hxxps://cdn[.]discordapp[.]com/attachments/1506650720143802409/1529780887460253726/Launcher_1[.]1[.]5_x64_en-US[.]msi?ex=6a63d7b9&is=6a628639&hm=ad7fa3e771b03ad20064e0e018169907e08591f9639eb6f442cd34bf260c4c7d&

Analysis

geolocation tags

eueuropefrfrance
user interaction
yes
max time kernel
54s
max time network
53s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/07/2026, 16:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://cdn.discordapp.com/attachments/1506650720143802409/1529780887460253726/Launcher_1.1.5_x64_en-US.msi?ex=6a63d7b9&is=6a628639&hm=ad7fa3e771b03ad20064e0e018169907e08591f9639eb6f442cd34bf260c4c7d&
Sample260724-thmecshd69

Score

7^/10

defense_evasion discovery execution ransomware trojan

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4784	revert-launcher.exe

Loads dropped DLL 1 IoCs

pid	Process
2216	MsiExec.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	revert-launcher.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Launcher\Uninstall Launcher.lnk	msiexec.exe
File created	C:\Program Files\Launcher\revert-launcher.exe	msiexec.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\Installer\{86E96FF9-7A7E-41A5-A5F5-501FE6D5A868}\ProductIcon	msiexec.exe
File created	C:\Windows\Installer\e58849e.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e58849c.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{86E96FF9-7A7E-41A5-A5F5-501FE6D5A868}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI872C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{86E96FF9-7A7E-41A5-A5F5-501FE6D5A868}\ProductIcon	msiexec.exe
File created	C:\Windows\Installer\e58849c.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4444	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4780	msedge.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000020c8f0fe5d92f37a0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000020c8f0fe0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff00000000070001000068090020c8f0fe000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a20c8f0fe000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d20c8f0fe000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 6 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134293826476525865"	msedge.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe

Modifies registry class 30 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9FF69E68E7A75A145A5F05F16E5D8A86\ShortcutsFeature = "MainProgram"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9FF69E68E7A75A145A5F05F16E5D8A86\External	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9FF69E68E7A75A145A5F05F16E5D8A86\ProductName = "Launcher"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9FF69E68E7A75A145A5F05F16E5D8A86\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9FF69E68E7A75A145A5F05F16E5D8A86\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\3C34BAD37D2DABE5DA3B70FB0E7582BB\9FF69E68E7A75A145A5F05F16E5D8A86	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{E864C20A-D052-4403-8FBE-AADCCC16068F}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9FF69E68E7A75A145A5F05F16E5D8A86\DeploymentFlags = "3"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9FF69E68E7A75A145A5F05F16E5D8A86\Language = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9FF69E68E7A75A145A5F05F16E5D8A86\Version = "16842757"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9FF69E68E7A75A145A5F05F16E5D8A86\AuthorizedLUAApp = "0"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9FF69E68E7A75A145A5F05F16E5D8A86\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9FF69E68E7A75A145A5F05F16E5D8A86	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9FF69E68E7A75A145A5F05F16E5D8A86\PackageCode = "09391E31398BC0545B282F07D1A01B4E"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\3C34BAD37D2DABE5DA3B70FB0E7582BB	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9FF69E68E7A75A145A5F05F16E5D8A86\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\Downloads\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9FF69E68E7A75A145A5F05F16E5D8A86\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9FF69E68E7A75A145A5F05F16E5D8A86\ProductIcon = "C:\\Windows\\Installer\\{86E96FF9-7A7E-41A5-A5F5-501FE6D5A868}\\ProductIcon"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9FF69E68E7A75A145A5F05F16E5D8A86\SourceList\PackageName = "Launcher_1.1.5_x64_en-US.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9FF69E68E7A75A145A5F05F16E5D8A86\MainProgram	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9FF69E68E7A75A145A5F05F16E5D8A86\Environment = "MainProgram"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9FF69E68E7A75A145A5F05F16E5D8A86\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9FF69E68E7A75A145A5F05F16E5D8A86\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9FF69E68E7A75A145A5F05F16E5D8A86\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9FF69E68E7A75A145A5F05F16E5D8A86\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9FF69E68E7A75A145A5F05F16E5D8A86	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9FF69E68E7A75A145A5F05F16E5D8A86\SourceList\Net\1 = "C:\\Users\\Admin\\Downloads\\"	msiexec.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
3556	reg.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4336	msiexec.exe
4336	msiexec.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
3516	msedgewebview2.exe
2964	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1696	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1696	msiexec.exe
Token: SeSecurityPrivilege	4336	msiexec.exe
Token: SeCreateTokenPrivilege	1696	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1696	msiexec.exe
Token: SeLockMemoryPrivilege	1696	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1696	msiexec.exe
Token: SeMachineAccountPrivilege	1696	msiexec.exe
Token: SeTcbPrivilege	1696	msiexec.exe
Token: SeSecurityPrivilege	1696	msiexec.exe
Token: SeTakeOwnershipPrivilege	1696	msiexec.exe
Token: SeLoadDriverPrivilege	1696	msiexec.exe
Token: SeSystemProfilePrivilege	1696	msiexec.exe
Token: SeSystemtimePrivilege	1696	msiexec.exe
Token: SeProfSingleProcessPrivilege	1696	msiexec.exe
Token: SeIncBasePriorityPrivilege	1696	msiexec.exe
Token: SeCreatePagefilePrivilege	1696	msiexec.exe
Token: SeCreatePermanentPrivilege	1696	msiexec.exe
Token: SeBackupPrivilege	1696	msiexec.exe
Token: SeRestorePrivilege	1696	msiexec.exe
Token: SeShutdownPrivilege	1696	msiexec.exe
Token: SeDebugPrivilege	1696	msiexec.exe
Token: SeAuditPrivilege	1696	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1696	msiexec.exe
Token: SeChangeNotifyPrivilege	1696	msiexec.exe
Token: SeRemoteShutdownPrivilege	1696	msiexec.exe
Token: SeUndockPrivilege	1696	msiexec.exe
Token: SeSyncAgentPrivilege	1696	msiexec.exe
Token: SeEnableDelegationPrivilege	1696	msiexec.exe
Token: SeManageVolumePrivilege	1696	msiexec.exe
Token: SeImpersonatePrivilege	1696	msiexec.exe
Token: SeCreateGlobalPrivilege	1696	msiexec.exe
Token: SeCreateTokenPrivilege	1696	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1696	msiexec.exe
Token: SeLockMemoryPrivilege	1696	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1696	msiexec.exe
Token: SeMachineAccountPrivilege	1696	msiexec.exe
Token: SeTcbPrivilege	1696	msiexec.exe
Token: SeSecurityPrivilege	1696	msiexec.exe
Token: SeTakeOwnershipPrivilege	1696	msiexec.exe
Token: SeLoadDriverPrivilege	1696	msiexec.exe
Token: SeSystemProfilePrivilege	1696	msiexec.exe
Token: SeSystemtimePrivilege	1696	msiexec.exe
Token: SeProfSingleProcessPrivilege	1696	msiexec.exe
Token: SeIncBasePriorityPrivilege	1696	msiexec.exe
Token: SeCreatePagefilePrivilege	1696	msiexec.exe
Token: SeCreatePermanentPrivilege	1696	msiexec.exe
Token: SeBackupPrivilege	1696	msiexec.exe
Token: SeRestorePrivilege	1696	msiexec.exe
Token: SeShutdownPrivilege	1696	msiexec.exe
Token: SeDebugPrivilege	1696	msiexec.exe
Token: SeAuditPrivilege	1696	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1696	msiexec.exe
Token: SeChangeNotifyPrivilege	1696	msiexec.exe
Token: SeRemoteShutdownPrivilege	1696	msiexec.exe
Token: SeUndockPrivilege	1696	msiexec.exe
Token: SeSyncAgentPrivilege	1696	msiexec.exe
Token: SeEnableDelegationPrivilege	1696	msiexec.exe
Token: SeManageVolumePrivilege	1696	msiexec.exe
Token: SeImpersonatePrivilege	1696	msiexec.exe
Token: SeCreateGlobalPrivilege	1696	msiexec.exe
Token: SeCreateTokenPrivilege	1696	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1696	msiexec.exe
Token: SeLockMemoryPrivilege	1696	msiexec.exe

Suspicious use of FindShellTrayWindow 52 IoCs

pid	Process
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
1696	msiexec.exe
1696	msiexec.exe
1696	msiexec.exe
4784	revert-launcher.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe

Suspicious use of WriteProcessMemory 59 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 4796	2964	msedge.exe	84
PID 2964 wrote to memory of 4780	2964	msedge.exe	87
PID 2964 wrote to memory of 1532	2964	msedge.exe	88
PID 2964 wrote to memory of 1052	2964	msedge.exe	89
PID 2964 wrote to memory of 2464	2964	msedge.exe	90
PID 2964 wrote to memory of 1532	2964	msedge.exe	88
PID 2964 wrote to memory of 1532	2964	msedge.exe	88
PID 2964 wrote to memory of 3228	2964	msedge.exe	91
PID 2964 wrote to memory of 1052	2964	msedge.exe	89
PID 2964 wrote to memory of 2008	2964	msedge.exe	92
PID 2964 wrote to memory of 2464	2964	msedge.exe	90
PID 2964 wrote to memory of 2464	2964	msedge.exe	90
PID 2964 wrote to memory of 816	2964	msedge.exe	93
PID 2964 wrote to memory of 3228	2964	msedge.exe	91
PID 2964 wrote to memory of 3228	2964	msedge.exe	91
PID 2964 wrote to memory of 2008	2964	msedge.exe	92
PID 2964 wrote to memory of 2008	2964	msedge.exe	92
PID 2964 wrote to memory of 816	2964	msedge.exe	93
PID 2964 wrote to memory of 816	2964	msedge.exe	93
PID 2964 wrote to memory of 4036	2964	msedge.exe	96
PID 2964 wrote to memory of 4036	2964	msedge.exe	96
PID 2964 wrote to memory of 4504	2964	msedge.exe	97
PID 2964 wrote to memory of 4504	2964	msedge.exe	97
PID 2964 wrote to memory of 2856	2964	msedge.exe	98
PID 2964 wrote to memory of 2896	2964	msedge.exe	99
PID 2964 wrote to memory of 2856	2964	msedge.exe	98
PID 2964 wrote to memory of 2896	2964	msedge.exe	99
PID 2964 wrote to memory of 2896	2964	msedge.exe	99
PID 2964 wrote to memory of 4168	2964	msedge.exe	103
PID 2964 wrote to memory of 3136	2964	msedge.exe	104
PID 2964 wrote to memory of 1696	2964	msedge.exe	107
PID 4336 wrote to memory of 2216	4336	msiexec.exe	112
PID 2964 wrote to memory of 5452	2964	msedge.exe	119
PID 2964 wrote to memory of 5460	2964	msedge.exe	120
PID 2964 wrote to memory of 5468	2964	msedge.exe	121
PID 4336 wrote to memory of 5840	4336	msiexec.exe	124
PID 2964 wrote to memory of 5856	2964	msedge.exe	126
PID 2964 wrote to memory of 5856	2964	msedge.exe	126
PID 1696 wrote to memory of 4784	1696	msiexec.exe	128
PID 4784 wrote to memory of 3516	4784	revert-launcher.exe	129
PID 3516 wrote to memory of 4584	3516	msedgewebview2.exe	130
PID 3516 wrote to memory of 4268	3516	msedgewebview2.exe	131
PID 3516 wrote to memory of 4268	3516	msedgewebview2.exe	131
PID 3516 wrote to memory of 4268	3516	msedgewebview2.exe	131
PID 3516 wrote to memory of 5836	3516	msedgewebview2.exe	132
PID 3516 wrote to memory of 5628	3516	msedgewebview2.exe	133
PID 3516 wrote to memory of 5628	3516	msedgewebview2.exe	133
PID 3516 wrote to memory of 5512	3516	msedgewebview2.exe	134
PID 3516 wrote to memory of 5512	3516	msedgewebview2.exe	134
PID 3516 wrote to memory of 5512	3516	msedgewebview2.exe	134
PID 4784 wrote to memory of 3556	4784	revert-launcher.exe	135
PID 4784 wrote to memory of 4444	4784	revert-launcher.exe	137
PID 3516 wrote to memory of 5516	3516	msedgewebview2.exe	139
PID 3516 wrote to memory of 5516	3516	msedgewebview2.exe	139
PID 4444 wrote to memory of 6112	4444	cmd.exe	140
PID 6112 wrote to memory of 6108	6112	msedge.exe	141
PID 2964 wrote to memory of 5792	2964	msedge.exe	142
PID 2964 wrote to memory of 5792	2964	msedge.exe	142
PID 2964 wrote to memory of 5792	2964	msedge.exe	142

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.discordapp.com/attachments/1506650720143802409/1529780887460253726/Launcher_1.1.5_x64_en-US.msi?ex=6a63d7b9&is=6a628639&hm=ad7fa3e771b03ad20064e0e018169907e08591f9639eb6f442cd34bf260c4c7d&
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x240,0x244,0x248,0x23c,0x268,0x7ffe8ea5c188,0x7ffe8ea5c194,0x7ffe8ea5c1a0
  2⤵
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1856,i,11220453734136956087,2990060090118152221,524288 --field-trial-handle=3780,i,9910226411227946516,9999091505958077520,262144 --variations-seed-version --mojo-platform-channel-handle=3920 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,6216503248569966567,14522474215133747176,262144 --field-trial-handle=3780,i,9910226411227946516,9999091505958077520,262144 --variations-seed-version --mojo-platform-channel-handle=3776 /prefetch:2
  2⤵
  PID:1532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2356,i,17222314816347440096,11118313339367657429,524288 --field-trial-handle=3780,i,9910226411227946516,9999091505958077520,262144 --variations-seed-version --mojo-platform-channel-handle=4000 /prefetch:8
  2⤵
  PID:1052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3128,i,14690985241165683328,3782811714728145955,2097152 --field-trial-handle=3780,i,9910226411227946516,9999091505958077520,262144 --variations-seed-version --mojo-platform-channel-handle=4128 /prefetch:1
  2⤵
  PID:2464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3132,i,2137483895347869901,9538814006611662575,2097152 --field-trial-handle=3780,i,9910226411227946516,9999091505958077520,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:1
  2⤵
  PID:3228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=3328,i,6305234656277289679,12246850931939327536,2097152 --field-trial-handle=3780,i,9910226411227946516,9999091505958077520,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:1
  2⤵
  PID:2008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3348,i,10663280443229031836,17813012176037882114,2097152 --field-trial-handle=3780,i,9910226411227946516,9999091505958077520,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:2
  2⤵
  PID:816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5020,i,6270549310138635967,3663107311025269223,524288 --field-trial-handle=3780,i,9910226411227946516,9999091505958077520,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:8
  2⤵
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5024,i,4447696650154134575,14604199348422554931,524288 --field-trial-handle=3780,i,9910226411227946516,9999091505958077520,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:8
  2⤵
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5584,i,12716714696810766401,13826946166449615563,524288 --field-trial-handle=3780,i,9910226411227946516,9999091505958077520,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:8
  2⤵
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5608,i,4598902274482598928,9256916334757418090,2097152 --field-trial-handle=3780,i,9910226411227946516,9999091505958077520,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:1
  2⤵
  PID:2896
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6412,i,116560508002769279,418216225897875974,524288 --field-trial-handle=3780,i,9910226411227946516,9999091505958077520,262144 --variations-seed-version --mojo-platform-channel-handle=6436 /prefetch:8
  2⤵
  PID:1596
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6412,i,116560508002769279,418216225897875974,524288 --field-trial-handle=3780,i,9910226411227946516,9999091505958077520,262144 --variations-seed-version --mojo-platform-channel-handle=6436 /prefetch:8
  2⤵
  PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6984,i,18089261021998605776,1972093191437101236,524288 --field-trial-handle=3780,i,9910226411227946516,9999091505958077520,262144 --variations-seed-version --mojo-platform-channel-handle=6776 /prefetch:8
  2⤵
  PID:3136
- C:\Windows\System32\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\Launcher_1.1.5_x64_en-US.msi"
  2⤵
  - Enumerates connected drives
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1696
- - C:\Program Files\Launcher\revert-launcher.exe
    "C:\Program Files\Launcher\revert-launcher.exe"
    3⤵
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4784
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=revert-launcher.exe --webview-exe-version=1.1.5 --user-data-dir="C:\Users\Admin\AppData\Local\org.arcfn.revertlauncher\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=4784.3624.8300786623824834627
      4⤵
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of WriteProcessMemory
      PID:3516
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\org.arcfn.revertlauncher\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\org.arcfn.revertlauncher\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x160,0x164,0x168,0x13c,0x40,0x7ffe87bab078,0x7ffe87bab084,0x7ffe87bab090
        5⤵
        
        PID:4584
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\org.arcfn.revertlauncher\EBWebView" --webview-exe-name=revert-launcher.exe --webview-exe-version=1.1.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1800,i,12766335026607499387,8667303342957843808,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1756 /prefetch:2
        5⤵
        
        PID:4268
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\org.arcfn.revertlauncher\EBWebView" --webview-exe-name=revert-launcher.exe --webview-exe-version=1.1.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2016,i,12766335026607499387,8667303342957843808,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2032 /prefetch:3
        5⤵
        
        PID:5836
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\org.arcfn.revertlauncher\EBWebView" --webview-exe-name=revert-launcher.exe --webview-exe-version=1.1.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2356,i,12766335026607499387,8667303342957843808,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:8
        5⤵
        
        PID:5628
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\org.arcfn.revertlauncher\EBWebView" --webview-exe-name=revert-launcher.exe --webview-exe-version=1.1.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3656,i,12766335026607499387,8667303342957843808,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:1
        5⤵
        
        PID:5512
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\org.arcfn.revertlauncher\EBWebView" --webview-exe-name=revert-launcher.exe --webview-exe-version=1.1.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=3648,i,12766335026607499387,8667303342957843808,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4128 /prefetch:8
        5⤵
        
        PID:5516
  - - C:\Windows\system32\reg.exe
      "reg" query HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v ArcLauncher
      4⤵
      Modifies registry key
      PID:3556
  - - C:\Windows\system32\cmd.exe
      "cmd" /C start "" https://backend-service-prod.ol.arcfn.org/launcher/auth/login?port=50446
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:4444
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://backend-service-prod.ol.arcfn.org/launcher/auth/login?port=50446
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:6112
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://backend-service-prod.ol.arcfn.org/launcher/auth/login?port=50446
        6⤵
        
        PID:6108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6444,i,4159656390737103623,7888545183050006473,524288 --field-trial-handle=3780,i,9910226411227946516,9999091505958077520,262144 --variations-seed-version --mojo-platform-channel-handle=4856 /prefetch:8
  2⤵
  PID:5452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4872,i,3124853614687757176,12701466162961867776,524288 --field-trial-handle=3780,i,9910226411227946516,9999091505958077520,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:8
  2⤵
  PID:5460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4868,i,3324578411028721898,17130694851334695323,524288 --field-trial-handle=3780,i,9910226411227946516,9999091505958077520,262144 --variations-seed-version --mojo-platform-channel-handle=6632 /prefetch:8
  2⤵
  PID:5468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5032,i,4933175499732446246,6464460148271484442,524288 --field-trial-handle=3780,i,9910226411227946516,9999091505958077520,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:8
  2⤵
  PID:5856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=5768,i,4851103962883046484,15624662566574263474,2097152 --field-trial-handle=3780,i,9910226411227946516,9999091505958077520,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:1
  2⤵
  PID:5792

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3540

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4336
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 43B187F085EEAA49F9F345825C9DB258 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2216
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:5840

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:3544

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e58849d.rbs

Path C:\Config.Msi\e58849d.rbs
Size 9KB
SHA256 4cd2b2f3fe59a121635596a2eef82868b47fa66527f78d94a3815d4c489a2456
MD5 e1e87a6ddbc88ddf2e610b65258d8098
SHA1 39c14f5af3f51da2bb04134e684bc33cff089b39
SHA512 3acb7bd6df14e25ba0d6f4a7bc4f81573a28ce3bf0b2be5b726c570ea6dcfce705ae78ebe68661aee9539e05d1d7bbb06e2244d2ebbc1fcac79699239fb042e5
SSDEEP 192:irzavtF8w3mzeg4SyOTGWOTQhfgjcdyNd8hdQlWdwicZm83oApzBK2KFK3KoKjV8:irzavtF8w3maOrO2jF463EJp
TLSH
T182227446E601C5D3FCA21B34CB0B1B107BA7E3E55349934B0DCD55284E5BB884F6A6AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Launcher.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Launcher\Launcher.lnk
Size 2KB
SHA256 337c66c419a89489a64dbbc7bcdfa09155cc900e0b8b96447fd4813647ac0cb3
MD5 fcf3bdf9b424dc96634ad22aa633cd5e
SHA1 ba44f80048680d1c85685eb4dfa142eb5f1969bd
SHA512 c0fe2f625174e531d2acc80b18e51bd3f5b27f313a24b1f8bcaa8e31666175cc48323bb8657a52151aa6abe7b5c3d961a1a9faa745311550d9a0cfa28a30469c
TLSH
T14741F0108BE4665CF37B47396A320A20DE32FC0AF5698F1F4189818904749005EA9F3F
MD5 SHA1 SHA512 TLSH

Submit Download

Launcher.lnk~RFe588b72.TMP

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Launcher\Launcher.lnk~RFe588b72.TMP
Size 1KB
SHA256 e065a5c7f822ff8cb8410f82bf0f674b561c148c7c60b7ad38264cbef75cf05a
MD5 5741ad5d3c879504daea5b5a7559dcc1
SHA1 435440cd2690e014e1b810f0e14c8691eaaacf69
SHA512 58dae6444cd0428634a14be4e781a5bb827d7205979e690462f82f6195543b9ac12d30777c4ae8ffdba22be5a8cda4e6cfcded1f8af55fe65d7380a0004b60fc
TLSH
T1F641DF608BE4666CF37747395E720A60DF72FC0AF6658F1F408A818904749005EA9F7F
MD5 SHA1 SHA512 TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 deae8ba3a07225fe9f1490e4968fd83f8d308707a88a6d3d541d8ab416841ddf
MD5 1fcf11901014bf515178c91bdb7a6c5c
SHA1 4746b018067d9671617515224b7697b27fd2fc5f
SHA512 6059830103275d34e1aa4dd4e8d4177b6c2b684b2b3ad5417753387a227c838c0b258e662c78853cf649656ebd762f5d160c10349cd19ac1953380bd6572c660
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7p:fwUQC5VwBIiElEd2K57P7p
TLSH
T16EB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 39b8627875fea5ac5c5bfb887da12c15116e3fe81f200852c71d5699102c9044
MD5 e3962be2eb3bd350a67bf6309159a1cc
SHA1 c10632202b95ed6f7f4475b6483bf5196e4c5578
SHA512 d12d4acc23b51c071fbc9bf4db2f0575a6b43ec7894b272035e4c01dfce30099cd3ef90a1009dd1e6284cfbcf7a37fd3b79490739946700a2c61ec578374cbe6
TLSH
T173D08C677A0E7815E72F8231A413E360A76B4072A5629702F324C81DA9BC8D85BE63D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a59087fbda784cffb013f4e2a0bf13a7fca483c48e8a7fc15fa022402eb25d72
MD5 dd54db185d82309b854bfa7657ba4600
SHA1 d01c14e8b4dec85ed2e1671545a868fd7ad4fa95
SHA512 f014ab84dd934b90e006883b74ad349d05f60071e57d2cf0bdf8a9bce118654c92139263e082094b602f6900a71e9a7848754994a2ea88642b2376121b581d07
TLSH
T165D08067354D7815E71F42319413D350576B4072A562D702F314C41D957C4D857D53D7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 43bda8f14ff22f9f80c81697d37170f7bbebf3caf4ded11786418aa272b29f73
MD5 32bdfaa67820e8a44476f56cf9cc6f10
SHA1 b784fca9be08803e413e704f2eaa453419ec1f05
SHA512 931da59046a86511d035962063c5173344c9091efbe4a3e0a1346fcec631e10008c3b41d157f9bc413002c681f19375196a66801e79267ee37857d7c529a2764
TLSH
T1B5612D3A028FC160F3A0C672E5D11D0E3A7F4097474F9EA5D3B379FC95197A595A3848
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe584f63.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe584f63.TMP
Size 3KB
SHA256 c32d01c97f191f3f404a3e67949ae4ec404ab4ffc63768e7496ef2e69b39c644
MD5 513a31c08d4b143ddb213d80de8f60df
SHA1 db44c66c11d2b58d73ec641670d4bd9bb237cd96
SHA512 7d26e3b9757efb97b781e61c1cc91b068f894e148b484e581c80b6de6d64dc327566e6ecac68f6bc70834b46382e1c5f26e3f31fb28ba5a24186516d972aeb19
TLSH
T1E1612D3A428FC160F3A0C572E5D11D0E3A7F4097074F9EA9D3B739FC952A7A595A3848
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 e4a40966e9c853ca2d635ccd37436b2f3d64c91ae2d0f09030d0652c7850f01e
MD5 55fa5df1cbe483082e3f2a5882be28dd
SHA1 43c81e39bee01bd808b224e942eb2a1a43c51e1b
SHA512 4856bee9c65332b738cce16d391c899ae203143d204f4c90adf7f6868716d5a9a15af2194f6a42406ec7528e98fbb4fd85debe7b1032d2dc3e9905bd04eed032
SSDEEP 192:sxZvR0KyM/+K1Ml8M9w/fzsr97jEdpJHW6+WNGYHf8+oIgrJ:sxZvE1w/fzsx7wJHbGzh9
TLSH
T14C42C5166B349A77CCCBD209FA55BF53D6F54562E2900E44A9FCCA0C04E6AED231781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 d828f836a161a6374a9ed1fc6c74a639aeab1342978cd03bc93cbfcacd0b6b63
MD5 6f915d0506195f28b9337256932e901f
SHA1 99a46a1fe8e113fc5ca24e1bd30dceb67f85077a
SHA512 e0c1a54989ae6ed81e48eb82d17e1d98986f1626c00c469ef1c31ea9f13757d9a82110de9bd876a5aaef0776b82d70cb21f3a7178d902891964bfa842ca20e91
SSDEEP 192:sxZvR0KyM/+K1Ml8M9w/fzs49voIdp3aHW6+WNWgVK/YH4uE+oIg5MJ:sxZv01w/fzsqvZKHbw/ZhK
TLSH
T1C452C756AA34597BCCDBD209B555BB53D6F64472E2900E44A9FCCA0C01E6BED230781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 d31a16c101068bd95c5d5fe26299d86d5e747b8b1e95f442c9d59429c0231e5f
MD5 69669d92864d42fecfe74d32fbe6d0d2
SHA1 aecb99d16198fc53541aa3926a3adf5a70e76b97
SHA512 323c651d36ae80b2b876f57250616f6339aa0611af916462b82890cea30f34d61e8e5e7241455a6e3915e9b2a89d905769387739fa38c743d8fecd32cc71360c
SSDEEP 768:oXUZYTMWvg0Po8F1+UoAYDCx9Tuqh0VfUC9xbog/OV1eLlPZ4RUroV60I:oXUZYTMWvg0Pou1jaQeLZmR/DI
TLSH
T131D21B2F280CCB7E4F844E9DEC2A6F963ED801CB9A584D5447EA894C03C76EF512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 7KB
SHA256 89db96501acac17924251bb2b24d8dee9262e45bb9a200a0658e8044ff67d42a
MD5 5c955bd5e39673e9d39ccc67a4d9a260
SHA1 578366a55cb0c0511e40e4900d541037dacc8279
SHA512 32e94115e62f188a34cf581c5605ba0a2d21223aff21867adbcf30cd44f2680abcde695c19c0ef39e4712429195c418872318fdb9e887a6cd161417f265cb35d
SSDEEP 96:KA1eK2AYPOKQo+G1CKG0vLsfrZhR2ThC9Rr2KpTRd2tjLaNLnWNqK+0vT1TUTxTA:Ect51j5IVshl7vLO3yhtp1tzm9tiT1tg
TLSH
T16BF1194271F712023D7E3A0581A497279E81F167311CA96B7BAC50B64E6AE21DCFF8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 0d7a317730a56384253b1f4258b14ac595818f34120e5f6be3debd9693a5ca9a
MD5 78109d30343ddce66ed0f1be04d00615
SHA1 fbc83862319d33bae6f6f8f97d5c42345feeb4e5
SHA512 e361bea4405dc3e648c08d28c103360efb3bac334e33e202c23ddb4b099d0de96e8f23190b80d1c67d440f7991bf91d564c9b054c6412c8dd625d00c86a79df8
SSDEEP 384:sZcITsNBUMwOfOjZTzX5od+W8yLXmPQ3ucV56zi52:6TROfs3OtmPQ3wT
TLSH
T128927C725C38AC6798E3E246F98B32130FF98177D788AF8091EC1B1D019A6DC131BD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 b583274c5d63530f8d780ac7317dc98f497d99e1129a1db5986f5a1890a1c570
MD5 90771133d99b200bc92506f3eb2cbce0
SHA1 c426c4d5dcf06783e7a556d523f111e673f909c0
SHA512 9821b819384bb21dcc0cf6c8128a1859a6bbf0a5f8c07bcfaa301e8b77cccab937b36be5c93fc03607b446f166b10fdc5d9703efc34ef27af8272cecdedaf0d9
SSDEEP 384:QZcI6sNBUFwOfOFZTzX5od+W8yLXFPQ3ucV56zi52:u6UOfy3OtFPQ3wT
TLSH
T110927D725C38AC6798E7A246F98B32130FF98177D7886F8091EC1B1D01DA6DC131BD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 429184fcfa97c8d8ea39e6424b74821b7324ef86651160cb21e80c6f2349555e
MD5 8b39e20176918c061cb6c3a435ac6afd
SHA1 2e6e4cebb6b0c3fa7733a557a7c9129a795cf167
SHA512 104dbf3ae55b1f569e9845e1cf1e1451e73218968bf98c620852e8531e33232ffd65c9db08cc9787114daf9d1072767dc618a41583be9735aad894e7e74be0af
SSDEEP 192:9ONj61AWQmiUykcBGX5Obd+j2jzoryXmOXY72jJVquU6:9ONj6JkBGX5od+W8yLXvPU6
TLSH
T140120932A468AC679DE2B545B48732135FE95167EB497FC0D2EC2B1C00DFA9C630AC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 62d544725c8a0515dd6d891d3ce75a9d8ebb499baccc69f499dbcf124531d544
MD5 6b65fa371863b8ac1921292e490e0679
SHA1 cf39784ad38fa5f2b8c5f548f7a33ad2431353c3
SHA512 bc1a1f01fadcaa90fb077755c9c3e4d07f312d95f41cb7bdd06051b352111d18c5567b14000a09d80509e1c318a50fec1b66ac114d635f2d8994816f916bd170
SSDEEP 384:PsNBU2wOfOpfTzX5od+W8yLXTPQ3ucV56zi7:PfOfS3OtTPQ3wK
TLSH
T13F625B36A828AC679DE3A245F55B32130FB9526BDB886F8095DC1B1C01CF2DC6317D1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 4c1f6899a2e8dae4e6c7e3392f0d06c98b8f945cdd9834dc82794ed0197802bd
MD5 28ab8cbe6b9a1d125640ad5ed4e17c49
SHA1 483d6a0f8860135e1721497a66deea549e393cde
SHA512 d23fac042fd232ddb5935c3fe277dc0d5b8ea8d69599b6a135bbc5b430e2b9e7d54bb20bcde1d17ef7bd9a84fe693c53cdcd2b4c8b6a984ec4094ac2afa9219e
SSDEEP 384:SZcI6sNBUMwOfOFZTzX5od+W8yLXFPQ3ucV56zi52:g6ROfy3OtFPQ3wT
TLSH
T15A927C725C28AC6798E7E246F98B32170FF99177D7886F8091EC1B1D01DA6DC131BD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 85b289175d046da4d543ce8bfb107dc42a457f14eae2713d16cbe6c47e594398
MD5 a5db9111ead018eb36c7a6e8dc479ce7
SHA1 945452b00dcb3fbda8b48aba7c8a678a7812e71d
SHA512 1af08f8a75bed09a6ab5ad98fa91bdcf4bca71c29a157ec9482f40ab487739ec78b52f0fe1968b1b112e9c196929730c1cd4f2f334bcc4490855a4533bb42be3
SSDEEP 192:yON861VWQmiUyecgGX5Obd+j2jzoryXm0/aj3mDU6:yON86WsgGX5od+W8yUqDU6
TLSH
T18E02D835A8687CAB8EF2BE49B48737135FA92167EA552F84D6EC1B1C00D765C2306C37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 e393aa43ad7851697a05cefa9c00146e96620e553b1df856a8cdff3e2b0cc74d
MD5 eedc71f082c9bf9dd5c54fa8d5cfed34
SHA1 a980ffbf4b5d54cdcb61a6ecc5424102b9043114
SHA512 4bf7aed7a8b28f7401d87e8305ba7eadf586db304ae8146846efc63fe756bd68fe84db4193ef944737606b39e407523259b07a4d4271aeb19f105f1c11ed7363
TLSH
T198411C98B6F91148B3B76E569BF6686D447B7C372E0BD55E00110D4F4A32B41C871B37
MD5 SHA1 SHA512 TLSH

Submit Download

MSI3B10.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI3B10.tmp
Size 132KB
SHA256 7f47d98ab25cfea9b3a2e898c3376cc9ba1cd893b4948b0c27caa530fd0e34cc
MD5 cfbb8568bd3711a97e6124c56fcfa8d9
SHA1 d7a098ae58bdd5e93a3c1b04b3d69a14234d5e57
SHA512 860cbf3286ac4915580cefaf56a9c3d48938eb08e3f31b7f024c4339c037d7c8bdf16e766d08106505ba535be4922a87dc46bd029aae99a64ea2fc02cf3aec04
SSDEEP 3072:Kx2YbpcgwmiTPJDnCO+DATkURBnrskNwPj2:XXgwmY1CPx2XG2
TLSH
T1DBD39D02B5D0C473D9BE09390870DB229F7EB930DF909EDB636856699E702C19E35A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\org.arcfn.revertlauncher\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 d4e4fcbb28c7bea30482cc8511d532e3f43c79bea99d7e151c1e8c2f22e5570e
MD5 fe454e3f9deb9614ea3d5b08121f6f1f
SHA1 e0bddee79785362b6f441f0ae2d899d52da6647f
SHA512 d52436bc172525f032b38f86a971c0ebae06332d71b91e93e7f1e44694eccf9e2cf5e1bf05a6ca1e757459d667384afa86ec518e2bc62118d02a20b5463582cd
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\org.arcfn.revertlauncher\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 a5c0b7436f48e01f1aa4f77a4a63e4e2ddb9a8d351b2b9cc14963f7701e80778
MD5 88d950513f55ad69c86f3f9593eb7fce
SHA1 18fe803c374c00adc2d90e0d5c2c469a0469cdaa
SHA512 e54bbc13310b8588e72bb214be59b4f6ce6b4eca3ef7017d34b994c5f2065167829def93a385dc099dc31e208bf675dcf15688c9a74793ada95818bff87bfe2c
TLSH
T174D01216765111F4C01024330003664C0442DA2F9049414298289A1D2B080500902443
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\org.arcfn.revertlauncher\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\org.arcfn.revertlauncher\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\org.arcfn.revertlauncher\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\org.arcfn.revertlauncher\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\org.arcfn.revertlauncher\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\org.arcfn.revertlauncher\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\org.arcfn.revertlauncher\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\org.arcfn.revertlauncher\EBWebView\Local State
Size 16KB
SHA256 034fc90fbee67318898841266c793ed07d25a1f2bb7c2637ba9dda6d33b60e0c
MD5 ca872b0ba41398c977769860c6cf14c8
SHA1 9fe20c24d8e364643766e20459ce1ae97ab1ca16
SHA512 a143ddc39f01d78ade1c6ce5fab6d36fac3bca0c018683603118b9a9139a445eb855f8c0bc29081b8e442eee879f4f94218963e55a883a152a3d2e406d4b70b8
SSDEEP 192:zqfDFOKH/2/aQWjYhwZ00i+z/kNWIU6ZwNj1Jfo/iVQ45hgj4k6NbCUooDUhRjno:z0+aQikB+z/xvxjg/qhEmNb7uMS590f
TLSH
T12672AE3B54696A2399F3F54535190B8BDBB698B6C1C27EB849FD0F0C06CB7981302D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\org.arcfn.revertlauncher\EBWebView\Local State
Size 1KB
SHA256 b7fa0605ec7e8e9907fe526d52494f47d1a3a143afc13cea0b1953a77003fab4
MD5 8d230d9d4ee34d2deea8c776207fe842
SHA1 1290c35b6d17f5fc0e56e5dde63e48dfb8fcc946
SHA512 3ce6fcd28e1b1171e60a3163bc9948315e98cb9c6e215bb72a2b1ec683818e09dcba2da7772d6a49811cfd856f421eff7e51b26f1fb644dc96dc89f4fe08eac2
TLSH
T1903140F7A4A45B339D91A5467242AF532E636066C2614E48A1ED0B0C02FB78DF327C32
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\org.arcfn.revertlauncher\EBWebView\Local State
Size 2KB
SHA256 d8fdc27042cb5c819ecd88a0eb4b9efe840dcc8537de5ee1ce6022cbdf718b89
MD5 9742418618c2bce8fdb3c43f135f5bd0
SHA1 8df753633a5141ca1acaf360fad4c8edb6474134
SHA512 154ac8337cbe92d8fcdf082a15b3f148e10b162a9343f2acc118b36d3f54b403076c6eadd40096aef020c8e247aa0840b09d5de919c34313bf0353af805c4e37
TLSH
T10151A5B378549B338AE29944794A3F226E7761A6D6A12F5495ED0B0C01EB75C7303C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\org.arcfn.revertlauncher\EBWebView\Local State
Size 3KB
SHA256 866a089594a8b9ad50ba1f12e1d0cab53b0dd6be00cec0edda8354ee5ea18085
MD5 02f558686d5ef209ea36cce35dd0a497
SHA1 5713398a56e485621b3e1113d0829724758a3285
SHA512 f982f357cfa63d5421c97a3a8cec247dd64c967f27173848f20b2cf4c27a10cf5a24475b96d307b897e30625e50fa59d1778c1d82f59ba0e90a49193e90ecaf9
TLSH
T17B71B67B696496274EF2D945B8852F127BA76177D5E13F98C5EC0F0C01DB7982302C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe58a004.TMP

Path C:\Users\Admin\AppData\Local\org.arcfn.revertlauncher\EBWebView\Local State~RFe58a004.TMP
Size 1KB
SHA256 6aa3e43f17ce56bb3c6429b3ff8d0862d4c4f4b75203230e06ab35c6a283ba9a
MD5 9b4496de3f5a1f9d031eca61ce565a1f
SHA1 eae86dd54de7c725f3e38daa5a28ae61a8676932
SHA512 df59f4761a4ed19c9647b3f4f61cde013f02a1c0c8ab875a0235611ce7da88c51d4bfce8183d9db5aa76593e5fbaf3ee9a86ac67d869a3cb34a951773f078881
TLSH
T19B2162FBD4D55B33AA8198567242BF472E626176D2714E0CA1ED030C12EB69DE323C33
MD5 SHA1 SHA512 TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.1MB
SHA256 fdcecf91606acb7ae126cb3bc0fb9c02653f86e8f8b2fb3ddd18c7e976279151
MD5 8a2856d35826ab52193bdc53ee648a9d
SHA1 15a1c06ed4107144dea492bbdd460ebc7a6e1517
SHA512 e25f96c24bd153d859bba4efc603bc3b286ca8201090a169eb86d6b4df5867f99c0b38404cbd58d63d629c45c329eb1eeab1f4254c8c3dc9a99c90674b5fed86
SSDEEP 24576:Pu8m+1zidoO/vvTL7WBeU26FA4kDJFhitHmNjegl5Uqwe2YMYvlYpXqhU:2
TLSH
T11947D22432F92510E7F39E3CA8F1AA2389397D579C199E8D05411F4E0961FB1E872F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{5dd1e4a1-28e6-48ab-b284-310baac46337}_OnDiskSnapshotProp

Path \??\Volume{fef0c820-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{5dd1e4a1-28e6-48ab-b284-310baac46337}_OnDiskSnapshotProp
Size 6KB
SHA256 b8ccbb2b0f2e318eb9113b9142e9ddb1e343c937483ec6da10b0801d1d68dccd
MD5 f21020476626e6539c34b75280a7bd29
SHA1 3498f153bfed3ac09053033ec6417ffaab686a97
SHA512 4a2b8b09fa25544b3c7bdad35a2b6e791f883de9b403928c9fcde471333068a3b5e7e41e8f39fed0af8ea616d25a855e8eaea377150e6a95789f40b5e12597d7
SSDEEP 96:FMUMijlSvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:60+b++ZVmN
TLSH
T146D189085AF54711E2B3AB7228F14557A877B811EF33CB8E0198638E6670910F975F5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4268-320-0x00007FFEA9000000-0x00007FFEA9001000-memory.dmp

Download

memory/5512-432-0x00007FFEA9000000-0x00007FFEA9001000-memory.dmp

Download

memory/5628-349-0x00007FFEA8B40000-0x00007FFEA8B41000-memory.dmp

Download

memory/5628-350-0x00007FFEA8970000-0x00007FFEA8971000-memory.dmp

Download