db633a2ef6d82acdf79c368bf85b0f832e5e3ab343281983f1c6d6f1a4f70aeb

Analysis

user interaction
yes
max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/08/2026, 17:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
X.Spoofer (3) (1).msi
Size 928KB
Sample260826-wk6bcstdne
SHA256 db633a2ef6d82acdf79c368bf85b0f832e5e3ab343281983f1c6d6f1a4f70aeb
MD5 776e1e21eddc854bd2a0a7f9314e4ca0
SHA1 733d749d1a03512ca8d2c348503bf578bd91a81c
SHA512 f367a4ac273fd1a98b807cfbcad60f422e98373b8b41179dc367a958427399604284ab6a57b5c8f5f264fdf8ea11ba45a059aac66019f9662ff952066b3e5815
SSDEEP 24576:14A+11gZdbLipHTHDR+qMXJcMIVEX7rYYxyxPPm7L4M:CIK5Xk3XRLXfYYQxPPGLz
TLSH
T10D1523183778DA35D11916BA0B625BE81EF00F298D5E086E9FAC795F8CBC5C21218DDF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence ransomware

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
123	3128	msedge.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	windowsdesktop-runtime-9.0.19-win-x64.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	windowsdesktop-runtime-9.0.19-win-x64.exe

Executes dropped EXE 9 IoCs

pid	Process
4792	X.SPOOFER.exe
5920	windowsdesktop-runtime-9.0.19-win-x64.exe
5940	windowsdesktop-runtime-9.0.19-win-x64.exe
4192	windowsdesktop-runtime-9.0.19-win-x64.exe
5860	windowsdesktop-runtime-9.0.19-win-x64.exe
5312	windowsdesktop-runtime-9.0.19-win-x64.exe
1520	windowsdesktop-runtime-9.0.19-win-x64.exe
2464	windowsdesktop-runtime-9.0.19-win-x64.exe
5132	X.SPOOFER.exe

Loads dropped DLL 49 IoCs

pid	Process
5940	windowsdesktop-runtime-9.0.19-win-x64.exe
5304	MsiExec.exe
5304	MsiExec.exe
1520	windowsdesktop-runtime-9.0.19-win-x64.exe
3468	MsiExec.exe
3468	MsiExec.exe
4308	MsiExec.exe
4308	MsiExec.exe
3680	MsiExec.exe
3680	MsiExec.exe
3364	MsiExec.exe
3364	MsiExec.exe
5408	MsiExec.exe
5408	MsiExec.exe
4420	MsiExec.exe
4420	MsiExec.exe
5132	X.SPOOFER.exe
5132	X.SPOOFER.exe
5132	X.SPOOFER.exe
5132	X.SPOOFER.exe
5132	X.SPOOFER.exe
5132	X.SPOOFER.exe
5132	X.SPOOFER.exe
5132	X.SPOOFER.exe
5132	X.SPOOFER.exe
5132	X.SPOOFER.exe
5132	X.SPOOFER.exe
5132	X.SPOOFER.exe
5132	X.SPOOFER.exe
5132	X.SPOOFER.exe
5132	X.SPOOFER.exe
5132	X.SPOOFER.exe
5132	X.SPOOFER.exe
5132	X.SPOOFER.exe
5132	X.SPOOFER.exe
5132	X.SPOOFER.exe
5132	X.SPOOFER.exe
5132	X.SPOOFER.exe
5132	X.SPOOFER.exe
5132	X.SPOOFER.exe
5132	X.SPOOFER.exe
5132	X.SPOOFER.exe
5132	X.SPOOFER.exe
5132	X.SPOOFER.exe
5132	X.SPOOFER.exe
5132	X.SPOOFER.exe
5132	X.SPOOFER.exe
5132	X.SPOOFER.exe
5132	X.SPOOFER.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{7a013c32-dd46-48f5-81b1-2576c92468db} = "\"C:\\ProgramData\\Package Cache\\{7a013c32-dd46-48f5-81b1-2576c92468db}\\windowsdesktop-runtime-9.0.19-win-x64.exe\" /burn.runonce"	windowsdesktop-runtime-9.0.19-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{7a013c32-dd46-48f5-81b1-2576c92468db} = "\"C:\\ProgramData\\Package Cache\\{7a013c32-dd46-48f5-81b1-2576c92468db}\\windowsdesktop-runtime-9.0.19-win-x64.exe\" /burn.runonce"	windowsdesktop-runtime-9.0.19-win-x64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
162	discord.com
164	discord.com
161	discord.com

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.19\de\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.19\ru\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.19\cs\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.19\zh-Hans\System.Windows.Forms.Design.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.19\System.Runtime.Numerics.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.19\de\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.19\zh-Hans\UIAutomationTypes.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.19\System.Reflection.Metadata.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.19\System.Private.CoreLib.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.19\System.Collections.Concurrent.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.19\cs\System.Windows.Forms.Design.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.19\zh-Hans\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.19\msquic.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.19\clrgc.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.19\tr\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.19\Microsoft.WindowsDesktop.App.runtimeconfig.json	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.19\System.Globalization.Extensions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.19\System.IO.IsolatedStorage.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.19\System.Formats.Asn1.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.19\tr\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.19\System.Text.Encoding.CodePages.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.19\System.Threading.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.19\System.Runtime.InteropServices.RuntimeInformation.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.19\System.Security.Cryptography.Xml.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.19\ja\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.19\System.Linq.Queryable.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.19\Microsoft.Win32.SystemEvents.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.19\pt-BR\ReachFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.19\System.ServiceProcess.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.19\System.Dynamic.Runtime.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.19\cs\System.Windows.Forms.Primitives.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.19\System.Diagnostics.EventLog.dll	msiexec.exe
File opened for modification	C:\Program Files\dotnet\LICENSE.txt	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.19\ru\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.19\hostpolicy.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.19\tr\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.19\System.Configuration.ConfigurationManager.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.19\System.Numerics.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.19\System.Runtime.Serialization.Json.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.19\System.IO.MemoryMappedFiles.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.19\System.Runtime.InteropServices.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.19\System.Diagnostics.Debug.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.19\PresentationCore.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.19\es\System.Windows.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.19\UIAutomationClient.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.19\System.Globalization.Calendars.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.19\ja\System.Windows.Forms.Design.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.19\PresentationNative_cor3.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.19\tr\UIAutomationTypes.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.19\it\WindowsBase.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.19\System.ComponentModel.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.19\System.IO.FileSystem.Primitives.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.19\System.Security.Cryptography.Algorithms.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.19\PresentationFramework.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.19\System.Security.Cryptography.Pkcs.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.19\System.Security.Cryptography.ProtectedData.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.19\System.Web.HttpUtility.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.19\System.Net.HttpListener.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\9.0.19\es\System.Windows.Forms.Primitives.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.19\System.Reflection.Emit.ILGeneration.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.19\System.Net.Primitives.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.19\System.Threading.Tasks.Dataflow.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.19\System.Net.WebProxy.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\9.0.19\System.Security.AccessControl.dll	msiexec.exe

Drops file in Windows directory 49 IoCs

description	ioc	Process
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\e58bcf4.msi	msiexec.exe
File created	C:\Windows\Installer\e58bcfa.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e58bcfa.msi	msiexec.exe
File created	C:\Windows\Installer\e58bd05.msi	msiexec.exe
File created	C:\Windows\Installer\e58bd06.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e58bd06.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA215.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{13EF0513-4B2F-4375-B65B-2C89BFCFFB83}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAA84.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAD93.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB69F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICF1B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID2BA.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9448.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9785.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIABAD.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1\64.60.31149	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB304.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID17F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID75F.tmp	msiexec.exe
File created	C:\Windows\Installer\e58bcf5.msi	msiexec.exe
File created	C:\Windows\Installer\e58bcff.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1\64.60.31149\fileCoreHostExe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID7CE.tmp	msiexec.exe
File created	C:\Windows\Installer\e58bcf9.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAE5F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID25B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBDBD.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e58bcf5.msi	msiexec.exe
File created	C:\Windows\Installer\e58bcfe.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e58bcff.msi	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1\64.60.31149\fileCoreHostExe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB083.tmp	msiexec.exe
File created	C:\Windows\Installer\e58bcf2.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{180151CE-8FA2-4682-9E2F-00AD30D1D19D}	msiexec.exe
File created	C:\Windows\Installer\SourceHash{C248215D-6C6B-404A-AB6E-505D4640E205}	msiexec.exe
File created	C:\Windows\Installer\SourceHash{8DDA0C5E-EE0E-4ADC-ADC4-1A816363A3D2}	msiexec.exe
File created	C:\Windows\Installer\e58bd0a.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICFE7.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e58bcf2.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{B482E2FD-38BB-43F2-8E97-0B7CB485EF18}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA9C7.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC5D3.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID075.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID403.tmp	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-9.0.19-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-9.0.19-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-9.0.19-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-9.0.19-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-9.0.19-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-9.0.19-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-9.0.19-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3128	msedge.exe
5452	msedge.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000499bfc0d34bfe76b0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000499bfc0d0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900499bfc0d000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a499bfc0d000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d499bfc0d000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 21 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2C	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2e	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2d	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2B	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134322408468929098"	msedge.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2D	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2f	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EC1510812AF82864E9F200DA031D1DD9\ProductName = "X.Spoofer"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EC1510812AF82864E9F200DA031D1DD9\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EC1510812AF82864E9F200DA031D1DD9\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{7a013c32-dd46-48f5-81b1-2576c92468db}\Dependents	windowsdesktop-runtime-9.0.19-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E5C0ADD8E0EECDA4DA4CA11836363A2D\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\EC1510812AF82864E9F200DA031D1DD9\MainFeature	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EC1510812AF82864E9F200DA031D1DD9\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\dotnet_runtime_72.76.56792_x64	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\DF2E284BBB832F34E879B0C74B58FE81\MainFeature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DF2E284BBB832F34E879B0C74B58FE81\ProductName = "Microsoft .NET Runtime - 9.0.19 (x64)"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\dotnet_runtime_72.76.56792_x64	windowsdesktop-runtime-9.0.19-win-x64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{696EC4DF-DC00-42A9-A1B5-24D3E1D3AC5A}	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_72.76.56792_x64\Version = "72.76.56792"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DF2E284BBB832F34E879B0C74B58FE81\Clients = 3a0000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D512842CB6C6A404BAE605D564042E50\Clients = 3a0000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EC1510812AF82864E9F200DA031D1DD9\Version = "16777216"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EC1510812AF82864E9F200DA031D1DD9\SourceList\Net	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DF2E284BBB832F34E879B0C74B58FE81\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3150FE31F2B457346BB5C298FBFCBF38\ProductName = "Microsoft .NET Host FX Resolver - 9.0.19 (x64)"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D512842CB6C6A404BAE605D564042E50	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_72.76.56849_x64\ = "{8DDA0C5E-EE0E-4ADC-ADC4-1A816363A3D2}"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E5C0ADD8E0EECDA4DA4CA11836363A2D\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E5C0ADD8E0EECDA4DA4CA11836363A2D\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{8DDA0C5E-EE0E-4ADC-ADC4-1A816363A3D2}v72.76.56849\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DF2E284BBB832F34E879B0C74B58FE81\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3150FE31F2B457346BB5C298FBFCBF38\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3150FE31F2B457346BB5C298FBFCBF38\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_72.76.56792_x64\Dependents\{7a013c32-dd46-48f5-81b1-2576c92468db}	windowsdesktop-runtime-9.0.19-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_72.76.56849_x64\Dependents\{7a013c32-dd46-48f5-81b1-2576c92468db}	windowsdesktop-runtime-9.0.19-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{B345CFBF-1870-4208-AC40-A53A2D2AB9D4}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_72.76.56792_x64\ = "{B482E2FD-38BB-43F2-8E97-0B7CB485EF18}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_72.76.56792_x64\DisplayName = "Microsoft .NET Runtime - 9.0.19 (x64)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DF2E284BBB832F34E879B0C74B58FE81\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{B482E2FD-38BB-43F2-8E97-0B7CB485EF18}v72.76.56792\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3150FE31F2B457346BB5C298FBFCBF38\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3150FE31F2B457346BB5C298FBFCBF38\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D512842CB6C6A404BAE605D564042E50\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E5C0ADD8E0EECDA4DA4CA11836363A2D\MainFeature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\2D4F77546E6E9AC438E51196DF1E3AE8\EC1510812AF82864E9F200DA031D1DD9	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EC1510812AF82864E9F200DA031D1DD9\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3150FE31F2B457346BB5C298FBFCBF38\Provider	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3150FE31F2B457346BB5C298FBFCBF38\Version = "1212997080"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3150FE31F2B457346BB5C298FBFCBF38\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D512842CB6C6A404BAE605D564042E50\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D512842CB6C6A404BAE605D564042E50\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{7a013c32-dd46-48f5-81b1-2576c92468db}\Version = "9.0.19.36321"	windowsdesktop-runtime-9.0.19-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\DF2E284BBB832F34E879B0C74B58FE81\Provider	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DF2E284BBB832F34E879B0C74B58FE81	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DF2E284BBB832F34E879B0C74B58FE81\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DF2E284BBB832F34E879B0C74B58FE81\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D512842CB6C6A404BAE605D564042E50	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E5C0ADD8E0EECDA4DA4CA11836363A2D\ProductName = "Microsoft Windows Desktop Runtime - 9.0.19 (x64)"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E5C0ADD8E0EECDA4DA4CA11836363A2D\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DF2E284BBB832F34E879B0C74B58FE81\Version = "1212997080"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DF2E284BBB832F34E879B0C74B58FE81\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3150FE31F2B457346BB5C298FBFCBF38\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D512842CB6C6A404BAE605D564042E50\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E5C0ADD8E0EECDA4DA4CA11836363A2D	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E5C0ADD8E0EECDA4DA4CA11836363A2D\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_9.0_x64	windowsdesktop-runtime-9.0.19-win-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{7a013c32-dd46-48f5-81b1-2576c92468db}\ = "{7a013c32-dd46-48f5-81b1-2576c92468db}"	windowsdesktop-runtime-9.0.19-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EC1510812AF82864E9F200DA031D1DD9\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\DF2E284BBB832F34E879B0C74B58FE81	msiexec.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
3508	msiexec.exe
3508	msiexec.exe
3508	msiexec.exe
3508	msiexec.exe
3508	msiexec.exe
3508	msiexec.exe
3508	msiexec.exe
3508	msiexec.exe
3508	msiexec.exe
3508	msiexec.exe
3508	msiexec.exe
3508	msiexec.exe
3508	msiexec.exe
3508	msiexec.exe
3508	msiexec.exe
3508	msiexec.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
664	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
5968	msedge.exe
5968	msedge.exe
5968	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2940	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2940	msiexec.exe
Token: SeSecurityPrivilege	3508	msiexec.exe
Token: SeCreateTokenPrivilege	2940	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2940	msiexec.exe
Token: SeLockMemoryPrivilege	2940	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2940	msiexec.exe
Token: SeMachineAccountPrivilege	2940	msiexec.exe
Token: SeTcbPrivilege	2940	msiexec.exe
Token: SeSecurityPrivilege	2940	msiexec.exe
Token: SeTakeOwnershipPrivilege	2940	msiexec.exe
Token: SeLoadDriverPrivilege	2940	msiexec.exe
Token: SeSystemProfilePrivilege	2940	msiexec.exe
Token: SeSystemtimePrivilege	2940	msiexec.exe
Token: SeProfSingleProcessPrivilege	2940	msiexec.exe
Token: SeIncBasePriorityPrivilege	2940	msiexec.exe
Token: SeCreatePagefilePrivilege	2940	msiexec.exe
Token: SeCreatePermanentPrivilege	2940	msiexec.exe
Token: SeBackupPrivilege	2940	msiexec.exe
Token: SeRestorePrivilege	2940	msiexec.exe
Token: SeShutdownPrivilege	2940	msiexec.exe
Token: SeDebugPrivilege	2940	msiexec.exe
Token: SeAuditPrivilege	2940	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2940	msiexec.exe
Token: SeChangeNotifyPrivilege	2940	msiexec.exe
Token: SeRemoteShutdownPrivilege	2940	msiexec.exe
Token: SeUndockPrivilege	2940	msiexec.exe
Token: SeSyncAgentPrivilege	2940	msiexec.exe
Token: SeEnableDelegationPrivilege	2940	msiexec.exe
Token: SeManageVolumePrivilege	2940	msiexec.exe
Token: SeImpersonatePrivilege	2940	msiexec.exe
Token: SeCreateGlobalPrivilege	2940	msiexec.exe
Token: SeBackupPrivilege	764	vssvc.exe
Token: SeRestorePrivilege	764	vssvc.exe
Token: SeAuditPrivilege	764	vssvc.exe
Token: SeBackupPrivilege	3508	msiexec.exe
Token: SeRestorePrivilege	3508	msiexec.exe
Token: SeRestorePrivilege	3508	msiexec.exe
Token: SeTakeOwnershipPrivilege	3508	msiexec.exe
Token: SeRestorePrivilege	3508	msiexec.exe
Token: SeTakeOwnershipPrivilege	3508	msiexec.exe
Token: SeRestorePrivilege	3508	msiexec.exe
Token: SeTakeOwnershipPrivilege	3508	msiexec.exe
Token: SeRestorePrivilege	3508	msiexec.exe
Token: SeTakeOwnershipPrivilege	3508	msiexec.exe
Token: SeRestorePrivilege	3508	msiexec.exe
Token: SeTakeOwnershipPrivilege	3508	msiexec.exe
Token: SeRestorePrivilege	3508	msiexec.exe
Token: SeTakeOwnershipPrivilege	3508	msiexec.exe
Token: SeRestorePrivilege	3508	msiexec.exe
Token: SeTakeOwnershipPrivilege	3508	msiexec.exe
Token: SeRestorePrivilege	3508	msiexec.exe
Token: SeTakeOwnershipPrivilege	3508	msiexec.exe
Token: SeRestorePrivilege	3508	msiexec.exe
Token: SeTakeOwnershipPrivilege	3508	msiexec.exe
Token: SeRestorePrivilege	3508	msiexec.exe
Token: SeTakeOwnershipPrivilege	3508	msiexec.exe
Token: SeRestorePrivilege	3508	msiexec.exe
Token: SeTakeOwnershipPrivilege	3508	msiexec.exe
Token: SeRestorePrivilege	3508	msiexec.exe
Token: SeTakeOwnershipPrivilege	3508	msiexec.exe
Token: SeRestorePrivilege	3508	msiexec.exe
Token: SeTakeOwnershipPrivilege	3508	msiexec.exe
Token: SeRestorePrivilege	3508	msiexec.exe

Suspicious use of FindShellTrayWindow 17 IoCs

pid	Process
2940	msiexec.exe
2940	msiexec.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
5940	windowsdesktop-runtime-9.0.19-win-x64.exe
2788	msedge.exe
1520	windowsdesktop-runtime-9.0.19-win-x64.exe
5968	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3508 wrote to memory of 2176	3508	msiexec.exe	98
PID 4792 wrote to memory of 4404	4792	X.SPOOFER.exe	107
PID 4404 wrote to memory of 2788	4404	msedge.exe	108
PID 2788 wrote to memory of 3760	2788	msedge.exe	109
PID 2788 wrote to memory of 3128	2788	msedge.exe	110
PID 2788 wrote to memory of 3468	2788	msedge.exe	111
PID 2788 wrote to memory of 3468	2788	msedge.exe	111
PID 2788 wrote to memory of 3468	2788	msedge.exe	111
PID 2788 wrote to memory of 2740	2788	msedge.exe	112
PID 2788 wrote to memory of 2740	2788	msedge.exe	112
PID 2788 wrote to memory of 4456	2788	msedge.exe	113
PID 2788 wrote to memory of 4508	2788	msedge.exe	114
PID 2788 wrote to memory of 4456	2788	msedge.exe	113
PID 2788 wrote to memory of 4456	2788	msedge.exe	113
PID 2788 wrote to memory of 4508	2788	msedge.exe	114
PID 2788 wrote to memory of 4508	2788	msedge.exe	114
PID 2788 wrote to memory of 3200	2788	msedge.exe	116
PID 2788 wrote to memory of 3200	2788	msedge.exe	116
PID 2788 wrote to memory of 3200	2788	msedge.exe	116
PID 2788 wrote to memory of 5004	2788	msedge.exe	117
PID 2788 wrote to memory of 5004	2788	msedge.exe	117
PID 2788 wrote to memory of 5004	2788	msedge.exe	117
PID 2788 wrote to memory of 1660	2788	msedge.exe	123
PID 2788 wrote to memory of 1660	2788	msedge.exe	123
PID 2788 wrote to memory of 4008	2788	msedge.exe	121
PID 2788 wrote to memory of 4008	2788	msedge.exe	121
PID 2788 wrote to memory of 1660	2788	msedge.exe	123
PID 2788 wrote to memory of 1660	2788	msedge.exe	123
PID 2788 wrote to memory of 1660	2788	msedge.exe	123
PID 2788 wrote to memory of 208	2788	msedge.exe	124
PID 2788 wrote to memory of 208	2788	msedge.exe	124
PID 2788 wrote to memory of 180	2788	msedge.exe	125
PID 2788 wrote to memory of 180	2788	msedge.exe	125
PID 2788 wrote to memory of 2288	2788	msedge.exe	127
PID 2788 wrote to memory of 5436	2788	msedge.exe	128
PID 2788 wrote to memory of 5436	2788	msedge.exe	128
PID 2788 wrote to memory of 5496	2788	msedge.exe	129
PID 2788 wrote to memory of 5496	2788	msedge.exe	129
PID 2788 wrote to memory of 5680	2788	msedge.exe	130
PID 2788 wrote to memory of 5680	2788	msedge.exe	130
PID 2788 wrote to memory of 5712	2788	msedge.exe	131
PID 2788 wrote to memory of 5712	2788	msedge.exe	131
PID 2788 wrote to memory of 5244	2788	msedge.exe	132
PID 2788 wrote to memory of 5244	2788	msedge.exe	132
PID 2788 wrote to memory of 6128	2788	msedge.exe	133
PID 2788 wrote to memory of 6136	2788	msedge.exe	134
PID 2788 wrote to memory of 6128	2788	msedge.exe	133
PID 2788 wrote to memory of 6136	2788	msedge.exe	134
PID 2788 wrote to memory of 6136	2788	msedge.exe	134
PID 2788 wrote to memory of 5336	2788	msedge.exe	135
PID 2788 wrote to memory of 5920	2788	msedge.exe	141
PID 5920 wrote to memory of 5940	5920	windowsdesktop-runtime-9.0.19-win-x64.exe	142
PID 2788 wrote to memory of 5312	2788	msedge.exe	143
PID 2788 wrote to memory of 5324	2788	msedge.exe	144
PID 2788 wrote to memory of 5332	2788	msedge.exe	145
PID 5940 wrote to memory of 4192	5940	windowsdesktop-runtime-9.0.19-win-x64.exe	146
PID 5860 wrote to memory of 5312	5860	windowsdesktop-runtime-9.0.19-win-x64.exe	149
PID 5312 wrote to memory of 1520	5312	windowsdesktop-runtime-9.0.19-win-x64.exe	150
PID 3508 wrote to memory of 5304	3508	msiexec.exe	151
PID 3508 wrote to memory of 3468	3508	msiexec.exe	152
PID 3508 wrote to memory of 4308	3508	msiexec.exe	153
PID 3508 wrote to memory of 3680	3508	msiexec.exe	154
PID 1520 wrote to memory of 2464	1520	windowsdesktop-runtime-9.0.19-win-x64.exe	155
PID 3508 wrote to memory of 3364	3508	msiexec.exe	156

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I "C:\Users\Admin\AppData\Local\Temp\X.Spoofer (3) (1).msi"
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2940

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3508
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:2176
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 2B1E9BA566003A4491EB4AB47E9340D2
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5304
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding AAF09A3E2EF2E7A0F2DF0ED8A7475CEF
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3468
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 07DC24C6DBD1B486369BDA16D9F62865
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4308
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 537776F7BED6B6579A1ED4CF13AFB9DD
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3680
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 29D87792A3DA3694415BD323A28A9EC3
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3364
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 19138233C06FE59CD317F8F14061E5BC
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5408
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 6106683676C3188F6A140E1F52C71407
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4420

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:764

C:\Program Files\X.Spoofer\X.SPOOFER.exe
"C:\Program Files\X.Spoofer\X.SPOOFER.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?framework=Microsoft.NETCore.App&framework_version=9.0.0&arch=x64&rid=win-x64&os=win10&gui=true
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://aka.ms/dotnet-core-applaunch?framework=Microsoft.NETCore.App&framework_version=9.0.0&arch=x64&rid=win-x64&os=win10&gui=true
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x20c,0x7ff9b916c188,0x7ff9b916c194,0x7ff9b916c1a0
      4⤵
      PID:3760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1892,i,2347138552769153029,17664372930217447080,524288 --field-trial-handle=2272,i,8693160581364126424,14456497015514283433,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:3
      4⤵
      Downloads MZ/PE file
      System Time Discovery
      PID:3128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1804,i,10709089671944751734,16196300351157162086,262144 --field-trial-handle=2272,i,8693160581364126424,14456497015514283433,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:2
      4⤵
      PID:3468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2492,i,8918749595682064267,9785114431692637231,524288 --field-trial-handle=2272,i,8693160581364126424,14456497015514283433,262144 --variations-seed-version --mojo-platform-channel-handle=2652 /prefetch:8
      4⤵
      PID:2740
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3484,i,16248882103840765993,17971116792038528194,2097152 --field-trial-handle=2272,i,8693160581364126424,14456497015514283433,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
      4⤵
      PID:4456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3488,i,15221934556574078183,6413551040524896442,2097152 --field-trial-handle=2272,i,8693160581364126424,14456497015514283433,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
      4⤵
      PID:4508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4216,i,15359731288289305156,6419492718142254743,2097152 --field-trial-handle=2272,i,8693160581364126424,14456497015514283433,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:1
      4⤵
      PID:3200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4236,i,6330934987617735754,16445144979984342208,2097152 --field-trial-handle=2272,i,8693160581364126424,14456497015514283433,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:2
      4⤵
      PID:5004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3532,i,10844657057227796315,3148210558029595322,524288 --field-trial-handle=2272,i,8693160581364126424,14456497015514283433,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:8
      4⤵
      PID:1660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5232,i,12480866325096882409,11069411329994321716,524288 --field-trial-handle=2272,i,8693160581364126424,14456497015514283433,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:8
      4⤵
      PID:4008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5236,i,3784733619882338651,16234310244083356996,2097152 --field-trial-handle=2272,i,8693160581364126424,14456497015514283433,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:1
      4⤵
      PID:1660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5176,i,2863236825838040645,7136127699427225973,524288 --field-trial-handle=2272,i,8693160581364126424,14456497015514283433,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:8
      4⤵
      PID:208
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5048,i,11460624860288004497,16341638723741126030,524288 --field-trial-handle=2272,i,8693160581364126424,14456497015514283433,262144 --variations-seed-version --mojo-platform-channel-handle=3772 /prefetch:8
      4⤵
      PID:180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,11196768819535923076,15236988280210108487,524288 --field-trial-handle=2272,i,8693160581364126424,14456497015514283433,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:8
      4⤵
      PID:3388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,11196768819535923076,15236988280210108487,524288 --field-trial-handle=2272,i,8693160581364126424,14456497015514283433,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:8
      4⤵
      PID:2288
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6000,i,11322172068148324608,16238102043638210297,524288 --field-trial-handle=2272,i,8693160581364126424,14456497015514283433,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:8
      4⤵
      PID:5436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6220,i,11955130415312435102,11938724945904058378,524288 --field-trial-handle=2272,i,8693160581364126424,14456497015514283433,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:8
      4⤵
      PID:5496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6068,i,6400952800470462616,12286395029144163444,524288 --field-trial-handle=2272,i,8693160581364126424,14456497015514283433,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:8
      4⤵
      PID:5680
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6188,i,5624480298080675074,1184745114725306742,524288 --field-trial-handle=2272,i,8693160581364126424,14456497015514283433,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:8
      4⤵
      PID:5712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6240,i,14592085955315013030,13377583172132217781,524288 --field-trial-handle=2272,i,8693160581364126424,14456497015514283433,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:8
      4⤵
      PID:5244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6304,i,17571477678062041033,14618835569890271831,524288 --field-trial-handle=2272,i,8693160581364126424,14456497015514283433,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:8
      4⤵
      PID:6128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6292,i,2317685866296248492,5052242121105996462,2097152 --field-trial-handle=2272,i,8693160581364126424,14456497015514283433,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:1
      4⤵
      PID:6136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6788,i,17660806766399303822,9858715714038986429,524288 --field-trial-handle=2272,i,8693160581364126424,14456497015514283433,262144 --variations-seed-version --mojo-platform-channel-handle=6796 /prefetch:8
      4⤵
      PID:5336
  - - C:\Users\Admin\Downloads\windowsdesktop-runtime-9.0.19-win-x64.exe
      "C:\Users\Admin\Downloads\windowsdesktop-runtime-9.0.19-win-x64.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5920
    - - C:\Windows\Temp\{DEEDE553-99B6-4D34-8E67-E0D57804B1CB}\.cr\windowsdesktop-runtime-9.0.19-win-x64.exe
        
        "C:\Windows\Temp\{DEEDE553-99B6-4D34-8E67-E0D57804B1CB}\.cr\windowsdesktop-runtime-9.0.19-win-x64.exe" -burn.clean.room="C:\Users\Admin\Downloads\windowsdesktop-runtime-9.0.19-win-x64.exe" -burn.filehandle.attached=660 -burn.filehandle.self=692
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:5940
      - C:\Windows\Temp\{0720FB24-83FB-40FF-B361-161CD7540DC8}\.be\windowsdesktop-runtime-9.0.19-win-x64.exe
        
        "C:\Windows\Temp\{0720FB24-83FB-40FF-B361-161CD7540DC8}\.be\windowsdesktop-runtime-9.0.19-win-x64.exe" -q -burn.elevated BurnPipe.{62213E71-6D1D-40CD-9868-A6980FA3A6DF} {2CBBA588-1C90-417E-93D2-398549984381} 5940
        6⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4192
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=564,i,7451121456487484308,14118233198390299164,524288 --field-trial-handle=2272,i,8693160581364126424,14456497015514283433,262144 --variations-seed-version --mojo-platform-channel-handle=6892 /prefetch:8
      4⤵
      PID:5312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6880,i,11279928582734218373,903880412016684456,524288 --field-trial-handle=2272,i,8693160581364126424,14456497015514283433,262144 --variations-seed-version --mojo-platform-channel-handle=6904 /prefetch:8
      4⤵
      PID:5324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6876,i,15592414440231303514,4188913697422883180,524288 --field-trial-handle=2272,i,8693160581364126424,14456497015514283433,262144 --variations-seed-version --mojo-platform-channel-handle=6968 /prefetch:8
      4⤵
      PID:5332

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2436

C:\ProgramData\Package Cache\{7a013c32-dd46-48f5-81b1-2576c92468db}\windowsdesktop-runtime-9.0.19-win-x64.exe
"C:\ProgramData\Package Cache\{7a013c32-dd46-48f5-81b1-2576c92468db}\windowsdesktop-runtime-9.0.19-win-x64.exe" /burn.runonce
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5860
- C:\ProgramData\Package Cache\{7a013c32-dd46-48f5-81b1-2576c92468db}\windowsdesktop-runtime-9.0.19-win-x64.exe
  "C:\ProgramData\Package Cache\{7a013c32-dd46-48f5-81b1-2576c92468db}\windowsdesktop-runtime-9.0.19-win-x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_9.0.19_(x64)_20260826190108.log"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5312
- - C:\ProgramData\Package Cache\{7a013c32-dd46-48f5-81b1-2576c92468db}\windowsdesktop-runtime-9.0.19-win-x64.exe
    "C:\ProgramData\Package Cache\{7a013c32-dd46-48f5-81b1-2576c92468db}\windowsdesktop-runtime-9.0.19-win-x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{7a013c32-dd46-48f5-81b1-2576c92468db}\windowsdesktop-runtime-9.0.19-win-x64.exe" -burn.filehandle.attached=520 -burn.filehandle.self=540 /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_9.0.19_(x64)_20260826190108.log"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1520
  - - C:\ProgramData\Package Cache\{7a013c32-dd46-48f5-81b1-2576c92468db}\windowsdesktop-runtime-9.0.19-win-x64.exe
      "C:\ProgramData\Package Cache\{7a013c32-dd46-48f5-81b1-2576c92468db}\windowsdesktop-runtime-9.0.19-win-x64.exe" -q -burn.elevated BurnPipe.{53245137-C5FC-4AA0-97B2-17D2631E618C} {B6B18489-7606-4404-826A-672974B8CD81} 1520
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:2464

C:\Program Files\X.Spoofer\X.SPOOFER.exe
"C:\Program Files\X.Spoofer\X.SPOOFER.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/t9y3XKAe79
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  PID:5968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2ec,0x7ff9b916c188,0x7ff9b916c194,0x7ff9b916c1a0
    3⤵
    PID:1160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1952,i,7668930355376422305,3535414809001206388,524288 --field-trial-handle=2292,i,11935600409104557477,11808302182693196247,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:3
    3⤵
    - System Time Discovery
    PID:5452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1676,i,8338246727798918113,3087984597540634566,262144 --field-trial-handle=2292,i,11935600409104557477,11808302182693196247,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:2
    3⤵
    PID:5428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2492,i,17519559990434241437,15997131637857507101,524288 --field-trial-handle=2292,i,11935600409104557477,11808302182693196247,262144 --variations-seed-version --mojo-platform-channel-handle=2612 /prefetch:8
    3⤵
    PID:5308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,11788207232416263611,11861238108196382034,2097152 --field-trial-handle=2292,i,11935600409104557477,11808302182693196247,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
    3⤵
    PID:3988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,14915764911413574279,7136015183985739837,2097152 --field-trial-handle=2292,i,11935600409104557477,11808302182693196247,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
    3⤵
    PID:3200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4936,i,13988195806786573702,12296828063106558377,2097152 --field-trial-handle=2292,i,11935600409104557477,11808302182693196247,262144 --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:1
    3⤵
    PID:176
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5264,i,7781585440922369314,16062968008945811045,524288 --field-trial-handle=2292,i,11935600409104557477,11808302182693196247,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:8
    3⤵
    - Modifies registry class
    PID:5672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5268,i,11481030058606206397,11587480280314106910,524288 --field-trial-handle=2292,i,11935600409104557477,11808302182693196247,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:8
    3⤵
    PID:5588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5352,i,7776930976730001796,10038763233658164449,524288 --field-trial-handle=2292,i,11935600409104557477,11808302182693196247,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:8
    3⤵
    PID:4528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5348,i,367204823968351236,5940541129536655827,524288 --field-trial-handle=2292,i,11935600409104557477,11808302182693196247,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:8
    3⤵
    PID:3744
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6180,i,12414343113473073389,248833947204256088,524288 --field-trial-handle=2292,i,11935600409104557477,11808302182693196247,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:8
    3⤵
    PID:5628
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6180,i,12414343113473073389,248833947204256088,524288 --field-trial-handle=2292,i,11935600409104557477,11808302182693196247,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:8
    3⤵
    PID:3520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6192,i,13116692663626177909,14417258793904301605,524288 --field-trial-handle=2292,i,11935600409104557477,11808302182693196247,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:8
    3⤵
    PID:6776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6236,i,4215911616190260906,4037129323606277375,524288 --field-trial-handle=2292,i,11935600409104557477,11808302182693196247,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:8
    3⤵
    PID:6784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6196,i,11186803082300336652,5825981811678946927,524288 --field-trial-handle=2292,i,11935600409104557477,11808302182693196247,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:8
    3⤵
    PID:6792

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5500

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2472

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e58bcf3.rbs

Path C:\Config.Msi\e58bcf3.rbs
Size 9KB
SHA256 1da445266a7263d2995a9a4814482edaf9febdd2af9e114461167939189fb66a
MD5 34da49e024dd915d74e8cdbb5249858a
SHA1 0fd4c1ca69e5a6179088c117f5a99e7212a60fe2
SHA512 30d6e647cd63319f5d3fa839a7d10511fa62db28793a3a249233336e297d46ffaf236b6ff73105be38a4943d3fe8dfece35235a8ee61209170c888cb54f8e9d4
SSDEEP 192:is2LEzHdOpJsvPJwDe1ScOIgcOQulmpVgNMpO:is2LuHdOpJsGc2czpVg3
TLSH
T1F2125742750191E5FCDF1BB8C747279E3772E2AA6318420B36CC42249E4B7D85F592DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58bcf8.rbs

Path C:\Config.Msi\e58bcf8.rbs
Size 48KB
SHA256 cc7159ad2a8763e3b6d46473dbdc10293720c7c2d56d05361b10b442b71a7366
MD5 fd84ad92e410050c308d58c448edbc73
SHA1 0b9c92d6b10d06f5429b3aff55a228ecfe2de0b8
SHA512 479550fa3fdf283e2004d28d43f1982eaefa7652dc9641efea903d36b17470daed5e8cc7ceecef6ba66af2c05d14c1973c7a31535fd81d2118397e9726998769
SSDEEP 1536:tfw7X9a/uKqjSnQ36UoEW8o2kqkWB7Wue3JJzqADk7x/PxoCtPVAULwXLDJw2WdO:2kmiT
TLSH
T153233294EB00C3F3E6332E987F21EE0937194E9B5B45448E57C5510BC9D6EF8EAA82C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58bcfd.rbs

Path C:\Config.Msi\e58bcfd.rbs
Size 9KB
SHA256 d06e1aa8e247d857d95d00821a07cac2aefea7f82bb0fb0dc2f40cfeaffdfcbe
MD5 dd3bc77c80fe35357efcd934bcff5101
SHA1 dd90cf2788d50cce99074e31f13b5f4c3ae28848
SHA512 a521e4adb161aa96a2e783846e1ae1110a975cafa562911495565609072ffb8af0b0c880ee7d9f32372de5462b37fa3701dda0b792749b8dbc3bf7089974bdbf
SSDEEP 192:CdnPjn8ntznPDwnneIKUn1nsn/iZCI8n5Un1nsn/iZCov8niEcxn6IpFkncnK:CdPj8tzMOU1s/iZu5U1s/iZgs2cK
TLSH
T1A1124156B60499E2D8B61F74CB0B1B2437B6E3C94354871B448EE5680F437C8DFAE39A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58bd02.rbs

Path C:\Config.Msi\e58bd02.rbs
Size 10KB
SHA256 72d67522ec74017c5b3cbfb06aef12c080850fb9e59469992ff509c47535dae5
MD5 f978a5bed5f79c8af5993c2c23a639f2
SHA1 676307bb8ad51cd4bc36357814430ae72ce9659d
SHA512 c4a47e331178d7a9f81089a4ede8b9fd6d280a56e238c36717236b0de54cd2a206721e17c59fadbfa3a3e17404dbdb6aa566ffa86f8b0bdc5a05406b25e5f4c1
SSDEEP 192:hOpreKo5HxGX/ebKk6iZCI1k6iZCHpE9QmzIp+:hOpreKo5HIHk6iZTk6iZZz
TLSH
T11B22FF02AB40D2E3E8672776CB032B213762C3D99704579B51CCE9648F1AB8D7F6978D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58bd09.rbs

Path C:\Config.Msi\e58bd09.rbs
Size 88KB
SHA256 8fb1a624a40d129c4d645fae6a21473414d1f35bc656460ac7581d81c4e9a752
MD5 512af9fb322316f9a68cb7c2677b9c5f
SHA1 bcc0788ed944f2ae67eca5cdddbaf255a3e61f74
SHA512 6026fe27e2638f4b02fa913316060c5dac7d8d79e94f78110d736a130cd77768c069fab9aab4f7ede1eba9800acfbf0629fa0c58fa9b05ff91f759f57ec82e27
SSDEEP 1536:XMb2rekZzNoT5MV4JrH66HteA3Y4MxPXlgUm/Qg2bLqQCyI3VVTGnq17AWW1Janr:XQb0v2AttOKmWjKK3f72y2mfkiIaynVx
TLSH
T152938E9DAB01C3D5A8373B449B3FEF086E0A8CAB57489A1F17C44526D8E1F876B794C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58bd0d.rbs

Path C:\Config.Msi\e58bd0d.rbs
Size 3KB
SHA256 c68c5d6253f07c292da15b255ada0c90b7d4ad46b5005e7ffb5f5809be159a36
MD5 101e2ee059c59e5586dc44ac048df491
SHA1 f617929918bd652647382b5c4565fe079eefcc88
SHA512 e15e210025a2da2b81a5d8a6a51bd0cd10eecfcc36a36c40ebe6f239eec672f44c07a94918392f1f8357725d2d548b5a0d5718d9779eda3bf0d0e1d68d027d6b
TLSH
T14E816B02EA04E993DCB22F71CD1B0B243377E7DA97248347448C95740E47BD5EEEA68A
MD5 SHA1 SHA512 TLSH

Submit Download

e58bd10.rbs

Path C:\Config.Msi\e58bd10.rbs
Size 3KB
SHA256 5f69c9c475f76fce2e980a49fc827c4930a7a6d3bcf652ef64852ebdbab067f0
MD5 8ecc1cb00a77b4fe7e50253c1a159917
SHA1 32cde9cc422510acfc8c6a8d77cae59f69ef4c0b
SHA512 72cabbe4733dd7ca84657cb71f6190e8cb4bcf5d9510ac5ceb21781918d6072f6e785e0df1ba54cd406c1c4c96c36be767a65037f3f090b2613b7ad09517732c
TLSH
T1377169039A44E293EC632B71CE171B1133B7D3DAD7218387508CA5B44E4BBC9AFE9649
MD5 SHA1 SHA512 TLSH

Submit Download

e58bd13.rbs

Path C:\Config.Msi\e58bd13.rbs
Size 3KB
SHA256 8edde85f28f22185f3acc0773b6ea2d4c4b657de3fb29c4cc071302f74931fcb
MD5 1dbc680eab61646823726fb72291e66d
SHA1 aa6e8b32fe90ed0db90aece58db9b2fc28f3094f
SHA512 2bc8138fd9d0c19711e2cee33c710a308465a1e8a5131d0973cb695abbfe8c46f4601d3f576963588485308c534cb1f340d2a98a694c9b455894d653271e8b49
TLSH
T19D817A439A04D682ECA71B30CD2B0B16337BC6DB9715838B44CC91714E87BD6AFEA54A
MD5 SHA1 SHA512 TLSH

Submit Download

X.SPOOFER.exe

Path C:\Program Files\X.Spoofer\X.SPOOFER.exe
Size 153KB
SHA256 c37a60ee5969f80ff061b99cf5e510c2e930603e8566e39cfad98536c724b5cd
MD5 f180f8e732f9c37c3d836e4f8949fe9d
SHA1 da09b453e3fd0c4bf685535c78b161e49dc47ed8
SHA512 e78a6f050b2f0b4351a5d86f0e6d7b8c2964d17c95ad3cff4ea8124c304271b1e1cdd488e8a54494993bab36afc39cf48b87c55060f228db36c4165d3f01a0b3
SSDEEP 3072:e20jWfVKLer59aSpfO9D/87jXEkeNZA4nsSIU7:vIhSpfO9jCf4GU
TLSH
T1CCE33A07A6A840FEE1B7D679CD924941FB7238598B71A6CF07504AB60F777D0AE39302
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

X.SPOOFER.runtimeconfig.json

Path C:\Program Files\X.Spoofer\X.SPOOFER.runtimeconfig.json
Size 516B
SHA256 05917b409d59af31bc8d3021bc06302a0c21c7d05b449603d6cc9f0301a2b66c
MD5 6cc5992b5f24e3ff259ff61441f0bce9
SHA1 98e9fecdc80c90f6d250b9afca50eab4c4c0151b
SHA512 64b9612846b342fd254c439be1833b4fde0e7bcea5979879d333b54a7633a9936df65639101ddb28023a3877f9a4dd1cbde29b2dfe79538bec48cc4a8aecb377
TLSH
T150F02069CA106DA704B937BAC63AC182FB30573B00041D92B9FC080C2F77DB22212F89
MD5 SHA1 SHA512 TLSH

Submit Download

ThirdPartyNotices.txt

Path C:\Program Files\dotnet\ThirdPartyNotices.txt
Size 77KB
SHA256 e8ddd95ac905467e4e519b446ca023fa00c31732bebd9b66e65101c712092ee7
MD5 406d07d20e58568365df0557629fadc6
SHA1 9ab5ba1ef3866afa75b8cf3c392b7dd3d7f52026
SHA512 c6025a947faa5dc2b41a14d75e228ca2bd0df094e8cef914c58a6d2f5854424972a647b2c8ca8173345e40ba7557843d03efa85c5098c6e0e6726377efc8a38f
SSDEEP 1536:HA9jHwsGfgg39/zwgAVkguQxrDjugtSEGepkWvrpX7anuqdLSVnfiStPq+3Lefrb:HA97w/ogz1AVxuMjHtSFULryLOgrGWwa
TLSH
T1F573A45F7E45077319E2C3916569A8C5F22FA02E3B6B2A44346EF248133B42DD6FF858
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

state.rsm

Path C:\ProgramData\Package Cache\{7a013c32-dd46-48f5-81b1-2576c92468db}\state.rsm
Size 932B
SHA256 988473f95bdfd249e3a0e2a3bea2f9c224e743e1882217ab9db7dad62f1a674b
MD5 6dc7e45b2c2839f6ca1bd090cbb69678
SHA1 0ece8faa4879e86809edfc88a462e6288e4733b5
SHA512 b806f7c44caea54b81e9232b258e79b21054bfc5c0cddbc45be3e16ada841e55d3e050a84886e9b7b721fd6c6fe57ebc81d859ac3dfd13b8d10ccee5fc07c725
TLSH
T140119A515FFA0129E3FA6B3069F52721643ABC160D32C16C0001318A8E32BA0C8B0F77
MD5 SHA1 SHA512 TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 dc3cbdc636712cd0ad246adb60e10a6c82511eff5067261c392024fae841e7a9
MD5 c1825e771385238aa2866582788cf8ff
SHA1 cdd34f1c740914ce98dfac6172ecd00fb2da9783
SHA512 33f14925d45545eb4c68af5b5b273b9724142601b0f5098ecd00afa7d2c73115a7bbfbde0f2118a5645868d8b32a69bd2a748d5d5a3d469656956f8af0313fdf
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7C:fwUQC5VwBIiElEd2K57P7C
TLSH
T14FB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cdffa249a35ee1b35aaa4deee5516b419a42193c7c90c56923df65d0f3eb94db
MD5 cd31ac3155ade2f31cc79580940fb81d
SHA1 760ebf333c148025220a7393d05430ae97c22623
SHA512 fb844a0a791241e5c51e3effcc85b934b0568f9a20a1ca0e18543f92ae6d196976fc1cbbdfb8269f9592e50ff2bf2c516b3cbb7a29f178d7f5117675e779dd17
TLSH
T17BD02354FA5CF954D1633C3D5452A702B1CEDA947D579212D250418958576B363D10D2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 46c75c695c711992d70b43ad12d4203d5912cdc7c2a0f6eb9628b3d260f55e33
MD5 a72f3cdd7960977c7bea5d7cc8d45bc5
SHA1 6c9320f76086e75b609498124e4f9a9f58e3f8b1
SHA512 19a53f02b7405b33ba1faac7bc704634eeab947cef31258c74c63a601ce05555a767fd324382c26aa9f019454ca57daeb78e02f3667c15f4adb5a38acdcf6e4d
TLSH
T15AD02354FE5CF954D1633C3D5861A702B1CEDAD87D579212D250418958576B363D10D2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5d2c4e39ddbeb0ac61628bae04f1ac5787600ec893b0e230d1a84d61470771a9
MD5 cd6e704306442404371caebfec7f5b29
SHA1 e4beab8b7820af3633bf7c75a5498a958a95832e
SHA512 de66681a9245e8ece7d7e2ea2080251c395f2aeb8a885ac007eaf16f2ee3a3e36610d2afc17be964a038704371cedfbe4da91143ebed5adac20dbda97768d6e6
TLSH
T13AD080273A196404F7964175A483D7061319956129579712F310C44C99775D553C11C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c940d188ab030b713ca22632d74da3274c2906564b4b03738a468c4c21f8aca0
MD5 31d38895e3328226e32ffe0982bc4bbc
SHA1 a5e3b93cfa8b8f85be97da4f75316f6bdfa484bf
SHA512 c45911bbee8fe9aaf8329deccb43d61fdf7c69193320147838d0091e340733494cfaa7e68016b0f78d1ed1477db2079b2d5e0ff12334a6e579c392541cae4eb4
TLSH
T137D02314BD7CF6D4F163103D55519602714CAB967A135216F150444D5D3755253D05D2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1c8e6fcbb66aba64fe595f222fc4117e00e82ccdc0eef2100a1b4f7babb04f87
MD5 398d1e7948d46a763209c466fdacd0fb
SHA1 b26f2c32bc106089a59ce779d792beaba59f92bf
SHA512 a0bbf31d803e7333d004f03de9c261732d00cceb5d82dd64b5f0decf8adc8b840891187c72bb21cce83873e6d4dd2fab89d4c7efa320afe2ef3589678dcb1424
TLSH
T1B6D080277A196004F3964175A483D7061319956129575711F310C44CA9775D553C11C2
MD5 SHA1 SHA512 TLSH

Submit Download

1848c608-022d-438c-b92b-07908d1f671c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1848c608-022d-438c-b92b-07908d1f671c.tmp
Size 414B
SHA256 def75767f5aec13789a6179771f1e45ebab462c76fa219a4bba913dfebd47840
MD5 7ba69f9c6302cb2540e863ef94904194
SHA1 7f652555dcb373cec06553546017f94b5f009122
SHA512 b95ca71bc9b51c28ab66bfb1472eb5042f54efb8d5eaf08adb4c95dc79a0553512ec03fc2022e305f7f98d4c95c749740782a266b6ff57f731847e212b89ad85
TLSH
T106E0E565C825EC271EFD0B2894215686E75013271640494E7A3C81188FF463A568A86C
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 a435e2da756d54aa713dc5ff99b4c09439f86a09127f3574e7019f9c1bc6c558
MD5 bc3c9cc17f6e5e737838f8c6c963ef61
SHA1 13c3d92ac514b3e4d183285942e2b6ab8c614bfb
SHA512 d20f35090086487283d02bf7afa69ca2df1ce8c3f6db66918237473b539eaf65f16987f2121e76763e6d5cc00a9f152b514205aa992f707070dc3ff73ceb7fc6
TLSH
T1DA716EFE2A92419BF350C2BA40F2C20439F496E8F40FCED9BDA45C302917BA0C264B95
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 10KB
SHA256 e529783f80bb9ceaad9a8c0f46ed4b1c33e59d06ca48324658a4a2e121d0faa2
MD5 6269e938aba58afce29388c8b48cfc22
SHA1 d9cfa281ccded39d7dd3966288eb4af10aed8055
SHA512 d6d359418b4632cd1f003745fb98b39c74020162af8a5aa7a08aa16e9de8053285ded35ca81f5fa92bfb885457dcf686fc2d7fd8dc17415cbb87ced8610998d1
SSDEEP 96:yaDI9leKhmArmG1YpCO3Pn0ASAZv01m699ScrIV0kWTmJVgrEnoQBT0QkF1Bmc:/I0j3d0AS11m6OcrIVr+gOQVBimc
TLSH
T11D2296FDA56D881AFB408D7940E0868838B553D7FD1F8FB86952583193CEB93811CBAC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 62363b794f947c0d2fa16ee9a9943b47352d30f162e61743c927eeda0012e6ba
MD5 2cd696460d861c53df7c4708e18ca4be
SHA1 f4a247c643351f7173856e71173beb6471990ba6
SHA512 55b1b8809e3ed3a188fe28155f61ed8b20d9c3f176c657c15cc6b56ee0eda136a1bfe08a080e2fd330b5b677e093d5528e68205d694849c9970a1127841aa912
TLSH
T1AD714CFD2A5241AFF354C2BB40F2C10479F195E8F41FCECABDA04C302616BA5C269B98
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 cc20a1662f07fd0be28683fd169d361fd12c77a690b2417a6a1f3cf972ba94b8
MD5 8dff8f478df4f7de29e316a295c00705
SHA1 548e7fb5db7ecab422a1e7d327009138c15f8fac
SHA512 06c4943c62bf3c4e9a55e198795f0453a4362ef8959c2bfde035df2b60d5f4797c1ae012e6f5fb5058737db987b1334ff9bbf427407538e34d2070c343f2f1fd
SSDEEP 3:MsEllllkEthXllkl2zEklTH:/M/xT02znz
TLSH
T1944404447FD45505C50010315111C3501370D4310D11575334D107335CC55401C40005
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0671b223-0c7f-4381-8cf5-7a0084ec3b65.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\0671b223-0c7f-4381-8cf5-7a0084ec3b65.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 4ab7a04c07f4a68c0743a31e31c8034baa9876693b0834368748f9b3f803fd89
MD5 1e03dd2ea3e789843649471bd94885ab
SHA1 be277e1c932478cd78e47de0d6ce7d54f0cc8896
SHA512 95323c4aeeb0b6371b321d404a56a4ca0a0b6d6279e0a28f7bf9228b55b29d8e6e9a492be4d530bceed35a7e87674bb297f843d474e557af1e94fe667138d192
TLSH
T19051CEF783E5856E8A0196F0AA18AE2FCE2D0615431C3C5989D4EF27D7E34B1E00165F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 dff6039f78f2345d903ba5aa3b80a2856eb981ca9518280f8a25af4028756243
MD5 56af6316603a59890b752eed4dfb5a1a
SHA1 11061c3a71e38d4d3d413e5c3506cabe52b85ab5
SHA512 5c92703786fb90ab9bb1a249b0eb9b3845a8866a4b762ab1ae6d1bde898e9208478914c024f51849461905190ec68307176434f6969d3fb22da68f27aae595c3
SSDEEP 192:sxZGRzyM/jK1Ml8Mi6/fus/zRkv7uBmQ7WIdpw7HW6+WNrOT/ANCmyucFIg4J:sxZGPq6/fus/z2zw7T+Hb8/Suc
TLSH
T13252E911BA389977CCCBD219FA557B53D6F90472A1850D48AAFCCA1C04F6AED320782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 f6bdfa01a51c653ea3b0eee8d20f9881d3e914124a1e78ff6d1b98e60ab14035
MD5 0bacb298073d50091dd94ae5d190ddec
SHA1 0ea85999db056e278430596cc9bcb9d6062d5b6c
SHA512 d9eae845cb01b6044bbe518c63409f081b4ec3370ca0218f143935c4d1c90183f4f671e213aa9cdc1b9ef52d075294ee477c2fb7ac414995b8a044a6afe1767e
SSDEEP 192:sxZGRzyM/jK1Ml8Mz6/fusskzRkv7uBmQ7WIdpw7HW6+WNr8KXANCUyucFIg5wJ:sxZGPL6/fusskz2zw7T+Hb1Xouu
TLSH
T17252F816BA386977CCCBD209FA457B53D6F9047291950D48AAFCCA1C04E6BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 2180d458c465b46e2084e7152f0406ff84a0fb1185f75466cd30a1007fbb57db
MD5 61174d9d8b0fecf5d2ff6cfb5eb07588
SHA1 a9fb8f0055f866bed70a7092813de77b299a35e0
SHA512 69163219134422924fd702043e8225e2d119f247ef14b66ab0d7b70fde142cbcebb775434eeaf40dc2c5c4ca4953c1da68794833a37185af47e025dd5a867c24
SSDEEP 192:sxZGRzyM/jK1Ml84m6/fussZWpVnzukv7uBmQ7WIdpw7HW6+WNAi8KXANGzmuqDe:sxZGP06/fussZWvnzzzw7T+Hb1XZie
TLSH
T12762E716BA385977CCDBD219FA457F53D6F8042292951E44AAFCCA1C00F6BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 aba2a252a9ce3e768b5d39034d45076cdd269887f7a0fedc6bbfbca5a2d50752
MD5 0a97205259010d120d7edaa5f70eee21
SHA1 9933e8a4a9a9c6635888954f32363175f67cddd5
SHA512 00818c0d6b682036e3746b94b6279ed005a0d8ac491bf8e329d4af39858418b2fcc39f46db89fa9dd2bb96ede39254ccc098c69a2b1e25322f7f54f8ac6207c5
SSDEEP 384:sxZGe06/fuss7WvQ9zw7/nAGKHbRsXeN5e:s+J6/fwYQ9xHbceNs
TLSH
T11B72F811A6385D77CDDBD208FA45BB63D6F8042291954E84AAFCCE1C00E6BED320782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 3a903c4e847722a6af8b744a1ad52ce43e0c955710239f7a40fa725fcb382fbf
MD5 304595ef99e2b701a2689428e480038c
SHA1 ed1d3886802251c61a31cdb18ccfda795b6dd1cd
SHA512 99bbcd02a894da91f9f4f1e77165529b6e21c25d3d14c768501ca855b6003639e024521efe16fef92efe4b402718f1809331d18c4bc785ba422060164c14118e
SSDEEP 768:sRCbqDD7pLuLzc+WvSCb68F1+UoAYDCx9Tuqh0VfUC9xbog/OVFY1ZLlRTKRzro1:sRCbqD1Ezc+WvSCb6u1ja0Y1ZLbWRAfd
TLSH
T1FEF2FA3B2C0CCB7E4F804E9CDD2AAF9B6DE8028B5A98C95447F9944C03C66EB55171DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 2f795f229dcf957abbb2441509a501111529da5c94d59ee1c9911ce432cc126c
MD5 fa29794bfd1c8cec8f41c8699b076bb2
SHA1 658482080011e0a1111671cf70c08bdd979a6bf7
SHA512 f8ad34bce46f73f86f05f41d4431b78f98642b1ed48e50da7d1caedf815900bab34db308e12476f587f1b5662d588dd68ee197db9ddaa030bb96b0b3b6a66272
SSDEEP 768:sl8bqDD7pLuLza+WvSCt68F1+UoAYDCx9Tuqh0VfUC9xbog/OVFYLZLlRTKVzroC:sl8bqD1Eza+WvSCt6u1ja0YLZLbWVAMX
TLSH
T14BF2FB3B2C0CCB7E4F804E9CED2AAF9A6DE8018B5698C95447FA844C03C76EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 233B
SHA256 31c95e8cc460d1d664ddfe1a4eadbd94e1a4e3765a727dfec5bbd6e1441ed58d
MD5 d26b3f948e79fcc1d6b7eb55fc0ad013
SHA1 b9025881aac6805f028096732a66f86d819b2b95
SHA512 1a0c8db07f5043a158b3a527fcda1a640022a204b2bee653098989367c53182c6e1ee89c22260a29052fb447b28c9690e93830e7e8282b264e35fed5ab447f2f
TLSH
T1E1D097C7F0208880DFBA4F420A2120BB87152CCD0889908CA202253F0839B57E222F96
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 226B
SHA256 b3736b85ed3fd9cef330ef6c678da3303475d603e2a914ee04144b0d672acf45
MD5 e2a0bff2efe79258e21ac6eb7c272b10
SHA1 e5faed9c69a3144771bcfe0489a8c0f91bc0b6c4
SHA512 61747e6d791bfc19d27d3ed69ea548265090d8ff648d2ad705b25b45eb2d41609488f4c3289b77e330c28fbe78a39e4636b429628dd02deaba08cf15a24e39cc
TLSH
T1A8D097C7F0408980DEBA8F420A1120BB87053CCD0898908CB102063B4809B67A212F96
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5a4ebd.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt~RFe5a4ebd.TMP
Size 138B
SHA256 733792f79dca3b23fbb88b2c1e2e08d08ea83e62cef3dc202c341828cbd36f3d
MD5 98053da11a8669c9ca94cc105dba4e55
SHA1 a94ea5ef34a8335d89c486e398d1ac40568becb7
SHA512 79feebfacc2996aab7ab39d8d06d74dd6035740fe4cdde60bf98268acf427b80d5013c75aafbfa0c58f1ccd4f866e0ec6b31fb25266ae61bb87f2d85339b4d01
TLSH
T1EFC02BE7A0400240CF290B420232315EDB0A3DCC0CCAC44D710333261036E177102FD5
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 b58baa9136dd4239a88f61ff5ac4a86df9783b6e038ac6f605330fffce12e3a3
MD5 166385d7019a7d7add77e32d4893b7ed
SHA1 3b3cf62047028470bbd04790ff4a9a7e99e64fb9
SHA512 938a64d566cf10352e101870f78e717bc8d39d74dcd3140dcc28149b9e9040b9c97c8b121f924a68c4111fd96d28093e7bc7df07be2beddeec4a85f0111254b7
SSDEEP 96:KA/ArPNhtY5p+L/HYKn9/lYTHnOlP1W9KKe8CaMAKdqmE:ynBtXK
TLSH
T14891D122737B130238BE691DA659873B9E5232E33465A46E7BFC40610A77E211EFC4DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 c8675327187a1b87207e6c8e9b6c487ae1e42be4e8fc6b8033d873f9fa416d6e
MD5 33745b4385dc7147a47f21efe7bd8783
SHA1 09d9c7579884b5005e9979e2c3bcc2fe56dd8427
SHA512 a0891064b0cb67e1793ca98f686751fb74f6fb12f7aa54f0db44a4c24f384f71d6e27dc8e11dd9a06b7517ede0da5359ff681fc3bd7336af3c80337104184714
SSDEEP 192:uuZLsNwEQqw4Qe1tbip7QmiU13la4Ea+joOmw+4z5FEamwrqRU8:nFsNwEU4dM/rFEa+UOH+MHk3U8
TLSH
T16C322836687C6C775DE7A144F84B36239FA40067DA8A2F95D2DC1F1C04EF69C230A92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 88a436f9d1d3424c6e674c586153d2b093e387756cd908766836fc04ed292988
MD5 649c4bbc261bcc8fa640dfe95ab637f1
SHA1 c07e739d5975ca4cac9c1df029340a2386cd2221
SHA512 8b6d47cfa1e196f054ea3948db269eb607353caae4531ba77f83a0ca9a1da699130a7a7b77e371480ab696cd67f58468978169df2b9dd11199db0613dea4c294
SSDEEP 384:ndZcILsNJdU4dMVbFEa+UOH+MHFC+LBNj5VkzJx8/7IzEoG:FLzGaJOHZlCWN5Wzgd
TLSH
T135927D75687C5CB35CBAB545FA9B2B17AFF40077C5CA1E80C5E89F1E1087699230B83A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 0985a5b42f0b1c44be3629b2b3bace12773e9fe5c5bdb75ca1d151e0628f1471
MD5 814515108a231591c5f9dd04462cd008
SHA1 d6b56093fa50176d2bd26e503ffd82a86fd2828d
SHA512 82bb971a4935d5816e650ca6f6497936612462ced08f3f605bd054ec42f3d767860e381d950ab50fdf62b465577cfde24e25fcae45cabc43b5847e82a28ba3a5
SSDEEP 384:nAZcIjsNqyU4dMTHFEa+UOH+MH6iCvKASBv9/olOKsd5H6F+LBNj5Vkzrov:+j3GaJOHZaptSo0KsdN0WN5WzrQ
TLSH
T191B24BB1D8B81CF704A5E5C5EA42E6176EB8003BC5CD5A0CD6F9BB3E309F5B91316426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d84bf620fbe65a76f84d5efe0a39e4c90d3ab175bad2773b37c8732890be1145
MD5 0fc34d50978ad786a7fa7c24fac4f3ec
SHA1 6f6353f8ee688aabd13efcabc61ee277bea5c53b
SHA512 30a601a1ce814afd80b10d459cba92c48b0945ceda4debc51b4cc8a6fcf6569f648b2440c0ffd3ef38979fd126e3b8e89da784c8b86edd066133d380273a9d49
SSDEEP 192:vONJ6Db6QmiUyY4HBa+joOmw+4sRgtCU6:vONJ6uWHBa+UOH+WEU6
TLSH
T17B02C735687C6CB79EA26E49F88B37279F94203BD9966B94D6D81F0C00D764C2307837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6a7d9bd37116c8f586fa0c19730ff3fae07c49f2fb1f1ff4c07c14b909b24898
MD5 03f6635229a5209a82d8aef7b36d67f6
SHA1 9abd6378d8d0ef6a62c7b21f5af72e8fb7ed59c8
SHA512 98768715931e2c5277359bc94075f837bed9f4ae66c98a8c5b3b0f57c506745518dc2bf4eb77f58fbccd651d53ae63b8cd280ccec48355a2792ac1362b269637
SSDEEP 192:3ONZ6DbkQmiUyQ43Ba+joOmw+4z5FFNzwrqRU6:3ONZ6sg3Ba+UOH+MH73U6
TLSH
T199120836787C6C775DE26584F88736279FA85027DA4A6B91D2DC1F0C01EFA5C230AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 74c0a3391882592f358b21b94537594ecc7e3ad79cfb3281eaa3e44d4e79e170
MD5 070bc1e1b76b55e0682f14ad81906dda
SHA1 6b943b24f9e5d84f4f38497393079517a0bd0245
SHA512 fd8e48bc4356270634738af1cf02245443eda3314d04d4edc548f63473353e28c48cb5e31d9aec3c865bd83ddd7442e0dd4a8421339322dfb6f6e46d88cce905
SSDEEP 384:njZcIKsNJdU4dModFEa+UOH+MHFC+LBNj5VkzJx8/7IzEoG:7KmGaJOHZlCWN5Wzgd
TLSH
T1A3927D75687C5CB35CBAA545FA9B2B17AFF40077C5CA1E80C5E89F1E1087699230B83A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7cde9ee3-5556-4626-94e8-8cd0fcd27e8b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\7cde9ee3-5556-4626-94e8-8cd0fcd27e8b.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 b7b19214bfb2c3b7feb8243d59a25eda7b883efe00943359c3194bdf4b3728c4
MD5 eeb6a61acf564a39be04c301b88916ef
SHA1 ebcb6596473dd6fb990e7d47b62dda8a2e8ddc8f
SHA512 9da0aa254469287101e5d7f6678543f94c813c1ab01cf25c1f071da7af1b754a6b190a346922e04383480252e18189fd7460ff2e20c2adeeb1ee65574cbd8d15
TLSH
T11E412D5CB6FA1104B3B36E5A9BF2A86E447F79772F1AD49E00110E4F4766640C8B1737
MD5 SHA1 SHA512 TLSH

Submit Download

7a03f12c-ae3e-4490-b8cd-09902403579b.tmp

Path C:\Users\Admin\AppData\Local\Temp\7a03f12c-ae3e-4490-b8cd-09902403579b.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_-_9.0.19_(x64)_20260826190108_000_dotnet_runtime_9.0.19_win_x64.msi.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_9.0.19_(x64)_20260826190108_000_dotnet_runtime_9.0.19_win_x64.msi.log
Size 4KB
SHA256 d15c68842e5124f98ccbdba66876e1b510e6a9d6aff1b1e2b0da6ff2a8064f58
MD5 338771307f40e28b0ccef5007d58100a
SHA1 c56e245b27aba2c2b8769890172b7f536650d0a1
SHA512 3bb74de8c74224d620b3dc9b0014a07551244b21408d951c4cd806ccf88c359f209d34fe85f87203177637bda89e71a116d2d7121999b68d57f38c0cebd1eff5
SSDEEP 48:Yc5U+xhWJw1JhdwGPEFORLAj/AcAaqcsm1+dwGSHSJzy1JjTdwGP0y1JNnVfiP9e:YZ+xAELwGuOKjfsiiwGSiStwGln+KFMK
TLSH
T17F8116151EF80915B2B35B479DF394235A33BD92A930DF5C2384831A036BA49687DB6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_-_9.0.19_(x64)_20260826190108_001_dotnet_hostfxr_9.0.19_win_x64.msi.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_9.0.19_(x64)_20260826190108_001_dotnet_hostfxr_9.0.19_win_x64.msi.log
Size 3KB
SHA256 9d5e5e8c1e7d521357876042685ae7f0369c8bf698b74a86558f3798ba2da5d3
MD5 d155fe362caa98caca2281ee80659aac
SHA1 d57b608e6b78086768422eb1ab02311ab324c600
SHA512 a657e433b8e212944a3d2b867cb5a3507bbcbb40bd6aaacf5dab40426c53ec48e22b8d63e0edc4fe435297386b5e5693aa04142a4fcae8b1c072071a67881b3e
TLSH
T16A713D291EE90815B1B3D7579DF3D4325A33FCD5A834CB5C23C8431947AB8067868BAA
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_-_9.0.19_(x64)_20260826190108_002_dotnet_host_9.0.19_win_x64.msi.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_9.0.19_(x64)_20260826190108_002_dotnet_host_9.0.19_win_x64.msi.log
Size 2KB
SHA256 3197b93919971d082e114508f5ba4f69a7f03a8a50444e658ec5efd92d616a34
MD5 d2f9c5cc1f92f76167a76fbe9c14d22a
SHA1 ca985c4542b99b0a95ab793e2554d7d0869a7a21
SHA512 bfee7c1f1cb8019c327e40a2da595ea5db22ccb358e7c866008af44f2981a88a7e892e3ccb6a862da8ec346fdb1a30729fb498f22aca05546b7cfb08b575d1a1
TLSH
T1A24137291EF91845B1B397179AF3C4236A33BC91B930CB4C2384831D476BD05687DBAA
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft_Windows_Desktop_Runtime_-_9.0.19_(x64)_20260826190108_003_windowsdesktop_runtime_9.0.19_win_x64.msi.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_9.0.19_(x64)_20260826190108_003_windowsdesktop_runtime_9.0.19_win_x64.msi.log
Size 2KB
SHA256 03ad372acaa09afe1794f460102339b50b3fe3b4beb1fe841b70b42ac4f129e7
MD5 4dda34de3fc1b0bddd38bcbe7aa00b70
SHA1 1db360477a4e06ff7f99c0fb8d50de85b90b8672
SHA512 2e01de85a71f25cbfcd660409a2b2a4b0869147d10417f63771e600b45dc09a6df0a1df52cf09564c75c937b8748d05822df0df426dcea0e4259a087eab7e22a
TLSH
T1364116252FE80805B1B357079AF3C5635A33FC916930DB4C3384832A0A67D0968BCBBE
MD5 SHA1 SHA512 TLSH

Submit Download

fe41009c-5034-47e3-881c-d58112dde90d.tmp

Path C:\Users\Admin\AppData\Local\Temp\fe41009c-5034-47e3-881c-d58112dde90d.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2788_1449062925\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f09890c3-0da5-4ca5-a0d1-a63ebc7d0a64.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2788_454740193\f09890c3-0da5-4ca5-a0d1-a63ebc7d0a64.tmp
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI9448.tmp

Path C:\Windows\Installer\MSI9448.tmp
Size 219KB
SHA256 2bf33a9b9980e44d21d48f04cc6ac4eed4c68f207bd5990b7d3254a310b944ae
MD5 928f4b0fc68501395f93ad524a36148c
SHA1 084590b18957ca45b4a0d4576d1cc72966c3ea10
SHA512 7f2163f651693f9b73a67e90b5c820af060a23502667a5c32c3beb2d6b043f5459f22d61072a744089d622c05502d80f7485e0f86eb6d565ff711d5680512372
SSDEEP 3072:FVzl3qiEZybztEwiUx6D02cWVsV1v2vZR3X6j7zo6k2FkngTLrOrORT9flQnS6lg:FVIMEgXmEAR3oHon2VaFuG0eEp
TLSH
T1AF248D217494947EEAFA0832A57EDA71BF3DF2241760C8AEC3409D1E6D604C167B7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58bcf2.msi

Path C:\Windows\Installer\e58bcf2.msi
Size 928KB
SHA256 db633a2ef6d82acdf79c368bf85b0f832e5e3ab343281983f1c6d6f1a4f70aeb
MD5 776e1e21eddc854bd2a0a7f9314e4ca0
SHA1 733d749d1a03512ca8d2c348503bf578bd91a81c
SHA512 f367a4ac273fd1a98b807cfbcad60f422e98373b8b41179dc367a958427399604284ab6a57b5c8f5f264fdf8ea11ba45a059aac66019f9662ff952066b3e5815
SSDEEP 24576:14A+11gZdbLipHTHDR+qMXJcMIVEX7rYYxyxPPm7L4M:CIK5Xk3XRLXfYYQxPPGLz
TLSH
T10D1523183778DA35D11916BA0B625BE81EF00F298D5E086E9FAC795F8CBC5C21218DDF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bg.png

Path C:\Windows\Temp\{0720FB24-83FB-40FF-B361-161CD7540DC8}\.ba\bg.png
Size 4KB
SHA256 9095bf7b6baa0107b40a4a6d727215be077133a190f4ca9bd89a176842141e79
MD5 9eb0320dfbf2bd541e6a55c01ddc9f20
SHA1 eb282a66d29594346531b1ff886d455e1dcd6d99
SHA512 9ada3a1757a493fbb004bd767fab8f77430af69d71479f340b8b8ede904cc94cd733700db593a4a2d2e1184c0081fd0648318d867128e1cb461021314990931d
SSDEEP 48:u+Xg+NXWbdlIr33lx9W5OstaDIy3r5XpPyvZKmXYTDeiByNxcaaaaaaaaaaaaaaE:AaXWPIrHT932JsdpPyjqDeioatEn
TLSH
T19891B4D8FCF95322C6002BF255F4C0735A0215B713ABFEC82F496BD90E6878E25058B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wixstdba.dll

Path C:\Windows\Temp\{0720FB24-83FB-40FF-B361-161CD7540DC8}\.ba\wixstdba.dll
Size 190KB
SHA256 dcea15f3710822ffc262e62ec04cc7bbbf0f33f5d1a853609fbfb65cb6a45640
MD5 f1919c6bd85d7a78a70c228a5b227fbe
SHA1 71647ebf4e7bed3bc1663d520419ac550fe630ff
SHA512 c7ff9b19c9bf320454a240c6abbc382950176a6befce05ea73150eeb0085d0b6ed5b65b2dcb4b04621ef9cca1d5c4e59c6682b9c85d1d5845e5ce3e5eedfd2eb
SSDEEP 3072:sjEoXsLW9OLG8Qp51ySdjDXY33b+Av7O5IkI+/AYkPAEc527uu3k/gLtxavf0ir2:sjEo8LW9553hXWy15I2YrAW7FUVEihs3
TLSH
T1FF14AF1176D0A07AEBFB16307A39A5216E7DBA200FA0C9DF63449D2B1D715C19B36B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet_host_9.0.19_win_x64.msi

Path C:\Windows\Temp\{0720FB24-83FB-40FF-B361-161CD7540DC8}\dotnet_host_9.0.19_win_x64.msi
Size 704KB
SHA256 0d81a9e820be226d2b15f8dc90e05b475871a5b0250a7d4a6d4083c88cd63b16
MD5 0368681ab717bb62e0906d84fe6e97f6
SHA1 26c3f93fc63167f8531081b169cfc980ef439e7e
SHA512 a016334e43c8aac45ed92fc1b2101d4276db0275550d20ebd835e1e43b40e0d18593c377086d27e7232d892b8326b7cc502f3daacda22b6d6833c87dca76dae6
SSDEEP 12288:KBiLV1EgXmEI3os2Qx7E4D4Rxbp4K+1uiqb:KBiLXdc3/7Rin+sj
TLSH
T152E49D137D80803AD9BA0D31853AD7B16F3DBD204A64899B6380B91DDDF15C0AF76BE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet_hostfxr_9.0.19_win_x64.msi

Path C:\Windows\Temp\{0720FB24-83FB-40FF-B361-161CD7540DC8}\dotnet_hostfxr_9.0.19_win_x64.msi
Size 776KB
SHA256 abf0fb7ef359426b67121e4c2b8bb4674ea791623bca73baccabaed390d89d9f
MD5 d211fbd50bc22ef313880510d7f88179
SHA1 3abc891ffc635b7dc5fc96e9baf559d238f5b2d2
SHA512 f314eb999541ed2a86e057411d140ca26e4705ed3c9481f077db9fe305f32ec3731b32bfe2cdcc059689b4bf3cbf2933e7f6ba38e8edc2c597140e10be8513b2
SSDEEP 12288:vwr8yrpGw29DV1EgXmEI3os2Qx7E4D4Rxbp4K+1uiq:vqrpOJXdc3/7Rin+s
TLSH
T132F4AD137D80903AD9BA0D719539D7B16F3DBE208A64889B5380B91DDDF11C0AF76BE2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet_runtime_9.0.19_win_x64.msi

Path C:\Windows\Temp\{0720FB24-83FB-40FF-B361-161CD7540DC8}\dotnet_runtime_9.0.19_win_x64.msi
Size 27.4MB
SHA256 6cdb76b8df3e2e119a6895dfc6fcc0f0d895f268bc4435f6b6ee3c294060af09
MD5 937c53d23701feb18ef5f7fafe2eee6d
SHA1 1aa155c421045d72a03551fd8f6667a4e9d9bd33
SHA512 19c1a9d2f592873cb2659024340e877ce0b764b94711cdf0b3280fe76473764d7e6916d099372524a2a640a061a314bb242344f39197194f4361cc90e30b60f7
SSDEEP 786432:I0lTuzwaHTJkMwXUoZV3KleHhUGSU7+Jnx:MzF1kMwXnZV6gHVSAAnx
TLSH
T1D6573323BE969839C4390D7215BE73611F3DAD285761C9CB57103828EDF65E09BF2AC2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windowsdesktop_runtime_9.0.19_win_x64.msi

Path C:\Windows\Temp\{0720FB24-83FB-40FF-B361-161CD7540DC8}\windowsdesktop_runtime_9.0.19_win_x64.msi
Size 29.8MB
SHA256 8bed48caee2da4c4b2da97c937f189283ab84b964a48d05ec1ccfb44a42a26a3
MD5 1eafbc1cf9459ed37429ff67fee4262a
SHA1 ad410825d89b1e43d82a48d6763d403c64b78100
SHA512 bf55d974d53593a6f2ca30cf9f7da6c6c0f4ffeb7e3ab1dc49e19e3c8612d74131737683ba4ae4e9b79304ec23a27d59095298231cdbb9e4179a7ea28a8c8598
SSDEEP 786432:sEsegWkun91a6F/T/DWsezaLlT3H+eYzW3W0R:sbCnXp9P+aAfz4W0R
TLSH
T1916733173D939539D4AA0C36C57AEB30133E7D008F19881A92A0B91DDDF51F09EAEBD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{9BA1E11B-CF3E-4EC2-9368-111C127A1B9A}\.ba\1033\thm.wxl
Size 5KB
SHA256 81a68046b06e09385be8449373e7ceb9e79f7724c3cf11f0b18a4489a8d4926a
MD5 d5070cb3387a0a22b7046ae5ab53f371
SHA1 bc9da146a42bbf9496de059ac576869004702a97
SHA512 8fcf621fb9ce74725c3712e06e5b37b619145078491e828c6069e153359de3bd5486663b1fa6f3bcf1c994d5c556b9964ea1a1355100a634a6c700ef37d381e3
SSDEEP 96:MT0abTxmup/vrCKATQdYQHdYCwgoVOBq9LjP5dbSE7:OQNkdYQHdYCYXt7
TLSH
T1F1C1DBA778CF53C128731255EA925AAA5911C19C537F2DF4FC8B454B838A827A373F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windowsdesktop-runtime-9.0.19-win-x64.exe

Path C:\Windows\Temp\{DEEDE553-99B6-4D34-8E67-E0D57804B1CB}\.cr\windowsdesktop-runtime-9.0.19-win-x64.exe
Size 607KB
SHA256 21ee8ba010669a3814268926875d3565b7166ee62db8a41b9f717b111190f119
MD5 5887634f8042d630c771b773b1adf4c4
SHA1 05f24f02f5d10601b8749457052776dbbe640fde
SHA512 723b1cef6a79828ca170840dc68079d5298f9b33bd94def165c8b815f62ce2d59985cf2ffb2ce3f2060fa605f2702c049640a6486ec16d67a187f639b8a37e7d
SSDEEP 12288:tmEsd9PZfePv3xl7ft7V+6uC+zd5qLl8S3wBfiy7nlEM0DnmX:tm39PZfePv3r7fm6t+jqpB3ipzCM0c
TLSH
T1CED47D32A5614032E7F10673B928D6303E3CE328175488AAE7D4AD1D7EB88D667F7257
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.1MB
SHA256 47cacb926dabc4a4e5a3b5345104f42cdd0aa4e14d473787d16089d23e9e7073
MD5 34ea67850ecb40ba9086c7778695af48
SHA1 f756849c3aa38047cc4a260ed35698d035726939
SHA512 69ca9711a8afeb11d4bb7a85c859b381cfb640cf236272e9802ee493b4813efeb83f76f6a1c0e885e933da71a295ba999b0b45f7d062b9d59ab398482f210ed7
SSDEEP 24576:Ru8m+1zUdoO/vvTL7W6u/maObDkzylKSGM2NIFb1ykqredzHIvlzicRRv:O
TLSH
T18A47B22477F92210E7F79E3CA8F06A234D3A7D5B9C259E8D45411B4E0921FB0E872F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{267e0678-e62d-4e74-9f00-0d74d92a37f3}_OnDiskSnapshotProp

Path \??\Volume{0dfc9b49-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{267e0678-e62d-4e74-9f00-0d74d92a37f3}_OnDiskSnapshotProp
Size 6KB
SHA256 ad1fcf2cb2d7c0d61a6a1d02a0c38b7eab15c9c5f6a9b39e37e3b92f1d5c57ee
MD5 ed794cf9f63d61f9543c9832977a0ee0
SHA1 6ffed5afa307ead4cc5f02b877287dd4b0555173
SHA512 a4847a24fbe455bdbc103e82b09bceb18a5669b09dc028abd184b002caa9345044546cd8db412150c49e4646ce328ad2613e724f3b1b6fa19e8a2db7c4c01a5c
SSDEEP 96:FnyJLGPGtvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:tWGPGnb++ZVmN
TLSH
T119D189085AF54711E2B3AB7129F14557A877B911EF33CB8E0198638E6670A10F836F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download