9b0d29a5d8ea5a3bba7b86dd44ac6dc59c96f4cb3b6402c797becdfba642a893

Analysis

max time kernel
899s
max time network
879s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 19:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Unconfirmed 515131.msi
Size 6.6MB
Sample260809-xwpcnaca66
SHA256 9b0d29a5d8ea5a3bba7b86dd44ac6dc59c96f4cb3b6402c797becdfba642a893
MD5 046c2491e0c3a14aa78c5c66102447e7
SHA1 86f5dfe93183c33044ff1aff4bdb5962d38ec1a3
SHA512 bc6bc7982c3a782d9bf36ae44a33426cbddb3aa54be86207847c89b9e7c078005a22c95eca0a97f99862cfcfd97d4b8d9b6ec131cc4ba56fa4be1d20a1259f67
SSDEEP 196608:At2hzUaRxVIylRM6SeeYwCwciQYE6MCeORIlx4:hlUUTjSPfXObae4Ilx4
TLSH
T1C666335B7EC5C222CC256C3B047BCB648628BC109B69589372A0B36DDDF16D05FA6DE3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery ransomware trojan

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3768	ahc_launcher.exe

Loads dropped DLL 1 IoCs

pid	Process
2000	MsiExec.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ahc_launcher.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\ahctesting\ahc_launcher.exe	msiexec.exe
File created	C:\Program Files\ahctesting\Uninstall ahctesting.lnk	msiexec.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1912_363858096\Sigma\Social	msedgewebview2.exe
File created	C:\Windows\SystemTemp\~DFD12EB28D0FC85694.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1912_1723519451\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1912_363858096\Sigma\Advertising	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1912_307242169\manifest.fingerprint	msedgewebview2.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1912_1075565048\hyph-ka.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1912_1075565048\hyph-uk.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1912_1231640693\_platform_specific\win_x64\widevinecdm.dll	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1912_803150091\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1912_543785317\Part-ES	msedgewebview2.exe
File created	C:\Windows\SystemTemp\~DF09C6704A48E0B041.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1912_652008218\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1912_1075565048\hyph-cy.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1912_803150091\ranked_dicts	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1912_803150091\surnames.txt	msedgewebview2.exe
File created	C:\Windows\Installer\{48402D93-FC77-404D-8141-F2C0764DD5D2}\ProductIcon	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1912_1075565048\hyph-be.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1912_1075565048\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1912_307242169\crl-set	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1912_1075565048\hyph-gl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1912_1075565048\hyph-hy.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1912_1075565048\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1912_1231640693\_platform_specific\win_x64\widevinecdm.dll.sig	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1912_1339279535\kp_pinslist.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1912_1339279535\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1912_1339279535\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1912_363858096\Mu\Analytics	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1912_1075565048\hyph-lv.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1912_1075565048\hyph-ml.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1912_1231640693\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1912_543785317\Filtering Rules	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1912_363858096\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1912_1723519451\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1912_1075565048\hyph-mul-ethi.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1912_543785317\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1912_1075565048\hyph-bn.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1912_1075565048\hyph-de-1996.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1912_1075565048\hyph-mn-cyrl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1912_543785317\Part-DE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1912_363858096\Mu\Social	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1912_363858096\Sigma\Fingerprinting	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1912_1075565048\hyph-et.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1912_363858096\Sigma\Cryptomining	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1912_1075565048\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1912_1075565048\hyph-pt.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1912_543785317\Filtering Rules-AA	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1912_543785317\Part-FR	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1912_2083911723\manifest.json	msedgewebview2.exe
File created	C:\Windows\Installer\e5a0a35.msi	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1912_652008218\metadata.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1912_1075565048\hyph-es.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\~DFA629BA57DBAB1BF9.TMP	msiexec.exe
File created	C:\Windows\Installer\e5a0a33.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1912_1075565048\hyph-de-ch-1901.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1912_1075565048\hyph-gu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1912_1075565048\hyph-la.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1912_1075565048\hyph-und-ethi.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1912_803150091\us_tv_and_film.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1912_363858096\Mu\Fingerprinting	msedgewebview2.exe
File created	C:\Windows\Installer\SourceHash{48402D93-FC77-404D-8141-F2C0764DD5D2}	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1912_1075565048\hyph-af.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1912_1075565048\hyph-ga.hyb	msedgewebview2.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ad3b1fc6af0fc0350000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801ad3b1fc60000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101ad3b1fc6000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3ad3b1fc600000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6ad3b1fc600000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe

Modifies registry class 35 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\39D2048477CFD40418142F0C67D45D2D\SourceList\PackageName = "Unconfirmed 515131.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\39D2048477CFD40418142F0C67D45D2D\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\39D2048477CFD40418142F0C67D45D2D\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\39D2048477CFD40418142F0C67D45D2D\SourceList\Media	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\fortnitelauncher\shell\open\command	ahc_launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\fortnitelauncher\shell\open	ahc_launcher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\39D2048477CFD40418142F0C67D45D2D\MainProgram	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\39D2048477CFD40418142F0C67D45D2D\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\39D2048477CFD40418142F0C67D45D2D\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\39D2048477CFD40418142F0C67D45D2D\SourceList\Media\1 = ";"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\39D2048477CFD40418142F0C67D45D2D\Version = "16842753"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\39D2048477CFD40418142F0C67D45D2D\ProductIcon = "C:\\Windows\\Installer\\{48402D93-FC77-404D-8141-F2C0764DD5D2}\\ProductIcon"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\39D2048477CFD40418142F0C67D45D2D\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\fortnitelauncher\shell\open\command\ = "\"C:\\Program Files\\ahctesting\\ahc_launcher.exe\" \"%1\""	ahc_launcher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\39D2048477CFD40418142F0C67D45D2D\External	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\39D2048477CFD40418142F0C67D45D2D\ProductName = "ahctesting"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\096976871033933519530E45A2F6C26E\39D2048477CFD40418142F0C67D45D2D	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\39D2048477CFD40418142F0C67D45D2D\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\fortnitelauncher\DefaultIcon	ahc_launcher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\39D2048477CFD40418142F0C67D45D2D	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\39D2048477CFD40418142F0C67D45D2D\PackageCode = "DD31D13771455FA4BAC9F5D3C641386C"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\fortnitelauncher\shell	ahc_launcher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\39D2048477CFD40418142F0C67D45D2D	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\39D2048477CFD40418142F0C67D45D2D\ShortcutsFeature = "MainProgram"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\39D2048477CFD40418142F0C67D45D2D\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\39D2048477CFD40418142F0C67D45D2D\Environment = "MainProgram"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\39D2048477CFD40418142F0C67D45D2D\Language = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\39D2048477CFD40418142F0C67D45D2D\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\fortnitelauncher\ = "URL:launcher.ahc.testingserver protocol"	ahc_launcher.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\39D2048477CFD40418142F0C67D45D2D\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\39D2048477CFD40418142F0C67D45D2D\SourceList	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\fortnitelauncher	ahc_launcher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\fortnitelauncher\URL Protocol	ahc_launcher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\fortnitelauncher\DefaultIcon\ = "C:\\Program Files\\ahctesting\\ahc_launcher.exe,0"	ahc_launcher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\096976871033933519530E45A2F6C26E	msiexec.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3520	msiexec.exe
3520	msiexec.exe
2996	msedgewebview2.exe
2996	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
1912	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	6076	msiexec.exe
Token: SeIncreaseQuotaPrivilege	6076	msiexec.exe
Token: SeSecurityPrivilege	3520	msiexec.exe
Token: SeCreateTokenPrivilege	6076	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	6076	msiexec.exe
Token: SeLockMemoryPrivilege	6076	msiexec.exe
Token: SeIncreaseQuotaPrivilege	6076	msiexec.exe
Token: SeMachineAccountPrivilege	6076	msiexec.exe
Token: SeTcbPrivilege	6076	msiexec.exe
Token: SeSecurityPrivilege	6076	msiexec.exe
Token: SeTakeOwnershipPrivilege	6076	msiexec.exe
Token: SeLoadDriverPrivilege	6076	msiexec.exe
Token: SeSystemProfilePrivilege	6076	msiexec.exe
Token: SeSystemtimePrivilege	6076	msiexec.exe
Token: SeProfSingleProcessPrivilege	6076	msiexec.exe
Token: SeIncBasePriorityPrivilege	6076	msiexec.exe
Token: SeCreatePagefilePrivilege	6076	msiexec.exe
Token: SeCreatePermanentPrivilege	6076	msiexec.exe
Token: SeBackupPrivilege	6076	msiexec.exe
Token: SeRestorePrivilege	6076	msiexec.exe
Token: SeShutdownPrivilege	6076	msiexec.exe
Token: SeDebugPrivilege	6076	msiexec.exe
Token: SeAuditPrivilege	6076	msiexec.exe
Token: SeSystemEnvironmentPrivilege	6076	msiexec.exe
Token: SeChangeNotifyPrivilege	6076	msiexec.exe
Token: SeRemoteShutdownPrivilege	6076	msiexec.exe
Token: SeUndockPrivilege	6076	msiexec.exe
Token: SeSyncAgentPrivilege	6076	msiexec.exe
Token: SeEnableDelegationPrivilege	6076	msiexec.exe
Token: SeManageVolumePrivilege	6076	msiexec.exe
Token: SeImpersonatePrivilege	6076	msiexec.exe
Token: SeCreateGlobalPrivilege	6076	msiexec.exe
Token: SeCreateTokenPrivilege	6076	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	6076	msiexec.exe
Token: SeLockMemoryPrivilege	6076	msiexec.exe
Token: SeIncreaseQuotaPrivilege	6076	msiexec.exe
Token: SeMachineAccountPrivilege	6076	msiexec.exe
Token: SeTcbPrivilege	6076	msiexec.exe
Token: SeSecurityPrivilege	6076	msiexec.exe
Token: SeTakeOwnershipPrivilege	6076	msiexec.exe
Token: SeLoadDriverPrivilege	6076	msiexec.exe
Token: SeSystemProfilePrivilege	6076	msiexec.exe
Token: SeSystemtimePrivilege	6076	msiexec.exe
Token: SeProfSingleProcessPrivilege	6076	msiexec.exe
Token: SeIncBasePriorityPrivilege	6076	msiexec.exe
Token: SeCreatePagefilePrivilege	6076	msiexec.exe
Token: SeCreatePermanentPrivilege	6076	msiexec.exe
Token: SeBackupPrivilege	6076	msiexec.exe
Token: SeRestorePrivilege	6076	msiexec.exe
Token: SeShutdownPrivilege	6076	msiexec.exe
Token: SeDebugPrivilege	6076	msiexec.exe
Token: SeAuditPrivilege	6076	msiexec.exe
Token: SeSystemEnvironmentPrivilege	6076	msiexec.exe
Token: SeChangeNotifyPrivilege	6076	msiexec.exe
Token: SeRemoteShutdownPrivilege	6076	msiexec.exe
Token: SeUndockPrivilege	6076	msiexec.exe
Token: SeSyncAgentPrivilege	6076	msiexec.exe
Token: SeEnableDelegationPrivilege	6076	msiexec.exe
Token: SeManageVolumePrivilege	6076	msiexec.exe
Token: SeImpersonatePrivilege	6076	msiexec.exe
Token: SeCreateGlobalPrivilege	6076	msiexec.exe
Token: SeCreateTokenPrivilege	6076	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	6076	msiexec.exe
Token: SeLockMemoryPrivilege	6076	msiexec.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
6076	msiexec.exe
6076	msiexec.exe
3768	ahc_launcher.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
6076	msiexec.exe
3520	msiexec.exe
2000	MsiExec.exe

Suspicious use of WriteProcessMemory 55 IoCs

description	pid	Process	procid_target
PID 3520 wrote to memory of 2000	3520	msiexec.exe	91
PID 3520 wrote to memory of 4592	3520	msiexec.exe	97
PID 6076 wrote to memory of 3768	6076	msiexec.exe	100
PID 3768 wrote to memory of 1912	3768	ahc_launcher.exe	101
PID 1912 wrote to memory of 5976	1912	msedgewebview2.exe	102
PID 1912 wrote to memory of 1992	1912	msedgewebview2.exe	103
PID 1912 wrote to memory of 1992	1912	msedgewebview2.exe	103
PID 1912 wrote to memory of 1992	1912	msedgewebview2.exe	103
PID 1912 wrote to memory of 1992	1912	msedgewebview2.exe	103
PID 1912 wrote to memory of 904	1912	msedgewebview2.exe	104
PID 1912 wrote to memory of 2940	1912	msedgewebview2.exe	105
PID 1912 wrote to memory of 2940	1912	msedgewebview2.exe	105
PID 1912 wrote to memory of 2940	1912	msedgewebview2.exe	105
PID 1912 wrote to memory of 1092	1912	msedgewebview2.exe	106
PID 1912 wrote to memory of 1092	1912	msedgewebview2.exe	106
PID 1912 wrote to memory of 1092	1912	msedgewebview2.exe	106
PID 1912 wrote to memory of 1092	1912	msedgewebview2.exe	106
PID 1912 wrote to memory of 1092	1912	msedgewebview2.exe	106
PID 1912 wrote to memory of 6092	1912	msedgewebview2.exe	109
PID 1912 wrote to memory of 6092	1912	msedgewebview2.exe	109
PID 1912 wrote to memory of 6092	1912	msedgewebview2.exe	109
PID 1912 wrote to memory of 1336	1912	msedgewebview2.exe	110
PID 1912 wrote to memory of 1336	1912	msedgewebview2.exe	110
PID 1912 wrote to memory of 1336	1912	msedgewebview2.exe	110
PID 1912 wrote to memory of 1632	1912	msedgewebview2.exe	111
PID 1912 wrote to memory of 1632	1912	msedgewebview2.exe	111
PID 1912 wrote to memory of 1632	1912	msedgewebview2.exe	111
PID 1912 wrote to memory of 2996	1912	msedgewebview2.exe	112
PID 1912 wrote to memory of 5900	1912	msedgewebview2.exe	113
PID 1912 wrote to memory of 5900	1912	msedgewebview2.exe	113
PID 1912 wrote to memory of 5900	1912	msedgewebview2.exe	113
PID 1912 wrote to memory of 5692	1912	msedgewebview2.exe	114
PID 1912 wrote to memory of 5692	1912	msedgewebview2.exe	114
PID 1912 wrote to memory of 5692	1912	msedgewebview2.exe	114
PID 1912 wrote to memory of 2696	1912	msedgewebview2.exe	115
PID 1912 wrote to memory of 2696	1912	msedgewebview2.exe	115
PID 1912 wrote to memory of 2696	1912	msedgewebview2.exe	115
PID 1912 wrote to memory of 572	1912	msedgewebview2.exe	116
PID 1912 wrote to memory of 572	1912	msedgewebview2.exe	116
PID 1912 wrote to memory of 572	1912	msedgewebview2.exe	116
PID 1912 wrote to memory of 4520	1912	msedgewebview2.exe	118
PID 1912 wrote to memory of 4520	1912	msedgewebview2.exe	118
PID 1912 wrote to memory of 4520	1912	msedgewebview2.exe	118
PID 1912 wrote to memory of 4124	1912	msedgewebview2.exe	119
PID 1912 wrote to memory of 4124	1912	msedgewebview2.exe	119
PID 1912 wrote to memory of 4124	1912	msedgewebview2.exe	119
PID 1912 wrote to memory of 5480	1912	msedgewebview2.exe	120
PID 1912 wrote to memory of 5480	1912	msedgewebview2.exe	120
PID 1912 wrote to memory of 5480	1912	msedgewebview2.exe	120
PID 1912 wrote to memory of 1504	1912	msedgewebview2.exe	121
PID 1912 wrote to memory of 1504	1912	msedgewebview2.exe	121
PID 1912 wrote to memory of 1504	1912	msedgewebview2.exe	121
PID 1912 wrote to memory of 1248	1912	msedgewebview2.exe	125
PID 1912 wrote to memory of 1248	1912	msedgewebview2.exe	125
PID 1912 wrote to memory of 1248	1912	msedgewebview2.exe	125

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I "C:\Users\Admin\AppData\Local\Temp\Unconfirmed 515131.msi"
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6076
- C:\Program Files\ahctesting\ahc_launcher.exe
  "C:\Program Files\ahctesting\ahc_launcher.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Modifies registry class
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3768
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=ahc_launcher.exe --webview-exe-version=1.1.1 --user-data-dir="C:\Users\Admin\AppData\Local\launcher.ahc.testingserver\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=3768.2920.1478839775910959646 /pfhostedapp:0e11b86931aa44f4f0c8a254bf481bd6b5bfbaaf
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:1912
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\launcher.ahc.testingserver\EBWebView /prefetch:4 /pfhostedapp:0e11b86931aa44f4f0c8a254bf481bd6b5bfbaaf --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\launcher.ahc.testingserver\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffe668c5fd8,0x7ffe668c5fe4,0x7ffe668c5ff0
      4⤵
      PID:5976
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\launcher.ahc.testingserver\EBWebView" --webview-exe-name=ahc_launcher.exe --webview-exe-version=1.1.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1716 --field-trial-handle=1740,i,14956556050608927386,18178511837841843610,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:0e11b86931aa44f4f0c8a254bf481bd6b5bfbaaf
      4⤵
      PID:1992
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\launcher.ahc.testingserver\EBWebView" --webview-exe-name=ahc_launcher.exe --webview-exe-version=1.1.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2132 --field-trial-handle=1740,i,14956556050608927386,18178511837841843610,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:0e11b86931aa44f4f0c8a254bf481bd6b5bfbaaf
      4⤵
      PID:904
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\launcher.ahc.testingserver\EBWebView" --webview-exe-name=ahc_launcher.exe --webview-exe-version=1.1.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2284 --field-trial-handle=1740,i,14956556050608927386,18178511837841843610,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:0e11b86931aa44f4f0c8a254bf481bd6b5bfbaaf
      4⤵
      PID:2940
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\launcher.ahc.testingserver\EBWebView" --webview-exe-name=ahc_launcher.exe --webview-exe-version=1.1.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3280 --field-trial-handle=1740,i,14956556050608927386,18178511837841843610,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:0e11b86931aa44f4f0c8a254bf481bd6b5bfbaaf /prefetch:1
      4⤵
      PID:1092
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\launcher.ahc.testingserver\EBWebView" --webview-exe-name=ahc_launcher.exe --webview-exe-version=1.1.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4460 --field-trial-handle=1740,i,14956556050608927386,18178511837841843610,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:0e11b86931aa44f4f0c8a254bf481bd6b5bfbaaf
      4⤵
      PID:6092
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\launcher.ahc.testingserver\EBWebView" --webview-exe-name=ahc_launcher.exe --webview-exe-version=1.1.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4460 --field-trial-handle=1740,i,14956556050608927386,18178511837841843610,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:0e11b86931aa44f4f0c8a254bf481bd6b5bfbaaf
      4⤵
      PID:1336
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\launcher.ahc.testingserver\EBWebView" --webview-exe-name=ahc_launcher.exe --webview-exe-version=1.1.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4288 --field-trial-handle=1740,i,14956556050608927386,18178511837841843610,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:0e11b86931aa44f4f0c8a254bf481bd6b5bfbaaf
      4⤵
      PID:1632
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\launcher.ahc.testingserver\EBWebView" --webview-exe-name=ahc_launcher.exe --webview-exe-version=1.1.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4512 --field-trial-handle=1740,i,14956556050608927386,18178511837841843610,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:0e11b86931aa44f4f0c8a254bf481bd6b5bfbaaf
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2996
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\launcher.ahc.testingserver\EBWebView" --webview-exe-name=ahc_launcher.exe --webview-exe-version=1.1.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2056 --field-trial-handle=1740,i,14956556050608927386,18178511837841843610,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:0e11b86931aa44f4f0c8a254bf481bd6b5bfbaaf
      4⤵
      PID:5900
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\launcher.ahc.testingserver\EBWebView" --webview-exe-name=ahc_launcher.exe --webview-exe-version=1.1.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4092 --field-trial-handle=1740,i,14956556050608927386,18178511837841843610,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:0e11b86931aa44f4f0c8a254bf481bd6b5bfbaaf
      4⤵
      PID:5692
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\launcher.ahc.testingserver\EBWebView" --webview-exe-name=ahc_launcher.exe --webview-exe-version=1.1.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4320 --field-trial-handle=1740,i,14956556050608927386,18178511837841843610,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:0e11b86931aa44f4f0c8a254bf481bd6b5bfbaaf
      4⤵
      PID:2696
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\launcher.ahc.testingserver\EBWebView" --webview-exe-name=ahc_launcher.exe --webview-exe-version=1.1.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4676 --field-trial-handle=1740,i,14956556050608927386,18178511837841843610,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:0e11b86931aa44f4f0c8a254bf481bd6b5bfbaaf
      4⤵
      PID:572
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\launcher.ahc.testingserver\EBWebView" --webview-exe-name=ahc_launcher.exe --webview-exe-version=1.1.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2052 --field-trial-handle=1740,i,14956556050608927386,18178511837841843610,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:0e11b86931aa44f4f0c8a254bf481bd6b5bfbaaf
      4⤵
      PID:4520
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\launcher.ahc.testingserver\EBWebView" --webview-exe-name=ahc_launcher.exe --webview-exe-version=1.1.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4688 --field-trial-handle=1740,i,14956556050608927386,18178511837841843610,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:0e11b86931aa44f4f0c8a254bf481bd6b5bfbaaf
      4⤵
      PID:4124
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\launcher.ahc.testingserver\EBWebView" --webview-exe-name=ahc_launcher.exe --webview-exe-version=1.1.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4532 --field-trial-handle=1740,i,14956556050608927386,18178511837841843610,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:0e11b86931aa44f4f0c8a254bf481bd6b5bfbaaf
      4⤵
      PID:5480
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\launcher.ahc.testingserver\EBWebView" --webview-exe-name=ahc_launcher.exe --webview-exe-version=1.1.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4612 --field-trial-handle=1740,i,14956556050608927386,18178511837841843610,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:0e11b86931aa44f4f0c8a254bf481bd6b5bfbaaf
      4⤵
      PID:1504
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\launcher.ahc.testingserver\EBWebView" --webview-exe-name=ahc_launcher.exe --webview-exe-version=1.1.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4680 --field-trial-handle=1740,i,14956556050608927386,18178511837841843610,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:0e11b86931aa44f4f0c8a254bf481bd6b5bfbaaf
      4⤵
      PID:1248

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3520
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding D646B6C83428FCA80FDE57C09E3397E6 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2000
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:4592

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:2720

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4828

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:5536

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5a0a34.rbs

Path C:\Config.Msi\e5a0a34.rbs
Size 9KB
SHA256 143cbcbbb5f9057054e24a0fbbce6347f90c0cae928d0d8ed520df02a6b0dc8a
MD5 3ece4d19ee9810d72d973dab9f5051ed
SHA1 4b2b3e2ef5f5c27820afc55c8570b1acc7b5fc1b
SHA512 c67fab36959e4ef88a69a6a08adddd63be23a68a6b4f51586affe805b44473184e8f2d48a745b156f346ad47948b848a692663f74ddc09e621b78bbdcec7203a
SSDEEP 192:96Z71Tx4+eKCdKBK1OcXG4cXaCKAKdkhTKZYTKgqTKfKWTKti6K+KlKhKOKRKpH+:96ZBTx4+enKBKkchcKCKAKidKZiKgUKf
TLSH
T1F4220F42A20085E3FCA32B71CB2B271437A2D6D8522C53EF4ADDF0745E477885FB569A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ahc_launcher.exe

Path C:\Program Files\ahctesting\ahc_launcher.exe
Size 19.1MB
SHA256 16b5db1d4e5b93c4c4ef66e6f26e51d25ef785be471bde8ff155207b7da0ee67
MD5 40352c05bb3da1f865c69706bc950c67
SHA1 dc165801844b6e0327c507dd8fad151abe470e76
SHA512 e03c7fff254822f228f9e17eee12cf981e50af866471d38fc68427517bed0d14e8e5bf0e836eb2f8275da5d01a5e916fb82fce45907aa3640143fe2c9f8db93d
SSDEEP 196608:bX/mH2CihWf+2F92LLiTo40iiuPxLSp/X:CH20V9M44uPxLSZ
TLSH
T16317F720BA5B996CD09BC4B083478A765A7134CB0B35B9FF44D496382F6DBF42F38259
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ahctesting.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ahctesting\ahctesting.lnk
Size 2KB
SHA256 f0f035cf90ff4267ce8d494ccd3a1bf90ad0b045f6460ffd32a0418085b6c4f5
MD5 3582b72bd1244f407bbfdedb3cb33189
SHA1 15c1d32436cc206179c6579d2c5160fd5f92fd02
SHA512 6a2c7eedc4c0ab683db972fe6b2b8640b674fc6c806b3fec2a912ab4b98296b9c9876b3978b8caf22eb835908c5d04a13346a6350c92ad7150dbbdb8fd44385c
TLSH
T18741B11047EA061EF7728771297156129A71FC16B6658F1F8285818909B4A00EF6DFB9
MD5 SHA1 SHA512 TLSH

Submit Download

ahctesting.lnk~RFe5a1128.TMP

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ahctesting\ahctesting.lnk~RFe5a1128.TMP
Size 1KB
SHA256 e63c6fc7ba45fa4b04dad3e58f5523dab30e70d86255b48419563a590ac849ee
MD5 f44757b3b113ffc4e2b711b7d7be436c
SHA1 ffd59b1a5e6b28f4bdff16d148f530b11e7e37b8
SHA512 a7ac6648efe9a0c761b75557aad0e6c10481049ece87611253318a722490afbf578395f04ba11d0d52ca2d943d7c7f43ce24bdebe4aacb4bb83b7813978a24de
TLSH
T18C41DF104BEA062FF773877129B15651AA71FC06B6758F1F8286818909B4A00EF6DFBD
MD5 SHA1 SHA512 TLSH

Submit Download

MSIAEC4.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSIAEC4.tmp
Size 132KB
SHA256 7f47d98ab25cfea9b3a2e898c3376cc9ba1cd893b4948b0c27caa530fd0e34cc
MD5 cfbb8568bd3711a97e6124c56fcfa8d9
SHA1 d7a098ae58bdd5e93a3c1b04b3d69a14234d5e57
SHA512 860cbf3286ac4915580cefaf56a9c3d48938eb08e3f31b7f024c4339c037d7c8bdf16e766d08106505ba535be4922a87dc46bd029aae99a64ea2fc02cf3aec04
SSDEEP 3072:Kx2YbpcgwmiTPJDnCO+DATkURBnrskNwPj2:XXgwmY1CPx2XG2
TLSH
T1DBD39D02B5D0C473D9BE09390870DB229F7EB930DF909EDB636856699E702C19E35A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\launcher.ahc.testingserver\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 444809dc94fe0f9e9e6989cd23944c958eb55f90e3891acbd53f44657606549e
MD5 c4d2f8d125732a4c9a87c6a189d8bbab
SHA1 18f4b5a7dfabc75faf9a6d3f9c1f65fdb0d51888
SHA512 7dc35d366e97c947f0f706bdf3bfd6c88a32c0a4786ad13140fc629f451a29b0c5800fb258ec49b3eaef4779fe14f91b5ca535a3c5f931dad9cdb3c466c9e83f
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\launcher.ahc.testingserver\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 c3b2c1510a9a9c67fc64abd27d6a0475fe0e446f8bfd437589d03edb70fa24a2
MD5 a069f51a6da88e6c375cdc1b29ad774a
SHA1 703ababe5be7f1e8eeab0be7a3e001169f6ae71c
SHA512 9c6b85d70f99a53bd902b918729dd22db693b664189bb9b60cce071a746e25a84b387933428201bd550a97fe5c19f3146643edfe770cb4988fff00cf1def9106
TLSH
T140D0125333110178C43020334012A5481D00C30B4105C0405828891D1E440601B06851
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\launcher.ahc.testingserver\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

1e0b5966-27ab-4ace-8d76-07d3f094cf97.tmp

Path C:\Users\Admin\AppData\Local\launcher.ahc.testingserver\EBWebView\Default\1e0b5966-27ab-4ace-8d76-07d3f094cf97.tmp
Size 6KB
SHA256 6be0957e20041ba23a55dc868fa08cdb536e8edca4de6393cb5568e5055e7bfb
MD5 3d3043053cd1c5bcba4635012c566123
SHA1 9ce6a26e27219f498af471df9e63bf1f18160391
SHA512 d8f3bd733ae9e4cdb853a88bb7cb3bf7b6ef616b58b1c8d24f1bd84d1a9d781f90ad3acb9d004e6a9f7f0b332111e42fae08f8515b1ae3f5b395e85af22f74ba
SSDEEP 96:stf/dM+rwYoib9ok3mo5h16Z0ys7/x+6MhmuecJYg1ejeuK+gEm+28XM1C7K:stnOcOBonysV+FdYgQjS9+G6K
TLSH
T190D185125E28B97B8CC6F508BA29BB17E2F9603165D51E68E7FC452C08DB6CC730790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\launcher.ahc.testingserver\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 d6fd95506420dfd9edd959ae6d88bf4ac7ef46cb46dc875ada7d19e297dfe4c7
MD5 5973e54bca9cb6d93ce986eef409a4f1
SHA1 15b48a64b1ef640563627bc6b73fdd9f8cde6809
SHA512 70e93a1b1f4bf4a7c982794616d50e8d1f9f2162c883b8ea28ac5f8a86a8a67a1bfbb505a16cf8f149f53e6b9963a1733ec655c9d65d76e13f345d58cc94714b
TLSH
T1A1A0023007500597D1564B782AC992C07330EC6402132A9D55F5287889E43405EAB555
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a93d5.TMP

Path C:\Users\Admin\AppData\Local\launcher.ahc.testingserver\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe5a93d5.TMP
Size 48B
SHA256 1454c1793e0db07ae8328e201b1187a03c116e0bc81d30413d85805f557f33a2
MD5 31ec8768a8b21cc6375448195d4de5b8
SHA1 2bee0af17e3bd5d3527c0be31f9ff12c7c353043
SHA512 01d8ff3e6b2ba380c8f6579d591310ac0d130fa02603938e3232f166d8c0d8ab1a722210a8ba085877d4ceb098863489af52ff1baeeb64bdfafeb27b9e54c96b
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\launcher.ahc.testingserver\EBWebView\Default\DawnCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\launcher.ahc.testingserver\EBWebView\Default\Network\Network Persistent State
Size 821B
SHA256 1582907d33547af1a1e92c4316c46e37d1a42f84adcbc030a09cec5f869afdc5
MD5 284a3f837099b3674cf894ed5cb2fa43
SHA1 20856e84a5bd4a993d1c706f2a583f79a564d81d
SHA512 58e93da0f5a6b2931f731a6749d50fea926915f2dca793ec6739469e65d24cf1070d4ed7a6b4c7626b679105a62d326302f20c4851d5afcd17574506be80961d
TLSH
T116018EA2C3D4C67E8A4527E427347917CD2E091A93282D67CDEAEBEA97E1071D11050F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5b56c7.TMP

Path C:\Users\Admin\AppData\Local\launcher.ahc.testingserver\EBWebView\Default\Network\Network Persistent State~RFe5b56c7.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\launcher.ahc.testingserver\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\launcher.ahc.testingserver\EBWebView\Default\Preferences
Size 6KB
SHA256 307dc70c1d998491829638a1266354323153f78ed3f897fd894c4f76406df8d0
MD5 9a9f3fd6e3cf67f3b0d2c79b84da3a3b
SHA1 9acb78a304a1d3a06a79e0299ec562aa96b25de9
SHA512 1478cce0c13a11d71f584ba9ea489ff87e32e340cd761ea2c0ba1dda4744ef919f8480a5979b0d724ea83a8759c7368383dd6d9ff655e1f899db881b803f8878
SSDEEP 96:stf/dM+rwYfGib9ok3mo5h16Z0ys7/x+6MhmuecJYg1ejeuK+gTm+28XM1C7K:stnOc4BonysV+FdYgQjSw+G6K
TLSH
T1F4D185125E24B97B8CC6F518BA29BB13E2F9607165D02E58EBFC452C08DB6DC730790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\launcher.ahc.testingserver\EBWebView\Default\shared_proto_db\metadata\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\launcher.ahc.testingserver\EBWebView\Default\shared_proto_db\metadata\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\launcher.ahc.testingserver\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\launcher.ahc.testingserver\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\launcher.ahc.testingserver\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\launcher.ahc.testingserver\EBWebView\Local State
Size 3KB
SHA256 b9793af2f0a5a05753fdeba54aadba6670b9a66d7d66050501ca14425c2ab6e5
MD5 308e75bd278762ffaab83272d6faba78
SHA1 796df31529386a9387143954db46e1af1cad6557
SHA512 b1574f4827ddd878848c86bcbb4950133d59b03bef21fb3f95f496a98ec0153a73d4b6feb4d30cfdd63c9d346699352095f07bc9918f28a00463306040c2be31
TLSH
T19E619837A970AA3B8DF29A04B9862B03EBA54127E5823FA8D6EC0F1D01D73DC1341C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\launcher.ahc.testingserver\EBWebView\Local State
Size 15KB
SHA256 aa40c41802be939a114b6614e4793a8be1fdaa763081dfede82778fe2c4a896d
MD5 5a076ba3e3017060d96f94164f501811
SHA1 f6fd5fb76d159a8ac928946f9e1bdb9966dcc7ff
SHA512 323d46c85a53427ebfde4e943595c8d6a4f007e15e73c630d7afad25134123a419314016369eede76b94cae5f52c023258b3af82165023ab0c03aed63899b125
SSDEEP 384:8+aQikB+z/xvxjg/qhEwNBSUZ7xYJwAVdpk9zI:b/UxvxjgC+M5CJwUkFI
TLSH
T109729F2B94357D27D5F7BA0579494B8BCAF884B2D0C26EB84AFD5F0906C72D81342C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\launcher.ahc.testingserver\EBWebView\Local State
Size 2KB
SHA256 dfc90035700a427c39f823052721d12951e4cb9ecf8b6be9737194fff1b4c611
MD5 64df427670f03063484bfbba255f0977
SHA1 9f3998602b72bf7e9ab779aea4582de43d7756af
SHA512 f99968489aa0bf1531371cf4c027d6eab9a138fd4e956c60034aff57ac00982472955bf9a854a69814f338889fed0147ad9c3b69cf6807a9c7b8b7e46169e3e0
TLSH
T171519473A810AB37C5B26A04BA4B6F13CEB54156EA532F64AADC1B1C41C76AD1342C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe5a4046.TMP

Path C:\Users\Admin\AppData\Local\launcher.ahc.testingserver\EBWebView\Local State~RFe5a4046.TMP
Size 1KB
SHA256 fc5dc7e6de07b4906e25c87785ae35cb37d2213e8cd3e9a0f6c0d4eb131d1f55
MD5 77fdba16fa61662ef47d262b0b6df60c
SHA1 89e02689a4d5e09b8cbd399126b7825f677764a6
SHA512 5642d422111523c2c1fea290b510dbeefebcf090635322c0c58a1744c021af2c5cad8a56faa84138cb57b49305e073e8dfdffadb446e8d44c97375ffbffa4c7f
TLSH
T1FD2184F3D9602F33E9A16605B243AF574EB1115BD2834E48B2DD4B2C42E32DE9266C33
MD5 SHA1 SHA512 TLSH

Submit Download

e5a0a33.msi

Path C:\Windows\Installer\e5a0a33.msi
Size 6.6MB
SHA256 9b0d29a5d8ea5a3bba7b86dd44ac6dc59c96f4cb3b6402c797becdfba642a893
MD5 046c2491e0c3a14aa78c5c66102447e7
SHA1 86f5dfe93183c33044ff1aff4bdb5962d38ec1a3
SHA512 bc6bc7982c3a782d9bf36ae44a33426cbddb3aa54be86207847c89b9e7c078005a22c95eca0a97f99862cfcfd97d4b8d9b6ec131cc4ba56fa4be1d20a1259f67
SSDEEP 196608:At2hzUaRxVIylRM6SeeYwCwciQYE6MCeORIlx4:hlUUTjSPfXObae4Ilx4
TLSH
T1C666335B7EC5C222CC256C3B047BCB648628BC109B69589372A0B36DDDF16D05FA6DE3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hyph-bn.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1912_1075565048\hyph-bn.hyb
Size 703B
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
TLSH
T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-mr.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1912_1075565048\hyph-mr.hyb
Size 687B
SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
SHA1 d0914fb069469d47a36d339ca70164253fccf022
SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
TLSH
T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-nn.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1912_1075565048\hyph-nn.hyb
Size 141KB
SHA256 5bcbb58eaf65f13f6d039244d942f37c127344e3a0a2e6c32d08236945132809
MD5 f2d8fe158d5361fc1d4b794a7255835a
SHA1 6c8744fa70651f629ed887cb76b6bc1bed304af9
SHA512 946f4e41be624458b5e842a6241d43cd40369b2e0abc2cacf67d892b5f3d8a863a0e37e8120e11375b0bacb4651eedb8d324271d9a0c37527d4d54dd4905afab
SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgY:p73HEUP8dsiinTThjy90VKY
TLSH
T1C1E319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Staging

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1912_363858096\Mu\Staging
Size 36B
SHA256 411a706def2e70f96a507208bf80bceb93e950c4c2d671cd1ddb4134ce54b2a9
MD5 0163de1b14421d4eee3757ff76fd81e4
SHA1 96c75c4fe1e3f33a367f45293bd1bd8bff1c06f4
SHA512 80114d59db8f3654dd6821589e5ad03daa923a35610a372756a8865b3e769621e32ef2aed92c2494de2b9fc06d9796b12f1e3bb75873ed794e8c9ae8a0d5e965
MD5 SHA1 SHA512

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 1e3db4f61bd8ed44719f190332a26e1f72c39756abdbe59236e17755e59bb9ae
MD5 62ac97b4912e8e2522e9d43b0a96b2e5
SHA1 534a8a4d396bf4bd6dce5f9f3db52f3d65bdbe85
SHA512 50b3198048277b187586e747f4f9b0fff6766c6ae44682529042c3aae4a2e97a6415e485ba1d2c29456460e863c20c6cbe10cb9410c3dd66d08a224a27f4305b
SSDEEP 24576:nFo3DMPtdoO/vvTL/Sg88iFQvrumHb7P0BKudxSUKpyKpb9cMoRWclmd4+2:HHY
TLSH
T1E457B42436F92200E7F79E3DA8F06A234D397D5BAC15DE8D45511B4E0822F71E872F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{048cf4b1-9d3b-46bf-87ef-52443b4a60b7}_OnDiskSnapshotProp

Path \??\Volume{c61f3bad-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{048cf4b1-9d3b-46bf-87ef-52443b4a60b7}_OnDiskSnapshotProp
Size 6KB
SHA256 bd568b17166dde28894822ff3f0a9303b67e8990fb2c220a6032dd502a2bd0f7
MD5 fc18b3f1a6184a55cfaec4ac2c83e878
SHA1 5b59c52f06c51926368931192a1508322707149f
SHA512 e28c1de60b219b8a1ebcd03ecf389df822c7c96dd3680e77d61476ee9248e0c0a96a0802a3323a5a589703019edace293206e66cacacd8f8da5a641aa036535d
SSDEEP 96:FHyZ7TCvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:Upeb++uVm
TLSH
T1ADD188085AF54711E2B3AB3129F14557A877B911FF33CB8E0198238E6671A10F935F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/572-682-0x0000025FB3DB0000-0x0000025FB3DDF000-memory.dmp

Download

memory/1092-89-0x00007FFE886D0000-0x00007FFE886D1000-memory.dmp

Download

memory/1248-927-0x00000275BEE00000-0x00000275BEE2F000-memory.dmp

Download

memory/1336-346-0x0000016C8CF80000-0x0000016C8CFAF000-memory.dmp

Download

memory/1504-833-0x000001DBD4930000-0x000001DBD495F000-memory.dmp

Download

memory/1632-370-0x000001E087E00000-0x000001E087E2F000-memory.dmp

Download

memory/1992-75-0x00007FFE886D0000-0x00007FFE886D1000-memory.dmp

Download

memory/1992-244-0x0000012B8EFE0000-0x0000012B8F139000-memory.dmp

Download

memory/2696-656-0x0000022E38F10000-0x0000022E38F3F000-memory.dmp

Download

memory/2996-379-0x000002430C380000-0x000002430C381000-memory.dmp

Download

memory/2996-378-0x000002430C380000-0x000002430C381000-memory.dmp

Download

memory/2996-371-0x000002430C380000-0x000002430C381000-memory.dmp

Download

memory/2996-373-0x000002430C380000-0x000002430C381000-memory.dmp

Download

memory/2996-380-0x000002430C380000-0x000002430C381000-memory.dmp

Download

memory/2996-382-0x000002430C380000-0x000002430C381000-memory.dmp

Download

memory/2996-377-0x000002430C380000-0x000002430C381000-memory.dmp

Download

memory/2996-381-0x000002430C380000-0x000002430C381000-memory.dmp

Download

memory/4124-778-0x0000018DE7F30000-0x0000018DE7F5F000-memory.dmp

Download

memory/4520-715-0x000001FB23F80000-0x000001FB23FAF000-memory.dmp

Download

memory/5480-805-0x000001BD40E70000-0x000001BD40E9F000-memory.dmp

Download

memory/5692-605-0x0000016B26F40000-0x0000016B26F6F000-memory.dmp

Download

memory/5900-479-0x0000024E03F70000-0x0000024E03F9F000-memory.dmp

Download

memory/6092-301-0x00007FFE89B00000-0x00007FFE89B01000-memory.dmp

Download

memory/6092-300-0x00007FFE88100000-0x00007FFE88101000-memory.dmp

Download

memory/6092-318-0x00000211CC220000-0x00000211CC24F000-memory.dmp

Download