5b0bd08381b164ffa6894a20429db1a00588e055f69518948e521dfb128a7562

Analysis

user interaction
yes
max time kernel
49s
max time network
123s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 03:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
A4abgVzX.exe
Size 19.3MB
Sample260804-ehzmcsvxbw
SHA256 5b0bd08381b164ffa6894a20429db1a00588e055f69518948e521dfb128a7562
MD5 625fa12813ef496ff850be269a6cd971
SHA1 fcf7425a156b0b890cdab324a6d7b71b1ca02de3
SHA512 df25ccebae53a7f1e03fd5e06fbee1ba1bacb06f0579ca2e2faf06314c1b4d46c5b9941f4bd2976bed6d06203b5932dad5a7c9b1a3a972d16d72555a3cc5876b
SSDEEP 393216:N0a0vKT80nMnVVPrdQllv7Y/ME0ctWrynS:bTNIIlcL0XrGS
TLSH
T1D117AD102BE88A3AD1EFA772D0F1401197B1E866A313E74F7868A9A51D637D4CF017E7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence ransomware

Malware Config

Signatures

Executes dropped EXE 8 IoCs

pid	Process
5888	windowsdesktop-runtime-10.0.10-win-x64 (1).exe
3520	wixstdba.exe
3624	windowsdesktop-runtime-10.0.10-win-x64 (1).exe
1308	wixstdba.exe
3548	windowsdesktop-runtime-10.0.10-win-x64.exe
5108	windowsdesktop-runtime-10.0.10-win-x64.exe
4192	windowsdesktop-runtime-10.0.10-win-x64.exe
1740	wixstdba.exe

Loads dropped DLL 6 IoCs

pid	Process
4240	MsiExec.exe
4240	MsiExec.exe
5088	MsiExec.exe
5088	MsiExec.exe
5372	MsiExec.exe
5372	MsiExec.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{866BECDA-F284-473A-9E84-0CCE816BF06F} = "\"C:\\ProgramData\\Package Cache\\{866BECDA-F284-473A-9E84-0CCE816BF06F}\\windowsdesktop-runtime-10.0.10-win-x64.exe\" /burn.runonce"	windowsdesktop-runtime-10.0.10-win-x64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.AppContext.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Collections.Concurrent.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Core.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.IO.Pipes.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Net.NetworkInformation.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Net.WebHeaderCollection.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.ObjectModel.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Reflection.Primitives.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Buffers.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Security.AccessControl.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Xml.XmlDocument.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\hostpolicy.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Diagnostics.TraceSource.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Globalization.Calendars.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Text.Encodings.Web.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Threading.Tasks.Extensions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Xml.XPath.XDocument.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.ComponentModel.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Configuration.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Data.Common.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Net.WebClient.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Reflection.Metadata.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Reflection.TypeExtensions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Runtime.Serialization.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\mscorrc.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.ComponentModel.EventBasedAsync.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\Microsoft.VisualBasic.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Diagnostics.StackTrace.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Linq.Parallel.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Memory.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Net.WebProxy.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Private.CoreLib.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Security.Cryptography.Algorithms.dll	msiexec.exe
File created	C:\Program Files\dotnet\dotnet.exe	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Collections.Immutable.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Security.Cryptography.Encoding.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\createdump.exe	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Drawing.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.IO.FileSystem.DriveInfo.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Net.Http.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Security.Claims.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\clrgc.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\clrgcexp.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Globalization.Extensions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.IO.Pipelines.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Reflection.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Transactions.Local.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Net.WebSockets.Client.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Runtime.Serialization.Primitives.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Security.Cryptography.Primitives.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Xml.Serialization.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\WindowsBase.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\Microsoft.VisualBasic.Core.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.ComponentModel.DataAnnotations.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Data.DataSetExtensions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Diagnostics.Contracts.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Diagnostics.DiagnosticSource.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Diagnostics.Tracing.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Net.HttpListener.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Net.Requests.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.IO.MemoryMappedFiles.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Reflection.Emit.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Resources.Reader.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Resources.Writer.dll	msiexec.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_93841500\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_93841500\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1\64.60.31149\fileCoreHostExe	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_93841500\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_93841500\_locales\or\messages.json	msedge.exe
File opened for modification	C:\Windows\Installer\MSI95CE.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF6DF2C328EDC48C78.TMP	msiexec.exe
File created	C:\Windows\Installer\e5993d6.msi	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_93841500\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_93841500\manifest.json	msedge.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1	msiexec.exe
File created	C:\Windows\SystemTemp\~DFC9582EC8B6222708.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_93841500\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_93841500\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\~DFEBACEE7C3A1C7203.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF8403A14D59A28BF0.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_93841500\_locales\am\messages.json	msedge.exe
File created	C:\Windows\Installer\e5993ca.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFBA2FB13C3DF30639.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAD53.tmp	msiexec.exe
File created	C:\Windows\Installer\e5993db.msi	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_93841500\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_93841500\_locales\iw\messages.json	msedge.exe
File opened for modification	C:\Windows\Installer\MSIB3FB.tmp	msiexec.exe
File created	C:\Windows\Installer\e5993da.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFE4FAFCD0FE2EC0C8.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_93841500\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_93841500\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_93841500\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_93841500\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_93841500\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_93841500\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_93841500\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_93841500\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_93841500\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_93841500\_locales\fi\messages.json	msedge.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\SystemTemp\~DF1251256AEA23F5A4.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{441FCDB0-A03A-4130-A1D5-FFD8C53CFF6B}	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_93841500\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\Installer\e5993d1.msi	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_93841500\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_93841500\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_93841500\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_93841500\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_93841500\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_93841500\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_93841500\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_4616_1835115975\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_108_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_93841500\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_93841500\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_93841500\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\Installer\e5993d5.msi	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_93841500\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_93841500\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\~DFCF06C2C3068A21B5.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_93841500\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_93841500\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_93841500\128.png	msedge.exe
File created	C:\Windows\Installer\e5993d0.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF1EAB7CB53FAE117A.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_93841500\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4616_93841500\_locales\mr\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wixstdba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wixstdba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wixstdba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.10-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.10-win-x64 (1).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.10-win-x64 (1).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.10-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.10-win-x64.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2524	msedge.exe
1504	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134302894564654443"	msedge.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F94CC8A8E1D7CD547B5B53FF162A2CE5\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{8A8CC49F-7D1E-45DC-B7B5-35FF61A2C25E}v80.40.55332\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2FA394AD12A558D4BB7557D75752BE37	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2FA394AD12A558D4BB7557D75752BE37\ProductName = "Microsoft .NET Host FX Resolver - 10.0.10 (x64)"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2FA394AD12A558D4BB7557D75752BE37\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\9309C9E278150CC5452917C0EA916C61	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0BDCF144A30A03141A5DFF8D5CC3FFB6\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{866BECDA-F284-473A-9E84-0CCE816BF06F}\Dependents\{866BECDA-F284-473A-9E84-0CCE816BF06F}	windowsdesktop-runtime-10.0.10-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A8A84F1AA6E5EFD5BE00C8237B84D6D4\F94CC8A8E1D7CD547B5B53FF162A2CE5	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x64\Dependents\{866BECDA-F284-473A-9E84-0CCE816BF06F}	windowsdesktop-runtime-10.0.10-win-x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2FA394AD12A558D4BB7557D75752BE37\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.40.55332_x64\Dependents	windowsdesktop-runtime-10.0.10-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0BDCF144A30A03141A5DFF8D5CC3FFB6\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{441FCDB0-A03A-4130-A1D5-FFD8C53CFF6B}v80.40.55332\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{866BECDA-F284-473A-9E84-0CCE816BF06F}\ = "{866BECDA-F284-473A-9E84-0CCE816BF06F}"	windowsdesktop-runtime-10.0.10-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F94CC8A8E1D7CD547B5B53FF162A2CE5\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.40.55332_x64\ = "{DA493AF2-5A21-4D85-BB57-757D7525EB73}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2FA394AD12A558D4BB7557D75752BE37\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_80.40.55332_x64\Version = "80.40.55332"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0BDCF144A30A03141A5DFF8D5CC3FFB6\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0BDCF144A30A03141A5DFF8D5CC3FFB6\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{441FCDB0-A03A-4130-A1D5-FFD8C53CFF6B}v80.40.55332\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F94CC8A8E1D7CD547B5B53FF162A2CE5\SourceList\PackageName = "dotnet-host-10.0.10-win-x64.msi"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2FA394AD12A558D4BB7557D75752BE37\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0BDCF144A30A03141A5DFF8D5CC3FFB6\Version = "1344854052"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1875162379-3804078649-638427191-1000\{45EC5A72-450C-4E2F-999C-718F81DC88DF}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\{866BECDA-F284-473A-9E84-0CCE816BF06F}	windowsdesktop-runtime-10.0.10-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x64\ = "{8A8CC49F-7D1E-45DC-B7B5-35FF61A2C25E}"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F94CC8A8E1D7CD547B5B53FF162A2CE5\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2FA394AD12A558D4BB7557D75752BE37\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1875162379-3804078649-638427191-1000\{14EAA2CC-A763-4EFD-B37E-CABA2CB8D6FB}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0BDCF144A30A03141A5DFF8D5CC3FFB6	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0BDCF144A30A03141A5DFF8D5CC3FFB6\PackageCode = "69DC61D230D275C4FAFCB32DD99348DD"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x64	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F94CC8A8E1D7CD547B5B53FF162A2CE5	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F94CC8A8E1D7CD547B5B53FF162A2CE5\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2FA394AD12A558D4BB7557D75752BE37	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0BDCF144A30A03141A5DFF8D5CC3FFB6\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0BDCF144A30A03141A5DFF8D5CC3FFB6\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0BDCF144A30A03141A5DFF8D5CC3FFB6\SourceList\Media	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0BDCF144A30A03141A5DFF8D5CC3FFB6\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F94CC8A8E1D7CD547B5B53FF162A2CE5	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F94CC8A8E1D7CD547B5B53FF162A2CE5\SourceList\Media\1 = ";"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2FA394AD12A558D4BB7557D75752BE37\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2FA394AD12A558D4BB7557D75752BE37\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{DA493AF2-5A21-4D85-BB57-757D7525EB73}v80.40.55332\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{866BECDA-F284-473A-9E84-0CCE816BF06F}\Dependents	windowsdesktop-runtime-10.0.10-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F94CC8A8E1D7CD547B5B53FF162A2CE5\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.40.55332_x64\DisplayName = "Microsoft .NET Host FX Resolver - 10.0.10 (x64)"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0BDCF144A30A03141A5DFF8D5CC3FFB6\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0BDCF144A30A03141A5DFF8D5CC3FFB6\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0BDCF144A30A03141A5DFF8D5CC3FFB6\SourceList\PackageName = "dotnet-runtime-10.0.10-win-x64.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\dotnet_runtime_80.40.55332_x64	windowsdesktop-runtime-10.0.10-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x64\Version = "80.40.55332"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F94CC8A8E1D7CD547B5B53FF162A2CE5\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F94CC8A8E1D7CD547B5B53FF162A2CE5\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{8A8CC49F-7D1E-45DC-B7B5-35FF61A2C25E}v80.40.55332\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2FA394AD12A558D4BB7557D75752BE37\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{DA493AF2-5A21-4D85-BB57-757D7525EB73}v80.40.55332\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0BDCF144A30A03141A5DFF8D5CC3FFB6\ProductName = "Microsoft .NET Runtime - 10.0.10 (x64)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0BDCF144A30A03141A5DFF8D5CC3FFB6\SourceList\Media\1 = ";"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2FA394AD12A558D4BB7557D75752BE37\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F94CC8A8E1D7CD547B5B53FF162A2CE5\ProductName = "Microsoft .NET Host - 10.0.10 (x64)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F94CC8A8E1D7CD547B5B53FF162A2CE5\PackageCode = "BB5A5A59AE909304FB0B47459E96A72D"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F94CC8A8E1D7CD547B5B53FF162A2CE5\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A8A84F1AA6E5EFD5BE00C8237B84D6D4	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.40.55332_x64	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2FA394AD12A558D4BB7557D75752BE37\SourceList\PackageName = "dotnet-hostfxr-10.0.10-win-x64.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\0BDCF144A30A03141A5DFF8D5CC3FFB6	msiexec.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3444	msiexec.exe
3444	msiexec.exe
3444	msiexec.exe
3444	msiexec.exe
3444	msiexec.exe
3444	msiexec.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3548	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeIncreaseQuotaPrivilege	3548	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeSecurityPrivilege	3444	msiexec.exe
Token: SeCreateTokenPrivilege	3548	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeAssignPrimaryTokenPrivilege	3548	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeLockMemoryPrivilege	3548	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeIncreaseQuotaPrivilege	3548	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeMachineAccountPrivilege	3548	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeTcbPrivilege	3548	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeSecurityPrivilege	3548	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeTakeOwnershipPrivilege	3548	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeLoadDriverPrivilege	3548	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeSystemProfilePrivilege	3548	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeSystemtimePrivilege	3548	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeProfSingleProcessPrivilege	3548	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeIncBasePriorityPrivilege	3548	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeCreatePagefilePrivilege	3548	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeCreatePermanentPrivilege	3548	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeBackupPrivilege	3548	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeRestorePrivilege	3548	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeShutdownPrivilege	3548	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeDebugPrivilege	3548	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeAuditPrivilege	3548	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeSystemEnvironmentPrivilege	3548	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeChangeNotifyPrivilege	3548	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeRemoteShutdownPrivilege	3548	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeUndockPrivilege	3548	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeSyncAgentPrivilege	3548	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeEnableDelegationPrivilege	3548	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeManageVolumePrivilege	3548	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeImpersonatePrivilege	3548	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeCreateGlobalPrivilege	3548	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeRestorePrivilege	3444	msiexec.exe
Token: SeTakeOwnershipPrivilege	3444	msiexec.exe
Token: SeRestorePrivilege	3444	msiexec.exe
Token: SeTakeOwnershipPrivilege	3444	msiexec.exe
Token: SeRestorePrivilege	3444	msiexec.exe
Token: SeTakeOwnershipPrivilege	3444	msiexec.exe
Token: SeRestorePrivilege	3444	msiexec.exe
Token: SeTakeOwnershipPrivilege	3444	msiexec.exe
Token: SeRestorePrivilege	3444	msiexec.exe
Token: SeTakeOwnershipPrivilege	3444	msiexec.exe
Token: SeRestorePrivilege	3444	msiexec.exe
Token: SeTakeOwnershipPrivilege	3444	msiexec.exe
Token: SeRestorePrivilege	3444	msiexec.exe
Token: SeTakeOwnershipPrivilege	3444	msiexec.exe
Token: SeRestorePrivilege	3444	msiexec.exe
Token: SeTakeOwnershipPrivilege	3444	msiexec.exe
Token: SeRestorePrivilege	3444	msiexec.exe
Token: SeTakeOwnershipPrivilege	3444	msiexec.exe
Token: SeRestorePrivilege	3444	msiexec.exe
Token: SeTakeOwnershipPrivilege	3444	msiexec.exe
Token: SeRestorePrivilege	3444	msiexec.exe
Token: SeTakeOwnershipPrivilege	3444	msiexec.exe
Token: SeRestorePrivilege	3444	msiexec.exe
Token: SeTakeOwnershipPrivilege	3444	msiexec.exe
Token: SeRestorePrivilege	3444	msiexec.exe
Token: SeTakeOwnershipPrivilege	3444	msiexec.exe
Token: SeRestorePrivilege	3444	msiexec.exe
Token: SeTakeOwnershipPrivilege	3444	msiexec.exe
Token: SeRestorePrivilege	3444	msiexec.exe
Token: SeTakeOwnershipPrivilege	3444	msiexec.exe
Token: SeRestorePrivilege	3444	msiexec.exe
Token: SeTakeOwnershipPrivilege	3444	msiexec.exe

Suspicious use of FindShellTrayWindow 23 IoCs

pid	Process
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
1308	wixstdba.exe
4616	msedge.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3444	msiexec.exe
4240	MsiExec.exe
5088	MsiExec.exe
5372	MsiExec.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4912 wrote to memory of 4616	4912	A4abgVzX.exe	90
PID 4616 wrote to memory of 1292	4616	msedge.exe	91
PID 4616 wrote to memory of 2560	4616	msedge.exe	92
PID 4616 wrote to memory of 2524	4616	msedge.exe	93
PID 4616 wrote to memory of 2560	4616	msedge.exe	92
PID 4616 wrote to memory of 2560	4616	msedge.exe	92
PID 4616 wrote to memory of 3736	4616	msedge.exe	94
PID 4616 wrote to memory of 3736	4616	msedge.exe	94
PID 4616 wrote to memory of 1220	4616	msedge.exe	96
PID 4616 wrote to memory of 1220	4616	msedge.exe	96
PID 4616 wrote to memory of 1220	4616	msedge.exe	96
PID 4616 wrote to memory of 5072	4616	msedge.exe	97
PID 4616 wrote to memory of 5072	4616	msedge.exe	97
PID 4616 wrote to memory of 5072	4616	msedge.exe	97
PID 4616 wrote to memory of 3900	4616	msedge.exe	98
PID 4616 wrote to memory of 3900	4616	msedge.exe	98
PID 4616 wrote to memory of 3900	4616	msedge.exe	98
PID 4616 wrote to memory of 1968	4616	msedge.exe	99
PID 4616 wrote to memory of 1968	4616	msedge.exe	99
PID 4616 wrote to memory of 1968	4616	msedge.exe	99
PID 4616 wrote to memory of 3340	4616	msedge.exe	101
PID 4616 wrote to memory of 3340	4616	msedge.exe	101
PID 4616 wrote to memory of 5984	4616	msedge.exe	102
PID 4616 wrote to memory of 3148	4616	msedge.exe	103
PID 4616 wrote to memory of 5984	4616	msedge.exe	102
PID 4616 wrote to memory of 3148	4616	msedge.exe	103
PID 4616 wrote to memory of 932	4616	msedge.exe	104
PID 4616 wrote to memory of 932	4616	msedge.exe	104
PID 4616 wrote to memory of 932	4616	msedge.exe	104
PID 4616 wrote to memory of 1232	4616	msedge.exe	106
PID 4616 wrote to memory of 5676	4616	msedge.exe	107
PID 4616 wrote to memory of 5676	4616	msedge.exe	107
PID 4616 wrote to memory of 5468	4616	msedge.exe	108
PID 4616 wrote to memory of 5468	4616	msedge.exe	108
PID 4616 wrote to memory of 5276	4616	msedge.exe	111
PID 4616 wrote to memory of 5276	4616	msedge.exe	111
PID 4616 wrote to memory of 4700	4616	msedge.exe	112
PID 4616 wrote to memory of 4700	4616	msedge.exe	112
PID 4616 wrote to memory of 3340	4616	msedge.exe	113
PID 4616 wrote to memory of 4284	4616	msedge.exe	114
PID 4616 wrote to memory of 3340	4616	msedge.exe	113
PID 4616 wrote to memory of 4284	4616	msedge.exe	114
PID 4616 wrote to memory of 4284	4616	msedge.exe	114
PID 4616 wrote to memory of 4952	4616	msedge.exe	115
PID 4616 wrote to memory of 5244	4616	msedge.exe	116
PID 4616 wrote to memory of 5244	4616	msedge.exe	116
PID 4616 wrote to memory of 5244	4616	msedge.exe	116
PID 4616 wrote to memory of 1696	4616	msedge.exe	117
PID 4616 wrote to memory of 1696	4616	msedge.exe	117
PID 4616 wrote to memory of 3644	4616	msedge.exe	118
PID 4616 wrote to memory of 3644	4616	msedge.exe	118
PID 4616 wrote to memory of 3644	4616	msedge.exe	118
PID 4616 wrote to memory of 4356	4616	msedge.exe	119
PID 4616 wrote to memory of 4356	4616	msedge.exe	119
PID 4616 wrote to memory of 4356	4616	msedge.exe	119
PID 4616 wrote to memory of 5548	4616	msedge.exe	131
PID 4616 wrote to memory of 5888	4616	msedge.exe	122
PID 5888 wrote to memory of 3520	5888	windowsdesktop-runtime-10.0.10-win-x64 (1).exe	123
PID 4616 wrote to memory of 3624	4616	msedge.exe	124
PID 3624 wrote to memory of 1308	3624	windowsdesktop-runtime-10.0.10-win-x64 (1).exe	125
PID 4616 wrote to memory of 3808	4616	msedge.exe	126
PID 4616 wrote to memory of 1240	4616	msedge.exe	127
PID 4616 wrote to memory of 4540	4616	msedge.exe	128
PID 3624 wrote to memory of 3548	3624	windowsdesktop-runtime-10.0.10-win-x64 (1).exe	129

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\A4abgVzX.exe
"C:\Users\Admin\AppData\Local\Temp\A4abgVzX.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?framework=Microsoft.NETCore.App&framework_version=10.0.0&arch=x64&rid=win-x64&os=win10&gui=true
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4616
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffc6abdc188,0x7ffc6abdc194,0x7ffc6abdc1a0
    3⤵
    PID:1292
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,11296248914239582712,7312094414630526698,262144 --field-trial-handle=2288,i,8933860736314230535,2316679743596673053,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:2
    3⤵
    PID:2560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1888,i,17518840970612489110,2824672068287322821,524288 --field-trial-handle=2288,i,8933860736314230535,2316679743596673053,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:11
    3⤵
    - System Time Discovery
    PID:2524
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2552,i,9532442574237724442,6386894786303170588,524288 --field-trial-handle=2288,i,8933860736314230535,2316679743596673053,262144 --variations-seed-version --mojo-platform-channel-handle=3392 /prefetch:13
    3⤵
    PID:3736
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3572,i,1044713103818205707,8957029643012815754,2097152 --field-trial-handle=2288,i,8933860736314230535,2316679743596673053,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
    3⤵
    PID:1220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3576,i,9633807521730219937,16672445351229717739,2097152 --field-trial-handle=2288,i,8933860736314230535,2316679743596673053,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
    3⤵
    PID:5072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4172,i,13578462403608302960,12635201563251382774,2097152 --field-trial-handle=2288,i,8933860736314230535,2316679743596673053,262144 --variations-seed-version --mojo-platform-channel-handle=4716 /prefetch:1
    3⤵
    PID:3900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4184,i,12515254485673751773,7845876396400510498,2097152 --field-trial-handle=2288,i,8933860736314230535,2316679743596673053,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:9
    3⤵
    PID:1968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5264,i,4694531100532200012,4651286974420106775,524288 --field-trial-handle=2288,i,8933860736314230535,2316679743596673053,262144 --variations-seed-version --mojo-platform-channel-handle=3780 /prefetch:14
    3⤵
    PID:3340
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5352,i,2436062532168719103,8328449687836070703,524288 --field-trial-handle=2288,i,8933860736314230535,2316679743596673053,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:14
    3⤵
    PID:5984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3612,i,11506813869774315967,17197290299260038563,524288 --field-trial-handle=2288,i,8933860736314230535,2316679743596673053,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:14
    3⤵
    PID:3148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3708,i,2715443296115673121,9047668059958329023,2097152 --field-trial-handle=2288,i,8933860736314230535,2316679743596673053,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:1
    3⤵
    PID:932
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3532,i,509161923736440746,10190911767611590065,524288 --field-trial-handle=2288,i,8933860736314230535,2316679743596673053,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:14
    3⤵
    PID:5708
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3532,i,509161923736440746,10190911767611590065,524288 --field-trial-handle=2288,i,8933860736314230535,2316679743596673053,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:14
    3⤵
    PID:1232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6324,i,13849171015816413022,2514743618947207366,524288 --field-trial-handle=2288,i,8933860736314230535,2316679743596673053,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:14
    3⤵
    PID:5676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6584,i,5312961162933954265,5112005917794306986,524288 --field-trial-handle=2288,i,8933860736314230535,2316679743596673053,262144 --variations-seed-version --mojo-platform-channel-handle=6560 /prefetch:14
    3⤵
    PID:5468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6696,i,1562249110161186675,18283501666525866968,524288 --field-trial-handle=2288,i,8933860736314230535,2316679743596673053,262144 --variations-seed-version --mojo-platform-channel-handle=6616 /prefetch:14
    3⤵
    PID:5276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6452,i,3192588733102050063,15241602896280667508,524288 --field-trial-handle=2288,i,8933860736314230535,2316679743596673053,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:14
    3⤵
    PID:4700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6324,i,15792043036856470132,15570634082989303469,524288 --field-trial-handle=2288,i,8933860736314230535,2316679743596673053,262144 --variations-seed-version --mojo-platform-channel-handle=6696 /prefetch:14
    3⤵
    PID:3340
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6820,i,2188899802986885457,10265396037545519496,2097152 --field-trial-handle=2288,i,8933860736314230535,2316679743596673053,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:1
    3⤵
    PID:4284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7188,i,9352552454935823387,14456226374783577409,524288 --field-trial-handle=2288,i,8933860736314230535,2316679743596673053,262144 --variations-seed-version --mojo-platform-channel-handle=7176 /prefetch:14
    3⤵
    PID:4952
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7244,i,16842713407079020117,12876543256702613415,2097152 --field-trial-handle=2288,i,8933860736314230535,2316679743596673053,262144 --variations-seed-version --mojo-platform-channel-handle=7272 /prefetch:1
    3⤵
    PID:5244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7560,i,2160977238625393399,7678726030872418008,524288 --field-trial-handle=2288,i,8933860736314230535,2316679743596673053,262144 --variations-seed-version --mojo-platform-channel-handle=7556 /prefetch:14
    3⤵
    PID:1696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7248,i,14007689666738603949,9108954088115309279,2097152 --field-trial-handle=2288,i,8933860736314230535,2316679743596673053,262144 --variations-seed-version --mojo-platform-channel-handle=7752 /prefetch:1
    3⤵
    PID:3644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=4856,i,9828686037544697474,11571777117615006871,2097152 --field-trial-handle=2288,i,8933860736314230535,2316679743596673053,262144 --variations-seed-version --mojo-platform-channel-handle=4968 /prefetch:1
    3⤵
    PID:4356
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7632,i,9900930967474217023,13909890166584471887,524288 --field-trial-handle=2288,i,8933860736314230535,2316679743596673053,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:14
    3⤵
    PID:5548
- - C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.10-win-x64 (1).exe
    "C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.10-win-x64 (1).exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5888
  - - C:\Windows\TEMP\{AEB2F2A1-5C2E-4D86-A674-613867E26F01}\.ba\wixstdba.exe
      "C:\Windows\TEMP\{AEB2F2A1-5C2E-4D86-A674-613867E26F01}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{B808BF7A-9CB3-4F2A-9D2C-0122D386113D} {F6ACBC96-02C0-4FB5-88A6-72CC154BB65B}
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3520
- - C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.10-win-x64 (1).exe
    "C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.10-win-x64 (1).exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3624
  - - C:\Windows\TEMP\{D9CB1E16-21CD-4805-B42F-5D5C61BAD530}\.ba\wixstdba.exe
      "C:\Windows\TEMP\{D9CB1E16-21CD-4805-B42F-5D5C61BAD530}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{02950C83-A11D-4B92-A366-F5A3ADBC27E4} {05DAFC39-719F-445E-AAC5-46A6FE06B249}
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      PID:1308
  - - C:\Windows\TEMP\{D9CB1E16-21CD-4805-B42F-5D5C61BAD530}\.be\windowsdesktop-runtime-10.0.10-win-x64.exe
      "C:\Windows\TEMP\{D9CB1E16-21CD-4805-B42F-5D5C61BAD530}\.be\windowsdesktop-runtime-10.0.10-win-x64.exe" -q -burn.elevated BurnPipe.{A966F57E-75D3-4F96-9906-943BCB76FA40} {0AD0EC5B-FAAD-4D95-B5BB-5CC87B0D048E} 3624
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      PID:3548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6608,i,17538898937968635524,15242807644898622776,524288 --field-trial-handle=2288,i,8933860736314230535,2316679743596673053,262144 --variations-seed-version --mojo-platform-channel-handle=6712 /prefetch:14
    3⤵
    PID:3808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3884,i,16962439554634032786,2589853628800057029,524288 --field-trial-handle=2288,i,8933860736314230535,2316679743596673053,262144 --variations-seed-version --mojo-platform-channel-handle=7308 /prefetch:14
    3⤵
    PID:1240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6872,i,12583139500240255294,17852143294065939801,524288 --field-trial-handle=2288,i,8933860736314230535,2316679743596673053,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:14
    3⤵
    PID:4540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
    3⤵
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    PID:1180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2e0,0x7ffc6abdc188,0x7ffc6abdc194,0x7ffc6abdc1a0
      4⤵
      PID:1820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1768,i,1353741812181866697,17389351948935729583,524288 --field-trial-handle=2580,i,5919475259994983975,4758349975450114718,262144 --variations-seed-version --mojo-platform-channel-handle=2656 /prefetch:11
      4⤵
      System Time Discovery
      PID:1504
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1564,i,12272314846101124703,1822462254529699360,262144 --field-trial-handle=2580,i,5919475259994983975,4758349975450114718,262144 --variations-seed-version --mojo-platform-channel-handle=2560 /prefetch:2
      4⤵
      PID:4360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2256,i,13168813327810596864,12710387849474496597,524288 --field-trial-handle=2580,i,5919475259994983975,4758349975450114718,262144 --variations-seed-version --mojo-platform-channel-handle=2596 /prefetch:13
      4⤵
      PID:928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4360,i,12374440945889467907,4767958466916272408,524288 --field-trial-handle=2580,i,5919475259994983975,4758349975450114718,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:14
      4⤵
      PID:5696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4360,i,12374440945889467907,4767958466916272408,524288 --field-trial-handle=2580,i,5919475259994983975,4758349975450114718,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:14
      4⤵
      PID:5972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4892,i,9931575160312114262,16553371084915981439,524288 --field-trial-handle=2580,i,5919475259994983975,4758349975450114718,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:14
      4⤵
      PID:3844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=600,i,13388413937406531684,16606026012400307747,524288 --field-trial-handle=2580,i,5919475259994983975,4758349975450114718,262144 --variations-seed-version --mojo-platform-channel-handle=4924 /prefetch:14
      4⤵
      PID:5404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4480,i,4634126278211128495,12810480898420137716,524288 --field-trial-handle=2580,i,5919475259994983975,4758349975450114718,262144 --variations-seed-version --mojo-platform-channel-handle=4968 /prefetch:14
      4⤵
      PID:1872

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5544

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4776

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3444
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding B1CC7571E61AF21B496DE92EF9E490AA
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:4240
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding FE96D8B486AB6A91B12D4AAFBC582258
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:5088
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 525CCCEA69255A56FAAB38BB7FCF6F19
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:5372
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding A4931200061F89760A6B098EA10EF8F8
  2⤵
  PID:4588

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:5548

C:\ProgramData\Package Cache\{866BECDA-F284-473A-9E84-0CCE816BF06F}\windowsdesktop-runtime-10.0.10-win-x64.exe
"C:\ProgramData\Package Cache\{866BECDA-F284-473A-9E84-0CCE816BF06F}\windowsdesktop-runtime-10.0.10-win-x64.exe" /burn.runonce
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5108
- C:\ProgramData\Package Cache\{866BECDA-F284-473A-9E84-0CCE816BF06F}\windowsdesktop-runtime-10.0.10-win-x64.exe
  "C:\ProgramData\Package Cache\{866BECDA-F284-473A-9E84-0CCE816BF06F}\windowsdesktop-runtime-10.0.10-win-x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.10_(x64)_20260804045800.log"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4192
- - C:\Windows\TEMP\{A1922651-0B5D-4094-B615-DE8E697C1B3B}\.ba\wixstdba.exe
    "C:\Windows\TEMP\{A1922651-0B5D-4094-B615-DE8E697C1B3B}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{191E90E5-F83D-4CA5-93A0-DFDCBD876D36} {A5672679-0BCC-45FB-AF7A-A98D8CE949CC}
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1740

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1304

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3272

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5993cd.rbs

Path C:\Config.Msi\e5993cd.rbs
Size 11KB
SHA256 7cc37c0de7818b1df81d247b3eb0dd66070f9e2d2bd301afbed6bb60f1940a8c
MD5 10b6eece18b7637cabb599c929d3054c
SHA1 d40555ffb34b610f1ba84cfae7b7e621ef43200c
SHA512 8d7a516b33b3b7a70fce4004c4e68047f71304fbcd49dcf117263edb32eedd471ecb92a0ed33d6f36c53fc0947cd04bc1f618cfdcbe054b1ff86697c542c1fd5
SSDEEP 192:/rHHCR6C9t15HJAQ9CqxRRI1RRlHE+o5Ca35pbM:/rHHCR6C9t15HSwRoRzaM
TLSH
T1F83252027604D2D7E9DB2B38D71727703B73D3A99314674F05CCC22C9F8B7884A64AAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5993d4.rbs

Path C:\Config.Msi\e5993d4.rbs
Size 9KB
SHA256 feabc29df351d73bd6560cb0b7dfc041219332b49650baf94ea34609bf1601cb
MD5 66a89e37f2b501d9aa453df06b92f52c
SHA1 9b8e4c881e4eed09bcf672ee9feee37ffd753d14
SHA512 958b7bcd4d29091d2f82f8d4ede8fe928f424f2b17d4b82482c1a4babd6dafc335237dcc41a92e93d1ac10b3f4d556a48395efc080f448ace68af8991cf3d951
SSDEEP 96:tmSDTaA3rWS2Cv3FeU8eD2AyCsTlyyU8eD2AyC6jMlN8gnuTlyfnyP7E5d7P/53k:wCmOECdxtRIItRP0F7EbnKCCi5pu3
TLSH
T1FF121012750081A2E9921B39C7133B223BBAD3D99315665F48CDE9F41E03BD52FA91DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5993d9.rbs

Path C:\Config.Msi\e5993d9.rbs
Size 49KB
SHA256 975ce98ef5379b811c9cbc792a3152ce38a7f8bb60f5518a34118b4f75ade921
MD5 5bce3db20625f0d45b0691f576cc79cc
SHA1 161aca8b0231bced6823e464b97fd148f654f6da
SHA512 f26b95acf5d0194936913e50c73ab9bc2c1751ea5f7bfe58314ea1d6d6f6427c1c36e66acb7c3f8d388b3b1b78c951e16f645e10f1e9240ee0a86ec9901b129a
SSDEEP 1536:3HZgOohW4wN5RaHB/LyM/ajqmuUHr92ha8u3tn2N8zRM9Wc/hihbZGXEpp4IQPD9:+NgeE+BD
TLSH
T1F4335461DB08C0F2F9333DA26770F8847719C99AE34095AD16D60144CEA6EEEDEBD1E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5993de.rbs

Path C:\Config.Msi\e5993de.rbs
Size 71KB
SHA256 bff55a56e2eef67800e7adcd1cbf5ae8841c7a68fa917b80cf3e8c6f33f0695f
MD5 0d5c027357b7afacc825e92d2708da86
SHA1 28638679a24b80bdb92a0fa2118d2b75fad868cb
SHA512 1238c03c287a489033a5e85272d30eacddaf904e9c62aaf6921903c33901d93d4e26bee1e8bbbe9d7907ed14757777a50beb2519762e5a1aaae3f5e10fc2f13c
SSDEEP 1536:4lTX+EvElgJPlhUR+6svby5ybcmb/WrPMmq0mgG2WdDfbH9cMWmHDCaJVZ/KoLHk:ku2T+LmEEiycECCoeWB
TLSH
T17C6324BA7A14D1C1BC732DD457BBE916AD054C7393608D2E63CC4129CDD2A86EFB86E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ThirdPartyNotices.txt

Path C:\Program Files\dotnet\ThirdPartyNotices.txt
Size 77KB
SHA256 deb4427a295e1ed474b0d81c5a0d972c1b550b9a715cda939cdfa9236b1b418f
MD5 0d8867a25ba926e6e40cd52ab3536b5c
SHA1 89390dc8b8318d0bfef1c6a2fb4783537e28a465
SHA512 317ca335405274f4f91b173651ca2826760acb5ba5cf41aff51adc55c2cda9059fb268333665f13f62fa48119e55a303720a780dd58d28dd9967db4c88407d61
SSDEEP 1536:HA9jHwsGfgg39/zwgAVkguQxrDjugtSEGepkWvrpX7anuqdLSVnfiStPq+3LefrL:HA97w/ogz1AVxuMjHtSFULryLOgrGWm+
TLSH
T17773A45F7E45077319E2C3916569A8C5F22FA02E3B6B2A44346EF248133B42DD6FF858
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 163KB
SHA256 4377f10c78400f0370b88156773de9843c07f14e65b3232005ec3179ef38d463
MD5 363603c51aa522bf21b2e8320a51c54e
SHA1 b4dba9e0d47c9fd4636549d5a23fe1a96faf9b1f
SHA512 b2b045ad8538416bd81753359ca86ba956f2ac99befeb89c7c03993741411703e03f4373d11cb94992cb93ed569d6741954111f4ad519daebcb18138800877ce
SSDEEP 3072:oGgPYwruvTSBbQ/fp4SbDqIG/vk7l55wK9vLPg:oG4rubgbQpDvqIbt10
TLSH
T1A6F3F61AD65811AAD06E9575CB428941BB337C668BE0E3CB53C0F9BE0F726905EF9703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

state.rsm

Path C:\ProgramData\Package Cache\{866BECDA-F284-473A-9E84-0CCE816BF06F}\state.rsm
Size 1KB
SHA256 9fe2a11e5c2c34ba23870fe07e6355b4103664b0dd57910bdb4088efc86697b5
MD5 c4b36937b6c6e5ca25f2a3b25f1b2545
SHA1 b652ac9128ebf9a8399f7f0d63afb458b79043f0
SHA512 23001ed33f48826cdebfb7069e2a765a727e5c37124b41d36bc68caa5702fc85e4c0d216aec5a0a0cbf485a0c4b369c6e98fb28078c0c5d04461c3e6dae3853a
TLSH
T12121AD515BF6092CF3F2AB3469F96665443BBC121C24C26E0001318A9E32BD0CCB4B37
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ecdd5c8034c45eff453cbaf31d8886e2bd9609a73853367a6d096a69cc81f1be
MD5 a774534a956a5c8affebe08e87c80683
SHA1 b3e4e20a91e4087d3b9247b5ef6815f51858a041
SHA512 27769aee2cac148a0154fe42b51da2a9a1088e9e990873915b4c7ab9bd5442a3facf82b2bd1cbaef75328bd5937813698b96ac06aa76d934d07ab5ebb194a824
TLSH
T103D09B6673449A1CC9C439712461565161115820E41443581C96715CCDE56C707571DE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 dfacefa73d018d54e3feba3eef28ec722a8422fee8768a2c3d8d6253f863b375
MD5 cb5000b6fab1115bfff50bedcc3eb9fd
SHA1 afbfe0ec03df59e7a1eba1da4227111508419c03
SHA512 aab9a1afd5de2f983466724b6ecf0dbc2e176c5a1eb2f059b9507511cc53643fcf9ed990bd565f22f8d53fb82db71cba238962a75c68db02d5f10b526661bd08
TLSH
T15AD09B667354991CC9C439712462565161015820941443581D96B16CCDE56C707561DA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2923c1222ce49db187e097dafa5245e107880e380c2d4c3c042ec4c5e21d98bb
MD5 da1d8185397a8ac0bd44a31e4155fa93
SHA1 7c2bea94dea010a070c12a44a8464f7b1c541abe
SHA512 87ca63d88bf02a3c244ee505ed09f102c1f20a53c8d7854e1a9e11961db009f99bf7a7a5380ad49ee5b98c2e3c4196c803c521d754b64bb9070c4a8694487664
TLSH
T1DCD023317929F3A0CA1C013040100A002126447171A3435138E6180CCFF40C047CBEDA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 651be877889335a4ad7198a3507e3930ef716ac9998484096808162e5a711a96
MD5 1745a08c06e165957f34b3d9192f62f7
SHA1 c716e9b951730b0e1d8021f0dcd30da5b8b60857
SHA512 3424db9f5b119014f7384e2240c729411f703bc2e259553479022878fc1cb6089a7995fb50a5299710a6f412569129b8aaab29e2b3f773b2bd37afd65e447a75
TLSH
T1FDD02375B345D720CA0D55305811E7512273457070B7C77268F6644DDAE80C893DF199
MD5 SHA1 SHA512 TLSH

Submit Download

429ef2db-b5d4-4565-b4d3-e00669c90290.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\429ef2db-b5d4-4565-b4d3-e00669c90290.tmp
Size 414B
SHA256 6434cc3abdf62ac5dba66026f08c9ddd8c12cc8652a5d09b59d8ebc0fed68d28
MD5 712ac97902db4ed518ddc769f69cacc1
SHA1 c92e76cb133a707371912ed2c31bafd53b6c7568
SHA512 d9a8a41c19c222bfc8dc9e290fef9b9cb33686bac20ae217118c00a1ca7c9ddbb47c442fe7afcebcf2a5328101d22cb76904322bdf87a2ec73c1fa42ebc86ce7
TLSH
T159E02B69C920AC3B0AFD0B5A50500787D75113562B51A94F3B3DD11C8FB0A3B69C5D5C
MD5 SHA1 SHA512 TLSH

Submit Download

917be889-87e1-429d-99c2-89e1578e29c8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\917be889-87e1-429d-99c2-89e1578e29c8.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 49cf8c71db04f151cff73d0f3decb718b0e642d501af86ba327510e24f65fc9c
MD5 249a2d8d923ee91a040cb85d575279b6
SHA1 50ba657661ad9de5f9f2383a0a36ff691a200a9a
SHA512 3e135023b1b7700069acedf7d3b47461ffbb1ba9bf5a85fdc7cf7a2ac6fff1411422518b73d3385bc9693d557a6e375dfeb8c29a3c5bdc346a5e95b0dc0f7648
TLSH
T192618601837A18DFE728547140E1149B37FEA0DD25EB2E1D1693AD7AAAC2F367DE8003
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59ac92.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59ac92.TMP
Size 3KB
SHA256 cbfae615469560c8124e2a77a343156d48cfde3a404fe27ef1519520ad9d7eb2
MD5 57b87b5a52571e05e40219e86fc4a72c
SHA1 7d2901119072cb4fa777cf4b2e0df8c46d9b92b4
SHA512 d087c75a30fbbc9eccded94a2a74f3ec4a25dbb846b5e20059deb16868fc0ed39670a372cddd8d1f1b2bb3609de75a2f11231675c5bbd3e82303f0f570716950
TLSH
T1E3512F01833A08DFE728947140E1549F37FAE4DD24AB2E1D0693AD7A6AC2F367CE9013
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 f1a9271b31bd588bd67e07bbd3f792c3ddc697f229ea3fc728e9fdb164fa65f8
MD5 aac07577349b1c92aaeb0cd41c5c899f
SHA1 f7fce7b286a8ef5571b8925d64c56a4f041100ea
SHA512 9ecdfcff30810006b6989c04dd85f2850b12eb5dc14f23b1a11c9dff8b924ea3321e0b17ea6f377c8e066e56e42a63cd42566963e21b937e798f169f0a5d25aa
SSDEEP 3:MsEllllkEthXllkl2zEklsvK/:/M/xT02znsi
TLSH
T13E4404047FD00407CF5015304011D7501371F41407115F4334515433DCCD5C00C10C00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

f1eebf5d-7d3d-4fde-b475-f001c71bb29b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\f1eebf5d-7d3d-4fde-b475-f001c71bb29b.tmp
Size 3KB
SHA256 328b2a1acd5c779d744c8e28f3d0e8bc35837eca2b570aaa6405771fe2ece20f
MD5 20a99aeb7268e22d8b04eb11877c4865
SHA1 3d6363f7662782896b9950a34fab3ea40d8b2ff7
SHA512 61b70f1e38d5cf43cf263e721dbef39dbcf11a67f0c2fada9a2a633bf41e699d0f21a043947655b3b129bf21d05e80fde9c9720065d23cc6f8075ee5d55bd7a7
TLSH
T17C71ADF787E4856E8A0196F0A614AE2FDF2D0615431C3C6A89E4EE27D3E3472E14165F
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 fe599da398880e8aad55c6c28b63fa06d6a03acc8ec52c67b227727daa350bc8
MD5 5bfc41ce892479dea8d942f4f49bbd3d
SHA1 06440d24a109705608667de4c048c6e0d6360aad
SHA512 e2129054f2dc2b2f10820a3e07b350507a20f0517e86bb3761b09f722149d6c10d66f61e905fed52d674ff451c6b613f66258076ee02ed7a60365d2838f918b8
SSDEEP 192:sxRERBT3/f6s5gJEdZuIUzoA8p9y/g6+WNZ00XAjD9A6StGhhIgDuSWJJ:sxREz3/f6s5gJETv10/5BXeSSC
TLSH
T1CA42F856A978693B5CCBD20DBB55BF53E2F91032A1D05E18A7FC961C00E76DD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 59cf40098daedae649e6e40e5a24acb676e18253a257bbe09639e38ad45b582b
MD5 32b8016993565228408d85aa54a44fa0
SHA1 1e538b1d3501d739b426886f9513ca3283a826d7
SHA512 22f80530e77f6c43160215648462ef748824b7a48f2a096582b91e2290580572433eb52d44f008441a52e77315a7ecaefa93e555de6fd61bd20b1143e0aad1f4
SSDEEP 192:sxR3RBT3/f6sjgJUdZuIUzoA8p9y/g6+WNZVy/AjD9H6StGhhIgVSWJJ:sxR3z3/f6sjgJUTv10/5e/7SS9
TLSH
T17542D7166978A93B5CCBD21DBB15BF53E2F91032A1D46E18E7FC961C00E76DD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 9bf70a8f05650cc50aaa10ceac9a210aef8a2db90a764b26501fbe6bcf5038f7
MD5 7bf282d9a30e12858cf61c645f2d36da
SHA1 1566b5ea7cc2db327912a55c7bca875e708d1263
SHA512 ebb166ba4b9b4cd5543a1bc45d70ffa5ee61f521da213c8fc01cfb056bc91495d03a6a0248f7780c10744dcd10bf62f27705f7ca145d4fddaa606e3a8fe66206
SSDEEP 192:sxRERPT3/f6s5pWpVnJEdZuIqzoA8p9y/g6+WNvL00XAjD9NO6S0ghhIgDuSWJJ:sxREd3/f6s5pWvnJETvn0/5/XMHSZC
TLSH
T17D52E856A978993B9CC7D21DFB55BF23E6F91022A1D05F14A7FC9A1C00E76DD620380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 e7a32e26c940b3be8ba135e2b0448a9142bf1d71c38e8944f560d1e23c6036cc
MD5 6706618525494b64f5bf7edd38816650
SHA1 2562b90ee2a845da94cb1dd524aaeb4f98f128fc
SHA512 2fcaf6a74f161e987cdb758f42598249d9d55a465bef172f4cf280dd891ba2161d314cc47fbbb93df45b8ad0e1b65bc88f0e0ba912ba0a34b89edea4346f4397
SSDEEP 192:sxRERBT3/f6s5gJUdZuIUzoA8p9y/g6+WNZ00XAjD9k6StGhhIgD8SWJJ:sxREz3/f6s5gJUTv10/5BXoSSc
TLSH
T13742E816A938A93B5CCBD21DFB55BF53E2F91032A1D06E18A7FC961C00E76DD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 8308c1e3133103ce5b168d87d8cc9ed232d2907d512fc4af863c1e097542d0b6
MD5 bbf7380e53b80e75127742fbec49ab42
SHA1 9cc36c15ce6c9901a4a3e62c32969ce7c98a581b
SHA512 c31cf7267e247046043c14be0a1ea7086719006f0be4de95aea7fcaf74d1300c147aef44f3ba23f7c710095b8d05a58b7b0a1cd9f7b4e04516d2a2feb4f4ac5f
SSDEEP 192:sxRERPT3/f6sHWpVHJ8dZuIF9zoA8p9y/g6+WNvL00XAjD9NO6SQGhhIgDuSWJJ:sxREd3/f6sHWvHJ8TvFw0/5/XMHS3C
TLSH
T11652E84AA974593B9CC7E21DFB567F63E2F91022A1D05F54ABFC9A1C00EB6DD620340B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 31aeca805c166d7baf7d8d83eb8e418095e8f026783e706ac384ced178cbded6
MD5 3ad25b219866f614b388ebbc81852010
SHA1 68622fa85db8dcad32246fa8da55c61f78712919
SHA512 91638d4f009afbab6eaa333807754711276179b9137d7c0bffe41c336d36409fdfcf2e8b88b46579976ab57be41c31c7fc5decffd212fdfd22344ad2e75d267e
SSDEEP 768:azfWgw7pLuLf30Wg/XfHf8F1+UoAYDCx9Tuqh0VfUC9xbog/OVMSYc16uropL5NP:azfWg8Ef30Wg/XfHfu1javSYy6lpLH
TLSH
T163D2DA7B640CCA7F4F800ADDAD197EDB6DA802CB9698CD5047FE941C02C6BEB52164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 41b1e2ff48acf86b417452ebb4176e034217aff43c8bebe3c8cedc039b317331
MD5 72b2e87c3472657adeb8df0f885bf9bb
SHA1 678cb7875cabf0d595a4be000eb099771a4f6fac
SHA512 fe44b3d7e6512003cb06c4d428ad863b2c9a6bbbeef2b1cb5634c75d69537b0285e6e727c5c1c7c96516e8147f9ec51d25f0bc3e596b85b312ecd5ce4075e36c
SSDEEP 96:KRI5MYKWaAW+jTgAAK4VgiAcQATCoNu/6KwEW+JaKSIuk:CI5MYKWaH+jMA0VgifQATCoNRxNu
TLSH
T15191E114727E02457C7FA60C81A4891B9682B4637416E46BBBF940AA4F67F164CFDCCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4d26b1a9-8ee0-4f7b-a977-48f8686451dd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\4d26b1a9-8ee0-4f7b-a977-48f8686451dd.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 b7cdd32c37e6e7e412aee15d02b2567e685de6bf83c3be77e7d72eee14384136
MD5 23a0fdbf2cd140574c4e63c25c58ef73
SHA1 51744e95bf807eab4e57398f232ac7da2a977f6a
SHA512 2e8c860c3469d3cd9484489103ae298e8db55ece00d633f75fa98fe57b90d7d50b4127e0900455ea7efe0096d8e625a0cec9ac251a50c138f727cf055b97d47d
SSDEEP 768:JR3Rpi0DM+grEnjN3Gac1FbojKgqmUmhOG7:JR3ZdgQnjMaUfgRUm8G7
TLSH
T183F2BF7468A59DB38CFAE386B5433B426EF015B384D44FA4E6DDBA0D118759C270B837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 6b376d0c72c7862c2c3b49338187ee1425a16fc726a2493491e74bfa9b911b8f
MD5 5c12b01ea25c0f70ec7a154b7330d3fa
SHA1 346558165b641434714cbea2e7a5770b05935134
SHA512 dfd664ef6924f44983b1391e5cdb62c924d6ed0a2042b3b0dd437aa26f6bad6cb2ee3787cfcf6f513f5c1842f9445c9c63ef36203f4454e6eecaa66033aeb3ab
SSDEEP 768:yR3Ipi0DwrEnjN3Gac1WrQb9jh0MjKgqmUmhOGh:yR3wsQnjMaVq9N0TgRUm8Gh
TLSH
T13D03AE385CA59DBB88FEF386724A3A126DE04673D1E40EA4D7DC7B0D516389CE307866
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 60KB
SHA256 53b3e6647cfb950d921f1a41fc6a9d5b7b9fc37af0d8feb9187ff2e2ab334c7a
MD5 03c18c73050e510e0ff09fb139d2b4c8
SHA1 7e31cf85570be4f559ccc99ad3e0aa88910bea63
SHA512 a0c39adac716ff41d0aafcdb7677f2adb3b38d1254ac46c9453de8bf00ceef38b4ceb647453510dea7d214fa9b6435f7c33ccea3694a24c749ece9df6c09f115
SSDEEP 1536:oR3QQnjMawixn6u4XVPcISzCq9N0VgRUm8Gh:ohQQnjC6D8PKCqn8gAI
TLSH
T13F536AF988D39A7AD8EEAB83633D2E0159BCC163B1984494F7C86E0CDC524BFD306914
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 0f73949d4b6f11306faef6b6a2d41d4e0b806eb64e8539fd0d5a6c94258543b3
MD5 2dd2bb9b8f3ef5f666a49d1bd4d81945
SHA1 cd3c0d9fc9a3fdcf1976015601f50a4b096a4923
SHA512 aad3505bff7a1eb0075ef8ed6e84dc11778fdbfd16acc583afa5d1eb4a125c52a0dc9cd2ccf5e64a0e3aa8f5d34e54b365152707629b4ee84a051730e1aded75
SSDEEP 768:aR31pi0DMsrEnjN3Gac1F1nb9jhhojKgqmUmhOG7:aR39VQnjMagb9NhfgRUm8G7
TLSH
T158138D3C9CA55DBF88FEFB85614E3A126DA00673C1B409A4D7D96B0DD173898F307925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 1a2675b4c5cfbdcb2e2e0ee0ea6c56f222e4833263d6f4f906d9cae25cdb0443
MD5 5934166d44b0bfedb270f574adb52c4a
SHA1 f43621b3fe7118d924fd1ca05adedd87d42c6281
SHA512 c21b7eb6f595d706842327fb496cde352db2506a1c4bc27536202386067c2c2c6ecb5c431ded029843c252c26eb8341cfc15a63466774ebf1c8d9420acc762ad
SSDEEP 768:gt3xpi0DMggrEnjN3Gac1FbojKgqmUmhOG7:gt35lgQnjMaUfgRUm8G7
TLSH
T1B1F2BF3468A59DB39CFBE386B58337826EF015B384D04FA4E6DDBA0D11835AC170B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 0490da2d42ea3af97fe42c87430772c0abf14a715f19d0c58d24a4e8a3929bd1
MD5 00432d03584a4233bda224a91c671ca8
SHA1 96aba24067ea8e476a17b777ce15997304ed9be0
SHA512 73c0aa5593403f659b2f6348875a92d56890fb7d20783ef6a5c7461f36f1db81155fe5141054ff00c6d1c8ec93ba0b05419239b7cacd29ff471669d57debb819
SSDEEP 768:rrv+4UNbdS3fmi0DZrEnjN3Gac1ZqeVH1SCz:rbsbg3MlQnjMaJEH1V
TLSH
T11703CF3569A89AB39CEBE385714376037FB4525385940BE0CADD7B0D02DB5EC130B967
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e1367161-6657-4198-82e4-2128d11b85a9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e1367161-6657-4198-82e4-2128d11b85a9.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

metadata.json~RFe595a2c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json~RFe595a2c.TMP
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_10.0.10_(x64)_20260804045800_000_DotNetHost.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.10_(x64)_20260804045800_000_DotNetHost.log
Size 2KB
SHA256 6009b4677e683919d3884063eec4cbd17b6a8e5ce57ed9f1ff99013f16dd9c39
MD5 e8eccb3ba25898f6eee47093bfc986d1
SHA1 cf84a24bc8e0223dd16c22e0cb958a2683df29c8
SHA512 7cfaba0037d0b4a100a274f13cb13483b215703e35d096523b65a6e72e1d98d4616353e2d62d499125b9e623b0f1086da660e1bc7f5772b2dbe755dcb1c29a1c
TLSH
T1FD41F4541AE9090AF1B25757DEF3C053AA73FCE6A874CB0D2245832A066FD0158ACB7E
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_10.0.10_(x64)_20260804045800_001_DotNetHostFxr.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.10_(x64)_20260804045800_001_DotNetHostFxr.log
Size 4KB
SHA256 96ee4702d4785e5fb25ad370b6c2d00b6cc80885d2858b124558625fd080d579
MD5 19a252ac75519c1b5289bbdc5acd313d
SHA1 408449d5952e59ee1536a545af08418f71a0ad23
SHA512 68109041a9b2938e45e2d5a54c5e71b204093f679c040ffa575f4a4b3360212e02bbad34fd70e433399c061a76c964d840e7a96ce4861484d2e67a92456accf6
SSDEEP 96:YD+45kV0YR9+pyJONDCKyZfoiR9+pl0bR9+picVKFMb:eJaWi9dJONDCKyR9r9SKFe
TLSH
T19881EB251FD50946B1B75607DEF38053AA33FCD35974DB0D2286831A016BD0699BCBBE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_10.0.10_(x64)_20260804045800_002_DotNetRuntime.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.10_(x64)_20260804045800_002_DotNetRuntime.log
Size 3KB
SHA256 a6e933d21d0ed27d8ade3432ff4ee3dfdeeaa535d517c0e52a47a1d9f2be1274
MD5 bcb3c846d510cb3d007822939deea58a
SHA1 703972230079e90229e587be5018af932112456f
SHA512 9287c6f84be5e12a9467585cb8b1662fc659f6891ab5834e6751b58a90a917da891621b0940fbf530e728cadd9fbcd44e2dda8ee1b6df8c671beb5302155307e
TLSH
T18A8116101FE90945B2B71747DAF3C053AA33FCD69974CB4C224A831A42ABD0148BDBBE
MD5 SHA1 SHA512 TLSH

Submit Download

e8ede86b-9a97-486a-9cec-a8fcf441421c.tmp

Path C:\Users\Admin\AppData\Local\Temp\e8ede86b-9a97-486a-9cec-a8fcf441421c.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4616_33815135\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetHost

Path C:\Users\Admin\AppData\Local\Temp\{D9CB1E16-21CD-4805-B42F-5D5C61BAD530}\DotNetHost
Size 1012KB
SHA256 03eb33e8eb7746542febda19278dde1c7bd496396a69a9d625a05f9506a1c3ee
MD5 667bbe018d9a8052f0ed4d4b44a02ec8
SHA1 9af6e69d606a4741ada8a58f36b9c06c9cf22626
SHA512 5e07d476569a3c7bf938278adb2b710be015698e5c3f01a5aab2db319d07b8ea675758aeb201577d3d51394550c313dc4bf401397c44f846154fcec9a445c073
SSDEEP 12288:SN2etgX0xsm7HrObWMInYLE/BbdJ0zErWolCJ9TeWxqYZfDvXNM:i26gG74W6WBbdJwEqECJ9Te7YxDXN
TLSH
T1A2256A1BBFA404A9D8B24E75C5B78321EE357C482320969F43A47229DEFB7D0647A7C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetHostFxr

Path C:\Users\Admin\AppData\Local\Temp\{D9CB1E16-21CD-4805-B42F-5D5C61BAD530}\DotNetHostFxr
Size 1.1MB
SHA256 da12be59d35710ff0082f3506e84d741c00816290ac1d3093078e7c7b4ec2d51
MD5 ecd6f2e85cdb3623db79832c198448b2
SHA1 48580a0e26d28d8c3ec0c0418e1896eb70448285
SHA512 4764485b64fb4bb7e3c4e28678e172c84cf9f67a23a905a0cca8f9c4522cf404be3a5dd6cc23d3dd6fb96ea2bd7dae425ca36adb80324ec795ce560806575fa7
SSDEEP 24576:626gG74W6WBbdJwEqECJ9Te7YxM6fA9Ac:626748BnwEpI9T6Yu6lc
TLSH
T134357B1BBFA404A9D8A24EB5C5B78321FE357C082320959F43A47229DEFB7D0647A7C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetRuntime

Path C:\Users\Admin\AppData\Local\Temp\{D9CB1E16-21CD-4805-B42F-5D5C61BAD530}\DotNetRuntime
Size 28.2MB
SHA256 4af98ab9168f319b9d026e01bd6e9df577799a222b04454579053a5a00abd555
MD5 8fe07617a818797bf2170e4ca5f4bb95
SHA1 126523726901f0a1129d9066c369f963f1ef5854
SHA512 75544a3a9bff83e7fed005ecfd0847ce32442e82c53879097518fd03ef4f6d8364bd5400912613d1eb33f6ae1e262bd1a61087960fbc6655ecd03260072bdaea
SSDEEP 786432:Tg+OS4VhnxfDEAOZGc3PHDOsz1tHDypQp:TF43nxfYnvDOsqu
TLSH
T12A573397BFA408A9D4A24E71C5B78325EF313C182721C59B42607669EFFB3D464BA7C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsDesktopRuntime

Path C:\Users\Admin\AppData\Local\Temp\{D9CB1E16-21CD-4805-B42F-5D5C61BAD530}\WindowsDesktopRuntime
Size 28.8MB
SHA256 024753cf71ec777cf38c82c29bfaae467ab554086d1cf6b34f5d850f61a16c28
MD5 b76d067851e1d31cc6c6f00bd68d078b
SHA1 1a83f1fca787b802f03b12c60cea0306b64eda1e
SHA512 c1551bc40c04b552b6925675180fdb69bd00e4282bbe5c3ac6db13fa49a2786f430171ed7379f7bbdfbecb998297fff54ecb77db6c58feb9f8a1196d112d155a
SSDEEP 786432:Kl8TBZmSPFbeIQhCxCLWcSEDm03uCoE7WOF:KlGZmiFbVQsECcSEdfS
TLSH
T19B673367BF9018A9D87B4E78C4B783649E317C192320AAAB47607619DEF73D451BB3C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ed392029-4424-47ac-a46c-c1cc76b9c696.tmp

Path C:\Users\Admin\Downloads\ed392029-4424-47ac-a46c-c1cc76b9c696.tmp
Size 57.3MB
SHA256 e82fc901c8f52d716293b2bc0830ce0dd254a06268c457a19e8fc503560a84d1
MD5 01f6421e8e9db024b617cbaa584d2b11
SHA1 45ee2ef6d36881dddda3c599209fd00cb6c56d3a
SHA512 a5502261c25ba163f35bca7d50611c195e78b8797b16c5bbf2203fbdfff92c0275d36838a3200c08443d2d23a2f6a867c58093d5c239a60dd798a6596df4dc13
SSDEEP 1572864:uHsvoCFeMH5Gg+QRiwFDq0GzSngXW6ApiLhS6tNg1h:msAuhHsfOFDq0GzSsH5s6Q
TLSH
T148D73331A218382BE7F90977F84292303F249B14275889B6C6D0DE5D7C596F85FFB24A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI95CE.tmp

Path C:\Windows\Installer\MSI95CE.tmp
Size 392KB
SHA256 a28ed81b8594774c7e1e82f9bbe858c3b36f0d7a93067001387a5a872288231a
MD5 f1fafe5c54813a5d7b60d08b859bd58b
SHA1 95e6598ce1c02220d68edab5474980b7f0f0a12c
SHA512 6dbc8b10277c6fae8d7ba961a843810df0bb11c9c6e3ba54eea1b24e13b1069e454ef5d76d345839a32f94871855928578a15948ba242d03c990b21d8f845df9
SSDEEP 6144:u/VbdUw0z9ursTolCJSqJiIUk8AeWNxFqYrtUc06N:u/VbdJ0zErWolCJ9TeWxqYZfN
TLSH
T1CC846A29F7E418EDD4B782B6C5A68030FF75754D332095AF8BA845291F3BAA470BB701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BootstrapperApplicationData.xml

Path C:\Windows\TEMP\{AEB2F2A1-5C2E-4D86-A674-613867E26F01}\.ba\BootstrapperApplicationData.xml
Size 9KB
SHA256 b1eda1e98d843eef81232344754cdc0973d9dda1c1790a91a352c167c9a64ca5
MD5 5b54f26d64fb1f7e82bec5b4ff190ba2
SHA1 11d8be75fdb2bded9b835a2d0f6e5bf1848e0ce6
SHA512 3418f51296007c704600edc69c91e26c23e8e159e0a20aadeae06d010c80cb85cb4d86517d9fcf6ec5b150578311cb57592eb220ba0f93c7512d812e29b83fb6
SSDEEP 192:2/zaT1c/ovY9qnpijXjamaD0QP7XsCsysz:9sCsysz
TLSH
T1A912D4112BFD0218F0F3AE48EFF6A4555A3ABD552E39C92D01301D0F49B2E819962FB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetLogo_256x.png

Path C:\Windows\TEMP\{AEB2F2A1-5C2E-4D86-A674-613867E26F01}\.ba\DotNetLogo_256x.png
Size 2KB
SHA256 0f571f95d8eab48dbc81b0ec5e9f7225e349e26ef50868bfaab556f3c2443b01
MD5 39aa52615723b782c92dec710caaec7f
SHA1 760b49e256a7979fe50a56a2b1be3688a474b886
SHA512 89d1baa3820154667747b25e9e2fd321bfb2ec71dc309915b0a28dacdc80822a4943b639ebb37c37bd2559d5a4306d2096119cd970c84a0d331f6c68b0456dc9
TLSH
T1534195CF1BFD78D7E6E557918E1A8DD232738483B4B3A42CCE7B10B8274A5642B87940
MD5 SHA1 SHA512 TLSH

Submit Download

dotnet.ico

Path C:\Windows\TEMP\{AEB2F2A1-5C2E-4D86-A674-613867E26F01}\.ba\dotnet.ico
Size 44KB
SHA256 61a2cbd12868cb9b359e0c78961d409b7875f072eb8e53ea88d3e6bfe2961a18
MD5 b8096652d9ec286709a2c863b244b110
SHA1 b3b7f0f4d608fad7cb59ba499d4d17c2b873a7af
SHA512 492a5aa83220bb77c178b7c5b50bf44968c0427e9e45bb97a33df14d7fb4c667ca7adde0ebb3874c7b6011057b01144e4e6651fbad62c6bcf5e0b93586c4bc7a
SSDEEP 96:r+gfbzo+wHK9NbwOY4tIWQeVlV1W9+H+guapUjFamINUItzf1dBNaIZ:ro5HuNcH4tIzeVlV1WEOFDgUWzf1PIm
TLSH
T1E913EF6DE68547C1C10C2032DB4AC792B5233C72E4DAE0C4F9D4FA7E177906965C6E6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\TEMP\{AEB2F2A1-5C2E-4D86-A674-613867E26F01}\.ba\thm.wxl
Size 7KB
SHA256 b00edd703dd8a475119d0e4dd70a3aaa47f0e95361af290e76d367a8edef3432
MD5 8b2c667a8bbad3153068c0ed90df7ec4
SHA1 c9e04a3a37e5e6262ab9bfecf78280171b8f7b74
SHA512 5269f00d474acccb4c48cb7bcfdf19e63557a388572d3a6335aa39191319691d924e27f70da3f3495387c319396476c63a8fd7b35835cca0901220e39783847b
SSDEEP 96:HiTgM1+XSNEzA0HtYQstYCpCwZQpCeyk5HQJM9ouvj9urz8:Ew9EmtYQstYCPC9e8
TLSH
T191E1026F68DFDEE03A732651B2B3698D6919C29A136F1CF0F869084B47635016377A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.xml

Path C:\Windows\TEMP\{AEB2F2A1-5C2E-4D86-A674-613867E26F01}\.ba\thm.xml
Size 11KB
SHA256 dfee8e2d075087227f19c835c145c5bb8e72a46880ea24080bb2472fd3a521be
MD5 4329e418dc56b1386d7ea29a0dcfab5b
SHA1 58387f92e89ca21b4179fb697c7de9675c59142f
SHA512 6934873d27e6efbb94da4f13ee8369b29995490051016fdf82800256b924902306d328bf1d4ebbf266d1a53eb24adb6478d1a67de4ecc3e3bcbe561968f24922
SSDEEP 96:HgvPkoeWEH3IWTaQfSJgHzth5mFahbuB8pR5+Vpwe+UIJLg1gEp+6F5pQnxc:AvoWydmQfVHMyyj5Z
TLSH
T14B42FC6851DC7811C532D702AB9371D3FF12BDA6C6C85A58B48E256B1FF262028B739C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wixstdba.exe

Path C:\Windows\Temp\{AEB2F2A1-5C2E-4D86-A674-613867E26F01}\.ba\wixstdba.exe
Size 431KB
SHA256 2b1cee5e3e24593247854eb7a7c4308937b9c607754ed2fb83520a8706c26f1e
MD5 0e88ffd2e737ac9b9a4241616838bc23
SHA1 3c8beb465d20bcef0cd6ceca9c60286d1d15cebd
SHA512 169b9e08518834c9bc5adfe4ab7b79e07685b72f30ede1c1a386229668bde8c15da378e1274e4013ad7b84d6f7a5acc64ef0806e3b8a66322861efaa7e26b620
SSDEEP 6144:X9vfS1NP+c3ytxmg4Stlqe3B9m2LSLTwGw7C3ZLaov5xZvSdF:X9v+GIyugllqe3wwGfX5/SdF
TLSH
T129943B3165F04037C6F90572AE14FA31BF69F208231095EBA3C0DD293968AE5BBB7657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windowsdesktop-runtime-10.0.10-win-x64.exe

Path C:\Windows\Temp\{D9CB1E16-21CD-4805-B42F-5D5C61BAD530}\.be\windowsdesktop-runtime-10.0.10-win-x64.exe
Size 967KB
SHA256 47b74e25c31fceb862dcc4496af4dcce01823094997aba1e88eb936013ffc2f8
MD5 0f57602b1b78b077a5b0e996ef306a7d
SHA1 4c86ca072878cf03f66be4dc721a02d5c6fe76d2
SHA512 b28e50f9ef8debb5e25af797cc9a7ed6882f08425c595ce36eb6d48e0b703c17f619151d84a6d1b8dd8b5f7affc231c19790c46d6224b94279de5a5c568aa1a2
SSDEEP 12288:OVGWl6qCmyZeU6lqlDjC+fScn6X8GwMgJEkqd68Wr//f0ZoiDqIMjFqs:OVGWl6qCmyt6UdmcpMzrI58lDqPxr
TLSH
T1B4257D31A166242BD6F50973F914D2307E28D7082B5C99B6C6C0DD0D39689FA6FFB24B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3444-947-0x000002346E080000-0x000002346E3C7000-memory.dmp

Download

memory/3444-1467-0x000002346E080000-0x000002346E3C7000-memory.dmp

Download

memory/3548-1465-0x0000000000330000-0x00000000003F6000-memory.dmp

Download

memory/4240-689-0x00000224BE9F0000-0x00000224BED37000-memory.dmp

Download

memory/4588-1438-0x000002B924780000-0x000002B924AC7000-memory.dmp

Download

memory/5088-716-0x0000024B7EB20000-0x0000024B7EE67000-memory.dmp

Download

memory/5372-1132-0x0000029ADA280000-0x0000029ADA5C7000-memory.dmp

Download