df76d77fc80d0cb993f2f2f429971a9ffdee5a94c68a49fdc1c2cacd057149f0

Analysis

user interaction
yes
max time kernel
164s
max time network
171s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
09/08/2026, 17:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
Synapse Launcher.exe
Size 88.7MB
Sample260809-wk5d3abf95
SHA256 df76d77fc80d0cb993f2f2f429971a9ffdee5a94c68a49fdc1c2cacd057149f0
MD5 5507ef23a15b61504e5cbe51e3afb236
SHA1 aba732e8e86ee99408b461ae607c73dc85201f3d
SHA512 4d036c2cdcd2622336d2cae600eed8295c97b20343a77066e4a57e515f6d723b2cecd6b06c45d3c79fcce2adb045a471b16b4483611fc9a627848912bd56e9f1
SSDEEP 1572864:N7NgpeUE9GA+H2Sg3D7y5Cf6zVKN/fYqam/Jkuo6816HQgwTLNKmKIPdDhZIM:zGeUXAa2Sg3HiY6BKlam/JG6w7NUKpt
TLSH
T1181833942289A5BCCFEB3DF40777A85449579D21022041BB137AFCA8DBBD287CC2756E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery persistence trojan

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
89	3260	msedge.exe

Executes dropped EXE 8 IoCs

pid	Process
932	windowsdesktop-runtime-8.0.29-win-x86.exe
2880	windowsdesktop-runtime-8.0.29-win-x86.exe
2392	windowsdesktop-runtime-8.0.29-win-x86.exe
3152	windowsdesktop-runtime-8.0.29-win-x86.exe
4808	windowsdesktop-runtime-8.0.29-win-x86.exe
3460	windowsdesktop-runtime-8.0.29-win-x86.exe
3380	Decompiler.exe
1264	SYNX.exe

Loads dropped DLL 64 IoCs

pid	Process
2880	windowsdesktop-runtime-8.0.29-win-x86.exe
1588	MsiExec.exe
1736	MsiExec.exe
3460	windowsdesktop-runtime-8.0.29-win-x86.exe
4320	MsiExec.exe
2236	MsiExec.exe
3940	Synapse Launcher.exe
3940	Synapse Launcher.exe
3940	Synapse Launcher.exe
3940	Synapse Launcher.exe
3940	Synapse Launcher.exe
3940	Synapse Launcher.exe
3940	Synapse Launcher.exe
3940	Synapse Launcher.exe
3940	Synapse Launcher.exe
3940	Synapse Launcher.exe
3940	Synapse Launcher.exe
3940	Synapse Launcher.exe
3940	Synapse Launcher.exe
3940	Synapse Launcher.exe
3940	Synapse Launcher.exe
3940	Synapse Launcher.exe
3940	Synapse Launcher.exe
3940	Synapse Launcher.exe
3940	Synapse Launcher.exe
3940	Synapse Launcher.exe
3940	Synapse Launcher.exe
3940	Synapse Launcher.exe
3940	Synapse Launcher.exe
3940	Synapse Launcher.exe
3940	Synapse Launcher.exe
3940	Synapse Launcher.exe
3940	Synapse Launcher.exe
3940	Synapse Launcher.exe
3940	Synapse Launcher.exe
3940	Synapse Launcher.exe
3940	Synapse Launcher.exe
3940	Synapse Launcher.exe
3940	Synapse Launcher.exe
3940	Synapse Launcher.exe
3940	Synapse Launcher.exe
3940	Synapse Launcher.exe
3940	Synapse Launcher.exe
3940	Synapse Launcher.exe
3940	Synapse Launcher.exe
3940	Synapse Launcher.exe
3940	Synapse Launcher.exe
3940	Synapse Launcher.exe
3940	Synapse Launcher.exe
3940	Synapse Launcher.exe
3940	Synapse Launcher.exe
3940	Synapse Launcher.exe
3940	Synapse Launcher.exe
3940	Synapse Launcher.exe
3940	Synapse Launcher.exe
3940	Synapse Launcher.exe
3940	Synapse Launcher.exe
3940	Synapse Launcher.exe
3940	Synapse Launcher.exe
3940	Synapse Launcher.exe
3940	Synapse Launcher.exe
3940	Synapse Launcher.exe
3940	Synapse Launcher.exe
3940	Synapse Launcher.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{facc4ae9-22f7-4df6-a5c9-d989da27b947} = "\"C:\\ProgramData\\Package Cache\\{facc4ae9-22f7-4df6-a5c9-d989da27b947}\\windowsdesktop-runtime-8.0.29-win-x86.exe\" /burn.runonce"	windowsdesktop-runtime-8.0.29-win-x86.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Synapse Launcher.exe

Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
145	discord.com
98	raw.githubusercontent.com
131	raw.githubusercontent.com
142	discord.com
143	discord.com

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\8.0.29\System.Configuration.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.29\ko\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\8.0.29\System.Text.RegularExpressions.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\8.0.29\System.Net.Http.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\8.0.29\System.ComponentModel.Annotations.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.29\zh-Hant\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.29\de\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.29\pl\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\8.0.29\System.IO.Compression.FileSystem.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\8.0.29\System.Formats.Tar.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.29\zh-Hans\WindowsBase.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.29\pl\WindowsBase.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.29\zh-Hant\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.29\WindowsBase.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.29\cs\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.29\PresentationFramework.Aero.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\8.0.29\System.Net.NetworkInformation.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.29\cs\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\8.0.29\System.Net.Http.Json.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\8.0.29\System.Reflection.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\8.0.29\System.Diagnostics.Debug.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.29\PresentationFramework-SystemDrawing.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.29\pl\WindowsFormsIntegration.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\8.0.29\System.IO.MemoryMappedFiles.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.29\Microsoft.Win32.SystemEvents.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\8.0.29\System.Reflection.Emit.Lightweight.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.29\cs\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.29\Microsoft.VisualBasic.Forms.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.29\pt-BR\UIAutomationClient.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.29\System.Windows.Extensions.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\8.0.29\clrgc.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\8.0.29\System.Net.Quic.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.29\cs\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.29\ru\System.Windows.Forms.Design.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.29\System.Design.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.29\cs\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\8.0.29\System.Data.DataSetExtensions.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.29\es\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.29\System.Security.Permissions.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.29\System.Drawing.Design.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.29\ja\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.29\ko\ReachFramework.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.29\es\System.Windows.Forms.Design.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\8.0.29\System.Data.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.29\zh-Hans\ReachFramework.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\8.0.29\System.IO.Compression.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\8.0.29\System.Security.Principal.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.29\ja\ReachFramework.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.29\tr\ReachFramework.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.29\fr\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\8.0.29\System.Private.Xml.Linq.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.29\ko\WindowsFormsIntegration.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.29\fr\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\8.0.29\System.Text.Encodings.Web.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\8.0.29\System.IO.Pipes.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\8.0.29\System.Security.AccessControl.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.29\pl\System.Windows.Forms.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.29\pl\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.29\zh-Hant\System.Windows.Forms.Primitives.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.29\it\System.Windows.Forms.Design.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\8.0.29\System.Private.DataContractSerialization.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.29\ja\System.Windows.Forms.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.29\cs\ReachFramework.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.29\cs\WindowsFormsIntegration.resources.dll	msiexec.exe

Drops file in Windows directory 52 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1368_1077770124\llm_user_input_extractor_config.json	msedge.exe
File opened for modification	C:\Windows\Installer\e589c89.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{A5DA29AC-BB7A-4432-988F-D52D203C348B}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA93B.tmp	msiexec.exe
File created	C:\Windows\Installer\e589c97.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB892.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e589c98.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFB45A1F768DC62D6E.TMP	msiexec.exe
File created	C:\Windows\Installer\e589c89.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\e589c92.msi	msiexec.exe
File created	C:\Windows\Installer\e589c93.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{7918A3FA-8E70-4FD1-AFC5-5699F9E93775}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB804.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF95E59A3A9C13D2F6.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1368_1077770124\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\~DFD0A7175440532796.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e589c8e.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF24FCA83F7428A152.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICAF3.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF65F8138AD1E82CE0.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1368_357899717\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\~DF10B8C4918471A107.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB245.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF839BA9B63052D273.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF6B88B90207C25A3D.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1368_1490377425\manifest.json	msedge.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\SystemTemp\~DFA691CFC255B9B01A.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB4E6.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1368_357899717\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\~DF3D0CD4F00422C332.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF2DEE1E0B5A3ABFF5.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB592.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e589c93.msi	msiexec.exe
File created	C:\Windows\Installer\e589c98.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{5492B473-F6B5-45EC-A9AD-C2592654CA2F}	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1368_1077770124\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1368_1077770124\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\~DF91999C8B8EF46048.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF814C487D8458179A.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBCAA.tmp	msiexec.exe
File created	C:\Windows\Installer\e589c9c.msi	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1368_797540852\protocols.json	msedge.exe
File created	C:\Windows\Installer\e589c8d.msi	msiexec.exe
File created	C:\Windows\Installer\e589c8e.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF80107D27799794B2.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{7D51133B-C855-49EF-ACF2-B701C09CBAFB}	msiexec.exe
File created	C:\Windows\SystemTemp\~DFFE3C754BDE5D56B4.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF9DCA9DAFBEE7CA56.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1368_797540852\manifest.json	msedge.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\windowsdesktop-runtime-8.0.29-win-x86.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-8.0.29-win-x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synapse Launcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synapse Launcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-8.0.29-win-x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-8.0.29-win-x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-8.0.29-win-x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SYNX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-8.0.29-win-x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-8.0.29-win-x86.exe

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2372	msedge.exe
1368	msedge.exe
3260	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 27 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307720268288650"	msedge.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "190"	LogonUI.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_8.0_x86\Dependents\{facc4ae9-22f7-4df6-a5c9-d989da27b947}	windowsdesktop-runtime-8.0.29-win-x86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\31FC1BDC064587D7DC59159E75B5F577	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AF3A819707E81DF4FA5C65999F9E7357\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CA92AD5AA7BB234489F85DD202C343B8\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{A5DA29AC-BB7A-4432-988F-D52D203C348B}v64.116.55299\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CA92AD5AA7BB234489F85DD202C343B8\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AF3A819707E81DF4FA5C65999F9E7357	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AF3A819707E81DF4FA5C65999F9E7357\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AF3A819707E81DF4FA5C65999F9E7357\SourceList\PackageName = "dotnet-host-8.0.29-win-x86.msi"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AF3A819707E81DF4FA5C65999F9E7357\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AF3A819707E81DF4FA5C65999F9E7357\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\374B29455B6FCE549ADA2C956245ACF2\SourceList\Media\1 = ";"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CA92AD5AA7BB234489F85DD202C343B8\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B33115D7558CFE94CA2F7B100CC9ABBF\MainFeature	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AF3A819707E81DF4FA5C65999F9E7357\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_64.116.55299_x86\Version = "64.116.55299"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\374B29455B6FCE549ADA2C956245ACF2	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{facc4ae9-22f7-4df6-a5c9-d989da27b947}\Dependents\{facc4ae9-22f7-4df6-a5c9-d989da27b947}	windowsdesktop-runtime-8.0.29-win-x86.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CA92AD5AA7BB234489F85DD202C343B8\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CA92AD5AA7BB234489F85DD202C343B8\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CA92AD5AA7BB234489F85DD202C343B8\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{A5DA29AC-BB7A-4432-988F-D52D203C348B}v64.116.55299\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\31FC1BDC064587D7DC59159E75B5F577\B33115D7558CFE94CA2F7B100CC9ABBF	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B33115D7558CFE94CA2F7B100CC9ABBF\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_64.116.55299_x86\Dependents	windowsdesktop-runtime-8.0.29-win-x86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2654269261-3199571979-4291878722-1000\{0433B63D-C795-48D1-B91E-ACD85D783FFF}	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\AF3A819707E81DF4FA5C65999F9E7357\MainFeature	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\374B29455B6FCE549ADA2C956245ACF2\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\374B29455B6FCE549ADA2C956245ACF2\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B33115D7558CFE94CA2F7B100CC9ABBF	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B33115D7558CFE94CA2F7B100CC9ABBF\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_8.0_x86\ = "{7918A3FA-8E70-4FD1-AFC5-5699F9E93775}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AF3A819707E81DF4FA5C65999F9E7357\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AF3A819707E81DF4FA5C65999F9E7357\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{7918A3FA-8E70-4FD1-AFC5-5699F9E93775}v64.116.55299\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_64.116.55314_x86\ = "{5492B473-F6B5-45EC-A9AD-C2592654CA2F}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\374B29455B6FCE549ADA2C956245ACF2\MainFeature	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B33115D7558CFE94CA2F7B100CC9ABBF\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CA92AD5AA7BB234489F85DD202C343B8	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CA92AD5AA7BB234489F85DD202C343B8\PackageCode = "A87E4C127FFBE0C42A89D080BEA86AD2"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B33115D7558CFE94CA2F7B100CC9ABBF\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_8.0_x86\Dependents	windowsdesktop-runtime-8.0.29-win-x86.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\374B29455B6FCE549ADA2C956245ACF2\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2654269261-3199571979-4291878722-1000\{E6DBB0AD-08E7-4761-A1CC-B04F51FD9B5E}	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B33115D7558CFE94CA2F7B100CC9ABBF\PackageCode = "AC0CFBF70DFA57249BC449AE33BCBA16"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B33115D7558CFE94CA2F7B100CC9ABBF\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\78C4F1961E353BB69FDDCF8BF5647D54	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_64.116.55299_x86	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_64.116.55314_x86\Version = "64.116.55314"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\374B29455B6FCE549ADA2C956245ACF2\SourceList\PackageName = "windowsdesktop-runtime-8.0.29-win-x86.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{facc4ae9-22f7-4df6-a5c9-d989da27b947}\DisplayName = "Microsoft Windows Desktop Runtime - 8.0.29 (x86)"	windowsdesktop-runtime-8.0.29-win-x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\CA92AD5AA7BB234489F85DD202C343B8\MainFeature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CA92AD5AA7BB234489F85DD202C343B8\ProductName = "Microsoft .NET Runtime - 8.0.29 (x86)"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CA92AD5AA7BB234489F85DD202C343B8\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\374B29455B6FCE549ADA2C956245ACF2\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_64.116.55314_x86\Dependents	windowsdesktop-runtime-8.0.29-win-x86.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\{facc4ae9-22f7-4df6-a5c9-d989da27b947}	windowsdesktop-runtime-8.0.29-win-x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_64.116.55299_x86\DisplayName = "Microsoft .NET Runtime - 8.0.29 (x86)"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\AF3A819707E81DF4FA5C65999F9E7357	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AF3A819707E81DF4FA5C65999F9E7357\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\374B29455B6FCE549ADA2C956245ACF2\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{facc4ae9-22f7-4df6-a5c9-d989da27b947}\Version = "8.0.29.36225"	windowsdesktop-runtime-8.0.29-win-x86.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CA92AD5AA7BB234489F85DD202C343B8\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B33115D7558CFE94CA2F7B100CC9ABBF\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B33115D7558CFE94CA2F7B100CC9ABBF\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\15E955187255612684DD295E2F5C1A4A\AF3A819707E81DF4FA5C65999F9E7357	msiexec.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\windowsdesktop-runtime-8.0.29-win-x86.exe:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4848	msiexec.exe
4848	msiexec.exe
4848	msiexec.exe
4848	msiexec.exe
4848	msiexec.exe
4848	msiexec.exe
4848	msiexec.exe
4848	msiexec.exe
3940	Synapse Launcher.exe
1264	SYNX.exe
1264	SYNX.exe
1264	SYNX.exe
1264	SYNX.exe
1264	SYNX.exe
1264	SYNX.exe
1264	SYNX.exe
1264	SYNX.exe
1264	SYNX.exe
1264	SYNX.exe
1264	SYNX.exe
1264	SYNX.exe
1264	SYNX.exe
1264	SYNX.exe
1264	SYNX.exe
1264	SYNX.exe
1264	SYNX.exe
1264	SYNX.exe
1264	SYNX.exe
196	msedge.exe
196	msedge.exe
1264	SYNX.exe
1264	SYNX.exe
1264	SYNX.exe
1264	SYNX.exe
1264	SYNX.exe
1264	SYNX.exe
1264	SYNX.exe
1264	SYNX.exe
1264	SYNX.exe
1264	SYNX.exe
1264	SYNX.exe
1264	SYNX.exe
1264	SYNX.exe
1264	SYNX.exe
1264	SYNX.exe
1264	SYNX.exe
1264	SYNX.exe
1264	SYNX.exe
1264	SYNX.exe
1264	SYNX.exe
1264	SYNX.exe
1264	SYNX.exe
1264	SYNX.exe
1264	SYNX.exe
1264	SYNX.exe
1264	SYNX.exe
1264	SYNX.exe
1264	SYNX.exe
1264	SYNX.exe
1264	SYNX.exe
1264	SYNX.exe
1264	SYNX.exe
1264	SYNX.exe
1264	SYNX.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
3268	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2392	windowsdesktop-runtime-8.0.29-win-x86.exe
Token: SeIncreaseQuotaPrivilege	2392	windowsdesktop-runtime-8.0.29-win-x86.exe
Token: SeSecurityPrivilege	4848	msiexec.exe
Token: SeCreateTokenPrivilege	2392	windowsdesktop-runtime-8.0.29-win-x86.exe
Token: SeAssignPrimaryTokenPrivilege	2392	windowsdesktop-runtime-8.0.29-win-x86.exe
Token: SeLockMemoryPrivilege	2392	windowsdesktop-runtime-8.0.29-win-x86.exe
Token: SeIncreaseQuotaPrivilege	2392	windowsdesktop-runtime-8.0.29-win-x86.exe
Token: SeMachineAccountPrivilege	2392	windowsdesktop-runtime-8.0.29-win-x86.exe
Token: SeTcbPrivilege	2392	windowsdesktop-runtime-8.0.29-win-x86.exe
Token: SeSecurityPrivilege	2392	windowsdesktop-runtime-8.0.29-win-x86.exe
Token: SeTakeOwnershipPrivilege	2392	windowsdesktop-runtime-8.0.29-win-x86.exe
Token: SeLoadDriverPrivilege	2392	windowsdesktop-runtime-8.0.29-win-x86.exe
Token: SeSystemProfilePrivilege	2392	windowsdesktop-runtime-8.0.29-win-x86.exe
Token: SeSystemtimePrivilege	2392	windowsdesktop-runtime-8.0.29-win-x86.exe
Token: SeProfSingleProcessPrivilege	2392	windowsdesktop-runtime-8.0.29-win-x86.exe
Token: SeIncBasePriorityPrivilege	2392	windowsdesktop-runtime-8.0.29-win-x86.exe
Token: SeCreatePagefilePrivilege	2392	windowsdesktop-runtime-8.0.29-win-x86.exe
Token: SeCreatePermanentPrivilege	2392	windowsdesktop-runtime-8.0.29-win-x86.exe
Token: SeBackupPrivilege	2392	windowsdesktop-runtime-8.0.29-win-x86.exe
Token: SeRestorePrivilege	2392	windowsdesktop-runtime-8.0.29-win-x86.exe
Token: SeShutdownPrivilege	2392	windowsdesktop-runtime-8.0.29-win-x86.exe
Token: SeDebugPrivilege	2392	windowsdesktop-runtime-8.0.29-win-x86.exe
Token: SeAuditPrivilege	2392	windowsdesktop-runtime-8.0.29-win-x86.exe
Token: SeSystemEnvironmentPrivilege	2392	windowsdesktop-runtime-8.0.29-win-x86.exe
Token: SeChangeNotifyPrivilege	2392	windowsdesktop-runtime-8.0.29-win-x86.exe
Token: SeRemoteShutdownPrivilege	2392	windowsdesktop-runtime-8.0.29-win-x86.exe
Token: SeUndockPrivilege	2392	windowsdesktop-runtime-8.0.29-win-x86.exe
Token: SeSyncAgentPrivilege	2392	windowsdesktop-runtime-8.0.29-win-x86.exe
Token: SeEnableDelegationPrivilege	2392	windowsdesktop-runtime-8.0.29-win-x86.exe
Token: SeManageVolumePrivilege	2392	windowsdesktop-runtime-8.0.29-win-x86.exe
Token: SeImpersonatePrivilege	2392	windowsdesktop-runtime-8.0.29-win-x86.exe
Token: SeCreateGlobalPrivilege	2392	windowsdesktop-runtime-8.0.29-win-x86.exe
Token: SeRestorePrivilege	4848	msiexec.exe
Token: SeTakeOwnershipPrivilege	4848	msiexec.exe
Token: SeRestorePrivilege	4848	msiexec.exe
Token: SeTakeOwnershipPrivilege	4848	msiexec.exe
Token: SeRestorePrivilege	4848	msiexec.exe
Token: SeTakeOwnershipPrivilege	4848	msiexec.exe
Token: SeRestorePrivilege	4848	msiexec.exe
Token: SeTakeOwnershipPrivilege	4848	msiexec.exe
Token: SeRestorePrivilege	4848	msiexec.exe
Token: SeTakeOwnershipPrivilege	4848	msiexec.exe
Token: SeRestorePrivilege	4848	msiexec.exe
Token: SeTakeOwnershipPrivilege	4848	msiexec.exe
Token: SeRestorePrivilege	4848	msiexec.exe
Token: SeTakeOwnershipPrivilege	4848	msiexec.exe
Token: SeRestorePrivilege	4848	msiexec.exe
Token: SeTakeOwnershipPrivilege	4848	msiexec.exe
Token: SeRestorePrivilege	4848	msiexec.exe
Token: SeTakeOwnershipPrivilege	4848	msiexec.exe
Token: SeRestorePrivilege	4848	msiexec.exe
Token: SeTakeOwnershipPrivilege	4848	msiexec.exe
Token: SeRestorePrivilege	4848	msiexec.exe
Token: SeTakeOwnershipPrivilege	4848	msiexec.exe
Token: SeRestorePrivilege	4848	msiexec.exe
Token: SeTakeOwnershipPrivilege	4848	msiexec.exe
Token: SeRestorePrivilege	4848	msiexec.exe
Token: SeTakeOwnershipPrivilege	4848	msiexec.exe
Token: SeRestorePrivilege	4848	msiexec.exe
Token: SeTakeOwnershipPrivilege	4848	msiexec.exe
Token: SeRestorePrivilege	4848	msiexec.exe
Token: SeTakeOwnershipPrivilege	4848	msiexec.exe
Token: SeRestorePrivilege	4848	msiexec.exe
Token: SeTakeOwnershipPrivilege	4848	msiexec.exe

Suspicious use of FindShellTrayWindow 14 IoCs

pid	Process
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
2880	windowsdesktop-runtime-8.0.29-win-x86.exe
1264	SYNX.exe
1264	SYNX.exe
1264	SYNX.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
1264	SYNX.exe
1264	SYNX.exe
1264	SYNX.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4292	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2576 wrote to memory of 2372	2576	Synapse Launcher.exe	81
PID 2372 wrote to memory of 1368	2372	msedge.exe	82
PID 1368 wrote to memory of 1112	1368	msedge.exe	83
PID 1368 wrote to memory of 3260	1368	msedge.exe	84
PID 1368 wrote to memory of 2120	1368	msedge.exe	85
PID 1368 wrote to memory of 2120	1368	msedge.exe	85
PID 1368 wrote to memory of 2120	1368	msedge.exe	85
PID 1368 wrote to memory of 1924	1368	msedge.exe	86
PID 1368 wrote to memory of 1924	1368	msedge.exe	86
PID 1368 wrote to memory of 4936	1368	msedge.exe	87
PID 1368 wrote to memory of 4936	1368	msedge.exe	87
PID 1368 wrote to memory of 1108	1368	msedge.exe	88
PID 1368 wrote to memory of 4936	1368	msedge.exe	87
PID 1368 wrote to memory of 1108	1368	msedge.exe	88
PID 1368 wrote to memory of 1108	1368	msedge.exe	88
PID 1368 wrote to memory of 2476	1368	msedge.exe	91
PID 1368 wrote to memory of 2476	1368	msedge.exe	91
PID 1368 wrote to memory of 2476	1368	msedge.exe	91
PID 1368 wrote to memory of 4296	1368	msedge.exe	92
PID 1368 wrote to memory of 1100	1368	msedge.exe	93
PID 1368 wrote to memory of 4676	1368	msedge.exe	94
PID 1368 wrote to memory of 4296	1368	msedge.exe	92
PID 1368 wrote to memory of 4296	1368	msedge.exe	92
PID 1368 wrote to memory of 1100	1368	msedge.exe	93
PID 1368 wrote to memory of 1100	1368	msedge.exe	93
PID 1368 wrote to memory of 4676	1368	msedge.exe	94
PID 1368 wrote to memory of 4676	1368	msedge.exe	94
PID 1368 wrote to memory of 4708	1368	msedge.exe	95
PID 1368 wrote to memory of 4708	1368	msedge.exe	95
PID 1368 wrote to memory of 4120	1368	msedge.exe	96
PID 1368 wrote to memory of 4120	1368	msedge.exe	96
PID 1368 wrote to memory of 5004	1368	msedge.exe	98
PID 1368 wrote to memory of 5004	1368	msedge.exe	98
PID 1368 wrote to memory of 5004	1368	msedge.exe	98
PID 1368 wrote to memory of 5116	1368	msedge.exe	99
PID 1368 wrote to memory of 3904	1368	msedge.exe	100
PID 1368 wrote to memory of 5116	1368	msedge.exe	99
PID 1368 wrote to memory of 3904	1368	msedge.exe	100
PID 1368 wrote to memory of 3992	1368	msedge.exe	102
PID 1368 wrote to memory of 3252	1368	msedge.exe	103
PID 3252 wrote to memory of 3716	3252	msedge.exe	104
PID 1368 wrote to memory of 3652	1368	msedge.exe	105
PID 1368 wrote to memory of 3652	1368	msedge.exe	105
PID 1368 wrote to memory of 3456	1368	msedge.exe	106
PID 1368 wrote to memory of 3456	1368	msedge.exe	106
PID 1368 wrote to memory of 2716	1368	msedge.exe	107
PID 1368 wrote to memory of 2716	1368	msedge.exe	107
PID 1368 wrote to memory of 4792	1368	msedge.exe	108
PID 1368 wrote to memory of 4792	1368	msedge.exe	108
PID 1368 wrote to memory of 3708	1368	msedge.exe	109
PID 1368 wrote to memory of 3708	1368	msedge.exe	109
PID 1368 wrote to memory of 3192	1368	msedge.exe	110
PID 1368 wrote to memory of 3192	1368	msedge.exe	110
PID 1368 wrote to memory of 5068	1368	msedge.exe	111
PID 1368 wrote to memory of 5068	1368	msedge.exe	111
PID 1368 wrote to memory of 5068	1368	msedge.exe	111
PID 1368 wrote to memory of 4832	1368	msedge.exe	112
PID 1368 wrote to memory of 4012	1368	msedge.exe	113
PID 1368 wrote to memory of 4012	1368	msedge.exe	113
PID 1368 wrote to memory of 4012	1368	msedge.exe	113
PID 1368 wrote to memory of 700	1368	msedge.exe	114
PID 1368 wrote to memory of 700	1368	msedge.exe	114
PID 1368 wrote to memory of 932	1368	msedge.exe	115
PID 932 wrote to memory of 2880	932	windowsdesktop-runtime-8.0.29-win-x86.exe	116

C:\Users\Admin\AppData\Local\Temp\Synapse Launcher.exe
"C:\Users\Admin\AppData\Local\Temp\Synapse Launcher.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?missing_runtime=true&arch=x86&rid=win-x86&os=win10&apphost_version=8.0.11&gui=true
  2⤵
  - System Time Discovery
  - Suspicious use of WriteProcessMemory
  PID:2372
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://aka.ms/dotnet-core-applaunch?missing_runtime=true&arch=x86&rid=win-x86&os=win10&apphost_version=8.0.11&gui=true
    3⤵
    - Drops file in Windows directory
    - System Time Discovery
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2a4,0x7ffd361ec188,0x7ffd361ec194,0x7ffd361ec1a0
      4⤵
      PID:1112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1820,i,7902521393922517535,17479805070161080895,524288 --field-trial-handle=2268,i,9038118514981604386,5803994271851622824,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:11
      4⤵
      Downloads MZ/PE file
      System Time Discovery
      PID:3260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1600,i,998997365040789779,7610404506812612229,262144 --field-trial-handle=2268,i,9038118514981604386,5803994271851622824,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:2
      4⤵
      PID:2120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2536,i,1008209214397799412,14553921478032827189,524288 --field-trial-handle=2268,i,9038118514981604386,5803994271851622824,262144 --variations-seed-version --mojo-platform-channel-handle=2548 /prefetch:13
      4⤵
      PID:1924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,7869686962498274358,9535944052440899802,2097152 --field-trial-handle=2268,i,9038118514981604386,5803994271851622824,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
      4⤵
      PID:4936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,15474848988773787542,14279822917884876991,2097152 --field-trial-handle=2268,i,9038118514981604386,5803994271851622824,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
      4⤵
      PID:1108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4248,i,4222126254899686706,5565342612173688734,2097152 --field-trial-handle=2268,i,9038118514981604386,5803994271851622824,262144 --variations-seed-version --mojo-platform-channel-handle=2560 /prefetch:1
      4⤵
      PID:2476
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4300,i,4780506650858798998,10783735637502497220,2097152 --field-trial-handle=2268,i,9038118514981604386,5803994271851622824,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:9
      4⤵
      PID:4296
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4324,i,12864113414569140790,12790727851090637287,2097152 --field-trial-handle=2268,i,9038118514981604386,5803994271851622824,262144 --variations-seed-version --mojo-platform-channel-handle=4456 /prefetch:1
      4⤵
      PID:1100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4352,i,8805391739967543419,12680579859798028545,2097152 --field-trial-handle=2268,i,9038118514981604386,5803994271851622824,262144 --variations-seed-version --mojo-platform-channel-handle=3416 /prefetch:9
      4⤵
      PID:4676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3496,i,10745900029344097076,8697982388700424813,524288 --field-trial-handle=2268,i,9038118514981604386,5803994271851622824,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:14
      4⤵
      PID:4708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5412,i,980998462915725522,1044768713359162304,524288 --field-trial-handle=2268,i,9038118514981604386,5803994271851622824,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:14
      4⤵
      PID:4120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5432,i,14525949594064411972,10689791227719609406,2097152 --field-trial-handle=2268,i,9038118514981604386,5803994271851622824,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:1
      4⤵
      PID:5004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3604,i,18033825841830249814,5298572370459626002,524288 --field-trial-handle=2268,i,9038118514981604386,5803994271851622824,262144 --variations-seed-version --mojo-platform-channel-handle=3752 /prefetch:14
      4⤵
      PID:5116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5160,i,3750815328116972123,7434356621762441698,524288 --field-trial-handle=2268,i,9038118514981604386,5803994271851622824,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:14
      4⤵
      PID:3904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,17211620967332781934,15191991701154178754,524288 --field-trial-handle=2268,i,9038118514981604386,5803994271851622824,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:14
      4⤵
      PID:4188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,17211620967332781934,15191991701154178754,524288 --field-trial-handle=2268,i,9038118514981604386,5803994271851622824,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:14
      4⤵
      PID:3992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6292,i,6031517937142112621,3299066216157152286,524288 --field-trial-handle=2268,i,9038118514981604386,5803994271851622824,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:14
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3252
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1140
        5⤵
        
        PID:3716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6432,i,7192587722568876108,7605458562767546657,524288 --field-trial-handle=2268,i,9038118514981604386,5803994271851622824,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:14
      4⤵
      PID:3652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6440,i,10526608467075230061,6761075389846256419,524288 --field-trial-handle=2268,i,9038118514981604386,5803994271851622824,262144 --variations-seed-version --mojo-platform-channel-handle=6564 /prefetch:14
      4⤵
      PID:3456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6724,i,7435719816365374332,4124590565893636139,524288 --field-trial-handle=2268,i,9038118514981604386,5803994271851622824,262144 --variations-seed-version --mojo-platform-channel-handle=6728 /prefetch:14
      4⤵
      PID:2716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6896,i,12566852144137993972,17892827277658136052,524288 --field-trial-handle=2268,i,9038118514981604386,5803994271851622824,262144 --variations-seed-version --mojo-platform-channel-handle=6848 /prefetch:14
      4⤵
      PID:4792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6612,i,8823512828357670845,13828808211093838896,524288 --field-trial-handle=2268,i,9038118514981604386,5803994271851622824,262144 --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:14
      4⤵
      PID:3708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6736,i,15354264849017141374,16242244768556364410,524288 --field-trial-handle=2268,i,9038118514981604386,5803994271851622824,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:14
      4⤵
      PID:3192
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=6632,i,14085159332833968560,17510909434717351545,2097152 --field-trial-handle=2268,i,9038118514981604386,5803994271851622824,262144 --variations-seed-version --mojo-platform-channel-handle=6920 /prefetch:1
      4⤵
      PID:5068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6480,i,11183986857361642664,14202146098042102439,524288 --field-trial-handle=2268,i,9038118514981604386,5803994271851622824,262144 --variations-seed-version --mojo-platform-channel-handle=6708 /prefetch:14
      4⤵
      Subvert Trust Controls: Mark-of-the-Web Bypass
      NTFS ADS
      PID:4832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=5204,i,2483903615939335737,6545057193424182674,2097152 --field-trial-handle=2268,i,9038118514981604386,5803994271851622824,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:1
      4⤵
      PID:4012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7224,i,12054872087553262711,2593618726271802892,524288 --field-trial-handle=2268,i,9038118514981604386,5803994271851622824,262144 --variations-seed-version --mojo-platform-channel-handle=6544 /prefetch:14
      4⤵
      PID:700
  - - C:\Users\Admin\Downloads\windowsdesktop-runtime-8.0.29-win-x86.exe
      "C:\Users\Admin\Downloads\windowsdesktop-runtime-8.0.29-win-x86.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:932
    - - C:\Windows\Temp\{ED0AF511-0BE8-490F-B1EA-34C066C7260C}\.cr\windowsdesktop-runtime-8.0.29-win-x86.exe
        
        "C:\Windows\Temp\{ED0AF511-0BE8-490F-B1EA-34C066C7260C}\.cr\windowsdesktop-runtime-8.0.29-win-x86.exe" -burn.clean.room="C:\Users\Admin\Downloads\windowsdesktop-runtime-8.0.29-win-x86.exe" -burn.filehandle.attached=724 -burn.filehandle.self=728
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        
        PID:2880
      - C:\Windows\Temp\{451931B2-4237-4887-9E07-0A4A0FAF4607}\.be\windowsdesktop-runtime-8.0.29-win-x86.exe
        
        "C:\Windows\Temp\{451931B2-4237-4887-9E07-0A4A0FAF4607}\.be\windowsdesktop-runtime-8.0.29-win-x86.exe" -q -burn.elevated BurnPipe.{9AA1CD52-3634-485F-BF65-DAE267A2F21E} {60FAD067-8C1E-46D3-A972-CBBB49689A91} 2880
        6⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:2392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6624,i,9366047965700102588,1591711398126408586,524288 --field-trial-handle=2268,i,9038118514981604386,5803994271851622824,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:14
      4⤵
      PID:1588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6912,i,16094700716970080249,14070208982521896752,524288 --field-trial-handle=2268,i,9038118514981604386,5803994271851622824,262144 --variations-seed-version --mojo-platform-channel-handle=7204 /prefetch:14
      4⤵
      PID:4248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6408,i,1137061343396086530,12670923630867677491,524288 --field-trial-handle=2268,i,9038118514981604386,5803994271851622824,262144 --variations-seed-version --mojo-platform-channel-handle=7080 /prefetch:14
      4⤵
      PID:4348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6944,i,2718655862799918195,5072813187060827152,524288 --field-trial-handle=2268,i,9038118514981604386,5803994271851622824,262144 --variations-seed-version --mojo-platform-channel-handle=3736 /prefetch:14
      4⤵
      PID:4100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6232,i,9088748719787093123,18036446280535723602,524288 --field-trial-handle=2268,i,9038118514981604386,5803994271851622824,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:14
      4⤵
      PID:1236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=6912,i,7006993866788004462,16960050664550327211,2097152 --field-trial-handle=2268,i,9038118514981604386,5803994271851622824,262144 --variations-seed-version --mojo-platform-channel-handle=7316 /prefetch:1
      4⤵
      PID:5528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=6276,i,14867140187433263446,1303199553546124425,2097152 --field-trial-handle=2268,i,9038118514981604386,5803994271851622824,262144 --variations-seed-version --mojo-platform-channel-handle=6952 /prefetch:1
      4⤵
      PID:5640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6932,i,5540545266770680804,8203084644623526399,524288 --field-trial-handle=2268,i,9038118514981604386,5803994271851622824,262144 --variations-seed-version --mojo-platform-channel-handle=7608 /prefetch:14
      4⤵
      Modifies registry class
      PID:6096
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7080,i,17778000535718957290,9047336626049564816,524288 --field-trial-handle=2268,i,9038118514981604386,5803994271851622824,262144 --variations-seed-version --mojo-platform-channel-handle=7700 /prefetch:12
      4⤵
      PID:6104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5500,i,2859512081520690667,5790636550846975237,524288 --field-trial-handle=2268,i,9038118514981604386,5803994271851622824,262144 --variations-seed-version --mojo-platform-channel-handle=7980 /prefetch:14
      4⤵
      PID:5268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6480,i,15259974686594381815,670169488643820178,524288 --field-trial-handle=2268,i,9038118514981604386,5803994271851622824,262144 --variations-seed-version --mojo-platform-channel-handle=7152 /prefetch:14
      4⤵
      PID:5768
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6216,i,8760908832514100428,474932103329306334,262144 --field-trial-handle=2268,i,9038118514981604386,5803994271851622824,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6364,i,786924069873395150,8211070808034422982,524288 --field-trial-handle=2268,i,9038118514981604386,5803994271851622824,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:14
      4⤵
      PID:2620

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:352

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4848
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding F574E90A7B7CE91D850862FC2EDD6489
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1588
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 3F2E92F407FBE67C76766CDF49777CC1
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1736
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding D3D00F570827BF5C80169DE16EF597F1
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4320
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding DB0BDF32728DFD9249C3413E5C2F9217
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2236

C:\ProgramData\Package Cache\{facc4ae9-22f7-4df6-a5c9-d989da27b947}\windowsdesktop-runtime-8.0.29-win-x86.exe
"C:\ProgramData\Package Cache\{facc4ae9-22f7-4df6-a5c9-d989da27b947}\windowsdesktop-runtime-8.0.29-win-x86.exe" /burn.runonce
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3152
- C:\ProgramData\Package Cache\{facc4ae9-22f7-4df6-a5c9-d989da27b947}\windowsdesktop-runtime-8.0.29-win-x86.exe
  "C:\ProgramData\Package Cache\{facc4ae9-22f7-4df6-a5c9-d989da27b947}\windowsdesktop-runtime-8.0.29-win-x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.29_(x86)_20260809190040.log"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4808
- - C:\ProgramData\Package Cache\{facc4ae9-22f7-4df6-a5c9-d989da27b947}\windowsdesktop-runtime-8.0.29-win-x86.exe
    "C:\ProgramData\Package Cache\{facc4ae9-22f7-4df6-a5c9-d989da27b947}\windowsdesktop-runtime-8.0.29-win-x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{facc4ae9-22f7-4df6-a5c9-d989da27b947}\windowsdesktop-runtime-8.0.29-win-x86.exe" -burn.filehandle.attached=548 -burn.filehandle.self=564 /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.29_(x86)_20260809190040.log"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:3460

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4716

C:\Users\Admin\AppData\Local\Temp\Synapse Launcher.exe
"C:\Users\Admin\AppData\Local\Temp\Synapse Launcher.exe"
1⤵
- Loads dropped DLL
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/r5SyNyCYjb
  2⤵
  PID:5480
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://discord.gg/r5SyNyCYjb
    3⤵
    PID:5500
- C:\Users\Admin\AppData\Local\Temp\Bin\Decompiler.exe
  "Bin\Decompiler.exe"
  2⤵
  - Executes dropped EXE
  PID:3380
- C:\Users\Admin\AppData\Local\Temp\bin\SYNX.exe
  "C:\Users\Admin\AppData\Local\Temp\bin\SYNX.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1264
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name="Synapse Launcher.exe" --webview-exe-version=1.1.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Synapse Launcher.exe.WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --mojo-named-platform-channel-pipe=3940.5676.2559314485684318877
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  PID:3268
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Temp\Synapse Launcher.exe.WebView2\EBWebView" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Temp\Synapse Launcher.exe.WebView2\EBWebView\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x168,0x16c,0x170,0x144,0x178,0x7ffd2558b078,0x7ffd2558b084,0x7ffd2558b090
    3⤵
    PID:1688
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Synapse Launcher.exe.WebView2\EBWebView" --webview-exe-name="Synapse Launcher.exe" --webview-exe-version=1.1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1676,i,11139100411056986190,12331419355880858113,262144 --variations-seed-version --mojo-platform-channel-handle=1672 /prefetch:2
    3⤵
    PID:5304
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Synapse Launcher.exe.WebView2\EBWebView" --webview-exe-name="Synapse Launcher.exe" --webview-exe-version=1.1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=1988,i,11139100411056986190,12331419355880858113,262144 --variations-seed-version --mojo-platform-channel-handle=1996 /prefetch:11
    3⤵
    PID:5848
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Synapse Launcher.exe.WebView2\EBWebView" --webview-exe-name="Synapse Launcher.exe" --webview-exe-version=1.1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=2200,i,11139100411056986190,12331419355880858113,262144 --variations-seed-version --mojo-platform-channel-handle=2208 /prefetch:13
    3⤵
    PID:5188
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Synapse Launcher.exe.WebView2\EBWebView" --webview-exe-name="Synapse Launcher.exe" --webview-exe-version=1.1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3352,i,11139100411056986190,12331419355880858113,262144 --variations-seed-version --mojo-platform-channel-handle=3372 /prefetch:1
    3⤵
    PID:240

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa39d8855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4292

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:468

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e589c8c.rbs

Path C:\Config.Msi\e589c8c.rbs
Size 49KB
SHA256 a72eccec77523ce4e49bf2888a1cbf379aa4cc4efc94e7dc6244a5779ed79d69
MD5 0b5a2ea81549fa12cd0265dd67a739f3
SHA1 baaf5e195e474cbdfe3238a739edcd3642b91068
SHA512 051bd9bf376ff476a2b464e97270fde76ca9699d8802689c87af2b690639a875ba4e4d89c8cf6ddf4bb5ab8336181e04c0fdb6a5a78206eccca40655cd19ff5f
SSDEEP 768:A+YUBVf/TyQzPu0Fo2rvLvhjaXp2r0MsOPf6t9A4E1syNETwCJr46g2raJ4G3QXg:J5w9Bzr5XQNb
TLSH
T1FD3356129F40D2C7E3213E333BE4DD54335BCEAD77849A8921D9596281D35A87AEC1F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e589c91.rbs

Path C:\Config.Msi\e589c91.rbs
Size 8KB
SHA256 1019a4d1258ae1d6608ad335ee163b8228420d4c1abaca66673257fe718fab12
MD5 a643fa40c905b83b2e8fe76420912bb7
SHA1 27c7fb594ac28aac4ee7c2615e8d1afa5483ff17
SHA512 523074aa2b5fb563e98c70c09961e5af6ec499f275a569a3de0a06773003f07ffe1cd02eb16ee3aeb5cdbb839255dd21965513d13f2b49d29301170190293890
SSDEEP 96:SxoSEfE3cwjCd1PpqFfUweD2GNCsThqXUweD2GNC6jg8gYjThqIH1jYME5d7K/5p:Se5ECd1xmMxQIHxQeDEDigh0NPqpc
TLSH
T129126405B204DAE3F8571B70CF0B1B213BB6D2FAC224530F189D91665F5379D6EA129B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e589c96.rbs

Path C:\Config.Msi\e589c96.rbs
Size 9KB
SHA256 d65775d2adbee9b8d9f21b88f34ffae851826f76b82d04d9197337e49a930494
MD5 181d4988d0e2fe98f0b566f8f670cfd6
SHA1 ef2955db311ec69bb09bea1569dbf810210b2cdb
SHA512 f0f8f8a6571b8fa0fd21326fde01304f8830ea8b42e4f832b1b1def33b46fc28dd80bc09542a8bce3457ece6d62f65ac5cf105ebbcc1f9cd84dcc6d61e844a70
SSDEEP 96:S43rwa1mk/TRdCdisCBufU8eD2YNCsThq0U8eD2YNC6jlb1MjThqBH5j8E5W7BwV:SkMwfCdiL4MDQIIDQ/rECBQf9qpI
TLSH
T1B6121242FA00C1E2E5931B35C70727553BE3DBEA6719934F048ED2644E93B8CAB7819A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e589c9b.rbs

Path C:\Config.Msi\e589c9b.rbs
Size 91KB
SHA256 559b33bb193e5221893d2dc8a1f00342944638a2c257989a18a663da81a7c86c
MD5 9a8c43f3878605e23a734c9e5bac3fe4
SHA1 cb4436ec662b8d4b3ec7ace461100d206bdfda9e
SHA512 cb1bc161c2e78df9ed9ad8845c3d47af5ebcd0c6ed4f13dd490ef8d69ad05cbaa02bc8a99b0b2037e37bd0a9681f8366db52fe04a463445f2bc9bc0677e8a369
SSDEEP 768:5Ajh/PNT5eTMnQyK9Kv4GC42PpqK2MK+pHk+y24ztiELK:4pFT5Ge1K9Kv4GC42xqK2MK+pHk+ydxu
TLSH
T1DE93CE5A6700D3C196327E576FBFEE08AE124CAF7781C96A08C61537D8E1985EBFC481
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE.txt

Path C:\Program Files (x86)\dotnet\LICENSE.txt
Size 9KB
SHA256 7f6839a61ce892b79c6549e2dc5a81fdbd240a0b260f8881216b45b7fda8b45d
MD5 31c5a77b3c57c8c2e82b9541b00bcd5a
SHA1 153d4bc14e3a2c1485006f1752e797ca8684d06d
SHA512 ad33e3c0c3b060ad44c5b1b712c991b2d7042f6a60dc691c014d977c922a7e3a783ba9bade1a34de853c271fde1fb75bc2c47869acd863a40be3a6c6d754c0a6
SSDEEP 192:ydP0KvBLCqikR/EgGJLrlwD+eilNi5Py1SDeoDXDw9lF5OMz6Q:PWBuqikR/EDJLriwlNi5KI1Tw9lF5OjQ
TLSH
T1EC12B57D7284177109D207E16A0AB9D6F62A953C3117AA2438FDC15923AAF2CC37F3E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ThirdPartyNotices.txt

Path C:\Program Files (x86)\dotnet\ThirdPartyNotices.txt
Size 93KB
SHA256 1271701f435f7fe4aa81dc7e273ca80b6391b73580ee20b35a956052c95de4cf
MD5 90630d9ee3e0a5672166a45e00f79a5f
SHA1 d1148f8c7558e9b8a81bf1f50f9e3bed89d9928c
SHA512 29e10bd57d1c580ece70b9b7c4a69dc036a5a64012eb89ba360a71be6b808150610ea0737351277a3d4235c02323fabef29f092fa6b2a40f0289f55a7973e93d
SSDEEP 1536:HA9jHwLvGfgg39/zwgAVkguQhrDjugtSEGepkWvrpX7anuqdLSVnfiStPq+3LefF:HA97wyogz1AVxuMjHtSFULryLOgrGWwc
TLSH
T1DC93B55F7E45077319E2C7916969A8C5F22FA02E3F6B2A44346EE248133B42DC6FF458
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hostfxr.dll

Path C:\Program Files (x86)\dotnet\host\fxr\8.0.29\hostfxr.dll
Size 293KB
SHA256 01fdf7969e0e97254b8710050c24b989a2bd7c5db0affd3b6d64b593d00f2aa9
MD5 12ab029c44aa9226e53c4b8cd5a7796a
SHA1 e1143ef63f1d77680fd1b4f0c8673fd631455238
SHA512 f0760b5bfb7b69ee3d233ebb972a8ed7ed756463f7f5d226e999edf02af60016b5f1edfa42d0fa8324820920cf482d5eae1cb7ae7a731717e67ac3ad1970136f
SSDEEP 6144:BTXUYsYXiRmScjuxm15ZX1eI0SSZoEHl1oil3R1ETqukN7sGiD/:BjUSXiRmScjuE1BeiCpHwObETqZ8z
TLSH
T108544B11B69AC135F6FB1BB0A9389F95957EBD609FB1D0CB63C04D5D08322C2AA31B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.NETCore.App.deps.json

Path C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\8.0.29\Microsoft.NETCore.App.deps.json
Size 28KB
SHA256 0bed61d3685c3997858375f13899d1a8913ffed0ffe7c9fdf0f5c75403d677a0
MD5 bf47e82c924f3eca2e2ecefc36c859ac
SHA1 b3eeafcf6d2b6923e69602820c71761367a8c067
SHA512 691af8adfabc97a8543d77dfc9f7a0dc85a219bafc0c55b45057b9667490da45635e1572cafd6add3dd0ca56ef6a11629f327d331f050d6fb3a4ebb541eb02ee
SSDEEP 192:MbrdijH5pb5rCa7q0ya4nHELFWcU0xdf5PtwRVTh:MbrdijH5pb5rCa7q0ya4nHELFvVxdf50
TLSH
T125D29275C9508EE70835BB9E1C799946F2B203AF20C60C4EB0BC642D9F7B9BA4555B3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.NETCore.App.runtimeconfig.json

Path C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\8.0.29\Microsoft.NETCore.App.runtimeconfig.json
Size 53B
SHA256 ac377253f9f7cf9d6127d684369de36da123d992cdc2e17950e3c8bf9688df76
MD5 0828cc814843c0960554265cda859ef5
SHA1 0140385a9e76436a7f3fed45136462f3393b5cba
SHA512 22cbb29225f35cea4329a08be760420cab6ab7ea85628436b7518759e09acee8f382d79c800e5c8f6ba647ca98b32a35a3a52cc1cb5b9cbd2e3b20fa314d839a
TLSH
T1C09002204C544F4726FA175A9A3145C1AD35C71300541465B755805856131035506F84
MD5 SHA1 SHA512 TLSH

Submit Download

hostpolicy.dll

Path C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\8.0.29\hostpolicy.dll
Size 329KB
SHA256 c6fbdb29df13f13a372c6a9ec6f09d702467273c155f28962252dc51cf743a6a
MD5 d7d64aefd20284526f7ff6992986418b
SHA1 f42b00015f77c8e8e32ee0968170a6ec5970524b
SHA512 f35cdf1a96f16424100fd9939676e407c39068aaa48ce0c72f60becc1ebf9ab2f59faed8c114f6ab49b5c2f4129d8cd59778b0719ab488d67ae00112638bc784
SSDEEP 6144:hmz5bzYaccfM/3ycblOZ7LCliRCmIIodNay9uj2dWBgSXc2wxBLSci:09QaccU/3ycblOpOFdQ8ujrBhX7wvLSp
TLSH
T184746C20B69BC135E5EE1AB0A9389F96957EBD754FF5D0CB63C0985E08225C26B30F13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.WindowsDesktop.App.runtimeconfig.json

Path C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.29\Microsoft.WindowsDesktop.App.runtimeconfig.json
Size 183B
SHA256 bfae374f3b8e2b5d4df278e4cac7a16d5f2f8fc458ea92dad223440d1f0c5b9d
MD5 d7614f3d3ebe06668b61305214d974d8
SHA1 ab7104c9744c95ee9ab5096bd3739adedbff02e2
SHA512 eca9351e65bfbc0bebdcc5a691ffdecde3486d8e9e2bcfc19653346ab2ee8a4a29034582bdc94f51d82aba1dbba4bca7a575812342ae687dc50c8888cc7bba94
TLSH
T18AC08C37DE008E3321F12B6DD4314682FE36839F101008A6727E495C0F72E7A9044F84
MD5 SHA1 SHA512 TLSH

Submit Download

state.rsm

Path C:\ProgramData\Package Cache\{facc4ae9-22f7-4df6-a5c9-d989da27b947}\state.rsm
Size 932B
SHA256 5fbb4dca04e79a98b15a50035649e4ca4ee02d3bcf09beb735041b4bdebc85cd
MD5 2a24600ac9362009cb8e77b401cfe7f2
SHA1 bd8bc2c4f6b600b760fc748620d8e6ce94bc05c4
SHA512 46e2bbc57203f92dc209119bfb3d0933c2bd5dc16fa56cf6ad946ac89829ef031b5e20208027a868811dff6fa06d8d42243720c0d0722743ae6633e09f42caa1
TLSH
T1A41167505FFA0129E3F7AB34AAF52721643AB8064E22C16C0041318A8F32BA1C874B73
MD5 SHA1 SHA512 TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 70ec916fbc4bdc762d303a32b425b3e0261fdf5d4861f31961987ba096c316ad
MD5 996e8e432c1af85dbbc9617643df9f45
SHA1 d0195d75db411ad1a86b9c76c84c53d5dbfa292c
SHA512 e3b70f66cf03c6c9999788962930b9cabd2ecfa0b384ab514e85ba204c430600ab36e315c9acc46dffdc31af52289db2f445b572d3c1a4cf9868b5e4604b5b6b
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7m:fwUQC5VwBIiElEd2K57P7m
TLSH
T1B8B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\protocols.json
Size 3KB
SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
MD5 5e2067a92dcfcb05537479c384a89725
SHA1 eeed29b07d865ac4d46629fddadad629d0ad4e2b
SHA512 c96c5f9cb7a169ad91b070b567cf9fa8f35951ccc5aa930e97dbeccbeac27f7e9dde1379138c9ba6b0d10339f9cb053ef21f19f06d7560f97d5d23a27c8ed4f6
TLSH
T17D7184B7862088194E360AB4AA0DF10DF93702DF2AF598D3B27D455F1F712BB3946249
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b825960e093c505ed8b2d25208a6a3ef4eb588fd7e3f0a739f6681adec4241fe
MD5 f001f4c7632aabbc8547c40a2a9665a2
SHA1 d3257e13c3132d0536b33ef02f337f9476b1c310
SHA512 c9c2806c7593f3b769405c2676589dac1a14d13f8c6d2e67e0b14995b01f4e41d04a60b8f556d218c2168180bcb2316746a622635dc3053b54c55fbde5cf4f2d
TLSH
T185D092217B5DB082EB0A0A3188639B342A6EC94A389BC21A7122400DAD66808E3C944B
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 22365024d48727271cea3f4a0227522b6f03c49f56b43e6c84b7ff09091fecdf
MD5 06f667ba3e99a1653d7a18267b654b23
SHA1 215c6ee19110026e8893c47477f4e12711e7c9de
SHA512 f5c1db56da435db9aed5ca1b2fd0fc395cc06bfca2c0a716350e1dd59d05dfac9f6e0cc97ea6d28624b96006d4eaacb12207f25701f287601683ff070a2f9da9
TLSH
T105D092213B9DB082EB0A0A3188639B342A6EC94A389BC21B7122400D9D67848E3C944B
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 91ff6d48c6a5511dbce885be2aca9ae34b3b061944c63f2c51ca9f1c1fac61ce
MD5 8d14d25e46e18503c4a330ded3e6ff93
SHA1 344f5164a4eba4e0c3fda993f106bb058515164a
SHA512 b626a47204ee0dfd5ca63b71d3745766bc54f6a51256d846a2c633656c7ae2bc4e5cc9fecaa9ad738b9ed26b6f5e7492740862e8db8aab0b7d2ff29c20984c15
TLSH
T16471A55405D1046FD7509BF34CF11E0238728EA58963FE0AA1D1BFFBA92A328C759F24
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 8KB
SHA256 4bb6a0118c196a84e5c921a532a6e08e62e26aa96484158aac27a23dc94e396c
MD5 6b0018b63eb35805b7502b8367c6b8e7
SHA1 ae26e4a397779ceb4e3fb26a89df6f25fa93c13b
SHA512 995a5b2dd765129d7620169ad854e447057256e693777e61d5a64484a626a4f4492e540dfea309a6cf35b50b94a46ad4c05bfdfee10888124a351eb33bee9340
SSDEEP 96:oTz1ViIgny+E+rTSWOdz0VD1HCLSs6LUyr5jXfQLDNdmN9AH/XlioTYTpkFuN:Ez1VEn5E+rgZ0VpH/B50LDHmEfXlD3M
TLSH
T1E20272A107DA015FFB9296B30CF22E3574B1CAE24B836E0757816EB29D3736CC654E18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58d30a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58d30a.TMP
Size 3KB
SHA256 0edc712d770b3f60a06c0a10eaf088a254cda3edb138e9ecd8e636fef5246822
MD5 dd949be0c791e84a1c3cf957f731fbb9
SHA1 b64467c4a31fb46f3f8ccb41661ba834b6637c8c
SHA512 4995ebca95f35766255fe5f1280e8244b5d2e0d631a27c95bdc69efba46c1a559549f062b1c79ab7de8a09b4d099c23bedb15df78ed3d85f7d7871c78c7e8f3f
TLSH
T1FA71F75405E1045FD3609BF28DF01E0638B28F518AA3FE4A60D1BFFBA61A320D719F28
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 a6640c123306a21d5a5d8113b9321ef7e4ccb3213ac17ec4052bea2e7827179a
MD5 4171784298b8c1360f85ed68cb0b9207
SHA1 19132e278dc30aebf178c86a679505743ce60c2f
SHA512 b9b6de9b887ada4b7a3fe8131c3a598447ca42423d1b75927732b1d1c24ade3132f52a03bdec29faa6a514af838322e93fddfa93818658da64e03b051cb3a60c
TLSH
T170519AF787E4856E8A0196F09A18AE2FDE2D0615431C7C6989D4EE27D3E34B2E10265F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 9e034e944d422ee47b36ee254bfb4af0e64572b724c84d14bc3ddc7e8565e0aa
MD5 12f8355b75ceb8041b6fb44755df9077
SHA1 87e2aff13e3deccaf35517f27230b362df787f13
SHA512 5835ef806b1776a3882f2d2c4d4515ef699b1b423dcfdc3afbf006f7696a4fb93f93fa1f2219145110feaadbb12a55265f6750b448a3ff199b82efb41bdd9ce0
SSDEEP 192:sxZ0ROyM/jK1Ml8Mg//fvsk2ftPIJIdpf9/W6+WNrSK/A00uBHh+PvMKIg4J:sxZ0E4//fvskIpIC1/bP/YuLKc
TLSH
T1DC52FA05AA34A977CCCBD219FA55BB53D6F50563D2800E44AAFCDA1C04E7BED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 92540acc7ef1a1a9eb15cfc07b9d668b60f3bc4732af0afb0d4171bf8ffedb34
MD5 3289ecd8300c4a3cf9f728498595c167
SHA1 dd12afbfda46414434fd84ad43aa759d8c6980bf
SHA512 4321ac1c2a64b66151885a50811202f35babe6031116467f88d3590fd72017858ced26874a96a5852fa242647dfe6cc1961ccc14788c6105dd85fb6800c219f2
SSDEEP 192:sxZ0ROyM/jK1Ml8MH//fvs62qtPIJIdpxg9/W6+WNz2C2SK/eBu00uBHDjPcMKIV:sxZ00///fvs6RpICa/bD+/e4upKM
TLSH
T101620906A6346D77CCDBD219BA45BB53D6F90466D2900E44AAFCCA1C00E7BED621782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 366567870f519185777284adf13090d792cf9a961e4d3678be1eab1bd3711ea3
MD5 ed627c4b8baf165b597aa07b93a5f98a
SHA1 b50a3eb53ea86669a28fcfd10e029116ff5f1877
SHA512 e01d0a52f374fc7ed889cd5009cf1898561742cb9a0fa63f0337202080d2f5c3068c3d5724f3d2e1a9d8e8c439808f001f1706124b9eaba295e51f6f6cb8ce11
SSDEEP 192:sxZ0ROyM/jK1Ml8UQhH//fvs62qtPIJIdpxg9/W6+WNz2C2SK/eBu00uBHDjPcMP:sxZ00ql//fvs6RpICa/bD+/e4upKM
TLSH
T117621906A6346D77CCDBD219BA45BB53D6F90466D2940E44AAFCCA1C00E7BED621382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 8e1d6a23dae0b9d465c340b2edf394627f1fc74adff03b0f585c0c7791021f2d
MD5 026508589cf005a3130d8e7c60a1f145
SHA1 ee6bb58137686f5b35808109425017420250fe77
SHA512 5ab418ddedd191af0fbddd9690d7485b579b37249b7f8d2b27a3e218479f0b9352576e906df4d5aefca055142917de4d6c29e3f70322d2a781ee53bbabe77580
SSDEEP 192:sxZ0ROyM/jK1Ml8Ml//fvs62ftPIJIdpf9/W6+WNrSK/A00uBHh+PvMKIg5YJ:sxZ0Et//fvs6IpIC1/bP/YuLKi
TLSH
T105520905AA34A977CCCBD209FA45BB53D6F50462D2900E54AAFCDA1C04E7BED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 78927e0490444fd9d3eb0c72db69fab3eb6f1edf93d1d65bc8b350710cd618ae
MD5 d396cf0e73de8ebf1e49ecbfc620d7b4
SHA1 03a459c7f864a695386ce3345578ba37200391ef
SHA512 e4282a964fb0bf8fdf02fed218e1e43e3a8fe6061a2b0e967b7b5914625f810f6531bf9386bccbb0d331d6c4100a36ed90d5eba5a314cb0686c4f45757f78861
SSDEEP 192:sxZ0ROyM/jK1Ml8MH//fvs62qtPIJIdpf9/W6+WNrSK/A00uBHiPPvMKIg5OJ:sxZ0E///fvs6RpIC1/bP/YulKM
TLSH
T1CF620905AA346977CCCBD209FA55BF53D6F50462D2900E44AAFCCA1C01E7BED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 dcf183e4a4931c03f0e88882be1d3eedf434d861f982f0578466bd25ef60a24b
MD5 fea39f0a8d597d21e9656339964091d2
SHA1 2924521ba8256d3d3070f39a5813b12f1a8e8ca2
SHA512 ccb60c6866a7496f2e8e353428d979da4e349de5fac1f28130f347068f0950fce3e19b6488e5462cb693bef6b23c84f7e3b089befedff54d7b51f9cf9392727f
SSDEEP 768:wf/Lh8dF2gd7pLuLfAkWRmAcQ3w8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3u6xjLlb:wf/Lh8dF2gLEfAkWRmAcQ3wu1jaKu6xJ
TLSH
T160031C3B690CCB7E4F844A9CED2A7F8B6DE801CB5698895447FA844C03C66EF41161DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 226B
SHA256 1aa2c9f86c95a4946afc75643cb4ca0d9a9d43f1e4bbb2c5aff4fbc5adaf607c
MD5 a71c26cfd16a2555c389566041312242
SHA1 a2b981b424846c73c64036b68929f19cceb9a39c
SHA512 f55e845095030d93bc380f024847e9ad3448b86a825adcc77e2af7228c69a1529b4e1309190e002506b3d695fff83123880981f5f9b282845c1e340d5ebff749
TLSH
T120D0A76BE1540585D7BB4A911A52002E8A247888248AA088E45319196D85BA39222FA2
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 233B
SHA256 bcaa1e1c6ec1362ecf19f0acab885c11161a85ac04e175572fd7526be00d149d
MD5 7ce71dde6b2e805059d9225bece21131
SHA1 b25d10e0bbf773a12df427824590e930d5cfe74a
SHA512 79e24e237a2071a81cb1b7530b3d8576b6a0aad184a9ae64a7c3aa873ccb3368719ba5f9ee000ecab8897ae22be0a75b4c17dacf78a16adb60d3430a174eb8c7
TLSH
T1BFD0A76BE1600581D7770A915A62005E8A247C88288AA088E413392D7DB5BA39222FA2
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe599b4c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt~RFe599b4c.TMP
Size 138B
SHA256 d25b10ca8c583c068f50201f98a2e1e2f8e33f1e860c11d221efe18d4d2a8f72
MD5 bfc0477353d1f3f15878ddb7b8420c42
SHA1 60a41f17cb4bc7e365e710c36a90307d819476bc
SHA512 63ac5d086667e4d390f82ab03ba9e97148beeff916f6e453d9df5a410cc3d6610c5e8513723855e32b446e351a04de17162a8644ef12d85022ace03355b94ce7
TLSH
T10CC04CB7A25409128B2506914626565D4B197C886D86C48DB42335283475F276116E95
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 3e263e23f8b08c2f7321def8fd22ec88c1c136cfc22037c7a48eaf1394b04a96
MD5 adfb94e6f8359936f8d4972ef25bebf4
SHA1 52211db96acf10d3e5a909a50d4dc416df1ee9a0
SHA512 f014515f41838f5d8466d194f3f29750887d9e8579a808342ebaf4d37537bee3df32cc0eb4697723fe2de011b8e1135470476d8baaf1ae1103fa9506a37b7ab2
SSDEEP 48:K08I/KFGsgtJtEtltZtTtHtjtgntPtWtzIatBtgKZt1BtLtgVtRtwotGtrtpttye:K08gKFGpIAKdaiCiMKrK0z
TLSH
T15B91049631BB02023C7E2B08B76597278A8271A73519A52F7BF840B50E27E164CFD9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c0099563-f597-43cb-8948-f8f38a35ad29.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\c0099563-f597-43cb-8948-f8f38a35ad29.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

office_endpoints_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2026.6.5.1\office_endpoints_list.json
Size 9KB
SHA256 f0c77aaacfc571e0bc3f51387febe134d991bf3c7f1941af303ed901f288dcd6
MD5 30719122f9edf4e23019a3b74e4f4325
SHA1 6707d64052797b9c5f1a5ccf016e5859c8ef898b
SHA512 ec2e1a33fcd1301f282512ffafb611ea705dc5df09d9aee014276909c1b62b0c73600121d94e9b6d9e160296672b41f2cb8c3ba23f121244ad2ea6521680723c
SSDEEP 96:DdQ/JJvwjyUsrdfsysVsnQfbJNZidYusysXYs2sFsdv12XvlRT07s/DkhcrHPglW:D7d7mfgiIWRcV4sobxezQd1Y
TLSH
T11512BB3BC4B49F229AB060659705E244F13C43BF5600C6FF76B9829C1F366ECA58E1E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 cc98543e640be9088e8dae39f21ebc0aa9a6a8bdd856fb746a6c848d712d419e
MD5 d91cff78198d85fc64d8a4119aa47451
SHA1 8537d27b50eda4377a64940e6c0ae3c73c7d91c8
SHA512 4d86d38ac6d16506b332d29a7e6257792bf2b03f3e4b1d339597d9cceeb6d816f5e244d4a700ed8c9e87188536a35e25b48321867cdb94338b12cde8b8015d62
SSDEEP 384:nAiFJZcIX8Nf8TUNTUlIlpLb9N40H9MEBDfwQFptJR8LMXCiqnTKwBODNZOCz0e:bFBXmwg/972BQbLgECiqnewBKZOO0e
TLSH
T197E2B4F188E7993BD9AE5783A73E6D068DFCC153B5885A84B7985D0CCC861BFC30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 4f8757653189c37d0124bf28150e5a34d40ddf3cab3807979ac6f9b39a7ceaf8
MD5 e54c25e142d06559cd535c7415345178
SHA1 ed3ed8cc24bd2f5587c415a956edacd204574ac6
SHA512 975a17d644077975028e99429a53b775901a5612d93fe6e66cc491b19ac3d4a3406f9fc38f7fd64337c6ff8421765cbfb337d0b47353b233cf3f0873d98baeaa
SSDEEP 384:nAiFdZcIx8NI8TUNTUlIlpLb9N40H1912BUfxQFptJR8LMXCLqnTKwBODNZOCz0e:bFFx3wg/9771rQbLgECLqnewBKZOO0e
TLSH
T1C9E2C4F188E7993BD9AE5783A73E2D068DFCC153B5885A84B7985D0CCC861BFC30A811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 fb8fded28bb7af432a1bfb801bcdb7ece58823c056c9eaddc5662b6ef8004e18
MD5 2e3ae10b24d2dba633791feffc991029
SHA1 0ec14f6ab24a3fba9f996e97f143d96ff5961346
SHA512 df6393fe69223b6ddde0cfa489e1e95aee60e8d35b5915ef9ba656c0ac064df4c82d7ad5723b05f5920e4974980cc47749482f61cb2ec2066a30a604a866f847
SSDEEP 384:nrZcI28NFpLb9N40H9sE0FptJR8LMXCNqnTKwBODNZOCz0e:z2m97ibbLgECNqnewBKZOO0e
TLSH
T139928D725C386C7B9EF3B545F44632079EF4816BE6C46F58DAEDAB1C01DA288131AC36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 4e6fa8a7abaa3868ac90149644e6d5dc3b5657cef82c1e2333bb0b2950d0e308
MD5 fe149d37f5f68a6bb98193e766e0cbb1
SHA1 c42a28a88f7305f2accc922e8717f01cc152707c
SHA512 1dc72b0e030ee43273b757e9161a861d3fadcf528d3fc34bfb94331ca9d632a9f3de3dc79bf51c20b7ae27b487c6777aa7d80a58f68c725782d71a6d43b6cdf8
SSDEEP 384:nQZcIh8NFWLb9N40HzsE0FptJR8LMXCEqnTKwBODNZOCz0e:uhl974bbLgECEqnewBKZOO0e
TLSH
T18F928E725C386C7B9EF3B545F44732075EF8812BE6C46B58DAEDAB1C01DA298131AC36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 df5642046098ddbc427f7b7acfb09a6787a7089c329bb482c4f86ea23e5a82b9
MD5 a7d4073ba2991608d53a001195ac8360
SHA1 453f7596434c4e7f2923cdb9e811e50187c140ec
SHA512 248dba9a5b34dc292ae208373bcb6ff28140eb6f18678666502b686be41f568683c28a4eff2877f3c8b9e48d0f9ea0b3f429fd9991486681772b309657b6af50
SSDEEP 192:qGNi6d9402QmiUyTvSTBF2oP1J9jzorTRSgGw+xwU6:qGNi6740SoqTBFptJR8FdU6
TLSH
T1D802D83668786CAB9EB36E45B44737176FD5102FAAC56B44DAE41F1C40DB25C1306836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 cb9c8b3ba0d7999dfd75985b89d4cc2a9af654e3319bb1dcf6d2c206559cc17c
MD5 1839c924957243218222bb44a481a571
SHA1 5e370b7e8b023d9a5a8d808729df7be72692bbd0
SHA512 b498fadaaa068b2df6f3f0b3255c8f08690cf4f636826d6e819d72ef6b615789bbe2758e723fd1d187483ea3c7091910a6af62a22f80f0a118d2233483ffc081
SSDEEP 384:nNZcIm8NF6Lb9N40HasE0FptJR8LMXCEqnTKwBODNZOCz0e:VmV97/bbLgECEqnewBKZOO0e
TLSH
T191928E725C386C7B9EF3A545F44632074EF8816BE6C46F58DAEDAB1C01DA298131AC36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e404c726c1306ad30be0e281f29770f78b7e63023764f8b2d038f00401c0ce4f
MD5 adf6f047e1466ca85025f6dbf06a9b51
SHA1 eef27cbc5048f187ddf776fe4195a26df1744dcb
SHA512 9f710a017f88ec2f12185b0022e576bf0e0113cb0bad1f54322126322249f7fb1d789c30507a893b3e2538fdfe26239ae06d88a01db72d3f4ca1d0eaf3c79753
SSDEEP 192:zGNI6d940/QmiUycSEBF2oP1J9jzorTRSiMXizOiDmquU6:zGNI6740BKEBFptJR8LMXCjqU6
TLSH
T1C512E936A8786C6F5EE37994B44736136EE5412BEBC4AB54D6EC2F1C01DF29C130AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nav_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json
Size 2KB
SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
MD5 499d9e568b96e759959dc69635470211
SHA1 2462a315342e0c09fd6c5fbd7f1e7ff6914c17e6
SHA512 3a5922697b5356fd29ccf8dcc2e5e0e8c1fd955046a5bacf11b8ac5b7c147625d31ade6ff17be86e79c2c613104b2d2aebb11557399084d422e304f287d8b905
TLSH
T16B51DB73D5988C4B9BF4A29CE919A309F11107CF75D48C0B76BE010C1F7757AB5C6588
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

0b695dff-99ae-44c7-b809-372ea79d7500.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\0b695dff-99ae-44c7-b809-372ea79d7500.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

8d21b046-43ed-49f6-9e99-d3c7cbac4089.tmp

Path C:\Users\Admin\AppData\Local\Temp\8d21b046-43ed-49f6-9e99-d3c7cbac4089.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_-_8.0.29_(x86)_20260809190040_000_dotnet_runtime_8.0.29_win_x86.msi.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.29_(x86)_20260809190040_000_dotnet_runtime_8.0.29_win_x86.msi.log
Size 3KB
SHA256 491e8fc18ddb98f70250565f584443d03e48e0cbebaec3979d938712bcc72f0c
MD5 d6c164d530440dda1ab758b0875e12a4
SHA1 4b3a62e090dd09cebedcf02da645bc8527d62ca3
SHA512 e0e8c66996435b2ead81c15b39749a93b3306fc39d6d67e09386194fc84e04387abfb32c497318a2d4027c03376decd1d4f9c882fbde60d34cbec23458e5ed05
TLSH
T1BC81D8641FE90955F2B356079AF385636A33FDC3A834CF4C2385C31942ABD05D96CBAA
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_-_8.0.29_(x86)_20260809190040_001_dotnet_hostfxr_8.0.29_win_x86.msi.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.29_(x86)_20260809190040_001_dotnet_hostfxr_8.0.29_win_x86.msi.log
Size 4KB
SHA256 bca04fea4402ddd232fcec5a22822b92902e352a21a93c26ef9ac0ca9bbb3c16
MD5 cdfa73ce733493e28e83249a9e57081c
SHA1 3f2834ac37e2861ef0f0ac0cb938c7d80f483d79
SHA512 ed62af6e65e7e1d27958b3b0c1dff2c3257c11a597c80c1762ea4977d540fb0996521601b451f691beea95591f6776be7bfabaa75a2f0e56af52361183dd0265
SSDEEP 96:Yy+20lgVHgmR/w0eO8VJQT7fIsigmR/wgEmRgmR/wH7SKFMW:H/uqZR/7eO8VJQTUTR/n1R/PKFT
TLSH
T112817A251FF90966B2B357479EF3C8235A33FCD69934CF4C2344831942A7905D9ACBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_-_8.0.29_(x86)_20260809190040_002_dotnet_host_8.0.29_win_x86.msi.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.29_(x86)_20260809190040_002_dotnet_host_8.0.29_win_x86.msi.log
Size 3KB
SHA256 89de313deb8af0c994fb4784bb696c1a3f1a75bee61edd2b81ae75d30a0c2a1e
MD5 06b64481c5c6555be102743e4b505d9f
SHA1 4dfe7572751aad510dbbe5530bc84e38837a8c10
SHA512 94bc7bfade5750fecb5343f40a70c872a370a9855ea80b9260f6ac33ffc3fd70bcdbce805ffabad002fbab100f1dc37e1c0323baf68813440ed852890849aac6
TLSH
T19771FC241EF549A5B2B7560BDEF3C513BA33BCC1A8348F4D134A8319465B90598ACB7E
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_-_8.0.29_(x86)_20260809190040_003_windowsdesktop_runtime_8.0.29_win_x86.msi.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.29_(x86)_20260809190040_003_windowsdesktop_runtime_8.0.29_win_x86.msi.log
Size 2KB
SHA256 d22e9666ee76f411f75ab88df8f0f0e33039dada516f417bce31c5b623c750d1
MD5 bfe11a4f52c2edf9e353b54c30e58830
SHA1 8ce9b1ebe050f4a6fa4f6d620b29292d21007004
SHA512 55c19066a6f9008fd932b44e71e705d021ab28839d429b18eb0a855d9372299a606cae672b0684e9d03a60037ff062ae3c2ba5c2bc1029e9a1f1075c84201035
TLSH
T1534117142EE50854B1B65B07DAF3C522AA33BCE69834DF4C13868319066B902A86CB6F
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\Synapse Launcher.exe.WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 348a36e0db62e2931903d8d45df854de5477d008ce63033d559739ec21663242
MD5 92670921127b961a1f695b8c93dede90
SHA1 4fed03c287355e6946ce1077d98e7a043e0478f7
SHA512 e78b4cb310e01a837af4d822ad8288fdd810f58c121713953f3b9c24f85e260f8266b7c1eff59f396f041d5bc7df2a7bf0efa0c4f232f996d3138b9106de615c
TLSH
T192D01122BA0202B8C02020330023AA088802C20B800E8888A82CCA2EAA088A00E0B8A2
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\Synapse Launcher.exe.WebView2\EBWebView\Default\DawnGraphiteCache\index
Size 256KB
SHA256 9760785f6cece965b6a7ccfc229a20ab7544936b675c26bf7211c197a122a5b7
MD5 1ceccd04efafe8bb2c44a9bab37c6e04
SHA1 d27171491c30af4e8e9a74d8b4434782427b8451
SHA512 b5720041320a6996724d261d87ccfa6e015333fa8b2c12748c2948870deac18b33cce8cf972ef4e952e7f315476f1fbadf22ca2166db6b7a8cb53f208b187626
SSDEEP 3:LstlNllkll/lQcl:LsX3lEtQcl
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\Synapse Launcher.exe.WebView2\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\Synapse Launcher.exe.WebView2\EBWebView\Default\Preferences
Size 6KB
SHA256 4a0896b4dbbebc92d30ca4ff693d04e2c16690364eab41f9642108a608cede0a
MD5 cb989f24abf6f065bd05d2facea89a4b
SHA1 6b64f276cfe9883120cea2d098fa70f53983963c
SHA512 7616773bfd8079a0e17cecba3bafb183410bb7ff20d669218ba30411fa0461d1bc424b095c0677079e3710f971d216734e94e96b9bf8f742191eae381b16f8be
SSDEEP 96:str05RRN0J+v4b9xHff1Z8i0vhEukmLm/7qx+WVHMSm+uecaxgLQjR+gwxMOB:str0ZNUHfNZ8pa+a/S+Wi8xgL4+xMC
TLSH
T11DD1B7029E686D7B4CC7F2197A25BB13E2F6202265D50EA8FBFD861C05E66CD520780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe5a9607.TMP

Path C:\Users\Admin\AppData\Local\Temp\Synapse Launcher.exe.WebView2\EBWebView\Default\Preferences~RFe5a9607.TMP
Size 6KB
SHA256 3415981ef997a8db330585615d3de0c9774c0c9f9e206a263fb4249b2f6cf30b
MD5 9f54383fbfc33c804837de7101118d53
SHA1 6ed51cb2dba81cc9c791fc5222ebcba3e42da4e7
SHA512 81539f66252c25f87d86a16816e49a4c8b32f41382e51cfad777f7f187dea96976cc65e136085b6f3831f806d6029c54ebe9f4d9ae00281a780cb551c779c70f
SSDEEP 96:str05RRN0J+v4b90Hff1Z8i0vhEukmLm/7qx+WVHMSm+uecaxgLQjR+gQxMEB:str0ZN1HfNZ8pa+a/S+Wi8xgL4KxM8
TLSH
T10CD1A7029E686D7B4CC7E219BA35BB03D2FA202265D50EA8FBFD851C08D66CC521790F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\Synapse Launcher.exe.WebView2\EBWebView\Default\Shared Dictionary\cache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\Synapse Launcher.exe.WebView2\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\Synapse Launcher.exe.WebView2\EBWebView\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\Synapse Launcher.exe.WebView2\EBWebView\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\Synapse Launcher.exe.WebView2\EBWebView\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\Synapse Launcher.exe.WebView2\EBWebView\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\Synapse Launcher.exe.WebView2\EBWebView\Local State
Size 1KB
SHA256 f86eb21de721e502a43e1ce985be3975e84aa8c3f2ec8192d1c314c8fe8c1698
MD5 f16ca576fa4d07af4fbb4fbd2874b96d
SHA1 5e555757fb0dcaeb89a8795b2b992238ed1124b7
SHA512 127ec0652562f155f38d0aa01bac8ec0dcdf0c4c4f1bc8d083d366038e06cd268ecffb520542a62eea2e416bd956b52751e0f5108f9f5d09e34ae4c19ca40376
TLSH
T1433185B3A4D42B775C8665467201BBD76E31217BC1259E5CA2DE472C03A72CC9226C36
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\Synapse Launcher.exe.WebView2\EBWebView\Local State
Size 3KB
SHA256 a4937c79415bba0f1705be63b20d5eb6a46102cb66a9c2b2bf35446b081cbdd2
MD5 8f22f9930d58753375ec833cb2122b50
SHA1 939d5757650d63e2b7af788870deac59c8efdad8
SHA512 8a4b16e433ffdc5855685db3ee5921a771d6598b144c837a7381f389070f3ecb981cad7e2bdca10a496a2e8a7edc21b3ab7f08238d9b0dde52167ff70f51df6e
TLSH
T1DD71A532A8A4A9374DE2A900B8813B07BB725137D5993FA8D9ED0F1C02D73C82302C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\Synapse Launcher.exe.WebView2\EBWebView\Local State
Size 16KB
SHA256 5a30fedac13d22c120b6a1787bd33244de73dc53dba1feb264e3c7f6f9fa3272
MD5 edec95cd3ae0cbb5c67055920ce0e65a
SHA1 8ba53be8e9b80a975f1f8ae54dc44dc9bc2db361
SHA512 5e90aa79441c1b8f8a94f60912bf8ca28aa1f65b4177900a07b43db27e5ccabae843fcfa3d8fd1768db953f33fd4a896c2d5b784e7984363a3f792714815789b
SSDEEP 384:z2+aQikB+z/xvxjg/qhEwNblYx2O3jm9zc:9/UxvxjgC+mYX3jmFc
TLSH
T15F729E3B55683E2799F3F5057A48178BDBB594B2D0C56ABC4EEE5F09069B3D81303D02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\Synapse Launcher.exe.WebView2\EBWebView\Local State
Size 2KB
SHA256 1ffba2453e145aeefaad0936fb3e3960e7148c893f796f152bb021c832d1b0ce
MD5 86a220c45a097f2834581ead30b65ace
SHA1 a4b06934579504536319e2b7bca9defed709b573
SHA512 8f2cd8e28ba6e1f27185384a9ff39c760f5c70a3e0e8ed80f83c4b6333939dc89f4121da169ed73b5a5fefb7db6c82916fa76f009466a2166dfe3b2fca626f13
TLSH
T199511933B8446A774DD3650479053F53AE366176D6252F6496DE0B1C02EB29C2302C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe59f7c4.TMP

Path C:\Users\Admin\AppData\Local\Temp\Synapse Launcher.exe.WebView2\EBWebView\Local State~RFe59f7c4.TMP
Size 1KB
SHA256 d05c44c799e067c8d2834764c6ce624872b894fd5c713f9d9cb39c379a738dee
MD5 5bdb7e4e59a65f379c1e30bd1f44c478
SHA1 322da931f082bc54a7e921339f07aa96fa1b949f
SHA512 9c5e753410a797adb47d3e215b17f4a5883f779ea7e79a6f85c644d4dec9873e338bb9e4981fb20e2dd1409cdbb6c5e7c49f651210f455b5790e528d68d51867
TLSH
T1AB216573D4D42A775D4965457201BBCB2E70617BD1289A1CA1DE432D03AB2DC9237C37
MD5 SHA1 SHA512 TLSH

Submit Download

WebView2Loader.dll

Path C:\Users\Admin\AppData\Local\Temp\WebView2Loader.dll
Size 113KB
SHA256 1064ab1c2cdc0746b100f021514d591043da7cc1583b450dd071d291080c53ef
MD5 4e5905898ae2075676abbe34ffbbc511
SHA1 3383c05de93e41ba6ad68b3fc52dd2f0eb9057cc
SHA512 e481a444ccee4d41ba5a8a547f69492e315123a8bbe5309dea573a71239c68203bab9b15835da16b23d50a1efdb0fd5d044143f77759fd5544834a4670dde348
SSDEEP 3072:q5S+1NJzO6ecBL2McQ+l1PgqeNZvTzqEtJZAl3TCJ4fmdv:qrNJzTBgbl6mEtJSdGJ2mN
TLSH
T1FBB36B5176D08072E5BE0A380574EB655B3FBA61DFA09DEB279409A94F307C0CE35E2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Editor.html

Path C:\Users\Admin\AppData\Local\Temp\bin\Editor.html
Size 5KB
SHA256 84c02cf2db832cb9f74196014cdab9dddb9ed319977782f0605d8df7f36cbbfc
MD5 1105aa7fb37c1914ece4dd9780ef83e0
SHA1 fcb3bd9975e3fd8f8da1ff67cc5813252a10ca34
SHA512 07a71b0cb5f8d3a3d67d00d424dcaec7ce82b696a7064805ba762d94b5f54636708c0f859af92540b4266461de8b4c1ea726d89522ee657a779ea7c90afd64ea
SSDEEP 96:RGyTJJwj/+npVpJmSvh1Hrw5CLRtLWJ6i5iKVnrfVGL:RGyTJJwj/+NiQVtLWJzrTVc
TLSH
T147C1425FFAC240D31A23A22953F7B2A83FB95A03C251CE3D37AC73B29F015A185655E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dce6c119-062a-4578-8629-d16815d5d2a2.tmp

Path C:\Users\Admin\AppData\Local\Temp\dce6c119-062a-4578-8629-d16815d5d2a2.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

0d0b7857-3eec-404b-8291-c6621ec5561f.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1368_1575929303\0d0b7857-3eec-404b-8291-c6621ec5561f.tmp
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1368_544454481\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

theme-wpf.json

Path C:\Users\Admin\AppData\Local\Temp\themes\theme-wpf.json
Size 2KB
SHA256 87e25adbf22f5de87f82ef33fc3df93c1155c598ab2faf144fea1403e80a3d30
MD5 a67115902e9f037737bcbfa27688bb63
SHA1 dcf940a51b2c1b43024dc094aceb328fc2508169
SHA512 000d66d2c4fd17d2f4641563cdd27053c2075ccaa5e43f15cde589b0de5a8044e1fd9b82a337fea2b8e4d6b5f677b9e163a828ff76fa699dfbcc3b3c25daa673
TLSH
T1FE41F936C1914D3F62F6666124B94B02FA81437B12410F9BFEBD544D8F3752714A6F0B
MD5 SHA1 SHA512 TLSH

Submit Download

windowsdesktop-runtime-8.0.29-win-x86.exe:Zone.Identifier

Path C:\Users\Admin\Downloads\windowsdesktop-runtime-8.0.29-win-x86.exe:Zone.Identifier
Size 185B
SHA256 715b63af98e664918b8949a7fa50f0a6be9235f3f3a02aad67a194df9b0107b2
MD5 e659a58d0241071c6197e5e0b3be3a3b
SHA1 44c67cb37b72bb6804d940383107ddc766070ecb
SHA512 163cf673f7c06f0cf3d6222609bd6d9efee8a59149237f64c91d5044b9421e8f15d4d2acb6260c2782b92984cfaa50c65387268b8bc35e486ca749842c50f2ba
TLSH
T1B7C0125BC40055424E3022820F6ED659FA2F1DA74981C3D898C480A2E5525D7C1918D5
MD5 SHA1 SHA512 TLSH

Submit Download

MSIB245.tmp

Path C:\Windows\Installer\MSIB245.tmp
Size 219KB
SHA256 2bf33a9b9980e44d21d48f04cc6ac4eed4c68f207bd5990b7d3254a310b944ae
MD5 928f4b0fc68501395f93ad524a36148c
SHA1 084590b18957ca45b4a0d4576d1cc72966c3ea10
SHA512 7f2163f651693f9b73a67e90b5c820af060a23502667a5c32c3beb2d6b043f5459f22d61072a744089d622c05502d80f7485e0f86eb6d565ff711d5680512372
SSDEEP 3072:FVzl3qiEZybztEwiUx6D02cWVsV1v2vZR3X6j7zo6k2FkngTLrOrORT9flQnS6lg:FVIMEgXmEAR3oHon2VaFuG0eEp
TLSH
T1AF248D217494947EEAFA0832A57EDA71BF3DF2241760C8AEC3409D1E6D604C167B7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1368_1077770124\manifest.json
Size 165B
SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
TLSH
T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1368_1490377425\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1368_357899717\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1368_797540852\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{087BE143-4608-43BC-AFD9-F8304ACC170D}\.ba\1033\thm.wxl
Size 5KB
SHA256 81a68046b06e09385be8449373e7ceb9e79f7724c3cf11f0b18a4489a8d4926a
MD5 d5070cb3387a0a22b7046ae5ab53f371
SHA1 bc9da146a42bbf9496de059ac576869004702a97
SHA512 8fcf621fb9ce74725c3712e06e5b37b619145078491e828c6069e153359de3bd5486663b1fa6f3bcf1c994d5c556b9964ea1a1355100a634a6c700ef37d381e3
SSDEEP 96:MT0abTxmup/vrCKATQdYQHdYCwgoVOBq9LjP5dbSE7:OQNkdYQHdYCYXt7
TLSH
T1F1C1DBA778CF53C128731255EA925AAA5911C19C537F2DF4FC8B454B838A827A373F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bg.png

Path C:\Windows\Temp\{451931B2-4237-4887-9E07-0A4A0FAF4607}\.ba\bg.png
Size 4KB
SHA256 9095bf7b6baa0107b40a4a6d727215be077133a190f4ca9bd89a176842141e79
MD5 9eb0320dfbf2bd541e6a55c01ddc9f20
SHA1 eb282a66d29594346531b1ff886d455e1dcd6d99
SHA512 9ada3a1757a493fbb004bd767fab8f77430af69d71479f340b8b8ede904cc94cd733700db593a4a2d2e1184c0081fd0648318d867128e1cb461021314990931d
SSDEEP 48:u+Xg+NXWbdlIr33lx9W5OstaDIy3r5XpPyvZKmXYTDeiByNxcaaaaaaaaaaaaaaE:AaXWPIrHT932JsdpPyjqDeioatEn
TLSH
T19891B4D8FCF95322C6002BF255F4C0735A0215B713ABFEC82F496BD90E6878E25058B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wixstdba.dll

Path C:\Windows\Temp\{451931B2-4237-4887-9E07-0A4A0FAF4607}\.ba\wixstdba.dll
Size 190KB
SHA256 dcea15f3710822ffc262e62ec04cc7bbbf0f33f5d1a853609fbfb65cb6a45640
MD5 f1919c6bd85d7a78a70c228a5b227fbe
SHA1 71647ebf4e7bed3bc1663d520419ac550fe630ff
SHA512 c7ff9b19c9bf320454a240c6abbc382950176a6befce05ea73150eeb0085d0b6ed5b65b2dcb4b04621ef9cca1d5c4e59c6682b9c85d1d5845e5ce3e5eedfd2eb
SSDEEP 3072:sjEoXsLW9OLG8Qp51ySdjDXY33b+Av7O5IkI+/AYkPAEc527uu3k/gLtxavf0ir2:sjEo8LW9553hXWy15I2YrAW7FUVEihs3
TLSH
T1FF14AF1176D0A07AEBFB16307A39A5216E7DBA200FA0C9DF63449D2B1D715C19B36B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet_host_8.0.29_win_x86.msi

Path C:\Windows\Temp\{451931B2-4237-4887-9E07-0A4A0FAF4607}\dotnet_host_8.0.29_win_x86.msi
Size 700KB
SHA256 c59fbfae475ab9e3f5083205e48f5ffee0e4d050b5a3177274be7cfa7b9dbe51
MD5 9fa19a7cf734e0ea53d61bd58b4eaf2b
SHA1 f458c04314ea348f74c5e14c1316a536e63613b1
SHA512 5ba6f0270a425061def065d407f0a71494a1e7a2ee89a834a859f0611a87f9a439aebbcd7c279b64c92ce6d961af1751832f5985a06c63d44b6a6fdf0b9230ef
SSDEEP 12288:UVTO0OGZPD4Rxbp4K+1uiqNV+EgXmEI3os2Qx7E:UI0OGZrin+s18dc3/7
TLSH
T1B1E49D237D80803AD9BA1D718539D7B16F3DBD204A64889B6380B91DDDF11C0AF76BE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet_hostfxr_8.0.29_win_x86.msi

Path C:\Windows\Temp\{451931B2-4237-4887-9E07-0A4A0FAF4607}\dotnet_hostfxr_8.0.29_win_x86.msi
Size 756KB
SHA256 348e3c8125863393318db69638d76bb2e51aadb546922d7a8b0e80f87b8ca350
MD5 7b459ee5f6b0fd2e020b7ab5c90c3ec0
SHA1 8f96bffc7b32f9766e65c70acb4f3a9f29288f8b
SHA512 96db14fd244d8b9e47fb0bdd7ff2af8e325dab340ce95040fc82df43306eb8f616aee33b3447dc7903406af76a88f4de951484d28fb134bb0209d36cc1b6273b
SSDEEP 12288:1zdrMaPDD4Rxbp4K+1uiqAV+EgXmEI3os2Qx7E:1zVMaP3in+sY8dc3/7
TLSH
T1DCF4AD137D80803AD8BA1D718539D7B16F3DBE204A64989B6380B91DDDF11C0AF76BE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet_runtime_8.0.29_win_x86.msi

Path C:\Windows\Temp\{451931B2-4237-4887-9E07-0A4A0FAF4607}\dotnet_runtime_8.0.29_win_x86.msi
Size 24.2MB
SHA256 30e2901a6864045a73f008148f305d6b444c386b08d2b81814c9636dbe455e63
MD5 488807a806c8ceac2df09ad7958c769b
SHA1 2ca63132d910098740e26078e0e1811c8873274c
SHA512 7bbaf96f4e7a9f7d77b1bdfec8c2e84c5b1a1acd3b881d6792615776f2ef575ec2a5516c23ba5631d318b239b37d271c30caa358c77c3fb749141c496f22cbc0
SSDEEP 393216:emRWRj7cEGo3hrkQbLy23F6VjUDxWzt0h0axuEPv26KstcBExCmh4:cv3GarP4jOWDaxZPv26AeCmh
TLSH
T1B04733337EC6D476E9A80E391A3ED3900F3EAE150655888B5724B41DDCF12E21BF59E2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windowsdesktop_runtime_8.0.29_win_x86.msi

Path C:\Windows\Temp\{451931B2-4237-4887-9E07-0A4A0FAF4607}\windowsdesktop_runtime_8.0.29_win_x86.msi
Size 26.8MB
SHA256 2357d7749c47c19a7130642b9e4d242b459170140e560e914e716bb37b2252cf
MD5 bdeade6fc0a60ba0d043d12433317bdb
SHA1 3947adc681fb4fc61dfc764a0e00523587aea752
SHA512 7ab427d6abad95ebe27b59194b004e1424a7468e7ff0e6dc21008364747c96a1e79a2bb4e5421fd39114255a5990d3aa84815a2a82b79f4bb76a7401071e210f
SSDEEP 393216:J8RXcVkoAFd7sriYMsHtArQ5PbQAToYFtitmXfJV8U67FcPj/cvebg14N:iJcVkV7s+bMA0p3bxV8NyPj9bg6
TLSH
T11557331BBE868431D42F1C746632A7209F3DAC205F869867A384746EDDF25D04F72AF6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windowsdesktop-runtime-8.0.29-win-x86.exe

Path C:\Windows\Temp\{ED0AF511-0BE8-490F-B1EA-34C066C7260C}\.cr\windowsdesktop-runtime-8.0.29-win-x86.exe
Size 607KB
SHA256 39148521eccc248ad1e3e718b999252a65ca7a3d32651a12dc4fa8ead5ceef1b
MD5 3b41c67f0fb9b561651d53b8aedab4de
SHA1 e5b65b8160f3e1569557699bef54aac1638c98b4
SHA512 b8464438e89255eaec4aa48399ba48ce0fa79b9cda900177a252e171e3b128a545041f04ab0a018fb336693af7e147a6cc5e18ee2ac0466e58b4c1a3ccfecc11
SSDEEP 12288:wmEsd9PZfePv3xl7ft7V+6uC+zd5qLlWA3wfEr7h3kWhY5DnmOn:wm39PZfePv3r7fm6t+jqp53+uhUkY5p
TLSH
T1C4D48D32A5614032E7F106B3B928D5303E3CE328275488AAE7D4AD1D7EB84D667F7257
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/240-2418-0x000001A034390000-0x000001A03442E000-memory.dmp

Download

memory/240-2262-0x00007FFD44A60000-0x00007FFD44A61000-memory.dmp

Download

memory/1264-2162-0x0000000005000000-0x0000000005092000-memory.dmp

Download

memory/1264-2157-0x0000000000690000-0x000000000069A000-memory.dmp

Download

memory/1264-2158-0x0000000005500000-0x0000000005AA6000-memory.dmp

Download

memory/1264-2165-0x00000000050B0000-0x00000000050BA000-memory.dmp

Download

memory/3940-1341-0x000000000BD51000-0x0000000011599000-memory.dmp

Download

memory/5304-2389-0x0000024BE8C50000-0x0000024BE8CEE000-memory.dmp

Download

memory/5304-2187-0x00007FFD44A60000-0x00007FFD44A61000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads