841458bb733714d85f91485b1e1698de0b24f19c10791d70caca2283aaab0dc9

Analysis

user interaction
yes
max time kernel
243s
max time network
184s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
10/08/2026, 02:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ContextMenuManager.exe
Size 15.4MB
Sample260810-c3wp4azclb
SHA256 841458bb733714d85f91485b1e1698de0b24f19c10791d70caca2283aaab0dc9
MD5 1483486ac97204fd8bca49673d186141
SHA1 90b8a67e20539484969f186e46db20a0cdd7d3a0
SHA512 a3583699bdeda767a978a67dd2e00306de9f1429613279aa3a15258949f714d87bdd317e803b3114c16e581c33dd25513024a369011e03456bf7563d0f233fe4
SSDEEP 196608:5+tb4jVOnc/WQjXVWOquHVzyKP+RPfhd/nOfZ9YpM8NO9oNdvPp2z:GM5jXTquHVzyKWZOxmpMGO9IvPp2z
TLSH
T1DAF6AEAA23FD0D31C2AB1379ECA063361A35AD3521C0EB4F6F8F7F1C69552804DA5667
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery persistence ransomware

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
90	1940	msedge.exe

Executes dropped EXE 6 IoCs

pid	Process
2464	windowsdesktop-runtime-10.0.10-win-x64.exe
580	wixstdba.exe
4776	windowsdesktop-runtime-10.0.10-win-x64.exe
2660	windowsdesktop-runtime-10.0.10-win-x64.exe
3300	windowsdesktop-runtime-10.0.10-win-x64.exe
5032	wixstdba.exe

Loads dropped DLL 64 IoCs

pid	Process
644	MsiExec.exe
644	MsiExec.exe
3304	MsiExec.exe
3304	MsiExec.exe
4616	MsiExec.exe
4616	MsiExec.exe
2444	MsiExec.exe
2444	MsiExec.exe
1300	ContextMenuManager.exe
1300	ContextMenuManager.exe
1300	ContextMenuManager.exe
1300	ContextMenuManager.exe
1300	ContextMenuManager.exe
1300	ContextMenuManager.exe
1300	ContextMenuManager.exe
1300	ContextMenuManager.exe
1300	ContextMenuManager.exe
1300	ContextMenuManager.exe
1300	ContextMenuManager.exe
1300	ContextMenuManager.exe
1300	ContextMenuManager.exe
1300	ContextMenuManager.exe
1300	ContextMenuManager.exe
1300	ContextMenuManager.exe
1300	ContextMenuManager.exe
1300	ContextMenuManager.exe
1300	ContextMenuManager.exe
1300	ContextMenuManager.exe
1300	ContextMenuManager.exe
1300	ContextMenuManager.exe
1300	ContextMenuManager.exe
1300	ContextMenuManager.exe
1300	ContextMenuManager.exe
1300	ContextMenuManager.exe
1300	ContextMenuManager.exe
1300	ContextMenuManager.exe
1300	ContextMenuManager.exe
1300	ContextMenuManager.exe
1300	ContextMenuManager.exe
1300	ContextMenuManager.exe
1300	ContextMenuManager.exe
1300	ContextMenuManager.exe
1300	ContextMenuManager.exe
1300	ContextMenuManager.exe
1300	ContextMenuManager.exe
1300	ContextMenuManager.exe
1300	ContextMenuManager.exe
1300	ContextMenuManager.exe
1300	ContextMenuManager.exe
1300	ContextMenuManager.exe
1300	ContextMenuManager.exe
1300	ContextMenuManager.exe
1300	ContextMenuManager.exe
1300	ContextMenuManager.exe
1300	ContextMenuManager.exe
1300	ContextMenuManager.exe
1300	ContextMenuManager.exe
1300	ContextMenuManager.exe
1300	ContextMenuManager.exe
1300	ContextMenuManager.exe
1300	ContextMenuManager.exe
1300	ContextMenuManager.exe
1300	ContextMenuManager.exe
1300	ContextMenuManager.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{866BECDA-F284-473A-9E84-0CCE816BF06F} = "\"C:\\ProgramData\\Package Cache\\{866BECDA-F284-473A-9E84-0CCE816BF06F}\\windowsdesktop-runtime-10.0.10-win-x64.exe\" /burn.runonce"	windowsdesktop-runtime-10.0.10-win-x64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
128	raw.githubusercontent.com
131	raw.githubusercontent.com

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinXDefault\Group2\desktop.ini	ContextMenuManager.exe
File created	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinXDefault\Group3\desktop.ini	ContextMenuManager.exe
File created	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinXDefault\Group1\desktop.ini	ContextMenuManager.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.IO.IsolatedStorage.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.IO.FileSystem.AccessControl.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Memory.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Transactions.Local.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\PresentationFramework.Aero.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\clrgc.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\UIAutomationTypes.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\ko\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\ru\System.Windows.Forms.Primitives.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Data.Common.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Net.Http.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Net.Security.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\System.Windows.Controls.Ribbon.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\de\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\zh-Hans\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\System.Security.Cryptography.ProtectedData.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\pl\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\zh-Hant\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Formats.Asn1.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.IO.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Net.Primitives.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\de\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\it\System.Windows.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\tr\System.Windows.Forms.Primitives.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\zh-Hans\UIAutomationClient.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\zh-Hans\WindowsFormsIntegration.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Dynamic.Runtime.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\LICENSE.txt	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Runtime.InteropServices.JavaScript.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\de\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\de\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\pt-BR\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\cs\UIAutomationTypes.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\fr\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\it\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\ja\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Text.Encoding.Extensions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Threading.ThreadPool.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Web.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\PresentationUI.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\System.Printing.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\pt-BR\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\tr\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.ComponentModel.EventBasedAsync.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Collections.NonGeneric.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Diagnostics.Contracts.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Net.WebSockets.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Runtime.Extensions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\DirectWriteForwarder.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\zh-Hant\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\.version	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Data.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Security.Cryptography.Algorithms.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Windows.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\tr\System.Windows.Forms.Design.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Reflection.Extensions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\mscordaccore_amd64_amd64_10.0.1026.32716.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\D3DCompiler_47_cor3.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Net.ServicePoint.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\es\ReachFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\ko\WindowsBase.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\tr\UIAutomationClient.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.10\zh-Hans\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.10\System.Console.dll	msiexec.exe

Drops file in Windows directory 60 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSIBB60.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBDB4.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping560_13903872\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping560_772913164\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping560_772913164\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\~DFE6D9DCFC51522D0F.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF48BDDB742CBAFC89.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{F0BCFB2E-4878-4F6E-BD5D-3ABFF264829E}	msiexec.exe
File created	C:\Windows\SystemTemp\~DF0E64907B45CF1D82.TMP	msiexec.exe
File created	C:\Windows\Installer\e58ab84.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF6803B37D433895E9.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping560_379433890\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping560_772913164\manifest.json	msedge.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1\64.60.31149	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBAF1.tmp	msiexec.exe
File created	C:\Windows\Installer\e58ab88.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICB05.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC95E.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\SystemTemp\~DF14A6144EEFB20583.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{8A8CC49F-7D1E-45DC-B7B5-35FF61A2C25E}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAC29.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB87E.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF91EAA7A326529316.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICD86.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e58ab7d.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF80D1534FF099A008.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF30C2439F86150E78.TMP	msiexec.exe
File created	C:\Windows\Installer\e58ab92.msi	msiexec.exe
File created	C:\Windows\Installer\e58ab7d.msi	msiexec.exe
File created	C:\Windows\Installer\e58ab8d.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e58ab8e.msi	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping560_379433890\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping560_772913164\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\~DF8F1285476EE24314.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFE023790B0A22F093.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{DA493AF2-5A21-4D85-BB57-757D7525EB73}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBA06.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFBE43EA4989B17853.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDC5C.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping560_1094572856\manifest.json	msedge.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1\64.60.31149\fileCoreHostExe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBBED.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF6C11C0F676702314.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{441FCDB0-A03A-4130-A1D5-FFD8C53CFF6B}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBF3B.tmp	msiexec.exe
File created	C:\Windows\Installer\e58ab8e.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF7BA034443610249E.TMP	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1\64.60.31149\fileCoreHostExe	msiexec.exe
File created	C:\Windows\Installer\e58ab83.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e58ab89.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFAF4A319A0DC1C7B3.TMP	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\e58ab84.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFF945FEEB919C9364.TMP	msiexec.exe
File created	C:\Windows\Installer\e58ab89.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF15C80D7803A4F1F5.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping560_13903872\manifest.json	msedge.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.10-win-x64.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.10-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.10-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wixstdba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.10-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wixstdba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.10-win-x64.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1940	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 11 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134308030161185563"	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2FA394AD12A558D4BB7557D75752BE37	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0BDCF144A30A03141A5DFF8D5CC3FFB6\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0BDCF144A30A03141A5DFF8D5CC3FFB6\SourceList\Media\1 = ";"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0BDCF144A30A03141A5DFF8D5CC3FFB6\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2FA394AD12A558D4BB7557D75752BE37\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E2BFCB0F8784E6F4DBD5A3FB2F4628E9\MainFeature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F94CC8A8E1D7CD547B5B53FF162A2CE5\MainFeature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{866BECDA-F284-473A-9E84-0CCE816BF06F}\ = "{866BECDA-F284-473A-9E84-0CCE816BF06F}"	windowsdesktop-runtime-10.0.10-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F94CC8A8E1D7CD547B5B53FF162A2CE5\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.40.55332_x64\ = "{DA493AF2-5A21-4D85-BB57-757D7525EB73}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2FA394AD12A558D4BB7557D75752BE37\Provider	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_80.40.55332_x64\DisplayName = "Microsoft .NET Runtime - 10.0.10 (x64)"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\0BDCF144A30A03141A5DFF8D5CC3FFB6	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{866BECDA-F284-473A-9E84-0CCE816BF06F}\DisplayName = "Microsoft Windows Desktop Runtime 10.0.10 (x64)"	windowsdesktop-runtime-10.0.10-win-x64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x64	windowsdesktop-runtime-10.0.10-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2FA394AD12A558D4BB7557D75752BE37\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{DA493AF2-5A21-4D85-BB57-757D7525EB73}v80.40.55332\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\0BDCF144A30A03141A5DFF8D5CC3FFB6\Provider	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F94CC8A8E1D7CD547B5B53FF162A2CE5	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F94CC8A8E1D7CD547B5B53FF162A2CE5\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F94CC8A8E1D7CD547B5B53FF162A2CE5\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{8A8CC49F-7D1E-45DC-B7B5-35FF61A2C25E}v80.40.55332\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2FA394AD12A558D4BB7557D75752BE37\SourceList\Media\1 = ";"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0BDCF144A30A03141A5DFF8D5CC3FFB6\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\windowsdesktop_runtime_80.40.55332_x64	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E2BFCB0F8784E6F4DBD5A3FB2F4628E9\Clients = 3a0000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F94CC8A8E1D7CD547B5B53FF162A2CE5\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2FA394AD12A558D4BB7557D75752BE37\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0BDCF144A30A03141A5DFF8D5CC3FFB6\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0BDCF144A30A03141A5DFF8D5CC3FFB6\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{441FCDB0-A03A-4130-A1D5-FFD8C53CFF6B}v80.40.55332\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_80.40.55332_x64\Dependents	windowsdesktop-runtime-10.0.10-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{866BECDA-F284-473A-9E84-0CCE816BF06F}\Version = "10.0.10.50000"	windowsdesktop-runtime-10.0.10-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2FA394AD12A558D4BB7557D75752BE37	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.40.55332_x64\Dependents\{866BECDA-F284-473A-9E84-0CCE816BF06F}	windowsdesktop-runtime-10.0.10-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{866BECDA-F284-473A-9E84-0CCE816BF06F}\Dependents	windowsdesktop-runtime-10.0.10-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x64\DisplayName = "Microsoft .NET Host - 10.0.10 (x64)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F94CC8A8E1D7CD547B5B53FF162A2CE5\PackageCode = "BB5A5A59AE909304FB0B47459E96A72D"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_80.40.55332_x64\ = "{441FCDB0-A03A-4130-A1D5-FFD8C53CFF6B}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{866BECDA-F284-473A-9E84-0CCE816BF06F}\Dependents\{866BECDA-F284-473A-9E84-0CCE816BF06F}	windowsdesktop-runtime-10.0.10-win-x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F94CC8A8E1D7CD547B5B53FF162A2CE5\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\dotnet_runtime_80.40.55332_x64	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_80.40.55332_x64\Version = "80.40.55332"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E2BFCB0F8784E6F4DBD5A3FB2F4628E9\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E2BFCB0F8784E6F4DBD5A3FB2F4628E9\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x64	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.40.55332_x64	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2FA394AD12A558D4BB7557D75752BE37\SourceList\PackageName = "dotnet-hostfxr-10.0.10-win-x64.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_80.40.55332_x64\Version = "80.40.55332"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\dotnet_runtime_80.40.55332_x64	windowsdesktop-runtime-10.0.10-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\5D9ADA2B34E5318566B5BBB43BFD9EF6	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A8A84F1AA6E5EFD5BE00C8237B84D6D4\F94CC8A8E1D7CD547B5B53FF162A2CE5	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\0BDCF144A30A03141A5DFF8D5CC3FFB6\MainFeature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E2BFCB0F8784E6F4DBD5A3FB2F4628E9\SourceList\PackageName = "windowsdesktop-runtime-10.0.10-win-x64.msi"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2FA394AD12A558D4BB7557D75752BE37\Version = "1344854052"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E2BFCB0F8784E6F4DBD5A3FB2F4628E9\ProductName = "Microsoft Windows Desktop Runtime - 10.0.10 (x64)"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E2BFCB0F8784E6F4DBD5A3FB2F4628E9\DeploymentFlags = "3"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2FA394AD12A558D4BB7557D75752BE37\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F94CC8A8E1D7CD547B5B53FF162A2CE5\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F94CC8A8E1D7CD547B5B53FF162A2CE5\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2FA394AD12A558D4BB7557D75752BE37\ProductName = "Microsoft .NET Host FX Resolver - 10.0.10 (x64)"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2FA394AD12A558D4BB7557D75752BE37\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2FA394AD12A558D4BB7557D75752BE37\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.40.55332_x64\DisplayName = "Microsoft .NET Host FX Resolver - 10.0.10 (x64)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\834CD68BBAA561857EB26882AAFC6242\0BDCF144A30A03141A5DFF8D5CC3FFB6	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\5D9ADA2B34E5318566B5BBB43BFD9EF6\E2BFCB0F8784E6F4DBD5A3FB2F4628E9	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\9309C9E278150CC5452917C0EA916C61	msiexec.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.10-win-x64.exe:Zone.Identifier	msedge.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
932	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3980	msiexec.exe
3980	msiexec.exe
3980	msiexec.exe
3980	msiexec.exe
3980	msiexec.exe
3980	msiexec.exe
3980	msiexec.exe
3980	msiexec.exe
1588	msedge.exe
1588	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4776	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeIncreaseQuotaPrivilege	4776	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeSecurityPrivilege	3980	msiexec.exe
Token: SeCreateTokenPrivilege	4776	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeAssignPrimaryTokenPrivilege	4776	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeLockMemoryPrivilege	4776	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeIncreaseQuotaPrivilege	4776	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeMachineAccountPrivilege	4776	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeTcbPrivilege	4776	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeSecurityPrivilege	4776	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeTakeOwnershipPrivilege	4776	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeLoadDriverPrivilege	4776	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeSystemProfilePrivilege	4776	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeSystemtimePrivilege	4776	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeProfSingleProcessPrivilege	4776	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeIncBasePriorityPrivilege	4776	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeCreatePagefilePrivilege	4776	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeCreatePermanentPrivilege	4776	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeBackupPrivilege	4776	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeRestorePrivilege	4776	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeShutdownPrivilege	4776	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeDebugPrivilege	4776	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeAuditPrivilege	4776	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeSystemEnvironmentPrivilege	4776	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeChangeNotifyPrivilege	4776	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeRemoteShutdownPrivilege	4776	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeUndockPrivilege	4776	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeSyncAgentPrivilege	4776	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeEnableDelegationPrivilege	4776	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeManageVolumePrivilege	4776	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeImpersonatePrivilege	4776	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeCreateGlobalPrivilege	4776	windowsdesktop-runtime-10.0.10-win-x64.exe
Token: SeRestorePrivilege	3980	msiexec.exe
Token: SeTakeOwnershipPrivilege	3980	msiexec.exe
Token: SeRestorePrivilege	3980	msiexec.exe
Token: SeTakeOwnershipPrivilege	3980	msiexec.exe
Token: SeRestorePrivilege	3980	msiexec.exe
Token: SeTakeOwnershipPrivilege	3980	msiexec.exe
Token: SeRestorePrivilege	3980	msiexec.exe
Token: SeTakeOwnershipPrivilege	3980	msiexec.exe
Token: SeRestorePrivilege	3980	msiexec.exe
Token: SeTakeOwnershipPrivilege	3980	msiexec.exe
Token: SeRestorePrivilege	3980	msiexec.exe
Token: SeTakeOwnershipPrivilege	3980	msiexec.exe
Token: SeRestorePrivilege	3980	msiexec.exe
Token: SeTakeOwnershipPrivilege	3980	msiexec.exe
Token: SeRestorePrivilege	3980	msiexec.exe
Token: SeTakeOwnershipPrivilege	3980	msiexec.exe
Token: SeRestorePrivilege	3980	msiexec.exe
Token: SeTakeOwnershipPrivilege	3980	msiexec.exe
Token: SeRestorePrivilege	3980	msiexec.exe
Token: SeTakeOwnershipPrivilege	3980	msiexec.exe
Token: SeRestorePrivilege	3980	msiexec.exe
Token: SeTakeOwnershipPrivilege	3980	msiexec.exe
Token: SeRestorePrivilege	3980	msiexec.exe
Token: SeTakeOwnershipPrivilege	3980	msiexec.exe
Token: SeRestorePrivilege	3980	msiexec.exe
Token: SeTakeOwnershipPrivilege	3980	msiexec.exe
Token: SeRestorePrivilege	3980	msiexec.exe
Token: SeTakeOwnershipPrivilege	3980	msiexec.exe
Token: SeRestorePrivilege	3980	msiexec.exe
Token: SeTakeOwnershipPrivilege	3980	msiexec.exe
Token: SeRestorePrivilege	3980	msiexec.exe
Token: SeTakeOwnershipPrivilege	3980	msiexec.exe

Suspicious use of FindShellTrayWindow 13 IoCs

pid	Process
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
580	wixstdba.exe
560	msedge.exe

Suspicious use of SetWindowsHookEx 19 IoCs

pid	Process
4172	OpenWith.exe
4172	OpenWith.exe
4172	OpenWith.exe
4172	OpenWith.exe
4172	OpenWith.exe
4172	OpenWith.exe
4172	OpenWith.exe
4172	OpenWith.exe
4172	OpenWith.exe
4172	OpenWith.exe
4172	OpenWith.exe
4172	OpenWith.exe
4172	OpenWith.exe
4172	OpenWith.exe
4172	OpenWith.exe
4172	OpenWith.exe
4172	OpenWith.exe
4172	OpenWith.exe
4172	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1124 wrote to memory of 560	1124	ContextMenuManager.exe	80
PID 560 wrote to memory of 3876	560	msedge.exe	81
PID 560 wrote to memory of 1876	560	msedge.exe	82
PID 560 wrote to memory of 1940	560	msedge.exe	83
PID 560 wrote to memory of 1876	560	msedge.exe	82
PID 560 wrote to memory of 1876	560	msedge.exe	82
PID 560 wrote to memory of 3044	560	msedge.exe	84
PID 560 wrote to memory of 3044	560	msedge.exe	84
PID 560 wrote to memory of 5076	560	msedge.exe	86
PID 560 wrote to memory of 5076	560	msedge.exe	86
PID 560 wrote to memory of 5076	560	msedge.exe	86
PID 560 wrote to memory of 4880	560	msedge.exe	87
PID 560 wrote to memory of 4880	560	msedge.exe	87
PID 560 wrote to memory of 4880	560	msedge.exe	87
PID 560 wrote to memory of 2552	560	msedge.exe	88
PID 560 wrote to memory of 2144	560	msedge.exe	89
PID 560 wrote to memory of 2552	560	msedge.exe	88
PID 560 wrote to memory of 2552	560	msedge.exe	88
PID 560 wrote to memory of 3596	560	msedge.exe	91
PID 560 wrote to memory of 2144	560	msedge.exe	89
PID 560 wrote to memory of 2144	560	msedge.exe	89
PID 560 wrote to memory of 3596	560	msedge.exe	91
PID 560 wrote to memory of 3596	560	msedge.exe	91
PID 560 wrote to memory of 2736	560	msedge.exe	90
PID 560 wrote to memory of 2736	560	msedge.exe	90
PID 560 wrote to memory of 2736	560	msedge.exe	90
PID 560 wrote to memory of 4172	560	msedge.exe	93
PID 560 wrote to memory of 4172	560	msedge.exe	93
PID 560 wrote to memory of 2308	560	msedge.exe	94
PID 560 wrote to memory of 2308	560	msedge.exe	94
PID 560 wrote to memory of 2912	560	msedge.exe	96
PID 560 wrote to memory of 2912	560	msedge.exe	96
PID 560 wrote to memory of 1640	560	msedge.exe	97
PID 560 wrote to memory of 1640	560	msedge.exe	97
PID 560 wrote to memory of 3632	560	msedge.exe	99
PID 560 wrote to memory of 1044	560	msedge.exe	100
PID 1044 wrote to memory of 3968	1044	msedge.exe	101
PID 560 wrote to memory of 1280	560	msedge.exe	102
PID 560 wrote to memory of 1280	560	msedge.exe	102
PID 560 wrote to memory of 4332	560	msedge.exe	103
PID 560 wrote to memory of 4332	560	msedge.exe	103
PID 560 wrote to memory of 2916	560	msedge.exe	104
PID 560 wrote to memory of 2916	560	msedge.exe	104
PID 560 wrote to memory of 4688	560	msedge.exe	105
PID 560 wrote to memory of 4688	560	msedge.exe	105
PID 560 wrote to memory of 4872	560	msedge.exe	106
PID 560 wrote to memory of 4872	560	msedge.exe	106
PID 560 wrote to memory of 1552	560	msedge.exe	107
PID 560 wrote to memory of 1552	560	msedge.exe	107
PID 560 wrote to memory of 1552	560	msedge.exe	107
PID 560 wrote to memory of 2124	560	msedge.exe	109
PID 560 wrote to memory of 2124	560	msedge.exe	109
PID 560 wrote to memory of 2124	560	msedge.exe	109
PID 560 wrote to memory of 1008	560	msedge.exe	108
PID 560 wrote to memory of 1008	560	msedge.exe	108
PID 560 wrote to memory of 1808	560	msedge.exe	110
PID 560 wrote to memory of 2464	560	msedge.exe	111
PID 2464 wrote to memory of 580	2464	windowsdesktop-runtime-10.0.10-win-x64.exe	112
PID 2464 wrote to memory of 4776	2464	windowsdesktop-runtime-10.0.10-win-x64.exe	113
PID 2660 wrote to memory of 3300	2660	windowsdesktop-runtime-10.0.10-win-x64.exe	117
PID 3980 wrote to memory of 644	3980	msiexec.exe	118
PID 560 wrote to memory of 1224	560	msedge.exe	119
PID 560 wrote to memory of 3576	560	msedge.exe	120
PID 560 wrote to memory of 4496	560	msedge.exe	121

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\ContextMenuManager.exe
"C:\Users\Admin\AppData\Local\Temp\ContextMenuManager.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?framework=Microsoft.NETCore.App&framework_version=10.0.0&arch=x64&rid=win-x64&os=win10&gui=true
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2e8,0x368,0x7ffb36b2c188,0x7ffb36b2c194,0x7ffb36b2c1a0
    3⤵
    PID:3876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1720,i,6804035462695307310,16552216392622864356,262144 --field-trial-handle=2168,i,15303991487454523389,2694380319883216498,262144 --variations-seed-version --mojo-platform-channel-handle=2164 /prefetch:2
    3⤵
    PID:1876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1828,i,16546570591581131502,7075651541344836252,524288 --field-trial-handle=2168,i,15303991487454523389,2694380319883216498,262144 --variations-seed-version --mojo-platform-channel-handle=2204 /prefetch:11
    3⤵
    - Downloads MZ/PE file
    - System Time Discovery
    PID:1940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2424,i,14505676964880899013,12678015801745868391,524288 --field-trial-handle=2168,i,15303991487454523389,2694380319883216498,262144 --variations-seed-version --mojo-platform-channel-handle=3152 /prefetch:13
    3⤵
    PID:3044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3508,i,637991568890260795,16228521256978578014,2097152 --field-trial-handle=2168,i,15303991487454523389,2694380319883216498,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
    3⤵
    PID:5076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3512,i,9952440994501426783,11412285683853727493,2097152 --field-trial-handle=2168,i,15303991487454523389,2694380319883216498,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:1
    3⤵
    PID:4880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4120,i,15957474648013579835,18120889282387027207,2097152 --field-trial-handle=2168,i,15303991487454523389,2694380319883216498,262144 --variations-seed-version --mojo-platform-channel-handle=4164 /prefetch:1
    3⤵
    PID:2552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4144,i,8406166464862270424,18057717060162473367,2097152 --field-trial-handle=2168,i,15303991487454523389,2694380319883216498,262144 --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:9
    3⤵
    PID:2144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4216,i,3940009887393514104,11054659702069070792,2097152 --field-trial-handle=2168,i,15303991487454523389,2694380319883216498,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:1
    3⤵
    PID:2736
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4228,i,825570612801553256,6781274854114178277,2097152 --field-trial-handle=2168,i,15303991487454523389,2694380319883216498,262144 --variations-seed-version --mojo-platform-channel-handle=1712 /prefetch:9
    3⤵
    PID:3596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3580,i,16137169525838694529,7546313817511192014,524288 --field-trial-handle=2168,i,15303991487454523389,2694380319883216498,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:14
    3⤵
    PID:4172
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5536,i,12221682437048228491,17973063299686917118,524288 --field-trial-handle=2168,i,15303991487454523389,2694380319883216498,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:14
    3⤵
    PID:2308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3724,i,12622423778233313140,18187348548919342936,524288 --field-trial-handle=2168,i,15303991487454523389,2694380319883216498,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:14
    3⤵
    PID:2912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5540,i,15808427983333724368,5695523765144186204,524288 --field-trial-handle=2168,i,15303991487454523389,2694380319883216498,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:14
    3⤵
    PID:1640
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3596,i,17577771426119591378,4726350937450802316,524288 --field-trial-handle=2168,i,15303991487454523389,2694380319883216498,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:14
    3⤵
    PID:900
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3596,i,17577771426119591378,4726350937450802316,524288 --field-trial-handle=2168,i,15303991487454523389,2694380319883216498,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:14
    3⤵
    PID:3632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6172,i,9870976681391223424,3945694321887771771,524288 --field-trial-handle=2168,i,15303991487454523389,2694380319883216498,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:14
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=1132
      4⤵
      PID:3968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6392,i,772026404594753703,18115438855513350826,524288 --field-trial-handle=2168,i,15303991487454523389,2694380319883216498,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:14
    3⤵
    PID:1280
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6616,i,7195107498964041783,17659822467676468647,524288 --field-trial-handle=2168,i,15303991487454523389,2694380319883216498,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:14
    3⤵
    PID:4332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6752,i,6156273437190213066,12275799808219634043,524288 --field-trial-handle=2168,i,15303991487454523389,2694380319883216498,262144 --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:14
    3⤵
    PID:2916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6788,i,14157045650418967085,10234208163670758370,524288 --field-trial-handle=2168,i,15303991487454523389,2694380319883216498,262144 --variations-seed-version --mojo-platform-channel-handle=6792 /prefetch:14
    3⤵
    PID:4688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6736,i,7698428401061104652,14680682696262885574,524288 --field-trial-handle=2168,i,15303991487454523389,2694380319883216498,262144 --variations-seed-version --mojo-platform-channel-handle=6800 /prefetch:14
    3⤵
    PID:4872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6712,i,12787497392028543474,9468136723537390070,2097152 --field-trial-handle=2168,i,15303991487454523389,2694380319883216498,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:1
    3⤵
    PID:1552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6444,i,4160285397391687369,8169460915645428296,524288 --field-trial-handle=2168,i,15303991487454523389,2694380319883216498,262144 --variations-seed-version --mojo-platform-channel-handle=6844 /prefetch:14
    3⤵
    PID:1008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=4040,i,4460741744655055093,12751004389747241343,2097152 --field-trial-handle=2168,i,15303991487454523389,2694380319883216498,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:1
    3⤵
    PID:2124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,11565869740559434438,377673437485818962,524288 --field-trial-handle=2168,i,15303991487454523389,2694380319883216498,262144 --variations-seed-version --mojo-platform-channel-handle=4160 /prefetch:14
    3⤵
    - Subvert Trust Controls: Mark-of-the-Web Bypass
    - NTFS ADS
    PID:1808
- - C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.10-win-x64.exe
    "C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.10-win-x64.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2464
  - - C:\Windows\TEMP\{491E4D67-FDC2-44F4-8437-563D572448A8}\.ba\wixstdba.exe
      "C:\Windows\TEMP\{491E4D67-FDC2-44F4-8437-563D572448A8}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{3B411440-C472-407D-BBBF-5598EFB3F338} {9C7C33F3-595A-43E2-AD4D-7A501901B4D4}
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      PID:580
  - - C:\Windows\TEMP\{491E4D67-FDC2-44F4-8437-563D572448A8}\.be\windowsdesktop-runtime-10.0.10-win-x64.exe
      "C:\Windows\TEMP\{491E4D67-FDC2-44F4-8437-563D572448A8}\.be\windowsdesktop-runtime-10.0.10-win-x64.exe" -q -burn.elevated BurnPipe.{D079C1D0-E2A0-4E5D-A971-40338ED3E40C} {23C99886-8FF5-4670-BBF1-335DFB66E24F} 2464
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      PID:4776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7260,i,8951049622923956508,458612531665365553,524288 --field-trial-handle=2168,i,15303991487454523389,2694380319883216498,262144 --variations-seed-version --mojo-platform-channel-handle=7248 /prefetch:14
    3⤵
    PID:1224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4880,i,12370163042803926542,2247733750772853424,524288 --field-trial-handle=2168,i,15303991487454523389,2694380319883216498,262144 --variations-seed-version --mojo-platform-channel-handle=7252 /prefetch:14
    3⤵
    PID:3576
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4924,i,13030441986417942908,13509484917961859529,524288 --field-trial-handle=2168,i,15303991487454523389,2694380319883216498,262144 --variations-seed-version --mojo-platform-channel-handle=7904 /prefetch:14
    3⤵
    PID:4496
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3672,i,7734165011182328034,7910493107516845896,524288 --field-trial-handle=2168,i,15303991487454523389,2694380319883216498,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:14
    3⤵
    PID:1168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6256,i,9292866208411620298,9168654673902060894,524288 --field-trial-handle=2168,i,15303991487454523389,2694380319883216498,262144 --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:14
    3⤵
    PID:4392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3652,i,10817728021709587666,3804758972731328449,524288 --field-trial-handle=2168,i,15303991487454523389,2694380319883216498,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:14
    3⤵
    PID:1144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4932,i,11127033349006370466,7293318403999640408,524288 --field-trial-handle=2168,i,15303991487454523389,2694380319883216498,262144 --variations-seed-version --mojo-platform-channel-handle=8036 /prefetch:14
    3⤵
    PID:3848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2380,i,8930180668944232789,9781206450632423473,262144 --field-trial-handle=2168,i,15303991487454523389,2694380319883216498,262144 --variations-seed-version --mojo-platform-channel-handle=7952 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3640,i,16466386123600504646,4077852812084071737,524288 --field-trial-handle=2168,i,15303991487454523389,2694380319883216498,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:14
    3⤵
    PID:2068

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2708

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3980
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 6C8A8DEB2E5C0D7C8CA9A2D25FDC94DD
  2⤵
  - Loads dropped DLL
  PID:644
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 882ACE2FC2AD4DB7AFDF8D9B2D0836DB
  2⤵
  - Loads dropped DLL
  PID:3304
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding A4BA1F75BC82DF4B5768173EFAAC738F
  2⤵
  - Loads dropped DLL
  PID:4616
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding FA9785415D8060064A2804FBB224E663
  2⤵
  - Loads dropped DLL
  PID:2444

C:\ProgramData\Package Cache\{866BECDA-F284-473A-9E84-0CCE816BF06F}\windowsdesktop-runtime-10.0.10-win-x64.exe
"C:\ProgramData\Package Cache\{866BECDA-F284-473A-9E84-0CCE816BF06F}\windowsdesktop-runtime-10.0.10-win-x64.exe" /burn.runonce
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2660
- C:\ProgramData\Package Cache\{866BECDA-F284-473A-9E84-0CCE816BF06F}\windowsdesktop-runtime-10.0.10-win-x64.exe
  "C:\ProgramData\Package Cache\{866BECDA-F284-473A-9E84-0CCE816BF06F}\windowsdesktop-runtime-10.0.10-win-x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.10_(x64)_20260810033715.log"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3300
- - C:\Windows\TEMP\{01FE54E0-2F9B-49AE-8DA0-FB06F0DC352F}\.ba\wixstdba.exe
    "C:\Windows\TEMP\{01FE54E0-2F9B-49AE-8DA0-FB06F0DC352F}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{19EA6B19-43CC-448D-B64A-1B27F040FA98} {39CF0A5F-1F18-44A1-85FD-D82E3758AF4C}
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5032

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4640

C:\Users\Admin\AppData\Local\Temp\ContextMenuManager.exe
"C:\Users\Admin\AppData\Local\Temp\ContextMenuManager.exe"
1⤵
- Loads dropped DLL
- Drops desktop.ini file(s)
PID:1300

C:\Users\Admin\AppData\Local\Temp\ContextMenuManager.exe
"C:\Users\Admin\AppData\Local\Temp\ContextMenuManager.exe"
1⤵
PID:3684

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4172

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\ContextMenuManager\Config\Config.ini
1⤵
- Opens file in notepad (likely ransom note)
PID:932

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e58ab80.rbs

Path C:\Config.Msi\e58ab80.rbs
Size 11KB
SHA256 db148bc973cb5a1d52b595b154f981667ff06ca2e8c0f5fc6671e14b7bdc27df
MD5 5fbd6147526efb9f11be757017b46c0d
SHA1 bbd217b648b34a197a0d653a7be6777b01b654c8
SHA512 dadd7a86309a0cc3a75ef228d91f01749e79d8184baa0ab53ae6e7c14f70d68598668417865ac4ea0778566173d7f7679835e5072ddaecb077953e79db0c8c47
SSDEEP 192:XrHHCR6CUtz5HTAQ9CpxARI1ARlHE+o5Ca35pbM:XrHHCR6CUtz5HMVAoAzaM
TLSH
T1873253417614D2D3E9DB2B38D71727713B73D3A98314664F06DCC22C4F8B7884A68EAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58ab87.rbs

Path C:\Config.Msi\e58ab87.rbs
Size 9KB
SHA256 e5c9b7a5dc83e6fcd0a9c42832926e18884fb0f5630bd7067060de7c0cee4859
MD5 85f79c19ba9f00a46ab2142ff8d7a0b4
SHA1 60b78f55148797da69694b856cc31282450d5189
SHA512 4e31042a727d7ccf306e686069786198f19ea8b4eadf7aef89f2a2f99ee5a3d5a3e48d28790f239a0a5f0d44254c8806b67119c1d7932c1cf7f62d30c095a8bf
SSDEEP 96:3mSDTaA3rWS2CnIFeUzeD2AyCsTlyyUzeD2AyC6jMlN8gnuTlyfnyP7E5d7P/53k:WCmOECgxIRIIIRP0F7EbnKCCi5pu3
TLSH
T14B121012750081A2E9921B39C7133B223BBAD3D9A315665F48CDF9F41E03BD52FA91DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58ab8c.rbs

Path C:\Config.Msi\e58ab8c.rbs
Size 49KB
SHA256 4ef6be8c9ccd5d7d439c0ba52e8a858267ddaa4d014e288fd16d1fe78592ddc4
MD5 37ba287ce6ae3b78699b7efef387f2ca
SHA1 b907138b8a2b496a872a804edc29a747b661c81f
SHA512 dc8a041f873142c5d19f6e816e83774d058893bc3c56a4ee5a665f6f8a314b75d137623b948b53bdb95d30c75dc4fc31827f8b089a777c3fcdd01d23a67cde2a
SSDEEP 1536:EHZgOohW4wN5RaHB/LyM/ajqmuUHr92ha8u3tn2N8zRM9Wc/hihbZGXEpp4IQPDI:JNgeE+GD
TLSH
T122335461DB08C0F2F9333DA26770F8847719C99AE34095AD16D60144CEA6EEEDEBD1E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58ab91.rbs

Path C:\Config.Msi\e58ab91.rbs
Size 71KB
SHA256 d459d16d6d440bec780cd8667560c5f3141ce2e5842754995f876f78b70d299a
MD5 de307965c60ae596545b4b8dcde9ca90
SHA1 ddb97be6b0802bfa553f3b671dcd9177de706fbf
SHA512 6ebfa12a0e47c33ac61ec19f1d056ca651f326ea622bae63e7f0f4c64d8978603825a064ee9b520496da14e685307c030e85d1703a4232677fd6d73894703a23
SSDEEP 1536:JlTX+EvElgJPlhUR+6svby5ybcmb/WrPMmq0mgG2WdDfbH9cMWmHDCaJVZ/KoLHh:1u2T+LmEEiycECCoeWs
TLSH
T18D6325BA7A14D1C1BC732DD457BBE916AD054C7393608D2E63CC4129CDD2A86EFB86E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ThirdPartyNotices.txt

Path C:\Program Files\dotnet\ThirdPartyNotices.txt
Size 77KB
SHA256 deb4427a295e1ed474b0d81c5a0d972c1b550b9a715cda939cdfa9236b1b418f
MD5 0d8867a25ba926e6e40cd52ab3536b5c
SHA1 89390dc8b8318d0bfef1c6a2fb4783537e28a465
SHA512 317ca335405274f4f91b173651ca2826760acb5ba5cf41aff51adc55c2cda9059fb268333665f13f62fa48119e55a303720a780dd58d28dd9967db4c88407d61
SSDEEP 1536:HA9jHwsGfgg39/zwgAVkguQxrDjugtSEGepkWvrpX7anuqdLSVnfiStPq+3LefrL:HA97w/ogz1AVxuMjHtSFULryLOgrGWm+
TLSH
T17773A45F7E45077319E2C3916569A8C5F22FA02E3B6B2A44346EF248133B42DD6FF858
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 163KB
SHA256 4377f10c78400f0370b88156773de9843c07f14e65b3232005ec3179ef38d463
MD5 363603c51aa522bf21b2e8320a51c54e
SHA1 b4dba9e0d47c9fd4636549d5a23fe1a96faf9b1f
SHA512 b2b045ad8538416bd81753359ca86ba956f2ac99befeb89c7c03993741411703e03f4373d11cb94992cb93ed569d6741954111f4ad519daebcb18138800877ce
SSDEEP 3072:oGgPYwruvTSBbQ/fp4SbDqIG/vk7l55wK9vLPg:oG4rubgbQpDvqIbt10
TLSH
T1A6F3F61AD65811AAD06E9575CB428941BB337C668BE0E3CB53C0F9BE0F726905EF9703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

state.rsm

Path C:\ProgramData\Package Cache\{866BECDA-F284-473A-9E84-0CCE816BF06F}\state.rsm
Size 1KB
SHA256 b6e130620798f7bd39306cfbc54f351c279631f45fbd737ce808a23cae1ed732
MD5 4cc167ee5e80c908f3cec20447c9e1c6
SHA1 da9a58fa7558f93c2d9a332255b892eabbf1d56f
SHA512 24ad1747636e8100341677bdd1dc3cc29a3722aa47797be0284996f908f4c7e83255d72063dee7528eae646fb148d4b9b6fc5194212c6bd600ff7a418a8b6984
TLSH
T18321D1515BF6092CF3F6AB3469F96665443BBC121C24C26E0001318A9E32BD0CCB0B37
MD5 SHA1 SHA512 TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 26374662fab280ef96eaa929fd16d9c29e3f74bff1e5cdf49f3940b212c74426
MD5 b3d937ce21fb8a9c36b91767a220b12b
SHA1 792049998f48955661735784aa1a6653cfd6d461
SHA512 05958eec7798844717209ca31b3321bd05988e5248f66df4ba666cf3bbad7c9d2a9fd23d375157547fdb301a268f9f7b0a6a6c7b7c9fa62856f0848ecb862773
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7l:fwUQC5VwBIiElEd2K57P7l
TLSH
T190B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\protocols.json
Size 3KB
SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
MD5 5e2067a92dcfcb05537479c384a89725
SHA1 eeed29b07d865ac4d46629fddadad629d0ad4e2b
SHA512 c96c5f9cb7a169ad91b070b567cf9fa8f35951ccc5aa930e97dbeccbeac27f7e9dde1379138c9ba6b0d10339f9cb053ef21f19f06d7560f97d5d23a27c8ed4f6
TLSH
T17D7184B7862088194E360AB4AA0DF10DF93702DF2AF598D3B27D455F1F712BB3946249
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 bb2092aac65238f5c99a5041af4953f8df51484d0a523a06aaae064a4d1a8d8a
MD5 af65f1c9855ae2782507fa1daccd541e
SHA1 5392700bc0ec9624591499a538382cfc2ceba4eb
SHA512 8cbc9270f956100bcbaf414b1e907e92e012fc02f78de428360dd6c7b0c95d06de275470c8505a7b078f6ac12e8dca1fbf876ba7278a4f4b1bde7ed100e3d323
TLSH
T1FDD0A771B9A9DAA0C17A003680206610526901E5656B5A85A1E4882E9976050A6DE9DA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3d6022b8b09d410224e6f49ce6c5693abe531fcaf66bb13ef03126afd2691fe0
MD5 57d5bda89a3ce0cec5e5ba7de9f0b14b
SHA1 f3acef3d86afcfd0b7d491c8c55dd0679342b314
SHA512 b3100104fdba74d8ec0cde3847c8629b3f4d7d2f4eb07a7e44b61ece266b201daf1b4c4f2922da6731aa7e1518a90a163383bcb9d2738a6f78d052f8141237c8
TLSH
T1D4D012237A9CA410D2A78131D017D71556A910E468575A45F2A4C86D556B0A467CD187
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 940cbc9ecbe8080b4f78231e8ea559e5f25ba4586d9b9c7484580010ea141f8b
MD5 7b136c46d44a9c4f8f42a3893196bfa2
SHA1 65e92a8f631d018328a7c2cd1ea9b52d24fb05ed
SHA512 06b71e8d2ad9deb7c9ad47e7b7fc808b8513e4cd6ba4c5e561fab3aec9e937d3990c50625c22f7f7a281e06579a42d4a615f255576af4efa3a9daab503cc1a59
TLSH
T1E7D022233A8CA800D2A78130C016C30002A900E068178A01F2A4C82C442B0E063CD183
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 792f6ea302ec115679cf106a287abc680d0cc3fabc869fed040a897cb64bc8c8
MD5 2aa879eaa2176bf167a7c32da99115bb
SHA1 802fad15d0f823661a79f758642d01685bac1ba2
SHA512 be204810ce6e7daf5d91ada1200405be74fc61b8ef822578bdec2ff8bf883f9fb363722b20412d36b6fef6807902dad45422150cf2d5c28a26564bd2f4546866
TLSH
T1117161A00556DD52D32145F4D2E2D22B3EB148D9C7970E4E7AB42FBD2D05729C8D703D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58db86.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58db86.TMP
Size 3KB
SHA256 e5a9ad5ffc907b61619251a580ba6f2df8f4bb60fe6a8c0ec7c106318eda7d9c
MD5 9afc13656ab984d3f98e196a5922a50f
SHA1 0777ee35aab4b0231d3a128333037cd8dff0b2b8
SHA512 9af286ddf6f76c394b5c8df912ced6dc2e0a758ff9ecea4963aaff22a7dea4e48e1c8d2b3b59758d811d55b8a155c523f6e13e29dacae06b89d30c5387f814e4
TLSH
T1687193640617CD96E3620574E2E2D21B3EB18899CB970E8E7AB46B7E2E05728C4D703C
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 1c2d237d2da8a55051ec14824cd383d2b845299964e7df5474742aa6d95fb112
MD5 9da529b1e124dc5fd0784d623b832086
SHA1 64844374cc8c4528c6dea003112dcb5944397375
SHA512 3fca64980583c03f82253922778574a32367d0afdf1b4ed7d43af095e62d79bf1c7504ee296b74d862a419e0a756edc75f349be6d4f6a0ebd82382d73733b6a2
SSDEEP 3:MsEllllkEthXllkl2zExllVXtl:/M/xT02zw9l
TLSH
T156440444FFC10405D70410704013C3700371D550051157473DF10C53FCF55500C00000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 21d8e8db3d9ea278375b905549b919e0f34b3ce04988da33848f4b5379be453d
MD5 958f8fe189e5832dc2f5a960ea9137bd
SHA1 b36bebd229e3e4387b2c4856a3e06786059bd367
SHA512 b261294743a2fe28c604084cb19c8a64918a2b3d39b3cbc5ea1bc5bff86d000c424cd9fd9cb646523209729aa7a3d31a84ed4a928cdc3341d67ada14ef173c29
TLSH
T10A51BCF783B4856E8A1196F09A18AF2FDF2D0615431C7C6989D4EE27D3E3472E10265F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 31bcdbb605e01d86d196e6ed74955b5d7317caa2f6adca7726fc1867122490b9
MD5 97822b8898b33283bf1433c5e6e3a310
SHA1 04814abbfca81a3e35feec8bc0af031ebba12fef
SHA512 c972688311c9a8a6b139ff60ce1b7350180081f084e3328c5b886b3e1cb3892b7b35c88539cb4753751172313920422bbd0e380a1221037b9cade73ff970d14c
TLSH
T11751BCF783B4856E8A1196F09A18AF2FDF2D0615431C7C6989D4EE27D3E3472E10265F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 39e8c425ffb787f63493d0581ca515204fd07b89408b53275c2a605658bc2186
MD5 04674b48417546c1327928f4b0f52cfb
SHA1 3e55284f9bf5b245bc5474bc5655a5b4d024dbd8
SHA512 21cea095813dc8f52e7c6915c734ec04b29dcf5fa45b67dd8fd2ea345effaf10fe739605c42b163f06feb3b0f61e4bb92d68267c58c580525298df2efbdcf941
SSDEEP 192:sxZOaRiyM/jK1Ml8MNr/fNsGDtUJjIdpfT/W6+WNrOi/A00YaFKMIg4J:sxZOaA1r/fNsGDKJ8r/b3/IXc
TLSH
T1EA52FB05AA34997BCCCBD209BA54BB53D6F91563D2904E44AAFCD91C04E6BED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 054fac70703ee58842e9fa13784afc30c0ab4270617ff04cd39a23b381c2a689
MD5 66700d0b34c75ee1194bdf4b77df51f2
SHA1 3b88c55c2068709d1e85a0ec94ca72a62211ffdc
SHA512 903f65fb924765ba92ba72065da6872c0101d6a18b69c48e61c97124b8732d918781a0eda7279c1112ed132745866fd1af60f07f1cdde118adee5695db8e3ca7
SSDEEP 192:sxZOaRiyM/jK1Ml8UQqclr/fNs7qtUJjIdp5T/W6+WNrOi/A00Y4ABMIg5rJ:sxZOaAqrr/fNs7qKJ8d/b3/INb
TLSH
T17E620B06AA38597BCCDFD209F555BF53D6F9146292900E44AAFCDA1C00E7BED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 9e5a27e6f8b4883cdcf4ca21df625aa99760e4647a0a6c52c0f9bfe25fa7c048
MD5 88de9b834ec472b2102f4246ad0e9fa0
SHA1 6f67ff5456d23752fb2d18948d19c3c613d91516
SHA512 b2834b92fd3982cfe82f14e9e6deddb978f0f474ef9b344f600efb22d050a84b3ce5433eb898bbd080aa26b44630d92e6aa0976bea16aa99ccb8e7efdc750c7a
SSDEEP 192:sxZOaRiyM/jK1Ml8UQqWlr/fNscWpVpqtUJyIdp5T/W6+WNlVOi/A00wEAyraIgp:sxZOaAqnr/fNscWvpqKJ7d/bj/IZOp
TLSH
T1DF72FA06A938597BCCDBD20DFA557F53D6F9156292900E44AAFCDA1C00E7BED620382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 094dfdb3c4388a73fd0dcb19fa2f9dc6bc33ec149a1f1f67ed809ee4d7f8a7c3
MD5 4d942a0809ff9563f474b885e8bc9530
SHA1 cfac6f3b9e97c0a2541b764067e1f50bca367f1a
SHA512 f29398550426a182fc226e36b06c85c6a07b962e8c3c73f3da76abc796b9088e2008b3773aae4aa13faa086957673bd6395fa99e6df4cc5a0b6bbab3a7eeef15
SSDEEP 192:sxZOaRiyM/jK1Ml8Mlr/fNs7qtUJjIdpfT/W6+WNrOi/A00YruKMIg5rJ:sxZOaAtr/fNs7qKJ8r/b3/INb
TLSH
T151620A05BA38597BCCCFD209F645BF53D6F9142292900E44AAFCDA1C00E6BED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 107e0de26d7ef975ae3f89e15db881e919f1248d640d39fe6f6108296cd30f0c
MD5 77e0c01410009eb636197829605f06a6
SHA1 4e010c42bc1c6c9dac0dad06b1d319071f5541e5
SHA512 5ffd8ecfb103019b17fc72fa3eb0ecb8bc93647f7d3bbf53ef2d38f709d41c21b66e3d0f80804d70dc7e7840eb29a2a11c7f1b844d103d359767e8f730186868
SSDEEP 192:sxZOaRiyM/jK1Ml8Mgr/fNs7DtUJjIdpfT/W6+WNrOi/A00YaFKMIg5NJ:sxZOaA4r/fNs7DKJ8r/b3/IX5
TLSH
T105520B05AA34697BCCCFD209F655BF53D6F91562D2900E44AAFCDA1C04E6BED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 883d0ac9bf292637c4e067d296867eccd01265629ed7fe41d753f39294c73115
MD5 12bda0ff8860917d691960ddc611cec9
SHA1 fe8a47578c1b1f48bed304784ce2ceb8c65d9bde
SHA512 0771403efcebf7355eac7be4250043cc53330fde3f046549f0cd96720597108d23b52da4645e4aebfd7935031d7da02e9c1f45edf67aedde7857e7bde4d687f3
SSDEEP 768:d6l1j83r2AZ7pLuLfemWRmeKQBC8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3HjwALlj:d6l1j83r2AvEfemWRmeKQBCu1jaKHjwc
TLSH
T1F6032C3B780CCB7E4F844E9CEC267F9A6DE8018BA698895447F9440C03C67EF551A5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 e474a2d70f0001dc157975557e87202160d336083e1018495ac627cc917f46df
MD5 3849c772d4abd21fea3034791bf724d1
SHA1 e2e445db65c62fb453cbaed2bf03b74d108bb16f
SHA512 703f3884e6db807940966b46304cfe03bfc0d9bc729c4571f44358c9c43fe8c9cd5e7c51eb44f7f4b295ee51279d86432b835122d820cd4121fc99e76bc57013
SSDEEP 24:KdYIfYfYMY9aYidYqYaY24YqYm+Y9IjYgY2KiYVhaY+Y21EYIYmSmY8MYF8YAYnk:KkUIHKtecXy5hMIvK12c3yBAInKdGcW
TLSH
T1F8A1A74232BB42437C7E6908A692872B8B5676737114E5AF3BB840B24E27E344DFD4DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

75e4f09c-9dcb-4be5-be74-6b39e8c13902.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\75e4f09c-9dcb-4be5-be74-6b39e8c13902.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

office_endpoints_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2026.6.5.1\office_endpoints_list.json
Size 9KB
SHA256 f0c77aaacfc571e0bc3f51387febe134d991bf3c7f1941af303ed901f288dcd6
MD5 30719122f9edf4e23019a3b74e4f4325
SHA1 6707d64052797b9c5f1a5ccf016e5859c8ef898b
SHA512 ec2e1a33fcd1301f282512ffafb611ea705dc5df09d9aee014276909c1b62b0c73600121d94e9b6d9e160296672b41f2cb8c3ba23f121244ad2ea6521680723c
SSDEEP 96:DdQ/JJvwjyUsrdfsysVsnQfbJNZidYusysXYs2sFsdv12XvlRT07s/DkhcrHPglW:D7d7mfgiIWRcV4sobxezQd1Y
TLSH
T11512BB3BC4B49F229AB060659705E244F13C43BF5600C6FF76B9829C1F366ECA58E1E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 42c802013930256f759956530e0eeaf7e7e109adee3f1e47dbeaa3139b9a73d2
MD5 1b00e0d3ffc10dde4b2431ce0cd87974
SHA1 aa0e700ee66d96ce22aa7dcf1341245ce9e5b53f
SHA512 2d97091120d9c401e8573af9a912cbfdc8c481ddd0ff6ae30654cc259069ca1cc075cb84bd74d8ecd2988bb425a7a0e95afd88bc0f7c8af24ca13744de693d34
SSDEEP 768:QFPQ3wg/pNglOP2GtEqm43ccLoy6Dq1WK:8QdBtPMImGR
TLSH
T1540390F988E3993ED9AE6B47577D2D1289BCC033B5A84584F7881B0CCC625BFE306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 07d3f98d7bfb7a6cda4bbccdaa6489084149bc1b937e9ccf875a65b235587e02
MD5 58078ba7bc189690076e8f0d14d878aa
SHA1 c10db7341a4a1192abc670bd9dba9aadab17f8cf
SHA512 24f2aaa86d34f7a19ac22127af315353016db222a542cf5ced3c230582155b306bbae22b9f0cbf87ff7c8b6cd132a689d8200222fd41e28aa4590ba117061c58
SSDEEP 384:n1ZcIw8Nut/RsMYgX532MOWcVn/k6HlytEDq1rWK:NwrhHlOPpkoy6Dq1WK
TLSH
T180927D3059B8AC375AEFE145F48636139FF850779AD46F94D6EDAB2C008539D230AC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 dec2d9406c50774c42cfa45e8baee910d54e4a2c808f48ac3efb97247a86f4de
MD5 797576473d0d94669a1e122e4970a570
SHA1 6fd484759a66560ce93fbae9525c2e2c9cedf4b7
SHA512 d05a94089cd860ef1ab3868562548f0c19e718f4fc2b9f66ff06bb73f07d9066b379e75975fc3df1163236def67cfdff7c977fd4e20b9b4da2e5e91295c0b9d1
SSDEEP 192:6GNd6i5fQmiUytodKO7X5zPr2MOADUaj5oJU6:6GNd62hhAO7X532MOW5iJU6
TLSH
T14102C835B9687C778FE7AE45B58637235FE4102BE9946F80DAEC2B1C008768C1306937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 7cf46a31afaf6a94776a2f8e2e5db9541caf641f3320ebc4695cb0a78f2f5f13
MD5 69f1013b451f2e72dce9c2b03e37ca60
SHA1 76d531c3551a225f5cfee7b71e9d55579a71ee51
SHA512 2b97ab99e644897985b4eaa56240b988a6f1cecb9f0e2bf69a43b553f0bf6ff45b7c206db7a7ba783c090a005193ce83f34b25fcf1364aa26f6d4ae2efc100ec
SSDEEP 384:nDZcIh8NuLD/RtMYgX532MOWcVnXk6HlytEDq1rWK:bhB8HlOPhkoy6Dq1WK
TLSH
T16C927D3059B4AC775AEFF145F48636139FFC50779AE46F84E5EDAB2C008529D230AC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 89de23b08a348cbea2a0a8608486c9720d599a5fa4aa07843761339fafe98ef8
MD5 1331ceb694c9c1fe969042e4392c34df
SHA1 c0337e6438ea08ba5512b4df8cec19c71a771e5c
SHA512 b07db788d00ca89934d34e095045c64a9001485effb30ede879d46ecd6751c9139237b50d36b21567be2e3b08257633cd65ecec5580f6fd0b43e80dce9d584bb
SSDEEP 192:PGNP6i5VQmiUytMKo7X5zPr2MOADcVnMGQJqnZU6:PGNP62zio7X532MOWcVnWkU6
TLSH
T16912F834A8A8EC774ED7A555F5C732639EA81077DD84AF80D6EC6A2C00C678C274AC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 f7504462bb4688709432a1c0d284cb1dc03b6b2753c678e908a4b820e518f648
MD5 ee6cb0eafa5868091c98633faf220526
SHA1 330e8d8324c9825b3f4f3191d0969876d4a3421c
SHA512 c49ab16b2963c97481ff72dbe11a3368e93bfff7446cc6dff0046606863b5bb903ff3ca948c4d425ac8bcb94b84409b0a01bbff46ce0784f0a074846ae4e25db
SSDEEP 384:nbZcII8Nut/RUMYgX532MOWcVnXk6HlytEDq1rWK:DIrNHlOPhkoy6Dq1WK
TLSH
T167927D3059B8AC375AEFE105F48636139FF850779AD46F84D6EDAB2C008569D230AC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 bfe597b4ad8741b86326a5c45c0789794fa386f594f9879229ae884b19b1dc8c
MD5 13ce7983520ea1e3388f6aa03e205e2c
SHA1 57d670bfc8b1945338b1572f65b7f98c050a6587
SHA512 6f347a4a2477c99fc2dbf7be4c7cc3f808bc5af8231e06d74604df4d121d4465adebdbb0c0fdd54372706c4668a435780458a68d4f829af8adb539c00951f7e3
SSDEEP 384:nYqiFaZcIQ8N+8TUNTUlIlt/RsRYdDf0QX532MOWcVnqk6HlytEDq1rWK:QFYQ7wg/InglOP0koy6Dq1WK
TLSH
T13BE2B3F198E78936D9AE9783A77D3D428EBCC06375985984B7C85D0CCC822BFD30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nav_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json
Size 2KB
SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
MD5 499d9e568b96e759959dc69635470211
SHA1 2462a315342e0c09fd6c5fbd7f1e7ff6914c17e6
SHA512 3a5922697b5356fd29ccf8dcc2e5e0e8c1fd955046a5bacf11b8ac5b7c147625d31ade6ff17be86e79c2c613104b2d2aebb11557399084d422e304f287d8b905
TLSH
T16B51DB73D5988C4B9BF4A29CE919A309F11107CF75D48C0B76BE010C1F7757AB5C6588
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

69e8b5e0-8341-4a79-83dc-fdff2c88bb1c.tmp

Path C:\Users\Admin\AppData\Local\Temp\69e8b5e0-8341-4a79-83dc-fdff2c88bb1c.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7cfeed21-1434-4e2f-a7cf-3944472af60a.tmp

Path C:\Users\Admin\AppData\Local\Temp\7cfeed21-1434-4e2f-a7cf-3944472af60a.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

95687712-ab7d-4f40-a6ea-682501c5d73d.tmp

Path C:\Users\Admin\AppData\Local\Temp\95687712-ab7d-4f40-a6ea-682501c5d73d.tmp
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_10.0.10_(x64)_20260810033715_000_DotNetHost.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.10_(x64)_20260810033715_000_DotNetHost.log
Size 4KB
SHA256 e1b6d656028221722eb34030e3350c08c8e28e200420e5a41269324240342632
MD5 0db446206b3d2d07c37ecdd6c03e65b1
SHA1 c31553a7d0f13ab0e9f0c703db44d903c762c7a2
SHA512 c231038da46f938c22f6e31d95ccf5c41d221a66731def3f5dc19d36183d72169a28380f7774fd4947b82ebefeab8a06dd0d70c65c8d15d1397754d240b895b3
TLSH
T1B681E8251AF5090DB2B35A87DBF3C0520A33FDDF59749F0D6249831A056F90698ACBBA
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_10.0.10_(x64)_20260810033715_001_DotNetHostFxr.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.10_(x64)_20260810033715_001_DotNetHostFxr.log
Size 2KB
SHA256 ca56acb77e60fe56a0e6e59ac7cc8fe0af9e710ca02fdf510bed936a8bf4b49f
MD5 2c9c5913f5118286aefde0f3f95a94a7
SHA1 368c0a4acd2b684772c8fabcb33863ccaef70a96
SHA512 e5cb0ca967ab3efb03d59317f05bd47d33efa9487de37d5ef471ae9389f4ffe956cea446f15ed449d96b79078826ff58f367de9f423335604429072ef42034ce
TLSH
T17C412C2A1AE5080DB1B2E7079BF3C0516E73FDDB6834CF0D22C94259466BD057898BBA
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_10.0.10_(x64)_20260810033715_002_DotNetRuntime.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.10_(x64)_20260810033715_002_DotNetRuntime.log
Size 2KB
SHA256 37c7675ff577e6b8ecb33dbeb42eb6b7c4926e2106cbf1e33a7cfb9fd291be4c
MD5 27e619d0d6b24a5d257986b2ceb03189
SHA1 8ca3eb59563bddd5454dce6f015ec7322122328a
SHA512 77238b486d85d1cd0cf020ba6c793766066dcef37774cc4fd69f032214d011c9712667411aa787026fe37b10e6b4db43f82088330f90c6ecb4e39600edeb3c53
TLSH
T12D41F7691BF5080DB2B2D7479BF380525E33FCEB9874CF0D13C84659466BC026D99BAA
MD5 SHA1 SHA512 TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir560_1444371322\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetHost

Path C:\Users\Admin\AppData\Local\Temp\{491E4D67-FDC2-44F4-8437-563D572448A8}\DotNetHost
Size 1012KB
SHA256 03eb33e8eb7746542febda19278dde1c7bd496396a69a9d625a05f9506a1c3ee
MD5 667bbe018d9a8052f0ed4d4b44a02ec8
SHA1 9af6e69d606a4741ada8a58f36b9c06c9cf22626
SHA512 5e07d476569a3c7bf938278adb2b710be015698e5c3f01a5aab2db319d07b8ea675758aeb201577d3d51394550c313dc4bf401397c44f846154fcec9a445c073
SSDEEP 12288:SN2etgX0xsm7HrObWMInYLE/BbdJ0zErWolCJ9TeWxqYZfDvXNM:i26gG74W6WBbdJwEqECJ9Te7YxDXN
TLSH
T1A2256A1BBFA404A9D8B24E75C5B78321EE357C482320969F43A47229DEFB7D0647A7C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetHostFxr

Path C:\Users\Admin\AppData\Local\Temp\{491E4D67-FDC2-44F4-8437-563D572448A8}\DotNetHostFxr
Size 1.1MB
SHA256 da12be59d35710ff0082f3506e84d741c00816290ac1d3093078e7c7b4ec2d51
MD5 ecd6f2e85cdb3623db79832c198448b2
SHA1 48580a0e26d28d8c3ec0c0418e1896eb70448285
SHA512 4764485b64fb4bb7e3c4e28678e172c84cf9f67a23a905a0cca8f9c4522cf404be3a5dd6cc23d3dd6fb96ea2bd7dae425ca36adb80324ec795ce560806575fa7
SSDEEP 24576:626gG74W6WBbdJwEqECJ9Te7YxM6fA9Ac:626748BnwEpI9T6Yu6lc
TLSH
T134357B1BBFA404A9D8A24EB5C5B78321FE357C082320959F43A47229DEFB7D0647A7C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetRuntime

Path C:\Users\Admin\AppData\Local\Temp\{491E4D67-FDC2-44F4-8437-563D572448A8}\DotNetRuntime
Size 28.2MB
SHA256 4af98ab9168f319b9d026e01bd6e9df577799a222b04454579053a5a00abd555
MD5 8fe07617a818797bf2170e4ca5f4bb95
SHA1 126523726901f0a1129d9066c369f963f1ef5854
SHA512 75544a3a9bff83e7fed005ecfd0847ce32442e82c53879097518fd03ef4f6d8364bd5400912613d1eb33f6ae1e262bd1a61087960fbc6655ecd03260072bdaea
SSDEEP 786432:Tg+OS4VhnxfDEAOZGc3PHDOsz1tHDypQp:TF43nxfYnvDOsqu
TLSH
T12A573397BFA408A9D4A24E71C5B78325EF313C182721C59B42607669EFFB3D464BA7C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsDesktopRuntime

Path C:\Users\Admin\AppData\Local\Temp\{491E4D67-FDC2-44F4-8437-563D572448A8}\WindowsDesktopRuntime
Size 28.8MB
SHA256 024753cf71ec777cf38c82c29bfaae467ab554086d1cf6b34f5d850f61a16c28
MD5 b76d067851e1d31cc6c6f00bd68d078b
SHA1 1a83f1fca787b802f03b12c60cea0306b64eda1e
SHA512 c1551bc40c04b552b6925675180fdb69bd00e4282bbe5c3ac6db13fa49a2786f430171ed7379f7bbdfbecb998297fff54ecb77db6c58feb9f8a1196d112d155a
SSDEEP 786432:Kl8TBZmSPFbeIQhCxCLWcSEDm03uCoE7WOF:KlGZmiFbVQsECcSEdfS
TLSH
T19B673367BF9018A9D87B4E78C4B783649E317C192320AAAB47607619DEF73D451BB3C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Config.ini

Path C:\Users\Admin\AppData\Roaming\ContextMenuManager\Config\Config.ini
Size 134B
SHA256 a8f86a3bb8a349ccd6ff3b2463483ce9a6eed109daaf81ea8527b521fbccd022
MD5 f2f7be1c219199a74afee4c45011bfe4
SHA1 a6ce18909425685a243cf86a4d2ec40b25b742d0
SHA512 e240585b6929a76cb3f55b504b8e3f8b149b41f0b4e0799d077d282a40be4098d7f497394d865433fce2648784f327363d1e17e90e1cbcfa087b44a2dc0f6692
TLSH
T150C0927B11C0218B79BF3784C4B000A2FB00B811644FE85C91C3328A04E36436E560BE
MD5 SHA1 SHA512 TLSH

Submit Download

Config.ini

Path C:\Users\Admin\AppData\Roaming\ContextMenuManager\Config\Config.ini
Size 206B
SHA256 a7846ad4a2b1b702599e9353dfe44149d0852bc91787b8bbbb4b9c1ad1cb1ed5
MD5 7cf521b3232f3290a15eb7be54ea11df
SHA1 5fce2c7be987d6f5c48f4e3f47e1813225df40e4
SHA512 9ea30b192d036d96838d50e699439aa215e706e39e3228fafa047587ba6a27bd15a8a135bb2beca19288a8dfb3c354ba0af9b24ac72b58d54e4e4c95442079b9
TLSH
T116D0123B11D011AAE8FB2B8CC1F01073BB10F808240FE88C50C3234A08E3A132A122FF
MD5 SHA1 SHA512 TLSH

Submit Download

en-US.ini

Path C:\Users\Admin\AppData\Roaming\ContextMenuManager\Config\Languages\en-US.ini
Size 38KB
SHA256 13e2451b44503304367d9162e3a2e0a84351e0389b703bb8657096ee7217ea0f
MD5 672691edd6346cfd4173167a39bd6e42
SHA1 a5d9492c737ab5f3cc964dc0a342a7c124615fb6
SHA512 ecca62313edcd619128fc4fcb5efd307eaae07ee94a5a0f347f39b1b72ccb85a16e99b145c9171706c698c9e15a05ac7c5dd4539a5b07c0fb1b77675b0d3696d
SSDEEP 768:9pwQrNUygkfeZsEWtctyNNi+coDLnTHMRNTTUmXb:EMN9feZsEWtzFcoPzMRNTTdXb
TLSH
T1A30356536BFD5508F6F77F54AEB856744E3BBCAAAC38C61C1280504E1AF1E9088617B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIAC29.tmp

Path C:\Windows\Installer\MSIAC29.tmp
Size 392KB
SHA256 a28ed81b8594774c7e1e82f9bbe858c3b36f0d7a93067001387a5a872288231a
MD5 f1fafe5c54813a5d7b60d08b859bd58b
SHA1 95e6598ce1c02220d68edab5474980b7f0f0a12c
SHA512 6dbc8b10277c6fae8d7ba961a843810df0bb11c9c6e3ba54eea1b24e13b1069e454ef5d76d345839a32f94871855928578a15948ba242d03c990b21d8f845df9
SSDEEP 6144:u/VbdUw0z9ursTolCJSqJiIUk8AeWNxFqYrtUc06N:u/VbdJ0zErWolCJ9TeWxqYZfN
TLSH
T1CC846A29F7E418EDD4B782B6C5A68030FF75754D332095AF8BA845291F3BAA470BB701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping560_1094572856\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping560_13903872\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping560_379433890\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping560_772913164\manifest.json
Size 165B
SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
TLSH
T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
MD5 SHA1 SHA512 TLSH

Submit Download

BootstrapperApplicationData.xml

Path C:\Windows\TEMP\{491E4D67-FDC2-44F4-8437-563D572448A8}\.ba\BootstrapperApplicationData.xml
Size 9KB
SHA256 b1eda1e98d843eef81232344754cdc0973d9dda1c1790a91a352c167c9a64ca5
MD5 5b54f26d64fb1f7e82bec5b4ff190ba2
SHA1 11d8be75fdb2bded9b835a2d0f6e5bf1848e0ce6
SHA512 3418f51296007c704600edc69c91e26c23e8e159e0a20aadeae06d010c80cb85cb4d86517d9fcf6ec5b150578311cb57592eb220ba0f93c7512d812e29b83fb6
SSDEEP 192:2/zaT1c/ovY9qnpijXjamaD0QP7XsCsysz:9sCsysz
TLSH
T1A912D4112BFD0218F0F3AE48EFF6A4555A3ABD552E39C92D01301D0F49B2E819962FB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetLogo_256x.png

Path C:\Windows\TEMP\{491E4D67-FDC2-44F4-8437-563D572448A8}\.ba\DotNetLogo_256x.png
Size 2KB
SHA256 0f571f95d8eab48dbc81b0ec5e9f7225e349e26ef50868bfaab556f3c2443b01
MD5 39aa52615723b782c92dec710caaec7f
SHA1 760b49e256a7979fe50a56a2b1be3688a474b886
SHA512 89d1baa3820154667747b25e9e2fd321bfb2ec71dc309915b0a28dacdc80822a4943b639ebb37c37bd2559d5a4306d2096119cd970c84a0d331f6c68b0456dc9
TLSH
T1534195CF1BFD78D7E6E557918E1A8DD232738483B4B3A42CCE7B10B8274A5642B87940
MD5 SHA1 SHA512 TLSH

Submit Download

dotnet.ico

Path C:\Windows\TEMP\{491E4D67-FDC2-44F4-8437-563D572448A8}\.ba\dotnet.ico
Size 44KB
SHA256 61a2cbd12868cb9b359e0c78961d409b7875f072eb8e53ea88d3e6bfe2961a18
MD5 b8096652d9ec286709a2c863b244b110
SHA1 b3b7f0f4d608fad7cb59ba499d4d17c2b873a7af
SHA512 492a5aa83220bb77c178b7c5b50bf44968c0427e9e45bb97a33df14d7fb4c667ca7adde0ebb3874c7b6011057b01144e4e6651fbad62c6bcf5e0b93586c4bc7a
SSDEEP 96:r+gfbzo+wHK9NbwOY4tIWQeVlV1W9+H+guapUjFamINUItzf1dBNaIZ:ro5HuNcH4tIzeVlV1WEOFDgUWzf1PIm
TLSH
T1E913EF6DE68547C1C10C2032DB4AC792B5233C72E4DAE0C4F9D4FA7E177906965C6E6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\TEMP\{491E4D67-FDC2-44F4-8437-563D572448A8}\.ba\thm.wxl
Size 7KB
SHA256 b00edd703dd8a475119d0e4dd70a3aaa47f0e95361af290e76d367a8edef3432
MD5 8b2c667a8bbad3153068c0ed90df7ec4
SHA1 c9e04a3a37e5e6262ab9bfecf78280171b8f7b74
SHA512 5269f00d474acccb4c48cb7bcfdf19e63557a388572d3a6335aa39191319691d924e27f70da3f3495387c319396476c63a8fd7b35835cca0901220e39783847b
SSDEEP 96:HiTgM1+XSNEzA0HtYQstYCpCwZQpCeyk5HQJM9ouvj9urz8:Ew9EmtYQstYCPC9e8
TLSH
T191E1026F68DFDEE03A732651B2B3698D6919C29A136F1CF0F869084B47635016377A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.xml

Path C:\Windows\TEMP\{491E4D67-FDC2-44F4-8437-563D572448A8}\.ba\thm.xml
Size 11KB
SHA256 dfee8e2d075087227f19c835c145c5bb8e72a46880ea24080bb2472fd3a521be
MD5 4329e418dc56b1386d7ea29a0dcfab5b
SHA1 58387f92e89ca21b4179fb697c7de9675c59142f
SHA512 6934873d27e6efbb94da4f13ee8369b29995490051016fdf82800256b924902306d328bf1d4ebbf266d1a53eb24adb6478d1a67de4ecc3e3bcbe561968f24922
SSDEEP 96:HgvPkoeWEH3IWTaQfSJgHzth5mFahbuB8pR5+Vpwe+UIJLg1gEp+6F5pQnxc:AvoWydmQfVHMyyj5Z
TLSH
T14B42FC6851DC7811C532D702AB9371D3FF12BDA6C6C85A58B48E256B1FF262028B739C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wixstdba.exe

Path C:\Windows\Temp\{491E4D67-FDC2-44F4-8437-563D572448A8}\.ba\wixstdba.exe
Size 431KB
SHA256 2b1cee5e3e24593247854eb7a7c4308937b9c607754ed2fb83520a8706c26f1e
MD5 0e88ffd2e737ac9b9a4241616838bc23
SHA1 3c8beb465d20bcef0cd6ceca9c60286d1d15cebd
SHA512 169b9e08518834c9bc5adfe4ab7b79e07685b72f30ede1c1a386229668bde8c15da378e1274e4013ad7b84d6f7a5acc64ef0806e3b8a66322861efaa7e26b620
SSDEEP 6144:X9vfS1NP+c3ytxmg4Stlqe3B9m2LSLTwGw7C3ZLaov5xZvSdF:X9v+GIyugllqe3wwGfX5/SdF
TLSH
T129943B3165F04037C6F90572AE14FA31BF69F208231095EBA3C0DD293968AE5BBB7657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windowsdesktop-runtime-10.0.10-win-x64.exe

Path C:\Windows\Temp\{491E4D67-FDC2-44F4-8437-563D572448A8}\.be\windowsdesktop-runtime-10.0.10-win-x64.exe
Size 967KB
SHA256 47b74e25c31fceb862dcc4496af4dcce01823094997aba1e88eb936013ffc2f8
MD5 0f57602b1b78b077a5b0e996ef306a7d
SHA1 4c86ca072878cf03f66be4dc721a02d5c6fe76d2
SHA512 b28e50f9ef8debb5e25af797cc9a7ed6882f08425c595ce36eb6d48e0b703c17f619151d84a6d1b8dd8b5f7affc231c19790c46d6224b94279de5a5c568aa1a2
SSDEEP 12288:OVGWl6qCmyZeU6lqlDjC+fScn6X8GwMgJEkqd68Wr//f0ZoiDqIMjFqs:OVGWl6qCmyt6UdmcpMzrI58lDqPxr
TLSH
T1B4257D31A166242BD6F50973F914D2307E28D7082B5C99B6C6C0DD0D39689FA6FFB24B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3980-949-0x000002B98A5B0000-0x000002B98B072000-memory.dmp

Download

memory/4776-1251-0x0000000000290000-0x0000000000356000-memory.dmp

Download