Overview
overview
8Static
static
3bunnysense.zip
windows10-2004-x64
1bunnysense.zip
windows11-ltsc_2024-x64
1FFlagTool.deps.json
windows10-2004-x64
3FFlagTool.deps.json
windows11-ltsc_2024-x64
3FFlagTool.exe
windows10-2004-x64
1FFlagTool.exe
windows11-ltsc_2024-x64
1FFlagTool.exe
windows10-2004-x64
8FFlagTool.exe
windows11-ltsc_2024-x64
8FFlagTool.pdb
windows10-2004-x64
3FFlagTool.pdb
windows11-ltsc_2024-x64
3FFlagTool....g.json
windows10-2004-x64
3FFlagTool....g.json
windows11-ltsc_2024-x64
3Analysis
- user interaction
yes - max time kernel
149s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
09/08/2026, 18:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bunnysense.zip
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
bunnysense.zip
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
FFlagTool.deps.json
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral4
Sample
FFlagTool.deps.json
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral5
Sample
FFlagTool.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
FFlagTool.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
FFlagTool.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
22 signatures
150 seconds
Behavioral task
behavioral8
Sample
FFlagTool.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
14 signatures
150 seconds
Behavioral task
behavioral9
Sample
FFlagTool.pdb
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral10
Sample
FFlagTool.pdb
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral11
Sample
FFlagTool.runtimeconfig.json
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral12
Sample
FFlagTool.runtimeconfig.json
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target FFlagTool.exe
- Size 158KB
- Sample260809-xk4cfaca34
- SHA256 e7867ea29e09c8ba5a71ba9c546b868c6484b5df809e9483b104f7bbc7d73701
- MD5 bc04bee9e81d0ebbfc84059be8cb0b8c
- SHA1 92df520079f77486b5cdf28fff6a6e834342d4f6
- SHA512 c536940d1c7944d5e21142074a8c31b098bdf88778a7729ffc956b711ea9d3343828cf54a7f84cdae9f764553e46fb6fb4cb55d5acc1a6ff54168bc215d9b989
- SSDEEP 3072:mXwANETcQt1Onb5RHrfqDQXFn4dPPYseJwmm82jT6nbu:clxnlRLfyQXN42DCG
- TLSH T1A1F33B13A6AC11FEE1B7D678C9924941FB7278594B71A6CF03504EBA0F76BD09E39302
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Downloads MZ/PE file 1 IoCs
flow pid Process 86 2060 msedge.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation windowsdesktop-runtime-10.0.10-win-x64.exe - Executes dropped EXE 8 IoCs
pid Process 3084 windowsdesktop-runtime-10.0.10-win-x64.exe 2944 wixstdba.exe 3328 windowsdesktop-runtime-10.0.10-win-x64.exe 4752 wixstdba.exe 4920 windowsdesktop-runtime-10.0.10-win-x64.exe 4820 windowsdesktop-runtime-10.0.10-win-x64.exe 3336 windowsdesktop-runtime-10.0.10-win-x64.exe 3804 wixstdba.exe - Loads dropped DLL 8 IoCs
pid Process 5072 MsiExec.exe 5072 MsiExec.exe 3856 MsiExec.exe 3856 MsiExec.exe 2328 MsiExec.exe 2328 MsiExec.exe 3616 MsiExec.exe 3616 MsiExec.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{866BECDA-F284-473A-9E84-0CCE816BF06F} = "\"C:\\ProgramData\\Package Cache\\{866BECDA-F284-473A-9E84-0CCE816BF06F}\\windowsdesktop-runtime-10.0.10-win-x64.exe\" /burn.runonce" windowsdesktop-runtime-10.0.10-win-x64.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\J: msiexec.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Collections.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Runtime.InteropServices.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Security.Cryptography.Csp.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\de\System.Windows.Controls.Ribbon.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\es\System.Windows.Forms.Primitives.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\pl\System.Windows.Input.Manipulations.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Reflection.Primitives.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Security.Cryptography.Cng.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Windows.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\D3DCompiler_47_cor3.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\fr\UIAutomationClientSideProviders.resources.dll msiexec.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping4632_60317548\office_endpoints_list.json msedge.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Xml.XmlDocument.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\System.Diagnostics.EventLog.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\pt-BR\System.Windows.Forms.Design.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Net.Ping.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\coreclr.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\System.IO.Packaging.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\it\PresentationUI.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\ru\System.Xaml.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\ru\UIAutomationClientSideProviders.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.IO.FileSystem.Primitives.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Security.Cryptography.X509Certificates.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.ValueTuple.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\it\PresentationFramework.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\zh-Hans\WindowsFormsIntegration.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Net.WebSockets.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Runtime.Serialization.Json.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\es\PresentationUI.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Security.Cryptography.OpenSsl.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\pl\Microsoft.VisualBasic.Forms.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\pl\UIAutomationClient.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\es\System.Windows.Forms.Design.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Net.ServicePoint.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\PresentationCore.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\Microsoft.NETCore.App.runtimeconfig.json msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.IO.FileSystem.Watcher.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\PresentationFramework.Classic.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\ja\System.Windows.Forms.Design.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\zh-Hans\PresentationUI.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Core.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.IO.FileSystem.AccessControl.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Runtime.InteropServices.RuntimeInformation.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Security.Principal.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Threading.ThreadPool.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\mscordaccore_amd64_amd64_10.0.1026.32716.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\de\UIAutomationTypes.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\it\System.Windows.Controls.Ribbon.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\Microsoft.VisualBasic.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\System.Windows.Forms.Design.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\es\System.Xaml.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\fr\System.Windows.Forms.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\ja\System.Windows.Controls.Ribbon.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\ko\UIAutomationProvider.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.IO.Pipes.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Reflection.Emit.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\es\PresentationFramework.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\pl\System.Windows.Forms.Design.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.ComponentModel.DataAnnotations.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.ComponentModel.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.IO.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\ja\UIAutomationProvider.resources.dll msiexec.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Security.SecureString.dll msiexec.exe - Drops file in Windows directory 35 IoCs
description ioc Process File opened for modification C:\Windows\Installer\e58c83e.msi msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1\64.60.31149\fileCoreHostExe msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1\64.60.31149\fileCoreHostExe msiexec.exe File opened for modification C:\Windows\Installer\e58c834.msi msiexec.exe File created C:\Windows\Installer\SourceHash{DA493AF2-5A21-4D85-BB57-757D7525EB73} msiexec.exe File opened for modification C:\Windows\Installer\MSID9B3.tmp msiexec.exe File created C:\Windows\Installer\e58c834.msi msiexec.exe File opened for modification C:\Windows\Installer\e58c839.msi msiexec.exe File created C:\Windows\Installer\SourceHash{8A8CC49F-7D1E-45DC-B7B5-35FF61A2C25E} msiexec.exe File created C:\Windows\Installer\SourceHash{441FCDB0-A03A-4130-A1D5-FFD8C53CFF6B} msiexec.exe File created C:\Windows\Installer\e58c83e.msi msiexec.exe File created C:\Windows\Installer\SourceHash{F0BCFB2E-4878-4F6E-BD5D-3ABFF264829E} msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\e58c838.msi msiexec.exe File opened for modification C:\Windows\Installer\MSID50E.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIDE2A.tmp msiexec.exe File created C:\Windows\Installer\e58c839.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI86E.tmp msiexec.exe File opened for modification C:\Windows\Installer\e58c82d.msi msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1\64.60.31149 msiexec.exe File opened for modification C:\Windows\Installer\MSIE7F0.tmp msiexec.exe File created C:\Windows\Installer\e58c83d.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIFA04.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIFD9F.tmp msiexec.exe File created C:\Windows\Installer\e58c842.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSIF7FF.tmp msiexec.exe File created C:\Windows\Installer\e58c82d.msi msiexec.exe File opened for modification C:\Windows\Installer\MSID657.tmp msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1 msiexec.exe File created C:\Windows\Installer\e58c833.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIDCC2.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIDF73.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIEB9B.tmp msiexec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wixstdba.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language windowsdesktop-runtime-10.0.10-win-x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wixstdba.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language windowsdesktop-runtime-10.0.10-win-x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language windowsdesktop-runtime-10.0.10-win-x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language windowsdesktop-runtime-10.0.10-win-x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language windowsdesktop-runtime-10.0.10-win-x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wixstdba.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 2060 msedge.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier msedge.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Modifies data under HKEY_USERS 11 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29 msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b msiexec.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry msedge.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28 msiexec.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307753654330355" msedge.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F94CC8A8E1D7CD547B5B53FF162A2CE5\MainFeature msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E2BFCB0F8784E6F4DBD5A3FB2F4628E9\MainFeature msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F94CC8A8E1D7CD547B5B53FF162A2CE5\InstanceType = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2FA394AD12A558D4BB7557D75752BE37\AdvertiseFlags = "388" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\9309C9E278150CC5452917C0EA916C61 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0BDCF144A30A03141A5DFF8D5CC3FFB6\PackageCode = "69DC61D230D275C4FAFCB32DD99348DD" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0BDCF144A30A03141A5DFF8D5CC3FFB6\AdvertiseFlags = "388" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\windowsdesktop_runtime_80.40.55332_x64 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E2BFCB0F8784E6F4DBD5A3FB2F4628E9\Provider msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\windowsdesktop_runtime_80.40.55332_x64 windowsdesktop-runtime-10.0.10-win-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\{866BECDA-F284-473A-9E84-0CCE816BF06F} windowsdesktop-runtime-10.0.10-win-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\0BDCF144A30A03141A5DFF8D5CC3FFB6\MainFeature msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x64\DisplayName = "Microsoft .NET Host - 10.0.10 (x64)" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0BDCF144A30A03141A5DFF8D5CC3FFB6\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_80.40.55332_x64\DisplayName = "Microsoft Windows Desktop Runtime - 10.0.10 (x64)" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E2BFCB0F8784E6F4DBD5A3FB2F4628E9\AuthorizedLUAApp = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F94CC8A8E1D7CD547B5B53FF162A2CE5\ProductName = "Microsoft .NET Host - 10.0.10 (x64)" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F94CC8A8E1D7CD547B5B53FF162A2CE5\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2FA394AD12A558D4BB7557D75752BE37\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{DA493AF2-5A21-4D85-BB57-757D7525EB73}v80.40.55332\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0BDCF144A30A03141A5DFF8D5CC3FFB6\SourceList\Media\1 = ";" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E2BFCB0F8784E6F4DBD5A3FB2F4628E9\AdvertiseFlags = "388" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{866BECDA-F284-473A-9E84-0CCE816BF06F}\Version = "10.0.10.50000" windowsdesktop-runtime-10.0.10-win-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{866BECDA-F284-473A-9E84-0CCE816BF06F}\Dependents windowsdesktop-runtime-10.0.10-win-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F94CC8A8E1D7CD547B5B53FF162A2CE5\PackageCode = "BB5A5A59AE909304FB0B47459E96A72D" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A8A84F1AA6E5EFD5BE00C8237B84D6D4\F94CC8A8E1D7CD547B5B53FF162A2CE5 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0BDCF144A30A03141A5DFF8D5CC3FFB6\InstanceType = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0BDCF144A30A03141A5DFF8D5CC3FFB6\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0BDCF144A30A03141A5DFF8D5CC3FFB6\SourceList\Media msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F94CC8A8E1D7CD547B5B53FF162A2CE5 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_80.40.55332_x64\ = "{441FCDB0-A03A-4130-A1D5-FFD8C53CFF6B}" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2FA394AD12A558D4BB7557D75752BE37\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{DA493AF2-5A21-4D85-BB57-757D7525EB73}v80.40.55332\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.40.55332_x64\Dependents windowsdesktop-runtime-10.0.10-win-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\0BDCF144A30A03141A5DFF8D5CC3FFB6 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E2BFCB0F8784E6F4DBD5A3FB2F4628E9 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F94CC8A8E1D7CD547B5B53FF162A2CE5\Clients = 3a0000000000 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2FA394AD12A558D4BB7557D75752BE37\AuthorizedLUAApp = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0BDCF144A30A03141A5DFF8D5CC3FFB6\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F94CC8A8E1D7CD547B5B53FF162A2CE5\Assignment = "1" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.40.55332_x64 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E2BFCB0F8784E6F4DBD5A3FB2F4628E9 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2FA394AD12A558D4BB7557D75752BE37\Assignment = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\5D9ADA2B34E5318566B5BBB43BFD9EF6\E2BFCB0F8784E6F4DBD5A3FB2F4628E9 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E2BFCB0F8784E6F4DBD5A3FB2F4628E9\SourceList msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E2BFCB0F8784E6F4DBD5A3FB2F4628E9\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E2BFCB0F8784E6F4DBD5A3FB2F4628E9\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E2BFCB0F8784E6F4DBD5A3FB2F4628E9\InstanceType = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F94CC8A8E1D7CD547B5B53FF162A2CE5\AdvertiseFlags = "388" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x64\Dependents\{866BECDA-F284-473A-9E84-0CCE816BF06F} windowsdesktop-runtime-10.0.10-win-x64.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0BDCF144A30A03141A5DFF8D5CC3FFB6\Version = "1344854052" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0BDCF144A30A03141A5DFF8D5CC3FFB6\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{441FCDB0-A03A-4130-A1D5-FFD8C53CFF6B}v80.40.55332\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_80.40.55332_x64\ = "{F0BCFB2E-4878-4F6E-BD5D-3ABFF264829E}" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{866BECDA-F284-473A-9E84-0CCE816BF06F}\ = "{866BECDA-F284-473A-9E84-0CCE816BF06F}" windowsdesktop-runtime-10.0.10-win-x64.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2FA394AD12A558D4BB7557D75752BE37\Clients = 3a0000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E2BFCB0F8784E6F4DBD5A3FB2F4628E9\SourceList\Net msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x64\Dependents windowsdesktop-runtime-10.0.10-win-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.40.55332_x64\ = "{DA493AF2-5A21-4D85-BB57-757D7525EB73}" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0BDCF144A30A03141A5DFF8D5CC3FFB6 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0BDCF144A30A03141A5DFF8D5CC3FFB6\SourceList\Net msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_80.40.55332_x64\Dependents windowsdesktop-runtime-10.0.10-win-x64.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2FA394AD12A558D4BB7557D75752BE37\InstanceType = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2FA394AD12A558D4BB7557D75752BE37\SourceList msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E2BFCB0F8784E6F4DBD5A3FB2F4628E9\Version = "1344854052" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E2BFCB0F8784E6F4DBD5A3FB2F4628E9\Clients = 3a0000000000 msiexec.exe - Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 5064 msiexec.exe 5064 msiexec.exe 5064 msiexec.exe 5064 msiexec.exe 5064 msiexec.exe 5064 msiexec.exe 5064 msiexec.exe 5064 msiexec.exe 3460 msedge.exe 3460 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 4632 msedge.exe 4632 msedge.exe 4632 msedge.exe 4632 msedge.exe 4632 msedge.exe 4632 msedge.exe 4632 msedge.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4920 windowsdesktop-runtime-10.0.10-win-x64.exe Token: SeIncreaseQuotaPrivilege 4920 windowsdesktop-runtime-10.0.10-win-x64.exe Token: SeSecurityPrivilege 5064 msiexec.exe Token: SeCreateTokenPrivilege 4920 windowsdesktop-runtime-10.0.10-win-x64.exe Token: SeAssignPrimaryTokenPrivilege 4920 windowsdesktop-runtime-10.0.10-win-x64.exe Token: SeLockMemoryPrivilege 4920 windowsdesktop-runtime-10.0.10-win-x64.exe Token: SeIncreaseQuotaPrivilege 4920 windowsdesktop-runtime-10.0.10-win-x64.exe Token: SeMachineAccountPrivilege 4920 windowsdesktop-runtime-10.0.10-win-x64.exe Token: SeTcbPrivilege 4920 windowsdesktop-runtime-10.0.10-win-x64.exe Token: SeSecurityPrivilege 4920 windowsdesktop-runtime-10.0.10-win-x64.exe Token: SeTakeOwnershipPrivilege 4920 windowsdesktop-runtime-10.0.10-win-x64.exe Token: SeLoadDriverPrivilege 4920 windowsdesktop-runtime-10.0.10-win-x64.exe Token: SeSystemProfilePrivilege 4920 windowsdesktop-runtime-10.0.10-win-x64.exe Token: SeSystemtimePrivilege 4920 windowsdesktop-runtime-10.0.10-win-x64.exe Token: SeProfSingleProcessPrivilege 4920 windowsdesktop-runtime-10.0.10-win-x64.exe Token: SeIncBasePriorityPrivilege 4920 windowsdesktop-runtime-10.0.10-win-x64.exe Token: SeCreatePagefilePrivilege 4920 windowsdesktop-runtime-10.0.10-win-x64.exe Token: SeCreatePermanentPrivilege 4920 windowsdesktop-runtime-10.0.10-win-x64.exe Token: SeBackupPrivilege 4920 windowsdesktop-runtime-10.0.10-win-x64.exe Token: SeRestorePrivilege 4920 windowsdesktop-runtime-10.0.10-win-x64.exe Token: SeShutdownPrivilege 4920 windowsdesktop-runtime-10.0.10-win-x64.exe Token: SeDebugPrivilege 4920 windowsdesktop-runtime-10.0.10-win-x64.exe Token: SeAuditPrivilege 4920 windowsdesktop-runtime-10.0.10-win-x64.exe Token: SeSystemEnvironmentPrivilege 4920 windowsdesktop-runtime-10.0.10-win-x64.exe Token: SeChangeNotifyPrivilege 4920 windowsdesktop-runtime-10.0.10-win-x64.exe Token: SeRemoteShutdownPrivilege 4920 windowsdesktop-runtime-10.0.10-win-x64.exe Token: SeUndockPrivilege 4920 windowsdesktop-runtime-10.0.10-win-x64.exe Token: SeSyncAgentPrivilege 4920 windowsdesktop-runtime-10.0.10-win-x64.exe Token: SeEnableDelegationPrivilege 4920 windowsdesktop-runtime-10.0.10-win-x64.exe Token: SeManageVolumePrivilege 4920 windowsdesktop-runtime-10.0.10-win-x64.exe Token: SeImpersonatePrivilege 4920 windowsdesktop-runtime-10.0.10-win-x64.exe Token: SeCreateGlobalPrivilege 4920 windowsdesktop-runtime-10.0.10-win-x64.exe Token: SeRestorePrivilege 5064 msiexec.exe Token: SeTakeOwnershipPrivilege 5064 msiexec.exe Token: SeRestorePrivilege 5064 msiexec.exe Token: SeTakeOwnershipPrivilege 5064 msiexec.exe Token: SeRestorePrivilege 5064 msiexec.exe Token: SeTakeOwnershipPrivilege 5064 msiexec.exe Token: SeRestorePrivilege 5064 msiexec.exe Token: SeTakeOwnershipPrivilege 5064 msiexec.exe Token: SeRestorePrivilege 5064 msiexec.exe Token: SeTakeOwnershipPrivilege 5064 msiexec.exe Token: SeRestorePrivilege 5064 msiexec.exe Token: SeTakeOwnershipPrivilege 5064 msiexec.exe Token: SeRestorePrivilege 5064 msiexec.exe Token: SeTakeOwnershipPrivilege 5064 msiexec.exe Token: SeRestorePrivilege 5064 msiexec.exe Token: SeTakeOwnershipPrivilege 5064 msiexec.exe Token: SeRestorePrivilege 5064 msiexec.exe Token: SeTakeOwnershipPrivilege 5064 msiexec.exe Token: SeRestorePrivilege 5064 msiexec.exe Token: SeTakeOwnershipPrivilege 5064 msiexec.exe Token: SeRestorePrivilege 5064 msiexec.exe Token: SeTakeOwnershipPrivilege 5064 msiexec.exe Token: SeRestorePrivilege 5064 msiexec.exe Token: SeTakeOwnershipPrivilege 5064 msiexec.exe Token: SeRestorePrivilege 5064 msiexec.exe Token: SeTakeOwnershipPrivilege 5064 msiexec.exe Token: SeRestorePrivilege 5064 msiexec.exe Token: SeTakeOwnershipPrivilege 5064 msiexec.exe Token: SeRestorePrivilege 5064 msiexec.exe Token: SeTakeOwnershipPrivilege 5064 msiexec.exe Token: SeRestorePrivilege 5064 msiexec.exe Token: SeTakeOwnershipPrivilege 5064 msiexec.exe - Suspicious use of FindShellTrayWindow 14 IoCs
pid Process 4632 msedge.exe 4632 msedge.exe 4632 msedge.exe 4632 msedge.exe 4632 msedge.exe 4632 msedge.exe 4632 msedge.exe 4632 msedge.exe 4632 msedge.exe 4632 msedge.exe 4632 msedge.exe 4632 msedge.exe 4632 msedge.exe 4752 wixstdba.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2028 wrote to memory of 4632 2028 FFlagTool.exe 84 PID 4632 wrote to memory of 3228 4632 msedge.exe 85 PID 4632 wrote to memory of 2764 4632 msedge.exe 86 PID 4632 wrote to memory of 2060 4632 msedge.exe 87 PID 4632 wrote to memory of 2764 4632 msedge.exe 86 PID 4632 wrote to memory of 2764 4632 msedge.exe 86 PID 4632 wrote to memory of 3972 4632 msedge.exe 89 PID 4632 wrote to memory of 3972 4632 msedge.exe 89 PID 4632 wrote to memory of 2580 4632 msedge.exe 90 PID 4632 wrote to memory of 2580 4632 msedge.exe 90 PID 4632 wrote to memory of 4928 4632 msedge.exe 91 PID 4632 wrote to memory of 2580 4632 msedge.exe 90 PID 4632 wrote to memory of 4928 4632 msedge.exe 91 PID 4632 wrote to memory of 4928 4632 msedge.exe 91 PID 4632 wrote to memory of 4412 4632 msedge.exe 92 PID 4632 wrote to memory of 4412 4632 msedge.exe 92 PID 4632 wrote to memory of 4412 4632 msedge.exe 92 PID 4632 wrote to memory of 3856 4632 msedge.exe 93 PID 4632 wrote to memory of 3856 4632 msedge.exe 93 PID 4632 wrote to memory of 3856 4632 msedge.exe 93 PID 4632 wrote to memory of 4356 4632 msedge.exe 97 PID 4632 wrote to memory of 4356 4632 msedge.exe 97 PID 4632 wrote to memory of 2600 4632 msedge.exe 98 PID 4632 wrote to memory of 2600 4632 msedge.exe 98 PID 4632 wrote to memory of 4308 4632 msedge.exe 102 PID 4632 wrote to memory of 4308 4632 msedge.exe 102 PID 4632 wrote to memory of 4308 4632 msedge.exe 102 PID 4632 wrote to memory of 888 4632 msedge.exe 103 PID 4632 wrote to memory of 1900 4632 msedge.exe 104 PID 4632 wrote to memory of 888 4632 msedge.exe 103 PID 4632 wrote to memory of 1900 4632 msedge.exe 104 PID 4632 wrote to memory of 208 4632 msedge.exe 106 PID 4632 wrote to memory of 2760 4632 msedge.exe 107 PID 4632 wrote to memory of 2760 4632 msedge.exe 107 PID 4632 wrote to memory of 1432 4632 msedge.exe 108 PID 4632 wrote to memory of 1432 4632 msedge.exe 108 PID 4632 wrote to memory of 1232 4632 msedge.exe 109 PID 4632 wrote to memory of 1232 4632 msedge.exe 109 PID 4632 wrote to memory of 4180 4632 msedge.exe 110 PID 4632 wrote to memory of 4180 4632 msedge.exe 110 PID 4632 wrote to memory of 2488 4632 msedge.exe 111 PID 4632 wrote to memory of 2488 4632 msedge.exe 111 PID 4632 wrote to memory of 3700 4632 msedge.exe 112 PID 4632 wrote to memory of 3700 4632 msedge.exe 112 PID 4632 wrote to memory of 4384 4632 msedge.exe 113 PID 4632 wrote to memory of 4384 4632 msedge.exe 113 PID 4632 wrote to memory of 4384 4632 msedge.exe 113 PID 4632 wrote to memory of 2648 4632 msedge.exe 117 PID 4632 wrote to memory of 4536 4632 msedge.exe 126 PID 4632 wrote to memory of 4288 4632 msedge.exe 127 PID 4632 wrote to memory of 1700 4632 msedge.exe 128 PID 4632 wrote to memory of 3084 4632 msedge.exe 129 PID 3084 wrote to memory of 2944 3084 windowsdesktop-runtime-10.0.10-win-x64.exe 131 PID 4632 wrote to memory of 3328 4632 msedge.exe 132 PID 3328 wrote to memory of 4752 3328 windowsdesktop-runtime-10.0.10-win-x64.exe 133 PID 3328 wrote to memory of 4920 3328 windowsdesktop-runtime-10.0.10-win-x64.exe 134 PID 4820 wrote to memory of 3336 4820 windowsdesktop-runtime-10.0.10-win-x64.exe 138 PID 5064 wrote to memory of 5072 5064 msiexec.exe 139 PID 5064 wrote to memory of 3856 5064 msiexec.exe 142 PID 5064 wrote to memory of 2328 5064 msiexec.exe 144 PID 3336 wrote to memory of 3804 3336 windowsdesktop-runtime-10.0.10-win-x64.exe 145 PID 5064 wrote to memory of 3616 5064 msiexec.exe 147 PID 4632 wrote to memory of 4708 4632 msedge.exe 149 PID 4632 wrote to memory of 4708 4632 msedge.exe 149
Processes
-
C:\Users\Admin\AppData\Local\Temp\FFlagTool.exe"C:\Users\Admin\AppData\Local\Temp\FFlagTool.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?framework=Microsoft.NETCore.App&framework_version=10.0.0&arch=x64&rid=win-x64&os=win10&gui=true2⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x35c,0x7ff87028c188,0x7ff87028c194,0x7ff87028c1a03⤵PID:3228
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1760,i,18095892996015118707,473748426532918296,262144 --field-trial-handle=2320,i,14533737806991519404,15023095622284888245,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:23⤵PID:2764
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1968,i,11445169649721182573,6826983150241988841,524288 --field-trial-handle=2320,i,14533737806991519404,15023095622284888245,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:33⤵
- Downloads MZ/PE file
- System Time Discovery
PID:2060
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2640,i,7984171620687382624,17538551873881226971,524288 --field-trial-handle=2320,i,14533737806991519404,15023095622284888245,262144 --variations-seed-version --mojo-platform-channel-handle=2616 /prefetch:83⤵PID:3972
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3472,i,6718021549327956769,3888317190033615432,2097152 --field-trial-handle=2320,i,14533737806991519404,15023095622284888245,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:13⤵PID:2580
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3500,i,1244942910406655192,2911609760789040644,2097152 --field-trial-handle=2320,i,14533737806991519404,15023095622284888245,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:13⤵PID:4928
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4176,i,882287775798568356,3962772478385172401,2097152 --field-trial-handle=2320,i,14533737806991519404,15023095622284888245,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:13⤵PID:4412
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4236,i,1679640556233980546,13730561613381072368,2097152 --field-trial-handle=2320,i,14533737806991519404,15023095622284888245,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:23⤵PID:3856
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3656,i,10345367374243830810,5946622856918992556,524288 --field-trial-handle=2320,i,14533737806991519404,15023095622284888245,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:83⤵PID:4356
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5280,i,9395513565498130075,8112748525341100545,524288 --field-trial-handle=2320,i,14533737806991519404,15023095622284888245,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:83⤵PID:2600
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5256,i,16009677893025546882,4099645399460354023,2097152 --field-trial-handle=2320,i,14533737806991519404,15023095622284888245,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:13⤵PID:4308
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3576,i,12881770840089282864,13396056937249016889,524288 --field-trial-handle=2320,i,14533737806991519404,15023095622284888245,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:83⤵PID:888
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3988,i,9699044613155595218,17938204869867483517,524288 --field-trial-handle=2320,i,14533737806991519404,15023095622284888245,262144 --variations-seed-version --mojo-platform-channel-handle=3768 /prefetch:83⤵PID:1900
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5948,i,11023230865547694028,6153543721873492353,524288 --field-trial-handle=2320,i,14533737806991519404,15023095622284888245,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:83⤵PID:1084
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5948,i,11023230865547694028,6153543721873492353,524288 --field-trial-handle=2320,i,14533737806991519404,15023095622284888245,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:83⤵PID:208
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,97850382708135275,7955474200379902531,524288 --field-trial-handle=2320,i,14533737806991519404,15023095622284888245,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:83⤵PID:2760
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6244,i,11976978299447020340,199179551801108450,524288 --field-trial-handle=2320,i,14533737806991519404,15023095622284888245,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:83⤵PID:1432
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6344,i,4080245381858738837,17004421195109995421,524288 --field-trial-handle=2320,i,14533737806991519404,15023095622284888245,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:83⤵PID:1232
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,17097682427982704896,9664632838071125638,524288 --field-trial-handle=2320,i,14533737806991519404,15023095622284888245,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:83⤵PID:4180
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6236,i,10033402930858857559,6495522539994862526,524288 --field-trial-handle=2320,i,14533737806991519404,15023095622284888245,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:83⤵PID:2488
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6516,i,16525714647983741760,1136732089210294079,524288 --field-trial-handle=2320,i,14533737806991519404,15023095622284888245,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:83⤵PID:3700
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6472,i,3556464617353207173,67738521319499952,2097152 --field-trial-handle=2320,i,14533737806991519404,15023095622284888245,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:13⤵PID:4384
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7040,i,14234163882500780975,392077242003685208,524288 --field-trial-handle=2320,i,14533737806991519404,15023095622284888245,262144 --variations-seed-version --mojo-platform-channel-handle=7004 /prefetch:83⤵PID:2648
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6952,i,12096237977814143851,13566539215841587983,524288 --field-trial-handle=2320,i,14533737806991519404,15023095622284888245,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:83⤵PID:4536
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6828,i,11013203471444864229,12484203245667696004,524288 --field-trial-handle=2320,i,14533737806991519404,15023095622284888245,262144 --variations-seed-version --mojo-platform-channel-handle=7024 /prefetch:83⤵PID:4288
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6424,i,8621722522111438784,8118830022183884066,524288 --field-trial-handle=2320,i,14533737806991519404,15023095622284888245,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:83⤵PID:1700
-
-
C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.10-win-x64.exe"C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.10-win-x64.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3084 -
C:\Windows\TEMP\{AABECBD6-561A-4A7F-82E8-A65F3D1E6141}\.ba\wixstdba.exe"C:\Windows\TEMP\{AABECBD6-561A-4A7F-82E8-A65F3D1E6141}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{9B1294F2-A571-4AB3-86CC-DF0FE5CD121C} {EA4B8D77-5D57-4A43-BCED-E2FCC6679D12}4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2944
-
-
-
C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.10-win-x64.exe"C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.10-win-x64.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3328 -
C:\Windows\TEMP\{152B4305-1746-4CAB-B6C1-729A0F4FFBE2}\.ba\wixstdba.exe"C:\Windows\TEMP\{152B4305-1746-4CAB-B6C1-729A0F4FFBE2}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{6EFDEF77-9ABC-47D2-B0DD-A849CBBC5134} {B506D63D-4F00-401B-AD35-AB408EDEB893}4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
PID:4752
-
-
C:\Windows\TEMP\{152B4305-1746-4CAB-B6C1-729A0F4FFBE2}\.be\windowsdesktop-runtime-10.0.10-win-x64.exe"C:\Windows\TEMP\{152B4305-1746-4CAB-B6C1-729A0F4FFBE2}\.be\windowsdesktop-runtime-10.0.10-win-x64.exe" -q -burn.elevated BurnPipe.{3169D281-EB3A-46E8-82D6-A04692BA51C9} {D75B3841-47ED-4B30-BF20-357D2EDC8A58} 33284⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4920
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6616,i,14660206408714203078,4443086471017331239,524288 --field-trial-handle=2320,i,14533737806991519404,15023095622284888245,262144 --variations-seed-version --mojo-platform-channel-handle=6608 /prefetch:83⤵PID:4708
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6256,i,4582678379097530019,14074075071361839343,524288 --field-trial-handle=2320,i,14533737806991519404,15023095622284888245,262144 --variations-seed-version --mojo-platform-channel-handle=2160 /prefetch:83⤵PID:5000
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2820,i,4153172170656779496,15831700909266406177,524288 --field-trial-handle=2320,i,14533737806991519404,15023095622284888245,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:83⤵PID:1272
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6580,i,3564746909251476232,10520770495071503177,524288 --field-trial-handle=2320,i,14533737806991519404,15023095622284888245,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:83⤵PID:1036
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6116,i,3790422901192222498,14509039384065821447,262144 --field-trial-handle=2320,i,14533737806991519404,15023095622284888245,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
PID:3460
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4480,i,9033820325739747344,11868666090749237698,524288 --field-trial-handle=2320,i,14533737806991519404,15023095622284888245,262144 --variations-seed-version --mojo-platform-channel-handle=7156 /prefetch:83⤵PID:1824
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵PID:2316
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 6EF5A68D235E1585FB5C0A0E68ABE6E72⤵
- Loads dropped DLL
PID:5072
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 3F5A1DD63CBCA868C812E4E4145176462⤵
- Loads dropped DLL
PID:3856
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 68310BD1F5776438E176B4ADE400BD3A2⤵
- Loads dropped DLL
PID:2328
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 1D627F79E9F7271E7E57F7837781923C2⤵
- Loads dropped DLL
PID:3616
-
-
C:\ProgramData\Package Cache\{866BECDA-F284-473A-9E84-0CCE816BF06F}\windowsdesktop-runtime-10.0.10-win-x64.exe"C:\ProgramData\Package Cache\{866BECDA-F284-473A-9E84-0CCE816BF06F}\windowsdesktop-runtime-10.0.10-win-x64.exe" /burn.runonce1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\ProgramData\Package Cache\{866BECDA-F284-473A-9E84-0CCE816BF06F}\windowsdesktop-runtime-10.0.10-win-x64.exe"C:\ProgramData\Package Cache\{866BECDA-F284-473A-9E84-0CCE816BF06F}\windowsdesktop-runtime-10.0.10-win-x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.10_(x64)_20260809195634.log"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3336 -
C:\Windows\TEMP\{509DC217-D6F6-4C2A-B846-A8C4626AF1C7}\.ba\wixstdba.exe"C:\Windows\TEMP\{509DC217-D6F6-4C2A-B846-A8C4626AF1C7}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{1017529B-E66F-49F5-92FF-4C4E14F77D39} {E078DEDB-6C00-4B01-AD81-892ADCFA54B9}3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3804
-
-
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e58c830.rbs
- Size 11KB
- SHA256 5075578ba98f8c492843fcbd57c518890d06bd7ae32242d8ca702b536f95a5a1
- MD5 227725eaba0de794195b235e82e247a7
- SHA1 fe694ff6f08ea64a131da402785f76dce849f176
- SHA512 1b869f2e10c7b40219c594db7904750e474cde4568744ad46d76c84d8f38f548d2fbe1a503e58b2b94b1329432b178c21bf7a28478aae3448066f1a081eea0f2
- SSDEEP 192:SrKHCR6CbAtN5HnAl/ePvoexaRI1aRl1E+o5Ca35pbM:SrKHCR6CctN5HAUaoa9aM
- TLSH T1583242416614D2D3E9DB2B38D71727703B72D3AA9314665F05CCC22C8F8B78C5E64EAA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e58c837.rbs
- Size 9KB
- SHA256 3ed9be0d5fedaa93273cb221cde63581e22301beca0535e13c817a2b38148d38
- MD5 6538cb1a1ae736155e656873b4bbfbe1
- SHA1 1c923d931bde346937a725a644d53776133b5392
- SHA512 063ef828a9406c1677f8207deb1a648dba07736b0d089af1976dfc9e409c8f11370b44fb31faeb27b4f55f05c53bb85c89dcb66973662ca40e06b10416c46034
- SSDEEP 96:EmSDTTClrWS/eSbFeUteD2AyCsTlyyUteD2AyC6jMlN8gnuTlyfnAP7E5d7P/53k:BCnSFeAxiRIIiRP017EbnKCCi5pu3
- TLSH T1E3121012750081A2E9921B39C7173B223BBAD3D99315265F48CCF5F41E03BD92FA91DB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e58c83c.rbs
- Size 49KB
- SHA256 742de840dcc06cdd8e0446fbdc869b561755e9f52fb00abd7852e78d86f7b6e4
- MD5 2d9f723930d011554ad8b404df832b97
- SHA1 03e59c3ad6e30b6d6e68a148871bb7210ecb1f06
- SHA512 e80855a55458095a7a74454b9fd0a0160808de928c28fc6519239b61f87ca21f3d87320391c7fde56b7dab1c6ccbbbc2c6bed508e01be2544c736e288013438a
- SSDEEP 1536:LHZgOohW4wN5RaHB/LyM/ajqmuUHr92ha8u3tn2N8zRM9Wc/hihbZGXEpp4IQPDV:aNgeE+ZD
- TLSH T137335461DB08C0F2F9333DA26770F8847719C99AE34095AD16D60144CEA6EEEDEBD1E1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e58c841.rbs
- Size 71KB
- SHA256 f7d07d3c65d6a33ed38bdbf97275a74ddadad48e93c20017a5060e28a7d58326
- MD5 68ebbee849cebfabfa9c2d18cb585be3
- SHA1 76eadcddb664c270fa553b2e73230d74a89b2fdd
- SHA512 110097f12f78fddea3eb3ac082ebbffad4b6da6694847783dbc8c9200c4c160a2665a3d2cc508a1df69ab8c4d339e555b95d4f2a25062d264a384864dfcee422
- SSDEEP 1536:NlTX+EvElgJPlhUR+6svby5ybcmb/WrPMmq0mgG2WdDfbH9cMWmHDCaJVZ/KoLHg:xu2z+LmEEiycECCoeWr
- TLSH T1E96325BA7A14D1C1BC732DD457BBE916AD054C7393608D2E63CC4029CDD2A86EFB86E0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\chrome_Unpacker_BeginUnzipping4632_135472699\manifest.json
- Size 43B
- SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
- MD5 af3a9104ca46f35bb5f6123d89c25966
- SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
- SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
- MD5 SHA1 SHA512
- Path C:\Program Files\chrome_Unpacker_BeginUnzipping4632_328165395\manifest.json
- Size 135B
- SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
- MD5 616eb6b585f16811dc5db5063e088cd7
- SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
- SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
- TLSH T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\chrome_Unpacker_BeginUnzipping4632_462768834\manifest.json
- Size 160B
- SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
- MD5 c3911ceb35539db42e5654bdd60ac956
- SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
- SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
- TLSH T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\chrome_Unpacker_BeginUnzipping4632_60317548\manifest.json
- Size 165B
- SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
- MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
- SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
- SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
- TLSH T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\dotnet\ThirdPartyNotices.txt
- Size 77KB
- SHA256 deb4427a295e1ed474b0d81c5a0d972c1b550b9a715cda939cdfa9236b1b418f
- MD5 0d8867a25ba926e6e40cd52ab3536b5c
- SHA1 89390dc8b8318d0bfef1c6a2fb4783537e28a465
- SHA512 317ca335405274f4f91b173651ca2826760acb5ba5cf41aff51adc55c2cda9059fb268333665f13f62fa48119e55a303720a780dd58d28dd9967db4c88407d61
- SSDEEP 1536:HA9jHwsGfgg39/zwgAVkguQxrDjugtSEGepkWvrpX7anuqdLSVnfiStPq+3LefrL:HA97w/ogz1AVxuMjHtSFULryLOgrGWm+
- TLSH T17773A45F7E45077319E2C3916569A8C5F22FA02E3B6B2A44346EF248133B42DD6FF858
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 163KB
- SHA256 4377f10c78400f0370b88156773de9843c07f14e65b3232005ec3179ef38d463
- MD5 363603c51aa522bf21b2e8320a51c54e
- SHA1 b4dba9e0d47c9fd4636549d5a23fe1a96faf9b1f
- SHA512 b2b045ad8538416bd81753359ca86ba956f2ac99befeb89c7c03993741411703e03f4373d11cb94992cb93ed569d6741954111f4ad519daebcb18138800877ce
- SSDEEP 3072:oGgPYwruvTSBbQ/fp4SbDqIG/vk7l55wK9vLPg:oG4rubgbQpDvqIbt10
- TLSH T1A6F3F61AD65811AAD06E9575CB428941BB337C668BE0E3CB53C0F9BE0F726905EF9703
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Package Cache\{866BECDA-F284-473A-9E84-0CCE816BF06F}\state.rsm
- Size 1KB
- SHA256 b6e130620798f7bd39306cfbc54f351c279631f45fbd737ce808a23cae1ed732
- MD5 4cc167ee5e80c908f3cec20447c9e1c6
- SHA1 da9a58fa7558f93c2d9a332255b892eabbf1d56f
- SHA512 24ad1747636e8100341677bdd1dc3cc29a3722aa47797be0284996f908f4c7e83255d72063dee7528eae646fb148d4b9b6fc5194212c6bd600ff7a418a8b6984
- TLSH T18321D1515BF6092CF3F6AB3469F96665443BBC121C24C26E0001318A9E32BD0CCB0B37
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\protocols.json
- Size 3KB
- SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
- MD5 5e2067a92dcfcb05537479c384a89725
- SHA1 eeed29b07d865ac4d46629fddadad629d0ad4e2b
- SHA512 c96c5f9cb7a169ad91b070b567cf9fa8f35951ccc5aa930e97dbeccbeac27f7e9dde1379138c9ba6b0d10339f9cb053ef21f19f06d7560f97d5d23a27c8ed4f6
- TLSH T17D7184B7862088194E360AB4AA0DF10DF93702DF2AF598D3B27D455F1F712BB3946249
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 92b83a0e542b7bb3ed324c35b5f2a40c47a6351981065b804e4d9d80ddd6d7ee
- MD5 9ea20a12d0c030ae7f84014f382662b7
- SHA1 7912569189cf07c1ce092a268e67e9f391b7c8c7
- SHA512 39ca414f13163c8479fe7650ae0dd1607b267fe3f319c09aec7bd5f68448e9ac604351069bf6b166b3f897d3afb5d7f35e609b9fc72b9debbcb05bad8fad7d81
- TLSH T132D02B20FF04E002D1072172540047100E0848902093C140E030441CDCEC804D395307
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 7d64d2777f444a09968d6c155732e22d743fcf7c319c222bc06f6bb97808e489
- MD5 89bc5edb6bd922f1cf8ec5536b066fa6
- SHA1 c50aaf0fe1444780bb68ee7ab6e1c7468c2f303e
- SHA512 77a1265c1484940562f1514202a0072e343efb323e1dcdb979fc9b7a2c69d85b814c076828b260c0b86a19e482ebb0a2df850f9b7c130a327861a7c56e26cde8
- TLSH T15CD02B20BF04E402D1072172540047100E0848902093C241E030441CCCED844D395307
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 3KB
- SHA256 5e5c82e7eb815d8280786fc207f9b6c98e45f15ab33886070b6b77568b8ba3e3
- MD5 062a17d65974d58c8e3781581a89ce89
- SHA1 ab987de5b1ff95dccadfb41a404f00b4eeb779aa
- SHA512 1b89e08c1227e6c2996dc14e9ffdc6cd3a260ae9661d0f3eef2d014f9d6631ce75d3fbd8d7e5b202a5d317a8ba6fa062b7f38652b6adf6e620704a80701e8100
- TLSH T12F717F3A065538E0EB32427367D2274074378ACDFE27DE6BBC507BB81A5635DE11812E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58b4c4.TMP
- Size 3KB
- SHA256 2bf0a3fd7c0fe016577b339f25b2b01ad8722ab97ad609844876a404d31d7ced
- MD5 da8f5c91ca41d5c85c99f7a33a50e14a
- SHA1 073e5a0b3bd57fe7d8efb9c1a3ee60f00d6ca833
- SHA512 86408ba851b234fbfddbbf2d52a7b80c553382d9d8a26699957a41f9a041a68198d78ba68b93b7f35bc97e20373bfbd37dcc1eebe61051bfb8927f1517a81e63
- TLSH T16F616B73021238E4EB324273A7E22744743746D8FE6BDE6B7C90BBB81A4535DE01912E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
- Size 2B
- SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
- MD5 99914b932bd37a50b983c5e7c90ae93b
- SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
- SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
- Size 70KB
- SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
- MD5 efe54a870e0f5ff28d7e00036b861065
- SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
- SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
- SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
- TLSH T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 81e272f819c1d2625cfc710f0722167dcdc4cd89183b45fdcb9d76062bd7efd4
- MD5 b605d34b36c76fb9b6599533bc856466
- SHA1 3a4bedc942073b1a8264e6278b410519da589ca0
- SHA512 22169cd63678687d1a76f3bcea9b98ae12c041af199bea102402b0d67d54c28d0c1ad90c0921c214ea347f211b6e30c4ef9139b9c45fea269ba9bd0f73c94aae
- TLSH T159519CF787E4856E8A1196F09A18AE2FDE2C0615431C7C6989D4EE27D3E3472E10265F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
- Size 111B
- SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
- MD5 285252a2f6327d41eab203dc2f402c67
- SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
- SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
- TLSH T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 13KB
- SHA256 bf0da0eda372b71618b915b8d3a94521220e9c7f99f14f4048ef70aa857b2013
- MD5 614384cf47de144d90dab3df97d33f05
- SHA1 1e043481872ef65688937dca7e32a70cb685dbb0
- SHA512 b6dc9e2afc76fbaeb54fb938e1d013a5f092629212868f92d83fcc64ef224e33543b5cf12aac4984713044f82e7bcc2ee0d5cf0bf7d92e33a237273919ecd1c7
- SSDEEP 192:sxZ2RnyM/jK1Ml8Mzx/fCsnst3Fu0SPVDIdpwSHW6+WNr6m/AAvfVjjvIg4J:sxZ2jLx/fCsnsRPfHb//Bjc
- TLSH T14D520816AA34A977CCCBD309F941BF53D6F91462D6901E549AFCDA1C00E7AED220782F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 14KB
- SHA256 26d61007496fc884143d4d0237c4dc57d346fc7a28839b6f67e97422c8e0c8cd
- MD5 9dacab5a4d021c98d88fde4d9a3b06a0
- SHA1 3cd5670564696f001378bfe52914c65c2d5a10f1
- SHA512 b6101fae800fc13f13bd6ba7661d1b34c6443a07e20b3c2a84725c1a7f4e2ba6f517cd85ce984f693edbfda478bcb7e8d4b54bc2a414323f72e21be5ec9eb762
- SSDEEP 192:sxZ2RnyM/jK1Ml8UQVmx/fCstJt3Fu0SPVDIdp6SHW6+WNr6m/AAviMKjjvIg5oJ:sxZ2jqEx/fCstJRP5Hb//Wpj+
- TLSH T1CC62F816AA345977CCCBD309F941BF53E6F91466D6901E54AAFCDA1C00E7AED220382F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 14KB
- SHA256 fd1b890f2fa8f03b95f876db257724722a3c90fcb58ef1faa3c6b1f51c8d18e8
- MD5 5f313260ff785f227dc1c5e2d5381759
- SHA1 639d353b27e163019540a6bce62743ae03e57766
- SHA512 8cd108b0abacf81bcd7134e34a6f1c83f711ef0e7b7935c8ac5f7a962039c643e22004b5a0d9d73a01da3ac3faa6e37bf8fba3ee51d5511c4819fb38f1cbd7e0
- SSDEEP 192:sxZ2RnyM/jK1Ml8Mmx/fCstJt3Fu0SPVDIdpwSHW6+WNr6m/AAvzMVjjvIg5oJ:sxZ2jux/fCstJRPfHb//3cj+
- TLSH T1F962E816AA345977CCCBD309F951BF53E6F91462D6901E54AAFCDA1C00E7AED220382F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
- Size 35KB
- SHA256 baf5177f1ea921471a05cddd25354cc6df639db4e4c3d014edbe9c2b9bb2b1eb
- MD5 dac864d9e986393cca04fe192a4b03a5
- SHA1 8c6eb1f5a13b973f41f7acee2c81eea82a1b6106
- SHA512 92110cd1932ac996b9202adb5ae674c21c600ee8079d86f7ffef0aebceaebfe78c2934d26e2eeb7933d0636a46fea7f8da030c341c9de1cee2757274ce340489
- SSDEEP 768:MuseJya7pLuLfhxWvhfyn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVlHVcLly0ppzro3:MuseJyyEfhxWvhfynu1jaAHVcL88pA3
- TLSH T160F2FC3B680CCB7E4F804E9CED2A7F9A6EE8018F96D8895447F9940C02C76EB15175DB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
- Size 4KB
- SHA256 a767a552071a7886e62b40745b314a2a83eb1c5577a5857008eb28fdf8caf758
- MD5 8ae8075237d10af0a24b2c278d64e0b0
- SHA1 5a6ffbcdea556313a023369b867eb8d0bd6fe48c
- SHA512 a8eb34886c9d368552a922199ac783cc28db1d56124f2505469de62b6d24cd92830836e1a90208f48ff69f2b883d207fb06abdb75d634a6d7c49f16c7e708ab0
- SSDEEP 96:KYH+KggmArM/LRZJ2TZy9JL2KhTJV2ljrKFrnmTeKso+OU:49zT9Fr
- TLSH T162A13412357F02023C7F648CA6A5993A8E4235A375E8B46FBB680856CF67D111DFC8DD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
- Size 22KB
- SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
- MD5 f768bcb451a187c18099961c484eef8b
- SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
- SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
- SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
- TLSH T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe591e6b.TMP
- Size 3KB
- SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
- MD5 904e6e94a1d46374c8630cfd86cc729f
- SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
- SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
- TLSH T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2026.6.5.1\office_endpoints_list.json
- Size 9KB
- SHA256 f0c77aaacfc571e0bc3f51387febe134d991bf3c7f1941af303ed901f288dcd6
- MD5 30719122f9edf4e23019a3b74e4f4325
- SHA1 6707d64052797b9c5f1a5ccf016e5859c8ef898b
- SHA512 ec2e1a33fcd1301f282512ffafb611ea705dc5df09d9aee014276909c1b62b0c73600121d94e9b6d9e160296672b41f2cb8c3ba23f121244ad2ea6521680723c
- SSDEEP 96:DdQ/JJvwjyUsrdfsysVsnQfbJNZidYusysXYs2sFsdv12XvlRT07s/DkhcrHPglW:D7d7mfgiIWRcV4sobxezQd1Y
- TLSH T11512BB3BC4B49F229AB060659705E244F13C43BF5600C6FF76B9829C1F366ECA58E1E9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 26KB
- SHA256 c21ec44ff238bb68f0a8a09b5eeb1009a4ac9c9de64d1091333a12f07b0e342c
- MD5 45c8676005b7c44d03d4a8716472a917
- SHA1 c64c1932555cb5c8b79f0501e9d299eced7df5b4
- SHA512 984c1c7e27db6fbd25296948fdee91068af2679a5d9661f522c7884c26a19298a01885d846ccf6df7229d94eb41781814db49eed42c881dfc8ba0164cddf3e56
- SSDEEP 384:n1iFkZcIeWsNZ8TUNTUlIlfUr77z95I5DfxklvhcRf:8FCbQwgIr+k3cRf
- TLSH T13DC285F198D7893AE8AE5783A77D2E429EBCD067B5844990F7D85D0CCC825BFC306816
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 15KB
- SHA256 8fa6d4b43c9cfea3165daab6f4b682701a824d73c27d189d45cc0c12059f7013
- MD5 e5e79a9c01947aa3da2267b010106299
- SHA1 955e0c41752e250d32b8bd2776efbd0bef20fcfa
- SHA512 16a540fad59c1685daad69f915c4da6d954a512bc812d219476c4bd3dc4d2e36877dfb4cefc84b5e2ea85bc6458d169ce1e6c776bd289b3a86aab90ea30b5bb9
- SSDEEP 192:uuum+xasuheOwQxMGsNHaQV1rGM7D3JQmiU1gCX4MTxQClqyN48z1kql8R1Yy:ntZcIhsNHaUr77zn1IIlvxcRf
- TLSH T157625C719C789D3A99ABF241F48A33135FF860BBD9C45F50E5ECAF1D0096658130B92B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 8KB
- SHA256 c6e2053c3c8001f9678c273e13616ed77beed2f202bf98e9161d34ccb8565aeb
- MD5 4ed2d7cc3622815fd42746ae4fe5e438
- SHA1 a8b048866c22a391ef1419906eb0b486d2fc9433
- SHA512 660b4e9e2bc5426806e6ff222a69550c8be55bc9d8ca96b3cc5d6ddb65ee249085e341a9744b61dcec2ba4d927b10eee24776eb30c9016ba1be205d26018138c
- SSDEEP 96:eqONkPQsjpflMoUZre5ih/cIPURHl8h4otop50ODeBjPYvlCr5pgz6qNGemL5XuO:lONP6vMtPQmiUyleThTxQClT847VLU/u
- TLSH T1C402E835AC686C7BDAA7AE45F48A23172FF4606FA5905B50EAE82F1C00D765C1307927
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 15KB
- SHA256 7968bebcfb0b457db4ed93712627f44d32c5f782752abe4a20c5751fc59431f8
- MD5 d4a58c3466c6b0d2cbb3685a11d60980
- SHA1 492785d1eacd94a98d3da79291002bbe0a2f3eb3
- SHA512 e53545a504a03372c7452ead33260d4ff394081a0df4171dc4738e8ae46489ab92daa324ab08191cd8200334e2fe0efd0195253e4f231e171afddd659370ad2b
- SSDEEP 192:uupPo+xasuheOwQxMTsNHY6QV1rGM7D3LQmiU1gCX4MTxQClqyN48z1kql8R1Yy:nUZcIIsNHfUr77z91IIlvxcRf
- TLSH T1C4725CB19C789D3A98ABF241F48A33135FF860BBD9C45F50E6EC6F1D0096658130B92B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 9KB
- SHA256 875feaea182e7b59e4be10f387520b4db32b10d78be33df1edd900b899d36d96
- MD5 ef82b115ef77ac910187713dfbe3e339
- SHA1 680aca4589329c54c76d7f59fe6bd1bff481a98f
- SHA512 f7535ad2671bed44b5b6025b9506050930dba2f1e6a6403447cbc94cf1b037860c27aae22f8a6f12e75a09975684cfacde9aeae089478c1e2ea0f2373f00e43a
- SSDEEP 192:oONq6vM5PQmiUyPe4hTxQClqyNH80Ikql8U/u:oONq6U5Rf4blvYcU/u
- TLSH T1B8121A75ACA89C2B9D97B541F4CA23976EA421BBDCC09F10FAD82F1C00D764C270B927
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json
- Size 2KB
- SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
- MD5 499d9e568b96e759959dc69635470211
- SHA1 2462a315342e0c09fd6c5fbd7f1e7ff6914c17e6
- SHA512 3a5922697b5356fd29ccf8dcc2e5e0e8c1fd955046a5bacf11b8ac5b7c147625d31ade6ff17be86e79c2c613104b2d2aebb11557399084d422e304f287d8b905
- TLSH T16B51DB73D5988C4B9BF4A29CE919A309F11107CF75D48C0B76BE010C1F7757AB5C6588
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
- Size 372B
- SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
- MD5 80c2dfaf9affc09798a4976ae70f1b0b
- SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
- SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
- TLSH T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
- Size 252B
- SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
- MD5 880fe67d2d8def8a73d1f09d09f8f2ff
- SHA1 adad7fdd0652919461f89bfe36b449081489052b
- SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
- TLSH T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
- Size 132B
- SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
- MD5 f5a3b29f9a977e23d6ca4eb728238f9f
- SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
- SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
- TLSH T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
- Size 492B
- SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
- MD5 c1bec3bc77db46888e279f8b3eeb18fc
- SHA1 c2d14f387c796193ddc6378267768745c10dae14
- SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
- TLSH T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ea4af91e-6581-44c6-8d39-2db2b7d4fca8.tmp
- Size 13B
- SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
- MD5 2aa9e263ee3796d9ce358460a2451b4c
- SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
- SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
- Size 2KB
- SHA256 1a9419c9d988a2420937349892ff15894c35a62c6be3163bbe8c7c493ce99633
- MD5 ea36f48409be5cc2d3db8a96348ffbb0
- SHA1 81fc9ad18dc14bcbc92cc85d0699492c612b7522
- SHA512 8152af60df47bd431229ed236f4c236caf750a0ee2836ac11d3f41b44d89de6ac58901866d0ec515d760290b2a8117815bef9f21c0c1ecaa9712b03e1c170e6f
- TLSH T17C41185CA6F91148B3B7BE59ABF6A86D487ABD332E07956D00110D4F0672B40C9A2B37
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\37c8b7d6-0b61-4393-8429-89b683239afa.tmp
- Size 1B
- SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
- MD5 5058f1af8388633f609cadb75a75dc9d
- SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
- SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.10_(x64)_20260809195634_000_DotNetHost.log
- Size 2KB
- SHA256 e7d7271be9dcf70f817287aa38efc360989a0b776445d4e74ceaa18cd82872c0
- MD5 f4fa938044643cf4441e75f449ec0cdc
- SHA1 0c0bad3f54eaf224c69d997d384f7b50d994bc1b
- SHA512 9309133dec6fd95a273aab50f3fea5e3a04157e6320164abfcae8631f9b270195b2584bfc9c5b8d4473a2ed690aa0192cab789964a6f5991d7e7cc8015e7ce57
- TLSH T1424105542EE50854B1B7174BDAF3C4566B33FC87A834CF4C2345832A06BBD0668ACB6E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.10_(x64)_20260809195634_001_DotNetHostFxr.log
- Size 2KB
- SHA256 90439949a88f661d9ed21d40b6ce737953c20898e291c8f592c3448d347637b4
- MD5 efe193e0bf3eaf70c92ef2d7d5b49056
- SHA1 18520808e9273aa4dbc279d56e3be172bdd3d32f
- SHA512 0ea663f8733d106f1272a148e78b6de6e6a52e5354ae4e19daf3804aac07f2e1aaf8ec06c3293737eebe2cb475b2048de38f759a4ccac5804a568ce874b41f4a
- TLSH T14B41E1541EE50916B1F75747EEB3C4616A33FC866934CF4D2245C21A06FBD02A8ACBBE
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.10_(x64)_20260809195634_002_DotNetRuntime.log
- Size 2KB
- SHA256 5882873da32a1429f09e852e68a0874e848d2f5f91d7ad9d883b0e003fe18351
- MD5 8b80fc4496cb1b181d7c3df05a8abd74
- SHA1 c9f78bab1f704e36903aeca38230c528072d1a40
- SHA512 ca0a991601ee457e29083997cf66f98931a7608f06e82ac4a9dcc324564da51f0afdedd81df995f1c4a3c34c2e8f033f8b44d086d93315fb836c80497185b2d6
- TLSH T15241C3A41EE50905B1B61747DAF3D4527A33FC8AB934CF4C2745431A06BBD02A8ACB6A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\d09ef5ec-3985-427e-9c43-9b415543d7ce.tmp
- Size 10KB
- SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
- MD5 78e47dda17341bed7be45dccfd89ac87
- SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
- SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
- SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
- TLSH T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4632_1996896098\CRX_INSTALL\content_new.js
- Size 10KB
- SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
- MD5 3de1e7d989c232fc1b58f4e32de15d64
- SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
- SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
- SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
- TLSH T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4632_24455060\b57135a9-f0c2-41f0-b472-1768ac5fe0cb.tmp
- Size 153KB
- SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
- MD5 c4a20d073fe58488935da829aae6fa17
- SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
- SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
- SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
- TLSH T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{152B4305-1746-4CAB-B6C1-729A0F4FFBE2}\DotNetHost
- Size 1012KB
- SHA256 03eb33e8eb7746542febda19278dde1c7bd496396a69a9d625a05f9506a1c3ee
- MD5 667bbe018d9a8052f0ed4d4b44a02ec8
- SHA1 9af6e69d606a4741ada8a58f36b9c06c9cf22626
- SHA512 5e07d476569a3c7bf938278adb2b710be015698e5c3f01a5aab2db319d07b8ea675758aeb201577d3d51394550c313dc4bf401397c44f846154fcec9a445c073
- SSDEEP 12288:SN2etgX0xsm7HrObWMInYLE/BbdJ0zErWolCJ9TeWxqYZfDvXNM:i26gG74W6WBbdJwEqECJ9Te7YxDXN
- TLSH T1A2256A1BBFA404A9D8B24E75C5B78321EE357C482320969F43A47229DEFB7D0647A7C1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{152B4305-1746-4CAB-B6C1-729A0F4FFBE2}\DotNetHostFxr
- Size 1.1MB
- SHA256 da12be59d35710ff0082f3506e84d741c00816290ac1d3093078e7c7b4ec2d51
- MD5 ecd6f2e85cdb3623db79832c198448b2
- SHA1 48580a0e26d28d8c3ec0c0418e1896eb70448285
- SHA512 4764485b64fb4bb7e3c4e28678e172c84cf9f67a23a905a0cca8f9c4522cf404be3a5dd6cc23d3dd6fb96ea2bd7dae425ca36adb80324ec795ce560806575fa7
- SSDEEP 24576:626gG74W6WBbdJwEqECJ9Te7YxM6fA9Ac:626748BnwEpI9T6Yu6lc
- TLSH T134357B1BBFA404A9D8A24EB5C5B78321FE357C082320959F43A47229DEFB7D0647A7C1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{152B4305-1746-4CAB-B6C1-729A0F4FFBE2}\DotNetRuntime
- Size 28.2MB
- SHA256 4af98ab9168f319b9d026e01bd6e9df577799a222b04454579053a5a00abd555
- MD5 8fe07617a818797bf2170e4ca5f4bb95
- SHA1 126523726901f0a1129d9066c369f963f1ef5854
- SHA512 75544a3a9bff83e7fed005ecfd0847ce32442e82c53879097518fd03ef4f6d8364bd5400912613d1eb33f6ae1e262bd1a61087960fbc6655ecd03260072bdaea
- SSDEEP 786432:Tg+OS4VhnxfDEAOZGc3PHDOsz1tHDypQp:TF43nxfYnvDOsqu
- TLSH T12A573397BFA408A9D4A24E71C5B78325EF313C182721C59B42607669EFFB3D464BA7C0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{152B4305-1746-4CAB-B6C1-729A0F4FFBE2}\WindowsDesktopRuntime
- Size 28.8MB
- SHA256 024753cf71ec777cf38c82c29bfaae467ab554086d1cf6b34f5d850f61a16c28
- MD5 b76d067851e1d31cc6c6f00bd68d078b
- SHA1 1a83f1fca787b802f03b12c60cea0306b64eda1e
- SHA512 c1551bc40c04b552b6925675180fdb69bd00e4282bbe5c3ac6db13fa49a2786f430171ed7379f7bbdfbecb998297fff54ecb77db6c58feb9f8a1196d112d155a
- SSDEEP 786432:Kl8TBZmSPFbeIQhCxCLWcSEDm03uCoE7WOF:KlGZmiFbVQsECcSEdfS
- TLSH T19B673367BF9018A9D87B4E78C4B783649E317C192320AAAB47607619DEF73D451BB3C0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSID50E.tmp
- Size 392KB
- SHA256 a28ed81b8594774c7e1e82f9bbe858c3b36f0d7a93067001387a5a872288231a
- MD5 f1fafe5c54813a5d7b60d08b859bd58b
- SHA1 95e6598ce1c02220d68edab5474980b7f0f0a12c
- SHA512 6dbc8b10277c6fae8d7ba961a843810df0bb11c9c6e3ba54eea1b24e13b1069e454ef5d76d345839a32f94871855928578a15948ba242d03c990b21d8f845df9
- SSDEEP 6144:u/VbdUw0z9ursTolCJSqJiIUk8AeWNxFqYrtUc06N:u/VbdJ0zErWolCJ9TeWxqYZfN
- TLSH T1CC846A29F7E418EDD4B782B6C5A68030FF75754D332095AF8BA845291F3BAA470BB701
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\TEMP\{AABECBD6-561A-4A7F-82E8-A65F3D1E6141}\.ba\BootstrapperApplicationData.xml
- Size 9KB
- SHA256 b1eda1e98d843eef81232344754cdc0973d9dda1c1790a91a352c167c9a64ca5
- MD5 5b54f26d64fb1f7e82bec5b4ff190ba2
- SHA1 11d8be75fdb2bded9b835a2d0f6e5bf1848e0ce6
- SHA512 3418f51296007c704600edc69c91e26c23e8e159e0a20aadeae06d010c80cb85cb4d86517d9fcf6ec5b150578311cb57592eb220ba0f93c7512d812e29b83fb6
- SSDEEP 192:2/zaT1c/ovY9qnpijXjamaD0QP7XsCsysz:9sCsysz
- TLSH T1A912D4112BFD0218F0F3AE48EFF6A4555A3ABD552E39C92D01301D0F49B2E819962FB7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\TEMP\{AABECBD6-561A-4A7F-82E8-A65F3D1E6141}\.ba\DotNetLogo_256x.png
- Size 2KB
- SHA256 0f571f95d8eab48dbc81b0ec5e9f7225e349e26ef50868bfaab556f3c2443b01
- MD5 39aa52615723b782c92dec710caaec7f
- SHA1 760b49e256a7979fe50a56a2b1be3688a474b886
- SHA512 89d1baa3820154667747b25e9e2fd321bfb2ec71dc309915b0a28dacdc80822a4943b639ebb37c37bd2559d5a4306d2096119cd970c84a0d331f6c68b0456dc9
- TLSH T1534195CF1BFD78D7E6E557918E1A8DD232738483B4B3A42CCE7B10B8274A5642B87940
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\TEMP\{AABECBD6-561A-4A7F-82E8-A65F3D1E6141}\.ba\dotnet.ico
- Size 44KB
- SHA256 61a2cbd12868cb9b359e0c78961d409b7875f072eb8e53ea88d3e6bfe2961a18
- MD5 b8096652d9ec286709a2c863b244b110
- SHA1 b3b7f0f4d608fad7cb59ba499d4d17c2b873a7af
- SHA512 492a5aa83220bb77c178b7c5b50bf44968c0427e9e45bb97a33df14d7fb4c667ca7adde0ebb3874c7b6011057b01144e4e6651fbad62c6bcf5e0b93586c4bc7a
- SSDEEP 96:r+gfbzo+wHK9NbwOY4tIWQeVlV1W9+H+guapUjFamINUItzf1dBNaIZ:ro5HuNcH4tIzeVlV1WEOFDgUWzf1PIm
- TLSH T1E913EF6DE68547C1C10C2032DB4AC792B5233C72E4DAE0C4F9D4FA7E177906965C6E6B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\TEMP\{AABECBD6-561A-4A7F-82E8-A65F3D1E6141}\.ba\thm.wxl
- Size 7KB
- SHA256 b00edd703dd8a475119d0e4dd70a3aaa47f0e95361af290e76d367a8edef3432
- MD5 8b2c667a8bbad3153068c0ed90df7ec4
- SHA1 c9e04a3a37e5e6262ab9bfecf78280171b8f7b74
- SHA512 5269f00d474acccb4c48cb7bcfdf19e63557a388572d3a6335aa39191319691d924e27f70da3f3495387c319396476c63a8fd7b35835cca0901220e39783847b
- SSDEEP 96:HiTgM1+XSNEzA0HtYQstYCpCwZQpCeyk5HQJM9ouvj9urz8:Ew9EmtYQstYCPC9e8
- TLSH T191E1026F68DFDEE03A732651B2B3698D6919C29A136F1CF0F869084B47635016377A03
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\TEMP\{AABECBD6-561A-4A7F-82E8-A65F3D1E6141}\.ba\thm.xml
- Size 11KB
- SHA256 dfee8e2d075087227f19c835c145c5bb8e72a46880ea24080bb2472fd3a521be
- MD5 4329e418dc56b1386d7ea29a0dcfab5b
- SHA1 58387f92e89ca21b4179fb697c7de9675c59142f
- SHA512 6934873d27e6efbb94da4f13ee8369b29995490051016fdf82800256b924902306d328bf1d4ebbf266d1a53eb24adb6478d1a67de4ecc3e3bcbe561968f24922
- SSDEEP 96:HgvPkoeWEH3IWTaQfSJgHzth5mFahbuB8pR5+Vpwe+UIJLg1gEp+6F5pQnxc:AvoWydmQfVHMyyj5Z
- TLSH T14B42FC6851DC7811C532D702AB9371D3FF12BDA6C6C85A58B48E256B1FF262028B739C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{152B4305-1746-4CAB-B6C1-729A0F4FFBE2}\.be\windowsdesktop-runtime-10.0.10-win-x64.exe
- Size 967KB
- SHA256 47b74e25c31fceb862dcc4496af4dcce01823094997aba1e88eb936013ffc2f8
- MD5 0f57602b1b78b077a5b0e996ef306a7d
- SHA1 4c86ca072878cf03f66be4dc721a02d5c6fe76d2
- SHA512 b28e50f9ef8debb5e25af797cc9a7ed6882f08425c595ce36eb6d48e0b703c17f619151d84a6d1b8dd8b5f7affc231c19790c46d6224b94279de5a5c568aa1a2
- SSDEEP 12288:OVGWl6qCmyZeU6lqlDjC+fScn6X8GwMgJEkqd68Wr//f0ZoiDqIMjFqs:OVGWl6qCmyt6UdmcpMzrI58lDqPxr
- TLSH T1B4257D31A166242BD6F50973F914D2307E28D7082B5C99B6C6C0DD0D39689FA6FFB24B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{AABECBD6-561A-4A7F-82E8-A65F3D1E6141}\.ba\wixstdba.exe
- Size 431KB
- SHA256 2b1cee5e3e24593247854eb7a7c4308937b9c607754ed2fb83520a8706c26f1e
- MD5 0e88ffd2e737ac9b9a4241616838bc23
- SHA1 3c8beb465d20bcef0cd6ceca9c60286d1d15cebd
- SHA512 169b9e08518834c9bc5adfe4ab7b79e07685b72f30ede1c1a386229668bde8c15da378e1274e4013ad7b84d6f7a5acc64ef0806e3b8a66322861efaa7e26b620
- SSDEEP 6144:X9vfS1NP+c3ytxmg4Stlqe3B9m2LSLTwGw7C3ZLaov5xZvSdF:X9v+GIyugllqe3wwGfX5/SdF
- TLSH T129943B3165F04037C6F90572AE14FA31BF69F208231095EBA3C0DD293968AE5BBB7657
- MD5 SHA1 SHA512 SSDEEP TLSH