85715d21d50d63eb4d0074a32568fdabc99ee00900fc8a9a5e06622be4779b1e

Analysis

user interaction
yes
max time kernel
142s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/08/2026, 22:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Ultimate Tweaks Installer.exe
Size 24.6MB
Sample260807-2lwffadm21
SHA256 85715d21d50d63eb4d0074a32568fdabc99ee00900fc8a9a5e06622be4779b1e
MD5 5754c7649d63674afd081c7b72de2d0a
SHA1 af298e080390f9b992e9f033067983fe9123c909
SHA512 84ce417adbd7dd6c8d0ee794c7e0d91850d118ec17d1aeb94fe136651b6c2cd70e5e001e897b9088a5afbedabead1d4b323877d7fab731c614995e23a374c3c9
SSDEEP 196608:oQhPlaviiGD4FjXWPgXzDTjzND/GyCyLnSD3dH6:nne7WqzDTjzND/GyaDE
TLSH
T171475B4293A64F3DDA9F1B79E0C402264739C00A9F876377193CDAA93DD3396061A7F9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3868	powershell.exe

Downloads MZ/PE file 2 IoCs

flow	pid	Process
197	3052	chrome.exe
91	712	msedge.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	windowsdesktop-runtime-9.0.18-win-x64.exe
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	Ultimate Tweaks Installer.exe

Executes dropped EXE 8 IoCs

pid	Process
3504	windowsdesktop-runtime-9.0.18-win-x64.exe
4368	windowsdesktop-runtime-9.0.18-win-x64.exe
1596	windowsdesktop-runtime-9.0.18-win-x64.exe
3384	windowsdesktop-runtime-9.0.18-win-x64.exe
4548	windowsdesktop-runtime-9.0.18-win-x64.exe
4112	windowsdesktop-runtime-9.0.18-win-x64.exe
5128	Ultimate Tweaks Installer.exe
5488	Ultimate Tweaks.exe

Loads dropped DLL 64 IoCs

pid	Process
4368	windowsdesktop-runtime-9.0.18-win-x64.exe
2696	MsiExec.exe
4112	windowsdesktop-runtime-9.0.18-win-x64.exe
2696	MsiExec.exe
4976	MsiExec.exe
4976	MsiExec.exe
2312	MsiExec.exe
2312	MsiExec.exe
1416	MsiExec.exe
1416	MsiExec.exe
5128	Ultimate Tweaks Installer.exe
5128	Ultimate Tweaks Installer.exe
5128	Ultimate Tweaks Installer.exe
5128	Ultimate Tweaks Installer.exe
5128	Ultimate Tweaks Installer.exe
5128	Ultimate Tweaks Installer.exe
5128	Ultimate Tweaks Installer.exe
5128	Ultimate Tweaks Installer.exe
5128	Ultimate Tweaks Installer.exe
5128	Ultimate Tweaks Installer.exe
5128	Ultimate Tweaks Installer.exe
5128	Ultimate Tweaks Installer.exe
5128	Ultimate Tweaks Installer.exe
5128	Ultimate Tweaks Installer.exe
5128	Ultimate Tweaks Installer.exe
5128	Ultimate Tweaks Installer.exe
5128	Ultimate Tweaks Installer.exe
5128	Ultimate Tweaks Installer.exe
5128	Ultimate Tweaks Installer.exe
5128	Ultimate Tweaks Installer.exe
5128	Ultimate Tweaks Installer.exe
5128	Ultimate Tweaks Installer.exe
5128	Ultimate Tweaks Installer.exe
5128	Ultimate Tweaks Installer.exe
5128	Ultimate Tweaks Installer.exe
5128	Ultimate Tweaks Installer.exe
5128	Ultimate Tweaks Installer.exe
5128	Ultimate Tweaks Installer.exe
5128	Ultimate Tweaks Installer.exe
5128	Ultimate Tweaks Installer.exe
5128	Ultimate Tweaks Installer.exe
5128	Ultimate Tweaks Installer.exe
5128	Ultimate Tweaks Installer.exe
5128	Ultimate Tweaks Installer.exe
5128	Ultimate Tweaks Installer.exe
5128	Ultimate Tweaks Installer.exe
5128	Ultimate Tweaks Installer.exe
5128	Ultimate Tweaks Installer.exe
5128	Ultimate Tweaks Installer.exe
5128	Ultimate Tweaks Installer.exe
5128	Ultimate Tweaks Installer.exe
5128	Ultimate Tweaks Installer.exe
5128	Ultimate Tweaks Installer.exe
5128	Ultimate Tweaks Installer.exe
5128	Ultimate Tweaks Installer.exe
5128	Ultimate Tweaks Installer.exe
5128	Ultimate Tweaks Installer.exe
5128	Ultimate Tweaks Installer.exe
5128	Ultimate Tweaks Installer.exe
5128	Ultimate Tweaks Installer.exe
5128	Ultimate Tweaks Installer.exe
5128	Ultimate Tweaks Installer.exe
5128	Ultimate Tweaks Installer.exe
5128	Ultimate Tweaks Installer.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{b21e7fe8-9175-483b-a67f-0fd948722740} = "\"C:\\ProgramData\\Package Cache\\{b21e7fe8-9175-483b-a67f-0fd948722740}\\windowsdesktop-runtime-9.0.18-win-x64.exe\" /burn.runonce"	windowsdesktop-runtime-9.0.18-win-x64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\UltimateTweaksApp = "C:\\UltimateTweaks\\Ultimate Tweaks.exe"	Ultimate Tweaks Installer.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.18\System.Net.Ping.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\DirectWriteForwarder.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\ja\UIAutomationClient.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\tr\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.18\System.Net.Quic.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.18\System.Xml.Serialization.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\pl\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.18\System.Diagnostics.Process.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\it\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\fr\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.18\System.Formats.Asn1.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\zh-Hant\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\ru\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\ru\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\System.Drawing.Common.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\System.Windows.Input.Manipulations.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.18\Microsoft.Win32.Primitives.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\pt-BR\System.Windows.Forms.Design.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.18\System.Threading.Timer.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.18\System.Reflection.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\pt-BR\System.Windows.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\pl\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\tr\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.18\System.Net.Primitives.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.18\System.IO.Pipelines.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.18\mscorlib.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.18\Microsoft.NETCore.App.runtimeconfig.json	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\UIAutomationTypes.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\it\UIAutomationTypes.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.18\System.Xml.XPath.XDocument.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\cs\UIAutomationClient.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\cs\UIAutomationTypes.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.18\System.Private.Uri.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.18\System.Xml.XmlSerializer.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\System.Threading.AccessControl.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.18\System.Net.Http.Json.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.18\Microsoft.VisualBasic.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.18\System.IO.Compression.Native.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.18\System.Security.Principal.Windows.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.18\System.IO.Compression.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\ko\UIAutomationTypes.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\cs\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\it\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\System.Private.Windows.Core.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\ko\ReachFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\ko\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.18\System.Runtime.Serialization.Xml.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.18\System.Runtime.Numerics.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\ko\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\cs\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.18\System.Private.Xml.Linq.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\ja\UIAutomationTypes.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\PresentationUI.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.18\System.Text.RegularExpressions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.18\System.Xml.Linq.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\zh-Hans\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\cs\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\pl\WindowsFormsIntegration.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.18\System.Runtime.Serialization.Formatters.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\cs\System.Windows.Forms.Primitives.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.18\System.Reflection.Emit.ILGeneration.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\LICENSE.txt	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\de\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.18\System.CodeDom.dll	msiexec.exe

Drops file in Windows directory 35 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e58ed1f.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1\64.60.31149	msiexec.exe
File created	C:\Windows\Installer\SourceHash{B9CB3C69-65ED-445D-A35F-38FCC2058C35}	msiexec.exe
File created	C:\Windows\Installer\e58ed1a.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBC1.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{0CADB010-02E6-4833-B505-BD81F85D0915}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1160.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1\64.60.31149\fileCoreHostExe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3DC6.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e58ed1a.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI13A4.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{35EC5E45-F900-4AE8-B6FC-E96FB9249F74}	msiexec.exe
File opened for modification	C:\Windows\Installer\e58ed1f.msi	msiexec.exe
File created	C:\Windows\Installer\e58ed23.msi	msiexec.exe
File created	C:\Windows\Installer\e58ed2b.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e58ed2b.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1665.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\SourceHash{EDFAA9B4-1B98-43B0-95C5-6010790950B5}	msiexec.exe
File created	C:\Windows\Installer\e58ed24.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1\64.60.31149\fileCoreHostExe	msiexec.exe
File created	C:\Windows\Installer\e58ed2f.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF393.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF7B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI148F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4EA.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e58ed24.msi	msiexec.exe
File created	C:\Windows\Installer\e58ed2a.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI18E6.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1C91.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF095.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\e58ed1e.msi	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-9.0.18-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-9.0.18-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-9.0.18-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-9.0.18-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-9.0.18-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-9.0.18-win-x64.exe

System Time Discovery 1 TTPs 5 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3052	chrome.exe
1940	msedge.exe
4340	msedge.exe
6056	msedge.exe
712	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 14 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 14 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134306160581534263"	msedge.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4B9AAFDE89B10B34595C06019790055B\PackageCode = "5DB59C3C77BB8894AAD967E03E92BCB4"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4B9AAFDE89B10B34595C06019790055B\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\8ADC86493D955D5516528FD99E43D025	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4B9AAFDE89B10B34595C06019790055B\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\010BDAC06E2033845B50DB188FD59051\MainFeature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\010BDAC06E2033845B50DB188FD59051\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{0CADB010-02E6-4833-B505-BD81F85D0915}v72.72.55158\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96C3BC9BDE56D5443AF583CF2C50C853\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{b21e7fe8-9175-483b-a67f-0fd948722740}\Dependents\{b21e7fe8-9175-483b-a67f-0fd948722740}	windowsdesktop-runtime-9.0.18-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_9.0_x64\DisplayName = "Microsoft .NET Host - 9.0.18 (x64)"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\54E5CE53009F8EA46BCF9EF69B42F947\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96C3BC9BDE56D5443AF583CF2C50C853\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_72.72.55185_x64\Dependents\{b21e7fe8-9175-483b-a67f-0fd948722740}	windowsdesktop-runtime-9.0.18-win-x64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{D97121F4-72D3-455D-96E4-74F1A02D000B}	msedge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4B9AAFDE89B10B34595C06019790055B\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\dotnet_runtime_72.72.55158_x64	windowsdesktop-runtime-9.0.18-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\010BDAC06E2033845B50DB188FD59051\PackageCode = "E65350071DC5D4947B27B36EF90204B9"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96C3BC9BDE56D5443AF583CF2C50C853	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4B9AAFDE89B10B34595C06019790055B\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\54E5CE53009F8EA46BCF9EF69B42F947\Provider	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_9.0_x64	windowsdesktop-runtime-9.0.18-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96C3BC9BDE56D5443AF583CF2C50C853\PackageCode = "16D788EEB803C2E46B1BC3CEC75B4C69"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\010BDAC06E2033845B50DB188FD59051\ProductName = "Microsoft .NET Host FX Resolver - 9.0.18 (x64)"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\010BDAC06E2033845B50DB188FD59051\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\54E5CE53009F8EA46BCF9EF69B42F947	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\54E5CE53009F8EA46BCF9EF69B42F947\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96C3BC9BDE56D5443AF583CF2C50C853\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96C3BC9BDE56D5443AF583CF2C50C853\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96C3BC9BDE56D5443AF583CF2C50C853\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{B9CB3C69-65ED-445D-A35F-38FCC2058C35}v72.72.55185\\"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\ultimatetweaks\shell	Ultimate Tweaks.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4B9AAFDE89B10B34595C06019790055B	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\010BDAC06E2033845B50DB188FD59051	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\F71950C1A6A51F479A1ED20855BD5918\54E5CE53009F8EA46BCF9EF69B42F947	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\windowsdesktop_runtime_72.72.55185_x64	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\ultimatetweaks\DefaultIcon	Ultimate Tweaks.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\010BDAC06E2033845B50DB188FD59051\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_72.72.55185_x64\DisplayName = "Microsoft Windows Desktop Runtime - 9.0.18 (x64)"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\ultimatetweaks	Ultimate Tweaks.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{7FDD386B-A0C5-4B1D-A6D5-291951529FBC}	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{b21e7fe8-9175-483b-a67f-0fd948722740}\ = "{b21e7fe8-9175-483b-a67f-0fd948722740}"	windowsdesktop-runtime-9.0.18-win-x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4B9AAFDE89B10B34595C06019790055B\Version = "1212733302"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_9.0_x64\Version = "72.72.55158"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_9.0_x64\Dependents	windowsdesktop-runtime-9.0.18-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_72.72.55185_x64\Dependents	windowsdesktop-runtime-9.0.18-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\54E5CE53009F8EA46BCF9EF69B42F947	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\54E5CE53009F8EA46BCF9EF69B42F947\MainFeature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\54E5CE53009F8EA46BCF9EF69B42F947\SourceList\PackageName = "dotnet-host-9.0.18-win-x64.msi"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_72.72.55158_x64\ = "{EDFAA9B4-1B98-43B0-95C5-6010790950B5}"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4B9AAFDE89B10B34595C06019790055B\Clients = 3a0000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\010BDAC06E2033845B50DB188FD59051\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\96C3BC9BDE56D5443AF583CF2C50C853	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\3693C0A713552476F4E3AD22D8059B9B	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\010BDAC06E2033845B50DB188FD59051\SourceList\PackageName = "dotnet-hostfxr-9.0.18-win-x64.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\54E5CE53009F8EA46BCF9EF69B42F947\ProductName = "Microsoft .NET Host - 9.0.18 (x64)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_72.72.55185_x64\ = "{B9CB3C69-65ED-445D-A35F-38FCC2058C35}"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96C3BC9BDE56D5443AF583CF2C50C853\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\dotnet_runtime_72.72.55158_x64	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4B9AAFDE89B10B34595C06019790055B\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4B9AAFDE89B10B34595C06019790055B\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\54E5CE53009F8EA46BCF9EF69B42F947\PackageCode = "233F84B596182704094C41322839A2C2"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
784	msiexec.exe
784	msiexec.exe
4716	chrome.exe
4716	chrome.exe
784	msiexec.exe
784	msiexec.exe
784	msiexec.exe
784	msiexec.exe
784	msiexec.exe
784	msiexec.exe
5128	Ultimate Tweaks Installer.exe
3868	powershell.exe
3868	powershell.exe
3868	powershell.exe
5488	Ultimate Tweaks.exe
5488	Ultimate Tweaks.exe
5488	Ultimate Tweaks.exe
5488	Ultimate Tweaks.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 21 IoCs

pid	Process
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5572	msedge.exe
5572	msedge.exe
5572	msedge.exe
5572	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1596	windowsdesktop-runtime-9.0.18-win-x64.exe
Token: SeIncreaseQuotaPrivilege	1596	windowsdesktop-runtime-9.0.18-win-x64.exe
Token: SeSecurityPrivilege	784	msiexec.exe
Token: SeCreateTokenPrivilege	1596	windowsdesktop-runtime-9.0.18-win-x64.exe
Token: SeAssignPrimaryTokenPrivilege	1596	windowsdesktop-runtime-9.0.18-win-x64.exe
Token: SeLockMemoryPrivilege	1596	windowsdesktop-runtime-9.0.18-win-x64.exe
Token: SeIncreaseQuotaPrivilege	1596	windowsdesktop-runtime-9.0.18-win-x64.exe
Token: SeMachineAccountPrivilege	1596	windowsdesktop-runtime-9.0.18-win-x64.exe
Token: SeTcbPrivilege	1596	windowsdesktop-runtime-9.0.18-win-x64.exe
Token: SeSecurityPrivilege	1596	windowsdesktop-runtime-9.0.18-win-x64.exe
Token: SeTakeOwnershipPrivilege	1596	windowsdesktop-runtime-9.0.18-win-x64.exe
Token: SeLoadDriverPrivilege	1596	windowsdesktop-runtime-9.0.18-win-x64.exe
Token: SeSystemProfilePrivilege	1596	windowsdesktop-runtime-9.0.18-win-x64.exe
Token: SeSystemtimePrivilege	1596	windowsdesktop-runtime-9.0.18-win-x64.exe
Token: SeProfSingleProcessPrivilege	1596	windowsdesktop-runtime-9.0.18-win-x64.exe
Token: SeIncBasePriorityPrivilege	1596	windowsdesktop-runtime-9.0.18-win-x64.exe
Token: SeCreatePagefilePrivilege	1596	windowsdesktop-runtime-9.0.18-win-x64.exe
Token: SeCreatePermanentPrivilege	1596	windowsdesktop-runtime-9.0.18-win-x64.exe
Token: SeBackupPrivilege	1596	windowsdesktop-runtime-9.0.18-win-x64.exe
Token: SeRestorePrivilege	1596	windowsdesktop-runtime-9.0.18-win-x64.exe
Token: SeShutdownPrivilege	1596	windowsdesktop-runtime-9.0.18-win-x64.exe
Token: SeDebugPrivilege	1596	windowsdesktop-runtime-9.0.18-win-x64.exe
Token: SeAuditPrivilege	1596	windowsdesktop-runtime-9.0.18-win-x64.exe
Token: SeSystemEnvironmentPrivilege	1596	windowsdesktop-runtime-9.0.18-win-x64.exe
Token: SeChangeNotifyPrivilege	1596	windowsdesktop-runtime-9.0.18-win-x64.exe
Token: SeRemoteShutdownPrivilege	1596	windowsdesktop-runtime-9.0.18-win-x64.exe
Token: SeUndockPrivilege	1596	windowsdesktop-runtime-9.0.18-win-x64.exe
Token: SeSyncAgentPrivilege	1596	windowsdesktop-runtime-9.0.18-win-x64.exe
Token: SeEnableDelegationPrivilege	1596	windowsdesktop-runtime-9.0.18-win-x64.exe
Token: SeManageVolumePrivilege	1596	windowsdesktop-runtime-9.0.18-win-x64.exe
Token: SeImpersonatePrivilege	1596	windowsdesktop-runtime-9.0.18-win-x64.exe
Token: SeCreateGlobalPrivilege	1596	windowsdesktop-runtime-9.0.18-win-x64.exe
Token: SeRestorePrivilege	784	msiexec.exe
Token: SeTakeOwnershipPrivilege	784	msiexec.exe
Token: SeRestorePrivilege	784	msiexec.exe
Token: SeTakeOwnershipPrivilege	784	msiexec.exe
Token: SeRestorePrivilege	784	msiexec.exe
Token: SeTakeOwnershipPrivilege	784	msiexec.exe
Token: SeRestorePrivilege	784	msiexec.exe
Token: SeTakeOwnershipPrivilege	784	msiexec.exe
Token: SeRestorePrivilege	784	msiexec.exe
Token: SeTakeOwnershipPrivilege	784	msiexec.exe
Token: SeRestorePrivilege	784	msiexec.exe
Token: SeTakeOwnershipPrivilege	784	msiexec.exe
Token: SeRestorePrivilege	784	msiexec.exe
Token: SeTakeOwnershipPrivilege	784	msiexec.exe
Token: SeRestorePrivilege	784	msiexec.exe
Token: SeTakeOwnershipPrivilege	784	msiexec.exe
Token: SeRestorePrivilege	784	msiexec.exe
Token: SeTakeOwnershipPrivilege	784	msiexec.exe
Token: SeRestorePrivilege	784	msiexec.exe
Token: SeTakeOwnershipPrivilege	784	msiexec.exe
Token: SeRestorePrivilege	784	msiexec.exe
Token: SeTakeOwnershipPrivilege	784	msiexec.exe
Token: SeRestorePrivilege	784	msiexec.exe
Token: SeTakeOwnershipPrivilege	784	msiexec.exe
Token: SeRestorePrivilege	784	msiexec.exe
Token: SeTakeOwnershipPrivilege	784	msiexec.exe
Token: SeRestorePrivilege	784	msiexec.exe
Token: SeTakeOwnershipPrivilege	784	msiexec.exe
Token: SeRestorePrivilege	784	msiexec.exe
Token: SeTakeOwnershipPrivilege	784	msiexec.exe
Token: SeRestorePrivilege	784	msiexec.exe
Token: SeTakeOwnershipPrivilege	784	msiexec.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
4368	windowsdesktop-runtime-9.0.18-win-x64.exe
4368	windowsdesktop-runtime-9.0.18-win-x64.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
5128	Ultimate Tweaks Installer.exe
5488	Ultimate Tweaks.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5128	Ultimate Tweaks Installer.exe
5488	Ultimate Tweaks.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3816 wrote to memory of 3832	3816	Ultimate Tweaks Installer.exe	86
PID 3832 wrote to memory of 3872	3832	msedge.exe	87
PID 3832 wrote to memory of 4652	3832	msedge.exe	88
PID 3832 wrote to memory of 712	3832	msedge.exe	89
PID 3832 wrote to memory of 4652	3832	msedge.exe	88
PID 3832 wrote to memory of 4652	3832	msedge.exe	88
PID 3832 wrote to memory of 4764	3832	msedge.exe	91
PID 3832 wrote to memory of 4764	3832	msedge.exe	91
PID 3832 wrote to memory of 2012	3832	msedge.exe	92
PID 3832 wrote to memory of 220	3832	msedge.exe	93
PID 3832 wrote to memory of 2012	3832	msedge.exe	92
PID 3832 wrote to memory of 2012	3832	msedge.exe	92
PID 3832 wrote to memory of 220	3832	msedge.exe	93
PID 3832 wrote to memory of 220	3832	msedge.exe	93
PID 3832 wrote to memory of 1320	3832	msedge.exe	94
PID 3832 wrote to memory of 3572	3832	msedge.exe	95
PID 3832 wrote to memory of 1320	3832	msedge.exe	94
PID 3832 wrote to memory of 1320	3832	msedge.exe	94
PID 3832 wrote to memory of 3572	3832	msedge.exe	95
PID 3832 wrote to memory of 3572	3832	msedge.exe	95
PID 3832 wrote to memory of 4320	3832	msedge.exe	98
PID 3832 wrote to memory of 4320	3832	msedge.exe	98
PID 3832 wrote to memory of 3624	3832	msedge.exe	99
PID 3832 wrote to memory of 3624	3832	msedge.exe	99
PID 3832 wrote to memory of 3120	3832	msedge.exe	101
PID 3832 wrote to memory of 4636	3832	msedge.exe	102
PID 3832 wrote to memory of 3120	3832	msedge.exe	101
PID 3832 wrote to memory of 4636	3832	msedge.exe	102
PID 3832 wrote to memory of 5080	3832	msedge.exe	104
PID 3832 wrote to memory of 4196	3832	msedge.exe	105
PID 3832 wrote to memory of 928	3832	msedge.exe	106
PID 3832 wrote to memory of 4196	3832	msedge.exe	105
PID 3832 wrote to memory of 928	3832	msedge.exe	106
PID 3832 wrote to memory of 3796	3832	msedge.exe	110
PID 3832 wrote to memory of 3792	3832	msedge.exe	108
PID 3832 wrote to memory of 3796	3832	msedge.exe	110
PID 3832 wrote to memory of 3792	3832	msedge.exe	108
PID 3832 wrote to memory of 2616	3832	msedge.exe	109
PID 3832 wrote to memory of 2616	3832	msedge.exe	109
PID 3832 wrote to memory of 3796	3832	msedge.exe	110
PID 3832 wrote to memory of 3796	3832	msedge.exe	110
PID 3832 wrote to memory of 3796	3832	msedge.exe	110
PID 3832 wrote to memory of 4264	3832	msedge.exe	111
PID 3832 wrote to memory of 4264	3832	msedge.exe	111
PID 3832 wrote to memory of 2416	3832	msedge.exe	112
PID 3832 wrote to memory of 2416	3832	msedge.exe	112
PID 3832 wrote to memory of 2416	3832	msedge.exe	112
PID 3832 wrote to memory of 4368	3832	msedge.exe	113
PID 3504 wrote to memory of 4368	3504	windowsdesktop-runtime-9.0.18-win-x64.exe	125
PID 4368 wrote to memory of 1596	4368	windowsdesktop-runtime-9.0.18-win-x64.exe	127
PID 3384 wrote to memory of 4548	3384	windowsdesktop-runtime-9.0.18-win-x64.exe	131
PID 4548 wrote to memory of 4112	4548	windowsdesktop-runtime-9.0.18-win-x64.exe	132
PID 784 wrote to memory of 2696	784	msiexec.exe	134
PID 4716 wrote to memory of 628	4716	chrome.exe	136
PID 4716 wrote to memory of 1600	4716	chrome.exe	137
PID 4716 wrote to memory of 3052	4716	chrome.exe	138
PID 4716 wrote to memory of 1600	4716	chrome.exe	137
PID 4716 wrote to memory of 2256	4716	chrome.exe	139
PID 4716 wrote to memory of 2256	4716	chrome.exe	139
PID 4716 wrote to memory of 2180	4716	chrome.exe	141
PID 4716 wrote to memory of 4364	4716	chrome.exe	142
PID 4716 wrote to memory of 2180	4716	chrome.exe	141
PID 4716 wrote to memory of 4364	4716	chrome.exe	142
PID 4716 wrote to memory of 4868	4716	chrome.exe	143

C:\Users\Admin\AppData\Local\Temp\Ultimate Tweaks Installer.exe
"C:\Users\Admin\AppData\Local\Temp\Ultimate Tweaks Installer.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?framework=Microsoft.NETCore.App&framework_version=9.0.0&arch=x64&rid=win-x64&os=win10&gui=true
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2cc,0x2d0,0x2d4,0x2c8,0x2ac,0x7ff85a33c188,0x7ff85a33c194,0x7ff85a33c1a0
    3⤵
    PID:3872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1792,i,2520416715327216900,204713068805616766,262144 --field-trial-handle=2288,i,6800600155815473560,16591134288724661574,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:2
    3⤵
    PID:4652
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1952,i,13588913771736712977,4897119375950617407,524288 --field-trial-handle=2288,i,6800600155815473560,16591134288724661574,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:3
    3⤵
    - Downloads MZ/PE file
    - System Time Discovery
    PID:712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2620,i,7225579487565565010,6905690738098291529,524288 --field-trial-handle=2288,i,6800600155815473560,16591134288724661574,262144 --variations-seed-version --mojo-platform-channel-handle=2764 /prefetch:8
    3⤵
    PID:4764
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3480,i,1539533332147085892,16597301460498834203,2097152 --field-trial-handle=2288,i,6800600155815473560,16591134288724661574,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
    3⤵
    PID:2012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3484,i,7477183369796438046,14185530395332082627,2097152 --field-trial-handle=2288,i,6800600155815473560,16591134288724661574,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
    3⤵
    PID:220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4276,i,5720102324002698903,12035539400455983874,2097152 --field-trial-handle=2288,i,6800600155815473560,16591134288724661574,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:1
    3⤵
    PID:1320
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4292,i,16257546110448887458,12245966349426617040,2097152 --field-trial-handle=2288,i,6800600155815473560,16591134288724661574,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:2
    3⤵
    PID:3572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,8368513762272959629,11124551023918193106,524288 --field-trial-handle=2288,i,6800600155815473560,16591134288724661574,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:8
    3⤵
    PID:4320
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3344,i,9768146633098656415,12918306132619191926,524288 --field-trial-handle=2288,i,6800600155815473560,16591134288724661574,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:8
    3⤵
    PID:3624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,15789774427016566528,18422373480435429833,524288 --field-trial-handle=2288,i,6800600155815473560,16591134288724661574,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
    3⤵
    PID:3120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,9486888046255408382,906178142708220117,524288 --field-trial-handle=2288,i,6800600155815473560,16591134288724661574,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:8
    3⤵
    PID:4636
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6004,i,4360041282228226188,7132959594320978802,524288 --field-trial-handle=2288,i,6800600155815473560,16591134288724661574,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:8
    3⤵
    PID:1604
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6004,i,4360041282228226188,7132959594320978802,524288 --field-trial-handle=2288,i,6800600155815473560,16591134288724661574,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:8
    3⤵
    PID:5080
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6252,i,8430829670174944984,4683750530895959864,524288 --field-trial-handle=2288,i,6800600155815473560,16591134288724661574,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:8
    3⤵
    PID:4196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6256,i,14603878347267540398,15006235106587333225,524288 --field-trial-handle=2288,i,6800600155815473560,16591134288724661574,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:8
    3⤵
    PID:928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6428,i,14592776221037165408,17943790383685618781,524288 --field-trial-handle=2288,i,6800600155815473560,16591134288724661574,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:8
    3⤵
    PID:3796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6432,i,9000244161137884473,16503118015397530004,524288 --field-trial-handle=2288,i,6800600155815473560,16591134288724661574,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:8
    3⤵
    PID:3792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6492,i,17518688950017638692,1616676881945451728,524288 --field-trial-handle=2288,i,6800600155815473560,16591134288724661574,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:8
    3⤵
    PID:2616
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6552,i,1574074651550153371,15971426117261542048,2097152 --field-trial-handle=2288,i,6800600155815473560,16591134288724661574,262144 --variations-seed-version --mojo-platform-channel-handle=6620 /prefetch:1
    3⤵
    PID:3796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3720,i,2363132560905355784,1749535804802629717,524288 --field-trial-handle=2288,i,6800600155815473560,16591134288724661574,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:8
    3⤵
    PID:4264
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=3992,i,4552322038496994570,10661240712799854160,2097152 --field-trial-handle=2288,i,6800600155815473560,16591134288724661574,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:1
    3⤵
    PID:2416
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6416,i,8992746067330014416,4289811101893898847,524288 --field-trial-handle=2288,i,6800600155815473560,16591134288724661574,262144 --variations-seed-version --mojo-platform-channel-handle=7164 /prefetch:8
    3⤵
    PID:4368

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4432

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:928

C:\Users\Admin\Downloads\windowsdesktop-runtime-9.0.18-win-x64.exe
"C:\Users\Admin\Downloads\windowsdesktop-runtime-9.0.18-win-x64.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3504
- C:\Windows\Temp\{EAA23D86-5E50-49D0-B8D7-C12C662A50C5}\.cr\windowsdesktop-runtime-9.0.18-win-x64.exe
  "C:\Windows\Temp\{EAA23D86-5E50-49D0-B8D7-C12C662A50C5}\.cr\windowsdesktop-runtime-9.0.18-win-x64.exe" -burn.clean.room="C:\Users\Admin\Downloads\windowsdesktop-runtime-9.0.18-win-x64.exe" -burn.filehandle.attached=584 -burn.filehandle.self=720
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4368
- - C:\Windows\Temp\{2C3D558A-253A-4A3D-AEC1-AFDA9FCD2056}\.be\windowsdesktop-runtime-9.0.18-win-x64.exe
    "C:\Windows\Temp\{2C3D558A-253A-4A3D-AEC1-AFDA9FCD2056}\.be\windowsdesktop-runtime-9.0.18-win-x64.exe" -q -burn.elevated BurnPipe.{EE152F13-9AB3-4979-AE10-1EA75EA2BA89} {953EA9E7-A057-419A-819D-4EF3E556EE63} 4368
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    PID:1596

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:784
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding CD49667BD8E855DAC76BE9ABD528208E
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2696
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 8EE30336CE3EBAC19C87ECE3F214CD7C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4976
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding B2BAB39CA13964877D98D26A71545FB3
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2312
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding F9645EB1C66DB9FA6466AE590EB7BA68
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1416

C:\ProgramData\Package Cache\{b21e7fe8-9175-483b-a67f-0fd948722740}\windowsdesktop-runtime-9.0.18-win-x64.exe
"C:\ProgramData\Package Cache\{b21e7fe8-9175-483b-a67f-0fd948722740}\windowsdesktop-runtime-9.0.18-win-x64.exe" /burn.runonce
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3384
- C:\ProgramData\Package Cache\{b21e7fe8-9175-483b-a67f-0fd948722740}\windowsdesktop-runtime-9.0.18-win-x64.exe
  "C:\ProgramData\Package Cache\{b21e7fe8-9175-483b-a67f-0fd948722740}\windowsdesktop-runtime-9.0.18-win-x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_9.0.18_(x64)_20260807234121.log"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4548
- - C:\ProgramData\Package Cache\{b21e7fe8-9175-483b-a67f-0fd948722740}\windowsdesktop-runtime-9.0.18-win-x64.exe
    "C:\ProgramData\Package Cache\{b21e7fe8-9175-483b-a67f-0fd948722740}\windowsdesktop-runtime-9.0.18-win-x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{b21e7fe8-9175-483b-a67f-0fd948722740}\windowsdesktop-runtime-9.0.18-win-x64.exe" -burn.filehandle.attached=520 -burn.filehandle.self=540 /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_9.0.18_(x64)_20260807234121.log"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:4112

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff84c2ec728,0x7ff84c2ec734,0x7ff84c2ec740
  2⤵
  PID:628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1704,i,1513606358193349864,180575325266045181,262144 --field-trial-handle=2120,i,9642607889126061496,6963871707480963816,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:1600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2156,i,8362065841476086204,13581764542063818856,524288 --field-trial-handle=2120,i,9642607889126061496,6963871707480963816,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2192 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:3052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2432,i,13625517310734930380,2190508725357916921,524288 --field-trial-handle=2120,i,9642607889126061496,6963871707480963816,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2588 /prefetch:8
  2⤵
  PID:2256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3248,i,1070595343121897358,15010889134710013503,2097152 --field-trial-handle=2120,i,9642607889126061496,6963871707480963816,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:2180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3272,i,2597610914597626310,5357344339251493037,2097152 --field-trial-handle=2120,i,9642607889126061496,6963871707480963816,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:4364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3932,i,17971707913910521988,11354908246011534047,2097152 --field-trial-handle=2120,i,9642607889126061496,6963871707480963816,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4460 /prefetch:2
  2⤵
  PID:4868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4448,i,5735477587991358066,3282757510163902686,2097152 --field-trial-handle=2120,i,9642607889126061496,6963871707480963816,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4424 /prefetch:1
  2⤵
  PID:3304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5508,i,15920757423507727723,17452080754927025587,524288 --field-trial-handle=2120,i,9642607889126061496,6963871707480963816,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5536 /prefetch:8
  2⤵
  PID:4200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5836,i,14840516665481893660,18112398290847035969,2097152 --field-trial-handle=2120,i,9642607889126061496,6963871707480963816,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5788 /prefetch:1
  2⤵
  PID:3360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3304,i,5878493891852809890,7639386185878907763,2097152 --field-trial-handle=2120,i,9642607889126061496,6963871707480963816,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:3576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3276,i,6691337404472349683,13629531669267881046,2097152 --field-trial-handle=2120,i,9642607889126061496,6963871707480963816,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6008 /prefetch:1
  2⤵
  PID:2312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6172,i,18135208617923526491,13742742391124614598,524288 --field-trial-handle=2120,i,9642607889126061496,6963871707480963816,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6164 /prefetch:8
  2⤵
  PID:4964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6180,i,952393787290872302,2641177311312366291,524288 --field-trial-handle=2120,i,9642607889126061496,6963871707480963816,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5852 /prefetch:8
  2⤵
  PID:828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6168,i,4657585363274403658,17914693592904437305,524288 --field-trial-handle=2120,i,9642607889126061496,6963871707480963816,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6192 /prefetch:8
  2⤵
  PID:1452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6284,i,5529346308928393057,10042653249056122840,524288 --field-trial-handle=2120,i,9642607889126061496,6963871707480963816,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6300 /prefetch:8
  2⤵
  PID:5532

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3828

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3300

C:\Users\Admin\Downloads\Ultimate Tweaks Installer.exe
"C:\Users\Admin\Downloads\Ultimate Tweaks Installer.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:5128
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\UltimateTweaks'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:3868
- C:\UltimateTweaks\Ultimate Tweaks.exe
  "C:\UltimateTweaks\Ultimate Tweaks.exe"
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:5488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://ultimatetweaks.com/app-login/?session=c989a6b15526a0485b4f62168d026644ec6e9d9358fd82823990fd005aa00a7d
    3⤵
    PID:5916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://ultimatetweaks.com/app-login/?session=c989a6b15526a0485b4f62168d026644ec6e9d9358fd82823990fd005aa00a7d
      4⤵
      Checks processor information in registry
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      PID:5948
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x25c,0x7ff85a33c188,0x7ff85a33c194,0x7ff85a33c1a0
        5⤵
        
        PID:6020
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1812,i,12679813503309408606,7512739895982946031,524288 --field-trial-handle=2164,i,18151832467623901382,14279833409176997626,262144 --variations-seed-version --mojo-platform-channel-handle=2192 /prefetch:3
        5⤵
        System Time Discovery
        
        PID:1940
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1612,i,8118397725527132885,2355573033356194401,262144 --field-trial-handle=2164,i,18151832467623901382,14279833409176997626,262144 --variations-seed-version --mojo-platform-channel-handle=2160 /prefetch:2
        5⤵
        
        PID:1224
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2564,i,14154553278173174144,4950208582549023049,524288 --field-trial-handle=2164,i,18151832467623901382,14279833409176997626,262144 --variations-seed-version --mojo-platform-channel-handle=2576 /prefetch:8
        5⤵
        
        PID:6116
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3408,i,14817106824490403802,11678608823670707643,2097152 --field-trial-handle=2164,i,18151832467623901382,14279833409176997626,262144 --variations-seed-version --mojo-platform-channel-handle=3436 /prefetch:1
        5⤵
        
        PID:2540
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3404,i,15288672893396576848,1145942078538615799,2097152 --field-trial-handle=2164,i,18151832467623901382,14279833409176997626,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:1
        5⤵
        
        PID:1616
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5052,i,10530887050133006365,1753407957128983249,524288 --field-trial-handle=2164,i,18151832467623901382,14279833409176997626,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:8
        5⤵
        
        PID:5040
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5040,i,11792440113356261641,5087301805083840825,524288 --field-trial-handle=2164,i,18151832467623901382,14279833409176997626,262144 --variations-seed-version --mojo-platform-channel-handle=4976 /prefetch:8
        5⤵
        
        PID:5272
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5664,i,10594322628262512151,11057221238212014233,524288 --field-trial-handle=2164,i,18151832467623901382,14279833409176997626,262144 --variations-seed-version --mojo-platform-channel-handle=5640 /prefetch:8
        5⤵
        
        PID:2692
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5664,i,10594322628262512151,11057221238212014233,524288 --field-trial-handle=2164,i,18151832467623901382,14279833409176997626,262144 --variations-seed-version --mojo-platform-channel-handle=5640 /prefetch:8
        5⤵
        
        PID:4316
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=6012,i,7525070105459949315,6983133545435737215,2097152 --field-trial-handle=2164,i,18151832467623901382,14279833409176997626,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:1
        5⤵
        
        PID:2016
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=6344,i,10334830444728042301,11563169867509410974,2097152 --field-trial-handle=2164,i,18151832467623901382,14279833409176997626,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:1
        5⤵
        
        PID:5580
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6628,i,13013724879780546999,3131668430557503139,524288 --field-trial-handle=2164,i,18151832467623901382,14279833409176997626,262144 --variations-seed-version --mojo-platform-channel-handle=6640 /prefetch:8
        5⤵
        
        PID:2724
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6632,i,8004941475974704730,2906404975104382263,524288 --field-trial-handle=2164,i,18151832467623901382,14279833409176997626,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:8
        5⤵
        
        PID:5832
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
        5⤵
        Checks SCSI registry key(s)
        Checks processor information in registry
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        
        PID:5572
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff85a33c188,0x7ff85a33c194,0x7ff85a33c1a0
        6⤵
        
        PID:4224
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1952,i,2474685939738448727,4143248577375616288,524288 --field-trial-handle=2932,i,3104270700849914044,6951008764302983386,262144 --variations-seed-version --mojo-platform-channel-handle=3064 /prefetch:3
        6⤵
        System Time Discovery
        
        PID:4340
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1672,i,10044961503265904094,3327145897314589217,262144 --field-trial-handle=2932,i,3104270700849914044,6951008764302983386,262144 --variations-seed-version --mojo-platform-channel-handle=2940 /prefetch:2
        6⤵
        
        PID:5136
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2300,i,2664041185006585896,4991512274028242351,524288 --field-trial-handle=2932,i,3104270700849914044,6951008764302983386,262144 --variations-seed-version --mojo-platform-channel-handle=3108 /prefetch:8
        6⤵
        
        PID:5068
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4472,i,5587586017491417988,8048936298059130112,524288 --field-trial-handle=2932,i,3104270700849914044,6951008764302983386,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:8
        6⤵
        
        PID:5456
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4472,i,5587586017491417988,8048936298059130112,524288 --field-trial-handle=2932,i,3104270700849914044,6951008764302983386,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:8
        6⤵
        
        PID:4956
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4916,i,4198861744240818191,17783425739849252489,2097152 --field-trial-handle=2932,i,3104270700849914044,6951008764302983386,262144 --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:1
        6⤵
        
        PID:2660
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=4920,i,12673159721762327829,6896771014314610491,2097152 --field-trial-handle=2932,i,3104270700849914044,6951008764302983386,262144 --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:1
        6⤵
        
        PID:4364
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5460,i,10902256957624211014,5341832698658720621,524288 --field-trial-handle=2932,i,3104270700849914044,6951008764302983386,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:8
        6⤵
        
        PID:1496
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5456,i,15255765285584298944,1705716352919575423,524288 --field-trial-handle=2932,i,3104270700849914044,6951008764302983386,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:8
        6⤵
        
        PID:3192
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5948,i,6620880657377696144,3971893464911243949,2097152 --field-trial-handle=2932,i,3104270700849914044,6951008764302983386,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:1
        6⤵
        
        PID:4192
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5916,i,12157468736417476495,13592677067313553721,2097152 --field-trial-handle=2932,i,3104270700849914044,6951008764302983386,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:1
        6⤵
        
        PID:6120
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
        6⤵
        Enumerates system info in registry
        
        PID:3916
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x264,0x7ff85a33c188,0x7ff85a33c194,0x7ff85a33c1a0
        7⤵
        
        PID:956
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1904,i,7615323134611778147,18156375050376894343,524288 --field-trial-handle=2264,i,16606086109301244005,5558555274744497291,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:3
        7⤵
        System Time Discovery
        
        PID:6056
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1620,i,16995273363162872237,17499343065642377934,262144 --field-trial-handle=2264,i,16606086109301244005,5558555274744497291,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:2
        7⤵
        
        PID:5832
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2568,i,11508327550922971818,3080928219865320410,524288 --field-trial-handle=2264,i,16606086109301244005,5558555274744497291,262144 --variations-seed-version --mojo-platform-channel-handle=2428 /prefetch:8
        7⤵
        
        PID:5980
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4528,i,17481906565369947381,465982222948956419,524288 --field-trial-handle=2264,i,16606086109301244005,5558555274744497291,262144 --variations-seed-version --mojo-platform-channel-handle=4544 /prefetch:8
        7⤵
        
        PID:1776
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4528,i,17481906565369947381,465982222948956419,524288 --field-trial-handle=2264,i,16606086109301244005,5558555274744497291,262144 --variations-seed-version --mojo-platform-channel-handle=4544 /prefetch:8
        7⤵
        
        PID:1068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://ultimatetweaks.com/signup/
    3⤵
    PID:5576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://ultimatetweaks.com/signup/
      4⤵
      PID:4984

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6132

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3040

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1716

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3676

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e58ed1d.rbs

Path C:\Config.Msi\e58ed1d.rbs
Size 48KB
SHA256 2f3bb545561387802096b6f151ba6d11cc56833aa33ca2f0a5e8ea6f6d9bddc7
MD5 a04e4c13e04de326684149a6a76a25b2
SHA1 69534da2ff224aaa4946d04ab882ac74881c19f7
SHA512 66e1d1776d2ae77657daba2f6df1a8edeee4a34be24e89e4b18c7f096733b4c5c70b4ca67081cdb7578f4fbc93e63c8b9c4e3c50fcaf1d32c1171bc7fed43f60
SSDEEP 1536:xlV+cORT3I/4tktvfftgMQ4dskJhTaOTagmDxjHxW9nXzYnj2NE43H+lPSc6ScTM:eU4
TLSH
T1F2230F94DF00C4D2F233BBB6A374E90437588EA93F14944D67CED145C79AE89EAF9182
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58ed22.rbs

Path C:\Config.Msi\e58ed22.rbs
Size 9KB
SHA256 5c274cbc8bb318ad8b917ca2aafc5b3d6785c78a7c0485ff02766cc53cd3e2fa
MD5 232a3f0e79491c46ff6bfeb1df886ec6
SHA1 0ae38177405a7a00272882e05093c7535b7e6a57
SHA512 bb32d62fceac12312fe4c2625e69dd8ced8a4992ff56b7841122c55a1baed62201534460ab4bafaab9bb28fe8730a8b98610efdaa9cdd0822650cd1620b0bb56
SSDEEP 96:Am7Du5DSiS5XrLDCCemDvuUPeD2mon8CsTl7UPeD2mon8C6jCFS2YD+TlGYDQVEU:1WMiS7ZeSBKonTIeKonTjKEJWdhLvpF
TLSH
T18E1222097A1186F3E8561F35C747271437BBD2CAE700A24B06EFA5289F9774C0EA859E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58ed27.rbs

Path C:\Config.Msi\e58ed27.rbs
Size 10KB
SHA256 cf8b7e37033c6cac11d86e46e6f51f90c9599d08e86330a923c10ddd931dd1d7
MD5 2bc6e1b6908318cb3616ff9f00b3bfbd
SHA1 326cff5f6e157e9facab2a2c291a5c3f18041bd5
SHA512 d20f664a4860b8331368c5f81d26ed5fb604546efdeb013f08570c7d74a3d0bcb4527e720fec68dcd73bf5178a0fcdecd0e6680bfa15ce7a536f973c86d5736b
SSDEEP 192:ImuIxFX5HBbw/ePqvBWnonTIJWnonT8yCEoV99vpO:ImuIxFX5HR9q5WnonCWnonYPK
TLSH
T1A8222F01AA19C5D3E9921B70C3432BB137F3D3AE4704574F259DB2706F8B7885AB929A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58ed2e.rbs

Path C:\Config.Msi\e58ed2e.rbs
Size 88KB
SHA256 701623d9d19cbf22e147fc4fbe3c4c5faeceae5339ab7f54c9616d0accca965e
MD5 34921306e830363cb1d3fe531a497606
SHA1 0aed7377cbe5e37fabc525cc37bf0558dac838d0
SHA512 5f819516283e60410047dd14d38bb4b98d9abae1689220b88bd38f4f4bc56a7694c49b86e669a0f881d3dc0ec5b6f94df9fb514735ecd996aa069e031f9d47d4
SSDEEP 1536:Bk1eK8ItgdYnfGxhM4lEiJVLFnnzcp2X/60ir+XUfxLCekwFp8NFpSoBjMQRTsSw:lwpIs/3StbIAjKy7XwBss
TLSH
T15793E1B96710C186DD333A8883BBEA09AE015DAF53499E7A1BC5013AD9D3E971F7C4D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ThirdPartyNotices.txt

Path C:\Program Files\dotnet\ThirdPartyNotices.txt
Size 77KB
SHA256 e8ddd95ac905467e4e519b446ca023fa00c31732bebd9b66e65101c712092ee7
MD5 406d07d20e58568365df0557629fadc6
SHA1 9ab5ba1ef3866afa75b8cf3c392b7dd3d7f52026
SHA512 c6025a947faa5dc2b41a14d75e228ca2bd0df094e8cef914c58a6d2f5854424972a647b2c8ca8173345e40ba7557843d03efa85c5098c6e0e6726377efc8a38f
SSDEEP 1536:HA9jHwsGfgg39/zwgAVkguQxrDjugtSEGepkWvrpX7anuqdLSVnfiStPq+3Lefrb:HA97w/ogz1AVxuMjHtSFULryLOgrGWwa
TLSH
T1F573A45F7E45077319E2C3916569A8C5F22FA02E3B6B2A44346EF248133B42DD6FF858
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

state.rsm

Path C:\ProgramData\Package Cache\{b21e7fe8-9175-483b-a67f-0fd948722740}\state.rsm
Size 932B
SHA256 a8482ac4edbea2ffb94b21e511532326e8f176c080d52cb758ffcb6a8b8d965f
MD5 67f41a663f9a5a337f452d82bcfe4784
SHA1 1d9ae5f9e7460a56e77a28069f5112e44e2b2c72
SHA512 057db331df4c3ae137feb160ab6095d55b85e58a0c9eb631338be6e8dbac09fe2d38a12255fcea7bffba20773d1f9f5d6d9af98c2a80c984ef80eb6b20bea6ca
TLSH
T1CD119A515FFA0129E3FA6B30A9F92711643AB8120D32C16C0101318A8E32BA0C870F77
MD5 SHA1 SHA512 TLSH

Submit Download

Ultimate Tweaks.exe

Path C:\UltimateTweaks\Ultimate Tweaks.exe
Size 157KB
SHA256 1daa6f2bc7c92cc975ded72b9900dd752105bf37cbc53d5b4a9cade7eb84e941
MD5 8481188cbb07f55ef9a60c529f007e7b
SHA1 fb1f1258462181ea4fcf4f81bc106fde46112409
SHA512 7b70e9d5b4dc88982c2c0a197bc87649b180f38991be710b78d4194109723440c23b2d5d7cc700c3f3784af386c98e6b74b7c2c194afa26f39244133e7b2f375
SSDEEP 3072:120jWfVKLer59aSpfO9D/87jXEkeFZA4nsSQUP:4IhSpfO9jC/4yU
TLSH
T1BAF32B07A6B844BFE1B3D675C9924941FBF23855CB79A6CF03504AB60E637D0AE39306
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 908217dae4519f380066459015f1c8ac65c476d4ef07f220d7c006499d4b220b
MD5 5b40394ae146844bdedcd0957d4c555f
SHA1 28248b41eb26e6d6f813ee907a68624ddc11ff8a
SHA512 b0c9889d8a84bcfdc5c2b09889433b6d1d0e0ea0f721fff80cbe715cb7ef65c667b37e2c7b782e183f0d64d65944d182b924cbec6839bf3ca504ecd1c96cc67b
TLSH
T1D5E02B69CC21BC6708FD071950150785E750135B2E81554F7B3DA90CCFB0A2741C6C7C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000007

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007
Size 331KB
SHA256 db4ffbf0ec662620013dc14bc1268bdad6256d19d7d511ec7eff8446887e6900
MD5 05ef8155cf66131654d3bb9c9cba5853
SHA1 e79d53fcb604921222dd1dbc2f1c10c631ff6075
SHA512 ee38793245d91683ddb1f847e5b56a09864fd32ec059055459b3ebe101abed79683ee59c80f30b8f6249d2bbd83fbf7bca83dafb4ef2b634ceff6969c80fed23
SSDEEP 6144:FljUD58FLTW53eaLkNv+Ps0dj1fpqaGjYf0NIcB3bM1rJZ24:FDm5uaLcv+PFj7ajJNImbM1rD
TLSH
T1247423A9B50E3C8AC94F9473827EAFD2A4356FF38D47BAA3634241F401874342E4676D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 4e9d0455cb987fdbd99e60314a82e389c13d24f16d65b9378533804301a4e19c
MD5 77b6651694259a1e41058872662b797c
SHA1 44755e08de97fcac18b2f9acb91b848b610367d0
SHA512 1664a5106561ad484a3509119f65eacfd2fb6123d39fa2d37dd3c2d52ce5768c82c16744968e3a2ee4d24f2b5cc93d0c68d281597049ca28d9fdf25029d74472
TLSH
T1B71122646C8550B6CFE42C7291DE4B153001AACBF75B67DE3E024F976E02FB98885086
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 30f3c5608583c07de9d288deaf15b0a2b320a588a945f33f7dea8a046afff7fa
MD5 62571aad7b6d4c850c3b711968aed5f0
SHA1 d8b6a665950a80f955825a5cc6c4fc1e3a94355d
SHA512 5d487d0a0dbe65d2e2e1942bb10d5baca42ef5a0c894e06e2c994d035f91978bc14e998be35779c1e397b44fd1ad577daa8bb1e135b06628d2f7023104c4134f
SSDEEP 192:DqK7Ud8qoJ7536Faahmf+JlTe9VgHVuGNPIRaP4IaBvDfPgNeoHsKszs2JrW:DqK7Ud8qoJ7536Faah++JlTe9VgHVuGN
TLSH
T12F12ADF3C3E8862D891156F4A7252F2FCE6D1A28432C3C66C9D4EF5BA3E2471D25164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 2533539d01cc63968d404ee3a4a4952f0b38d76d11eb078e18f22f315c62542d
MD5 d612466d143748bca070a4baafed4f43
SHA1 ed9c7057b2c4b55071733daed5d14bdc8b0f1f7d
SHA512 05b6ef6c89b3da81621ecfd4da9b6c02b8c7d8bbf566dfa88c52f0323c7df084aca0e5c30b6c1f5520abc6c3bba76f2fa8437db9966e20310fa114987950e633
TLSH
T19A2149A7D5AEB47720B88C6F1D04BC161FB5A830519368F5CB9682BCF0D19E36F1A423
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 43fb6c699dad85dc45344816d0deff792926f26737b7b8532b74e95b0029b364
MD5 c401045b58f5fe853966dbbac8c13715
SHA1 e26a3d7f6c05d4bd35241f6c30bd2a734c5cf54d
SHA512 2450e72c47027cd48a10ceb2bdcf6cbcd1b70ee4dd14a200f847244b63aa53d6709819afedf5fe42a24f21a02db85a4e17815eb7dca406ccbbd14984479c8fa7
SSDEEP 192:NRuPImd7Zvv7spAPRp22mXc9wHsb+WNnEo47r2gkohkwMVyIsnAUgtaJ:NRuPHnYUX/BKwLQ2xKI8
TLSH
T14452D83EBD1469375CCBD22AF9227B57D7F5102225942E54E6FCC92C18DB9CC222741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 992500dd910715ee4ee122db48101ceb8dc437d7839ca3205d8f6411971f6f9e
MD5 cacfca2288b12559f3b3691c490ae1ff
SHA1 8663871cd7ca2b189700899db58bf22f60cf07f8
SHA512 1b182b81ead5c0a0098409c94f76ff6d910c2d92880fd9eed5362dc64162de8eac43d4aecf61b61207ee0db5fa5ecdac9746b83bc81bce337d96c9ada8044065
SSDEEP 192:NRWcBzfImd7Zvv7spAPRp22oPQqZ9wHsb+WNCXEoeeO+7r2QkohkwoVyIsnAUgrK:NRWmzfHnYUX/OKwwiq2BKse
TLSH
T10052B67EBD1429375DCAD22AF9227B17E7F1112225942E90EBFCD92C18E7ACC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 d6e4b36443f8a2eab617f03814b89599acf5a1cd2d4f069e381bf26f7c73c560
MD5 a6f5c714b2299454f92d7e38deae6667
SHA1 d0d2c39731644136d98530c36bbc476999b0633d
SHA512 a0454227210bdf8cd49b86bc017fdf9b66e567877621c1f74fc6dc2492cba20d3363b1a1681ebba18a8163c6f0021af58ccffe87f5072812a35f73418f98d5b0
SSDEEP 192:NRWcBzPImd7Zvv7spAPRp22mQ39wHsb+WNnEo47r2gkohkwMVyIsnAUgtaJ:NRWmzPHnYUX/TKwLQ2xKI8
TLSH
T18552E83EBD1469375CCBD22AF9227B57D7F5112225942E90E6FCC92C18DB9CC222741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 1cb7912d20d71e2b14ddd6d5928b8e5c43fb86f49f2b29967e74a39b2e1b1525
MD5 d00476216a9da39172c99fabd6bdab3d
SHA1 221f820a55f03b3f49b3d46d098db823baaffdaf
SHA512 cab925ed649d8e2077808535c6211dc9b326e7e745faa65f6b3db80076b0dcc9167b8586183e1fce03f2bc76ca9fddc3a838e2c444bdb4b843e8d6ef1b312b44
TLSH
T1F0B01281C0816102C08203F4214718C87114DF14E60A170643F06A228C35591C124050
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe595b84.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe595b84.TMP
Size 96B
SHA256 c480439d9c3b678bcf6a2884020fa1fbf9bb06b859d47d4d72739cd7b04447ea
MD5 a65b26c0d3dda10b149269e6e23190c1
SHA1 3c3f1bf1929451796728e8110cc72f1595983965
SHA512 a5637eeb60bf85dcd2e9166dbcadd082743ff31ba73eb6441d2db829979998cdf45532febf1e7c827590f5923e57d13592640bfdc8a9153ddec9c404caec6873
TLSH
T19AB00255C142B213C08203F02A9F99F87160DF35CB5B131B96E02E76DC266604625961
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 8113a45b06be040cbb6875299a7285223d6358ecf9cb10fb19d4563257346934
MD5 4a6169829ea1764b645de112413af48d
SHA1 04e2461585a2bc7a605d9b86bd0f4cd2d523a915
SHA512 096fcdf2494fdf30fa3b3de2404e1b8bb6363c9ca66d74b8959f5740fab3922ba32bf2e207d068dad288a076e7d49425f197e44e5c5d6fb710197004203bf5bf
TLSH
T1D1B02413540DF431C50C03FC13C4C4033355FC00F343014174504040D011F5145C0440
MD5 SHA1 SHA512 TLSH

Submit Download

c0f601fb-4cc9-4edd-ae80-3d4bab77d574.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\c0f601fb-4cc9-4edd-ae80-3d4bab77d574.tmp
Size 17KB
SHA256 379d96542283773f422c052abe7293924621df1604b63c9a59676e1514d2db6c
MD5 d066f854d368cbebca026e5da297c2c3
SHA1 4f2f84d54b0a8dfd273bbdb70bcde51ad5e2f12f
SHA512 613285c6b38983d33fb336394c5eff7edb692f60dfa433defdbf45524dd1c84cadfc8cba744a39b1c75482b318f7db6eaaae9842cfa8649a9ad00cece8442e41
SSDEEP 384:gCjUH7KxkXqKf/pUZNCgVLH2HfgslsZ7pLuLcSjCDXODUr+ErU3/NHGcmyqOqjmo:gCUH7KxkXqKf/pUZNCgVLH2Hfgs+Z7pF
TLSH
T15A7209676C4C9E370F94C6CCD8267F4F9DB5024B65E9886483FA9C2903D5ACB114A2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 7cfac4abe0abf64562373a9ef996b6353fcfdf72c911d24fb4fbdda6d98a233a
MD5 94ade82a7eb440e7858245757c33ad3c
SHA1 fd91c79f0265bb1559808bcbd9430c230730f2d2
SHA512 402d0dcb571fc82b3e14e364cd89aa0313855086b908d7ffcefa128a9a0ef2844f3b938770485a9ae51ac9e286ad4c743825ea33b9541578077e845e8d53d081
SSDEEP 6144:BxKcvfHpY1X0AkL69mn8lN/9n9Jpym7Rkm1tYpBeh2BAob:vKwPyX0Abk8lNVP9oBGcAob
TLSH
T1E33423294C75ED7758CDA33F706F2A2E3FF09866D9189CC2CAC06B486B587905788938
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 50d72410abeb5bc3bfcf291c99f815e7f614499490bf6b5a641fe30ac6a1a9c5
MD5 9b2badce8a5cff5f52d6ecaffe1f3f6c
SHA1 ca1afc30bade170c59efa9c84bfe5f76cd5e3ea2
SHA512 28a39222fdb075faa8e1776e9c1632da89f22be5e47c87a059c02b32f6477065469fbb765d057a5ab703a53add67835ddeb4a6703f1f73252a9bb77cf489cd72
SSDEEP 6144:BxKcvfHpY1X0AkL69mn8lN/9n9Jpym7Rkm1tYpBeh2BAob:vKwPyX0Abk8lNVP9oBGcAob
TLSH
T1843423294C75ED7758CDA73F707F2A2E3FF09866D9189CC2CAC06B486B587905788938
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 fda2216cd717c65082d5d6a538f7df2a5311212be1fe9b5bb3058ddae059847e
MD5 b2bccd39fefc0f29b7dff88e4a3d4150
SHA1 26607ea5d2e1e960740611c2e3a13ad64a5a468f
SHA512 5c0f13569ab3326189105a9a5dca9aa2ad4ece65b65ddc0080d71e4e1fbe6ee1769a3a153ca97c3214a4fb7b67b708ac8edde6e61cf2542ccd8890797dc8649e
SSDEEP 6144:cxKcvfHpY1X0AkL69mn8lN/9n9Jpym7Rkm1tYpBeh2BAob:SKwPyX0Abk8lNVP9oBGcAob
TLSH
T1663423294C75ED7758CDA33F707F2A2E3FF09866D9189CC2CAC06B486B587905788938
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 010bcaa2f5b6041e18516a7292754075bebc4f17cf99a492148125291195cab3
MD5 e120f511102df86d44bd8938dd7430d7
SHA1 057945c5a51d18039faf9ce95f5a75bae5105a26
SHA512 abab7bf6a1add486434848cb3e9c7b6cc575fc14644bd6cd1af85361374109d588976864d73e9ae0b42ca7a8e47c2375fcda939c69b4348a68f9133339d93f69
SSDEEP 3072:gGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMK:Lm7Rkm1tYpBeh2BAoK
TLSH
T10FC3123B5D75E8779979B70EB08E0B1F1EF149A2D920DE92C8D86A0437E97CD0A04D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 9267ca39fb50d75e1644d2a3d696dd6ccb217e6bf9e7569d932cd90aa7ddc3c6
MD5 3053e2c309efab6af094759a328116e7
SHA1 5d7903424cad814547aab0b24c905523966a4e3e
SHA512 e50de13a7f8638a26ab1291ceb7deeec0ee240e218416f04728511d55351ed30af33ec0e5c0080501730ddff8c78a910c56192116e7e3b1043719f834e9a713c
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7G:fwUQC5VwBIiElEd2K57P7G
TLSH
T1C9B3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0e2b315c59b1bfe8e547b0017a92548af7c81e08409e987a2628ad74667b4fec
MD5 7ab616f55807e9de5195a40c50f65e5b
SHA1 917a7797f800e5f30a1b9b8125127968246d7ce9
SHA512 da10f29803a072f42a2c102da0bee745cf1b1d47836e3d30e38b1e66beeb1abeaf2eb47b6c07b23682098f70fe2a4b29a0777eefa1380d0fff2509ff32d9b356
TLSH
T171D08023771D7182F35B41759053D7025A1680756463B701B325D41C9A740C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8680c5515aa1718110be67cf82a8959e6523019ae9127d5be2bdf6119b33184e
MD5 e29471957b68116f9048882287fb41be
SHA1 20e0a891bd9e64f4e1cb1c55b569ee323f60eafc
SHA512 f9d6813abe0f9660de11daae308924248d7f22d5315a4504ea8c180b492717b191a550d0260ae8f2653beca04aa43fbd5855a28aeefb00f83b9474676301491b
TLSH
T150D023B0F31597D1C20F443D5461F7125A62C13430BBFB726072740C6AA404CF2DF095
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c5fdfbfc4e5eba02e213d2e85a48195f6426ff01e074c452ae14e25f84010b80
MD5 0bef2d4e4d096ce40f92b7d493d36548
SHA1 3c62e290a31d3507d3f0887092129f883d8647e7
SHA512 a779909767f83d26e3acec1c21654927d895d970d306184f0a91f4f4fcbe13448b78f31d2c1d06deda525e42f89cb795b772a0bd5ef509d5f62f4405c4243ceb
TLSH
T10FD0A7A0B6159791C20B44395861B7126A62C17830BBFB626066640C5AA4048F2DF095
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a72142f4b4b6a0521f99f4b4683a7c080e52248ac8eb27a6176ca365ce700c9a
MD5 a15226a4d5e87a8381c41543090624a9
SHA1 39b1bf69b35da05614f7f8045d4fb16b3d71fd98
SHA512 d0b967770931e92f49a10de9a3264de7890896e507739036031b7b93671762528ccf41a89fe27e4ae674daf9fc9d8058162d03e08bf1c9e4466e014d7185adaf
TLSH
T18AD023B0B31597D1C20F443D5461F7125A62C13430BBFB726072741C5AA404CF2DF095
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c756e7f0173c2e46dad26d72efbfb0a42b35deefa8d8ed2308e4410b46b600ee
MD5 509bff51589c8be5e43f296423d20aac
SHA1 bd50ef22bf1362528eb591a13feb31f3231bdc04
SHA512 0a6364f7f6dcf2e0b00fd8e5b79f4583839b1b3e47f62102d14f4cf4f19c507ca7d7aa64e2f107b5f954db5341186688dd1fa2c0c0a1fc1e46de166184e5949d
TLSH
T1ACD02370B53577D2D21F007D44706B015515817772B7B7517166680DDF70085F1DF9E5
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b976ac8901ffd41ec02a04aa583bc9d11350f0f9f714fb92d3341bb0bde4629f
MD5 504ce80b644a85a7e68d85bd24169289
SHA1 1f740a722dfa97fc8fb30626b0e3d6217e4a9864
SHA512 9406464a4f6becd85591c12af8a97fdecfa2208649138f347fb50d3e28f1583adec061050924fa0405e46eb75af7e299e6564c2ed039db9d82c50326da32a3c5
TLSH
T19ED08023371D7582F75B41759053D7025A1680756463F701B325D41C9A750C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

98a9a599-eda4-4ada-aebc-80c6fad6df6c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\98a9a599-eda4-4ada-aebc-80c6fad6df6c.tmp
Size 414B
SHA256 119dda2c2de49fdbffebf91c4b82e26bafb7553807d11a578b3a1c6646c7f557
MD5 9042d35b72c4fccf9af26e14ea069a84
SHA1 b9e263a04c2d3ba1b5122feba608ee257ee4d678
SHA512 b7892a7f693a317387bea5f2788c4e318d01fce0049e068622e70c32ae6773469b7ad3448ac16d2b92f705bec8de33c395775a675548f3dddd75dbdb1020ba40
TLSH
T111E02BADCC71AC7708FD1B1C91508645E71023962B409A4F3A3D910C8FB0A3F029581C
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 8c00b8153eae1b7a2fe0dcdd0c0dff7a63e61d3ada9da2a9e69c934073ee2ab0
MD5 1d752ad2ff975bf894f95977d18a1203
SHA1 2ed69d1a875b3a2fdb4b0567bd468ad47ea8fe6f
SHA512 421bb53886b0a24bf1cb777a4eda70441ae34d4a3511740faecb415742a7162af7d0a71d1fff16aa031b12374dd9ef052b3c695cd2e15f0147b968ac7ece8606
TLSH
T184813DBC014301A2D351933A68E7C4D53CF18BCBF42BEEE65110D8BE29D63618274F60
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 852ff76b29a17089298138e3071d3515c46fe88cdf64d3574357484745cd377a
MD5 fa9e9e1f8500a7a75c50987589460f7f
SHA1 0a1e462eff07f28c7b535a0fc7e86c2eddfd904a
SHA512 6bbb4ba2321982048c20457a8e07ffd89f181bf9edb68c6efac99547e87033d08a03d57576671ea097feb42048f118a953065e831051f8d673ad44d06d95e58c
SSDEEP 48:rRfpFNXGyI1uU7wlL/VFnMr/D+iMNQIrYWeLmANilb/xZs6Wh8eV4luj9Rifqtt2:VBFNXW1olL/VdsxMV9sY/M14U5A2U
TLSH
T12B910ABC015300A2D712A33664D3C9C53CF14BCAF4A7EEE65510DC7E1AD67A5823AF52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 147bce5b2f0bacae861a2cb613d291445b29cb89123f5a4cf76981f4681c1a28
MD5 3fa2ab912ab74766e80f22373f921195
SHA1 1f9d1f88752185041147d907c353a7f70554ba91
SHA512 4fc4c18bfac4f95833297a008c0a7d36f88b0cc996fc100642f90eefb83608740d6c58ba595626ac14b8c2ffabccb16cb1e5450c867298dfa07525f56de51ca0
SSDEEP 48:vt6t0fBljZQn/Y/irtf+rvbxaHKdnwlKNl0pap7WoGI9Vvq560so7uNiMiwuQ:vt6qxZy/L+bbbwlgypaLRU5ZFPQ
TLSH
T1FC81F8BC014301A2C702A33A68E3C9D53CF14BCBF4A7EEE65510D87D29D67A6867AF51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58b929.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58b929.TMP
Size 3KB
SHA256 f272e9c11bd1fd339b38b6c9f9be1f33a8f5fbeae1aab418d9d54612e5d17b73
MD5 b0f18f3022f360350ff6d26f5197ae32
SHA1 edd37f7dd49800a13f2b6e6440158a74a503e3cf
SHA512 3dc5633921d52bf50134c6a6b35169cb4ca9467f7a40910378d1d112cf7b6977b560d293833f55884d8a13fa0cdedc46049a5bcdee43c1d135fdda44987767d3
TLSH
T17A7161BC020701A1E352933AA8D3C1D63CF18BCAF96BEDE61110D4BE26D67618278F50
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 b766167e76a68cfdd03a119607a02440d3eaac88731bb41ecffcc168f5b47162
MD5 873771cb610e774f5ceb67530e8c3e50
SHA1 128925c88e3b8bd1f1033c7916a80d7552064133
SHA512 ada8a16123e3ab3483e1beae242f87172d4c08d84185094ec61fb4d08f0858797f978a1c10b2bad5c0f30cd23c2774472dfe45a5d2c79c30fd7250157a562392
SSDEEP 192:DUQw4D+YvEi5ebKf4dlG30Is+RsXisqZj3muJlyAzR:DUQw4D+YvEi5ebKf4dA30Is+RsXisqZv
TLSH
T10AE19BF7C3E8866DCA1156F4AA18AF2FCE2D0615432C3C6AC9E4AE5B93E3471D14164F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 b1d38b63a078acf4ec53e3c8a4f658c435e16fdf533abe1639651fb78fad34bb
MD5 e32016f0ad2b1ace65817574aaa5124d
SHA1 87288545f953e6972c705e413781dbde854fcb28
SHA512 85326dd942183c0d31363884f8267c639908fee5fbfd619c5d9be7b9595047aa26f4101ac44941d217580645a0f648a0f970598fe1e7fa78849bbc9ef25751d6
TLSH
T129519AF787E4856E8A0196F0AA18AE2FDF2D0615431C3C6989D4EE27D7E3472E10265F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 f0df869034bf708b312649a1eb65875918efa7392efbe4e33d3c5efc1335e14f
MD5 a2d8e36915a237b1b31415abbc0cf6c1
SHA1 cc9bc435af69f826eb69dece6a098ea7ba5f88c0
SHA512 f252f876178e0741fb1bf2b92602f049104fec192967e452de28be5e1518a6c91cff8ffb0283db56b403364045c6201a5b883d69e3d77771fa94fee1fd33a017
SSDEEP 192:DUQw4DwoYvEi5ebKf4dlG3JluJlyAzmIs+jtrsgUiqTsMbYW:DUQw4DwoYvEi5ebKf4dA3JluJlyAzmIK
TLSH
T1CF02ABF3C3F8866DCA1156F4AA186F2FCE2D0625432C3C6AC9E4AE5B93E2471D14164F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 1e056839b6299d4fe3111b97b9dafd43c90c41ee309e87aa5c7cac1b5f3aa42f
MD5 e85ebbb05138687c90cf52ebe2254077
SHA1 36847b13474cb5a892d35d2e4605266f42d8c058
SHA512 3ce669ee27fdd5b9b7a01d9959956aa42812e71cfc630bb1b8d0fcd5bbf2bba26a279e7bf4285e9040a698889bdbe744a5693c9d71645272347c4b2955ff9b55
TLSH
T1BA418E93C67FB67B20BC08BF1D067C46A97AA831819194F5DB96817CB0D0AF74F15022
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 53939381ad18ee0fb028190d2ae054eec355d46fddaaebefdb49dce980224648
MD5 a9e8ad7a85be4255324a7b3b26a90825
SHA1 94d5b5f927edc7f8055405cbabd59d29749dffc8
SHA512 dd365c0b18a8f0202aadae03cf38a45ca76347b33763bc64b5a88d15081721a7fbd955b03c16b364ffc0a8f8f9941c6baf684944ba82c48fbb6d0a6d12c7d4a4
TLSH
T1ED317EA7C67FB57F20BC48BF1D067C46697A9830919198F5DB96827CB0D0AF74F15022
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 d6e4e81a01efe936d1bdd2b5fe3ac6173d4b5d38211ef258b4190b3a8f83277e
MD5 9ff83965ac7900e749f9b69e9dfb3873
SHA1 ff419ccfb4c04f267984fc9cfa2388cb67883ba3
SHA512 01c21b22d979fbcfe340f3a0bdd7916d90d909a773e478d07707bfd3bbb5fc6d6bc9f4bcd7950a9306a6a2c22849bf0dda7d7b102e59a04eaa188315e15e042f
SSDEEP 192:sxZ3RIyM/jK1Ml8MzH/fnsDtIZoF/YhIdpwsHW6+WNrIf/A8I0Q3L0Ig4J:sxZ3uLH/fnsDtb/xlHbE/Lc
TLSH
T10F52F915AE34A97BCCCBD309BA547F53D6F9147292800E449AFCDA1C04E7AEC221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 a0aaab92634dbcc0daf409a267a5770b8abdc621de387c203356cdab3c52f6dd
MD5 48fab780322af348849ee9bd5b45fa25
SHA1 598cb732db53389c83637155c8362d729e39cfe9
SHA512 8b24412f7dc517e6b48688bafadaaee2070cb390c359f8ce747d11f83b009cae0be195d5057dcc5a30d2ae5228265f2c7537d6beb8d7a5da71dc7f98c418a9df
SSDEEP 192:sxZ3RIyM/jK1hl8iXH/fnslNWpVU7IZoF/Ykf+zodpJUP57nHW6+WNLTkGIfAed6:sxZ3nHH/fnslNWvU7b/VfliHb8z/ev24
TLSH
T18272E816AA34597BCCDBD21CF955BB53D7F8146292904E54ABFCD91C04E6BEC220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 751dfbee78190b936b40faf8257643c73e20c2113f49c522297a0ef3f8f8c24a
MD5 892659b6bfc31ad95677875f3b5565de
SHA1 42be9f741e9487c2eb258f31f779c5b2334c6e81
SHA512 9c86d44e1f56aaef5ee8bb335c1023a3ebdbc4863b960677f26e05b8d3c1210c38be42c1bb3227238bb75372a4ed0bce3be051da0ddfd474acf9ca8662cf6975
SSDEEP 192:sxZ3RIyM/jK1Ml8CXH/fnseWpVqtIZoF/YeIdpwsHW6+WNLkIf/A8AOQL3aIgb4J:sxZ3uXH/fnseWvqtb/YlHbX/74
TLSH
T19B620815AA34997BCCCBD209FA45BF53D6F9147292900E549AFCDA1C04E7BEC221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 5abb555b42aa41e4c3d5486e0d971f76da501584209b4d590722a0dea2869b73
MD5 6deb7a4097aa703ed7e0d369aa1648a6
SHA1 382cd983236ee13dabef507d839a7059b07b0f38
SHA512 121e1907b3c7f6aa15b66ec15847288bf76bc7a1f591a18e7a39f953423438f0b7ee606f1a42e8c14b1e3e48a570f3a401d689df8f955acdbeb33c98725cb34c
SSDEEP 192:sxZ3RIyM/jK1Wl8NXH/fnseWpVU7IZoF/YkfwzodpJUu570HW6+WNLTIDIfAR9fo:sxZ3IYH/fnseWvU7b/VfzEHbBAfeHw4
TLSH
T1DC82D716A934597BCCDBD21CFA55BB63D6F8146292904E54ABFCD91C04E7BEC220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 78110b28bf9e7ad5e2feaf3befa76da518c0ef9698dcae4fbb96bc3c2099948f
MD5 b49f8f533ae73f8589a8255177886855
SHA1 5a48b1de30e02fcd815cf27d50b4b3b2f393c304
SHA512 eca606542d903a0b8c4d839ce9dbc6f3f518336361e492f8f9c5ec65a5f4236ccf2c6017e3cb30e1292b56732514505230b41e55522bddf209ea3f3003e5b3c9
SSDEEP 768:Y6sqx9y7pLuLfJlWvJD6T8F1+UoAYDCx9Tuqh0VfUC9xbog/OV/ur4Ll6AR9XroD:Y6sqx9KEfJlWvJD6Tu1jayur4LAs9E22
TLSH
T159F20B3B6D4CCB7E4F840E9CED2A7E9A6DE8018B56D8C95447FA880C02C66EB11165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 d43f8e2a7a402c8004fe8f43e5d99968faccba3ff6a13ee7adedca49e9abf364
MD5 46772861b697e5c997e55c810bfe2ecd
SHA1 17aa00f6ef8cb5dda42555dafd77197fe5662df5
SHA512 8ace5e9405d848dbc0e9b731ef533e54b7f0dba9fe1305c5f54653fd3a0b23324f71db11cdbad2730bc2ec4a797dde767f4bb7d3edf1b02c323d74f60b9ba307
SSDEEP 768:Y+4qx9y7pLuLfflWvJDoT8F1+UoAYDCx9Tuqh0VfUC9xbog/OV/ux4Ll6ARvXroP:Y+4qx9KEfflWvJDoTu1jayux4LAsvEVJ
TLSH
T1D1F20A3B694CCB7E4F800E9CDD2A7E9A6DE801CB96D8C95447FA880C03C66EF51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 229c1a9c1baa415feb40fb12831f623fb680af8f6f1b7404bdfa405dbc352b31
MD5 05fc600c9ce3cad03b38546142b9f365
SHA1 e47adf1359426551258df673ef2a5f0c4e2b1b59
SHA512 1711f098e66425915a7a6ad442e81404a39ba514be0b2c402ca812025007af2c2a33bf23ec0e896136074889db1e72ac14cd8d7130c36775499bb23f75fe041d
SSDEEP 96:KYbaKYIKScgKVWeS8AKhumJqKaoyKWoK3qFaTm6wYp:ExbPz4h31
TLSH
T15BE1E716713E061239FE2988B2A685374F423163305CA86F7FB950654E6BE235CFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\FileSystem\t\Paths\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\FileSystem\t\Paths\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 cd765d09e0cb85151741358da643686ce8956953b7adbe409874174bd5b3b816
MD5 ec097be60ea369717f64b76dc95f0e11
SHA1 4a68c86319e78301a4abdfb5e7e8c10cd8d2d488
SHA512 333bdad96aca76b9abb042a37e855ee1c60c55fd03e50e6103ed791b5c2fa4d463093a387170ad9015dbd962db0fae58d0476621086d48f73211d921fe961680
SSDEEP 192:tONC6JkRtQmiUylzW+RNfCk7Omth3eRwU6:tONC6Ur+W+RNaET5U6
TLSH
T17002F9356C382C7B8EF2AD05B58B27175FA4216BBA952F80DAD81A1C01D769C234793A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 e6c24fc97551f28d445cbd949ccb5803bd680f05805830f14d74457a473ea0e2
MD5 855f9e9024ec28ddd755f35e2e2fb83e
SHA1 8456574e6cdfa9a56897ed5566ca139b64b74e24
SHA512 cf65791bbb8414750c75afebbe5bd194fdf07625642277b63c0b9008aec20b52e494ee6a7988cccd001bb51487624a41811fc155a88e27a3006b28bd27c9e715
SSDEEP 384:nJZcIhsNjXaAQbRjjVRNaE3Zf5UrzZKDx:BhLAEBHaWZSZa
TLSH
T1E9929E702C389C3695F7A805F98B33174FF850B3E6C52B84D6ED5F2D049A59C270792A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 eef3574fbf22372260fb49044db04acfcf0e51cb2ac2bfd52a06153406a80ac9
MD5 9b092cafe1defc1e218c756fbcf0434c
SHA1 3b8b8c98cd071541aaf969b22092085c65575c3d
SHA512 a0d5e496a12edbbf96a5bf85cad190b27910e6cf564dab8020dedbd7883447699b1d6eb89f7dce59012effb5c3cbec6eb18cb63aaab67a9268c4d3647b02525b
SSDEEP 384:n2ZcIhsNjaaAQbRIjVRNaE3x3vKASBP9/sCQOKsitHXf5UrzZKDx:kheAFBHaW5tSICzKsixXSZa
TLSH
T1D9C26BB0DCA41DFB44E1E4C59942F1172DB84137C6896A4CD7FE7A3E31AF4B92716026
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 f40a660eed6b445b325760ee13273babf7067369ce0079f2ce8e0afb5c458645
MD5 74ddaa57c180caa38fe5d3cae2b3ace1
SHA1 7d1fa04d5348dff26134bd82b9ef5f1d68ff0e3a
SHA512 c4efbb1ab14a8989e67896f8733c076f9c03082241d51926e496fcd28ad4e5464aa94df21ef02a5e23ca0513a48d45d7bbd29e1e7a59dbeb41058cb1d109cc72
SSDEEP 384:nYZcIhsNCRaAQbH/jVRNaEj8eASYNsCQOKsitHlf5UrzZKDZHx/7Iz2:mhSAKBHaM0SDCzKsixlSZg
TLSH
T18DC26BB0A8A45DF744E5E4C9AA86E6133DF81177C5C95A0CD3FABA3E305F4B92707026
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7ab2bb18f1436e21fdf644dc5a3e3e560d4e28c1b67008b018a8fcada64abc66
MD5 f7616cf5ac73fc968f3f0299ebd38204
SHA1 6c0a711de84ab6c1753d4223a3f740e23cda5771
SHA512 b82f4f705f7648a7e4eb35ee2c307447b3e01ca3030cf658f5557f332708ca3d6f6e64bc46ec85eb17eb388a05e914819bc1a595688aa68d49438072d10a108e
SSDEEP 192:XON+6JkRIQmiUyyzx+RNfCk7OmqZZ+VciqGsU6:XON+6Uo/x+RNaEYZU6
TLSH
T1D81208357C78AC7B4EE6B805F5CB27535EA420B7ED856F40D6D80E1C04DB69C270B92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 eaf889f165bc2702baad709d77cd3d964b1d319571c3c65b862117c8ab0b8285
MD5 57df2b78cc8c4c6de6f041186a6393ae
SHA1 530a4ffb155539a74515dc44273947e0c6f8fd40
SHA512 71be998b1d22c9072461dd4e3242526608537b5b2b82130ec583d3406f2cb85125c147939e2629f872c4906a829ae5fb894bdc283fafdcdd958d6285b1185534
SSDEEP 384:n5ZcISsNifaAQbdojVRNaEYTf5UrzZKDZHx/7Iz2:RSIAZBHatTSZg
TLSH
T108A29E702C389C7799E7E405BA9B37036FF450B3E6C42A80D5ED5F2E049A5992B0782A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

af718564-6e2a-4082-b311-44a8806ac1a0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\af718564-6e2a-4082-b311-44a8806ac1a0.tmp
Size 27KB
SHA256 48d43a10d575d24cbe24a98dec4fc600e5c132cab6a43089fcff317bd1d481fc
MD5 4925ad88d6ad2fccede765b9d4672b80
SHA1 d4e50f27f9f882319048877776939a88c14a3b23
SHA512 1698279bc3b12e51a9c518fd268a456aa5215d9314d15fcd4e15894676353bf7819f96a0c343a8218c1b123f40d1793a5cc4fe1bc4131bc36d79b6f1999a1906
SSDEEP 384:nUZcIf3sNifaAQb+ajVRNaEYoN7SHNkCo9JeQkDSf5UrzZKDZHx/7Iz2:Sf3IAIBHatkSqCo9JetSSZg
TLSH
T1DCC26CB09CA45CFB44D6E4C96686A6033EF84133C68D6A4CE2FD7A3E355F8B85317426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aad8580d-a49e-4c17-9550-1b7d4f911b20.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\aad8580d-a49e-4c17-9550-1b7d4f911b20.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 612f7a1ef364a98e5df95d294c227b1def0e0a75bf4bbd7d21b4f6e4bc452280
MD5 55b7d8c9aca8e0ab3061480358b61976
SHA1 f9294f3683926d881d722560f7be77e7616ced83
SHA512 cfd4970e683196165d677541a50d2ecd382943dc1e545617b09c92d0c925252cfc2e8f6c49636ced9fd85053d1a3787dc91bc04ca3955af8d42eb4c2ec2a62f4
TLSH
T1FC410758B6FD1108B3B76F1AABFBA8AD447E7D372E06D45E10110E4E0A22A40C8A1737
MD5 SHA1 SHA512 TLSH

Submit Download

2c636f79-27ba-4d4a-991c-427b0d2ddc1d.tmp

Path C:\Users\Admin\AppData\Local\Temp\2c636f79-27ba-4d4a-991c-427b0d2ddc1d.tmp
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5fa952c3-e6f0-4b30-8d99-0a9264ca8a41.tmp

Path C:\Users\Admin\AppData\Local\Temp\5fa952c3-e6f0-4b30-8d99-0a9264ca8a41.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

Microsoft_Windows_Desktop_Runtime_-_9.0.18_(x64)_20260807234121_000_dotnet_runtime_9.0.18_win_x64.msi.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_9.0.18_(x64)_20260807234121_000_dotnet_runtime_9.0.18_win_x64.msi.log
Size 3KB
SHA256 00072b7e8af0e21cf1d8b484074d02f87ca9ced6828ac3634cb5574749a4a142
MD5 9fd4301271bb7d7130e5d7eeac782c4f
SHA1 aed7a84f9e89edeab816fb817a26238a8360b6ec
SHA512 22dfe2ff0ffbb3eb0cefe838ab7717e64e578111f1f3c56438c452c043d22a32e7ba1b54d26ac7c48377862ea842fa6ede2d4495c03a47eb039ac302c89eda73
TLSH
T192711D195AE40946B2B35B479EF3C0669B33FCE75834CF0C2385821A466BC055969FFE
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_-_9.0.18_(x64)_20260807234121_001_dotnet_hostfxr_9.0.18_win_x64.msi.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_9.0.18_(x64)_20260807234121_001_dotnet_hostfxr_9.0.18_win_x64.msi.log
Size 2KB
SHA256 22c9f3d8d5044aa76a48525ad2629ae8e59e0f5a16ea21ca8ea051e50c364cb4
MD5 12bd70997c0260dea4d51534ba82a0a1
SHA1 1abe55e0147cb67591ed80d970816d9089dc54a9
SHA512 436cb824b04ac1d2cde4a9140af291bb0881adc9a7b6861038aa44377b17411e85712c827c59f5d6b6781f4a31f86419215c3dc45f509f2973ed01fedf3b4d45
TLSH
T1604157581BF50814B1B39787AEF3C4228F73FCE35938CF4C22854229067BD049969BAE
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_-_9.0.18_(x64)_20260807234121_002_dotnet_host_9.0.18_win_x64.msi.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_9.0.18_(x64)_20260807234121_002_dotnet_host_9.0.18_win_x64.msi.log
Size 2KB
SHA256 c891d64e285c25fb70f6ed2b6ccc6706b1b401dc816a6e7d14a3aed1f496477a
MD5 3b143c9875e66a38a82cebe291670d42
SHA1 5ced7e662a84f1050bad1076bcc1619d5a11fbd6
SHA512 fc579e7c911ae36d1ef929dc0f77fdf298dda400c972d6a75cf09c79b2964cd3c8b3ba9636c205cdbab3d0f83612cb5f9e1f8ea15f9123896cf3b4675cf75ed0
TLSH
T14D4139191AF40805B1B65B479EF7C0239F73FDA66874DF0C23848219056BC0599AABBA
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_-_9.0.18_(x64)_20260807234121_003_windowsdesktop_runtime_9.0.18_win_x64.msi.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_9.0.18_(x64)_20260807234121_003_windowsdesktop_runtime_9.0.18_win_x64.msi.log
Size 2KB
SHA256 be3a3591cac9efdf409c753cdb8f51eb948f53966ed689bcfc56e8d9118c3cae
MD5 8d3278fdc578adfcee7d6d9d0866b680
SHA1 60404af603c6a82c5530909982970cdcee657811
SHA512 65037d24263f463a46e1debc0f39639d77b3cd852870160c22b2bac7f04a542b4d860ac5e05fc8470fa57187b2c4e7c5f9e82d5f66fc91270fc763325a057bcd
TLSH
T159413B181EF40814F1B65B839EF3C4625E73FCE39934DF4C22C44219457BD059979BAA
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_fsimybbu.lin.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fsimybbu.lin.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

dfa0c754-8dc1-4433-a234-4683d328f547.tmp

Path C:\Users\Admin\AppData\Local\Temp\dfa0c754-8dc1-4433-a234-4683d328f547.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3832_1925196644\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIF095.tmp

Path C:\Windows\Installer\MSIF095.tmp
Size 219KB
SHA256 2bf33a9b9980e44d21d48f04cc6ac4eed4c68f207bd5990b7d3254a310b944ae
MD5 928f4b0fc68501395f93ad524a36148c
SHA1 084590b18957ca45b4a0d4576d1cc72966c3ea10
SHA512 7f2163f651693f9b73a67e90b5c820af060a23502667a5c32c3beb2d6b043f5459f22d61072a744089d622c05502d80f7485e0f86eb6d565ff711d5680512372
SSDEEP 3072:FVzl3qiEZybztEwiUx6D02cWVsV1v2vZR3X6j7zo6k2FkngTLrOrORT9flQnS6lg:FVIMEgXmEAR3oHon2VaFuG0eEp
TLSH
T1AF248D217494947EEAFA0832A57EDA71BF3DF2241760C8AEC3409D1E6D604C167B7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bg.png

Path C:\Windows\Temp\{2C3D558A-253A-4A3D-AEC1-AFDA9FCD2056}\.ba\bg.png
Size 4KB
SHA256 9095bf7b6baa0107b40a4a6d727215be077133a190f4ca9bd89a176842141e79
MD5 9eb0320dfbf2bd541e6a55c01ddc9f20
SHA1 eb282a66d29594346531b1ff886d455e1dcd6d99
SHA512 9ada3a1757a493fbb004bd767fab8f77430af69d71479f340b8b8ede904cc94cd733700db593a4a2d2e1184c0081fd0648318d867128e1cb461021314990931d
SSDEEP 48:u+Xg+NXWbdlIr33lx9W5OstaDIy3r5XpPyvZKmXYTDeiByNxcaaaaaaaaaaaaaaE:AaXWPIrHT932JsdpPyjqDeioatEn
TLSH
T19891B4D8FCF95322C6002BF255F4C0735A0215B713ABFEC82F496BD90E6878E25058B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wixstdba.dll

Path C:\Windows\Temp\{2C3D558A-253A-4A3D-AEC1-AFDA9FCD2056}\.ba\wixstdba.dll
Size 190KB
SHA256 dcea15f3710822ffc262e62ec04cc7bbbf0f33f5d1a853609fbfb65cb6a45640
MD5 f1919c6bd85d7a78a70c228a5b227fbe
SHA1 71647ebf4e7bed3bc1663d520419ac550fe630ff
SHA512 c7ff9b19c9bf320454a240c6abbc382950176a6befce05ea73150eeb0085d0b6ed5b65b2dcb4b04621ef9cca1d5c4e59c6682b9c85d1d5845e5ce3e5eedfd2eb
SSDEEP 3072:sjEoXsLW9OLG8Qp51ySdjDXY33b+Av7O5IkI+/AYkPAEc527uu3k/gLtxavf0ir2:sjEo8LW9553hXWy15I2YrAW7FUVEihs3
TLSH
T1FF14AF1176D0A07AEBFB16307A39A5216E7DBA200FA0C9DF63449D2B1D715C19B36B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet_host_9.0.18_win_x64.msi

Path C:\Windows\Temp\{2C3D558A-253A-4A3D-AEC1-AFDA9FCD2056}\dotnet_host_9.0.18_win_x64.msi
Size 704KB
SHA256 999adf7d2c62e5c3dcf84f7d37de7b7239ed181320a34333be24e711ea31ac0a
MD5 84d594d4a01a5ef833b7f128e6527b4f
SHA1 c37629ebc7c6222903a49a6cbda70f9bca084cbf
SHA512 9a0f17c1f661777035637bb1122d3b07e1b5eea66e75659157da270bf37a3b8282bcfd0de84fb084f6eeee62d36d19b312451ad118bf05d2ae8cfdd5cbd53bbf
SSDEEP 12288:VDcWJ8xeV1EgXmEI3os2Qx7E4D4Rxbp4K+1uiq:pcJkXdc3/7Rin+s
TLSH
T1A3E49D237D80803AD9BA1D31953DD7B16F3EBD204A64889B5380B91DDDF11C0AF76AE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet_hostfxr_9.0.18_win_x64.msi

Path C:\Windows\Temp\{2C3D558A-253A-4A3D-AEC1-AFDA9FCD2056}\dotnet_hostfxr_9.0.18_win_x64.msi
Size 776KB
SHA256 1e32234822baf467c0eb2e2b1b498ea5f19e68a37fa74a4fb54b4b0c880d7a76
MD5 91fbf55d6cc731e4742cfed4db34fa82
SHA1 199284451a7a4c5904e63e691dd1fc8d8f4ffcc4
SHA512 fec81c0ad9bd574690c7950fb0a4a973ece04caadcba92b9b1a1a0f7ce27bd6f718fa4e75fcc50ead37d965c7d6db1dcbf947a51b727a481610bd06e472e9038
SSDEEP 12288:0flV+AtnKhJXV1EgXmEI3os2Qx7E4D4Rxbp4K+1uiq:Qj+A0hJXXdc3/7Rin+s
TLSH
T108F4AE137D80803AD9BA1D719539D7B16F3DBD204A64889B63807A1DDDF11C0AF36BE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet_runtime_9.0.18_win_x64.msi

Path C:\Windows\Temp\{2C3D558A-253A-4A3D-AEC1-AFDA9FCD2056}\dotnet_runtime_9.0.18_win_x64.msi
Size 27.5MB
SHA256 16d8a182dcb54a7d93defedea3bd23cc44f291a5d430e9a41b3379add5c9c963
MD5 59589f076158800d29bf3f83136b3c38
SHA1 2298f1a89ce7c1208274675e90861f3e0c35c61e
SHA512 74ad9447089266ecb00a3646c063fb61f84e46c903b4663a7816165adc2b37118ddfbc214fc4fb0c760051bbe6da74d3a8534a4e948e22d8ed6e72c6365617c7
SSDEEP 786432:0mwF1ZdIi7qAuVQGdtzBg88DHVT3GwXd9L2:GFqVnhg8fwX3L
TLSH
T13A573393FD82843AE17D1D3194BE97B46A3D6E111B0ACC1BA254381DFDF22D04A72ED6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windowsdesktop_runtime_9.0.18_win_x64.msi

Path C:\Windows\Temp\{2C3D558A-253A-4A3D-AEC1-AFDA9FCD2056}\windowsdesktop_runtime_9.0.18_win_x64.msi
Size 30.0MB
SHA256 87a9ba31111ed5aab4d44e31e3ece65126150e27447f5e30aade964694589517
MD5 70cf6a2e93dc90095236ba5477b2c767
SHA1 1b52740168aea04639d6c9ceba8e498a90e5ba9f
SHA512 d38565990bd8b75fc946e0d0f769b7a990982d05d585ced1f6121ead5f615b9a5561b328e4258f9cb75f2b6dd32551695d796104910a4c4ef952c1e516364bc2
SSDEEP 786432:yl9KaCo8bNp5Q5leTPY+OK/iAcWWHUto1Pe:a9KBXQXeTSWW0toQ
TLSH
T1FD6733137D53E174E89A0E75823A9B60AF3F6E241A208DE74310BA1CDDF06D05D76BE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{C9EEE4A0-DB68-4FBD-B102-1F7DC95CB780}\.ba\1033\thm.wxl
Size 5KB
SHA256 81a68046b06e09385be8449373e7ceb9e79f7724c3cf11f0b18a4489a8d4926a
MD5 d5070cb3387a0a22b7046ae5ab53f371
SHA1 bc9da146a42bbf9496de059ac576869004702a97
SHA512 8fcf621fb9ce74725c3712e06e5b37b619145078491e828c6069e153359de3bd5486663b1fa6f3bcf1c994d5c556b9964ea1a1355100a634a6c700ef37d381e3
SSDEEP 96:MT0abTxmup/vrCKATQdYQHdYCwgoVOBq9LjP5dbSE7:OQNkdYQHdYCYXt7
TLSH
T1F1C1DBA778CF53C128731255EA925AAA5911C19C537F2DF4FC8B454B838A827A373F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windowsdesktop-runtime-9.0.18-win-x64.exe

Path C:\Windows\Temp\{EAA23D86-5E50-49D0-B8D7-C12C662A50C5}\.cr\windowsdesktop-runtime-9.0.18-win-x64.exe
Size 607KB
SHA256 78a6d3bcdd33c659ba2e04ca01276bf725f4ced3654698f14706eeb93b924d3b
MD5 1be627af972f9f81164a08b0d7d6dfd6
SHA1 4d144311e2b9fb2d6f3470f3669eb5990c2c240d
SHA512 418fcea8100c6dae3f7f6a3eba06a9e64831ff7c03575fe3474074c6cb157cc9da742e7fb59a0df7ca0ae47f22281779e0746ce04a40c0e8bb3d2537474a08b7
SSDEEP 12288:CmEsd9PZfePv3xl7ft7V+6uC+zd5qLlJF3wURiy7nlEM0Dnma:Cm39PZfePv3r7fm6t+jqpz37rzCM0x
TLSH
T1B4D48D32A5614032F7F10673B92896303E3CE328175488AAE7D4AD1D7EB88D667F7257
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/784-1394-0x0000025415270000-0x0000025415D31000-memory.dmp

Download

memory/784-1028-0x0000025415270000-0x0000025415D31000-memory.dmp

Download

memory/3868-1745-0x000002031EAE0000-0x000002031F5A1000-memory.dmp

Download

memory/3868-1740-0x00000203378D0000-0x00000203378F2000-memory.dmp

Download