Analysis
- max time kernel
149s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
13/07/2026, 04:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-13_5b0a2233ee9d6dd7eea3996e5782bcc2_elex_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-13_5b0a2233ee9d6dd7eea3996e5782bcc2_elex_stop.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
28 signatures
150 seconds
General
- Target 2026-07-13_5b0a2233ee9d6dd7eea3996e5782bcc2_elex_stop.exe
- Size 5.3MB
- Sample260713-e28z5sdy5x
- SHA256 bd66ee3971ae55af7b35d2a206eaefeaa030242336c1b236d7ab4bd5b5416b3b
- MD5 5b0a2233ee9d6dd7eea3996e5782bcc2
- SHA1 387c6dbc6a2fc2bef0bf33bac0f7b30b39aa669c
- SHA512 bafcf0fe389f68d25436994a43f8045de967425e98ec1bfdd532c4736accbac8babbbc0502cd5ef75d77995837214fef5886498e6439b7573540b1bb0afb0194
- SSDEEP 98304:unA5OLieju67Z38sKnb2N5RKOoiTBDfjpsMGhiqlvqapgz1y:wA50jh38F2N5LoiNfjpsMgiV4gz1
- TLSH T1CF46021379C2C07FE2A219728C2F9DB446B57D234A31491B7994FE2C2EF4582B927F16
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 5 IoCs
pid Process 4424 SearchSettings.exe 1092 SearchSettings64.exe 4600 ApplicationUpdater.exe 1580 SearchSettings.exe 4716 SearchSettings64.exe - Loads dropped DLL 39 IoCs
pid Process 5916 MsiExec.exe 5916 MsiExec.exe 5916 MsiExec.exe 5916 MsiExec.exe 5916 MsiExec.exe 5916 MsiExec.exe 5916 MsiExec.exe 5916 MsiExec.exe 5916 MsiExec.exe 5916 MsiExec.exe 5916 MsiExec.exe 5916 MsiExec.exe 2992 MsiExec.exe 2992 MsiExec.exe 2992 MsiExec.exe 2992 MsiExec.exe 2992 MsiExec.exe 2992 MsiExec.exe 2992 MsiExec.exe 4728 MsiExec.exe 4728 MsiExec.exe 4424 SearchSettings.exe 5148 MSIEXEC.EXE 4728 MsiExec.exe 1092 SearchSettings64.exe 5568 Process not Found 1072 msedge.exe 5284 Process not Found 2992 MsiExec.exe 2992 MsiExec.exe 2992 MsiExec.exe 2992 MsiExec.exe 2992 MsiExec.exe 2992 MsiExec.exe 2992 MsiExec.exe 2992 MsiExec.exe 5916 MsiExec.exe 5916 MsiExec.exe 708 2026-07-13_5b0a2233ee9d6dd7eea3996e5782bcc2_elex_stop.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SearchSettings = "\"C:\\Program Files (x86)\\Common Files\\Spigot\\Search Settings\\SearchSettings.exe\"" msiexec.exe - Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 111 2992 MsiExec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: MSIEXEC.EXE File opened (read-only) \??\K: MSIEXEC.EXE File opened (read-only) \??\N: MSIEXEC.EXE File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\O: MSIEXEC.EXE File opened (read-only) \??\V: MSIEXEC.EXE File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\H: MSIEXEC.EXE File opened (read-only) \??\M: MSIEXEC.EXE File opened (read-only) \??\T: MSIEXEC.EXE File opened (read-only) \??\X: MSIEXEC.EXE File opened (read-only) \??\G: MSIEXEC.EXE File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Q: MSIEXEC.EXE File opened (read-only) \??\U: MSIEXEC.EXE File opened (read-only) \??\W: MSIEXEC.EXE File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\A: MSIEXEC.EXE File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: MSIEXEC.EXE File opened (read-only) \??\D: MSIEXEC.EXE File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\L: MSIEXEC.EXE File opened (read-only) \??\R: MSIEXEC.EXE File opened (read-only) \??\S: MSIEXEC.EXE File opened (read-only) \??\Y: MSIEXEC.EXE File opened (read-only) \??\Z: MSIEXEC.EXE File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\P: MSIEXEC.EXE File opened (read-only) \??\I: MSIEXEC.EXE - Installs/modifies Browser Helper Object 2 TTPs 2 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{0BDA0769-FD72-49F4-9266-E1FB004F4D8F} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0BDA0769-FD72-49F4-9266-E1FB004F4D8F}\ msiexec.exe - Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE ApplicationUpdater.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies ApplicationUpdater.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 ApplicationUpdater.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 ApplicationUpdater.exe - Drops file in Program Files directory 55 IoCs
description ioc Process File created C:\Program Files (x86)\IObit Toolbar\Res\search-button.gif msiexec.exe File created C:\Program Files (x86)\IObit Toolbar\Res\facebook.gif msiexec.exe File created C:\Program Files (x86)\IObit Toolbar\Res\iobit_logo.gif msiexec.exe File created C:\Program Files (x86)\IObit Toolbar\Res\search_baidu.gif msiexec.exe File created C:\Program Files (x86)\IObit Toolbar\Res\twitter.gif msiexec.exe File created C:\Program Files (x86)\Common Files\Spigot\Search Settings\Lang\res1036.ini msiexec.exe File created C:\Program Files (x86)\Common Files\Spigot\Search Settings\baidu_ie.xml msiexec.exe File created C:\Program Files (x86)\Common Files\Spigot\Search Settings\searchcom_ie.xml msiexec.exe File created C:\Program Files (x86)\IObit Toolbar\Res\radio-minimize.gif msiexec.exe File created C:\Program Files (x86)\IObit Toolbar\Res\search-chevron-hover.gif msiexec.exe File created C:\Program Files (x86)\IObit Toolbar\Res\radiobeta.gif msiexec.exe File created C:\Program Files (x86)\Common Files\Spigot\Search Settings\Lang\res1031.ini msiexec.exe File created C:\Program Files (x86)\Common Files\Spigot\Search Settings\Lang\res1034.ini msiexec.exe File created C:\Program Files (x86)\Common Files\Spigot\Search Settings\wth175.dll msiexec.exe File created C:\Program Files (x86)\Common Files\Spigot\Search Settings\yahoo_ie.xml msiexec.exe File created C:\Program Files (x86)\Common Files\Spigot\Search Settings\yandex_ff.xml msiexec.exe File created C:\Program Files (x86)\IObit Toolbar\Res\search-chevron.gif msiexec.exe File created C:\Program Files (x86)\IObit Toolbar\Res\amazon.gif msiexec.exe File created C:\Program Files (x86)\IObit Toolbar\Res\search_amazon.gif msiexec.exe File created C:\Program Files (x86)\IObit Toolbar\Res\search_yandex.gif msiexec.exe File created C:\Program Files (x86)\IObit Toolbar\Res\system.gif msiexec.exe File created C:\Program Files (x86)\IObit Toolbar\Res\widgets.xml msiexec.exe File created C:\Program Files (x86)\IObit Toolbar\WidgiHelper.exe msiexec.exe File created C:\Program Files (x86)\Application Updater\ApplicationUpdater.exe msiexec.exe File created C:\Program Files (x86)\IObit Toolbar\Res\Lang\res1033.ini msiexec.exe File created C:\Program Files (x86)\IObit Toolbar\Res\Lang\res1034.ini msiexec.exe File created C:\Program Files (x86)\IObit Toolbar\IE\8.5\iobitToolbarIE.dll msiexec.exe File opened for modification C:\Program Files (x86)\Common Files\Spigot\Search Settings\yahoo_ie.xml MsiExec.exe File created C:\Program Files (x86)\IObit Toolbar\Res\security.gif msiexec.exe File created C:\Program Files (x86)\Common Files\Spigot\Search Settings\Lang\res1033.ini msiexec.exe File created C:\Program Files (x86)\Common Files\Spigot\Search Settings\searchcom_ff.xml msiexec.exe File opened for modification C:\Program Files (x86)\IObit Toolbar\IE\8.5\config.ini msiexec.exe File created C:\Program Files (x86)\IObit Toolbar\Res\Lang\res1031.ini msiexec.exe File created C:\Program Files (x86)\IObit Toolbar\Res\icon_settings.gif msiexec.exe File created C:\Program Files (x86)\IObit Toolbar\Res\radio-close.gif msiexec.exe File created C:\Program Files (x86)\IObit Toolbar\Res\search-button-hover.gif msiexec.exe File created C:\Program Files (x86)\IObit Toolbar\Res\ebay.gif msiexec.exe File created C:\Program Files (x86)\IObit Toolbar\Res\googleplus.gif msiexec.exe File created C:\Program Files (x86)\IObit Toolbar\Res\Lang\res1040.ini msiexec.exe File created C:\Program Files (x86)\Common Files\Spigot\Search Settings\wthx175.dll msiexec.exe File created C:\Program Files (x86)\IObit Toolbar\Res\iobit_logo_hover.gif msiexec.exe File created C:\Program Files (x86)\IObit Toolbar\Res\search_ebay.gif msiexec.exe File created C:\Program Files (x86)\Common Files\Spigot\Search Settings\SearchSettings.exe msiexec.exe File created C:\Program Files (x86)\Common Files\Spigot\Search Settings\SearchSettings64.exe msiexec.exe File created C:\Program Files (x86)\Common Files\Spigot\Search Settings\yahoo_ff.xml msiexec.exe File created C:\Program Files (x86)\Common Files\Spigot\Search Settings\yandex_ie.xml msiexec.exe File created C:\Program Files (x86)\IObit Toolbar\IE\8.5\iobitToolbarIE64.dll msiexec.exe File opened for modification C:\Program Files (x86)\Application Updater\config.ini msiexec.exe File created C:\Program Files (x86)\Common Files\Spigot\Search Settings\{58d2a791-6199-482f-a9aa-9b725ec61362}.xpi msiexec.exe File created C:\Program Files (x86)\IObit Toolbar\Res\search_yahoo.gif msiexec.exe File created C:\Program Files (x86)\IObit Toolbar\Res\Lang\res1036.ini msiexec.exe File created C:\Program Files (x86)\Common Files\Spigot\Search Settings\Lang\res1040.ini msiexec.exe File created C:\Program Files (x86)\Common Files\Spigot\Search Settings\baidu_ff.xml msiexec.exe File opened for modification C:\Program Files (x86)\Common Files\Spigot\Search Settings\config.ini msiexec.exe File opened for modification C:\Program Files (x86)\Common Files\Spigot\Search Settings\yahoo_ff.xml MsiExec.exe - Drops file in Windows directory 39 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSICDB2.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSICFC7.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSID3F1.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSID49E.tmp msiexec.exe File created C:\Windows\Installer\{76FC33A8-2D83-439B-9C1B-09CDE10A555F}\ARPPRODUCTICON.exe msiexec.exe File opened for modification C:\Windows\Installer\{76FC33A8-2D83-439B-9C1B-09CDE10A555F}\ARPPRODUCTICON.exe msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSID21B.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSID9E0.tmp msiexec.exe File opened for modification C:\Windows\Installer\{76FC33A8-2D83-439B-9C1B-09CDE10A555F}\1033.MST msiexec.exe File opened for modification C:\Windows\Installer\MSIE0B8.tmp msiexec.exe File created C:\Windows\Installer\{76FC33A8-2D83-439B-9C1B-09CDE10A555F}\1033.MST msiexec.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1072_1235707228\manifest.json msedge.exe File opened for modification C:\Windows\Installer\MSID17E.tmp msiexec.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1072_1695562679\manifest.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1072_1695562679\nav_config.json msedge.exe File opened for modification C:\Windows\Installer\MSID79D.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIE280.tmp msiexec.exe File created C:\Windows\Installer\SourceHash{76FC33A8-2D83-439B-9C1B-09CDE10A555F} msiexec.exe File opened for modification C:\Windows\Installer\MSID0E1.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF3972FA4A2298B5B1.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSIE2B0.tmp msiexec.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1072_2143998571\manifest.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1072_2143998571\protocols.json msedge.exe File created C:\Windows\Installer\e5ac824.msi msiexec.exe File opened for modification C:\Windows\Installer\e5ac825.mst msiexec.exe File opened for modification C:\Windows\Installer\MSICCB7.tmp msiexec.exe File created C:\Windows\SystemTemp\~DFE29955301EDED0FD.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSIE098.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIE260.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIE2E0.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF74724606948580B6.TMP msiexec.exe File opened for modification C:\Windows\Installer\e5ac824.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIE174.tmp msiexec.exe File created C:\Windows\SystemTemp\~DFCE6081AB7DD29638.TMP msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\e5ac827.msi msiexec.exe File created C:\Windows\Installer\e5ac825.mst msiexec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SearchSettings.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SearchSettings.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ApplicationUpdater.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-13_5b0a2233ee9d6dd7eea3996e5782bcc2_elex_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSIEXEC.EXE - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 3952 msedge.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000031a81fc62ba3bf350000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c012000000000000000000000000270101000088380131a81fc60000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e8410131a81fc6000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e331a81fc600000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e631a81fc600000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\URLSearchHooks msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Toolbar msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{0BDA0769-FD72-49F4-9266-E1FB004F4D8F} = "IObit Toolbar" MsiExec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\URLSearchHooks\{0BDA0769-FD72-49F4-9266-E1FB004F4D8F} MsiExec.exe Key created \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Approved Extensions MsiExec.exe Set value (data) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Approved Extensions\{0BDA0769-FD72-49F4-9266-E1FB004F4D8F} = 51667a6c4c1d3b1b791acf1b42ad98068d6ea6bb03080992 MsiExec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\URLSearchHooks\{0BDA0769-FD72-49F4-9266-E1FB004F4D8F} SearchSettings.exe Set value (str) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\URLSearchHooks\{0BDA0769-FD72-49F4-9266-E1FB004F4D8F} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Toolbar\{0BDA0769-FD72-49F4-9266-E1FB004F4D8F} = "IObit Toolbar" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar MsiExec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\URLSearchHooks\{CFBFAE00-17A6-11D0-99CB-00C04FD64497} MsiExec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\URLSearchHooks\{CFBFAE00-17A6-11D0-99CB-00C04FD64497} SearchSettings.exe - Modifies data under HKEY_USERS 22 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\urlmon.dll,-4200 = "Open File - Security Warning" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry msedge.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\TelemetrySalt = "0" MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" ApplicationUpdater.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" ApplicationUpdater.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134283904730526786" msedge.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" MsiExec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix ApplicationUpdater.exe Key created \REGISTRY\USER\.DEFAULT\Software MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" MsiExec.exe - Modifies registry class 48 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0BDA0769-FD72-49F4-9266-E1FB004F4D8F}\Implemented Categories\{59fb2056-d625-48d0-a944-1a85b5ab2640} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8A33CF6738D2B934C9B190DC1EA055F5\ToolbarFF = "\x06" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A33CF6738D2B934C9B190DC1EA055F5\ProductName = "IObit Toolbar v8.5" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A33CF6738D2B934C9B190DC1EA055F5\PackageCode = "CF968342DDB1DDF488793C135EB7739E" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A33CF6738D2B934C9B190DC1EA055F5\SourceList\PackageName = "iobitToolbar.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A33CF6738D2B934C9B190DC1EA055F5\SourceList\Media\DiskPrompt = "[1]" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID MsiExec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A33CF6738D2B934C9B190DC1EA055F5\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{063BEAF7-D865-4E4B-B4AE-0155657A8500} msedge.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0BDA0769-FD72-49F4-9266-E1FB004F4D8F}\Implemented Categories msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0BDA0769-FD72-49F4-9266-E1FB004F4D8F}\Implemented Categories\{59fb2056-d625-48d0-a944-1a85b5ab2640}\ msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A33CF6738D2B934C9B190DC1EA055F5 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A33CF6738D2B934C9B190DC1EA055F5\AdvertiseFlags = "388" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A33CF6738D2B934C9B190DC1EA055F5\InstanceType = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0BDA0769-FD72-49F4-9266-E1FB004F4D8F}\InprocServer32\ = "C:\\Program Files (x86)\\IObit Toolbar\\IE\\8.5\\iobitToolbarIE.dll" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A33CF6738D2B934C9B190DC1EA055F5\Language = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\9575F99D17E59BB478A1A7190DB33813 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0BDA0769-FD72-49F4-9266-E1FB004F4D8F} MsiExec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{0BDA0769-FD72-49F4-9266-E1FB004F4D8F}\InprocServer32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0BDA0769-FD72-49F4-9266-E1FB004F4D8F}\InprocServer32\ThreadingModel = "Apartment" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A33CF6738D2B934C9B190DC1EA055F5\Version = "134545408" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\9575F99D17E59BB478A1A7190DB33813\8A33CF6738D2B934C9B190DC1EA055F5 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A33CF6738D2B934C9B190DC1EA055F5\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A33CF6738D2B934C9B190DC1EA055F5\SourceList\Net msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0BDA0769-FD72-49F4-9266-E1FB004F4D8F}\InprocServer32 MsiExec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{0BDA0769-FD72-49F4-9266-E1FB004F4D8F} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0BDA0769-FD72-49F4-9266-E1FB004F4D8F}\ = "IObit Toolbar" MsiExec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{0BDA0769-FD72-49F4-9266-E1FB004F4D8F}\Implemented Categories\{59fb2056-d625-48d0-a944-1a85b5ab2640} msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8A33CF6738D2B934C9B190DC1EA055F5 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8A33CF6738D2B934C9B190DC1EA055F5\Core msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A33CF6738D2B934C9B190DC1EA055F5\ProductIcon = "C:\\Windows\\Installer\\{76FC33A8-2D83-439B-9C1B-09CDE10A555F}\\ARPPRODUCTICON.exe" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A33CF6738D2B934C9B190DC1EA055F5\DeploymentFlags = "3" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A33CF6738D2B934C9B190DC1EA055F5\Clients = 3a0000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0BDA0769-FD72-49F4-9266-E1FB004F4D8F}\Implemented Categories\{59fb2056-d625-48d0-a944-1a85b5ab2640} MsiExec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A33CF6738D2B934C9B190DC1EA055F5\Assignment = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0BDA0769-FD72-49F4-9266-E1FB004F4D8F}\ = "IObit Toolbar" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0BDA0769-FD72-49F4-9266-E1FB004F4D8F} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8A33CF6738D2B934C9B190DC1EA055F5\ToolbarIE msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A33CF6738D2B934C9B190DC1EA055F5\Transforms = "C:\\Windows\\Installer\\{76FC33A8-2D83-439B-9C1B-09CDE10A555F}\\1033.MST" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A33CF6738D2B934C9B190DC1EA055F5\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A33CF6738D2B934C9B190DC1EA055F5\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\{015CC3CD-415F-48EC-883D-94C5228AA937}\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A33CF6738D2B934C9B190DC1EA055F5\SourceList\Media\1 = "DISK1;1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A33CF6738D2B934C9B190DC1EA055F5\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\{015CC3CD-415F-48EC-883D-94C5228AA937}\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0BDA0769-FD72-49F4-9266-E1FB004F4D8F}\InprocServer32\ = "C:\\Program Files (x86)\\IObit Toolbar\\IE\\8.5\\iobitToolbarIE64.dll" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0BDA0769-FD72-49F4-9266-E1FB004F4D8F}\InprocServer32\ThreadingModel = "Apartment" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0BDA0769-FD72-49F4-9266-E1FB004F4D8F}\Implemented Categories MsiExec.exe - Suspicious behavior: EnumeratesProcesses 50 IoCs
pid Process 5916 MsiExec.exe 5916 MsiExec.exe 2992 MsiExec.exe 2992 MsiExec.exe 2992 MsiExec.exe 2992 MsiExec.exe 2992 MsiExec.exe 2992 MsiExec.exe 2992 MsiExec.exe 2992 MsiExec.exe 4600 ApplicationUpdater.exe 4600 ApplicationUpdater.exe 4600 ApplicationUpdater.exe 4600 ApplicationUpdater.exe 4600 ApplicationUpdater.exe 4600 ApplicationUpdater.exe 4600 ApplicationUpdater.exe 4600 ApplicationUpdater.exe 4600 ApplicationUpdater.exe 4600 ApplicationUpdater.exe 4600 ApplicationUpdater.exe 4600 ApplicationUpdater.exe 2992 MsiExec.exe 2992 MsiExec.exe 2992 MsiExec.exe 2992 MsiExec.exe 2992 MsiExec.exe 2992 MsiExec.exe 2992 MsiExec.exe 2992 MsiExec.exe 4424 SearchSettings.exe 4424 SearchSettings.exe 4424 SearchSettings.exe 4424 SearchSettings.exe 4424 SearchSettings.exe 4424 SearchSettings.exe 4424 SearchSettings.exe 4424 SearchSettings.exe 4424 SearchSettings.exe 4424 SearchSettings.exe 4424 SearchSettings.exe 4424 SearchSettings.exe 4424 SearchSettings.exe 4424 SearchSettings.exe 4424 SearchSettings.exe 4424 SearchSettings.exe 4424 SearchSettings.exe 4424 SearchSettings.exe 3816 msedge.exe 3816 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs
pid Process 1072 msedge.exe 1072 msedge.exe 1072 msedge.exe 1072 msedge.exe 1072 msedge.exe 1072 msedge.exe 1072 msedge.exe 1072 msedge.exe 1072 msedge.exe 1072 msedge.exe 1072 msedge.exe 1072 msedge.exe 1072 msedge.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 5148 MSIEXEC.EXE Token: SeIncreaseQuotaPrivilege 5148 MSIEXEC.EXE Token: SeSecurityPrivilege 4512 msiexec.exe Token: SeCreateTokenPrivilege 5148 MSIEXEC.EXE Token: SeAssignPrimaryTokenPrivilege 5148 MSIEXEC.EXE Token: SeLockMemoryPrivilege 5148 MSIEXEC.EXE Token: SeIncreaseQuotaPrivilege 5148 MSIEXEC.EXE Token: SeMachineAccountPrivilege 5148 MSIEXEC.EXE Token: SeTcbPrivilege 5148 MSIEXEC.EXE Token: SeSecurityPrivilege 5148 MSIEXEC.EXE Token: SeTakeOwnershipPrivilege 5148 MSIEXEC.EXE Token: SeLoadDriverPrivilege 5148 MSIEXEC.EXE Token: SeSystemProfilePrivilege 5148 MSIEXEC.EXE Token: SeSystemtimePrivilege 5148 MSIEXEC.EXE Token: SeProfSingleProcessPrivilege 5148 MSIEXEC.EXE Token: SeIncBasePriorityPrivilege 5148 MSIEXEC.EXE Token: SeCreatePagefilePrivilege 5148 MSIEXEC.EXE Token: SeCreatePermanentPrivilege 5148 MSIEXEC.EXE Token: SeBackupPrivilege 5148 MSIEXEC.EXE Token: SeRestorePrivilege 5148 MSIEXEC.EXE Token: SeShutdownPrivilege 5148 MSIEXEC.EXE Token: SeDebugPrivilege 5148 MSIEXEC.EXE Token: SeAuditPrivilege 5148 MSIEXEC.EXE Token: SeSystemEnvironmentPrivilege 5148 MSIEXEC.EXE Token: SeChangeNotifyPrivilege 5148 MSIEXEC.EXE Token: SeRemoteShutdownPrivilege 5148 MSIEXEC.EXE Token: SeUndockPrivilege 5148 MSIEXEC.EXE Token: SeSyncAgentPrivilege 5148 MSIEXEC.EXE Token: SeEnableDelegationPrivilege 5148 MSIEXEC.EXE Token: SeManageVolumePrivilege 5148 MSIEXEC.EXE Token: SeImpersonatePrivilege 5148 MSIEXEC.EXE Token: SeCreateGlobalPrivilege 5148 MSIEXEC.EXE Token: SeCreateTokenPrivilege 5148 MSIEXEC.EXE Token: SeAssignPrimaryTokenPrivilege 5148 MSIEXEC.EXE Token: SeLockMemoryPrivilege 5148 MSIEXEC.EXE Token: SeIncreaseQuotaPrivilege 5148 MSIEXEC.EXE Token: SeMachineAccountPrivilege 5148 MSIEXEC.EXE Token: SeTcbPrivilege 5148 MSIEXEC.EXE Token: SeSecurityPrivilege 5148 MSIEXEC.EXE Token: SeTakeOwnershipPrivilege 5148 MSIEXEC.EXE Token: SeLoadDriverPrivilege 5148 MSIEXEC.EXE Token: SeSystemProfilePrivilege 5148 MSIEXEC.EXE Token: SeSystemtimePrivilege 5148 MSIEXEC.EXE Token: SeProfSingleProcessPrivilege 5148 MSIEXEC.EXE Token: SeIncBasePriorityPrivilege 5148 MSIEXEC.EXE Token: SeCreatePagefilePrivilege 5148 MSIEXEC.EXE Token: SeCreatePermanentPrivilege 5148 MSIEXEC.EXE Token: SeBackupPrivilege 5148 MSIEXEC.EXE Token: SeRestorePrivilege 5148 MSIEXEC.EXE Token: SeShutdownPrivilege 5148 MSIEXEC.EXE Token: SeDebugPrivilege 5148 MSIEXEC.EXE Token: SeAuditPrivilege 5148 MSIEXEC.EXE Token: SeSystemEnvironmentPrivilege 5148 MSIEXEC.EXE Token: SeChangeNotifyPrivilege 5148 MSIEXEC.EXE Token: SeRemoteShutdownPrivilege 5148 MSIEXEC.EXE Token: SeUndockPrivilege 5148 MSIEXEC.EXE Token: SeSyncAgentPrivilege 5148 MSIEXEC.EXE Token: SeEnableDelegationPrivilege 5148 MSIEXEC.EXE Token: SeManageVolumePrivilege 5148 MSIEXEC.EXE Token: SeImpersonatePrivilege 5148 MSIEXEC.EXE Token: SeCreateGlobalPrivilege 5148 MSIEXEC.EXE Token: SeCreateTokenPrivilege 5148 MSIEXEC.EXE Token: SeAssignPrimaryTokenPrivilege 5148 MSIEXEC.EXE Token: SeLockMemoryPrivilege 5148 MSIEXEC.EXE - Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 5148 MSIEXEC.EXE 1072 msedge.exe 5148 MSIEXEC.EXE 4424 SearchSettings.exe - Suspicious use of SendNotifyMessage 1 IoCs
pid Process 4424 SearchSettings.exe - Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 5148 MSIEXEC.EXE 4512 msiexec.exe 5916 MsiExec.exe 2992 MsiExec.exe 4728 MsiExec.exe 4424 SearchSettings.exe 1092 SearchSettings64.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 708 wrote to memory of 5148 708 2026-07-13_5b0a2233ee9d6dd7eea3996e5782bcc2_elex_stop.exe 87 PID 4512 wrote to memory of 5916 4512 msiexec.exe 89 PID 5916 wrote to memory of 1072 5916 MsiExec.exe 90 PID 1072 wrote to memory of 5904 1072 msedge.exe 91 PID 1072 wrote to memory of 2152 1072 msedge.exe 92 PID 1072 wrote to memory of 3952 1072 msedge.exe 94 PID 1072 wrote to memory of 2152 1072 msedge.exe 92 PID 1072 wrote to memory of 2152 1072 msedge.exe 92 PID 1072 wrote to memory of 4348 1072 msedge.exe 95 PID 1072 wrote to memory of 4348 1072 msedge.exe 95 PID 1072 wrote to memory of 2136 1072 msedge.exe 96 PID 1072 wrote to memory of 6056 1072 msedge.exe 97 PID 1072 wrote to memory of 2136 1072 msedge.exe 96 PID 1072 wrote to memory of 2136 1072 msedge.exe 96 PID 1072 wrote to memory of 6056 1072 msedge.exe 97 PID 1072 wrote to memory of 6056 1072 msedge.exe 97 PID 1072 wrote to memory of 2072 1072 msedge.exe 98 PID 1072 wrote to memory of 2072 1072 msedge.exe 98 PID 1072 wrote to memory of 2072 1072 msedge.exe 98 PID 1072 wrote to memory of 2440 1072 msedge.exe 99 PID 1072 wrote to memory of 2440 1072 msedge.exe 99 PID 1072 wrote to memory of 2440 1072 msedge.exe 99 PID 1072 wrote to memory of 4292 1072 msedge.exe 100 PID 1072 wrote to memory of 4292 1072 msedge.exe 100 PID 1072 wrote to memory of 4700 1072 msedge.exe 102 PID 1072 wrote to memory of 6012 1072 msedge.exe 103 PID 1072 wrote to memory of 4700 1072 msedge.exe 102 PID 1072 wrote to memory of 6012 1072 msedge.exe 103 PID 1072 wrote to memory of 4820 1072 msedge.exe 105 PID 1072 wrote to memory of 3640 1072 msedge.exe 106 PID 1072 wrote to memory of 3640 1072 msedge.exe 106 PID 1072 wrote to memory of 2876 1072 msedge.exe 108 PID 1072 wrote to memory of 2876 1072 msedge.exe 108 PID 5916 wrote to memory of 4196 5916 MsiExec.exe 111 PID 1072 wrote to memory of 5864 1072 msedge.exe 112 PID 1072 wrote to memory of 5864 1072 msedge.exe 112 PID 1072 wrote to memory of 5864 1072 msedge.exe 112 PID 5916 wrote to memory of 2764 5916 MsiExec.exe 114 PID 1072 wrote to memory of 760 1072 msedge.exe 115 PID 1072 wrote to memory of 760 1072 msedge.exe 115 PID 1072 wrote to memory of 760 1072 msedge.exe 115 PID 5916 wrote to memory of 3640 5916 MsiExec.exe 116 PID 1072 wrote to memory of 4640 1072 msedge.exe 117 PID 1072 wrote to memory of 4640 1072 msedge.exe 117 PID 1072 wrote to memory of 4640 1072 msedge.exe 117 PID 5916 wrote to memory of 2056 5916 MsiExec.exe 118 PID 1072 wrote to memory of 596 1072 msedge.exe 119 PID 1072 wrote to memory of 596 1072 msedge.exe 119 PID 1072 wrote to memory of 596 1072 msedge.exe 119 PID 1072 wrote to memory of 5548 1072 msedge.exe 120 PID 1072 wrote to memory of 3312 1072 msedge.exe 121 PID 1072 wrote to memory of 464 1072 msedge.exe 122 PID 5916 wrote to memory of 2536 5916 MsiExec.exe 123 PID 1072 wrote to memory of 2788 1072 msedge.exe 124 PID 1072 wrote to memory of 2788 1072 msedge.exe 124 PID 1072 wrote to memory of 2788 1072 msedge.exe 124 PID 5916 wrote to memory of 5524 5916 MsiExec.exe 125 PID 1072 wrote to memory of 2668 1072 msedge.exe 126 PID 1072 wrote to memory of 2668 1072 msedge.exe 126 PID 1072 wrote to memory of 2668 1072 msedge.exe 126 PID 5916 wrote to memory of 1580 5916 MsiExec.exe 127 PID 1072 wrote to memory of 1948 1072 msedge.exe 128 PID 1072 wrote to memory of 1948 1072 msedge.exe 128 PID 1072 wrote to memory of 1948 1072 msedge.exe 128 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-13_5b0a2233ee9d6dd7eea3996e5782bcc2_elex_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-13_5b0a2233ee9d6dd7eea3996e5782bcc2_elex_stop.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:708 -
C:\Windows\SysWOW64\MSIEXEC.EXEMSIEXEC.EXE /i "C:\Users\Admin\AppData\Local\Temp\{015CC3CD-415F-48EC-883D-94C5228AA937}\iobitToolbar.msi" TRANSFORMS="C:\Users\Admin\AppData\Local\Temp\{015CC3CD-415F-48EC-883D-94C5228AA937}\1033.MST" SETUPEXEDIR="C:\Users\Admin\AppData\Local\Temp" SETUPEXENAME="2026-07-13_5b0a2233ee9d6dd7eea3996e5782bcc2_elex_stop.exe"2⤵
- Loads dropped DLL
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:5148
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Adds Run key to start application
- Enumerates connected drives
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding BD81139D6F0624B0F407F772027A0893 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5916 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://iobit.mybrowserbar.com/privacy.html3⤵
- Loads dropped DLL
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffd60f3c188,0x7ffd60f3c194,0x7ffd60f3c1a04⤵PID:5904
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1696,i,9397563454511018017,3084546841026360161,262144 --field-trial-handle=2312,i,2364559870360169951,5021601565214425601,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:24⤵PID:2152
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1916,i,6089574861499701736,1441691428839342425,524288 --field-trial-handle=2312,i,2364559870360169951,5021601565214425601,262144 --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:114⤵
- System Time Discovery
PID:3952
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2488,i,7061776801411990381,11720068441455947730,524288 --field-trial-handle=2312,i,2364559870360169951,5021601565214425601,262144 --variations-seed-version --mojo-platform-channel-handle=3356 /prefetch:134⤵PID:4348
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3608,i,15104350573835868393,909823505339755909,2097152 --field-trial-handle=2312,i,2364559870360169951,5021601565214425601,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:14⤵PID:2136
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3612,i,7487159145314206835,8178981403944871712,2097152 --field-trial-handle=2312,i,2364559870360169951,5021601565214425601,262144 --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:14⤵PID:6056
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4244,i,13727436739202568319,14831792335172565045,2097152 --field-trial-handle=2312,i,2364559870360169951,5021601565214425601,262144 --variations-seed-version --mojo-platform-channel-handle=4424 /prefetch:14⤵PID:2072
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4260,i,12363046314909862567,16752070572360397211,2097152 --field-trial-handle=2312,i,2364559870360169951,5021601565214425601,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:94⤵PID:2440
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5244,i,15962079473447793791,1601708101753673634,524288 --field-trial-handle=2312,i,2364559870360169951,5021601565214425601,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:144⤵PID:4292
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5292,i,13261524668344246140,11336423826704262297,524288 --field-trial-handle=2312,i,2364559870360169951,5021601565214425601,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:144⤵PID:4700
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5280,i,5505710228759734361,4953053559466304434,524288 --field-trial-handle=2312,i,2364559870360169951,5021601565214425601,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:144⤵PID:6012
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6056,i,17088852987384888767,658310760773317488,524288 --field-trial-handle=2312,i,2364559870360169951,5021601565214425601,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:144⤵PID:5344
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6056,i,17088852987384888767,658310760773317488,524288 --field-trial-handle=2312,i,2364559870360169951,5021601565214425601,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:144⤵PID:4820
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6252,i,10674272496428846284,17940315778508743220,524288 --field-trial-handle=2312,i,2364559870360169951,5021601565214425601,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:144⤵PID:3640
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6352,i,14247583763365742322,9381422745163179175,524288 --field-trial-handle=2312,i,2364559870360169951,5021601565214425601,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:144⤵PID:2876
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6588,i,3222140612709695236,9304871359081684445,2097152 --field-trial-handle=2312,i,2364559870360169951,5021601565214425601,262144 --variations-seed-version --mojo-platform-channel-handle=6664 /prefetch:14⤵PID:5864
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6864,i,16303640106067194475,935077597929209776,2097152 --field-trial-handle=2312,i,2364559870360169951,5021601565214425601,262144 --variations-seed-version --mojo-platform-channel-handle=6844 /prefetch:14⤵PID:760
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=4460,i,17117235515424181902,7069185892280584152,2097152 --field-trial-handle=2312,i,2364559870360169951,5021601565214425601,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:14⤵PID:4640
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6964,i,8405136624968358968,17614510698794192423,2097152 --field-trial-handle=2312,i,2364559870360169951,5021601565214425601,262144 --variations-seed-version --mojo-platform-channel-handle=7020 /prefetch:14⤵PID:596
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7036,i,5655737284076437850,18065448308579931427,524288 --field-trial-handle=2312,i,2364559870360169951,5021601565214425601,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:144⤵PID:5548
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6908,i,7255812838739283749,7171124682984507187,524288 --field-trial-handle=2312,i,2364559870360169951,5021601565214425601,262144 --variations-seed-version --mojo-platform-channel-handle=6628 /prefetch:144⤵PID:3312
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6136,i,15103764580418327231,8220140090415689312,524288 --field-trial-handle=2312,i,2364559870360169951,5021601565214425601,262144 --variations-seed-version --mojo-platform-channel-handle=6524 /prefetch:144⤵PID:464
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7072,i,4489980048008928737,6989419893486881179,2097152 --field-trial-handle=2312,i,2364559870360169951,5021601565214425601,262144 --variations-seed-version --mojo-platform-channel-handle=7140 /prefetch:14⤵PID:2788
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=5376,i,18166229007317686770,17070097049232782163,2097152 --field-trial-handle=2312,i,2364559870360169951,5021601565214425601,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:14⤵PID:2668
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=2808,i,3280125126690571184,1528606685041978634,2097152 --field-trial-handle=2312,i,2364559870360169951,5021601565214425601,262144 --variations-seed-version --mojo-platform-channel-handle=7144 /prefetch:14⤵PID:1948
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7324,i,17232973842915099637,11096352171313584624,524288 --field-trial-handle=2312,i,2364559870360169951,5021601565214425601,262144 --variations-seed-version --mojo-platform-channel-handle=7328 /prefetch:144⤵PID:3188
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7660,i,4593169024202189535,14575478600906578719,2097152 --field-trial-handle=2312,i,2364559870360169951,5021601565214425601,262144 --variations-seed-version --mojo-platform-channel-handle=7676 /prefetch:14⤵PID:5412
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7216,i,10530129056074485628,1522764430014996404,524288 --field-trial-handle=2312,i,2364559870360169951,5021601565214425601,262144 --variations-seed-version --mojo-platform-channel-handle=7844 /prefetch:144⤵PID:1580
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7704,i,18231415793429653280,12018888239502184390,524288 --field-trial-handle=2312,i,2364559870360169951,5021601565214425601,262144 --variations-seed-version --mojo-platform-channel-handle=7936 /prefetch:144⤵PID:3400
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=8028,i,18213956482775820350,5926217978683914999,262144 --field-trial-handle=2312,i,2364559870360169951,5021601565214425601,262144 --variations-seed-version --mojo-platform-channel-handle=7864 /prefetch:104⤵
- Suspicious behavior: EnumeratesProcesses
PID:3816
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7936,i,9416918287277660320,4467698288126937267,524288 --field-trial-handle=2312,i,2364559870360169951,5021601565214425601,262144 --variations-seed-version --mojo-platform-channel-handle=8028 /prefetch:144⤵PID:2600
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://iobit.mybrowserbar.com/privacy.html3⤵PID:4196
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://iobit.mybrowserbar.com/privacy.html3⤵PID:2764
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://iobit.mybrowserbar.com/privacy.html3⤵PID:3640
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://iobit.mybrowserbar.com/privacy.html3⤵PID:2056
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://iobit.mybrowserbar.com/privacy.html3⤵PID:2536
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://iobit.mybrowserbar.com/privacy.html3⤵PID:5524
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://iobit.mybrowserbar.com/privacy.html3⤵PID:1580
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://iobit.mybrowserbar.com/install.html?cnid=642886&isn=645B809038844C7283BA595EBE262C57&code_ver=175&type=install&cid=e4421adc53e94e938b95efe6b5d60f4e3⤵PID:3372
-
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:3424
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 7282BA560F7CF76C59C698EE432251CF2⤵
- Loads dropped DLL
- Badlisted process makes network request
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2992
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding CB3991220833DA098B92BC9D81F5124B E Global\MSI00002⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4728
-
-
C:\Program Files (x86)\Common Files\Spigot\Search Settings\SearchSettings.exe"C:\Program Files (x86)\Common Files\Spigot\Search Settings\SearchSettings.exe" DFROMKIT2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1580
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵PID:3868
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:4140
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵PID:4128
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:1760
-
C:\Program Files (x86)\Common Files\Spigot\Search Settings\SearchSettings.exe"C:\Program Files (x86)\Common Files\Spigot\Search Settings\SearchSettings.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4424 -
C:\Program Files (x86)\Common Files\Spigot\Search Settings\SearchSettings64.exe"C:\Program Files (x86)\Common Files\Spigot\Search Settings\SearchSettings64.exe" HOOK -Dwthx175.dll -IE"DefaultScope" -GC"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data" -FF"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cxykicyu.Admin\Prefs.js"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1092
-
-
C:\Program Files (x86)\Common Files\Spigot\Search Settings\SearchSettings64.exe"C:\Program Files (x86)\Common Files\Spigot\Search Settings\SearchSettings64.exe" UNHOOK wthx175.dll2⤵
- Executes dropped EXE
PID:4716
-
-
C:\Program Files (x86)\Application Updater\ApplicationUpdater.exe"C:\Program Files (x86)\Application Updater\ApplicationUpdater.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:4600
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Browser Extensions
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e5ac826.rbs
- Size 1.7MB
- SHA256 cfe06ee20d312d0fe212676fa1b766479a4fb40a070620e800ca65dc2d594485
- MD5 98063c5749ffa27590402254ebe0d2bc
- SHA1 710393d11dfd6c8b0b777e8fa3927fcc2d77b967
- SHA512 1f11ba94795ccff287a979a866a9451bb362c64a28e15562297856b7471355dc54a31ec0ec868a6ec6dbda59e3ded7b0b1dcb7ae3af5de7d5ec98e34f077414d
- SSDEEP 49152:lbSYThO5H2rfFTnwCPl0XxCbSYThO5H2rfFTnwCPl0XxvV1ZU7:lbSYThO5W9nwCPl08bSYThO5W9nwCPlp
- TLSH T16A85CF12B3D1C03AF16F1270AA2A6B7A5ABAFD305930C94B67D49A5D4F706C1DA3D703
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 e413e02b9e80ee8d76d52c1043fc32251e2d7634d4b2fbd970df9ace9d91831a
- MD5 22959b3a06a842ac30237dd57e8a3801
- SHA1 0b7c28071a592034aa2607038000f085c7bb6362
- SHA512 644add9ab912ad7fdfc55bc7a1b84482c75cc9bc69a59d169bae63a0400619d999846ebbadb0ef2bd6d35c2bd08a5f07053b600874dd5dfcbda7e8f3076131fe
- TLSH T1A5D02BE476408A0CC980203335F6524092018910D801D1480040B325CC845C1257F0DF
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 8aaa68aad07ba45abe53bd513aa5f7e7b21bd1b29db6e1d5c1e0a79a5f4eb890
- MD5 74012bbce5fada7634c1da1b567562b3
- SHA1 09db27f38f27e35986cfd407b57f6f83c8fc59f8
- SHA512 c1a6a98f972793c84274c29552107bfe07b775c7c8121e5fdf137ebf9a7cc3f4eb43fe9eadfc842e7b92ca7281bbcea3d660bdd8fc9adc56add068510c41e48d
- TLSH T1FBD02BE07640890CC980203335F75240920189108401D1480040F335CC845C1257E0CF
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006b
- Size 20KB
- SHA256 57e12433622a0f043d950bc766a5bc423008d0468cab6497f3ead4e55df7c1c7
- MD5 8bd8220ca4c1c9bf2756086b9cdd2737
- SHA1 c4b09065bdb49f26cb911e6c724d49cdaa771b6d
- SHA512 16c22bb9f89d11df3db453ab71365fd27de31ffe97b1159b5ba940932773b0c4fd02903d9ed55cb1f05eb88ede1b3561ee555e90a0a592abda4f826ebe5eb691
- SSDEEP 384:BoikZS4VhesCQMQABVDUA+6SxKg8Z848u3eI2Vci2jRYxqEafv:dGcsCQMQCVDUA+VxKg8Zv8VGi6GPan
- TLSH T11E92E17988A32D89689D4E44A3FF6B5A5E09C94B1D2F05FE59181CC863D4E8BFC2C45C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006c
- Size 149KB
- SHA256 ca3e348a3cf729360a0e40fbcc3b0fb549d546998fb9c7b355d6064159836cd9
- MD5 635b5fde27c3c7ef234e1037a1c61827
- SHA1 f4cae89dd6134f0fb34662498ab1c9f37ee01183
- SHA512 426b40455c7c9820e2b96a1d1f48aa16c73ceb9cfb3da4805b916039aff3d74e7235563ec42a124497c5ca1283d55e25cd923fab0c2773b32f196488e5c9ce55
- SSDEEP 3072:RhPMO7H+A4biytF5gChzObJBo6rZ+nbX2W+AN6tMfKjbZVAZl:Rp17H/4+4HgChzOkWZ+N+ANCwKpVc
- TLSH T1A4E31222D1C293261222F3957D64FDA70C9EE8FE6E34374EBB54CB0512D25D383E5968
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\0372e0b79a5c74cc_0
- Size 88KB
- SHA256 67fba748985e8c9cb2d6f3a248759b4f29be87cc9117f2a6c0a2d4b01ebf4309
- MD5 26b3c125eaf23123ed0d167cb0b63f26
- SHA1 1119371037554111bc4a6e7f1e7aead9b41fb3de
- SHA512 89cd295d7c0e348d55dffea9d8c37e92089f03c38a0cbefbb70fd48906753d3eba1e10e97a7857a26a31638b4a092359516511e7291f960257194da0b8da5c0f
- SSDEEP 1536:g8yu71UQ/L0iSgZL9kMWZVB+c53YuALo/pOGLHy51+DTXCSS:g819jGgUdZVB+tD8ROGLSVSS
- TLSH T16893F814AB51B87ACF2A43BA91768817723502CC3FD7D20617E8B2352C653E75E8ED4B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\55cac0ddd33b27d0_0
- Size 278B
- SHA256 9187563bff00fe627543ba55a3b310920940e05a5ccc6af486d8f93d73c7ec4b
- MD5 8c6710dba515bb7428569b56b439d70a
- SHA1 f6118a373e0b6d369e89cc29925017a82531717c
- SHA512 1b09dff518c98fabc891268ef58b59953c4963f9300849885283f8444fcd06c1d96322e970eedea653f820bea4ec9bfdf771396e3789e7f1d7fee2438cb0b671
- TLSH T180D0955F1F6DF40FC71CC171E3B5658787E70042007D6050E78A4E1703041F6C9045D5
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a8063f4f5055b1b0_0
- Size 255B
- SHA256 c0d13e7ffd01f3c2003b42644a84818539eb7d23c5ddfba6e962bd8dd013e4c2
- MD5 c644b18424510d012859d56f4cc37f65
- SHA1 46f531a81b4299ce709084492bde9b917a4a200c
- SHA512 efa5cfd14fb141c275a58d583f60d1e2d6a0e97e134ca54a2bb0bd20d3cc333d3d094c5466b4ad0e84baca098bc7f2a45937211381d559e5b0a87c435cdcc3cf
- TLSH T12DD097C33A10A814CC0FDBB2E3E8260087B68F8016DCA7F1040637721321CA35CC0397
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a9657dc5c83b5e58_0
- Size 649KB
- SHA256 12b8275622a6b34026301eaa74304d5190c9303d2d35b5310da849ea03772f6d
- MD5 55559d2f7679b7944ecee05857c08b79
- SHA1 7c07c3da71c73fce1e7538ca677957ddecc90b84
- SHA512 830823221c0e3aabc8dc24e9f51fe160b10751d0da442473e413e75a1e6f5e16468e0613073ee85ec51ca7ad33e592bb6fa2240767681d7a253893f8b49e75b9
- SSDEEP 12288:Gxuq64nqea7ZW3wveN30rMcUk7pE3rb2qJ2WihTo0vY:GOeE30i/vY
- TLSH T197E4A504DB947F76CBB247B542D3C9277236414D2E93920362A0BF292C1D2E66E9BD4F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 3KB
- SHA256 9a28a28636db6fea35f22df5dc995b6cc2adaa2e0c3e75df7e37542622e2f7dd
- MD5 b77c3e0edc818b6f1d29d68ce36e1120
- SHA1 02d0a38b45cb6b73bd3fc91d3f8b01c8bf19e1e7
- SHA512 f9c962d890170233a8f555c1bab65ba41d6f6a966961fc900108526031f9377315dca705adf140b6d95c77c43a1261096a889cd18d8abc25413a255c614b5b0d
- TLSH T19B61947553B64DD2DB69AA3AF0E9742B33F6806A430B3E00E2852F744C46FB49BE1113
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 3KB
- SHA256 b2b88c109ec22b878039b9da5491a9383aa3d116f3273bac3c19a36f59a13948
- MD5 e77e6f6f0ce9d63ad8ceb3e508619efe
- SHA1 b0428e0ed9e9ddb3974df92c2d737ada7a325a94
- SHA512 d775d3332716b13c032528bfdb85f31598730fcfd8893827933b346b789acdb24c552a39edaea28c2e422d023a3e9f5758407bcd50f5ad0b384654acdc0bc21a
- TLSH T1EC61947553B64DD2DB69AA3AF0E9742B33F6806A430B3E00E2852F744C46F749BE1113
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5ab7a9.TMP
- Size 3KB
- SHA256 54195bc2ba5ec5c48c13b80e5585bde6fd1ac45b78343933f29714a1bbdbaf72
- MD5 8aef512e2f90030f069b22e031c180da
- SHA1 dae944316d746baa9657155b6e90c8c3b343a507
- SHA512 a56c43d65fc79fa6fcde3da0382e83b11d2ac36be8337ed4b017b9c68fd41c2e42d8c0fc35229acb567178be15fd978b4058b50b6eba358d6cad408deb7aca3a
- TLSH T15551847953B64DD2DB29AA7AF0E9746B32F6806A43073E00E2852F345C06F745BE1113
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
- Size 2B
- SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
- MD5 99914b932bd37a50b983c5e7c90ae93b
- SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
- SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
- Size 70KB
- SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
- MD5 efe54a870e0f5ff28d7e00036b861065
- SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
- SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
- SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
- TLSH T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
- Size 3KB
- SHA256 e93694b46e58f2e622ac0e3d107d9886cd78db8e7ee1cf72055c887f1318553d
- MD5 f9a10d9270b5588cfd926d8341caf55f
- SHA1 c465ba74f1a333cb2b49c31b80deda20a8f92735
- SHA512 80701039e75d91226a3ecad3bd8edded2653ee87a2192f98fb754a6d635800b945484a7b03ec552781d05a90c0863051656b4b53f361cb537f273699d82cbde0
- TLSH T1B171BDF7C2E5D66EC91153F0AB183E1BCE2D0918432C3D5AC9E4AF4BA3E2471D14198E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
- Size 40B
- SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
- MD5 20d4b8fa017a12a108c87f540836e250
- SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
- SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 14KB
- SHA256 0f96700b2f20fc41fb95fc8f1451fb8feaabfc53eec1968d61c8262ae81af91b
- MD5 6379093ea1389aab43f2c1c45134757f
- SHA1 3a999a375abb286f6050ef06814bd1c0af8fdcc2
- SHA512 843c3aec6e7e10f2b904ac139fad433eb3a3bc3e67c0a4f8b7221b107b01c0035bb3d071744bd58446c11fdcf068fe4a8642a5b800e00b9d7532af3104ceabd7
- SSDEEP 192:sxRzRxyM/jK1Ml8wCi/f0sIj97CZogWozoA8pfv/F876+WNxinfPbmnc3hOGRIg3:sxRzD8i/f0ss7EoPn/nqfbRL3
- TLSH T1C262D9066A3459779CDBD20DFA55BF93D6F91563A2901E44AAFCCA0C00E6BED2213C1F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 14KB
- SHA256 cfea4fc3a47bbb526a062a4f88a33aa37a8dbdecedab0a326b4e743c41dce741
- MD5 c639edb210e009fcdab08edf20faa0a3
- SHA1 e9c255d3e2a130b2262676dc69972b9e024ec84e
- SHA512 344f9818c33fa6efab9612120c8e1ed399dcb984a79cee911aa7fbd1bca5726b4b8f341b259bb43d88b740579c760202875fa2b7eeb17433c754ac6597688221
- SSDEEP 192:sxR8RxyM/jK1Ml8wCi/f0sMj97CZogWezoA8pf7l/FId6+WNx7THdZPd7rnYM3hL:sxR8D8i/f0sY7EoVzl/vdbdZpcMRL3
- TLSH T11A62DA066A3459779CDBD209FA55BF93D6F9156392901E44AAFCCB0C00E67ED2213C1F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
- Size 32KB
- SHA256 25adfd2c36867c04c7a39fd86bda9e8c226a39ee2e98fceafc591ce2e306d163
- MD5 1a3569bea2a915a03f52bb71d0880bda
- SHA1 01f5eaec717584bc4ca9e58539190ae52bf556e1
- SHA512 2acbb6a5ad1fb8a7b02b7fb9fc94485704228bcbf46843afebd06877eac34871d3fe23758fc34708ccbd00cca8535ee2ec2d3b7e2b186e7cc116d7e118080577
- SSDEEP 768:wGedPg7pLuL7X6WgoufDM8F1+UoAYDCx9Tuqh0VfUC9xbog/OV4VOu4Y2roSd8FE:wGedPsE7X6WgoufDMu1ja/VOVYNnXrBS
- TLSH T1B8E2DB3B680CCB7E4F804EDDEC29BE9FADA801CB5AD8895447EA840C03C57EB55165DB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
- Size 22KB
- SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
- MD5 f768bcb451a187c18099961c484eef8b
- SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
- SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
- SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
- TLSH T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5aa588.TMP
- Size 3KB
- SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
- MD5 904e6e94a1d46374c8630cfd86cc729f
- SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
- SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
- TLSH T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 35KB
- SHA256 b9b93f59520fa2574bab557453ef752d085dd87e7214f429b6b15f737f220900
- MD5 9c692e4c0f03ad9fbce11567fa06dd73
- SHA1 8e802a3bbdd919de5ca3d790e9263eb0ffabfa06
- SHA512 4c863c9dc1be581b31812674b33b8e8e93d7d690dc6e36fb4e2799249ecf0ae5237b97f99ccd6fbd8b00d5ebe4874dc26b13f270eb9ae8b00a471b2b0fe28d57
- SSDEEP 768:wj+9232eDZIO0oGErNzc4ReyIsP0b9Ms6:P923xGQtc44bscb+s6
- TLSH T163F2CF32BC258D739CE69246B61736D2BEF5216B81C42E88D6DD9F0C09436EC075B817
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 43KB
- SHA256 55814cb1898e16c7da2ac3fe549620c6b59d87793b80ba70dfb4257dd0dc3e96
- MD5 f9092e666bd62fbf3ccca7ba41b1571d
- SHA1 47788b45fad4b3fc43b7b813a3fe80f2808cc1a7
- SHA512 d0cf7d1964d31470569df2d86a15d5c51ceec39c253a601f5662c383f3c838d93da091ae22d84956f70dbc6325434e9acb3e814e52393291e4a952b3f341c7db
- SSDEEP 768:AF1j+9a3Uwg4TZQ5O0oGECNzc4ReyIsP0b9Ms6:N9a3vG3tc44bscb+s6
- TLSH T1021318F698D78976E89E4787673D6D86ADFCD067B1885884B7C85E0CCC421BFC30A816
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 38KB
- SHA256 0c96da166eaf6e8fcec11788555eb42e6b746460d59d2aa1ab8431615d1ee7f1
- MD5 569b4c1f8360b97601f70fd0a0f98f80
- SHA1 8957399a31adbcafeba81e6c5b024ae942e34ec4
- SHA512 26833bc8858281d651341f623dc0427aa77dc6e15c7dbe9d2f7bb800999cacf5f6bf852b08a37cada81b5d93faf377ba79d6b69dd118e77b2db286784da708d9
- SSDEEP 768:6rv+4UNbds3rhDZIO0oGJNzc4ReyIsXHeVH1S5D:6bsbS31GJtc44bs3EH1Y
- TLSH T1A103DF33E8688977ACF69686B40776537EF8A12782D81E94C5DE5F0C4A8B5DC130F923
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 35KB
- SHA256 1754a12d3e6b03d7c6ba507436c9e3c51d0fd9971b276957adc34ce02212dc58
- MD5 f77e493f45d1637e76984f5018c1382c
- SHA1 e315008599abde16ee900ee92d36735179b09583
- SHA512 bba639e0cc2c8a47819f443fd085f925d886fbb41b87355b311f4694fc64f52d1bae19faa610b9107a3a8261bcd71f18eb8c22bca17cc8349c9d61680359a382
- SSDEEP 768:Nj+9236+DZIO0oGEWNzc4ReyIsP0b9Ms6:o923dGjtc44bscb+s6
- TLSH T104F2CF32FC258D73ACEA9246B61776D2BEF5216B81C82D88D6DD9F0C09436EC075B817
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
- Size 252B
- SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
- MD5 551baa462724351873ccd655a8b64ea3
- SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
- SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
- TLSH T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
- Size 132B
- SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
- MD5 f5a3b29f9a977e23d6ca4eb728238f9f
- SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
- SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
- TLSH T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\4e88bb27-aafc-45bd-8300-d19ec4ebf2ea.tmp
- Size 13B
- SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
- MD5 2aa9e263ee3796d9ce358460a2451b4c
- SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
- SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\MSI9BF8.tmp
- Size 141KB
- SHA256 4c3d85e7c49928af0f43623dcbed474a157ef50af3cba40b7fd7ac3fe3df2f15
- MD5 edb88affffd67bca3523b41d3e2e4810
- SHA1 0055b93907665fed56d22a7614a581a87d060ead
- SHA512 2b9d99c57bfa9ab00d8582d55b18c5bf155a4ac83cf4c92247be23c35be818b082b3d6fe38fa905d304d2d8b957f3db73428da88e46acc3a7e3fee99d05e4daf
- SSDEEP 3072:Biaf8jGZY0WHkCKblNnRNE/I6CQQAMllgKtf5nY+M:L8jWY0WTcRNEw5QQpX9m
- TLSH T138E359117BE0C032E4AA2938193597755A3FB930AF74C6CB77650A6E4E70BD19E3A307
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI9CC4.tmp
- Size 715KB
- SHA256 f2a049107473fa70f2a08f035b107c7a8683112ed487c9198b880f650089f1cf
- MD5 2cfa8d9bd7e29609b9bcfc17f377ce05
- SHA1 662dbf290b23c8220a01455abd5c1327e6a48337
- SHA512 9f8924ed4883a24dac45e74185c24cd6d50d92932c6f996f430b607fe619b0fdb4783e93bf7d3decfbf50868fac8d5c3817f7949e15bfb25a0043b8036d40c5f
- SSDEEP 12288:tkopLbSYv9phO5nHnwEmNWyffFTy405hDcdRdXwCiTMVl0GqxPdwJ:tk4LbSYThO5nHnXmkgfFTpH5wCiTMVlD
- TLSH T1AAF4AE1373E1C03AF06F1270AA2AAB7A8AB6FD315835C84B67D44A5D5F70681DA3D713
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1072_31244951\CRX_INSTALL\content_new.js
- Size 10KB
- SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
- MD5 3de1e7d989c232fc1b58f4e32de15d64
- SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
- SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
- SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
- TLSH T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{015CC3CD-415F-48EC-883D-94C5228AA937}\0x0409.ini
- Size 21KB
- SHA256 e994689a13b9448c074f9b471edeec9b524890a0d82925e98ab90b658016d8f3
- MD5 be345d0260ae12c5f2f337b17e07c217
- SHA1 0976ba0982fe34f1c35a0974f6178e15c238ed7b
- SHA512 77040dbee29be6b136a83b9e444d8b4f71ff739f7157e451778fb4fccb939a67ff881a70483de16bcb6ae1fea64a89e00711a33ec26f4d3eea8e16c9e9553eff
- SSDEEP 384:CTmyuV//BiTbh/G4AwC2WrP2DBWa/Oa0Mhs+XVgv:CT6V//BiXh/z/lWr0aa0Mhs+XVgv
- TLSH T1FBA2B95667F94219F6F77F50FDB802221E7ABC82AC38D25C1280499D09F1E84D8B1B7B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{015CC3CD-415F-48EC-883D-94C5228AA937}\1033.MST
- Size 3KB
- SHA256 c84a77d921d5faee49a1f35e4954636233fc75acfd74e87fb5d6c97f3a10f2d6
- MD5 049f5861e5e5be01dcfde23fdf5ba47e
- SHA1 e947839bb8dedbcd2841bf4fb324ca500287a77a
- SHA512 a807b661bc073bbdeb8717e9d10287b91c971bd4f5fdba1cd49f25d8c2ceb928a291d27d8b2b4326d17fa631ad985fb0bff01f1ca3d7d6458f935b35db3ebb41
- TLSH T19271CC93BF64C561D14806B28FDBC7084326FC80CDA0930775A6B35F6D709C06B92665
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{015CC3CD-415F-48EC-883D-94C5228AA937}\_ISMSIDEL.INI
- Size 20B
- SHA256 0a33c5dffabcf31a1f6802026e9e2eef4b285e57fd79d52fdcd98d6502d14b13
- MD5 db9af7503f195df96593ac42d5519075
- SHA1 1b487531bad10f77750b8a50aca48593379e5f56
- SHA512 6839264e14576fe190260a4b82afc11c88e50593a20113483851bf4abfdb7cca9986bef83f4c6b8f98ef4d426f07024cf869e8ab393df6d2b743b9b8e2544e1b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\{015CC3CD-415F-48EC-883D-94C5228AA937}\iobitToolbar.msi
- Size 4.7MB
- SHA256 7c35532b59278072d3b417097638dba2f86881fe228cdadcd68fa344628188d9
- MD5 8e7ea3a342f4ff875ce03b69bf9373ea
- SHA1 e50bd9b7f958bfc50d0cbea6a377bc178cba7d17
- SHA512 372e4caedede280f0294c839124fc94b902a7d028346905ec31916eba3fc53562b84e6ddecfc7a74772e180cbca1058b87d464518dda7deec39060afcffa285a
- SSDEEP 98304:o6lYyvEaobSYHhO5kRjwCdl0esjtpOLq/ZjW/FvlsO+Q99a6a04iat5bTRpJCOTi:o6ZkhO5WX0TjrON9EkE0bajTpCW
- TLSH T179361213B7C1C13AE5AF0270142A67790B79FC314E30849B67E4AA2D5F71AD1DA3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\~8311.tmp
- Size 5KB
- SHA256 d62acdbdc992c09167b9dc7969cfd665db99862e0bd7d2e890508217c42ff178
- MD5 b662701dc750b59c2e62164e420b29c3
- SHA1 b501fa71fa27b6e583c7a1d7a6487e950b30c0f6
- SHA512 a86cea26718538104944305bf35e597bf5598c22f47088af3f62a70b1dcce7982085ec31ad97378bd8d3bdcc009abb0d44120404dfa14725c335dbd59b603953
- SSDEEP 96:rEhkMTEw1HmHU1B4OXONV2XsEbFWaEPRhS+gWPQPgWRGTwQbPrvnp6kY05w7tCYA:YhBkUxG2cuQaEZhdxoIWRGcQbPr/p00P
- TLSH T1F8B19A172BF6001EF6F36B45DAF1443787263C12282CDA5C55D0875A28F2D828A67BEB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSID3F1.tmp
- Size 269KB
- SHA256 77bdb05546c8f5fd436753c6316f897bb8d358515835b85b0243f06ecd96931e
- MD5 60f2c079f305acc2334e1f878200b6ed
- SHA1 dde8084c33ea33f47aae1f961409c5ae847c2d2d
- SHA512 590e4506ce3f47b54a3300308bd73cde3c9433d60ae2fd21c4f508d4a7bf212e58b064ef59a315f08aeb5c8cbb4f0f4d442b7b5f9aad7636ebb6dda6871926d0
- SSDEEP 3072:n9RlnNLLp55Q5allcyfd8oxSzDX1XuYNTj1aJdjFGgoeDtBtncFT5/bVWMANozSC:9PVV/yn8WtuYNlaJdjZoOtBkTCmzXf
- TLSH T1D344BE11F5D5C035CB8E0B7019BC677962B8E6946F90CED7E34AED5C9E32680893620F
- MD5 SHA1 SHA512 SSDEEP TLSH