2ed072e85134bcf7677b690885e066d3b912b33f13a45949e031c5f7bb1761df

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/08/2026, 05:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MicrosoftSettings.exe
Size 22.2MB
Sample260823-frqaqashle
SHA256 2ed072e85134bcf7677b690885e066d3b912b33f13a45949e031c5f7bb1761df
MD5 b95d0d3a60db4a9a25a150e280355159
SHA1 dc3fca9e01e86be393b808be7ad13d1b1343d8f8
SHA512 8a77d86c9abf60983ffee295b94a5a7e381252cde477015d696e4b18087693b7bdaaf8756488bb3e163be6c60c2025bfca9fd884a3d7926e4c5b37b23fc965a7
SSDEEP 393216:9liRuyFiF3O5acsy5GDulh4vTK4QBRiq7hyXKmgt90nRw+l01KxMgqWJ:0jFikaMoqcKnBQWhya3nOK1KCgT
TLSH
T1EB371203F2A691E8C46EC0B4D31AA637EB32B889453576EF27941B213F1AF906F1D745
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery persistence trojan

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSRecommendationDaemon = "C:\\Users\\Admin\\AppData\\Local\\Temp\\msrdcdae6a1a-0f00-41ff-b3c1-ecbab2203cf4\\MSRecommendationDaemon.exe"	MSRecommendationApp.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Executes dropped EXE 3 IoCs

pid	Process
4080	msrec-sidecar-1836.exe
1720	MSRecommendationDaemon.exe
1616	MSRecommendationDaemon.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	MicrosoftSettings.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe

Modifies registry class 6 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MSRecommendationApp_8wekyb3d8bbwe\MSRecommendationAppStartupTask\State = "2"	MicrosoftSettings.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MSRecommendationApp_8wekyb3d8bbwe\MSRecommendationAppStartupTask\UserEnabledStartupOnce = "0"	MicrosoftSettings.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MSRecommendationApp_8wekyb3d8bbwe	MicrosoftSettings.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{A0F543D0-1C41-4A11-9B97-FE332532967B}	MSRecommendationDaemon.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MSRecommendationApp_8wekyb3d8bbwe\MSRecommendationAppStartupTask	MicrosoftSettings.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MSRecommendationApp_8wekyb3d8bbwe\MSRecommendationAppStartupTask\ShowNotification = "1"	MicrosoftSettings.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1836	MicrosoftSettings.exe
5180	MSRecommendationApp.exe
1720	MSRecommendationDaemon.exe
1720	MSRecommendationDaemon.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
5568	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeSecurityPrivilege	5580	wevtutil.exe
Token: SeBackupPrivilege	5580	wevtutil.exe
Token: SeDebugPrivilege	5180	MSRecommendationApp.exe
Token: SeDebugPrivilege	1720	MSRecommendationDaemon.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1836	MicrosoftSettings.exe
5180	MSRecommendationApp.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 1836 wrote to memory of 5568	1836	MicrosoftSettings.exe	90
PID 5568 wrote to memory of 2668	5568	msedgewebview2.exe	91
PID 5568 wrote to memory of 2804	5568	msedgewebview2.exe	92
PID 5568 wrote to memory of 2804	5568	msedgewebview2.exe	92
PID 5568 wrote to memory of 2804	5568	msedgewebview2.exe	92
PID 5568 wrote to memory of 2804	5568	msedgewebview2.exe	92
PID 5568 wrote to memory of 3856	5568	msedgewebview2.exe	93
PID 5568 wrote to memory of 4344	5568	msedgewebview2.exe	94
PID 5568 wrote to memory of 4344	5568	msedgewebview2.exe	94
PID 5568 wrote to memory of 4344	5568	msedgewebview2.exe	94
PID 5568 wrote to memory of 3388	5568	msedgewebview2.exe	95
PID 5568 wrote to memory of 3388	5568	msedgewebview2.exe	95
PID 5568 wrote to memory of 3388	5568	msedgewebview2.exe	95
PID 5568 wrote to memory of 3388	5568	msedgewebview2.exe	95
PID 5568 wrote to memory of 3388	5568	msedgewebview2.exe	95
PID 1836 wrote to memory of 4080	1836	MicrosoftSettings.exe	96
PID 5180 wrote to memory of 1720	5180	MSRecommendationApp.exe	103

C:\Users\Admin\AppData\Local\Temp\MicrosoftSettings.exe
"C:\Users\Admin\AppData\Local\Temp\MicrosoftSettings.exe"
1⤵
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1836
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=MicrosoftSettings.exe --webview-exe-version=1.1.3 --user-data-dir="C:\Users\Admin\AppData\Local\com.microsoft.msrec.installer\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=1836.5160.3588216792064957273 /pfhostedapp:17c2622315636f2cc9b09993e3da6342daf79021
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:5568
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.microsoft.msrec.installer\EBWebView /prefetch:4 /pfhostedapp:17c2622315636f2cc9b09993e3da6342daf79021 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.microsoft.msrec.installer\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffa47fb5fd8,0x7ffa47fb5fe4,0x7ffa47fb5ff0
    3⤵
    PID:2668
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.microsoft.msrec.installer\EBWebView" --webview-exe-name=MicrosoftSettings.exe --webview-exe-version=1.1.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1768 --field-trial-handle=1776,i,9764618535269093161,17101202843640382504,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:17c2622315636f2cc9b09993e3da6342daf79021
    3⤵
    PID:2804
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.microsoft.msrec.installer\EBWebView" --webview-exe-name=MicrosoftSettings.exe --webview-exe-version=1.1.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2252 --field-trial-handle=1776,i,9764618535269093161,17101202843640382504,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:17c2622315636f2cc9b09993e3da6342daf79021
    3⤵
    PID:3856
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.microsoft.msrec.installer\EBWebView" --webview-exe-name=MicrosoftSettings.exe --webview-exe-version=1.1.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2328 --field-trial-handle=1776,i,9764618535269093161,17101202843640382504,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:17c2622315636f2cc9b09993e3da6342daf79021
    3⤵
    PID:4344
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.microsoft.msrec.installer\EBWebView" --webview-exe-name=MicrosoftSettings.exe --webview-exe-version=1.1.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3336 --field-trial-handle=1776,i,9764618535269093161,17101202843640382504,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:17c2622315636f2cc9b09993e3da6342daf79021 /prefetch:1
    3⤵
    PID:3388
- C:\Users\Admin\AppData\Local\Temp\msrec-sidecar-1836.exe
  "C:\Users\Admin\AppData\Local\Temp\msrec-sidecar-1836.exe"
  2⤵
  - Executes dropped EXE
  PID:4080
- C:\Program Files\WindowsApps\Microsoft.MSRecommendationApp_1.1.3.0_x64__8wekyb3d8bbwe\MSRecommendationApp.exe
  "C:\Program Files\WindowsApps\Microsoft.MSRecommendationApp_1.1.3.0_x64__8wekyb3d8bbwe\MSRecommendationApp.exe" microsoft-msrecommendationapp:
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5180
- - C:\Users\Admin\AppData\Local\Temp\msrdcdae6a1a-0f00-41ff-b3c1-ecbab2203cf4\MSRecommendationDaemon.exe
    "C:\Users\Admin\AppData\Local\Temp\msrdcdae6a1a-0f00-41ff-b3c1-ecbab2203cf4\MSRecommendationDaemon.exe"
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1720

C:\Windows\system32\wevtutil.exe
"C:\Windows\system32\wevtutil.exe" install-manifest "C:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.7_7000.522.1444.0_x64__8wekyb3d8bbwe\EventLog-Instrumentation.man" /resourceFilePath:"C:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.7_7000.522.1444.0_x64__8wekyb3d8bbwe\WindowsAppSdk.AppxDeploymentExtensions.Desktop-EventLog-Instrumentation.dll" /messageFilePath:"C:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.7_7000.522.1444.0_x64__8wekyb3d8bbwe\WindowsAppSdk.AppxDeploymentExtensions.Desktop-EventLog-Instrumentation.dll" /unicode:true
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5580

C:\Users\Admin\AppData\Local\Temp\msrdcdae6a1a-0f00-41ff-b3c1-ecbab2203cf4\MSRecommendationDaemon.exe
C:\Users\Admin\AppData\Local\Temp\msrdcdae6a1a-0f00-41ff-b3c1-ecbab2203cf4\MSRecommendationDaemon.exe
1⤵
- Executes dropped EXE
PID:1616

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MSRecommendationDaemon.exe

Path C:\Users\Admin\AppData\Local\Temp\msrdcdae6a1a-0f00-41ff-b3c1-ecbab2203cf4\MSRecommendationDaemon.exe
Size 79KB
SHA256 541cd0b94d57b0cbcd29a366daf0fdfcb4938fe9b906e5484ae2717236298c97
MD5 ce2fe396749360de5c40286946dbcaad
SHA1 c198d8083f1f1d896462e476564ac058238225c9
SHA512 5e7ca7091acd5c85ab6d3301c420c82a2f564d04b1be55935b1bcbf35654d32061e806a1b3ca536fe083c93f51ce47c3312fca5e7651ef9e5a0e6a8ba6f1f99e
SSDEEP 1536:5DXqkzluC5K6C0FYqQBih+v8DUyKwG0ZNUKItcPPzG:5jqeYc5Cqh+v+FKwrZmKIWPPq
TLSH
T15F836B40B3EC8923D9AF9D7ED93403064B77FB066806E78E54CCA8DC28977D19A12767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msrec-app-1836.msix

Path C:\Users\Admin\AppData\Local\Temp\msrec-app-1836.msix
Size 13.3MB
SHA256 ba4c7dc0a0dc682c8116d9b28bcecd7ae5b087d4562a6ef2bdef510831fdbb70
MD5 b766111301a76760a4954015a144e0d9
SHA1 940044da12029d550bc33b5800e25b6d39086880
SHA512 eb1c14fc78efee6b91bc2824835c085bc2f6f4a6f90cee8f257a078a26e5b878d21c9f230c6358c8abc39864f0bccdcab2dde4d5e53dcc93ca80e0905433e0ae
SSDEEP 393216:IO5acsy5GDulh4vTK4QBRiq7hyXKmgt90nRw+l0G:NaMoqcKnBQWhya3nOKG
TLSH
T17CE63335DEAD7AA5DC5B1C32C40F688FCE8B9A40A213685E3E0397552C5A6C95C933CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msrec-sidecar-1836.exe

Path C:\Users\Admin\AppData\Local\Temp\msrec-sidecar-1836.exe
Size 8.8MB
SHA256 9831634e370e1f76e2c2a40853a55e86b9ca210cadecb40efed666f7bc111d79
MD5 8b740781609b27e9fb8013e6749ebf38
SHA1 f0f997c0c9d174ff5c49debb5bf296d0202ba4c2
SHA512 94c95b927802ab44ed40f410b3c51be40f0d03fb462559230a04a6736aaa5033c6fef5b00a292b3953a7968aac29956abc0d6737b7ab0f23f18e07833e509426
SSDEEP 98304:T45w+4rSEH6A1m5zEyD+N/bLX/xpRfm/Fz77CEM:c5w+HK6A1UzHD+N/bLX/xm/Fz77k
TLSH
T1CA96AE09A3A500B5E92BC738CA55C733CAB8BD925635D14F085CF7C61F73A628B2F625
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.microsoft.msrec.installer\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 b4f30d135b004f3c1be90965ce7dac4a33b3e8fea490f297bbbaf131d8ec0553
MD5 c8a10de2b439d5da360a54ef19e306d3
SHA1 840ce43b7315a45e7f9fd33b64c7a9cf6ec14fb0
SHA512 3c8cb38b6faabaff8bf6622f434d3c7d7193fba3574d0d147afd3d5f8a2de24a4e0212973450dcf281035b932efbbf936ddfde7cfae582b888e7803e46228f00
TLSH
T1B4D0122636024274C4102073000263180500C31B80859104D43CC66D3F480940E03481
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.microsoft.msrec.installer\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 df0261b0523f5d929d79ed0b001c4609954f180c9ac05ac8252842be0f2e758e
MD5 77d8f0838e24b230506e9d87dcd95ceb
SHA1 b36af3168e3e93a1c57a04923c61c1359392734c
SHA512 ef3cb745364030a61cb3d5b9792ed3b201968add53b2d6164550e674d91d6e7cdd54acdda08d94cfb98fdd2ecba80ff269415579e9abd3311e958dc4d53b653f
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.microsoft.msrec.installer\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.microsoft.msrec.installer\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 59b4c61d9664a3c047a48c1d7224366c1710602ed9e46fc6bc4425b10f671dad
MD5 c7c4f27a4a35d34bffd730d00dde018f
SHA1 a36f9a727c6d6d4ee99cd354a7aaf4a8b79cc2e8
SHA512 c120c9db09c49cef339935d58b684e868451d459b9de4520f48f5d4f192a872a4c2347b5f1aa5e21aea104e4d82dad89843968365dfcb9597632e5128c42cde4
TLSH
T127A0021A05964005E1804675208B52C13A306C10010E1B025096147FD963245B27A6F4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe599bb9.TMP

Path C:\Users\Admin\AppData\Local\com.microsoft.msrec.installer\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe599bb9.TMP
Size 48B
SHA256 19a0ad0894088f02473397bfacffc1d7a59329879d478d66941a4811f4d3988d
MD5 3f0570d9a8a3f3ea41c326c22392d712
SHA1 b73a712a505922a06365e02ed79ea6f40d7d5f6c
SHA512 a6dd95c7ec487f7b81e36f53b92b543f497983f54eb6324517ccf2d4496c2d2e753563a5cd85083a4f0765c567561dd3dddebfe0c61b07c2b99a680f2e965c53
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.microsoft.msrec.installer\EBWebView\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.microsoft.msrec.installer\EBWebView\Default\Extension Scripts\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.microsoft.msrec.installer\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.microsoft.msrec.installer\EBWebView\Default\Preferences
Size 6KB
SHA256 da2d5977a5d6cdb90aa935da574f5fd384306c5835dcd4479aeda4da0b8b2a51
MD5 629009d350824c725068d102d7c67c7f
SHA1 51f638ad6c40acbf6052d35c5a117732874a5761
SHA512 30576cda87af092ee5748aac63fc0c9c18feabcf9b02ef4266c4ebb8243174e4f543f758a81803e15f5480047eed86426740e1341717964d390eb46cb6d45cef
SSDEEP 96:stt/ddl41b9Sk+yo5h16Z0Ps7/x+6MhmuecJ731ejeUK+g89ZI8XM1C7K:stxffWonPsV+Fd73QjQyZg6K
TLSH
T19BD1A5015E24B97B4CCBF109BA35BA57E3F9506260941E88EBF8492C18DB6DD7307D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe599bb9.TMP

Path C:\Users\Admin\AppData\Local\com.microsoft.msrec.installer\EBWebView\Default\Preferences~RFe599bb9.TMP
Size 6KB
SHA256 4849605bbd07cdcf06441211643edbedc1942c36115afb7566651861f01faf89
MD5 ecb8c90e7723b3fd48b37b3151bc5e82
SHA1 a06c15e76ec383ce37c3859c16bbe2ad949e8680
SHA512 b709d97bccb3c7d2eadf966962ef3e427c861960bd9c6e8f390931180785ad01f173fd6e48a72244d9826c7162b8a038650aea757eaabbd0cafde3c8e4153815
SSDEEP 96:stt/ddl41b9SkIo5h16Z0Ps7/x+6MhmuecJ731ejeUK+ge+28XM1C7K:stxffbonPsV+Fd73QjQ0+G6K
TLSH
T168D1A7025E24797B4CCBF509BA257A57E3F9907260D51E98EBF8492C08DA6CD7307D07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.microsoft.msrec.installer\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.microsoft.msrec.installer\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.microsoft.msrec.installer\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.microsoft.msrec.installer\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.microsoft.msrec.installer\EBWebView\Local State
Size 16KB
SHA256 3e23516413438234ff0cc98be17703aa4013d0219f4b3ae8dddd92b826880d51
MD5 057642cb6a5c9b512db6b4a9b88e6a12
SHA1 36f71168935bbbe0fce4b3670cfd33011afe23cc
SHA512 7bf0f2605920276ed07299b0c77e537f7e9d805e22a4283956ddb0cfe0fdf544074264cd3450718fafa3e6bb848a834ec311325d591d518bd340ba6aade09d1d
SSDEEP 384:m+aQikB+z/xvxjg/qhEAi3NBS9WaRMAVdpuh9zZ:x/UxvxjgC+AidQMU8FZ
TLSH
T132729E1B98797E23B4F3E505795957CBDBB8D4B390816EA44EBC6F0D02873D81306C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.microsoft.msrec.installer\EBWebView\Local State
Size 2KB
SHA256 7dadd9dbe3cfeb8815381a38294540d4925c7e850829ce75e55ac2351804097b
MD5 006f10cab25d7906c769449330694179
SHA1 7f4982ce2a7b760c917570db0f2d14d14edfe502
SHA512 aeb082573b1f2b887c6ec9a7d5c53dd2aff62eb33e95f8bb41f787b1fb0711cf55bf3c57f83224b760ab77c95d8529f95844851605305d2b0abad75f00d8b7e4
TLSH
T1CA519733B825AB37A8D3561975473B73DF3590A39A511F90EADC1B1C01D629C230AC3B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.microsoft.msrec.installer\EBWebView\Local State
Size 3KB
SHA256 9f1803f562075dc55a33f002e21a7c6cc7985d6e1a121f62d4d413eebce9f1f3
MD5 dbdae4e55e204b7263c7b050cd23d9f0
SHA1 013907ba51a2be80401190f555adfcd70414c8ee
SHA512 bf664c5fbc2773071f58a7b89ecb889b499b31a27f298d88da4869b0e0e23236928e18c69800ded96b7e401f10611960f74ec39710cf4ed8770045174a032b7a
TLSH
T13461A737A875AA375DE39605B4863762A7655063E5913F95D6EC0F0C01D73CC2301C2B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.microsoft.msrec.installer\EBWebView\Local State
Size 15KB
SHA256 60a8a310e334ad8fde9076210855e4864609626402cb1596bba206e29d9836cf
MD5 83814718d4dea6ace4ce7de4c7ac619b
SHA1 932255ee4eddde319c2305e47d6248626259ff58
SHA512 4f4b5abe0620b89b06eda9b221adadf93a034b2f189a623982e2fc3aaff123fbcabdd2b8f7caeeed9f8405628a5290dde0e36c519836fcc410f2b7bcea53679c
SSDEEP 384:H+aQikB+z/xvxjg/qhEJNBSh0aRLAVdpuh9zZ:W/UxvxjgC+PQLU8FZ
TLSH
T16772AE2B94797E23A9F3B605795D17CBDBB8D4B390816EA84EBC6F0906872D81306C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe5973ee.TMP

Path C:\Users\Admin\AppData\Local\com.microsoft.msrec.installer\EBWebView\Local State~RFe5973ee.TMP
Size 1KB
SHA256 7686ce3e74ee128caca7ca44fb4779b13db4db2543fd9c2c827292daa04de948
MD5 6113acdeb7ca7d488f628a024ae401e9
SHA1 b943407ebcd49d0de8165beba9ce96749813fc8f
SHA512 4154cbbfaf2bb97c3b514023a542c9dd959f19adefff09c478c700f42a24aa01315a8cea1c9140a011acb5172dd47df2fb91d54498aa8c8b78b92a7040999dcc
TLSH
T1262142B3D0B5AF33B882214B715377B39F2050B382110F84B6DD0B2D11E629CA92ED3A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1720-354-0x000002A112290000-0x000002A11229A000-memory.dmp

Download

memory/1720-295-0x000002A110570000-0x000002A110588000-memory.dmp

Download

memory/1720-356-0x000002A112300000-0x000002A112326000-memory.dmp

Download

memory/1720-353-0x000002A12B670000-0x000002A12BB98000-memory.dmp

Download

memory/1720-297-0x000002A12AE20000-0x000002A12AFE2000-memory.dmp

Download

memory/1720-355-0x000002A1122A0000-0x000002A1122A8000-memory.dmp

Download

memory/2804-26-0x00007FFA68AC0000-0x00007FFA68AC1000-memory.dmp

Download

memory/2804-290-0x00000208DCD00000-0x00000208DCDD6000-memory.dmp

Download

memory/3388-293-0x00000132BEDA0000-0x00000132BEE76000-memory.dmp

Download

memory/3388-63-0x00007FFA68AC0000-0x00007FFA68AC1000-memory.dmp

Download

memory/4080-180-0x0000028C026A0000-0x0000028C026B0000-memory.dmp

Download

memory/5180-193-0x000001D640CE0000-0x000001D640CF0000-memory.dmp

Download