354ab98a10767e73262dd2545115a3f1627d1c8d23ba74b873f32d6eae022202

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 17:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LogMeInIgnition.msi
Size 12.1MB
Sample260729-vs3prscj71
SHA256 354ab98a10767e73262dd2545115a3f1627d1c8d23ba74b873f32d6eae022202
MD5 d106135a73b7087d8a7b79d28c2243cf
SHA1 2d1eb75ccb7f19579efcbd87da10fc5634aaef4a
SHA512 0a9c91db8f886bc2178d42e2221228b331e1db28b56d2956e30bc2d22ab8db9a7c62951f645c5cbc27acd6ebcea07378d3d78bf7d37de40abd9bf92620e0efad
SSDEEP 196608:CwWEKLT21QHfGT8e3V0cN1QhsNAo1ZUBYnXkq/PMmamtqp7JKfFcjdJn2iIVW+qK:CJPeQRpcX1JASk05g4fUn2i+nqodrC
TLSH
T195D62353B040C97EC7790A70589BE69C417BFD145F38808FA25C7E692AB23411AEFE5B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery persistence privilege_escalation ransomware spyware

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 2 IoCs

pid	Process
5672	LMIIgnition.exe
1556	LMIGuardianSvc.exe

Loads dropped DLL 10 IoCs

pid	Process
3776	MsiExec.exe
3776	MsiExec.exe
3776	MsiExec.exe
3776	MsiExec.exe
2416	MsiExec.exe
3532	MsiExec.exe
3532	MsiExec.exe
3532	MsiExec.exe
3532	MsiExec.exe
1556	LMIGuardianSvc.exe

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	3728	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\LogMeIn Ignition\RACtrlKeyHook.dll	msiexec.exe
File created	C:\Program Files (x86)\LogMeIn Ignition\webview.dll	msiexec.exe
File created	C:\Program Files (x86)\LogMeIn Ignition\WebView2Loader.dll	msiexec.exe
File created	C:\Program Files (x86)\LogMeIn Ignition\LMIGuardianSvc.exe	msiexec.exe
File created	C:\Program Files (x86)\LogMeIn Ignition\RACtrl.dll	msiexec.exe
File created	C:\Program Files (x86)\LogMeIn Ignition\LMIGuardianDll.dll	msiexec.exe
File created	C:\Program Files (x86)\LogMeIn Ignition\LMIGuardianEvt.dll	msiexec.exe
File created	C:\Program Files (x86)\LogMeIn Ignition\LMIIgnition.exe	msiexec.exe
File created	C:\Program Files (x86)\LogMeIn Ignition\lmiquic.dll	msiexec.exe
File created	C:\Program Files (x86)\LogMeIn Ignition\LMIProxyHelper.exe	msiexec.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_605918428\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_605918428\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_605918428\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_605918428\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_605918428\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_605918428\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_605918428\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_605918428\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_605918428\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_605918428\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_605918428\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_605918428\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_605918428\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_368662116\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_605918428\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_605918428\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_605918428\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_605918428\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_605918428\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_605918428\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\~DFEC9A3BCA6FF062AD.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_605918428\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_605918428\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_605918428\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_605918428\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_605918428\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\~DFFA5FB6312612A06D.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_605918428\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_605918428\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_605918428\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_605918428\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFE1E0CD9D5CB77744.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_605918428\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_605918428\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_605918428\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_605918428\_locales\zu\messages.json	msedge.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1BCB.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_605918428\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_605918428\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_605918428\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_605918428\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_605918428\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_605918428\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_605918428\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_605918428\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_605918428\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_605918428\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_605918428\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_605918428\128.png	msedge.exe
File opened for modification	C:\Windows\Installer\{58494D61-79DE-4A0B-9816-B919B70366A2}\AppIcon.ico	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_605918428\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_605918428\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_605918428\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_864678647\manifest.json	msedge.exe
File opened for modification	C:\Windows\Installer\MSI16A8.tmp	msiexec.exe
File created	C:\Windows\Installer\{58494D61-79DE-4A0B-9816-B919B70366A2}\AppIcon.ico	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_605918428\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_605918428\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_605918428\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_605918428\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_605918428\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_605918428\_locales\lo\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
3728	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LMIIgnition.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LMIGuardianSvc.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1484	msedge.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000067831fc6f5c7bf350000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c012000000000000000000000000270101000088380167831fc60000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e8410167831fc6000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e367831fc600000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e667831fc600000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\LMIIgnition.exe = "11000"	MsiExec.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134298190204347379"	msedge.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B681B6DD-FF29-4107-BDED-5EF0DF48DFEC}\ = "IIgnitionApp"	LMIIgnition.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\16D49485ED97B0A489619B917B30662A\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Ignition.IgnitionApp\CLSID	LMIIgnition.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\AppID\{E497EDC0-AEDD-4252-8DC9-FC356FB414E7}\ = "LMIIgnition"	LMIIgnition.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\TypeLib\{063841EF-13C8-44E7-A3FC-1BFEB559E153}\1.0\ = "Ignition 1.0 Type Library"	LMIIgnition.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\WOW6432Node\Interface\{B681B6DD-FF29-4107-BDED-5EF0DF48DFEC}\TypeLib\Version = "1.0"	LMIIgnition.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B681B6DD-FF29-4107-BDED-5EF0DF48DFEC}\TypeLib\ = "{063841EF-13C8-44E7-A3FC-1BFEB559E153}"	LMIIgnition.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\16D49485ED97B0A489619B917B30662A\PackageCode = "C14BF994A157F8D4FA151D8375EECC05"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\16D49485ED97B0A489619B917B30662A\Version = "16979516"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Ignition.IgnitionApp.1\CLSID\ = "{B2C192C7-4005-4A8A-8485-BC7932DE3800}"	LMIIgnition.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\WOW6432Node\CLSID\{B2C192C7-4005-4A8A-8485-BC7932DE3800}\ = "IgnitionApp Class"	LMIIgnition.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\TypeLib\{063841EF-13C8-44E7-A3FC-1BFEB559E153}\1.0	LMIIgnition.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\TypeLib\{063841EF-13C8-44E7-A3FC-1BFEB559E153}\1.0\0	LMIIgnition.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\WOW6432Node\Interface\{B681B6DD-FF29-4107-BDED-5EF0DF48DFEC}\TypeLib\ = "{063841EF-13C8-44E7-A3FC-1BFEB559E153}"	LMIIgnition.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\16D49485ED97B0A489619B917B30662A\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\16D49485ED97B0A489619B917B30662A\SourceList\PackageName = "LogMeInIgnition.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\16D49485ED97B0A489619B917B30662A\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\logmein\shell\open	LMIIgnition.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Ignition.IgnitionApp\ = "IgnitionApp Class"	LMIIgnition.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\WOW6432Node\CLSID\{B2C192C7-4005-4A8A-8485-BC7932DE3800}\LocalServer32\ = "\"C:\\Program Files (x86)\\LogMeIn Ignition\\LMIIgnition.exe\""	LMIIgnition.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\TypeLib\{063841EF-13C8-44E7-A3FC-1BFEB559E153}\1.0\FLAGS	LMIIgnition.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Ignition.IgnitionApp.1\CLSID	LMIIgnition.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\WOW6432Node\CLSID\{B2C192C7-4005-4A8A-8485-BC7932DE3800}\TypeLib\ = "{063841EF-13C8-44E7-A3FC-1BFEB559E153}"	LMIIgnition.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\TypeLib\{063841EF-13C8-44E7-A3FC-1BFEB559E153}	LMIIgnition.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\WOW6432Node\Interface\{B681B6DD-FF29-4107-BDED-5EF0DF48DFEC}	LMIIgnition.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B681B6DD-FF29-4107-BDED-5EF0DF48DFEC}	LMIIgnition.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B681B6DD-FF29-4107-BDED-5EF0DF48DFEC}\ProxyStubClsid32	LMIIgnition.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\WOW6432Node\CLSID\{B2C192C7-4005-4A8A-8485-BC7932DE3800}\AppID = "{E497EDC0-AEDD-4252-8DC9-FC356FB414E7}"	LMIIgnition.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\AppID\{E497EDC0-AEDD-4252-8DC9-FC356FB414E7}	LMIIgnition.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\16D49485ED97B0A489619B917B30662A\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\logmein\shell	LMIIgnition.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Ignition.IgnitionApp\CurVer\ = "Ignition.IgnitionApp.1"	LMIIgnition.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\TypeLib\{063841EF-13C8-44E7-A3FC-1BFEB559E153}\1.0\HELPDIR	LMIIgnition.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\WOW6432Node\Interface\{B681B6DD-FF29-4107-BDED-5EF0DF48DFEC}\ProxyStubClsid32	LMIIgnition.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\D5B8CBF1891B6A34AADDFB334E64038F\16D49485ED97B0A489619B917B30662A	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\16D49485ED97B0A489619B917B30662A\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Ignition.IgnitionApp	LMIIgnition.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Ignition.IgnitionApp\CLSID\ = "{B2C192C7-4005-4A8A-8485-BC7932DE3800}"	LMIIgnition.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\WOW6432Node\CLSID\{B2C192C7-4005-4A8A-8485-BC7932DE3800}\ProgID\ = "Ignition.IgnitionApp.1"	LMIIgnition.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\WOW6432Node\Interface\{B681B6DD-FF29-4107-BDED-5EF0DF48DFEC}\ProxyStubClsid	LMIIgnition.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\WOW6432Node\Interface\{B681B6DD-FF29-4107-BDED-5EF0DF48DFEC}\TypeLib	LMIIgnition.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B681B6DD-FF29-4107-BDED-5EF0DF48DFEC}\TypeLib\Version = "1.0"	LMIIgnition.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\16D49485ED97B0A489619B917B30662A\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\16D49485ED97B0A489619B917B30662A\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\16D49485ED97B0A489619B917B30662A\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\AppID\LMIIgnition.EXE\AppID = "{E497EDC0-AEDD-4252-8DC9-FC356FB414E7}"	LMIIgnition.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\16D49485ED97B0A489619B917B30662A\SourceList	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Ignition.IgnitionApp\CurVer	LMIIgnition.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\AppID\{E497EDC0-AEDD-4252-8DC9-FC356FB414E7}\LocalServer32 = "LMIIgnition"	LMIIgnition.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B681B6DD-FF29-4107-BDED-5EF0DF48DFEC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	LMIIgnition.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\16D49485ED97B0A489619B917B30662A\Complete	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\16D49485ED97B0A489619B917B30662A\ProductName = "LogMeIn Client"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\TypeLib\{063841EF-13C8-44E7-A3FC-1BFEB559E153}\1.0\0\win32\ = "C:\\Program Files (x86)\\LogMeIn Ignition\\LMIIgnition.exe"	LMIIgnition.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\logmein\ = "URL:LogMeIn Remote Control Protocol"	LMIIgnition.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\logmein\URL Protocol	LMIIgnition.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\TypeLib\{063841EF-13C8-44E7-A3FC-1BFEB559E153}\1.0\HELPDIR\	LMIIgnition.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\16D49485ED97B0A489619B917B30662A	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\16D49485ED97B0A489619B917B30662A\SourceList\Media	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Ignition.IgnitionApp.1	LMIIgnition.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\TypeLib\{063841EF-13C8-44E7-A3FC-1BFEB559E153}\1.0\0\win32	LMIIgnition.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\WOW6432Node\Interface\{B681B6DD-FF29-4107-BDED-5EF0DF48DFEC}\ = "IIgnitionApp"	LMIIgnition.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B681B6DD-FF29-4107-BDED-5EF0DF48DFEC}\TypeLib	LMIIgnition.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\AppID\LMIIgnition.EXE	LMIIgnition.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\16D49485ED97B0A489619B917B30662A	msiexec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4968	msiexec.exe
4968	msiexec.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 38 IoCs

pid	Process
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3728	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3728	msiexec.exe
Token: SeSecurityPrivilege	4968	msiexec.exe
Token: SeCreateTokenPrivilege	3728	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3728	msiexec.exe
Token: SeLockMemoryPrivilege	3728	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3728	msiexec.exe
Token: SeMachineAccountPrivilege	3728	msiexec.exe
Token: SeTcbPrivilege	3728	msiexec.exe
Token: SeSecurityPrivilege	3728	msiexec.exe
Token: SeTakeOwnershipPrivilege	3728	msiexec.exe
Token: SeLoadDriverPrivilege	3728	msiexec.exe
Token: SeSystemProfilePrivilege	3728	msiexec.exe
Token: SeSystemtimePrivilege	3728	msiexec.exe
Token: SeProfSingleProcessPrivilege	3728	msiexec.exe
Token: SeIncBasePriorityPrivilege	3728	msiexec.exe
Token: SeCreatePagefilePrivilege	3728	msiexec.exe
Token: SeCreatePermanentPrivilege	3728	msiexec.exe
Token: SeBackupPrivilege	3728	msiexec.exe
Token: SeRestorePrivilege	3728	msiexec.exe
Token: SeShutdownPrivilege	3728	msiexec.exe
Token: SeDebugPrivilege	3728	msiexec.exe
Token: SeAuditPrivilege	3728	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3728	msiexec.exe
Token: SeChangeNotifyPrivilege	3728	msiexec.exe
Token: SeRemoteShutdownPrivilege	3728	msiexec.exe
Token: SeUndockPrivilege	3728	msiexec.exe
Token: SeSyncAgentPrivilege	3728	msiexec.exe
Token: SeEnableDelegationPrivilege	3728	msiexec.exe
Token: SeManageVolumePrivilege	3728	msiexec.exe
Token: SeImpersonatePrivilege	3728	msiexec.exe
Token: SeCreateGlobalPrivilege	3728	msiexec.exe
Token: SeCreateTokenPrivilege	3728	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3728	msiexec.exe
Token: SeLockMemoryPrivilege	3728	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3728	msiexec.exe
Token: SeMachineAccountPrivilege	3728	msiexec.exe
Token: SeTcbPrivilege	3728	msiexec.exe
Token: SeSecurityPrivilege	3728	msiexec.exe
Token: SeTakeOwnershipPrivilege	3728	msiexec.exe
Token: SeLoadDriverPrivilege	3728	msiexec.exe
Token: SeSystemProfilePrivilege	3728	msiexec.exe
Token: SeSystemtimePrivilege	3728	msiexec.exe
Token: SeProfSingleProcessPrivilege	3728	msiexec.exe
Token: SeIncBasePriorityPrivilege	3728	msiexec.exe
Token: SeCreatePagefilePrivilege	3728	msiexec.exe
Token: SeCreatePermanentPrivilege	3728	msiexec.exe
Token: SeBackupPrivilege	3728	msiexec.exe
Token: SeRestorePrivilege	3728	msiexec.exe
Token: SeShutdownPrivilege	3728	msiexec.exe
Token: SeDebugPrivilege	3728	msiexec.exe
Token: SeAuditPrivilege	3728	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3728	msiexec.exe
Token: SeChangeNotifyPrivilege	3728	msiexec.exe
Token: SeRemoteShutdownPrivilege	3728	msiexec.exe
Token: SeUndockPrivilege	3728	msiexec.exe
Token: SeSyncAgentPrivilege	3728	msiexec.exe
Token: SeEnableDelegationPrivilege	3728	msiexec.exe
Token: SeManageVolumePrivilege	3728	msiexec.exe
Token: SeImpersonatePrivilege	3728	msiexec.exe
Token: SeCreateGlobalPrivilege	3728	msiexec.exe
Token: SeCreateTokenPrivilege	3728	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3728	msiexec.exe
Token: SeLockMemoryPrivilege	3728	msiexec.exe

Suspicious use of FindShellTrayWindow 19 IoCs

pid	Process
3728	msiexec.exe
3728	msiexec.exe
4244	msedge.exe
5672	LMIIgnition.exe
5672	LMIIgnition.exe
5672	LMIIgnition.exe
5672	LMIIgnition.exe
5672	LMIIgnition.exe
5672	LMIIgnition.exe
5672	LMIIgnition.exe
5672	LMIIgnition.exe
5672	LMIIgnition.exe
5672	LMIIgnition.exe
5672	LMIIgnition.exe
5672	LMIIgnition.exe
5672	LMIIgnition.exe
5672	LMIIgnition.exe
5672	LMIIgnition.exe
5672	LMIIgnition.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5672	LMIIgnition.exe
5672	LMIIgnition.exe
5672	LMIIgnition.exe
5672	LMIIgnition.exe
5672	LMIIgnition.exe
5672	LMIIgnition.exe
5672	LMIIgnition.exe
5672	LMIIgnition.exe
5672	LMIIgnition.exe
5672	LMIIgnition.exe
5672	LMIIgnition.exe
5672	LMIIgnition.exe
5672	LMIIgnition.exe
5672	LMIIgnition.exe
5672	LMIIgnition.exe
5672	LMIIgnition.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
3728	msiexec.exe
4968	msiexec.exe
3776	MsiExec.exe
2416	MsiExec.exe
3532	MsiExec.exe
5672	LMIIgnition.exe
5672	LMIIgnition.exe
5672	LMIIgnition.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4968 wrote to memory of 3776	4968	msiexec.exe	90
PID 4968 wrote to memory of 4724	4968	msiexec.exe	97
PID 4968 wrote to memory of 2416	4968	msiexec.exe	99
PID 4968 wrote to memory of 3532	4968	msiexec.exe	100
PID 3728 wrote to memory of 5672	3728	msiexec.exe	102
PID 5672 wrote to memory of 1556	5672	LMIIgnition.exe	103
PID 5672 wrote to memory of 4244	5672	LMIIgnition.exe	104
PID 4244 wrote to memory of 1404	4244	msedge.exe	105
PID 4244 wrote to memory of 5504	4244	msedge.exe	106
PID 4244 wrote to memory of 1484	4244	msedge.exe	107
PID 4244 wrote to memory of 5504	4244	msedge.exe	106
PID 4244 wrote to memory of 5504	4244	msedge.exe	106
PID 4244 wrote to memory of 3372	4244	msedge.exe	108
PID 4244 wrote to memory of 3372	4244	msedge.exe	108
PID 4244 wrote to memory of 3140	4244	msedge.exe	124
PID 4244 wrote to memory of 3140	4244	msedge.exe	124
PID 4244 wrote to memory of 3140	4244	msedge.exe	124
PID 4244 wrote to memory of 2704	4244	msedge.exe	111
PID 4244 wrote to memory of 2704	4244	msedge.exe	111
PID 4244 wrote to memory of 2704	4244	msedge.exe	111
PID 4244 wrote to memory of 4180	4244	msedge.exe	112
PID 4244 wrote to memory of 4276	4244	msedge.exe	113
PID 4244 wrote to memory of 4180	4244	msedge.exe	112
PID 4244 wrote to memory of 4180	4244	msedge.exe	112
PID 4244 wrote to memory of 4276	4244	msedge.exe	113
PID 4244 wrote to memory of 4276	4244	msedge.exe	113
PID 4244 wrote to memory of 1084	4244	msedge.exe	115
PID 4244 wrote to memory of 1084	4244	msedge.exe	115
PID 5672 wrote to memory of 2316	5672	LMIIgnition.exe	116
PID 4244 wrote to memory of 5224	4244	msedge.exe	117
PID 4244 wrote to memory of 5224	4244	msedge.exe	117
PID 4244 wrote to memory of 5224	4244	msedge.exe	117
PID 4244 wrote to memory of 832	4244	msedge.exe	118
PID 4244 wrote to memory of 832	4244	msedge.exe	118
PID 4244 wrote to memory of 692	4244	msedge.exe	119
PID 4244 wrote to memory of 832	4244	msedge.exe	118
PID 4244 wrote to memory of 692	4244	msedge.exe	119
PID 4244 wrote to memory of 692	4244	msedge.exe	119
PID 4244 wrote to memory of 5924	4244	msedge.exe	121
PID 4244 wrote to memory of 3140	4244	msedge.exe	124
PID 4244 wrote to memory of 4948	4244	msedge.exe	125
PID 4244 wrote to memory of 5028	4244	msedge.exe	126
PID 4244 wrote to memory of 3140	4244	msedge.exe	124
PID 4244 wrote to memory of 4948	4244	msedge.exe	125
PID 4244 wrote to memory of 5028	4244	msedge.exe	126
PID 4244 wrote to memory of 5028	4244	msedge.exe	126
PID 4244 wrote to memory of 4456	4244	msedge.exe	127
PID 4244 wrote to memory of 2920	4244	msedge.exe	128
PID 4244 wrote to memory of 4456	4244	msedge.exe	127
PID 4244 wrote to memory of 2920	4244	msedge.exe	128
PID 4244 wrote to memory of 2656	4244	msedge.exe	129
PID 4244 wrote to memory of 2656	4244	msedge.exe	129
PID 4244 wrote to memory of 1052	4244	msedge.exe	130
PID 4244 wrote to memory of 1052	4244	msedge.exe	130
PID 5672 wrote to memory of 6084	5672	LMIIgnition.exe	131
PID 4244 wrote to memory of 4212	4244	msedge.exe	132
PID 4244 wrote to memory of 4212	4244	msedge.exe	132
PID 4244 wrote to memory of 4212	4244	msedge.exe	132
PID 4244 wrote to memory of 5484	4244	msedge.exe	133
PID 4244 wrote to memory of 5484	4244	msedge.exe	133
PID 4244 wrote to memory of 5484	4244	msedge.exe	133
PID 5672 wrote to memory of 5244	5672	LMIIgnition.exe	134
PID 4244 wrote to memory of 4696	4244	msedge.exe	135
PID 4244 wrote to memory of 4696	4244	msedge.exe	135

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\LogMeInIgnition.msi
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3728
- C:\Program Files (x86)\LogMeIn Ignition\LMIIgnition.exe
  "C:\Program Files (x86)\LogMeIn Ignition\LMIIgnition.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5672
- - C:\Program Files (x86)\LogMeIn Ignition\LMIGuardianSvc.exe
    "C:\Program Files (x86)\LogMeIn Ignition\LMIGuardianSvc.exe" /escort 5672
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:1556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://secure.logmein.com/backend/public/device/user-login?login_token=8eb23912-89ca-4a35-9c12-6182356a5320&lang=en
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffdf06cc188,0x7ffdf06cc194,0x7ffdf06cc1a0
      4⤵
      PID:1404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,8176979810370472164,17858832928379145334,262144 --field-trial-handle=2324,i,8473173507665333156,15903990938990834589,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:2
      4⤵
      PID:5504
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1888,i,8234178282961165500,15150635390352922237,524288 --field-trial-handle=2324,i,8473173507665333156,15903990938990834589,262144 --variations-seed-version --mojo-platform-channel-handle=2932 /prefetch:11
      4⤵
      System Time Discovery
      PID:1484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2460,i,11773211965636761615,16393322823205725639,524288 --field-trial-handle=2324,i,8473173507665333156,15903990938990834589,262144 --variations-seed-version --mojo-platform-channel-handle=2864 /prefetch:13
      4⤵
      PID:3372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=2504,i,8983909968755272890,17675547449984447361,2097152 --field-trial-handle=2324,i,8473173507665333156,15903990938990834589,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
      4⤵
      PID:3140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3408,i,10148101457383855781,6887223376967127463,2097152 --field-trial-handle=2324,i,8473173507665333156,15903990938990834589,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:1
      4⤵
      PID:2704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4208,i,13697273394332447691,7703040894730010932,2097152 --field-trial-handle=2324,i,8473173507665333156,15903990938990834589,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:1
      4⤵
      PID:4180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4196,i,4623787393942306121,3691766880620107349,2097152 --field-trial-handle=2324,i,8473173507665333156,15903990938990834589,262144 --variations-seed-version --mojo-platform-channel-handle=2456 /prefetch:9
      4⤵
      PID:4276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3700,i,15434187533787771370,5362505704297667741,524288 --field-trial-handle=2324,i,8473173507665333156,15903990938990834589,262144 --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:14
      4⤵
      PID:1084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5244,i,1108409622004930982,2782833959825558339,2097152 --field-trial-handle=2324,i,8473173507665333156,15903990938990834589,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:1
      4⤵
      PID:5224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5328,i,3980550342063550900,4972333604626809234,2097152 --field-trial-handle=2324,i,8473173507665333156,15903990938990834589,262144 --variations-seed-version --mojo-platform-channel-handle=3744 /prefetch:1
      4⤵
      PID:832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5476,i,7225688495450470077,12373877074310134864,2097152 --field-trial-handle=2324,i,8473173507665333156,15903990938990834589,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:1
      4⤵
      PID:692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6288,i,13383311218134534043,17902507361565169272,524288 --field-trial-handle=2324,i,8473173507665333156,15903990938990834589,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:14
      4⤵
      PID:6004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6288,i,13383311218134534043,17902507361565169272,524288 --field-trial-handle=2324,i,8473173507665333156,15903990938990834589,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:14
      4⤵
      PID:5924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5768,i,14645879881679345246,16892788445712472976,524288 --field-trial-handle=2324,i,8473173507665333156,15903990938990834589,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:14
      4⤵
      PID:3140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3660,i,7418875467964844578,3497646953455259562,524288 --field-trial-handle=2324,i,8473173507665333156,15903990938990834589,262144 --variations-seed-version --mojo-platform-channel-handle=6616 /prefetch:14
      4⤵
      PID:4948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5784,i,17174978964265479854,9002532464742028718,2097152 --field-trial-handle=2324,i,8473173507665333156,15903990938990834589,262144 --variations-seed-version --mojo-platform-channel-handle=6768 /prefetch:1
      4⤵
      PID:5028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6360,i,1547783582608079965,12704585667923022105,524288 --field-trial-handle=2324,i,8473173507665333156,15903990938990834589,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:14
      4⤵
      PID:4456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6476,i,2790204007685294905,75301827571601787,524288 --field-trial-handle=2324,i,8473173507665333156,15903990938990834589,262144 --variations-seed-version --mojo-platform-channel-handle=6808 /prefetch:14
      4⤵
      PID:2920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6484,i,16991796459432913880,5736170951181284099,524288 --field-trial-handle=2324,i,8473173507665333156,15903990938990834589,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:14
      4⤵
      PID:2656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7416,i,4140355950238703432,17859629504959079337,524288 --field-trial-handle=2324,i,8473173507665333156,15903990938990834589,262144 --variations-seed-version --mojo-platform-channel-handle=7408 /prefetch:14
      4⤵
      PID:1052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6364,i,10553256041388870219,7735946395444224015,2097152 --field-trial-handle=2324,i,8473173507665333156,15903990938990834589,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
      4⤵
      PID:4212
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=5428,i,6304799376286644785,1908677838162614484,2097152 --field-trial-handle=2324,i,8473173507665333156,15903990938990834589,262144 --variations-seed-version --mojo-platform-channel-handle=6760 /prefetch:1
      4⤵
      PID:5484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=2836,i,17359725000480315762,9874236401814990557,2097152 --field-trial-handle=2324,i,8473173507665333156,15903990938990834589,262144 --variations-seed-version --mojo-platform-channel-handle=6772 /prefetch:1
      4⤵
      PID:4696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=6992,i,3052717184252630007,7774496428147821750,2097152 --field-trial-handle=2324,i,8473173507665333156,15903990938990834589,262144 --variations-seed-version --mojo-platform-channel-handle=7428 /prefetch:1
      4⤵
      PID:4204
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=6404,i,3311202112559626377,3559871340950695817,2097152 --field-trial-handle=2324,i,8473173507665333156,15903990938990834589,262144 --variations-seed-version --mojo-platform-channel-handle=7244 /prefetch:1
      4⤵
      PID:5116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=4220,i,4751966840324424511,11981851451860702148,2097152 --field-trial-handle=2324,i,8473173507665333156,15903990938990834589,262144 --variations-seed-version --mojo-platform-channel-handle=4408 /prefetch:1
      4⤵
      PID:4592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=7308,i,1856020734614734247,14950004049054176731,2097152 --field-trial-handle=2324,i,8473173507665333156,15903990938990834589,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:1
      4⤵
      PID:5760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=7284,i,3503259330653861644,12059419591882098621,2097152 --field-trial-handle=2324,i,8473173507665333156,15903990938990834589,262144 --variations-seed-version --mojo-platform-channel-handle=7332 /prefetch:1
      4⤵
      PID:4204
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4408,i,5260469934786592024,12405232234969549043,524288 --field-trial-handle=2324,i,8473173507665333156,15903990938990834589,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:14
      4⤵
      PID:4292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3636,i,10846991788507623849,18262720469299616828,524288 --field-trial-handle=2324,i,8473173507665333156,15903990938990834589,262144 --variations-seed-version --mojo-platform-channel-handle=6524 /prefetch:14
      4⤵
      PID:3332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4564,i,1711740761270688352,6685609354559704269,524288 --field-trial-handle=2324,i,8473173507665333156,15903990938990834589,262144 --variations-seed-version --mojo-platform-channel-handle=4588 /prefetch:14
      4⤵
      PID:5720
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=5756,i,2722869601068465245,7402890134775151044,2097152 --field-trial-handle=2324,i,8473173507665333156,15903990938990834589,262144 --variations-seed-version --mojo-platform-channel-handle=2752 /prefetch:1
      4⤵
      PID:5948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=7336,i,1294759676878696696,15634734420190718218,2097152 --field-trial-handle=2324,i,8473173507665333156,15903990938990834589,262144 --variations-seed-version --mojo-platform-channel-handle=4568 /prefetch:1
      4⤵
      PID:1924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=7204,i,14528401803115914528,3579736315898640111,2097152 --field-trial-handle=2324,i,8473173507665333156,15903990938990834589,262144 --variations-seed-version --mojo-platform-channel-handle=7192 /prefetch:1
      4⤵
      PID:6056
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=4544,i,6971963023691315774,8359443755596779765,2097152 --field-trial-handle=2324,i,8473173507665333156,15903990938990834589,262144 --variations-seed-version --mojo-platform-channel-handle=7744 /prefetch:1
      4⤵
      PID:3604
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=7876,i,12497892355370095005,8821297862578397775,2097152 --field-trial-handle=2324,i,8473173507665333156,15903990938990834589,262144 --variations-seed-version --mojo-platform-channel-handle=4532 /prefetch:1
      4⤵
      PID:2196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=6148,i,7224587453627408969,1218848085705649521,2097152 --field-trial-handle=2324,i,8473173507665333156,15903990938990834589,262144 --variations-seed-version --mojo-platform-channel-handle=7676 /prefetch:1
      4⤵
      PID:4236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=7720,i,17021602731953280314,18110204796316329888,2097152 --field-trial-handle=2324,i,8473173507665333156,15903990938990834589,262144 --variations-seed-version --mojo-platform-channel-handle=4544 /prefetch:1
      4⤵
      PID:4432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=8072,i,4836507199586866621,17831371922077023190,2097152 --field-trial-handle=2324,i,8473173507665333156,15903990938990834589,262144 --variations-seed-version --mojo-platform-channel-handle=7768 /prefetch:1
      4⤵
      PID:1924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=7676,i,8078989383688745851,3278416224101761290,2097152 --field-trial-handle=2324,i,8473173507665333156,15903990938990834589,262144 --variations-seed-version --mojo-platform-channel-handle=7828 /prefetch:1
      4⤵
      PID:5840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=8252,i,17062793853030724879,14611017746411754083,2097152 --field-trial-handle=2324,i,8473173507665333156,15903990938990834589,262144 --variations-seed-version --mojo-platform-channel-handle=8280 /prefetch:1
      4⤵
      PID:2888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8464,i,9819650255664120995,5285077455435949146,524288 --field-trial-handle=2324,i,8473173507665333156,15903990938990834589,262144 --variations-seed-version --mojo-platform-channel-handle=8460 /prefetch:14
      4⤵
      PID:3780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=6232,i,5565332265456115019,2188626148438796142,2097152 --field-trial-handle=2324,i,8473173507665333156,15903990938990834589,262144 --variations-seed-version --mojo-platform-channel-handle=8680 /prefetch:1
      4⤵
      PID:6520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=8720,i,1761230384674072083,9793793567751676119,2097152 --field-trial-handle=2324,i,8473173507665333156,15903990938990834589,262144 --variations-seed-version --mojo-platform-channel-handle=8704 /prefetch:1
      4⤵
      PID:6612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=8380,i,13254424574572971097,3406266106691559491,2097152 --field-trial-handle=2324,i,8473173507665333156,15903990938990834589,262144 --variations-seed-version --mojo-platform-channel-handle=8736 /prefetch:1
      4⤵
      PID:6936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=8316,i,2189743289426721360,12091246680711129129,2097152 --field-trial-handle=2324,i,8473173507665333156,15903990938990834589,262144 --variations-seed-version --mojo-platform-channel-handle=8944 /prefetch:1
      4⤵
      PID:7028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8892,i,8062688413331621320,11482926781553824663,524288 --field-trial-handle=2324,i,8473173507665333156,15903990938990834589,262144 --variations-seed-version --mojo-platform-channel-handle=8208 /prefetch:14
      4⤵
      PID:4236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=9044,i,7469188644378885884,976632398658798107,2097152 --field-trial-handle=2324,i,8473173507665333156,15903990938990834589,262144 --variations-seed-version --mojo-platform-channel-handle=9076 /prefetch:1
      4⤵
      PID:6488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=8860,i,5197999242967415189,16523439477173425133,2097152 --field-trial-handle=2324,i,8473173507665333156,15903990938990834589,262144 --variations-seed-version --mojo-platform-channel-handle=8804 /prefetch:1
      4⤵
      PID:6640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=9008,i,12817616751756678761,104467322965353731,2097152 --field-trial-handle=2324,i,8473173507665333156,15903990938990834589,262144 --variations-seed-version --mojo-platform-channel-handle=8908 /prefetch:1
      4⤵
      PID:3364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=9276,i,9811664058322832346,11337007305005272119,2097152 --field-trial-handle=2324,i,8473173507665333156,15903990938990834589,262144 --variations-seed-version --mojo-platform-channel-handle=9036 /prefetch:1
      4⤵
      PID:7044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8740,i,6644159680060252597,153989713615374866,524288 --field-trial-handle=2324,i,8473173507665333156,15903990938990834589,262144 --variations-seed-version --mojo-platform-channel-handle=8820 /prefetch:14
      4⤵
      PID:6684
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --always-read-main-dll --metrics-shmem-handle=9104,i,7110778582517183172,17307863090803988547,2097152 --field-trial-handle=2324,i,8473173507665333156,15903990938990834589,262144 --variations-seed-version --mojo-platform-channel-handle=8720 /prefetch:1
      4⤵
      PID:7148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --always-read-main-dll --metrics-shmem-handle=9492,i,17903474162226526190,8837059682575079462,2097152 --field-trial-handle=2324,i,8473173507665333156,15903990938990834589,262144 --variations-seed-version --mojo-platform-channel-handle=8888 /prefetch:1
      4⤵
      PID:6856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --always-read-main-dll --metrics-shmem-handle=9268,i,2999588580860292264,7639853103885503318,2097152 --field-trial-handle=2324,i,8473173507665333156,15903990938990834589,262144 --variations-seed-version --mojo-platform-channel-handle=8940 /prefetch:1
      4⤵
      PID:6500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://secure.logmein.com/backend/public/device/user-login?login_token=7502f987-3d3e-46e1-bfb4-8e3d55b9fb74&lang=en
    3⤵
    PID:2316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://secure.logmein.com/backend/public/device/user-login?login_token=fee693bb-e1f0-4423-8eba-ebefd7690588&lang=en
    3⤵
    PID:6084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://secure.logmein.com/backend/public/device/user-login?login_token=f5a224a5-1572-44f2-a372-a547c7793c89&lang=en
    3⤵
    PID:5244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://secure.logmein.com/backend/public/device/user-login?login_token=0be9eecf-b4a1-469c-bf47-c60d5e28db31&lang=en
    3⤵
    PID:2140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://secure.logmein.com/backend/public/device/user-login?login_token=053eeda6-d456-4384-8da1-fd9d71b69814&lang=en
    3⤵
    PID:4276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://secure.logmein.com/backend/public/device/user-login?login_token=218d23b4-2182-41ab-b568-967c3cfc879b&lang=en
    3⤵
    PID:2904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://secure.logmein.com/backend/public/device/user-login?login_token=741d8ca2-4658-4e37-809f-16e051105429&lang=en
    3⤵
    PID:2196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://secure.logmein.com/backend/public/device/user-login?login_token=655818a7-227e-4b79-80b0-6fbeba621503&lang=en
    3⤵
    PID:6132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://secure.logmein.com/backend/public/device/user-login?login_token=f21f99a2-0bd2-4888-aad1-3b591bbb6b93&lang=en
    3⤵
    PID:5704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://secure.logmein.com/backend/public/device/user-login?login_token=77d5a146-1f5a-4825-b845-b894778fe244&lang=en
    3⤵
    PID:5492
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://secure.logmein.com/backend/public/device/user-login?login_token=c0c601f7-8b6b-4000-a80b-847d143622e7&lang=en
    3⤵
    PID:6508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://secure.logmein.com/backend/public/device/user-login?login_token=44ef12c5-7f41-4fdf-b45a-5384c082fbbb&lang=en
    3⤵
    PID:6920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://secure.logmein.com/backend/public/device/user-login?login_token=39148cdc-665c-4394-855a-1205a7f45aec&lang=en
    3⤵
    PID:6424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://secure.logmein.com/backend/public/device/user-login?login_token=8eb36ec0-20ac-4ff1-8a7c-0ddfa6e6c7cb&lang=en
    3⤵
    PID:6888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://secure.logmein.com/backend/public/device/user-login?login_token=b30e7e6f-01f5-4fb0-89ac-07a2e77a30fd&lang=en
    3⤵
    PID:5492
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://secure.logmein.com/backend/public/device/user-login?login_token=c37622ec-a653-46a8-920b-4d1f1c440902&lang=en
    3⤵
    PID:4260

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4968
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding D1DFD5A115987E7E78CC5ED2783C12CE C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3776
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:4724
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding A2EC27DE26CD4C5CBB0302991C7DC445
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2416
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 4E8B7A6DE491F869DE997AE6C2A6509D E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3532

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1672

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:5172

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1468

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:476

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5a0e1c.rbs

Path C:\Config.Msi\e5a0e1c.rbs
Size 11KB
SHA256 cf1c0411555b656578e15ca8e9c6a90c234d3fd5e0c34d4383a4593cdfbc5f8d
MD5 efbf510478a33c0ca4791d72e4077d4c
SHA1 2a071771ddf34009827e1cb3b46659c4377ad9c6
SHA512 1692ba1be8e565cdf3e8e613fcf7588c7386d3285d2c042de72a6602b9610ba7a005a1c25afb6291c2818745bc70925bf07a93a3638f134a4fa32107e5a08e84
SSDEEP 192:qPzQEt8tzQDTAzOiGRA/JcDBIDcDBwK4kLGpo:qPzpt8tmTAzdFcDAcD/v
TLSH
T1D4325F86BB14C6E3E28B5738CB47176033B3D6E59300971F1DCDD6A88E437845FAA14A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LMIGuardianDll.dll

Path C:\Program Files (x86)\LogMeIn Ignition\LMIGuardianDll.dll
Size 1.9MB
SHA256 155b75760692bcd2bab28816c1b47aa93bd88dae5532a4101b2ec724420fd2ab
MD5 57f199b0bc4153af33d650f2b0a1c3d3
SHA1 2dc19b6514c92beb0205b859c2d0c4476f22eb83
SHA512 43f4b0c5ea408e4822f047886627879ba792ccac1096589cdcb5ab1f7d2367f1887163b76e1152caf9a0ea509fe06504b7b50a64877e8860750f2ff80a4d2fc7
SSDEEP 12288:Na1gcErTjGRgbWllnA/7xrdyjv/XH6sTFitSVLGWTrtxBAzmEKmn3D+SHsgOUcnV:Na9E/AzMXw/ASVLBTrtx+zX+SMgOlV
TLSH
T1DA95D39C2C40CDF6CA38053F94D2A5AA07B5DD279774DCE7A1A07AEB19301C5052EBBE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LMIGuardianSvc.exe

Path C:\Program Files (x86)\LogMeIn Ignition\LMIGuardianSvc.exe
Size 422KB
SHA256 e42624ceadc3f3fbfbc7d4f5cdd76eba0f5e3a513fdfb155f9b8eb52c77b2da8
MD5 04749145ec667cd92b70ef5fd3c915ac
SHA1 bc58f54b38f34924c0f7f8b6327f1a74250a22e4
SHA512 de68cbe19e5acd057f9b978c11a4475f702fe7a0bc18a311e9ce22beb9e888bb8b3a4fa3b6457c6cce9f95f18fa5fcb7c1786cf8c08564f540c23f5eac469194
SSDEEP 3072:5/bxvSfqYMDFtJ+iPTBSJJXWOqX00BmaG+2iChYbXurcxA84/LFtVh5z:51HDXN7IXHBaC/BtL
TLSH
T18A94B69438D5C58ACE251C73D9D2D9E50B652C6BEBB1E9A3A6E03BBF95383C0011E47C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LMIIgnition.exe

Path C:\Program Files (x86)\LogMeIn Ignition\LMIIgnition.exe
Size 7.8MB
SHA256 03fe2b097f38d8d06213697de5fd6f5e7a8b4ef1bd26f7cecf5e73d9c3ab1d98
MD5 b22e57c3cf1015b6322ac55e1bd4651f
SHA1 0f05edb557f5b09e9c241a57f534ad147e073aa4
SHA512 5044673333f35523d0bb208a3278712066da8b570da61b8efe464d51eaa40edc8df12cb00d67c7a5b12cd483f4f41f7460e7a11572d441623b046c4a63ea20a1
SSDEEP 196608:ygu5s1cBhRDrOZZMht/tQtsp7Onc1GQnOu5:yguqOfKAQtsp+YO0
TLSH
T1F186C032BA8280B1D99202715A7DB7BE463E9F22173580C393D47D3D1A319D25B3EB5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RACtrl.dll

Path C:\Program Files (x86)\LogMeIn Ignition\RACtrl.dll
Size 8.6MB
SHA256 78e1d93cf928f9cadac83dcab58087d455f87746fde4407211da321cceeba810
MD5 61a371c57e6d12c69b0eb5b9583c9d47
SHA1 2e971f1e077c64e0a2fd63ddbe9b16f52fd1e99f
SHA512 98771991d7c8b219864043830de174a95d5c10e0ef72694bfed5fc077a69184b5e1aa0c75c6ed30dbf192985c6b911b749417e5daf7220d028c2885f5659c4d6
SSDEEP 98304:cSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSvSSSSSSSSSSSSSSSlwwwwwwwwwwwwwwz:3HCE8Jy915quJP4bXXLpG1RgY3wUS
TLSH
T17696CF13B682D0B2E8DD01B152AEA7FE993D6E345738C5D353D02EAD69305C26B3A713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A
Size 727B
SHA256 14fc4a36941bb2e4fc1ba2e1f4941ed7f4dc3ff71db504f5c57e35e71fee0e4f
MD5 01ba6db664825c80c61aa7ffd5b1b0aa
SHA1 288279294b014366e6ab2e320a929dfe087f5d46
SHA512 a30cfc8282a67606921da58931bde85f4855a41d08634ff37a9f4fc98a849f4fc6c04fe74913fcddd0c13b458882ad273e48b626b619a4b7fef7442e9d99fd73
TLSH
T1C001108339AB19B03A8C45B8CD84929DA0E764582ECB1E9AD43524CCD467627BEB3015
MD5 SHA1 SHA512 TLSH

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 471B
SHA256 90e373b63e7d3be82dbd5ce611613f89884f09e72666d691a6af7c6a0fb77361
MD5 e750ff772407b634eea4e1589ce1f31e
SHA1 f53ccf67cf4b982e66f05eb92073af987e1287d4
SHA512 b5e2654f667db8eb9492767a1e1319aa3d01bd36f99a5c32f82e4dcb38b7948eb9207eb53735335dfc91efcf9fd72c1402d4ec863b45874f772f5ca3792502b3
TLSH
T111F0D4775CBE60C2210BE0AC07E8BD7A152249891995C177257D95C447465E7B94F908
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_F3911A996680A5E4031AB6109A606645

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_F3911A996680A5E4031AB6109A606645
Size 727B
SHA256 153d152b0516f2b738bf6f177870d97564a67dc4fb67d47e631f9a772ab7a458
MD5 1ea6eda231755474512fa81fb92704dc
SHA1 9aa98af4e63abbfcfda9dd578735e6a10ea5c160
SHA512 356616395d1cae92e9a5e0be9838028a7a4b8fae4741b879cb0d8d1215822c5aa0f2c4c3d70f241e7743324fbd0e0e4ba1e8c240eab1c6b13471083203c9157d
TLSH
T11E0199018E7D4140BAE586561BEBCF3E737301419CDD014F49B1C0C0D151B302A5BA64
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 727B
SHA256 a979724fe78a75e9ebd04b45951bedf4560a843e90fe02283b2da2d01c3c6f11
MD5 e08d7206c6b1328162021158be2a3bba
SHA1 b2be6544fe648af07b04b5df08ed12055966c822
SHA512 7f7ad41d29021a1402267706e79dcaaefb26e46ed9e65b37901098745ed0a863e0f897d54ce1c35592719b92bc2aaaf95bd95443c0707e664f45b31be848f07e
TLSH
T18301991744B5D3603523050AFB9C65A93A670E8408E283B53E920CFF2C8DCFD0F8E410
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_64A201640BD8E31E72E33FB1EBF9962D

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_64A201640BD8E31E72E33FB1EBF9962D
Size 727B
SHA256 abc8e9807b5d0b53e65fe0a416178db53d43a334f46a744f16feed0b666320c5
MD5 dd2517356c7cfa00d4db3f399293bb99
SHA1 54fa3c2d1bdb1d9691406bbf25411452b15a8fbd
SHA512 747b635ee67880b45b22796fe12378ecfaca13d3bc673e3f714894a6481bbf07ece2656f8572fa3b3f6eb6766e5741e0729aa1f87c92cbf6f47603a6a27e9f67
TLSH
T1100165039EAA99C07816049E6C959D29711F425516D32426F828454F11F7F9A88032EA
MD5 SHA1 SHA512 TLSH

Submit Download

0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A
Size 400B
SHA256 c9ce6840b19ca986a92c818aec903e4c1bf5049e1bd6e8d4d678804f44c2f9ff
MD5 72558e3ba149a2da1d6609e0efcd8a2c
SHA1 1d679765e285904e760888fd0eba11c82a1e138a
SHA512 b7a5d246d4f928cd021c16acb15fddb6d2f4ea6c97dd8ebccf4be6da92cdf900489036ef59d98e5c66fc4acfc6d9fcd7728719bc88cdb548f57a77ad5f14fdeb
TLSH
T1AAE0C0151DF2016DF3A6CA759FD175524809F1539C108BE40F90054CCE09B000E528B4
MD5 SHA1 SHA512 TLSH

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 400B
SHA256 d4546f7f5e3cdf785089da2e43c2ff41aed3bb2654f478ea5866419da7f27346
MD5 fb925a307d97e149d69f5a0170986f94
SHA1 90582a26753d787eaac1c3166d3cc71b2abe4501
SHA512 ec751f5b00ceceabe36fc8a38dd419da4834a2a34e0718809c68cf5405b2012152a161492b9d9e823eefee8ec837323d93dcc4cb05d36e9b48b14d5fbe6b92c3
TLSH
T193E0C63023FB402EF2B08FB803E59086AF2EF1072C0892BF0E81092C980AE000CA2C30
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_F3911A996680A5E4031AB6109A606645

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_F3911A996680A5E4031AB6109A606645
Size 408B
SHA256 c41db9ed17983413447a9a94115a6ad188f3b559b4c619a8f6ba5f0368cee46d
MD5 87e4b984116c06d7b0b41e6a78f6dd2e
SHA1 b2c02519c9cf0d9e3b7aff31d79201f9eb28ed7d
SHA512 6ffd7130d981cb0a056b104f5e058d096726402a9fd171b032972730c70c20d9157bacbd0fbe851e0d039d71df1fb6496149931c027e908d6c5a3b1c089701be
TLSH
T11EE0C63472F8088CF5F0E8B542F5A922280EF22B2801C3BA0A808294EA28F001CD2220
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 412B
SHA256 3e4d14a99807e9f3a24e3059df012d1796e9c9c298ce21e863937f6e9ae2889f
MD5 39c5a68e9f0a713a3422dcced032a4c6
SHA1 6427915e609dcca98596ee1973c22ceecb4d89df
SHA512 efe282c630751ddb3f0c026483f13ee67f7702ce575715472ce76c9f1252937be04679e4a13d7e04aaf24c387c9f4430b8e9e3f9e95cc5a9eceab16b3df68947
TLSH
T124E06F3822ABB40EF0A0D83046FAA0BA0D89E20A2400D2B816C08388FB0AE015E50AF4
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_64A201640BD8E31E72E33FB1EBF9962D

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_64A201640BD8E31E72E33FB1EBF9962D
Size 416B
SHA256 68dd5fae610c5632ee7e4785210bf9bf69a99bf5027a109cb77ae149631480fe
MD5 72b4c1439b775d451d2e0c2594a4a4de
SHA1 561536b88f6d88daf315c2d8ecbb9154d6b92ace
SHA512 b962575bc6a6e7e133363c96e2e644d89ae0e15b50c278a6ebe346e0d4e8370eb797aab2bf92b81f6426f04a87de71d1289233b60ff8c76df091bfbcccaecbe3
TLSH
T115E0262822FE611EF060DD3547FDA5356988F30A240886B801808798B747E005C11AB0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 dfacefa73d018d54e3feba3eef28ec722a8422fee8768a2c3d8d6253f863b375
MD5 cb5000b6fab1115bfff50bedcc3eb9fd
SHA1 afbfe0ec03df59e7a1eba1da4227111508419c03
SHA512 aab9a1afd5de2f983466724b6ecf0dbc2e176c5a1eb2f059b9507511cc53643fcf9ed990bd565f22f8d53fb82db71cba238962a75c68db02d5f10b526661bd08
TLSH
T15AD09B667354991CC9C439712462565161015820941443581D96B16CCDE56C707561DA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ecdd5c8034c45eff453cbaf31d8886e2bd9609a73853367a6d096a69cc81f1be
MD5 a774534a956a5c8affebe08e87c80683
SHA1 b3e4e20a91e4087d3b9247b5ef6815f51858a041
SHA512 27769aee2cac148a0154fe42b51da2a9a1088e9e990873915b4c7ab9bd5442a3facf82b2bd1cbaef75328bd5937813698b96ac06aa76d934d07ab5ebb194a824
TLSH
T103D09B6673449A1CC9C439712461565161115820E41443581C96715CCDE56C707571DE
MD5 SHA1 SHA512 TLSH

Submit Download

f_00006f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006f
Size 67KB
SHA256 f6130356b0f284fd06d8be4e3ad68e3cd9d956aa825bf3764be917c525a23322
MD5 29ea02f5930d645075d25614bf1943ac
SHA1 199d9cb49bd515565c03e6970bfc69c9275ce6a6
SHA512 6b9c7b854b0970a82be441b04a5e716f5e45ce024167e6820051f0a9b9a9a4f7b483ae02295831c0ece049bbc46921f408b8f1983b38d8e4fe3cb5f05f9a14e0
SSDEEP 1536:zIiSGS8eHtpq3RxczG0FxLJ6fobr2jxN21TP8vs+2t:zIoS8cpoTci0bLsS2jxNbK
TLSH
T1526312C5C80561303165657FE885A751F94F88BA2FBE1A2F87461C2CFE8CAE2D4CC90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000070

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000070
Size 16KB
SHA256 0e4c8483e91039738e0e9e77cf711e4ad645fd9f2aeb98b84af6dcadeaeefc7a
MD5 d3e682fb9b5d33168caca7c577e97a90
SHA1 0185bbae781527bae669b533bf09fb6fc7b3dd6b
SHA512 39186d2d34deccde94aaf07684fcce5a69505ed7bf775eccdcc53ce08c0a7c7eb29df112846db296202a800b54cabc65a5396439800866b2ac103e6f2ed5e344
SSDEEP 384:jnoBd9YGMfEzbLTBJp845U28BTHm9fXWaPtB9ayp2DKthjC:MBd6MzXJ845U2MyZPvp2DKtBC
TLSH
T17A72DF9ABC113DA42B6345AD8E893EE7458900750632531665FBF5DB04F2BF894BC239
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000071

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000071
Size 155KB
SHA256 25e6c8ab2bd0ef79039a74b91bbab7b8a27197d5d5b569200bb32872f1b8e370
MD5 50ba712d543d6d7ccf10283abed66dc2
SHA1 12af4ce246052b42af03614854f0a467cf498273
SHA512 c6ee593e4b024ab4ae799312b9bd59c5a9134764620c5643558d7bf5d9085aa957331b97a720236324bf8df6fa8f74a8b5322840779957ddf57a30019f36406c
SSDEEP 3072:vDy+DvvYr4AHJYc/g48T3HPkxGJPMQENUAm+m8o6tDacRZHW5FhCfDmhsNmJGBa/:vDy+DIdJJRQEWD8o6jWhiWKmJG7g
TLSH
T17EF32383DD07BC8538B9B5F0D6693E33A4A33101846937F6488E64AEBD7B2D8D95C071
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

09771e9f95de1132_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\09771e9f95de1132_0
Size 34KB
SHA256 86e65462fceb579d7f9a6cb1e0ab177aa48fdd994cb05edb8a761a676c242a48
MD5 5e2d1010bdc93d576e606d069a5ede00
SHA1 356b6bff420b7bf885819b09f5c1cd6ab4d958a1
SHA512 8e97cd21d0dd848bb75536e9e059ac2e7e46244ad3cd2fc484b2fc7ca187a904bd31a2435b7594639c05a20ab192e6ce094819c5f64b4299a5b2b0b0419f1c4e
SSDEEP 768:uMmK5sNDUBxkeaEUyISUxJ+k2HZpVAWKz:yNIPz4QHaW
TLSH
T18EF2E8052B66A93BCD3613F651D28A27733641053F87D21722F217342C7B3E78A9ED8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0e91fa3c1143ce5d_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\0e91fa3c1143ce5d_0
Size 82KB
SHA256 33894aec4fa47d5f8d5e71c87439cbd8ce21e6af303496f07ce73a5139ca5c95
MD5 88a372ca92ddd8ad633884b07ae33bb7
SHA1 33272dd0d4d66f9d68d3781c2b6d7f3440ce36a7
SHA512 6550fa5bda2e21a679991a91bbdebf96d8120e64c6167f9c21e0b7c28abccac3335bd049a8a6a3bae40787b2eadb350a1b250e5d6924ee0a8abdfb1891f6e972
SSDEEP 1536:DueaHB69hnakjWRNOW54DV5kdnWLMCKcyWdhREJ+dT5PjPe:DueaHYzthW54DV5keMCXPZF5
TLSH
T10C8309116B65E976CF2283F6A1B348277676008C3ED7921637A0F7352C253FB8A4AC57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

404be73f40f5411a_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\404be73f40f5411a_0
Size 271KB
SHA256 812e25476d72f416a0d892de602dd06c4e17d487c31a3f55d9c1f24af42ba8c9
MD5 1320a35b368e8ebf050b66c156464cd2
SHA1 3afeeeb348b5b5e9ab917334c0c794b581c03b0b
SHA512 60466bda3857dc4ecf4cf38c17d987d6fb1f052a67170a8479cc4f4d0b54712e054f69ae01f821b77b47da1f6631d50d739971cb0f58c017275476daf652a8a8
SSDEEP 6144:LlT+arZaeg/4Oyy0jQYo6U/M8aCrZtoMY5U:b0uOqcYaMY
TLSH
T10144F9B567909E3ACA2657F50253C967573244093F93A34B32A1D2363C4C2EB1FBAD8D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5052005958714c7d_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\5052005958714c7d_0
Size 742B
SHA256 d4b5a1d67f68c845e4cd44c01235456cbb6c2bc888105fc66e50513af8b57214
MD5 fbf6cdf414fe75428f9af96c3717079b
SHA1 a98ff259b37e459c3e885bddbd1c11920c10642f
SHA512 80f438c90a154e58287ba59ccf748b85de87246a29e4d649a8bb035b6bfd09d8691bb49b2da72810b3068aaeb2a4a6a9b9525cee7eeaba6da84b060e398326c5
TLSH
T18D0160DFF735A974C0192275D23BE25D8A060888999DC4C81CD3A53FDA20B705953807
MD5 SHA1 SHA512 TLSH

Submit Download

50bf1f5a1d856021_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\50bf1f5a1d856021_0
Size 519KB
SHA256 96a16e6e2a886f8a8d8315f8f7c47bd8df7c3d7f62fcac9a2d0403949afcad4a
MD5 a3d0246842613ef83fa46ab905aab520
SHA1 323546390ef55c6d0caaa27c17f23c7e981dc6a7
SHA512 4f12ef9c5e7ab9def83ea490330c9edeb921e2339d8f512274a86e8bdf464b03453d77db47a3d3a8c226b1f86ac1654dd73a69eb95b9723a5051617f4f099a0d
SSDEEP 6144:XpcW7TDE4y+n6oWfNQSsi8M/9ahlGalUZPJP/igd2RTIYU1angHCDb:ZZ69zh8M/YhPeZFRDaJ
TLSH
T13DB4970A9B90FD76CBFA53F58292C566733641893EC3910322B16F293C1E2D65E4AC5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

96fbb8099c49ccac_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\96fbb8099c49ccac_0
Size 1KB
SHA256 fb613cd3ad442a934638139294f8319b5fba8af2ab34fddc2146f4a165380bef
MD5 4217f744a16b610b4419c947cecd9d94
SHA1 16804fd71ebd2802a98284fe42457c6144129790
SHA512 f36696ef3a143a14fe832755869d8378b39267c026d18519c9d29e14b2f25d674edb7c1000494b2761530c808e67d3c6bb3f8a988358ed3822c367c9ca44b3c7
TLSH
T1994142069BC94831CC3103F553539633F72E4AC90FAF920BB7506A2A3E27BE15F86516
MD5 SHA1 SHA512 TLSH

Submit Download

a362113341f64f1b_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a362113341f64f1b_0
Size 8KB
SHA256 d13d8da843ee85a4ffa1648c15ce260c0712b9798c914ac932ff9ee1b8967f04
MD5 2fb1793a8f4b3eda8eab0c85d5a04596
SHA1 5ab5948745c7ab870b68cf51623be0e0f43b0dc2
SHA512 b690d90da88e43c4814a570a25c1c143bfcd0d4ed0edd2538e083c9ca6a59e90ef6b98abed8c71b56814259accfbc2413f419366b6b5475e91ce907a86b8362c
SSDEEP 192:1J+QQqcNNN7WGFgfvOHMdX7wA6fbXWIdTiIGe60Pr6Rlpb:JQqQPFguHy7v6fzgIj6j
TLSH
T10F02FC21EB819935CA6263FA61828527673649483FC3D20621F05372BC977D39FDE94F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b279e2f2fc95d553_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\b279e2f2fc95d553_0
Size 241B
SHA256 4b49dd1a9d7d5ff0cb85081363c4677ab1f9d4f7988f0a6d774c81b40776d13f
MD5 b066e16b4d46a91e003c1618035cd4de
SHA1 f769fc767dc7664f7a001e6a871d57e860ff2c88
SHA512 4af6f7029d075d7aa059ea052c711e93f7606e91667a408faa6aa4a1701bb5601d691a751ca2a1fb26724f601b302874301a4465834eedf4ed7446f9b72d75d6
TLSH
T18BD097D78A305808C10B8971CF77A30287354AD00CC8C450C030A2FD0210CA45189113
MD5 SHA1 SHA512 TLSH

Submit Download

c9c679f21987470c_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\c9c679f21987470c_0
Size 4KB
SHA256 8b2b56141b41e0f13e824c3ddb624e738c5278b9400633bcd999b23d39b3fdb6
MD5 7ab7a2f96cec0116bead2d2f1d682c22
SHA1 1d0393ee6975365527914fe1ec33193f946c042f
SHA512 8572cdaa67670f3952f94eaa6586a723c5b6d741af822e750404a7198cac0d9a66e8241a14d26b32429d60bfb7c9ff0fe58cf6895094bf17ccd5759cc8a9accb
SSDEEP 96:pjacj+DOTq3CTkyF7pHQHf7V5JT1bYEspCN:hawkd3F67pHQHf7V5JT1lSy
TLSH
T12891B943FBD3E61CCB6A67BC420647A67730962D6982C25727E0AF0C2D671CB990DE49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e1932412fddef3a9_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e1932412fddef3a9_0
Size 256B
SHA256 cbfd6ea72d269a89ef1ecb18219c49fe6a283bc9855ce512ab22fd1467c683c5
MD5 27d0cd54693418362cc5b18938ecb3ee
SHA1 2063392ae62a1e5560a265fe1b2fefd6129055cd
SHA512 cb40903de56ab2577f7c48c45cb9da366166102ac7c63942b734f11473816cea615ae62b6bf0def5a5c5f285f766073d2e3011a5b7d208d8a27c3a2470c39d24
TLSH
T1F5D0977326393041C88B85FED252C292821209A10ECEA4002418683A014A0B3BB04140
MD5 SHA1 SHA512 TLSH

Submit Download

e924ac5039121386_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e924ac5039121386_0
Size 924B
SHA256 ddf017d52da26fef8b4d34a9ddbcdbf016186955994c2b2a3c7d2b2a9079b3a8
MD5 88a4a253a1a63788b7b061482a35ba73
SHA1 febc3feb803162b8f63f4ae0457445cacbaa6b65
SHA512 6ff760fdba818c2b7cd2f81a15478580207b7a2eb0841dbcc9c91645dd5926a5563607300211ed8ede1a202ef191f7602ec0b0550dc3eb0951801d02adbc1eac
TLSH
T19011B797B11D54D6EC6B5279CBA12E4C4225F73C8571D1DA140EC8F81893F276D09B91
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 12d6ae41b01f0c1eaf420d399f7b0bc07b892ade510f7c589bd33bd5ed76bfc7
MD5 5b696ef19fac2f5bd619bd9f42ce94c7
SHA1 efa86c850794c7769c38ae05bb86a58a4db7a119
SHA512 d7e7e5e3460daab28b952f2e7ba8266ee89fef996262e594364d52406b093084eb07e9ba4b845a6d5bfca947b41508e154998d590702aa23c6878bce7791bdfa
SSDEEP 96:D9OHT+5aZMGSGzoyGriwBuG+n2e8qsXxY:DQHa5aZMQEyGrikf+n2e8TBY
TLSH
T12E917BF783F8862EC901D6F0AA146F1FCE2D0955436C7D5A85D49E1B93E2471E181A4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 50581ea8fec5ed9fe41f615b79422aa2087e182450801f1c0464d756d476e4c8
MD5 a1f12ffbb196810060925ad97605cf96
SHA1 eb9284c637ba9d5cda1ce0ec7996bff93decc307
SHA512 9e9d11e6369a77ec88b5b4ce74f526cb3c345cd41a26ac02a21996f2bfa1caa543438d8810642bc590f5c75feec42d4c49846c0550d38a1ae336eb2f5d56d558
SSDEEP 192:sxR9RTCi/fisbhgjwZpEzoA8pRp/g6+WNdudpIHD9b6S/GFHIgD2A89J:sxR9Qi/fisbhgjubz/5ippSgm
TLSH
T11942C65AAA28593B9CC7D219FB557F53E2F95032A1D05F18A7FC8A1C10EB6ED220340B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 1de973da3881ddb1c258aba12c516bad537f8edadc11b32ccc8dda694ea3faca
MD5 185fe4009b5c5ab7bf67c5c2afffeed3
SHA1 62de9e18e3c3eab088a1a018c31138556b310515
SHA512 ac3bab28b5b87d386a7623de4bb279c4e211dee0d43b29fd6dfedb6c03858fa9ec09f4f8ca20918e16fdbd00e58bce346ff141c98e7fb6e7a15a5835f8e73b81
SSDEEP 192:sxRGRTCi/fisnhgZwZpEzoA8pR0/g6+WNdyRZIoD926S/GFHIgVA89J:sxRGQi/fisnhgZubW/5WZFSgp
TLSH
T13B42D7566A28A93B8CC7D21DFA557F53D6F91032A1D05F08A7FC8A1C10EB6ED120380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 0ac6e1e95e98ee074b585685ba878fb7709becf1dd52119692a3bd293e256b0b
MD5 2aaca7c97c469bbf2929b13727d39c15
SHA1 38e56960dadfcf13769183e81bd121bc21b0f580
SHA512 526ab4a3a2524aa624469315eb39794781864582f4c82d634dd9b82875168cda88131d2adf8405af4cbece407fec38a11a8f41a4ebbd18338529132b7337901b
SSDEEP 192:sxR9RTCi/fisbhgZwZpEzoA8pRV/g6+WNd5NZInD9n6S/GFHIgDUA89J:sxR9Qi/fisbhgZub//59Z3SgI
TLSH
T1F642D756AA28993B8CC7D21DFB557F53D6F95032A1D05E18A7FC8A1C10EB6ED230340B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 120859127ab329913af7a1d71cf07fa8d938481c9805b860b9e79177eaa6a9dd
MD5 35d1115d45627e4f7683ed0c2a212a85
SHA1 a0861e11e7aab5b9f6545db6a747bb5930ae92a9
SHA512 f16524b2d642b4306a7aab09057010aa267c8a90b4f88748343b8bfa8a71a51fe83c9490f24a9e024f558d8915c184c024d45753d7709bb9e42544a5201622e5
SSDEEP 192:sxR9RTCi/fisbhgjwZptzoA8pRu/g6+WNdWUhItD9X6S/GFHIgD2A89J:sxR9Qi/fisbhgju6A/5bhNSgm
TLSH
T18942B65AAA28593B9CC7D219FA557F53E6F95032A1D05F08A7FC8B1C10EB6ED230740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 790c51763f80aa625125ee067d384c5a6486dc2f70f1614e597166cbd3284ed5
MD5 69c91efebdefeefd9021e85c0a63000a
SHA1 585ad7b4b6914db8de5f2a16b7dd2803a1439462
SHA512 f647f9f709b41bdfefc365059c65a7cd373b1d3622152bc31d00d9a74954d015a2e23b17dafe5ca0b5004c6c53f1aadaeda0d5edd8708c3f832868441d008f4f
SSDEEP 768:azfWr47pLuLf30Wg/XfHf8F1+UoAYDCx9Tuqh0VfUC9xbog/OV71Yc16jropVpVc:azfWrkEf30Wg/XfHfu1ja41Yy6QpVA
TLSH
T1F6D2EA7B640CCE7F4F800ADDAD197E9B6DA802CB9698CD5047FE941C02C6BEB52164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5b2e50.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5b2e50.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 a473700818ae017c87d539f92d4b4e629c6d0dcc65a5af06ff6830fa24e21190
MD5 24d2b60a4fb06abc6b568c00acff8f14
SHA1 cd21a97865200143e476d31e79d74d50d03f7677
SHA512 60ed6d7d91ebcebc02ccddbe37c8bc61908372fe68fedc1e842edb1eca0ac46e0ff4388ea63a222b5170345451a33d3a13e051e9971f23cbd7783e1c35d11d4b
SSDEEP 384:nNZcIt38NHdIzFyOGBWWZlf8hyEGX177F0F4Hy2rEoajo4cdR8eHhVODjYPNDUMl:Vt3Pcni0NFBrEnjN3Gac1FwMjT
TLSH
T1F5F2BF716DA58DB38CEAE346B5437B52AEE016B385D44F94DAD8AB0C15836FC130B837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 363ab3f66541832f36d031c9f5335076128eab9caa939ffc8a6f2c4e231f5bec
MD5 a148d260a84a4bea2be6e2a9e64de25c
SHA1 a91f3dfdae0e8565d3dabf1ebe3de0fa03f0d87a
SHA512 2429c9799f66a28b8f8b089b7a821b73378d4074d50bb814f03d663ad13a65023d69f04c70ea7fbcf2bf0f7c9d1852dd3c83d0df6a91b84e1e6dd8384faf835b
SSDEEP 384:n9iFiZcIZ38NZ8TUNTUlIldIzFyOGhD44Hfw5yEGX177F0F4iy2rEoajo4cdR8e/:0FQZ3awg8GusNF+rEnjN3Gac1FwMjT
TLSH
T17A1328F599D38977D8EE9383A73E6E4299BCC163B5844994B7C45D0CDC821BFC30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 2b8db92e70ca483066a9afc1b8d47ebe7e50066e98c9da7ffdd4ec93b9227714
MD5 7f3e3bea87a9dcb1311d9b1909c83334
SHA1 ad6c3aae8b2276daf09e77f2e84b296fe811da6f
SHA512 49ca305c48c0a81bcb3b5b5baa4e10b3c9ff0461c82c76e263a2ec2ef4ce14437d444570745e56b62f9428637c49561f1a2cb523860cc491da5662caa665d0cc
SSDEEP 384:nGZcIt38NH4IzFyOGVH2WZlf8hyEGX177F0F4Hy2rEoajo4cdR8eHhVODjYPNDU2:Ut3sgHHi0NFBrEnjN3Gac1FwMjT
TLSH
T118F2BF316DA58DB38CEAE346B5437B52AEE016B385D04F94DAD9AB0C15836FC130B837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 70245211e6de850255b89431ff0efd404cb0e34e3f884c5ba6feda81e0650a98
MD5 ef09971322c1acef720908b37679abca
SHA1 8c498b66c1a0a536f5f3b5786e2515f5187f1b11
SHA512 709907d53ec959bb8a24c2a98f435a7cbf28f47fff7e2ef934688ff97e9a4200426a0d9f197f34f63f34d3c2c970633bc552afc465c1741f5bb7dbba26a0e44a
SSDEEP 768:rrv+4UNbdS3Omi0NLrEnjN3Gac1Z4eVH1SCz:rbsbg3t9QnjMazEH1V
TLSH
T1E103CF3669A88EB38CEBE385B18376037FF4525385940BE0C6DD6B0D129B5EC130B967
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 3f7ee77861b24e15080ea6389b149d819feba3404cac9086a25b7e018c19145c
MD5 d953d9c386932f305daedd93afcf3cfc
SHA1 35108c7b9103599bd96d9e5465e309c3064228b8
SHA512 7a04826e3990338b9471c252f2aeeb03f37964b897735a25ef5844febc060b8ba79dd2d7627b011eac4d39dd285bf5807b720746d5cb74bb1839d6a2a25fa5b0
SSDEEP 768:urv+4UNbdS3Ql3i0NFcrEnjN3Gac1Fw5j:ubsbg3G/cQnjMaf5j
TLSH
T1CA03BF317979CEB38CFBE285B5477A437EB416A389C00BA4D9D96B0C05975EC270B823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 aafc826c46d0c2f767d9026f18ac6a2c6c0595e5286468a48f30030f55fdaf8d
MD5 53370b0f397f80fce61c2bae098eca71
SHA1 d8b50846bcd78fa5fe7384ad4675b2529197ca1d
SHA512 138cfd7e89faa802367a7643bba4932b5b9dfce1e6849dc8b0009bf8d4cf56254bf958e71f9e4ad34a1b32859f2765a11985b4adbb394b2211e3dd21482b7425
TLSH
T1BBE00127AB0110EBD434273040C757243BF3C0B0077713476E1615782C2A7041E11A56
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 89f5bc8ec62f5f1060ea294d12ed6f593d070c394ed166b583f66c9be5b7c455
MD5 91a9f8de1652c550ab645c7a4b1e7140
SHA1 0569cdd7249e472b5d5ee992a2960b046f22fd76
SHA512 bb2298c2aa232b2614557439da3b8512f5377387443c2254497ab6d5f9f5083bb3707ab5e0bfd60f0aff229b011e0b5bc4674c1585e17e8d32d932113cb3f263
TLSH
T1F1E0EC23A78100EBD828433080CB5F243FB7812802B21A832F32147C2DBA7A02E20A81
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 4e66ca07e8769304bba19cd63fcf4a573e766e8b2d37df293bf5c3c6aea49696
MD5 ca23fa5ba4997e7158640fc6a013ce01
SHA1 61b7cd6ae0a891bd57326c2a11bdf024d0c0e431
SHA512 2d56eb0e1fa635d2f8f187034d468b10b6756f0e36c26cb803cae914f2a55d9278d56d4cb373a9d83f282dda972104f0f66ea847ead8963f8d4d9f9e039f2409
TLSH
T165E00127EB0110EBD834273140C75B243FF3C0B0077713477E2615782C2A7041E11B56
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 ebc91e99647d00281030df933ae528b1355d99d0b379688348a796a6f4913a8d
MD5 290121be127d870c448c0d80a1021d59
SHA1 a2619f521c44949ff361855f0e534f345a810826
SHA512 1327a6dbd5099820d507c9e3a9c29be76b7e38254e58d24cebabacc750c80bfbcaa45772fb55cfdd5d7d7eeaaf086641f6a3def0f939a5e99873baf523838c84
TLSH
T187E001279B01009AD430273040C717243BF2C0A0063713476A1511742C2A3041E01656
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 68867e8e43223caf871f116c967599152f9952d84638c46b4be6184c6af5e913
MD5 d0863dbfb4310fecee127795657a0b93
SHA1 6331b53297012d7e866968272eda76e230d0d548
SHA512 6d878e0c2bb3e5803bb3771e8a7c56340343bb6528f676b98103f6d9464c79aec0cbb7642f0bc81a95c8eac837d755fd2015493a158bb26e74f7fec31906a405
TLSH
T151E00123A78000EBD878033040C74F203FB3C13802A20B032F3204382CBA7802E20A81
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 b707d8b595fce465ecdbd2e2dc7465bf750036ee8d7b60d753891dd108f0f76b
MD5 b74dffa431036be5347b27882e935a8f
SHA1 841ba9eecc9f61d0e912cdb17b131453a6543ee7
SHA512 9f59ca0522eb0f71faf96e39caacf704dce7cf384e16a75f41f64cc5001faae72d7c0628f6f6352d9fd51d3cfb0c2b1fad7c4a7245f307a1cec559048720bcf4
TLSH
T1E9E00927EB0110EBD868277580C75B243BF3C0B007B713476E2615782C2A7041E21A56
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 bb3306ba250f61a3f0d43ea3a0c1c82873fbe2a4d4441320e72fc59ef95bce9e
MD5 f91e93a5615e97ce46d82250a0e831ad
SHA1 3ab520e27c3beeb97842612dd936b36a687b627f
SHA512 b8d4d70b9f818ca01f1354d85d99039bf59b56315eb4a089b1ffd58cf203eac949eb8906467977ae2a60a87987ff357816bb09520aadc9b9febb680be5d62a4e
TLSH
T194E0EC23A78100EBD868433040CB4F243BB7812802A21B832F2214382DBA7A02E20A81
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 033172b5323586491eb073596875f30f465c0894f24ef315889ca7a6971d6c48
MD5 00c878d0a553e485e219155f34df64f3
SHA1 480f8fad3c2e4847f0222367243fd5952b67de8a
SHA512 d9601e530a563cb3509bece6cbdfe00dae058ebcc07f89f27bd2e8e6e8e66a0711e4be2b2f8cb6bab6849e520fd70bab51cc05da70576c1850f3b5fec54d9cef
TLSH
T1C0E00123A70000EBD878033080C74F603FB3C17402A30B032E22083C1C2A7802E20A81
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 ecb25141d6c1e58e1a9b18cc82e1f5e293e399c639fbea15a2bb3a0c5084a338
MD5 913198e46e08e731a3138a3e00f8b74f
SHA1 999637907f5b53aae1e9c2e9d8e4e9ed9795e860
SHA512 bf5b848f885e306581be2e082df6eb5a363013980bf9e853a3c48efb3cf8f9c3d19534669f32d55732d9245599428be519adebba0be70bc063673d6ee44e8c30
TLSH
T18AE00927EB5110EBD8A8177680C79BA43BF7C0B407B727076E26197C2C6BB841E21B56
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 4eca5471d00c0908d4e1b4ebd44b100fc4bc6a92426de8898280cbc885c6584e
MD5 666ccd4bbba110e0bdf44b50f9f5f528
SHA1 7f72c95082d01b3e06b37f3e53dfcc7e4a1a93e4
SHA512 b13abaaf7bac226035876a6abe9838d97c4b3ec6707922be45f4ef06ac444db4fc6194e41df939c2123e7ac895041b7f3e5139c19b01f8bb196eed468f91f099
TLSH
T169E04823A70000EBD468033040C34F603FB3C07002B31B032F22083C2C3A7802E20A00
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 021af7cdc00e50cbde670fcb92baaecf00c2c9ed412d1e2c9df2e0ba76558c06
MD5 b9e22e420ac20471b76539595c167f77
SHA1 8e43151b2f64d4c9fd5fa5c042996ddfcd7cf9f3
SHA512 1fdb8eb3df4e7228588268a06f1eb19aa1bc30b79ea9f306006532c1995b67998ffc31c0074e879bff22c5285e3537774a6ca320404212155157c4f8a849f75a
TLSH
T106E0EA27A74104EBD878433440C75F653FB7853402B21A932F3114782DBA7907E20A40
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 983721ab5487500ff7963dc480ea92e0b128de9c446ddb6c8d94f9c47f2f970c
MD5 725860fe69ea49ed59a47ee7828cd6cf
SHA1 337136437e94697766ce3c2a268d92b9178fea71
SHA512 db5641b11275fdcdaa6b45a07baffa54bea4637879bc5ca5ce62f12f728322ac1ebb2c9e81db852b24ff5bfe988a7f7c26efb14a689855067e29e7386be63222
TLSH
T15BE002135B01009AD030273040C71B243FF2C090073313476A2511781C253041F01556
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 a0e450138e240e6e8e8ae91b17d87511432eae25323c70dc0ddcc867c46390ae
MD5 06f99ef83894f24be098569a421d45fd
SHA1 c0a2eb080cfa10bb86fe02786cc7de4e7b0632d9
SHA512 00083f0f89f3e32989c716a761b3c5b8a918a23127b47b282698cc80c946bde1239d53fb82d686cd267bf87bf1795c08b500617fffe7faf177821123dccddaa6
TLSH
T1A1E002125B010065D034073000871B143FE1C000016213076A2511781C253042E20955
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5a8f70.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5a8f70.TMP
Size 392B
SHA256 78fb09f546e9ebb62f22854ae23c6b6907c7600fd6a16878c407fb85e58b8d7d
MD5 206b2b604c4cd3bd3662c374b81498fa
SHA1 1ec92b7f79b611ccda861981214af93e535d34ec
SHA512 5e78f2e88e095dd201810680108568023fae4dd04523b100e2ed147decfe16ffa5d49f6ffe2ad35e5aac649707794224dd94026aadf8362d8c437fc6193a8ef4
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

0c2d8f8b-4280-4f0d-a491-ce79d3d09a67.tmp

Path C:\Users\Admin\AppData\Local\Temp\0c2d8f8b-4280-4f0d-a491-ce79d3d09a67.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

MSI9234.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI9234.tmp
Size 454KB
SHA256 bb3cabe6fed9b1007f186d961844d6af2dad4140fa5c461306cd019a436fe84e
MD5 eeae5ba98dbb50a03907988011651b92
SHA1 868dfa80d297af281c05da51061761d446d8f062
SHA512 1fea82de70ee6d0e9484a001ef1371175fcff1c32f9711a216b0351a773443db636eacb6428bb4c0b28e5c58aac73222dc40d66d154a5ec1f4ed1dc5dba745b3
SSDEEP 12288:yK75pEq+AnXu36PjM2IX6u1/UQf8Xu7caDeMLff:yi8AnXu36Pw6pQf8XaDeun
TLSH
T111A4AE12B5C28036D9AE0270997BABA5667EBC700F78D4CBD3C85CAF5A705C19B34B47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4244_1696034247\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a0e1b.msi

Path C:\Windows\Installer\e5a0e1b.msi
Size 12.1MB
SHA256 354ab98a10767e73262dd2545115a3f1627d1c8d23ba74b873f32d6eae022202
MD5 d106135a73b7087d8a7b79d28c2243cf
SHA1 2d1eb75ccb7f19579efcbd87da10fc5634aaef4a
SHA512 0a9c91db8f886bc2178d42e2221228b331e1db28b56d2956e30bc2d22ab8db9a7c62951f645c5cbc27acd6ebcea07378d3d78bf7d37de40abd9bf92620e0efad
SSDEEP 196608:CwWEKLT21QHfGT8e3V0cN1QhsNAo1ZUBYnXkq/PMmamtqp7JKfFcjdJn2iIVW+qK:CJPeQRpcX1JASk05g4fUn2i+nqodrC
TLSH
T195D62353B040C97EC7790A70589BE69C417BFD145F38808FA25C7E692AB23411AEFE5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 d0306e6dec6a82e326d5428aa62a7c4b04d62fff80f2491a03bb0ead7505976c
MD5 73cc9add9f2706806974f07b8edd11a9
SHA1 5ee20245f6ac6149bf05ebbc83419209c4f8210a
SHA512 8f8614658b999cae3b417ffebb7c075e8a21669e5204714fae28a4d85fb1609c24e67a31935428ebeceeab71caa6999a0ce574dc168b7c8d2bd5c715c0d7275e
SSDEEP 24576:WFo3DMPfdoO/vvTL/SwyiCFAvre45LFB0vkwN/8qUn8aZ1jS8Ih2ibYDGuY:sH0
TLSH
T11257B42436F92100EBF7AE3CA8F06A274D397D57AC16DE8D45511B4D0822F71E872F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{ee64d8b6-454d-483b-9d2b-f41173582dfb}_OnDiskSnapshotProp

Path \??\Volume{c61f8367-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{ee64d8b6-454d-483b-9d2b-f41173582dfb}_OnDiskSnapshotProp
Size 6KB
SHA256 29e89349c4eccc76b53dec3547eebcf256acc11872b2378496f6b6417c380666
MD5 a0aaf5dadba65a0ba13c4f166530355f
SHA1 c6cc2882cd1aeda21efb34441bfde3774cb3b1df
SHA512 eba4baa6b9f312928a585a42c4dba4750d785326be7c052c3da8d3ce0e69fed68399d879328a76cab13b6728406949257c0a8e97d8f4b2888fb805973315460f
SSDEEP 96:FUflLvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:KJb++uVm
TLSH
T189D187085AE54711E2B3AB3129F18557A837B911FF33CB8E0198238E6631910F835F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download