c4c0b8e1593bc5481521cecfce00b953e3ee6d7323b98e7ddf2e8c90a78ce545

Analysis

user interaction
yes
max time kernel
599s
max time network
598s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/07/2026, 05:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
VelocityLite.exe
Size 232KB
Sample260710-fp4ekaew4x
SHA256 c4c0b8e1593bc5481521cecfce00b953e3ee6d7323b98e7ddf2e8c90a78ce545
MD5 e4df8ee6e755c3da3088701eb1c05b76
SHA1 c52dbc1190b84555e27649b9b54746b958e5f3cb
SHA512 623ae06db60f42e33c6e94b4d74a20d6e456a1edb94e2b8bc58424532f27bc5baa516465cad455bddc0351e21614d4965919a123b7cb0891b8527021928a09d5
SSDEEP 3072:IlDJk88wN1QI7sxrYL1peQ3lOY9SkHNwG7NzaAT56Q7BQz:UAIwxrI14Q3kYBTM5QNQ
TLSH
T185341903B65890BAE1A2D638CD928981E7727C594F71A6CF37507B7E0F766D09E39302
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence ransomware

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
72	4180	msedge.exe

Executes dropped EXE 7 IoCs

pid	Process
3608	windowsdesktop-runtime-10.0.9-win-x64.exe
4084	wixstdba.exe
5348	windowsdesktop-runtime-10.0.9-win-x64.exe
4612	windowsdesktop-runtime-10.0.9-win-x64.exe
4936	windowsdesktop-runtime-10.0.9-win-x64.exe
4264	wixstdba.exe
4852	windowsdesktop-runtime-10.0.9-win-x64.exe

Loads dropped DLL 13 IoCs

pid	Process
3908	MsiExec.exe
3908	MsiExec.exe
1280	MsiExec.exe
1280	MsiExec.exe
3248	MsiExec.exe
3248	MsiExec.exe
5828	MsiExec.exe
5828	MsiExec.exe
1384	MsiExec.exe
1384	MsiExec.exe
2460	MsiExec.exe
2460	MsiExec.exe
5068	msedge.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{0B1257AA-9D34-46E7-B27B-07DF8CD5B92C} = "\"C:\\ProgramData\\Package Cache\\{0B1257AA-9D34-46E7-B27B-07DF8CD5B92C}\\windowsdesktop-runtime-10.0.9-win-x64.exe\" /burn.runonce"	windowsdesktop-runtime-10.0.9-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{0B1257AA-9D34-46E7-B27B-07DF8CD5B92C} = "\"C:\\ProgramData\\Package Cache\\{0B1257AA-9D34-46E7-B27B-07DF8CD5B92C}\\windowsdesktop-runtime-10.0.9-win-x64.exe\" /burn.runonce"	windowsdesktop-runtime-10.0.9-win-x64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.9\System.Core.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.9\System.IO.Compression.FileSystem.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.9\System.IO.Pipes.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.9\System.IO.UnmanagedMemoryStream.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.9\System.Net.NetworkInformation.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.9\UIAutomationClientSideProviders.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.9\de\WindowsFormsIntegration.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.9\ko\ReachFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.9\System.AppContext.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.9\cs\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.9\es\System.Windows.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.9\pt-BR\UIAutomationTypes.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.9\mscorrc.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.9\cs\UIAutomationTypes.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.9\es\System.Windows.Forms.Primitives.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.9\System.Globalization.Extensions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.9\de\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.9\it\System.Windows.Forms.Primitives.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.9\pl\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.9\System.ComponentModel.Primitives.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.9\System.ComponentModel.Annotations.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.9\System.Runtime.Intrinsics.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.9\PresentationFramework.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.9\System.Windows.Input.Manipulations.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.9\zh-Hant\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.9\.version	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.9\de\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.9\fr\System.Windows.Forms.Primitives.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.9\de\ReachFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.9\ko\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.9\tr\UIAutomationTypes.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.9\System.ObjectModel.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.9\System.Runtime.InteropServices.JavaScript.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.9\Microsoft.WindowsDesktop.App.runtimeconfig.json	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.9\System.Private.Windows.GdiPlus.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.9\tr\WindowsBase.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.9\System.Reflection.Emit.Lightweight.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.9\System.Configuration.ConfigurationManager.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.9\System.Threading.Tasks.Parallel.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.9\ja\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.9\tr\UIAutomationClient.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.9\System.CodeDom.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.9\ru\System.Windows.Forms.Primitives.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\host\fxr\10.0.9\hostfxr.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.9\System.Runtime.Extensions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.9\System.Threading.Tasks.Extensions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.9\it\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.9\System.Data.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.9\fr\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.9\ja\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.9\System.Formats.Tar.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.9\tr\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.9\es\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.9\pl\UIAutomationTypes.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.9\zh-Hans\WindowsFormsIntegration.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.9\System.Diagnostics.Debug.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.9\System.Resources.Reader.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.9\PresentationFramework-SystemData.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.9\es\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.9\ja\UIAutomationClient.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.9\ru\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.9\ru\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.9\System.Diagnostics.StackTrace.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.9\System.Runtime.Handles.dll	msiexec.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\e5992f5.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF6A44EF42D8AD2811.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF55FFE8B5FF65909E.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_387329193\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_387329193\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_1572426959\Sigma\Social	msedge.exe
File opened for modification	C:\Windows\Installer\e5992ec.msi	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_1548908277\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_611062509\autofill_bypass_cache_forms.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_785992907\manifest.json	msedge.exe
File opened for modification	C:\Windows\Installer\MSIAF39.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e5992f1.msi	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_989879058\manifest.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1\64.60.31149	msiexec.exe
File created	C:\Windows\SystemTemp\~DF99B9E7ED90165904.TMP	msiexec.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\Installer\e5992e7.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFB4A1C45F8A996F90.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_2046937584\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\~DF3BBF0E2C4DC00E41.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_1572426959\Mu\Entities	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_1572426959\Sigma\LICENSE	msedge.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1\64.60.31149\fileCoreHostExe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA533.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF577B7858B8DF694C.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE2A7.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_2075658091\safety_tips.pb	msedge.exe
File opened for modification	C:\Windows\Installer\MSIDE7D.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_2046937584\classification.js	msedge.exe
File created	C:\Windows\Installer\e5992e7.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFDAD3AA6E3DC4D7A4.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{B7AC6B1E-81BF-44EB-B1DA-D9F4A255984B}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI964C.tmp	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1\64.60.31149\fileCoreHostExe	msiexec.exe
File created	C:\Windows\SystemTemp\~DF7273F595C401EE76.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFE29D50B2D91ED681.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1216_1082514802\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_1572426959\Mu\Content	msedge.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA272.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDC2A.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_1479386672\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_2046937584\travel-facilitated-booking-kayak.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_611062509\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_393207921\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_1097530541\deny_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_1097530541\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_1572426959\Sigma\Staging	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_1097530541\deny_full_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_1572426959\Mu\CompatExceptions	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_1572426959\Mu\TransparentAdvertisers	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_1572426959\Sigma\Fingerprinting	msedge.exe
File created	C:\Windows\Installer\e5992e0.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9541.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF333ACF7D69DC3BD2.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFAEE387C12DA888C7.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF63493A087866D3CE.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDE3E.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF7784BE5F461FC240.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_1572426959\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_1572426959\Mu\Fingerprinting	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_1572426959\Mu\Other	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wixstdba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.9-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.9-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.9-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wixstdba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.9-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.9-win-x64.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4180	msedge.exe
2152	msedge.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2C	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2d	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2B	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{B30F5023-7228-4CDE-B00E-331095A705C9}	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x64\ = "{1BE0093C-57AD-46B8-9781-8437664E9957}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x64	windowsdesktop-runtime-10.0.9-win-x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6011F934DDD219409966D94D11124EB\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6011F934DDD219409966D94D11124EB\SourceList\PackageName = "dotnet-runtime-10.0.9-win-x64.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E1B6CA7BFB18BE441BAD9D4F2A5589B4\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E81AB649919215140BFA454FD258513A\MainFeature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E81AB649919215140BFA454FD258513A\PackageCode = "8A5256E12AB125A47A20C5879AB67446"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E81AB649919215140BFA454FD258513A\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E81AB649919215140BFA454FD258513A\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E1B6CA7BFB18BE441BAD9D4F2A5589B4\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{B7AC6B1E-81BF-44EB-B1DA-D9F4A255984B}v80.36.53633\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\windowsdesktop_runtime_80.36.53633_x64	windowsdesktop-runtime-10.0.9-win-x64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x64	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x64\Version = "80.36.53633"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_80.36.53633_x64\ = "{B7AC6B1E-81BF-44EB-B1DA-D9F4A255984B}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{90d77843-5fbd-64ef-6bdf-df7574d01646}\ = "{0B1257AA-9D34-46E7-B27B-07DF8CD5B92C}"	windowsdesktop-runtime-10.0.9-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C3900EB1DA758B647918487366E49975\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C3900EB1DA758B647918487366E49975\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{1BE0093C-57AD-46B8-9781-8437664E9957}v80.36.53633\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.36.53633_x64	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B6011F934DDD219409966D94D11124EB	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B6011F934DDD219409966D94D11124EB\Provider	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6011F934DDD219409966D94D11124EB\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{39F1106B-DDD4-4912-9069-D6491D1142BE}v80.36.53633\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{2A397EBD-7223-479A-8028-D64BAF7791EB}	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E1B6CA7BFB18BE441BAD9D4F2A5589B4\PackageCode = "6357AFECD0EB89A42B5D3459FDBB34A1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E1B6CA7BFB18BE441BAD9D4F2A5589B4\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{90d77843-5fbd-64ef-6bdf-df7574d01646}\Version = "10.0.9.50000"	windowsdesktop-runtime-10.0.9-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C3900EB1DA758B647918487366E49975	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C3900EB1DA758B647918487366E49975\SourceList\PackageName = "dotnet-host-10.0.9-win-x64.msi"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C3900EB1DA758B647918487366E49975\Clients = 3a0000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E81AB649919215140BFA454FD258513A\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E81AB649919215140BFA454FD258513A\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_80.36.53633_x64\Dependents\{0B1257AA-9D34-46E7-B27B-07DF8CD5B92C}	windowsdesktop-runtime-10.0.9-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A8A84F1AA6E5EFD5BE00C8237B84D6D4\C3900EB1DA758B647918487366E49975	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E81AB649919215140BFA454FD258513A\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{90d77843-5fbd-64ef-6bdf-df7574d01646}\DisplayName = "Microsoft Windows Desktop Runtime 10.0.9 (x64)"	windowsdesktop-runtime-10.0.9-win-x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E1B6CA7BFB18BE441BAD9D4F2A5589B4\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6011F934DDD219409966D94D11124EB\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x64\Dependents\{0B1257AA-9D34-46E7-B27B-07DF8CD5B92C}	windowsdesktop-runtime-10.0.9-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\922561FD73F5E174FCF6848F5B7EB11C\B6011F934DDD219409966D94D11124EB	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_80.36.53633_x64\Dependents	windowsdesktop-runtime-10.0.9-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x64\Dependents	windowsdesktop-runtime-10.0.9-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6011F934DDD219409966D94D11124EB\ProductName = "Microsoft .NET Runtime - 10.0.9 (x64)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E1B6CA7BFB18BE441BAD9D4F2A5589B4\SourceList\PackageName = "windowsdesktop-runtime-10.0.9-win-x64.msi"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\{90d77843-5fbd-64ef-6bdf-df7574d01646}	windowsdesktop-runtime-10.0.9-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{90d77843-5fbd-64ef-6bdf-df7574d01646}\DisplayName = "Microsoft Windows Desktop Runtime 10.0.9 (x64)"	windowsdesktop-runtime-10.0.9-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{90d77843-5fbd-64ef-6bdf-df7574d01646}\Dependents	windowsdesktop-runtime-10.0.9-win-x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C3900EB1DA758B647918487366E49975\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6011F934DDD219409966D94D11124EB\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{90d77843-5fbd-64ef-6bdf-df7574d01646}\ = "{0B1257AA-9D34-46E7-B27B-07DF8CD5B92C}"	windowsdesktop-runtime-10.0.9-win-x64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.36.53633_x64	windowsdesktop-runtime-10.0.9-win-x64.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E1B6CA7BFB18BE441BAD9D4F2A5589B4\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C3900EB1DA758B647918487366E49975\MainFeature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.36.53633_x64\Version = "80.36.53633"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E81AB649919215140BFA454FD258513A\SourceList\PackageName = "dotnet-hostfxr-10.0.9-win-x64.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6011F934DDD219409966D94D11124EB\PackageCode = "7449C1950640F524D8B78366F980D622"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6011F934DDD219409966D94D11124EB\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x64	windowsdesktop-runtime-10.0.9-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\FCF16EF4F69552A53562800BB6300BC9	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E1B6CA7BFB18BE441BAD9D4F2A5589B4\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{B7AC6B1E-81BF-44EB-B1DA-D9F4A255984B}v80.36.53633\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C3900EB1DA758B647918487366E49975	msiexec.exe

Suspicious behavior: EnumeratesProcesses 38 IoCs

pid	Process
3420	msiexec.exe
3420	msiexec.exe
3420	msiexec.exe
3420	msiexec.exe
3420	msiexec.exe
3420	msiexec.exe
3420	msiexec.exe
3420	msiexec.exe
3420	msiexec.exe
3420	msiexec.exe
3420	msiexec.exe
3420	msiexec.exe
4940	taskmgr.exe
4940	taskmgr.exe
4940	taskmgr.exe
4940	taskmgr.exe
4940	taskmgr.exe
4940	taskmgr.exe
4940	taskmgr.exe
4940	taskmgr.exe
4940	taskmgr.exe
4940	taskmgr.exe
4940	taskmgr.exe
4940	taskmgr.exe
4940	taskmgr.exe
4940	taskmgr.exe
4940	taskmgr.exe
4940	taskmgr.exe
4940	taskmgr.exe
4940	taskmgr.exe
4940	taskmgr.exe
4940	taskmgr.exe
4940	taskmgr.exe
4940	taskmgr.exe
5068	msedge.exe
5068	msedge.exe
4424	msedge.exe
4424	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5348	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeIncreaseQuotaPrivilege	5348	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeSecurityPrivilege	3420	msiexec.exe
Token: SeCreateTokenPrivilege	5348	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeAssignPrimaryTokenPrivilege	5348	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeLockMemoryPrivilege	5348	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeIncreaseQuotaPrivilege	5348	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeMachineAccountPrivilege	5348	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeTcbPrivilege	5348	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeSecurityPrivilege	5348	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeTakeOwnershipPrivilege	5348	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeLoadDriverPrivilege	5348	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeSystemProfilePrivilege	5348	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeSystemtimePrivilege	5348	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeProfSingleProcessPrivilege	5348	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeIncBasePriorityPrivilege	5348	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeCreatePagefilePrivilege	5348	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeCreatePermanentPrivilege	5348	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeBackupPrivilege	5348	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeRestorePrivilege	5348	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeShutdownPrivilege	5348	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeDebugPrivilege	5348	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeAuditPrivilege	5348	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeSystemEnvironmentPrivilege	5348	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeChangeNotifyPrivilege	5348	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeRemoteShutdownPrivilege	5348	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeUndockPrivilege	5348	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeSyncAgentPrivilege	5348	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeEnableDelegationPrivilege	5348	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeManageVolumePrivilege	5348	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeImpersonatePrivilege	5348	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeCreateGlobalPrivilege	5348	windowsdesktop-runtime-10.0.9-win-x64.exe
Token: SeRestorePrivilege	3420	msiexec.exe
Token: SeTakeOwnershipPrivilege	3420	msiexec.exe
Token: SeRestorePrivilege	3420	msiexec.exe
Token: SeTakeOwnershipPrivilege	3420	msiexec.exe
Token: SeRestorePrivilege	3420	msiexec.exe
Token: SeTakeOwnershipPrivilege	3420	msiexec.exe
Token: SeRestorePrivilege	3420	msiexec.exe
Token: SeTakeOwnershipPrivilege	3420	msiexec.exe
Token: SeRestorePrivilege	3420	msiexec.exe
Token: SeTakeOwnershipPrivilege	3420	msiexec.exe
Token: SeRestorePrivilege	3420	msiexec.exe
Token: SeTakeOwnershipPrivilege	3420	msiexec.exe
Token: SeRestorePrivilege	3420	msiexec.exe
Token: SeTakeOwnershipPrivilege	3420	msiexec.exe
Token: SeRestorePrivilege	3420	msiexec.exe
Token: SeTakeOwnershipPrivilege	3420	msiexec.exe
Token: SeRestorePrivilege	3420	msiexec.exe
Token: SeTakeOwnershipPrivilege	3420	msiexec.exe
Token: SeRestorePrivilege	3420	msiexec.exe
Token: SeTakeOwnershipPrivilege	3420	msiexec.exe
Token: SeRestorePrivilege	3420	msiexec.exe
Token: SeTakeOwnershipPrivilege	3420	msiexec.exe
Token: SeRestorePrivilege	3420	msiexec.exe
Token: SeTakeOwnershipPrivilege	3420	msiexec.exe
Token: SeRestorePrivilege	3420	msiexec.exe
Token: SeTakeOwnershipPrivilege	3420	msiexec.exe
Token: SeRestorePrivilege	3420	msiexec.exe
Token: SeTakeOwnershipPrivilege	3420	msiexec.exe
Token: SeRestorePrivilege	3420	msiexec.exe
Token: SeTakeOwnershipPrivilege	3420	msiexec.exe
Token: SeRestorePrivilege	3420	msiexec.exe
Token: SeTakeOwnershipPrivilege	3420	msiexec.exe

Suspicious use of FindShellTrayWindow 59 IoCs

pid	Process
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
4084	wixstdba.exe
4264	wixstdba.exe
1216	msedge.exe
4940	taskmgr.exe
4940	taskmgr.exe
4940	taskmgr.exe
4940	taskmgr.exe
4940	taskmgr.exe
4940	taskmgr.exe
4940	taskmgr.exe
4940	taskmgr.exe
4940	taskmgr.exe
4940	taskmgr.exe
4940	taskmgr.exe
4940	taskmgr.exe
4940	taskmgr.exe
4940	taskmgr.exe
4940	taskmgr.exe
4940	taskmgr.exe
4940	taskmgr.exe
4940	taskmgr.exe
4940	taskmgr.exe
4940	taskmgr.exe
4940	taskmgr.exe
4940	taskmgr.exe
4940	taskmgr.exe
4940	taskmgr.exe
4940	taskmgr.exe
4940	taskmgr.exe
4940	taskmgr.exe
4940	taskmgr.exe
4940	taskmgr.exe
4940	taskmgr.exe
4940	taskmgr.exe
4940	taskmgr.exe
4940	taskmgr.exe
4940	taskmgr.exe
4940	taskmgr.exe

Suspicious use of SendNotifyMessage 35 IoCs

pid	Process
4940	taskmgr.exe
4940	taskmgr.exe
4940	taskmgr.exe
4940	taskmgr.exe
4940	taskmgr.exe
4940	taskmgr.exe
4940	taskmgr.exe
4940	taskmgr.exe
4940	taskmgr.exe
4940	taskmgr.exe
4940	taskmgr.exe
4940	taskmgr.exe
4940	taskmgr.exe
4940	taskmgr.exe
4940	taskmgr.exe
4940	taskmgr.exe
4940	taskmgr.exe
4940	taskmgr.exe
4940	taskmgr.exe
4940	taskmgr.exe
4940	taskmgr.exe
4940	taskmgr.exe
4940	taskmgr.exe
4940	taskmgr.exe
4940	taskmgr.exe
4940	taskmgr.exe
4940	taskmgr.exe
4940	taskmgr.exe
4940	taskmgr.exe
4940	taskmgr.exe
4940	taskmgr.exe
4940	taskmgr.exe
4940	taskmgr.exe
4940	taskmgr.exe
4940	taskmgr.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
3420	msiexec.exe
3908	MsiExec.exe
1280	MsiExec.exe
3248	MsiExec.exe
5828	MsiExec.exe
1384	MsiExec.exe
2460	MsiExec.exe
4940	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4924 wrote to memory of 1216	4924	VelocityLite.exe	86
PID 1216 wrote to memory of 2800	1216	msedge.exe	87
PID 1216 wrote to memory of 6100	1216	msedge.exe	88
PID 1216 wrote to memory of 4180	1216	msedge.exe	90
PID 1216 wrote to memory of 6100	1216	msedge.exe	88
PID 1216 wrote to memory of 6100	1216	msedge.exe	88
PID 1216 wrote to memory of 3428	1216	msedge.exe	91
PID 1216 wrote to memory of 3428	1216	msedge.exe	91
PID 1216 wrote to memory of 4256	1216	msedge.exe	92
PID 1216 wrote to memory of 4256	1216	msedge.exe	92
PID 1216 wrote to memory of 4256	1216	msedge.exe	92
PID 1216 wrote to memory of 4732	1216	msedge.exe	93
PID 1216 wrote to memory of 4732	1216	msedge.exe	93
PID 1216 wrote to memory of 4732	1216	msedge.exe	93
PID 1216 wrote to memory of 2084	1216	msedge.exe	94
PID 1216 wrote to memory of 2084	1216	msedge.exe	94
PID 1216 wrote to memory of 2084	1216	msedge.exe	94
PID 1216 wrote to memory of 372	1216	msedge.exe	95
PID 1216 wrote to memory of 372	1216	msedge.exe	95
PID 1216 wrote to memory of 372	1216	msedge.exe	95
PID 1216 wrote to memory of 1496	1216	msedge.exe	97
PID 1216 wrote to memory of 1496	1216	msedge.exe	97
PID 1216 wrote to memory of 1476	1216	msedge.exe	98
PID 1216 wrote to memory of 1476	1216	msedge.exe	98
PID 1216 wrote to memory of 1476	1216	msedge.exe	98
PID 1216 wrote to memory of 4968	1216	msedge.exe	99
PID 1216 wrote to memory of 5756	1216	msedge.exe	100
PID 1216 wrote to memory of 4968	1216	msedge.exe	99
PID 1216 wrote to memory of 5756	1216	msedge.exe	100
PID 1216 wrote to memory of 2188	1216	msedge.exe	102
PID 1216 wrote to memory of 4264	1216	msedge.exe	103
PID 1216 wrote to memory of 4264	1216	msedge.exe	103
PID 1216 wrote to memory of 3140	1216	msedge.exe	107
PID 1216 wrote to memory of 6016	1216	msedge.exe	106
PID 1216 wrote to memory of 3140	1216	msedge.exe	107
PID 1216 wrote to memory of 6016	1216	msedge.exe	106
PID 1216 wrote to memory of 6016	1216	msedge.exe	106
PID 1216 wrote to memory of 4472	1216	msedge.exe	108
PID 1216 wrote to memory of 4472	1216	msedge.exe	108
PID 1216 wrote to memory of 6044	1216	msedge.exe	109
PID 1216 wrote to memory of 3608	1216	msedge.exe	110
PID 3608 wrote to memory of 4084	3608	windowsdesktop-runtime-10.0.9-win-x64.exe	111
PID 3608 wrote to memory of 5348	3608	windowsdesktop-runtime-10.0.9-win-x64.exe	112
PID 4612 wrote to memory of 4936	4612	windowsdesktop-runtime-10.0.9-win-x64.exe	116
PID 3420 wrote to memory of 3908	3420	msiexec.exe	117
PID 3420 wrote to memory of 1280	3420	msiexec.exe	118
PID 3420 wrote to memory of 3248	3420	msiexec.exe	119
PID 1216 wrote to memory of 3408	1216	msedge.exe	120
PID 1216 wrote to memory of 4584	1216	msedge.exe	121
PID 1216 wrote to memory of 4344	1216	msedge.exe	122
PID 4936 wrote to memory of 4264	4936	windowsdesktop-runtime-10.0.9-win-x64.exe	123
PID 3420 wrote to memory of 5828	3420	msiexec.exe	124
PID 4936 wrote to memory of 4852	4936	windowsdesktop-runtime-10.0.9-win-x64.exe	125
PID 3420 wrote to memory of 1384	3420	msiexec.exe	126
PID 3420 wrote to memory of 2460	3420	msiexec.exe	127
PID 1216 wrote to memory of 2704	1216	msedge.exe	128
PID 1216 wrote to memory of 2704	1216	msedge.exe	128
PID 1216 wrote to memory of 1296	1216	msedge.exe	132
PID 1216 wrote to memory of 1296	1216	msedge.exe	132
PID 1216 wrote to memory of 5068	1216	msedge.exe	133
PID 5068 wrote to memory of 4944	5068	msedge.exe	134
PID 5068 wrote to memory of 2152	5068	msedge.exe	136
PID 5068 wrote to memory of 4156	5068	msedge.exe	138
PID 5068 wrote to memory of 4156	5068	msedge.exe	138

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\VelocityLite.exe
"C:\Users\Admin\AppData\Local\Temp\VelocityLite.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?framework=Microsoft.NETCore.App&framework_version=10.0.0&arch=x64&rid=win-x64&os=win10&gui=true
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffd3702c188,0x7ffd3702c194,0x7ffd3702c1a0
    3⤵
    PID:2800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1592,i,14997133780554580830,8168176747069352455,262144 --field-trial-handle=2184,i,7702238355762430994,1618824451342333519,262144 --variations-seed-version --mojo-platform-channel-handle=2180 /prefetch:2
    3⤵
    PID:6100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1852,i,13364362322099701988,11636965486205831246,524288 --field-trial-handle=2184,i,7702238355762430994,1618824451342333519,262144 --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:11
    3⤵
    - Downloads MZ/PE file
    - System Time Discovery
    PID:4180
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2440,i,1836191099659871837,12399888745344670625,524288 --field-trial-handle=2184,i,7702238355762430994,1618824451342333519,262144 --variations-seed-version --mojo-platform-channel-handle=3316 /prefetch:13
    3⤵
    PID:3428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3492,i,10066131765245632769,17867007750143815056,2097152 --field-trial-handle=2184,i,7702238355762430994,1618824451342333519,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
    3⤵
    PID:4256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3500,i,613260684755197497,13465258253288100443,2097152 --field-trial-handle=2184,i,7702238355762430994,1618824451342333519,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
    3⤵
    PID:4732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4076,i,11259386324560252147,17890694497708795785,2097152 --field-trial-handle=2184,i,7702238355762430994,1618824451342333519,262144 --variations-seed-version --mojo-platform-channel-handle=4668 /prefetch:1
    3⤵
    PID:2084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4088,i,6467164488589455430,11755396162726232388,2097152 --field-trial-handle=2184,i,7702238355762430994,1618824451342333519,262144 --variations-seed-version --mojo-platform-channel-handle=4672 /prefetch:9
    3⤵
    PID:372
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5168,i,2935570012838933047,15643200320400199316,524288 --field-trial-handle=2184,i,7702238355762430994,1618824451342333519,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:14
    3⤵
    PID:1496
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5320,i,5635692462672666045,15145063923070351117,2097152 --field-trial-handle=2184,i,7702238355762430994,1618824451342333519,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:1
    3⤵
    PID:1476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5072,i,7524047971346755008,10283852804394404503,524288 --field-trial-handle=2184,i,7702238355762430994,1618824451342333519,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:14
    3⤵
    PID:4968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5080,i,2432557042717791810,5486682511408285102,524288 --field-trial-handle=2184,i,7702238355762430994,1618824451342333519,262144 --variations-seed-version --mojo-platform-channel-handle=3736 /prefetch:14
    3⤵
    PID:5756
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6032,i,549163512768214821,2554963966527183310,524288 --field-trial-handle=2184,i,7702238355762430994,1618824451342333519,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:14
    3⤵
    PID:6120
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6032,i,549163512768214821,2554963966527183310,524288 --field-trial-handle=2184,i,7702238355762430994,1618824451342333519,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:14
    3⤵
    PID:2188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,6058184605442281209,18139600961619330366,524288 --field-trial-handle=2184,i,7702238355762430994,1618824451342333519,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:14
    3⤵
    PID:4264
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6788,i,9580316121967870702,1668554832253994887,2097152 --field-trial-handle=2184,i,7702238355762430994,1618824451342333519,262144 --variations-seed-version --mojo-platform-channel-handle=6860 /prefetch:1
    3⤵
    PID:6016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6704,i,6426365238343530153,993084825657328266,524288 --field-trial-handle=2184,i,7702238355762430994,1618824451342333519,262144 --variations-seed-version --mojo-platform-channel-handle=6832 /prefetch:14
    3⤵
    PID:3140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7264,i,17677921172024834094,3551598244593286809,524288 --field-trial-handle=2184,i,7702238355762430994,1618824451342333519,262144 --variations-seed-version --mojo-platform-channel-handle=7268 /prefetch:14
    3⤵
    PID:4472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6248,i,12362374316186444385,9806775791666534698,524288 --field-trial-handle=2184,i,7702238355762430994,1618824451342333519,262144 --variations-seed-version --mojo-platform-channel-handle=7364 /prefetch:14
    3⤵
    PID:6044
- - C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.9-win-x64.exe
    "C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.9-win-x64.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3608
  - - C:\Windows\TEMP\{A54402AE-0A8D-49B3-9A44-509232231BF3}\.ba\wixstdba.exe
      "C:\Windows\TEMP\{A54402AE-0A8D-49B3-9A44-509232231BF3}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{ACEFEDAE-A046-44EF-99E7-A557A9B6D491} {97FAA01F-3DA0-4F3F-B97D-E25FD599501F}
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      PID:4084
  - - C:\Windows\TEMP\{A54402AE-0A8D-49B3-9A44-509232231BF3}\.be\windowsdesktop-runtime-10.0.9-win-x64.exe
      "C:\Windows\TEMP\{A54402AE-0A8D-49B3-9A44-509232231BF3}\.be\windowsdesktop-runtime-10.0.9-win-x64.exe" -q -burn.elevated BurnPipe.{BE69ABB8-7798-4C33-BB4E-D48738BE9721} {226F19C7-B8F6-45D7-91BE-A58D205C8D13} 3608
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      PID:5348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7416,i,18341229947535676995,12238973863410476384,524288 --field-trial-handle=2184,i,7702238355762430994,1618824451342333519,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:14
    3⤵
    PID:3408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7412,i,6862154806089648562,12719204284862750525,524288 --field-trial-handle=2184,i,7702238355762430994,1618824451342333519,262144 --variations-seed-version --mojo-platform-channel-handle=7424 /prefetch:14
    3⤵
    PID:4584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4692,i,15493882948337113215,16583400118921084070,524288 --field-trial-handle=2184,i,7702238355762430994,1618824451342333519,262144 --variations-seed-version --mojo-platform-channel-handle=7456 /prefetch:14
    3⤵
    PID:4344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5568,i,6593746372961576089,10206548907870982245,524288 --field-trial-handle=2184,i,7702238355762430994,1618824451342333519,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:14
    3⤵
    PID:2704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7088,i,3698471581558558353,1361590517148799818,524288 --field-trial-handle=2184,i,7702238355762430994,1618824451342333519,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:14
    3⤵
    PID:1296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:5068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x264,0x268,0x26c,0x260,0x240,0x7ffd3702c188,0x7ffd3702c194,0x7ffd3702c1a0
      4⤵
      PID:4944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2088,i,13811462753946819147,12256684421369594418,524288 --field-trial-handle=2504,i,4938998359784340512,7460332185301173545,262144 --variations-seed-version --mojo-platform-channel-handle=2552 /prefetch:11
      4⤵
      System Time Discovery
      PID:2152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1936,i,15119465564751402379,12847873412324912579,262144 --field-trial-handle=2504,i,4938998359784340512,7460332185301173545,262144 --variations-seed-version --mojo-platform-channel-handle=2500 /prefetch:2
      4⤵
      PID:5980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2656,i,16784338908442102067,8266016545877429814,524288 --field-trial-handle=2504,i,4938998359784340512,7460332185301173545,262144 --variations-seed-version --mojo-platform-channel-handle=3092 /prefetch:13
      4⤵
      PID:4156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4316,i,14014226928595373664,6755759651315555447,524288 --field-trial-handle=2504,i,4938998359784340512,7460332185301173545,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:14
      4⤵
      PID:2252
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4316,i,14014226928595373664,6755759651315555447,524288 --field-trial-handle=2504,i,4938998359784340512,7460332185301173545,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:14
      4⤵
      PID:2840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1228,i,14270763260360584957,8630263832767335160,524288 --field-trial-handle=2504,i,4938998359784340512,7460332185301173545,262144 --variations-seed-version --mojo-platform-channel-handle=1356 /prefetch:14
      4⤵
      PID:5056
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1224,i,18395520086003350506,12616296389168317512,524288 --field-trial-handle=2504,i,4938998359784340512,7460332185301173545,262144 --variations-seed-version --mojo-platform-channel-handle=4892 /prefetch:14
      4⤵
      PID:1460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1392,i,10558619952805156353,13462831710807427315,524288 --field-trial-handle=2504,i,4938998359784340512,7460332185301173545,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:14
      4⤵
      PID:5836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4896,i,16179783606556557161,632034151503958651,524288 --field-trial-handle=2504,i,4938998359784340512,7460332185301173545,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:14
      4⤵
      PID:4288
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5048,i,5242798731794070348,2497389707803462601,524288 --field-trial-handle=2504,i,4938998359784340512,7460332185301173545,262144 --variations-seed-version --mojo-platform-channel-handle=4968 /prefetch:14
      4⤵
      PID:3728
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5048,i,5579857842647986040,12876221820201527753,524288 --field-trial-handle=2504,i,4938998359784340512,7460332185301173545,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:14
      4⤵
      PID:1564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,18414908913116695154,10744809771155291624,524288 --field-trial-handle=2504,i,4938998359784340512,7460332185301173545,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:14
      4⤵
      PID:1380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5112,i,10517082243774205947,4259085135092246844,262144 --field-trial-handle=2504,i,4938998359784340512,7460332185301173545,262144 --variations-seed-version --mojo-platform-channel-handle=816 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2944,i,10708060037972634361,13924073526301334402,524288 --field-trial-handle=2504,i,4938998359784340512,7460332185301173545,262144 --variations-seed-version --mojo-platform-channel-handle=1444 /prefetch:14
      4⤵
      PID:1276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4776,i,2078847968087206696,13492371465483219538,524288 --field-trial-handle=2504,i,4938998359784340512,7460332185301173545,262144 --variations-seed-version --mojo-platform-channel-handle=1268 /prefetch:14
      4⤵
      PID:3796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1264,i,15862194844120207786,9507874713861454161,524288 --field-trial-handle=2504,i,4938998359784340512,7460332185301173545,262144 --variations-seed-version --mojo-platform-channel-handle=3844 /prefetch:14
      4⤵
      PID:1092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2960,i,16454989865191739889,18301331344492994901,524288 --field-trial-handle=2504,i,4938998359784340512,7460332185301173545,262144 --variations-seed-version --mojo-platform-channel-handle=4112 /prefetch:14
      4⤵
      PID:1168
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3864,i,9162111986868247325,13556689151946043004,524288 --field-trial-handle=2504,i,4938998359784340512,7460332185301173545,262144 --variations-seed-version --mojo-platform-channel-handle=3856 /prefetch:14
      4⤵
      PID:948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4432,i,9450266316651940205,5687063289171790577,524288 --field-trial-handle=2504,i,4938998359784340512,7460332185301173545,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:14
      4⤵
      PID:804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5152,i,6847470431687196820,4202508627907035716,524288 --field-trial-handle=2504,i,4938998359784340512,7460332185301173545,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:14
      4⤵
      PID:4444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4084,i,6224528377765114821,7143826428174462350,524288 --field-trial-handle=2504,i,4938998359784340512,7460332185301173545,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:14
      4⤵
      PID:3016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5384,i,9809941066619058706,10767800782010275409,524288 --field-trial-handle=2504,i,4938998359784340512,7460332185301173545,262144 --variations-seed-version --mojo-platform-channel-handle=604 /prefetch:14
      4⤵
      PID:4756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5388,i,8140093098245010023,7598606183349830354,524288 --field-trial-handle=2504,i,4938998359784340512,7460332185301173545,262144 --variations-seed-version --mojo-platform-channel-handle=3856 /prefetch:14
      4⤵
      PID:4848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3856,i,6959442253622371052,370228830424659213,524288 --field-trial-handle=2504,i,4938998359784340512,7460332185301173545,262144 --variations-seed-version --mojo-platform-channel-handle=4788 /prefetch:14
      4⤵
      PID:1864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2956,i,11008223470018143395,1808429656073810743,524288 --field-trial-handle=2504,i,4938998359784340512,7460332185301173545,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:14
      4⤵
      PID:4092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4400,i,11081877602306393075,7221716609354227143,524288 --field-trial-handle=2504,i,4938998359784340512,7460332185301173545,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:14
      4⤵
      PID:4600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4804,i,6459431775796014075,14289706591489162384,524288 --field-trial-handle=2504,i,4938998359784340512,7460332185301173545,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:14
      4⤵
      PID:4004

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2804

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2008

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3420
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding EBE8032AA67FA17E1263D6CF058D3B85
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:3908
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 272AA9311764B30630CD9A6E52389301
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:1280
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding F4B499CD5CDBF183713002356BA744C7
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:3248
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 05EBB73274E55DB0C399E5CA77EE9E96
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:5828
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 2351C2255DDB38917FDEC4C3F045E090
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:1384
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 8F43CA636B320D8A24FD84DB257F7FE0
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2460

C:\ProgramData\Package Cache\{0B1257AA-9D34-46E7-B27B-07DF8CD5B92C}\windowsdesktop-runtime-10.0.9-win-x64.exe
"C:\ProgramData\Package Cache\{0B1257AA-9D34-46E7-B27B-07DF8CD5B92C}\windowsdesktop-runtime-10.0.9-win-x64.exe" /burn.runonce
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4612
- C:\ProgramData\Package Cache\{0B1257AA-9D34-46E7-B27B-07DF8CD5B92C}\windowsdesktop-runtime-10.0.9-win-x64.exe
  "C:\ProgramData\Package Cache\{0B1257AA-9D34-46E7-B27B-07DF8CD5B92C}\windowsdesktop-runtime-10.0.9-win-x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.9_(x64)_20260710010444.log"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4936
- - C:\Windows\TEMP\{1F955AC4-D5D0-4044-B22B-80EC90EF3AFE}\.ba\wixstdba.exe
    "C:\Windows\TEMP\{1F955AC4-D5D0-4044-B22B-80EC90EF3AFE}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{0EFAA657-1A22-41D4-A690-86BCD24C9DB1} {1C8F389E-D1EA-471A-9B36-1506DBAC1620}
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:4264
- - C:\ProgramData\Package Cache\{0B1257AA-9D34-46E7-B27B-07DF8CD5B92C}\windowsdesktop-runtime-10.0.9-win-x64.exe
    "C:\ProgramData\Package Cache\{0B1257AA-9D34-46E7-B27B-07DF8CD5B92C}\windowsdesktop-runtime-10.0.9-win-x64.exe" -q -burn.elevated BurnPipe.{560538FB-8259-49D6-8D70-2A186ECFFE86} {9C17C302-B196-4D6E-97DD-32BA9023D10C} 4936
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4852

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1692

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4940

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3048

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s fdPHost
1⤵
PID:4980

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5992e3.rbs

Path C:\Config.Msi\e5992e3.rbs
Size 11KB
SHA256 5a1eacfdab718315bc54625aeca272f4a19dbc44e79eacaf6b0472b992fae89c
MD5 d98d5a4be1197011c4d3ba7e718d3944
SHA1 7b8b0f0662bfdc94f9adeb99ff8367884d9087e3
SHA512 f05e52363e45fe638bea561712e1ea6280b0d535eeffc6d4e134f801f865e325eedde1ef470f9772080d397d32a2c208a014f5ba90b6ddd97ca52be391d5ad78
SSDEEP 192:NOLCfIQ0tj5HlYP9CWO9UIY9UMcEKs9Cdeph:NOLCfIQ0tj5HqE9Y9kk
TLSH
T1843230856304C6C7F9D60734D3172B21B7B7E2E6A318124F00AD92359F0B3A52F6A6DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5992ea.rbs

Path C:\Config.Msi\e5992ea.rbs
Size 9KB
SHA256 ec6cc59f9dd6b1cca74b90e9ded0b889055ac00d8e3cdd678c259e523d5ae7ec
MD5 c149a1ba03c885885fbf599d5a2f07ef
SHA1 2af8e5894d84e20711362df0d4a496ddca6430e6
SHA512 e692aec7bfd1700b5e30e55f504cdbd6f63e7e5d0f6c10e50d24f38a034cf41940aedfbddd8b8a7f2d02409805de209f10891065adf9671a9de4eb560384ec4a
SSDEEP 96:SmfD1HZjALHrbcBC7cZ1UXeD2RhCsTlkUXeD2RhC6jI74UYsTlSY0j7E5Z7P/5L+:TrHjgL0C0OVUIdVUPe7E/nvSG2uepd
TLSH
T102121F01B60081E2F89F1B39E7577BA137B7D297D380639F58ADA0708F4B7C84B95199
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5992ef.rbs

Path C:\Config.Msi\e5992ef.rbs
Size 49KB
SHA256 37ebb8b48247de88f6a576dd7296d0c6e3253ad703f8cbe663c6463e53975ae7
MD5 5a986ce1b4f32585dc69ee5c0dca6dec
SHA1 2668acd3cc57a960ba2a325fe4bbc549355c0a64
SHA512 332e9488b138ec4f9a2c88cca5a70aa30a48774b73a6441212d9eff5a4ada751d0129c0e363154c33faf13299a3e53cb3fac6a7e097f83654d2b2a311afd2906
SSDEEP 1536:Q7EkxpNrxEFzaq0BfH8vjUbjvTyUk9ENNzdoKrCSZOnlFaMd2uuRHCoEzaKQKkDE:eUtV/
TLSH
T11133EE58FFC8D1D2FA363DB82761DE053344D9CB272058AD65CE429AAEC26C94EFC484
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5992f4.rbs

Path C:\Config.Msi\e5992f4.rbs
Size 71KB
SHA256 1e0402aef133f163b829702811f4f9fe8ca4600af8681e29b6f270cd4b98e49d
MD5 15235369889d3c6053e05a02a94d1d86
SHA1 180abb3f5fb75ab0c16607e808bad8178c1af2ec
SHA512 3cbd701abf65a76b889e3edd08c961d103e9980c5a1a098031a8ccecbf2dfe3f2b8a29f3b80be2df3a0a8b64a1622c290df7719401df611e93efb218075f6e9c
SSDEEP 1536:jCsJtY1z2XlYfypaocNCiOsh18/gd5n9GttC111v7eGHvoOfup2RmRcBi6hhuNWb:mX5vym+SeC6GWmiET+k
TLSH
T12F63E0961B00C2E1BC33AD5C1B6BF9C5FE068D96AB61896E02C85039DD925CF6F7C6C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5992f8.rbs

Path C:\Config.Msi\e5992f8.rbs
Size 3KB
SHA256 f8963f8d0acbdb4746a984511efda146cbaa2331c8d1b0bcc2232edd05c689c4
MD5 eea68cc76b308d3e28bb270a4d3240b6
SHA1 da9999200f608c8b8c2ab5f9b803598f34c776c6
SHA512 164457007d1ec03e7379ffd1331c8f17085ba82c4ff13e3a315aaae21d7dbc033a0a9945a83e06b7b056138c4fda9eea5564943e1b2f1ab9a5b6ce747fb5edcb
TLSH
T19A71CD02EE40D2C3ECAA2F31CE170B5137B7D6DB9320434B058D91751E577C69EE918A
MD5 SHA1 SHA512 TLSH

Submit Download

e5992fb.rbs

Path C:\Config.Msi\e5992fb.rbs
Size 3KB
SHA256 13b9dd38833e62bbf36192dedab1a1da4ba861d3d87b3e3fdf124a1662fdca35
MD5 3d31111351fbf69d81f325f6ba0e2a16
SHA1 4885879c8a8c8af44177d01e0d3100e479b59a02
SHA512 f58c22ab4fbcddeffdf2379fe28c0951a17f41496c32550cecc5798a1e1d65df36b115e179f910d6501c2084e12009b15b6a9c59667e7cfbabdc4ba8d09a8ca1
TLSH
T1A5818A43AB04D6C3ECB21F34CE571BA23777C6DA9725834704CC91750E877DAAEAA285
MD5 SHA1 SHA512 TLSH

Submit Download

ThirdPartyNotices.txt

Path C:\Program Files\dotnet\ThirdPartyNotices.txt
Size 77KB
SHA256 deb4427a295e1ed474b0d81c5a0d972c1b550b9a715cda939cdfa9236b1b418f
MD5 0d8867a25ba926e6e40cd52ab3536b5c
SHA1 89390dc8b8318d0bfef1c6a2fb4783537e28a465
SHA512 317ca335405274f4f91b173651ca2826760acb5ba5cf41aff51adc55c2cda9059fb268333665f13f62fa48119e55a303720a780dd58d28dd9967db4c88407d61
SSDEEP 1536:HA9jHwsGfgg39/zwgAVkguQxrDjugtSEGepkWvrpX7anuqdLSVnfiStPq+3LefrL:HA97w/ogz1AVxuMjHtSFULryLOgrGWm+
TLSH
T17773A45F7E45077319E2C3916569A8C5F22FA02E3B6B2A44346EF248133B42DD6FF858
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 163KB
SHA256 a5ccdc3a41d5e5c6014ff64509aed176db39f4f14caffff3dd1997f8907e94d7
MD5 b497651137eb819839df76f909340d9a
SHA1 549dbe63c781ee26d5ebd2ca8f605ce757b3dc21
SHA512 ed4e6f3556c08b832da992ec329610a0cd4671c51da49a81e1e08075036b46ae1951c5caff14789d5faafef84e88d467343ad400a0810522edadcc31141f18f2
SSDEEP 3072:UGgPzwruvTSBbQ/fp4SbDqIG/sk7l55wKGxvu:UGrrubgbQpDvqIwtQG
TLSH
T152F3F61AD65811AAD16E9575CB528941BB337C668BE0E3CB13C0F8BE0F726905EF9703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft Windows Desktop Runtime 10.0.9 (x64).swidtag

Path C:\Program Files\dotnet\swidtag\Microsoft Windows Desktop Runtime 10.0.9 (x64).swidtag
Size 488B
SHA256 e35c7aed7444295aad916a651e8ac6bbee7a7784dc27f9e097d2307362860f0d
MD5 d56d954e744b74c38ed30ff5e43d6f82
SHA1 bbec66a002a988392747ce6d4390544cc9678e34
SHA512 f87f89840dc6065ade6957c8b1d6c0b1d2664daf8be0c37b2b7a89cae24d85768f401267eaac019f70f29354beda3e8a531246d1f3db33f9ab30f4d480eea17f
TLSH
T1DFF09E86F5407A3282B31B64A54EB085F34DB6C3CC8C26C54C99C456019B5EA437B940
MD5 SHA1 SHA512 TLSH

Submit Download

state.rsm

Path C:\ProgramData\Package Cache\{0B1257AA-9D34-46E7-B27B-07DF8CD5B92C}\state.rsm
Size 1KB
SHA256 325a948d2f1f7757c2a8c8ad67bc6a91588d42ed0dd6aae2016471015840c8c0
MD5 84ca94a2a83e57d6980a407f7e039351
SHA1 7a94323e68f54be832a68422df0353f626e8b6b4
SHA512 e28f399a2465eb8ae1dfe7fb2035cf6b2fe5220911a2831071e0ad2fe3c94958878148adb2291ce62d5c64181f1b14d1a8d8b20c4b1014d268d07f1d64805d85
TLSH
T19F2181515BFA092DF3F6AB7569F96625543BBC161D24C26E0001318A9E72BD0C874B33
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 94dec02053c5653bb99c1c0743dc42d0d9a1b45570125bb35bd9b56d56a0c898
MD5 80621954e39909665113acb49efb7d24
SHA1 96c4d9a15a5b8a59987cdafca36273b3e438ba0f
SHA512 3db0d51e9ffd617c5dd28fd5eb72406d4f07ed05761c5d5de7dc9031337da8098941f2be28999786128e9c622da3bbbb98086e8185db67c294d23cc06481e8d1
TLSH
T108D097A432627507E71810B2A8224300B35688003A96C101C040A30E8E2E0A06BDA2CA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 63c8fee775f41336b8ded6c2d0ac08e4a532febf56501ac2558e9e5e8dab802e
MD5 8699dd98fa598241af54e35c7f266554
SHA1 5bf559cdb577d710f0b97bc7603c39ed02416817
SHA512 cadd92031f6c600b847ed7be7f1dcedf75c3dd318f30b9368fb4b420aa04d01ec7453792856bcf42ef4a61ebad56b0b0bce9aaf543c0b83b51f7079d04ff1a6d
TLSH
T10BD02364FB19F547CA0931B1D8778701B6524D207546D09151D0520D9C7E5C5F7DD39A
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e413e02b9e80ee8d76d52c1043fc32251e2d7634d4b2fbd970df9ace9d91831a
MD5 22959b3a06a842ac30237dd57e8a3801
SHA1 0b7c28071a592034aa2607038000f085c7bb6362
SHA512 644add9ab912ad7fdfc55bc7a1b84482c75cc9bc69a59d169bae63a0400619d999846ebbadb0ef2bd6d35c2bd08a5f07053b600874dd5dfcbda7e8f3076131fe
TLSH
T1A5D02BE476408A0CC980203335F6524092018910D801D1480040B325CC845C1257F0DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8aaa68aad07ba45abe53bd513aa5f7e7b21bd1b29db6e1d5c1e0a79a5f4eb890
MD5 74012bbce5fada7634c1da1b567562b3
SHA1 09db27f38f27e35986cfd407b57f6f83c8fc59f8
SHA512 c1a6a98f972793c84274c29552107bfe07b775c7c8121e5fdf137ebf9a7cc3f4eb43fe9eadfc842e7b92ca7281bbcea3d660bdd8fc9adc56add068510c41e48d
TLSH
T1FBD02BE07640890CC980203335F75240920189108401D1480040F335CC845C1257E0CF
MD5 SHA1 SHA512 TLSH

Submit Download

1faa0189-e268-422a-9f9f-52c6114b5adb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1faa0189-e268-422a-9f9f-52c6114b5adb.tmp
Size 414B
SHA256 208c3b92f9523b4699636e6e763184fb8af532156536cfdb1f3e275924c78d75
MD5 8fd1d6814685e5ef7c1d842f9dbab092
SHA1 8ea01992467fc2864863c7a82378522e797ec31c
SHA512 658adec0fe659929590db2894d508e8e602cfef2d620eaa6ccf72f2e3835adcbd5127abac7f73b05358e5297119231608ed2ea1928a30f71e949a3ba8c838388
TLSH
T14DE02BBAC915FC3709FE0B2C6090474AF7551B162F50945B3B3D821C8FB87364AC589C
MD5 SHA1 SHA512 TLSH

Submit Download

63af2b92-1289-4a39-a5e5-959054249960.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\63af2b92-1289-4a39-a5e5-959054249960.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

9a1fd0ac-8e23-4d9f-aa03-0bfa0b48fe6e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9a1fd0ac-8e23-4d9f-aa03-0bfa0b48fe6e.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 f394d47ca9d481fd8bcffc8925d310eaf7bafff279b1c781a7f4fef31f3a1bbf
MD5 b66d6f2d399c6139d9c225ceede292eb
SHA1 54ed4909caa5a3b08a95e52ca24217e039131d60
SHA512 5f4ca3ac83eb7f079ac75f636daf2b4b8e742c9c7de1c612514088b6b389f69f3a067f9078b37aa5f7d6a5cc5140cc8becbb8816bba9e724293168f73ce6d02f
TLSH
T13171C99317253AD0E73559FB47E854D8B7F4BB69090F5EE222582C7E580EF0860C902F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59b78e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59b78e.TMP
Size 3KB
SHA256 32c6097e0fc54a649fb74654ac35e51eb8be52cfd6792b464050153c5f5ba31a
MD5 90553848befcaf0570b0e118d1a590eb
SHA1 408752ecb44c6fde61cfee135cc470aa1ccffcfd
SHA512 9c7f28921170e57c2841c87f11bf1b1b3ef3b25a94614e363b03c315c7a49ec33e928c3737c382e37da87e08ac350f471413e55cf743bf2e7a8a78588a6df57c
TLSH
T16861869617193AE1E73549F757E954D4B7F0BB69480F9EE2224C6C3A581EF0850C902F
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 5aa59d91c1caa07214c6ead8496d19aaef436912737782bf18852ea1045d4e37
MD5 2ae907bb8062c9b85cbe84537e51f10c
SHA1 2a10d8e8675136bf015618933d07b66a0ed3fe1d
SHA512 83d002a48b70f101ccaf4cff80750f28dbbafd9467183e0b496d789a5cea089a75b431ade68c693a8646e25830134831990400da7b17ffb0878e691f1508e293
SSDEEP 3:MsEllllkEthXllkl2zE/l2G+t:/M/xT02z1G
TLSH
T146440204AB800406CA0212319091835113B4D41016125743255104229CCA6400C11040
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 556fda310506559d4ecefc127ac687060cb8edc92139a58b088f123912bb58a0
MD5 dad76382a2188e047b8de11ac6f70b7e
SHA1 a3eba40a64765fe707afbd4bef10f985d6fcdcd0
SHA512 1f3dcd9a080509d20d91a6fef1493e1f6813e4bc0e12685231738e454aed2e0edc26f97fbc668fe395ab8bf9cd6ff28655f67547080dc474d9d0b6df600e65c2
TLSH
T113818CF787B4856EDA1196F0AA18AE2FDF2C0515431C7C6A89D0AE27D7E3472E00265B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 c5d2f193989799c59c2f2e2e7f91704a8fc8fd77e1b17064e0c14d520eea1161
MD5 db6740e7a3dbfa8f6c945c45469bf262
SHA1 5b9831d8db7cf8ffa43c8a058e3464609bc10ded
SHA512 abb6d0ea56e0c60008130272b3792abc3bd34a79027746b2499e64e42ad09ccd4e3e8f336aa7cc880fb5322e6e8b0ab05a943cd2dd73bd8b6d14fa8854b9dd32
TLSH
T14621CDF7C3E8A67D890182F86A183F1BCE2D0854832C3D5BC4D4AB5B93E1471E240A5E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 9e76c0b60a62a607a66a6104c6e33669b3220f5869881681766a3dbaf45734c9
MD5 8f8fad11e9c2be903b018bf5d04cdc3a
SHA1 f78e87dd9ee9a6b38269889eeec1863585e96d30
SHA512 05eda47cdd5d192c4e9459e98e2d87d1babbac914aeb80dba5aca0ec05a2de04ad525ce5f0d8b90ff35804b6fbd0a3273ea20aa2436165118b029d68f48a627b
TLSH
T119818CF787B4856EDA1196F0AA18AE2FDF2C0515431C7C6A89D0AE27D7E3472E00265B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 7107d111a34fe834c94bad3b0c48a93b430cf6a2444334630411267a1bf2f78b
MD5 575f5f5238b993ddf58b69e3aa86728f
SHA1 d63959e04cee28f3fc100387e45d0256a887f991
SHA512 aa1bd7cde8f620e40d1c5ef3b0f0ce58778e54020d6df77eba9fc2346baaf61fea5af7e089e81b36563da853ca39f62cd9123504a3962d18a72a901d20e9e00f
SSDEEP 192:sxR7RGyM/jK1Ml8DTdv/fUseWpVqvEpZvjga0oA8pLn/g6+WNRyBv/aCopxOTHrr:sxR78Kh/fUseWvoEn7v7/5C/jIda
TLSH
T1DB72C716A534597B9CDBD319FA55BB63D6F81523A2905E44ABFCCA0C00E7BEC620381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 da9b2d376d683bfcb9ceb1eea747c00baac88c7315cdea5f79c93fed40ffa815
MD5 8dbffd1735da1b729833577789666721
SHA1 67744200f868866382f14032f06f796f1339378b
SHA512 c6a404f77a2bae5a678b83f0f55801df9f7f26d41aa4a78664abe8320e85ec049419482175be5ed291a4e7a1c731abae2fce433361ecfdef7119df8b0e64c15b
SSDEEP 192:sxR7RGyM/jK1Ml8wBdv/fUs2vEpZvjgd0oA8pLn/g6+WNZBv/aCopxOTnnRhuGPa:sxR78nh/fUsEEn7I7/5v//Lxa
TLSH
T13962C816A534597B9CCBD319FA55BB63D6F81563A2901E44ABFCCA0C00E7AED620381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 f9587a086888bdbfa1b0747553b249c27eac169f31012e0a139554df3264c184
MD5 f1570fb28e14c9126f31842c3bd496d2
SHA1 67b19d575de565838fa6889723d2fb9f8224f2c8
SHA512 fe5deceda6d429009988bcca7978188f8f961a267d00723bf8f265ab6cb4267fde421cfbc9e4edea7910d22ba969f657ff32f6bbd9ae618232cc3ceb327130a9
SSDEEP 192:sxR4RGyM/jK1Ml8wTdv/fUsGvEprQ5uszoA8p9n/g6+WNZBv/aCopxOTnn3huGP3:sxR48Fh/fUs0EF1/5v//Rx3
TLSH
T16062DA166A345D7B9CCBD319FA55BB63D6F81523A2905E44ABFCCA0C00E76ED620381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 25bf5a9a5b7a563ae3eeb1faf35ebf00f76e52525db3c9c4231699d10438f0bb
MD5 6702c57e6265f22675807febd458c980
SHA1 faf74a43079b9b2ba7bd76a4e5d7e92a81d41c3e
SHA512 ecadaf0ce58aa0e97d261fec23c582fe057c6e68437084236e06a16d44d1e948bc6c1ff638b577bd542ed9af3ac8e24c2eba4281420cca2bf27d5ce05f5da964
SSDEEP 192:sxR7RGyM/jK1Ml8wTdv/fUs2vEpZvjgd0oA8p9n/g6+WNZBv/aCopxOTnn3huGPa:sxR78Fh/fUsEEn7I1/5v//Rxa
TLSH
T1DE62D816AA34597B9CDBD319F655BB63D6F81563A2901E44AFFC8A0C00E76EC620381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 3d9d096b98571072179d1c42f1101a42f482b406874608d5e0d21fb32483551c
MD5 00795051e72bcf950bc9236d5058b09a
SHA1 fffc2239b8b5e5d2645df091cabb03de8adc2fa3
SHA512 4d897e3f89c53cbf71163b68fd6f3b6bb3681381ce69a4694371bef469fb8838958185eb553440d18d64e214bcef32a707ca06ad84da1c19b5d55d8f14a91861
SSDEEP 192:sxR7RGyMqZjK1Ml8DTdv/fUsnWpVqH8pZvjghYPv0oA8pLn/g6+WNRyBv/aCopxE:sxR7BKh/fUsnWv88n7+Yn7/5C/jIb03
TLSH
T18272C816A5345D7B9CDBD319FA45BB63D6F81563A2905E44ABFCCA0C00E76ED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 8be490be957202c519d278679d34d91e3e04aa0aa2e5c0802cde13297f40f1fa
MD5 f421254d42d0a2ddbf3b1c93b548a0bc
SHA1 037704d28bafc826fb58431b4729714b3863f11d
SHA512 d04beb9874627022d3e81194b87df855387586dfa4b5e4d077af609bc03cfd8f34c5cedde4e34dca20963d1e5907fcd96c98bb968f64f49259ef19005536ccec
SSDEEP 768:wGedPg7pLuL7X6WgoufDM8F1+UoAYDCx9Tuqh0VfUC9xbog/OVDROu4Y8roS28Ca:wGedPsE7X6WgoufDMu1jaUROVYn3a
TLSH
T1D0E2DB3B680CCB7E4F844EDCEC29BE9EADA801CB56D8895447EA840C03C66EB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 5da57f76822964b7625e263475b0de873143e203d654cb02cc3ff839e45411d2
MD5 4a833cbbefdadb18f91728980421cab2
SHA1 f61a3a9d98e5784e46c4dd7081003239c35f922c
SHA512 eb74af3e37f39663c9f139ece7ab5f9d46a8c4b621ee45a7cc89e47ea568cb688fcb3f1a1bf4e4e6cdaee1b2180548ac316f06144792b1c99a434e5b6dddf9be
SSDEEP 48:KEWIPKbCAjy9XI5KkA0X2I/K3qMDyLdaJtXbP:KEWMKbC+OXCKkAw2AK3q6R
TLSH
T1C29180677A3A43112C7E2E0C8295877782D170A77058653B7BE940668F26F02DDFEDC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a284a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a284a.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 50KB
SHA256 795ded011361eeed8e3ec0953f6342da6c7d29bb4f03af800b5fa2885a0f95aa
MD5 ea2f57e89a4d044d9b5e9dba727e4cd4
SHA1 402e08b85873a26377c739eeab44b8b22333739f
SHA512 503759e2192ba8cb73306ce0e5dbe68c7ab896d1bcfdd4535e12c6e8ea50a99843bad58736e92e6eaa70480d35632dac613d14eef214438495f440439667b0fc
SSDEEP 768:CFuj+9V3ewgKCVZJ5O0bI3Nzc4ReyIsP5Ucb84jGvG44Z71Po:w9V31btc44bsxUuB6vG44B1w
TLSH
T12733E4F998D3897ED8AD6B47633E6D1698BCC137B1A85894F7840B0CDC225BFE306911
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 2ce3d53826eae92323a0bc6b49af3f9859c3b3d610b6c38434d7952394ba0c85
MD5 d1467f7c5fa28497a50a50ebc21f7e8b
SHA1 7b4afb573841d5e5761887728eadb6736f83dc26
SHA512 b4502cbf48d730b92c96388f9aaddf5cb72ac1c9fe7806fc38f84dcf685325b1fd921b25470cf563cd7f31ea3a05ab30d0f433577b69824d3d3915977d0df591
SSDEEP 768:Tj+9V30e0DZIO0bIiNzc4ReyIsP0G44Z71Po:29V30Itc44bsMG44B1w
TLSH
T19EF2BD32ED26CC67ACEA8289B2173792BDF4126780C56E94D6DD6F0C05473AC0B1B923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 5c7daf375bd1e61f4f82694ff55050c33d908bbed24a3a83cccd27f1e6497990
MD5 e444f78d191425793888ea1356d209b7
SHA1 eadac7d1a4f5245a503e7915d06b92a70063d733
SHA512 bac6eb84162d500b1085fd1007930b9c0ece90f91f93d113219cfdda097c1852cbcc32e2a37ab81065163ab8920f0d803d3b3be0fca138860262f5a4bf3d36cf
SSDEEP 768:6rv+4UNbds31eDZIO0bxNzc4ReyIsXWeVH1S5D:6bsbS39tc44bsmEH1Y
TLSH
T1AD03CF32E8788937ACF6A686B14776537EF8512BC2981E94C5DE2F0C4A4B5DD130B923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 da07bf74b83be716aa1d0ffb8a9ac166027ff3ccaeff39d734cc7460470c4e2d
MD5 e20a933c73131a7d75b89dd08c0d9c8b
SHA1 f60dcd6eb913440751fb79c68d68be1e804a0115
SHA512 aca932efadc11a26b31eca00f698a49e74ec8ab40089b8b24b2ab318810dcdd9b2296409337acb43878542d9a22dd6a90317dd0a5b3e606b5f7781c03382d8db
SSDEEP 768:4j+9+3zt0DZIO0bIXNzc4ReyIsP0G44Z71Po:n9+3zStc44bsMG44B1w
TLSH
T19DF2BD32ED26CC67ACEA8689F2173792BDF4126780C56E94D6DD6F0C05473AC0B5B923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 46KB
SHA256 dea6f40c71f90c7497a1c247518f9bfbcfe1d5c327b780c32fa21adb6d0552d3
MD5 abfabf6caf36be50224b1039200f6bb5
SHA1 9adab19a43f436b749503bf9e1a09d3035e1d5d7
SHA512 a806543a8a9216bf1ab27fe3777a49524dbe94a5a3dfd5d2139441c6495414d4cd4efb4f585db5c71813dafd00ee3c3890b684ff69e696d203908498e2f5c4ac
SSDEEP 768:VFuj+9V3fwgKBRol75O0bFNzc4ReyIsMPC97Y44Z71Pd:59V30Ktc44bsEyY44B1F
TLSH
T1F42328F598D3897BE8AE5B47A33E6E166DBCC227B0955894F7881E0CCC521BFD306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 49f65b2f79eff6b61dddf371e9a2c1fa87cecb95e146bbe253c8ad4b3d787829
MD5 23a0650bf2ace37f31ed771a932c6962
SHA1 6809e6b9be26ef6d5e65c32e9ec92e4081fcef16
SHA512 43f86e207e94931222afe19387ebdf21f09e21a257df4ee22dbbf3313750f4151b39e3a6f01c779559a5b8da7e05e3f581843ca87b486757b66e973d4edede84
SSDEEP 768:CFUj+9V3BwgKLVZw5O0bI6Nzc4ReyIsP0G44Z71Po:G9V3KAtc44bsMG44B1w
TLSH
T15E13F6F698D78977ECAD4787B33E6E46A9FCC163B1885894B7885D0CCC461BFC60A811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 abff6d8a667a380ed6215f195774b9af0e192cc3c541f8f22eff82febdb1bc0c
MD5 c7bfc43436653539784fbc52d96d2858
SHA1 28384078de3933855a70d22de8eba2f3fbabc4ac
SHA512 cef0cd757382da8daa9b5113752354ea9b76b5cf47fa0801b2b808fc8796d323417083c000665c343a55a10578034afc683e6233e1ddcfbd3e411b5219eeaf8f
SSDEEP 768:wj+9G3fx0DZIO0bITNzc4ReyIsP0G44Z71Po:P9G3f4tc44bsMG44B1w
TLSH
T1A1F2BD32ED26CC67ACEA8289B2173792BDF4166780C56E94D6DD6F0C05473AC071B923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 4b3c2582cb82a445f1dc4cf31ad66dfb8d95abfd3cdbc0e3dacae0bc8a2a022c
MD5 b4591ac7d9d7723e64701f25f2d131f0
SHA1 025f1fad88679feb4f18d4004bd2e3e22022ef38
SHA512 51bc4f4181ec885fbbd45cce0db06f4fc8240834c2455cac99b1699a721bfb87e968ee6bc84a92ae96df7fef9f756e4dd543b8b0b534b810f1605fc0586663a5
TLSH
T19821FEE22C6D2AC1D1BE0EBFB08B3AED80D89216F5D0347A2C59ED54867DA1915418BF
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 955ad9f118127cf2f2ec369cc597cbc65dd66189a9200b7205d8c000e05ad29b
MD5 8779ac97c9fe90edc7d1d11ece646f59
SHA1 26d0c26a94b8bfd88cfc2bb52f050cee10dc0db4
SHA512 26ab0e4a83ed3193bde8d074ae5d99e89139d1cdd6af84aea9136a1bec2893feaa04d77f8186211612fa367680214a18925ff8c5a3116d9db5678bd5d0d03576
TLSH
T1AF21F0E26C6D1AC1D1BE0EEFA48B39EC84ECD216F190303A2898FD94567D61D158087F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 36414d88bb99481231d2656f167007eb3da0225bfb3c7372261a59db7f18db85
MD5 354a164d44ee0b433701830420ea6b07
SHA1 4d5e52f7fbb1edf2b8bc243ef7cce647a075c91c
SHA512 8ea981061e238755b9bd05730bbf23efa8fa4d8ca1cdc0085632f95f261a70c6409e0aa510f7e6ed5e1a203a4243103c9f52f5677db353fa9ed0f9bdc8ae7f33
TLSH
T1EB311DE25C2D1AD1D0BE0EFFA08B39EC84E8D212F590303A2858ED58567D91E154047F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 2705b2aa952c9e60c733010b09b666b0933de65d4b887ec2ed26b2909b45497e
MD5 d23b062b9f05755074a63c147e4ff265
SHA1 2ed501c135a3ebe6468724114b434caf49d06b97
SHA512 a120f2621c4fdfd1c004b98fa337c306eef0d11b71fbaa210e211da7216051f1192072eb9fe9a5560d7e6f063b3d2b886c5b86e6361e55b5fa7487833f418c28
TLSH
T13A313FE26C3C1AC1C4BE0EBFA08B39FC84E8D312F190703A6858EE58463DA0E154047F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 732B
SHA256 d902396b411748815d719def38a9e67b327e5401db353be49afe889bd1ecc133
MD5 13ce7b4a1ecbafa91675e8156476f6d3
SHA1 9bf6cec54355e4c6200b4cac01f6d6c14bf5004b
SHA512 cf45d7cf9c89fc0b9e088e8a665690c1e7d365fed0c718095301dc36e992e91e3f913fac3f435985cb040e8e689603d7063d2d2793e6e0ebfcec480530b851ad
TLSH
T1D70110D36C7D2AC6D6BD0FBFA08B7AE844C99117F29070B71C8DE954867890D104243E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 3e5e95b52cdf0c0454ad0544fefbb00e989231ba2b8df685b211d2eb798274ea
MD5 e59c1b1464ba303d64bab883b6c99a0d
SHA1 6c2d18abe1971316a6e03ec30b0176623f7f399d
SHA512 cc4f4e82bd95f5bec4d0a1e671c9f20247b61a258d5d4646da472a7c41e4fc8a2ea80a22a608dd6895baed82a31e96c68949a81642cbff051d1ed85189d21b7f
TLSH
T123E06082AC7E25D0A3D80F7FE84A29FC80D86503F080343A488FEA98C27E50E00020BD
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 70c2167ba319e2d9b4dbbd33be17d327dccc4afea0e88a8293bc277f7958b9e9
MD5 f110d7cfc88f70ce030d25ca440e977b
SHA1 465dfc01b041cbbcd534e5361c6b09c7fdeccecf
SHA512 16faf2d3a7009a7856c2846f2147f4cc1fe93e1693ba6aee4972027272fdd53b2e0b7b55760bea98e6edb956b9f0ac9c29e1419fa278ed6ce5e1420bd0be2128
TLSH
T1EFF09E929C7E25D692DD0F7ED44B2AE884D96503F0847436584EEA94D2B950E044207D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 612B
SHA256 c99c654c96dd1d6fb41d9ca5ee4da8943687d390afa763720c089516a64e6fbc
MD5 c96c5cc237844f210ccc2a561553aaa2
SHA1 731a19fab3ed5b029b7f4f3b43fb0a7002c5c824
SHA512 017280b1507c98b455cb8a79f898e18972809c987d522c29aafdd890e045960759775ba1c98bb54e1ee563adaa308e8d3440152a791f7501f9086fe1383c36dd
TLSH
T1D4F002C25C7E16D2929D0F7FD08A26EC44D9A513F08470761C8DF994C27D80D044202E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 e0142a4f723e45215ebec70a4d09ed76a008ba29de6ce9abe9f3ccdacba1ed1e
MD5 caa5a1ba895f2a98b49e8ad019f9df6a
SHA1 392da28da35e73abbb287fff0a69806f2d98313d
SHA512 0a4f2b08e8e22fa6ee47a3020b6e030c51e9cb1582ceaf38e1b3e7a8725c66d560552bf079288d8cdbdfe218454f0e6606b59bab994d209ec7d983a8a57d0850
TLSH
T1A111FCE22D6E1AD2D1BE0EBFA0873AED84D8D216F1D0307A2888EE54967D91D054187F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 3c9fcbfd1441cb4e4886e9bdfc99a929bda26303e23db4d8c7a918472b727cd1
MD5 ed23fb4d92226f0dc8da13daae7e926c
SHA1 ae4e513affb01f4361aabcfb1e10efd5bb820343
SHA512 203444c70e6d397ae7027d850b4d78edd85ecc15b562c9cce4b8521120f63cc81a41c04af480cf59ec945c4da529d0dd852e67965d55340cfa8faec2bcfb7c14
TLSH
T1F5D095826D7D15D073D50F3FD44B68FC44C95407F044647B480EFD88D17E546444287D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 852B
SHA256 4a5b5d8844d3f328aaadaae4011a64122d4a1b4a4238c6ca76966908c2b26eca
MD5 ed69b5ac4028ad35a56d6b1839fc6cb8
SHA1 90ebe35a6d50ce8fb40cd8b53d5df6301376fa7c
SHA512 4c12695aa3597147a09ac40e72fa29d904dc4e988438caad989da0badd5e058d54deb2c5b491366864db6cd6f419f3e2ca6f523f6fb557cd54ca7afa4e9dc84b
TLSH
T19D0146D25C6E2AC2D2BE0FBFA08B7AED44C8D217F290307A1C99FE54467C80D044247E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 972B
SHA256 b13719c86224505f1d08c3299ee466bb5844b446d57b445722509c92900d774a
MD5 3e7d5be4586d59f60439d6cce66f82fb
SHA1 a575165779a26854615d514017e7e65f4842cec2
SHA512 19a58bc709b0c1ae0cafc5788fb955ea9c7bc76a62855ee5c815dbd73388a1454aac9e268ff9e039f2de6df56413b711ecfd59362594128295151ed099cd347e
TLSH
T1521110D22D6E19C2D1BE0FBFA0877EED80D8D216F2D0707A1C88EE54467890D004147F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

Microsoft_Windows_Desktop_Runtime_10.0.9_(x64)_20260710010444_000_DotNetHost.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.9_(x64)_20260710010444_000_DotNetHost.log
Size 3KB
SHA256 845fe319cfed1803c92ceff9bb8b9c9a5b5fc5fb7824d6846828c9e1248ad574
MD5 5548765705a8b6b92c8d25bcd7fe0353
SHA1 f224a31d04e83db7a76ed4e17830cf7319e04055
SHA512 af4e549cd6279220a5e6eade4f14bf7bfaab1b6278a6ace765b78ff12e18aaae2a0ca4d5f32d3ea10adbcf1ee92215af39e85d32b02e711e8037d0be727c3926
TLSH
T1487129151ED40D16F2B327479DF3C4235A73FCD2A8748F4D6385831A47ABD0589A8B7A
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_10.0.9_(x64)_20260710010444_001_DotNetHostFxr.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.9_(x64)_20260710010444_001_DotNetHostFxr.log
Size 2KB
SHA256 302da10f0de017edb5f26fc3421c27209cdf4e3ee96f357c02899421aed75bd8
MD5 1a5e10111227404b53944c11a9d8fae1
SHA1 1f8310ec45e805b62da5df4805840718186cdae5
SHA512 5ea034725ea05e2ddc67df0219bc1fd07d1c365505229ced9ccaa0a19aced89ea3dd6472c80c2aa55e7d9781cc7ff12491610f93a4af2d4472feffb54d5a645e
TLSH
T19041E9552AE5085AB2B727479EF3C0639A73FCD26874CF4C128A431907ABD045DA8B7F
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_10.0.9_(x64)_20260710010444_002_DotNetRuntime.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.9_(x64)_20260710010444_002_DotNetRuntime.log
Size 2KB
SHA256 b1432ec112fc69387848e3c76fa3d682997513ff61761d5098302cdeee8a5057
MD5 050464dae686d4786ba875f1595edc01
SHA1 179db5443e436a308129c762ac705e885a20071d
SHA512 d738849fe001a2dad575b34265960b83f4f5d1e2a31ae63d7bd210385df67a51cfbc65189e07d52b07148e2959616ce954806627590eb834463fd90acfdbbf3f
TLSH
T1904105452AE4091BF5F75747AEF3C0634A33FCD26874CF9C6285931A076AD005868BBA
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_10.0.9_(x64)_20260710010444_003_WindowsDesktopRuntime.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.9_(x64)_20260710010444_003_WindowsDesktopRuntime.log
Size 2KB
SHA256 9ee7474d83a9793e4c52cfb63b62a1b90afc9f71c7d6478383dcfe1d653780cb
MD5 9adecd4968e18a57c38b836d681b1a74
SHA1 6bf315d460849e3ce7875711d2c97796a1e17451
SHA512 da053451aa991db0aa0c639b10f6898922c86cac4385c933311911c7cd32cf4a1f43e9ee0f2dd6801471464ef6580a1fdd4b351d12a342b661e77a0c6a624ab6
TLSH
T10D41F5452AE40906B1F35747AEF7D0234A33FCD1A878CF5D2285932E076BD049868BBE
MD5 SHA1 SHA512 TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1216_44289709\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetHost

Path C:\Users\Admin\AppData\Local\Temp\{A54402AE-0A8D-49B3-9A44-509232231BF3}\DotNetHost
Size 1012KB
SHA256 c8fa13b9c79f39d88a324a03ff97c21585643095b32e674fa668c58e1f106ef1
MD5 7bc75d5cc808fcc218f7d03f252db9ba
SHA1 fe59d3c4f3529fd31bdd277fa667eea4ccacc32e
SHA512 e51b451f4a6f7c919a4dbabf52470a3c448d5b9b1740d9e4cc5051310bcfe30b31d95e7c8766e414a5147f82c74b1b79500a9d48a6c7c80c466dced9e995a830
SSDEEP 12288:0N2etgX0xsm7HrObWMInYLE/BbdJ0zErWolCJ9TeWxqYZfUfP3R:I26gG74W6WBbdJwEqECJ9Te7Yxs3R
TLSH
T188256A1BBFA404A9D8B24E75C5B78321EE357C482320969F43A47229DEFB7D0647A7C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetHostFxr

Path C:\Users\Admin\AppData\Local\Temp\{A54402AE-0A8D-49B3-9A44-509232231BF3}\DotNetHostFxr
Size 1.1MB
SHA256 4edb63c267c96ca5c05f309081b55e3374626e25dddb205cf8b37a42c2438750
MD5 7edeb549573882d34df2df078c7299ce
SHA1 9d889c19de10586f6fb0138030afd519fd40d02c
SHA512 acab3c45b994afbe04d06c58d9d446e1bc10c2bc8e76275a6542f00b86a379cc6fb08dcd1ddb7e51280e5552b823fee64eb7917bf8993b80f82a5a70b14536f0
SSDEEP 24576:f26gG74W6WBbdJwEqECJ9Te7YxkQTbVHmIzOd:f26748BnwEpI9T6YGiVHmI
TLSH
T157357B1BBFA404A9D8A24E75C5B78321EE357C082320969F43A47229DEFB7D0647B7D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetRuntime

Path C:\Users\Admin\AppData\Local\Temp\{A54402AE-0A8D-49B3-9A44-509232231BF3}\DotNetRuntime
Size 28.1MB
SHA256 076b2f180cc513184db1d41b98ef8cab51a9059ad33a0c64919bac0dc9733775
MD5 4b8531ed0b9364894105ee2d0c2001d8
SHA1 6c0b1a0769fefa49f3ff2dd0918ef3f7f7913578
SHA512 8f823ba69293b3b106e550e5d69be29c8227f63b9edb15c1f753b72cb28d9f0fb7d7b5940d9dd7c3da326996f7a2f7e4dc61b2137ced1732755c497dc8d1fd35
SSDEEP 393216:BGA0lAITbkXCfyp4Q/24AJzL1GCn0LA8RVdhtmrBK6q5rONk/1CubJLetP/oj90x:JCAIkXCqOF4y0jbM1K6qV3lJL30VX
TLSH
T182573357BF9548A9C8624E3888BBD725AA7A3C082720964F5758751CCFF73E012BB7C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsDesktopRuntime

Path C:\Users\Admin\AppData\Local\Temp\{A54402AE-0A8D-49B3-9A44-509232231BF3}\WindowsDesktopRuntime
Size 28.8MB
SHA256 4d029b3bef558b3232e33e6e7c54f65feada347b99cac142978643cd7cadb12c
MD5 eb6a43971c26a1d58cf47055357f7300
SHA1 a5ac458efb05ca0166fb5b498b48bc6c42c20dd9
SHA512 fe49a258147dbb13cc37d5764e3af27dd424b0d49d2d353c3010f7d4d07495dd373c9a3fcee14696032fefff823f926b6e99a7d69b89154f36530d30d24783f7
SSDEEP 786432:fTxfdq4WD1EQMyoE5mX8/3LBGxTfb+T5Suf+0zkOPQa:7NyBowmXcgT+oe+1YQ
TLSH
T1086733177F9129A9C8AA4EB1C4778325AE313D44272089AF02A4725DEFFB3E4557B7C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI9541.tmp

Path C:\Windows\Installer\MSI9541.tmp
Size 392KB
SHA256 a28ed81b8594774c7e1e82f9bbe858c3b36f0d7a93067001387a5a872288231a
MD5 f1fafe5c54813a5d7b60d08b859bd58b
SHA1 95e6598ce1c02220d68edab5474980b7f0f0a12c
SHA512 6dbc8b10277c6fae8d7ba961a843810df0bb11c9c6e3ba54eea1b24e13b1069e454ef5d76d345839a32f94871855928578a15948ba242d03c990b21d8f845df9
SSDEEP 6144:u/VbdUw0z9ursTolCJSqJiIUk8AeWNxFqYrtUc06N:u/VbdJ0zErWolCJ9TeWxqYZfN
TLSH
T1CC846A29F7E418EDD4B782B6C5A68030FF75754D332095AF8BA845291F3BAA470BB701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Staging

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_1572426959\Mu\Staging
Size 36B
SHA256 411a706def2e70f96a507208bf80bceb93e950c4c2d671cd1ddb4134ce54b2a9
MD5 0163de1b14421d4eee3757ff76fd81e4
SHA1 96c75c4fe1e3f33a367f45293bd1bd8bff1c06f4
SHA512 80114d59db8f3654dd6821589e5ad03daa923a35610a372756a8865b3e769621e32ef2aed92c2494de2b9fc06d9796b12f1e3bb75873ed794e8c9ae8a0d5e965
MD5 SHA1 SHA512

Submit Download

BootstrapperApplicationData.xml

Path C:\Windows\TEMP\{A54402AE-0A8D-49B3-9A44-509232231BF3}\.ba\BootstrapperApplicationData.xml
Size 9KB
SHA256 5d0f15575f07c77858f4d2862603a0212eeb2bd7c8ec677f24f9b61c40e4e0ae
MD5 4a6fccfbb948643090ee45d55e11b483
SHA1 8cc055b7d7bc7ff5167ab02537eb334d72ba399c
SHA512 11e8d7dacd303c85c89bf4a071cfc10ae0136f03d1ac74bc40b4a7a3f1cd3741025240647ee432d21149bc5f244357e7b6b15ac5b17c70ce4b21631a862a0400
SSDEEP 96:2bpcBM/En6Yic0wZycLn2Vn6sKj0wFycr4qn6URL0wNycLCXn6fMSJw0wpMdycA7:2+z+TzV/zvI4qn2X5a3a1KcITzsCsysz
TLSH
T1C112D3512BFD0218F0F3AE48EFFAA5555A36BD552E39C82D01201D0F49B2E858962FB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetLogo_256x.png

Path C:\Windows\TEMP\{A54402AE-0A8D-49B3-9A44-509232231BF3}\.ba\DotNetLogo_256x.png
Size 2KB
SHA256 0f571f95d8eab48dbc81b0ec5e9f7225e349e26ef50868bfaab556f3c2443b01
MD5 39aa52615723b782c92dec710caaec7f
SHA1 760b49e256a7979fe50a56a2b1be3688a474b886
SHA512 89d1baa3820154667747b25e9e2fd321bfb2ec71dc309915b0a28dacdc80822a4943b639ebb37c37bd2559d5a4306d2096119cd970c84a0d331f6c68b0456dc9
TLSH
T1534195CF1BFD78D7E6E557918E1A8DD232738483B4B3A42CCE7B10B8274A5642B87940
MD5 SHA1 SHA512 TLSH

Submit Download

dotnet.ico

Path C:\Windows\TEMP\{A54402AE-0A8D-49B3-9A44-509232231BF3}\.ba\dotnet.ico
Size 44KB
SHA256 61a2cbd12868cb9b359e0c78961d409b7875f072eb8e53ea88d3e6bfe2961a18
MD5 b8096652d9ec286709a2c863b244b110
SHA1 b3b7f0f4d608fad7cb59ba499d4d17c2b873a7af
SHA512 492a5aa83220bb77c178b7c5b50bf44968c0427e9e45bb97a33df14d7fb4c667ca7adde0ebb3874c7b6011057b01144e4e6651fbad62c6bcf5e0b93586c4bc7a
SSDEEP 96:r+gfbzo+wHK9NbwOY4tIWQeVlV1W9+H+guapUjFamINUItzf1dBNaIZ:ro5HuNcH4tIzeVlV1WEOFDgUWzf1PIm
TLSH
T1E913EF6DE68547C1C10C2032DB4AC792B5233C72E4DAE0C4F9D4FA7E177906965C6E6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\TEMP\{A54402AE-0A8D-49B3-9A44-509232231BF3}\.ba\thm.wxl
Size 7KB
SHA256 b00edd703dd8a475119d0e4dd70a3aaa47f0e95361af290e76d367a8edef3432
MD5 8b2c667a8bbad3153068c0ed90df7ec4
SHA1 c9e04a3a37e5e6262ab9bfecf78280171b8f7b74
SHA512 5269f00d474acccb4c48cb7bcfdf19e63557a388572d3a6335aa39191319691d924e27f70da3f3495387c319396476c63a8fd7b35835cca0901220e39783847b
SSDEEP 96:HiTgM1+XSNEzA0HtYQstYCpCwZQpCeyk5HQJM9ouvj9urz8:Ew9EmtYQstYCPC9e8
TLSH
T191E1026F68DFDEE03A732651B2B3698D6919C29A136F1CF0F869084B47635016377A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.xml

Path C:\Windows\TEMP\{A54402AE-0A8D-49B3-9A44-509232231BF3}\.ba\thm.xml
Size 11KB
SHA256 dfee8e2d075087227f19c835c145c5bb8e72a46880ea24080bb2472fd3a521be
MD5 4329e418dc56b1386d7ea29a0dcfab5b
SHA1 58387f92e89ca21b4179fb697c7de9675c59142f
SHA512 6934873d27e6efbb94da4f13ee8369b29995490051016fdf82800256b924902306d328bf1d4ebbf266d1a53eb24adb6478d1a67de4ecc3e3bcbe561968f24922
SSDEEP 96:HgvPkoeWEH3IWTaQfSJgHzth5mFahbuB8pR5+Vpwe+UIJLg1gEp+6F5pQnxc:AvoWydmQfVHMyyj5Z
TLSH
T14B42FC6851DC7811C532D702AB9371D3FF12BDA6C6C85A58B48E256B1FF262028B739C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wixstdba.exe

Path C:\Windows\Temp\{A54402AE-0A8D-49B3-9A44-509232231BF3}\.ba\wixstdba.exe
Size 431KB
SHA256 2b1cee5e3e24593247854eb7a7c4308937b9c607754ed2fb83520a8706c26f1e
MD5 0e88ffd2e737ac9b9a4241616838bc23
SHA1 3c8beb465d20bcef0cd6ceca9c60286d1d15cebd
SHA512 169b9e08518834c9bc5adfe4ab7b79e07685b72f30ede1c1a386229668bde8c15da378e1274e4013ad7b84d6f7a5acc64ef0806e3b8a66322861efaa7e26b620
SSDEEP 6144:X9vfS1NP+c3ytxmg4Stlqe3B9m2LSLTwGw7C3ZLaov5xZvSdF:X9v+GIyugllqe3wwGfX5/SdF
TLSH
T129943B3165F04037C6F90572AE14FA31BF69F208231095EBA3C0DD293968AE5BBB7657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windowsdesktop-runtime-10.0.9-win-x64.exe

Path C:\Windows\Temp\{A54402AE-0A8D-49B3-9A44-509232231BF3}\.be\windowsdesktop-runtime-10.0.9-win-x64.exe
Size 966KB
SHA256 e2e18ec5b9eba1f7d53f5bbfb68b56d0bb9910abc92d429db538544ac8eb2b10
MD5 b6789f69e59f457288a3c4e37cc5e4ac
SHA1 4c5d5ad73304db60ba0e539f30d0a019621570cb
SHA512 2880a9b5ae09640d444fa888f1b05bba4eece82abbb226e80a0451a38f2892d3d8d525fb63ec38a11159cd1ae51e08c1aca113c84b0afcc5a49f79869c7ed7b2
SSDEEP 12288:SVGWl6qCmyZeU6lqlDjC+fScn6X8GwMgJErEA6Z2E2gh+3+U8FHFJb:SVGWl6qCmyt6UdmcpMzYzkR3+U8/Jb
TLSH
T178256D31A166242BD6F50973F914D2307E2CD7082B5C95BAC6C0D90D39689FA6FFB24B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4940-1315-0x00000165E5350000-0x00000165E5351000-memory.dmp

Download

memory/4940-1312-0x00000165E5350000-0x00000165E5351000-memory.dmp

Download

memory/4940-1307-0x00000165E5350000-0x00000165E5351000-memory.dmp

Download

memory/4940-1311-0x00000165E5350000-0x00000165E5351000-memory.dmp

Download

memory/4940-1314-0x00000165E5350000-0x00000165E5351000-memory.dmp

Download

memory/4940-1313-0x00000165E5350000-0x00000165E5351000-memory.dmp

Download

memory/4940-1316-0x00000165E5350000-0x00000165E5351000-memory.dmp

Download

memory/4940-1305-0x00000165E5350000-0x00000165E5351000-memory.dmp

Download

memory/5348-1041-0x0000000000430000-0x00000000004F6000-memory.dmp

Download