - C:\Windows\Temp\{B2F191E0-12BA-4002-86AC-E0E702D9E9D0}\.be\dotnet-runtime-9.0.11-win-x64.exe
        
        "C:\Windows\Temp\{B2F191E0-12BA-4002-86AC-E0E702D9E9D0}\.be\dotnet-runtime-9.0.11-win-x64.exe" -q -burn.elevated BurnPipe.{D193730D-54F2-4F50-AACB-7DF0E7E48EB5} {C1244AB7-655A-4956-AE32-B96071B7018F} 4296
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        System Time Discovery
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:5948
- - C:\Users\Admin\Downloads\dotnet-runtime-9.0.11-win-x64.exe
    "C:\Users\Admin\Downloads\dotnet-runtime-9.0.11-win-x64.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - System Time Discovery
    - Suspicious use of WriteProcessMemory
    PID:5140
  - - C:\Windows\Temp\{74741DCA-85C9-4DBA-9650-B637A4FA4947}\.cr\dotnet-runtime-9.0.11-win-x64.exe
      "C:\Windows\Temp\{74741DCA-85C9-4DBA-9650-B637A4FA4947}\.cr\dotnet-runtime-9.0.11-win-x64.exe" -burn.clean.room="C:\Users\Admin\Downloads\dotnet-runtime-9.0.11-win-x64.exe" -burn.filehandle.attached=748 -burn.filehandle.self=752
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      System Time Discovery
      PID:5224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1304,i,12533760999292537525,2316858465891869586,524288 --field-trial-handle=2512,i,7347435824077437236,1358315228139828801,262144 --variations-seed-version --mojo-platform-channel-handle=6712 /prefetch:14
    3⤵
    PID:4468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1308,i,14797397009926659025,2781531003983588216,524288 --field-trial-handle=2512,i,7347435824077437236,1358315228139828801,262144 --variations-seed-version --mojo-platform-channel-handle=6688 /prefetch:14
    3⤵
    PID:1584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1312,i,11123214053692252794,3908278592965391593,524288 --field-trial-handle=2512,i,7347435824077437236,1358315228139828801,262144 --variations-seed-version --mojo-platform-channel-handle=6756 /prefetch:14
    3⤵
    PID:3772
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6340,i,14850506079594565057,2664270318848705356,524288 --field-trial-handle=2512,i,7347435824077437236,1358315228139828801,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:14
    3⤵
    PID:7044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,7830117668174351703,1427501815407253332,524288 --field-trial-handle=2512,i,7347435824077437236,1358315228139828801,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:14
    3⤵
    PID:2512
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1604,i,372883898434194159,9441807192027537361,524288 --field-trial-handle=2512,i,7347435824077437236,1358315228139828801,262144 --variations-seed-version --mojo-platform-channel-handle=6992 /prefetch:14
    3⤵
    PID:6204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6320,i,12441980769982999423,6054172351503263715,524288 --field-trial-handle=2512,i,7347435824077437236,1358315228139828801,262144 --variations-seed-version --mojo-platform-channel-handle=6988 /prefetch:14
    3⤵
    PID:5128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=924,i,2750739133861086112,4809718439513733117,524288 --field-trial-handle=2512,i,7347435824077437236,1358315228139828801,262144 --variations-seed-version --mojo-platform-channel-handle=7232 /prefetch:14
    3⤵
    PID:1760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1124,i,9249872925742238141,5936243737575628186,262144 --field-trial-handle=2512,i,7347435824077437236,1358315228139828801,262144 --variations-seed-version --mojo-platform-channel-handle=6968 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6292,i,7133462241493337908,15381849929240164302,524288 --field-trial-handle=2512,i,7347435824077437236,1358315228139828801,262144 --variations-seed-version --mojo-platform-channel-handle=920 /prefetch:14
    3⤵
    PID:4780

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4416

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1632

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6128

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1248
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 9DA556C47FF9E33087320EDC1685712C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3092
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 6A85FDF9CF9C0D94ADBF7482D5A6C7D1
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2104
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 542A0C797787E72C8875C6F584C588CB
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5316

C:\ProgramData\Package Cache\{0019b11f-9474-4643-b590-4b4ddbe9039c}\dotnet-runtime-9.0.11-win-x64.exe
"C:\ProgramData\Package Cache\{0019b11f-9474-4643-b590-4b4ddbe9039c}\dotnet-runtime-9.0.11-win-x64.exe" /burn.runonce
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- System Time Discovery
- Suspicious use of WriteProcessMemory
PID:2156
- C:\ProgramData\Package Cache\{0019b11f-9474-4643-b590-4b4ddbe9039c}\dotnet-runtime-9.0.11-win-x64.exe
  "C:\ProgramData\Package Cache\{0019b11f-9474-4643-b590-4b4ddbe9039c}\dotnet-runtime-9.0.11-win-x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_.NET_Runtime_-_9.0.11_(x64)_20260623184407.log"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Time Discovery
  - Suspicious use of WriteProcessMemory
  PID:3668
- - C:\ProgramData\Package Cache\{0019b11f-9474-4643-b590-4b4ddbe9039c}\dotnet-runtime-9.0.11-win-x64.exe
    "C:\ProgramData\Package Cache\{0019b11f-9474-4643-b590-4b4ddbe9039c}\dotnet-runtime-9.0.11-win-x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{0019b11f-9474-4643-b590-4b4ddbe9039c}\dotnet-runtime-9.0.11-win-x64.exe" -burn.filehandle.attached=560 -burn.filehandle.self=580 /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_.NET_Runtime_-_9.0.11_(x64)_20260623184407.log"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - System Time Discovery
    PID:6092

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
PID:5196

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5244

C:\Users\Admin\AppData\Local\Temp\sagr-steam-tools.exe
"C:\Users\Admin\AppData\Local\Temp\sagr-steam-tools.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:6340
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=sagr-steam-tools.exe --webview-exe-version=0.1.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.sagarchaulagai.sagrsteamtools\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=6340.3900.5905679531083292154 /pfhostedapp:cf4c60c6415ee22acfe496bee5405483edd45b1e
  2⤵
  PID:2256
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.sagarchaulagai.sagrsteamtools\EBWebView /prefetch:4 /pfhostedapp:cf4c60c6415ee22acfe496bee5405483edd45b1e --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.sagarchaulagai.sagrsteamtools\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x164,0x198,0x7ff90c9b5fd8,0x7ff90c9b5fe4,0x7ff90c9b5ff0
    3⤵
    PID:6580
- C:\Program Files\dotnet\dotnet.exe
  "dotnet" --list-runtimes
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Time Discovery
  PID:6260

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5a2dcb.rbs

Path C:\Config.Msi\e5a2dcb.rbs
Size 48KB
SHA256 631cbdea3695b5d95061c0e1864b88b17454f2e57aace7e86515c50701ae98d1
MD5 9fff55e75af090d4782cb388a514f3e2
SHA1 d290eaf5d155f582f72402eaf0d4d3dbf8dda903
SHA512 86db7556603c89691f548050a6547d3786d70aa2a423bb82a58a4d2500ea5893499a87dbd695f212c715887c8163adcc6cd3c7fdf74d40ab3cda69b19eb675f9
SSDEEP 1536:oeNYI3CNqpo5r1XUHzhgsQQLeCyQTMpIABjp/0KQBLIr0TuTzcwF6CHDmq61D402:lzzp8V
TLSH
T12B230068AF00D1E3F632FB6D53B3DE4437598EC92F84448E4BC94226DD41ED89BAC199
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a2dd0.rbs

Path C:\Config.Msi\e5a2dd0.rbs
Size 9KB
SHA256 f872f26d7b8ba7a7b611766627c6959569120d3e97224df5250abf950e5acd69
MD5 32db3b058dff69061d14405463b3caec
SHA1 9a8b10d3dea9d69cdf62a060205b41b435ab44d1
SHA512 5c945365c9c19c9c74e22e89d29ff4bd3120dc8601227c9d72f87c996dfa7ae3f4fa6d4c5db136dcdb28158178211c012694bdf11a2e10ba8e328a7df6a2cd10
SSDEEP 96:nmYDhODJpLHrWDPCC/0IAUHeD2/tECsTleUHeD2/tEC6jFThLYDZTl5YDFqE5I72:mjBLRCRfLtrILLtr66XEEArZvpz9
TLSH
T16E124542765882F3DC6217B8CB431B653BA2D3D6A600938B18CD96749F537C80FE56EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a2dd5.rbs

Path C:\Config.Msi\e5a2dd5.rbs
Size 10KB
SHA256 ea110ba8de31cfae8b00e4e598fb084bbb211970a049a57fd82677607cc6f7c0
MD5 727e22b4cfd8a3d1fd8bf5a792ba15ad
SHA1 3eeb89d7a1ec413786d737850116d7ef871aacaa
SHA512 6946e1ee4d17e8bf01515084252bcfa92d88a68d856601a1e3deaa3ca96da2e88ce86522536a24c4720c77063a4d58dc2d44f4cdc3975f2558f8f2132afaba9e
SSDEEP 192:baB72KO5HHJm9CGfG6trIgG6trXhEdwGgvpS:baB72KO5Hp4G6trG6tA/
TLSH
T1822201027A00C9D3FD526735CB072B213BB7DBD68314664F14CCA568AE937D81AB92DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ThirdPartyNotices.txt

Path C:\Program Files\dotnet\ThirdPartyNotices.txt
Size 77KB
SHA256 e8ddd95ac905467e4e519b446ca023fa00c31732bebd9b66e65101c712092ee7
MD5 406d07d20e58568365df0557629fadc6
SHA1 9ab5ba1ef3866afa75b8cf3c392b7dd3d7f52026
SHA512 c6025a947faa5dc2b41a14d75e228ca2bd0df094e8cef914c58a6d2f5854424972a647b2c8ca8173345e40ba7557843d03efa85c5098c6e0e6726377efc8a38f
SSDEEP 1536:HA9jHwsGfgg39/zwgAVkguQxrDjugtSEGepkWvrpX7anuqdLSVnfiStPq+3Lefrb:HA97w/ogz1AVxuMjHtSFULryLOgrGWwa
TLSH
T1F573A45F7E45077319E2C3916569A8C5F22FA02E3B6B2A44346EF248133B42DD6FF858
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 158KB
SHA256 65f08e5f087ef76325a019b13159ddedac551bb23827ae552f806a818acbee78
MD5 a9717adafd14f14f9830f78d38015492
SHA1 73dc981c7361ff336886b7e241da102dfabb5419
SHA512 189e42f827b3674afc0d043b217b6c6a433acec79dcede77bf0d63e2fff432fb40cd73a538c3a349ce13744852ca55fda6c7ad2a92e17ef775b33b4e0a102e90
SSDEEP 3072:5ObbfFCnbu6mG/0j0Rhn2p/S7EcN7KE9IMmC:g/wnbu6mG/aIhzAW5hv
TLSH
T129F3061AD65811AAD16E9571C7428A41FB337C6687E0E7CB13D0F9BE0F326906EE9703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hostfxr.dll

Path C:\Program Files\dotnet\host\fxr\9.0.11\hostfxr.dll
Size 365KB
SHA256 b569dfb48ae024e236be55987bec36f92f7e38cf42b3b62307c0bbedd3798a34
MD5 2739f8246c9c851a38c23172b5361849
SHA1 397ba975d313c02b00632844aec1c0880ff13d7d
SHA512 b5beff2644f13a66d4c6a3afb4e7bfb1c2034bdcc06774773a7701fa3040b7f1caffd811102142ecf5af584b8b1b011c6f95aa33bb1f155114191461551b9aae
SSDEEP 6144:c46pHMZyxe/Ynv5T5EVu5gEa4V/RLyy/No5MiuXe2+Dj3gIqa44swuOzmLDsXJz7:KaevGwV/xLo5TEjwvEwz5OE
TLSH
T147842916D7E8057CF0B79678C9B28901EB727C494B74D6CF139098A61E73BD09E39322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

state.rsm

Path C:\ProgramData\Package Cache\{0019b11f-9474-4643-b590-4b4ddbe9039c}\state.rsm
Size 886B
SHA256 8cbd3c086cfe3e47742c7b6c9bb04fee7cf3dc760ce13265a7cbd222b2fbdf6c
MD5 434720f16ddcae310e309bbff1d6596f
SHA1 83309a6a131d4e0cbe1bc9a01b1a779f3824dae9
SHA512 7d78530a90c3f745b1fb7e24a60bb3cb0783dea9c04cd07e401711ba5860dda8ddd2742fc2caff48e2b48095462323d33fc9accdc658727c441a13c5dc0b1593
TLSH
T128118CA14FFA422DE3FA6B7078F95659253ABC124D32C62C0441318A8F31B908D74F77
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e4519ee111087f538c263265602f50ded4fd0a8d30a1eb29782923b7ecf6f706
MD5 d977ed51ddea169ff3aaacb58cc9fc88
SHA1 1161e22350839b669f3e2b6cb5cee6ee9c25e467
SHA512 3be5b17585bc96cf349403e8b57f50691da3e8f841f657a12d21c7bac323eb584bb56037d190cf5f25e30923fa75219cfff261e56df71e06f9d9981a3fd990d4
TLSH
T187D022213628F001E62A10B34D30832012198A4A29A39A0A3C90804AE8A6080A2D244B
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 01fc33638563dc8ab1a7b28573704bed2449b99eedc9bd38a25b21316506e8a0
MD5 11027c4e8a2219c9ce2e898ab0ee23b7
SHA1 035426b9d83735103c3507c9017885546a4bc3f1
SHA512 a538fa52093c0e8ae9c8760749e2905603b5390edd667d6d7eed03fc52795e15b07573b9fb01fe984851203afcec62a80bbc50d6e99f5fbb2fc0771ec7bb014b
TLSH
T1B2D022213628F001E22A10B34D20831012198A0629A39A0A3C90D04AE8A6080B2D2447
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 032dda1487d7a4e04000744afa72472e25cabd40425855a8757c7169f41dfc34
MD5 7da6c730f27c553640924da7dd3cead0
SHA1 de08b3bfdfa5262d963e9a879e0bb5a89a398d70
SHA512 e072cbea66c5183f6ac74d90b8dee2c7a81cfe31b400a31d1a5e0c5b201d6ed31dd4e56962dffed087afa10f08578eb3b55a4fd79bd3e2e420fcfcc43a2b6908
TLSH
T194E02BABC8249C7B04FD1F59645046C6EB1013576B40455B3A3DC20D8FB47FF5681C5C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 f7153ac0515940dd01b89b91a421d38232fd6053aef0139db3a7995e462e96e0
MD5 c8b27e5ecda6bcdb26bc940866f9b9f0
SHA1 0bc0e239ddfc54eecd175eb0758d93592a6f2265
SHA512 0749668543d6da0cc4fcc04c0d222f3731f70b1f4a9b9b08865f644da4a5f761d73c3688586162104c56546b2602bd25b5dd3ed0f3f19de14bc360d0aa400d29
TLSH
T16E713E0851A145A2FF1606F4BCE2D899FB7704CE57872EF298B0F2708D5FB768191C58
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a5e4e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a5e4e.TMP
Size 3KB
SHA256 d1efe77bec6a8749c55dfdc59fc083ba0e9119c2067586b56b3f6168d41dfe26
MD5 606b1ebdad7d2203761ef295d0d26c8d
SHA1 a312b9126d30d3cba62bd73ab0702615f2e5e2eb
SHA512 9a6ecbf86ae778af76becf200017d7ac2a04950f327bd37253a0558c805ffcc3180bbe145e56c799e1d8e2c322066c86037e2b85718634c407f58fe139b70a40
TLSH
T10161810851614562FB2606F9BCE1D5C9F77708CE97072EF1A8B0F2708D0FB328181D59
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a7b69a7e-5659-42fb-bfca-efa712091dd0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\a7b69a7e-5659-42fb-bfca-efa712091dd0.tmp
Size 2KB
SHA256 79618ceeddfdc04e11b7bb7e5cd597d4f2a697c8ae6c8a2526efba6843979c7d
MD5 35b15f616eb51c72f8ae4e63e5354a6c
SHA1 a8c26beab69cba7a5bf6df78028ed18c03f8d4bc
SHA512 5ddfa0988192f00cb1107ebe8ffe7372497fb02ab81a2b0baed7e1842b8d5b4e5537e6f7a4dfe2d853d7b39f6c0ca94984bc33273b8729beada84b84dadd8a17
TLSH
T1E651ACF787F4856E9E1196F0AA18AE2FDF2D0515431C3C6A89E0AE27D3E3471E10265B
MD5 SHA1 SHA512 TLSH

Submit Download

c369f9fd-8e79-403c-ab9b-1905d7dca6ab.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\c369f9fd-8e79-403c-ab9b-1905d7dca6ab.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 a2a9e00f31d2f9f45eecea0b7f204b7d92436e6525ed4413a9c5acbac9d02f02
MD5 31bf48b5f132ccc81fcba38937fe5fc6
SHA1 580f4ecc246ef25e7fbbbb45a3f30aef9c61edcd
SHA512 261a06e151b410a4954003917d80fdfb54d68e7376f6513ea3845aa142d34b9280c06a7f6ad0892fd6c52c7e8554670939b8ad271e50d6935f8946fbf99408af
SSDEEP 192:sxRwRQyMqZjK1Ml8wlQ/f5sb2yD+1ZuEsZUzoA8pLg/g6+WNZ8DIc/Aa1UCZDkGx:sxRw7TQ/f5sbLi7QZ1k/5Wsc/AsDiju
TLSH
T13172DA16A93899778CDBD219FA457F63D2F81563F2905E44AAFC8B1C00E7ADD211382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 60adc7a2b62b350bc528b04ee4cd96b06a70e47228a30ea426cffe06beade2dc
MD5 4977738c3057d853e07861bbb081dc7b
SHA1 b9eebf3c5c3777658ff26e7e57dedad3fe2270c4
SHA512 1eb946a62b23d1b431b5dc779c972242ef2679e4e70901ebde8f60acca4457b51a5c0d5f89d86676c63caf4689b1f531bdd1cab4718f0fe284a7b16bb1cb9879
SSDEEP 192:sxRwRQyMqZjK1Ml8UQJlQ/f5skyDw1ZuEsZUzoA8pLg/g6+WNZ8DIc/Aa1USZDku:sxRw7q/Q/f5st87QZ1k/5Wsc/AcDiAl
TLSH
T1B772D916A9389D778CDBD619F6857F53D2F81563B2805E48AAFC8B1C00E7ADD211382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 4abc6164591cff00ae678087fb4d8431cd91ff540b14f92fa0b1049871f390d4
MD5 85cb62396a5c267f9a6b166484779647
SHA1 7d382838e69bef4ce1515559f8715debd737c6b6
SHA512 d2be961d88bd5f8edc7a375fae5f08b09b7068a8bf7ba6c6119eb0711369eb7f94efb24ec324594add3effb077757688f8cdedd13f9f55a9237d3ea06ce344af
SSDEEP 768:z2SIZz7pLuL7uTWgBdfLk8F1+UoAYDCx9Tuqh0VfUC9xbog/OVUtbIvbgZvro1Ac:z2SIZlE7uTWgBdfLku1jaDcvkZ8ic
TLSH
T1E5E2DC3B680CCB7E4F44499CEC29BE9A6DE801CF96D8C99447FA444C03C66EB52175D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 27d56ca20a6bc7749e8fc24cd8ffc47c19d2c4ebcc368773a650c4835973c1bd
MD5 9aab9c5ad370d5ef4af0e9b69e3d0cc8
SHA1 5d15f975e3990d7d1b28cb01fdd8f4cc47d36e66
SHA512 cc6e8928e4687885f204cdcbe303b30f67061a5e4937d51a0167d1fa5baeb09e979f30322fb4f73612b0e9eb2d8520fdb2a5330d060c8273ab6067971dbe66bd
SSDEEP 96:KcucKzSmmD+KsoPjWKQsKGpSKSsx8gKVGeGbqKEEfxGK6giOrOKs4MduK2E662w7:ijdt9ZpfpRBNwVnqxpJFBTPLyPp6
TLSH
T1CFB229117A7E220138BE250CE195966F274230B3705AB63B7B7D20F64EA6E011FFD9D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 e460b66cb4bd657cb14efabd0a213a1c249aca4535f5ff48435d848fa6b69e21
MD5 bf8c2f23730a5517f4b49594e6b297d6
SHA1 2a96d58ec75d9bb404c3074b63ef10509b59fd36
SHA512 0333e83a1a3eaaab40a0cd9b27de45139fb68c009e53089f7fdd43dbb274622bfbc86f2ac1f2cdfcc13c563c0efd563cc96f82cd0b38b5f56db3052b7732a5ad
SSDEEP 384:nXiF1tNn/s3n9S58N98TUNTUlIRXLqYBaAnmcAfLpGwoA0u4mRZ5VwxSAYITGT0g:SF1j+9sIwgd3ngGxA0inoSAYi+0lQvf
TLSH
T1C3C23A32D864CABBEDEA4FD5B70A774AAEF0016384D86ED9D9D81D4D00972DC1307C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 c9dc907996f2345552f7c93b0d13b916b0fcfcd746186cf009a51144ad89f24f
MD5 b79f59de14ac4f80d21da94acfe4fc4e
SHA1 d8341014b7b8ed647a03a47aa34da70faca4cad6
SHA512 cdb0b13c22b8917be8dec4aae3486ae4bc58c0323a0c44f4527c8f8982ae966db1785dd8411dbf7565624e716faaa949d9e51843e066fd283ab99c85019bb804
SSDEEP 384:ngiFotNn/s3n9Sw8Ng8TUNTUlIRmLqYBrgWVcAfLpGwoA0u4mRZ5VwCNsBcITGTv:7Foj+9JRwgc6WNGxA0inwBci+0evJ
TLSH
T146C24B32D855CE77ACEB8AD5B34A374A9EF001A3C4C86ED9D9D85E4C00972ED174BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 86eaa095e46289a0973c8448f8d5121c4f673ef4e67bc1d138fa455d2ef508fa
MD5 be9f099b9fd08cd171b8a3f62856e4ad
SHA1 738acfff85051eb5b809802f2d5a807e8ea3e7c6
SHA512 4b0f109bfe1d80bf6c8961963b7c1342382a4645c30f31248cde149b6b36e8ba8256dcc68a8d3a452bcb5fa031d0bc2317fa541da5d15e4617b51c2311aa0633
SSDEEP 384:nx2iFPtNn/s3n9S78Ng8TUNTUlIRmLqYBZgWVcAfLpGwoA0u4mRZ5VwCNslcITGD:xdFPj+9uRwgcMWNGxA0inwlci+0evJ
TLSH
T17CC25C32D855CE77ACEB8AD5B20A374A9EF001A3C4C86ED9D9DC5E4C00872DD174BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 827f77ca40a1affc4436fa3fc7b9f85f233541d2a3754efb5a042d6c0fa423a5
MD5 8ff2faaa3304798352441b422bd24024
SHA1 e419107ac3bbff511d3b447ed2e0fe8f83b1d47d
SHA512 679fa667b65bb64c75167dcb256db051124ff8f596b2a0a6da3005c739a1387ed1968b9ad7a42a3a88a1dfbf1855f3642af3bf9b58837e71340f93f2f64960ce
SSDEEP 384:nxfiFPtNn/s3n9Sp8Ng8TUNTUlIRmLqYBZsWVcCfLpGwoA0u4mRZ5VwCNsLcITGD:xqFPj+9oRwgcQWzGxA0inwLci+0evJ
TLSH
T1F6E2B4F298D7C977D89E4787633D2E469AFCC163B4885989B7C81D4CCC861BFC60A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 673da5c871f4c97f22617aea1a6822b08b65021ec081e656dfabfa0871fd32b8
MD5 0ce545db4881bdfcc8120090a0893b18
SHA1 7fbdf2a47d2414e2ddb04238831aa2aa36318896
SHA512 7153cfc93cff571538ceb2630058ebc40b9d92c139663e3dcffc7b0e3138d68410df0ef1ea58471dd15c334b23d0421ada7a046dc0be6d45332cec5ae512c9e2
SSDEEP 384:ngiF1tNn/s3n9S58Ng8TUNTUlIRpLqYBmgWVcAfLpGwoA0u4mRZ5VwCNsBcqdDjK:7F1j+9sRwgLvWNGxA0inwBcADlvU
TLSH
T106B22A32E854CE77ACEB8AC5B74A3746AEF001A394C89ED9D9C85E4D00D72DD174BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 72dbd3facc3a825d14389fe56f8006793191b0b1422513ab4a212f2afbf899e5
MD5 82e626649d93fabe8501899eb8b179ee
SHA1 a8b32deb654ebdc84d5cbdaa8977549ecab3f8a4
SHA512 fc999dcccf74e1cb1192f9245e4b3ea1a1b897c6eaf9f1408994a0db828bd4993251dad75a89116e65aea3e85467dabeac650880c75942f10bbc9f966a82ad5e
TLSH
T13E3164D15C3C1AD1D4BE0DBFA04B38FC84D8D216F5A4707A2C54ED94563D90E254083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 6b7ce99216c6d4efa8eebf7a194b97670da04b9983ee8b5b5194cddfdf05c63d
MD5 5ca2000393b2b67b15b7cffaf44f9b74
SHA1 d8edaf0bbb2647369a0e28292df3a48fecca14ca
SHA512 d67f76d988669c64f5a3d383c997663de5566af5c84fe085c387382fbe94c64b1210432906962a7d786250e6e07ec66dbccd6d892fe380b840cdbb5e1f845acf
TLSH
T1AE414ED19D3C2AD1D4BE0EBFB48B38FC94D8D226F5A4347A2C58EC94522DA0D258083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 02b12a324c621ead0cc3030adca24575ce3c079b69d0da1071c9abb8222acd6d
MD5 e9b83554e137e15898ab30fab49a6bcc
SHA1 3d7328c9aff15a4006c1560fb685f0284624fc45
SHA512 63542b332c588cde9cb61fb250a7baa9565e65e7c7fe51a2cfbbb29b633b8ca218c077528540dadfde4480f08305fe656af199fad206915f4cbef95f09d9b319
TLSH
T14A3121D16D3C2AD1D4BE0EBFA09B38FC94D8D226F564747A2854EC94563D54E258083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 66c92f96c49327b9a864f35f36dac477d18a8b7a792272c6d6d80342dca496b3
MD5 0cf9367ae8266d057d3547b339dffd7b
SHA1 ccf3db6d8b42baf3f1b3224a2ed577113327a4e7
SHA512 0e6be53fcf9a142b7d92f8ccded1444e66d23561881c36fe83ef8473d1faa0692dd9137a3987528d617a0a6b853aab3ebab744c5f20076858b0f292af053e58f
TLSH
T14B4161D0583C2AD1D4BE0E7FB08738FC84E8D726F1A4347E2C58E898463AA0D658083F
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft_.NET_Runtime_-_9.0.11_(x64)_20260623184407_000_dotnet_runtime_9.0.11_win_x64.msi.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_.NET_Runtime_-_9.0.11_(x64)_20260623184407_000_dotnet_runtime_9.0.11_win_x64.msi.log
Size 2KB
SHA256 31e7afea2fd570967dbaa476b8fc14e609ae17ccd6db91f8b15336632900fbf3
MD5 531a3f4cdfe228c085b39831ebd6f700
SHA1 3d15dad4025bfa165c16e8f29e99eb0cea31dfea
SHA512 94fed7c5b3c9e3fd6eef385e57cfeb2c9cf3100607ab8427cb09efe21624d5c097b502126a397b3a2279b3755c56b544f88e698cc853f8063947f0c3ffa2c154
TLSH
T16F41EA691BD90906B1B617879EF7C1A30B73FCD7A834DF4C13448229066BD05696CB7A
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft_.NET_Runtime_-_9.0.11_(x64)_20260623184407_001_dotnet_hostfxr_9.0.11_win_x64.msi.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_.NET_Runtime_-_9.0.11_(x64)_20260623184407_001_dotnet_hostfxr_9.0.11_win_x64.msi.log
Size 3KB
SHA256 50eb20c21ff35d1c32e6b0120b52378fd98542e02415a2336d4ea6376bce4c7e
MD5 b3f7ecdf03beb40ab5237625ea6a5eb1
SHA1 9e59306db0e9fcc6bd39d4ddb0dd918e588dd344
SHA512 e9f7a5f47556e0db1b2838cb2fea608a29788bcc6dafa99867d558750dc8ad6f763d949ee8239e32065eec289abdfe892c596798f854d1cb28685e3441208fda
TLSH
T1C88122295AD50807B2B356475FF7C5521A33FCD65834DF8C1385821D06ABC09B9ACB7E
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft_.NET_Runtime_-_9.0.11_(x64)_20260623184407_002_dotnet_host_9.0.11_win_x64.msi.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_.NET_Runtime_-_9.0.11_(x64)_20260623184407_002_dotnet_host_9.0.11_win_x64.msi.log
Size 3KB
SHA256 e9486d9746d470203757b3960e83ebd103a8557fa8b08b4c31360bec27ab177b
MD5 96cd86dfca9baf732b1169e483b86f2c
SHA1 b724e1b70934d2d770c75ae9329efbcd37437c44
SHA512 67a6842c310ee97ba977f136651e6a6a1bdcdaf0065fa6fd6f346ed72d4acd490b5730e71b203359b4ae300d9487921db5e8068ac482dfb0bab71909ec2e6e68
TLSH
T188712D255EE50906F2B75687DEF7C1921B33FCDA9934CB4C5384C219066BC06A8BCB7A
MD5 SHA1 SHA512 TLSH

Submit Download

5820f146-f4ec-46dc-9326-8786474c7024.tmp

Path C:\Users\Admin\AppData\Local\com.sagarchaulagai.sagrsteamtools\EBWebView\5820f146-f4ec-46dc-9326-8786474c7024.tmp
Size 17KB
SHA256 d14489d7e9408ad4c8df9747440de789643860f3134e4de30883de85a191f0d6
MD5 05f4719b4f9fab4c36b1a9c1a2f952db
SHA1 9b91b9ea904b2582f891e7f42f51a1f5b39001c0
SHA512 2d636da927e45f3f97f46babdb624c627a08f936bad9ff05331985857ff75e732fb0bc2f73e01f4cdea22055ae19c325820da9dac20b05ca160d57717dabafd3
SSDEEP 384:dOjae3af7pOMe4tyUOh8iqLyWpMmGXNBSAMtPRkadEWkj4fHH3isdp5:wjaeqD4MlshiLdMmOMtPiUkj4fHH3isx
TLSH
T181728C7ADCB8AD778C7385466A07BB9B57B0419A86C67ED8E8D81F4C02875CE0207C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.sagarchaulagai.sagrsteamtools\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 97f4052b0eb27699cad80350325ce99f70981ca22de9b444ac7fcc98a2654a6f
MD5 c5b75065a853130c41050f235ebad6a0
SHA1 8f013e5e0ed6f638ce34eb753d63bc813517ce33
SHA512 c1ba4793d598c13eca0c47d382829df9e835a7d7258512390883529d76738f34fe9b5e7c5770cdfa020d202997ee29e8d22c0670f6858df360e9fea81a64e07a
TLSH
T1F9D02BB63D4175F0D40024330041BD4A1380D707440A40550C3ECE1D6B458700C0BCB3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.sagarchaulagai.sagrsteamtools\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 077c146d78ad6b580e195b9dac5f0c99e92feef9da66dd13fa31baa07b902185
MD5 3ce39dc90e12e9e378d2fa0fc5ac77a0
SHA1 4b95d094c9904db67248381946af82dd4f7aad24
SHA512 dedb319a93ed623b03cde5cf02eb3cdc5823fb93ee0b3a31ac27ae95e44dd058bea36cdc2132133768b892a8288105f8a3f4f77e5a935853bb9d8e58a7f8926a
TLSH
T1F6D012323A412174C010343300026A590540C60B400640005C2CC91D1B450601907892
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.sagarchaulagai.sagrsteamtools\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 85433843c03412fe717ca48ff1dd6f8f30ea9eb66c09ca095f61aaa983cf1342
MD5 a414d849419ec231cf436fef1183dd35
SHA1 806c42bcbdd1a69e6d6b26812f35306fc52b59bb
SHA512 75c6c275daaffeff31be0d547c62e6a9eb354083ed6d7c09015cf28ca21e74bd6725ef8be432dbbae129c3958c2b4a66ca248fef0d25fe350b3c3abcde15056d
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.sagarchaulagai.sagrsteamtools\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.sagarchaulagai.sagrsteamtools\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 e58e248aae44d2ac55276869273205e33d8c864f5689fd462106a53ae5a39945
MD5 3918b1b49ae0bffa5239a6dc40f47fef
SHA1 bc5f4c52915fee83253b9c85ec91981f87e5ae89
SHA512 0101f360fbb3d1da2d79e0cd4cd59f89567371f7d971fb9c6653b0fa57932d8558f12aabcf651cea2f3ca52176d4619b3da249571dbc3ba87eed672758be489d
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.sagarchaulagai.sagrsteamtools\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 be1fa7b14bb3f4b9801c1978bdc70ff092316981ba7152ff9e5b7b1fa6242bb4
MD5 eef2a558a75fd74376149924400157b8
SHA1 eadfff2ef4fdcc82e50fe9a1685725a7293ce9d2
SHA512 c89038cdb8faa4d8ec103fd510e92a5ec9efef9a4f2f0a99715b2c5d5b0de042f6de0eb82b1116e0d0b52f90fcb4c654c88fe01f746f8c61a5622545d4672648
TLSH
T160A002101154A242C91343F012F281A4F3789E118AA3070585F641BCC859F95C126055
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.sagarchaulagai.sagrsteamtools\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 40f650489d9aa39a2dc601dfc04c861775ed264c7187d229c7bfce2bfb304468
MD5 3aa77f4a3c6695e42c6a87215afad00b
SHA1 1ef85d3dc43bdccc8313e43e7e932c6bb03bb0c4
SHA512 a9c67eada24f7d0f24f4468a4e82fcf529a82e86c2b6d65b6c3746ded89b255168334081974cc195b13264aa77a64835d8058e03d7dfca41a5acd07be6a5e162
TLSH
T196B01210000071C2E962E3B241D1406573308D100143070D10F380DC8820FD04453002
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.sagarchaulagai.sagrsteamtools\EBWebView\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.sagarchaulagai.sagrsteamtools\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.sagarchaulagai.sagrsteamtools\EBWebView\Default\Network\Network Persistent State
Size 964B
SHA256 91ba408909c673bd5ab9a9b999aac5b169c398165bf5843d38b11417cdeff0bf
MD5 38067cc1a883d663b900f8352db535bf
SHA1 9705ae72e63511c3cc5e795e571fc57c10d3ad55
SHA512 4899b431dc3a2f59e417fab037566d007b660f7075b071c42e340e5bdaebb955cd58cffe8b75e8293634278ef8a82fae9e3a90483d3e66c1d29c0ff212b98143
TLSH
T10B119BA683E4C67D8A4566E026347917CD2E041A93287D27CDEAEBD997E1071D21160F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.sagarchaulagai.sagrsteamtools\EBWebView\Default\Network\Network Persistent State
Size 821B
SHA256 7eaa351749490620c2734e1b8fa6dccd06817e612f82739b8f8bfbee6349c8d8
MD5 32d955b0eeee1e7f83573d83029dea0d
SHA1 6a8f95644d9640a906e8d05987f24975543a691a
SHA512 c67d58de846c9888bac48cfdfb38bd37d818aceae3e82a44f4da50bf0372d32ab6ed348dec63c37c813512412a5706f42fcd9a7160094571aae1dcd4b5d1ed35
TLSH
T18601C9A6C3E4C67D8E4117E036387913CD2E081993287E27CDEAEBDA97E1071D22060F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe59e4f7.TMP

Path C:\Users\Admin\AppData\Local\com.sagarchaulagai.sagrsteamtools\EBWebView\Default\Network\Network Persistent State~RFe59e4f7.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.sagarchaulagai.sagrsteamtools\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\com.sagarchaulagai.sagrsteamtools\EBWebView\Default\Network\TransportSecurity
Size 356B
SHA256 8a2e95c58177ca928cbd767077ea946cd2ae52937bda9039db8b40da3e93f43a
MD5 aa96cd13c104335e46ee3829d81b04fd
SHA1 a6169dd4ad2eba6a2795815898324624e69a4699
SHA512 95372d45006456327bbd4e2c48d6ffb6a082b4033d968b04b7f2a2072027f3b3e71e04784fb0b8fde2ef2d079007581423a4ebb227c79e2cfbcd7b470cae1a84
TLSH
T1B8E020D740FEA07B50384D3A084C7D199F76B274525078F6EE93456D70C41F75F06421
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\com.sagarchaulagai.sagrsteamtools\EBWebView\Default\Network\TransportSecurity
Size 356B
SHA256 543951da5d83e79483c9bd624473cdbbc2cbaecc40aca6d648d7ba2739ea6313
MD5 a65efaa992a2c3210e97fb7b9c7129ca
SHA1 319188d7a0352988ad560b76bb4f780c6a38648f
SHA512 c6f6b18c358ef43f537ac6d8decf2d656157efa2714b1c1c1bff276c81b4e3df8b28941fa54b5ef51821dfe454f25ec65bae194c2737707ff63bc8600ad76a42
TLSH
T13DE020D740FEE03710394D264C48BD199B76F67462516CE5FE934A6D70411E75747822
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe5a0679.TMP

Path C:\Users\Admin\AppData\Local\com.sagarchaulagai.sagrsteamtools\EBWebView\Default\Network\TransportSecurity~RFe5a0679.TMP
Size 356B
SHA256 f4e55dede8c3aa7bae3ece13eb0442ebd06e9dee6a703f6ebc9ebc4d1ab4bc01
MD5 80cac463d81fb8efb65dbe275d28bb31
SHA1 efebab83ff85b4c51b67fb1dc6c0ba244dcc0e27
SHA512 aeabc1ebee688aad956f881ba67fca71d4ba0bd37bf21b2eb80787ced56ce6f372b5b34090b082e67aa8bdfa96844e0f42d208e1ac4f0f4cbd838575e5f2401c
TLSH
T1FAE0C0DB40BEB03710384F26084C7E099B36B534028038FADE97073D70800A3260B021
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.sagarchaulagai.sagrsteamtools\EBWebView\Default\Preferences
Size 6KB
SHA256 6129044eefefd0e7f8e9c6817031f73a3fb819193e20948f35f988840511e8be
MD5 4a5efb45583d48f224fa38f814fa599d
SHA1 0ef15f4949571fab4ccd4f4ad289fe98e710639f
SHA512 53d28c77f5ec3018da25f5f410235e454598ef855435f317e3c065bcd731c6eb9eb246f16644e4193c606c9e6177a0122e69c5cc11320d89f80b71cfc7592012
SSDEEP 96:st3/d45Lmob9s0kXo5h16Z0Rs7/x+6MhmuecJCXS1ejezK+g+28XM1C7K:stPys70AonRsV+FdCCQjZsG6K
TLSH
T1DAD1A4065E28A97B4CC6E508BE29BB47E2F5643275D11D58EBF8472C08DBACC6307C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.sagarchaulagai.sagrsteamtools\EBWebView\Default\Preferences
Size 6KB
SHA256 8df7e20ff276f69c48f2bd67e1297eb07e7874c0038d6cd91c19bf527e3953d2
MD5 c3450319b78da679103ef41b504570bf
SHA1 50afff8b95632b9608036bf6b26b75b5e475dc4a
SHA512 ccd94894510bed20fc4c6d5334b4b6ffc6b4330ee5067679bb560bee84514759606810b9148adf9f115f80ced3d770a8c76d61c603fe06a526e439c6cd310f30
SSDEEP 96:st3/d45aGmob9s0kXo5h16Z0Rs7/x+6MhmuecJVzErjezK+gM+qe28XM1C7K:stPyK70AonRsV+FdVzqjZbG6K
TLSH
T1ADD1A6065E28A97B8CC6E508BE3A7B43E2F5647275951E58EBF8471C04DBADC2307C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.sagarchaulagai.sagrsteamtools\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.sagarchaulagai.sagrsteamtools\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.sagarchaulagai.sagrsteamtools\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.sagarchaulagai.sagrsteamtools\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.sagarchaulagai.sagrsteamtools\EBWebView\Local State
Size 2KB
SHA256 be64e21caedb3666557c6b968abe58b94c3907dc6c2718b98fe3a41ef57bfef8
MD5 53eba69c865fcacb63a93b7c524e9203
SHA1 a6e4bbb378c08b36f41321927ba593eb7d8f5067
SHA512 50db4c40970928c6dc69ca75c3d9bbe2f04c09ef98680f81a80733807378a9cb76e8a3943b727e176015d910e216cb5707b569be6cbaf9a3078c1c2f1c9c52a0
TLSH
T18A5182736C54AA728AE246087D4B7F539BA441A5AB922F64A9DC0B0C01DBD8D2307C36
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.sagarchaulagai.sagrsteamtools\EBWebView\Local State
Size 3KB
SHA256 c4095a85cfe06bfed7c7e20db0385b29cad03b703a2c8ca969c29acff07da0a8
MD5 16d56ef3987b822a12729778ecf8af7a
SHA1 1205c245a3d7e0a72d6dfa3c0d05e7fdbf857b4f
SHA512 7a260729dd0240de5ae7ef2714466f625b596ad2ccf12034b5e4bde413654011dee1f08456b609d33717ff7bed35034404feadbb8e680e7f8158ca57ab5e203c
TLSH
T12571947B69A4A9374DE286097D863B06A7A04177EAD13FA9E5EC0F0C01DBACC1353C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.sagarchaulagai.sagrsteamtools\EBWebView\Local State
Size 15KB
SHA256 ee0ac16d8e0bb143150686e68959522632941ad3c5bf4a9b27638ca8d7f7f479
MD5 853de0c417a3154eecbe3f9fb7039d8d
SHA1 d02b0eb02401efa2488232b1eed1695891c67146
SHA512 c2f7a7fc3cee03a7cda6b104fdb044553b3a79ee24c6a823a036703a69d995e23d05f9251b3ab4c28370b345ab8985fc6d6ee3b04b4c18ba59ed4e4b1a4260c1
SSDEEP 384:tOjae3af7pOMe4tyUOh8iqLyWpMmG1NBSAMtPRkadPH3isdp5:AjaeqD4MlshiLdMmsMtPi6H3isx
TLSH
T15E728DAF5DB83DB78D73840A6E466B57577040EAC6827FADE8D81B0D019B5CE0207C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.sagarchaulagai.sagrsteamtools\EBWebView\Local State
Size 17KB
SHA256 c6cfb288a0856feba7d6e615c3a746df8a7e04b89182b4de5cd0858a908ac572
MD5 dc6cb8396b886803f1fa32d8795dd72f
SHA1 940e42dfc69361c4cf6c6242a6fb4fa0b9b74df3
SHA512 1eaff1f15f8ccd5ff5ea61d4d76df0bf9195600c27d6b6bb11717a587d40e7543270e92990881a734010c0595fe2a206f50ac957455f439580d0e17bd619f917
SSDEEP 384:eOjae3af7pOMe4tyUOh8iqLyWpMmGXNlAMtPR7abfNkj4fHH3isdp5:tjaeqD4MlshiLdMmTMtP9Ikj4fHH3isx
TLSH
T1C0829C7A9CB4AD778C7389466E47B79B5BB0419A86867ED8ECC81F4C01875CE020BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.sagarchaulagai.sagrsteamtools\EBWebView\Local State
Size 17KB
SHA256 a50fcbb7158057b6e8972caca2e240a96f7caf3fac26f7230fdd0cdcd202cb11
MD5 ddf4b28eb7b9bf2a7e6d9b102a9bafad
SHA1 4969c9f76bed7f1f77619f5d650223ee082dd7a5
SHA512 6b73b8c1d8160a009114aadabb3a4330406066858e1ec17adb16edb6b968e5e984023d2dc6c9ac05facb01b08b49de01eb45780ddc0990c58ae240a585e0e09d
SSDEEP 384:7Ojae3af7pOMe4tyUOh8iqLyWpMmGuNlAMtP27abfNJmOj4fHH3isdp5:qjaeqD4MlshiLdMm4MtP4IsOj4fHH3i6
TLSH
T1A7828C7A9CB4AD778C7389066E46B79B5BB0419986867EDCECD81F4C01874CE020BC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe58d02c.TMP

Path C:\Users\Admin\AppData\Local\com.sagarchaulagai.sagrsteamtools\EBWebView\Local State~RFe58d02c.TMP
Size 1KB
SHA256 438031933d5014f627d827a219c287fc1367f6b8fe72a931e128ab6115e61266
MD5 fcf9fa7d31bf388b8b6f99906a827e83
SHA1 dcd416788ee533237cc9b8fe79ddfeb3d312211a
SHA512 7af5efc91d9616dc92833cc73713219fb57e7e3052fafb50bfcd5e5e3177add312a94764f06aa2f313ff6a9fb91e8dd63a441a01acdfaa8230e987924b86494d
TLSH
T1BF3154B699D46A329D92530A3956BF971FA000BAD6514F44B5CC4B0C11DBCCD512FD32
MD5 SHA1 SHA512 TLSH

Submit Download

2a2e0412b8ad04a2.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\2a2e0412b8ad04a2.customDestinations-ms
Size 4KB
SHA256 8fe6392121d9938cf9958d296afa7e7807b32e3bd3bcd6c4b25e29434f6ed914
MD5 f7fb25cd7de246e317ab10fb61a7aed2
SHA1 12881bb49618eb99e0b13ef72c972a021dd75e3b
SHA512 10183178baaa3982a0291e8887a030a01cfa4a6e3120e79bdca2b2f644aae2916f854d983af5cb6ec4290e708181006756cf267cf8a59e0d08e5eb825f8810a8
SSDEEP 96:cn9vtzBJZkfzHu8zqcVl9vQzBJFktzHu8zW:c9vv3kLPjvkrkNC
TLSH
T1F3A1010507E21A17F3F3EF7294B37641AA7BB54AAA040B9D01CA47050872F80B9F8F67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2a2e0412b8ad04a2.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\2a2e0412b8ad04a2.customDestinations-ms
Size 4KB
SHA256 c7c7259b3f12ec93c4d54b9cd773879b0332bff109715f028a32eb328585b137
MD5 0d0c0c410dce298344950472fd404a8a
SHA1 252d8bbf70eccd1867ab7f759563d52868f1e1bf
SHA512 013d70189bf2fa197d50330b1a6713ea4babac0a6910a0e40e9c7153508bd2c40b08cdebc1e80870b47352fad4e2d649bcaa16aad5d8200e1b6c31a72eb4d0dc
SSDEEP 96:NVl9vQzBJZkfzHu8zqcVl9vQzBJFktzHu8zW:vjvk3kLPjvkrkNC
TLSH
T144A1040807E21A17F3F3EF7294737641AA7BB54AAA040B9D05CA47050872F80B9F8F67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet-runtime-9.0.11-win-x64.exe

Path C:\Users\Admin\Downloads\dotnet-runtime-9.0.11-win-x64.exe
Size 28.5MB
SHA256 c32c80f4de9ab948f48cad7a23ef7a9913548b3ac65556513fd6fcbc7e9c8bab
MD5 706db63f88afb58c8ba123c7b522fe4c
SHA1 55242c8a658b30bf3fc83d81285ce1490b7d0c9a
SHA512 26229ad6573bbcb4e75f5da2042a818169352a8f219a7df8af0299f0246665bc406430333857726f478d2409cb77701ff4ff481cea154ebf1b903732aa0ec5de
SSDEEP 786432:JeQASmek6Fm8Ru/3xFQa/SHPCSIBHD20BPBia8nKuz9VW:8IFm8U/hGsKPCHa+ZiHfC
TLSH
T1A8673332D021D235E9F002739DBBD634AE28B129035855ABD6C8BC2D2A769D373F7572
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\Videos\Captures\desktop.ini
Size 190B
SHA256 86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
MD5 b0d27eaec71f1cd73b015f5ceeb15f9d
SHA1 62264f8b5c2f5034a1e4143df6e8c787165fbc2f
SHA512 7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c
TLSH
T11EC0121892F93224A1728D12BD7460119AB1F4217C16CA9D1380508F08A1601E631B53
MD5 SHA1 SHA512 TLSH

Submit Download

MSI31A0.tmp

Path C:\Windows\Installer\MSI31A0.tmp
Size 219KB
SHA256 2bf33a9b9980e44d21d48f04cc6ac4eed4c68f207bd5990b7d3254a310b944ae
MD5 928f4b0fc68501395f93ad524a36148c
SHA1 084590b18957ca45b4a0d4576d1cc72966c3ea10
SHA512 7f2163f651693f9b73a67e90b5c820af060a23502667a5c32c3beb2d6b043f5459f22d61072a744089d622c05502d80f7485e0f86eb6d565ff711d5680512372
SSDEEP 3072:FVzl3qiEZybztEwiUx6D02cWVsV1v2vZR3X6j7zo6k2FkngTLrOrORT9flQnS6lg:FVIMEgXmEAR3oHon2VaFuG0eEp
TLSH
T1AF248D217494947EEAFA0832A57EDA71BF3DF2241760C8AEC3409D1E6D604C167B7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hyph-bn.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1004_898238693\hyph-bn.hyb
Size 703B
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
TLSH
T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-mr.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1004_898238693\hyph-mr.hyb
Size 687B
SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
SHA1 d0914fb069469d47a36d339ca70164253fccf022
SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
TLSH
T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-nn.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1004_898238693\hyph-nn.hyb
Size 141KB
SHA256 5bcbb58eaf65f13f6d039244d942f37c127344e3a0a2e6c32d08236945132809
MD5 f2d8fe158d5361fc1d4b794a7255835a
SHA1 6c8744fa70651f629ed887cb76b6bc1bed304af9
SHA512 946f4e41be624458b5e842a6241d43cd40369b2e0abc2cacf67d892b5f3d8a863a0e37e8120e11375b0bacb4651eedb8d324271d9a0c37527d4d54dd4905afab
SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgY:p73HEUP8dsiinTThjy90VKY
TLSH
T1C1E319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Staging

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4548_1722617693\Mu\Staging
Size 36B
SHA256 411a706def2e70f96a507208bf80bceb93e950c4c2d671cd1ddb4134ce54b2a9
MD5 0163de1b14421d4eee3757ff76fd81e4
SHA1 96c75c4fe1e3f33a367f45293bd1bd8bff1c06f4
SHA512 80114d59db8f3654dd6821589e5ad03daa923a35610a372756a8865b3e769621e32ef2aed92c2494de2b9fc06d9796b12f1e3bb75873ed794e8c9ae8a0d5e965
MD5 SHA1 SHA512

Submit Download

crs.pb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4548_1818289783\crs.pb
Size 233KB
SHA256 c132e2ba94619caf6143b3bbdd9c32944e80cbf3bff87364175c42801afe2584
MD5 8bbfaa2cd5cdd9a5019da146cf4deed5
SHA1 17ed2fb07543c5d4bc196a1989dd16a9dbcaacc1
SHA512 cfeee2916f19648ed408b4287e234b4140cf82254cd4b83d918c0a4c3bac2b0467d921915aec290823355be4a0cc82017557be588f65134b466b7192f795f6c2
SSDEEP 6144:KKiD4F7BVps9YpVW+J2i/P66k8GyST+uUP:KB69Vps9C2GAQb
TLSH
T14A34AE9A0F3C3A11BFD2DEA466C8D9377D79B3E06A6928172111C4F169927E07D8C12F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ct_config.pb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4548_1818289783\ct_config.pb
Size 16KB
SHA256 aaeeb46cd91a4a392223cf2885f449bf532f0878c087d50bb0cb3fc7fa873a60
MD5 ca6e253c3fc7718b4455493460053be3
SHA1 4085dcccd29a931b8ea9b74f008e26409edf78ad
SHA512 0004e83a845bdab07f01df32094c202c9f3b8767a6dadd707abc19796f917221f869791673315e9d2c5a6a1fc50b922cceb622db98601055df5949818dd6ea58
SSDEEP 384:7tomWvvtJvzm9myvg+FN2VOhikm5hV5+QiyA94pDmiDyDS1c8CazaUhszz:7l5Zhk5hV5+Qis2DS1cbe7Kzz
TLSH
T13A72C9BFA1169F000383D558D6E157AAA12363DACCF3763DB1E1C005F5423E6B1A567B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kp_pinslist.pb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4548_1818289783\kp_pinslist.pb
Size 10KB
SHA256 b5b2a45a5b25becb901916b13752e3477d4126a42d088f29863bd8672320ecf6
MD5 8061c7027f406f3e20ea5d26969f00bd
SHA1 635d6260e16d1ac595f760df9c5bdda8279629a4
SHA512 7be0be7d59ed46b7ce6adbc1ddc42119426b3223491a03ff068dae66d13a261cc954640916ff4379a6040e021689f070b33dc82b45c010b728ee59abd42f3610
SSDEEP 96:Bxk+yBjecaikDBwrBnnoxGwMAy5z5tBT6c5MacFwn2Xh6g/gw:I1IDCrBnYQ5jlMacFwn2c9w
TLSH
T1362204B37904F99350E7E0BE1041F59AE93343A540ADF98A528C4A7635F1F0719BB4EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4548_1818289783\manifest.json
Size 102B
SHA256 932322ae700a7d7606efb182239db5fd9550dd6cb5860e0a17bfb6fe3bcb5f35
MD5 19322c8a94f1ac01a70f8c58cdbbc720
SHA1 7c90dac178c47dac9087dfce738f24a4a627f022
SHA512 f54a9cab8dbe96333862a67912e88c4f26cc3e25a7dc93e8f06d1fb5b0b8e91d53cc0f5619c192380573a2846034ee583276d7eda73dc9fc93bb0d9168f4e099
TLSH
T156B01221EC10B4B32004036C086CC3C063272F032C4079280DE19F84E90D9DBE471528
MD5 SHA1 SHA512 TLSH

Submit Download

dotnet-runtime-9.0.11-win-x64.exe

Path C:\Windows\Temp\{1AF8E040-6603-4CE7-8EF7-31BE0F36683E}\.cr\dotnet-runtime-9.0.11-win-x64.exe
Size 607KB
SHA256 74fc7c5f65955a4da50b4c24121c18f65b2239584430169d0257b0f0e2cac521
MD5 60ab26379284de6e08a4a8bbbb98cf2d
SHA1 5f565fe53268b7599f76a8db10619891189ceeb5
SHA512 6d880b4be4d7908429623bb6e84636eb996b2a887811fe2cc3b4f288fd6fd01e79cc2214cf08cb0344ccb50e74c23d5dd0a512a19402716ed152a373fddb347d
SSDEEP 12288:5mEsd9PZfePv3xl7ft7V+6uC+zd5qLlJQvwS7WiaJeUaQx:5m39PZfePv3r7fm6t+jqp2vrip
TLSH
T1CFD47C32A5614032F7F106B3B928D5303E7CE328275488AAE7C4AD1D7EA84D667F7257
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{995A79D0-5214-46EA-B086-1DC2DCB81833}\.ba\1033\thm.wxl
Size 5KB
SHA256 0d2abde2e4974cc8b7231f017975180d67592ee6d3418cd6dc52e2bc4bf03e50
MD5 34d0c531eed48550be3d877290ad2553
SHA1 7983955032f9e7d2ee72cabc644a14c892a92289
SHA512 0c9d916ac420c6a27e723d8bab2db80372cc6303c79a6e1c3b2bd462711b711f2cc45fae43ceb2ce603708c884b0ec6bb7217981ef2a03e0fc3e6c6916716e7a
SSDEEP 96:JT0abTxmup/vrCKATQdYQHdYCwgoVOBq9L05kbSED:XQNkdYQHdYCYa+D
TLSH
T1CDC1BAA7B88F53D128732255EA9256AA1911C19C533F2DF4FC8B454B838A827A377F13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BootstrapperApplicationData.xml

Path C:\Windows\Temp\{ABA0EDD4-D838-49A9-A8E4-066C34703F58}\.ba\BootstrapperApplicationData.xml
Size 6KB
SHA256 f8c9bb0861b17e4c6863278bd17b1d715f0502a0b76fc60e94164c7ba1f2190b
MD5 e9f07b1bf786a9360387abbadb5e8ba0
SHA1 30cf8147353946493ced1ba225df4e48f587125d
SHA512 a382c920b3b9dbd051711b38975dc95566d4f54235b86634f6ec2ff9681cd1b2922806eec7ed5ab03bbc56880ecb36602a3df2020b0d3ffa7cac8d74e03aa545
SSDEEP 96:XeV2VS/V2VvPkn6+o2p0wPycDvn62Ml0wnyc0Dn6a8W0wzycfytprKVhrPS5VrPH:X0sesvsNO9gvl3VFDxyxeyiSf
TLSH
T146D16B252FFE0325F1F34F84E9B8511A5A35BC926D38CA6D01541D0E8973B8199A2FBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.xml

Path C:\Windows\Temp\{ABA0EDD4-D838-49A9-A8E4-066C34703F58}\.ba\thm.xml
Size 11KB
SHA256 af7c42ac777b45751763bceaf8604fa5b842b096da4d1370158a1c3422713555
MD5 03cf60952e7b59460fd22807e8cb28e1
SHA1 5f4454019c5f33059ae53522ffb534eef815a5f5
SHA512 bfb3c642759522cd4fd8c784909e97c38e6c44cced11d70167d0e243d8da12555a94aa2cd9978745849fa5233a1915485d3e1cb011d985c92a115e44a11b7140
SSDEEP 96:eCdhlFGZRd4UyAi0Rz96zYFGiRdl6dXXdT9gUoLNEmRG3QBinRFRK03K8+GGI9k4:eCSfiozkI/A
TLSH
T1F7325BA986DE7C00D232E711ABF271D6AF126862C4C46A58F94C39BB4FE25406C7727D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bg.png

Path C:\Windows\Temp\{B2F191E0-12BA-4002-86AC-E0E702D9E9D0}\.ba\bg.png
Size 4KB
SHA256 9095bf7b6baa0107b40a4a6d727215be077133a190f4ca9bd89a176842141e79
MD5 9eb0320dfbf2bd541e6a55c01ddc9f20
SHA1 eb282a66d29594346531b1ff886d455e1dcd6d99
SHA512 9ada3a1757a493fbb004bd767fab8f77430af69d71479f340b8b8ede904cc94cd733700db593a4a2d2e1184c0081fd0648318d867128e1cb461021314990931d
SSDEEP 48:u+Xg+NXWbdlIr33lx9W5OstaDIy3r5XpPyvZKmXYTDeiByNxcaaaaaaaaaaaaaaE:AaXWPIrHT932JsdpPyjqDeioatEn
TLSH
T19891B4D8FCF95322C6002BF255F4C0735A0215B713ABFEC82F496BD90E6878E25058B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wixstdba.dll

Path C:\Windows\Temp\{B2F191E0-12BA-4002-86AC-E0E702D9E9D0}\.ba\wixstdba.dll
Size 190KB
SHA256 dcea15f3710822ffc262e62ec04cc7bbbf0f33f5d1a853609fbfb65cb6a45640
MD5 f1919c6bd85d7a78a70c228a5b227fbe
SHA1 71647ebf4e7bed3bc1663d520419ac550fe630ff
SHA512 c7ff9b19c9bf320454a240c6abbc382950176a6befce05ea73150eeb0085d0b6ed5b65b2dcb4b04621ef9cca1d5c4e59c6682b9c85d1d5845e5ce3e5eedfd2eb
SSDEEP 3072:sjEoXsLW9OLG8Qp51ySdjDXY33b+Av7O5IkI+/AYkPAEc527uu3k/gLtxavf0ir2:sjEo8LW9553hXWy15I2YrAW7FUVEihs3
TLSH
T1FF14AF1176D0A07AEBFB16307A39A5216E7DBA200FA0C9DF63449D2B1D715C19B36B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet_host_9.0.11_win_x64.msi

Path C:\Windows\Temp\{B2F191E0-12BA-4002-86AC-E0E702D9E9D0}\dotnet_host_9.0.11_win_x64.msi
Size 708KB
SHA256 584945e77f8d784118ad50ca49e360ea805cdf6c86f92bb7de6715e647748de1
MD5 c18956925fd6a7e1c3c733b48b21fdae
SHA1 d8bda5b82d8c0619d409e2ccdbef315bcbd02e11
SHA512 a98cdd00c3abfbccdcea49f6fa62b22cae7061b5135dfcdc385b1de2528e7ed85bca0ca0c315f506e19c6a58e05807909cebea1ca8d52034c3c82204ceac9404
SSDEEP 12288:mRbKF5uV1EgXmEI3os2Qx7E4D4Rxbp4K+1uiq:ZiXdc3/7Rin+s
TLSH
T1FBF49D137D80803AD9BA1D71853AD7716F3EBD204A64889B6380B91DDDF11C0AF76BE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet_hostfxr_9.0.11_win_x64.msi

Path C:\Windows\Temp\{B2F191E0-12BA-4002-86AC-E0E702D9E9D0}\dotnet_hostfxr_9.0.11_win_x64.msi
Size 780KB
SHA256 261880211b66eb3ace0083623ae46786bc8e766db0ea9569d9e0d082922bfd2d
MD5 9c2ba1331509ca03b99c5684754d353c
SHA1 c0ed675fc2ca1ac5ca19bbbf28ad72f4febfe903
SHA512 acfa7db86f18c7fefd501d7493feed9827a9b26434cd115de0355de87ef384e9c6f8487871285d4ee576fe69dfacd33280f68f7a79ce9e48ef30bcfb47c593ee
SSDEEP 12288:hjvsIScwV1EgXmEI3os2Qx7E4D4Rxbp4K+1uiq:VvsIBwXdc3/7Rin+s
TLSH
T19105AD137D80803AD9BA0D71853AD7B15F3DBD208A6489AB5380B91DDDF11C0AF76BE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet_runtime_9.0.11_win_x64.msi

Path C:\Windows\Temp\{B2F191E0-12BA-4002-86AC-E0E702D9E9D0}\dotnet_runtime_9.0.11_win_x64.msi
Size 27.6MB
SHA256 dc0f1277806add6dcffc2ced78946bd890efba01d804be9cc4d878dda68d9206
MD5 af9caeca2c423c4bee17a5c7a4a53b1a
SHA1 90118ac64a3a51e020f7bf2c62f4089f6a69ce8d
SHA512 20af7a38479a510f61d03646d33d1e257a8dea76022a85aa1f512d565e91902366ea98463b214113339ec47eeaa992cb15d59fb99ea98aeb57c692a81070933d
SSDEEP 786432:k+1EPxyUsMTo16N5aeitL90O5KXTH7N/Qnfoiuxic3:kjsMTI6NIxx90g0HRIfo702
TLSH
T186573303BD82E539C8B91D3285BFC761D73A68754B94854B6388390EDCF26D066B0BF6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4528-65-0x00007FF92EFE0000-0x00007FF92EFE1000-memory.dmp

Download

memory/4824-227-0x00007FF92EFE0000-0x00007FF92EFE1000-memory.dmp

Download

memory/4824-226-0x00007FF92D170000-0x00007FF92D171000-memory.dmp

Download

memory/5028-26-0x00007FF92EFE0000-0x00007FF92EFE1000-memory.dmp

Download

memory/6792-1149-0x0000028F66390000-0x0000028F66391000-memory.dmp

Download

memory/6792-1142-0x0000028F66390000-0x0000028F66391000-memory.dmp

Download

memory/6792-1144-0x0000028F66390000-0x0000028F66391000-memory.dmp

Download

memory/6792-1148-0x0000028F66390000-0x0000028F66391000-memory.dmp

Download

memory/6792-1153-0x0000028F66390000-0x0000028F66391000-memory.dmp

Download

memory/6792-1151-0x0000028F66390000-0x0000028F66391000-memory.dmp

Download

memory/6792-1150-0x0000028F66390000-0x0000028F66391000-memory.dmp

Download

memory/6792-1152-0x0000028F66390000-0x0000028F66391000-memory.dmp

Download